@askexenow/exe-os 0.9.392 → 0.9.394

package/dist/build-manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 2,
-  "generated_at": "2026-09-23T21:11:44.524Z",
+  "generated_at": "2026-09-23T23:35:24.804Z",
   "files": [
     {
       "path": "active-agent-KMGOYJTP.js",
@@ -179,7 +179,7 @@
     },
     {
       "path": "bin/cli.js",
-      "sha256": "57b256c77dad69f65194abc99fe8b50ce2bfe8d48d211eec73e563c128036147",
+      "sha256": "407694f935b3d6c4613ca6c24229ac39e53d9022bf4bc62303bc4436920089f5",
       "bytes": 69792
     },
     {
@@ -524,7 +524,7 @@
     },
     {
       "path": "bin/registry-proxy.js",
-      "sha256": "3ee14439bf46ca5a72a2a72a6130b9248eabfdd670df0da054c0123c1e954054",
+      "sha256": "224728a8c04ed51bd21488f26c521f39776d6d5c67d40e6b05acfa30aaa47eb8",
       "bytes": 1885
     },
     {
@@ -549,8 +549,8 @@
     },
     {
       "path": "bin/stack-update.js",
-      "sha256": "ee70fb51e77796565a2d1864764e4865cf24a5671c9753fe73ac198517fdb7ed",
-      "bytes": 128550
+      "sha256": "39605342987fd37972f577aa1619e9fdc7aef0e339bc5188f820251392c45242",
+      "bytes": 131487
     },
     {
       "path": "bin/update.js",
@@ -569,7 +569,7 @@
     },
     {
       "path": "bin/vps-health-gate.js",
-      "sha256": "17c6d47cae46484f15223cfd9cd9e5b07db13506c0579bf932aff4eed897e252",
+      "sha256": "386e8e34d613c6ed0511ff3380532e9bc24176de7c6a955770134c6a29853940",
       "bytes": 333
     },
     {
@@ -672,11 +672,6 @@
       "sha256": "0649a4d1eb38a53ced9d539731618da75464e0e191ebcc39b03aa2871071c2d4",
       "bytes": 442
     },
-    {
-      "path": "chunk-33CHRORT.js",
-      "sha256": "0f7fbaa13b4c7522f0b14a45b48ce2dfc004790e2577760afb9bb370e69ff90f",
-      "bytes": 7587
-    },
     {
       "path": "chunk-37IIJJZ7.js",
       "sha256": "f7f9ea3373fb44a010f78ef8852bd264f8d67bea44c3ae9abc1d84c7d2771513",
@@ -717,11 +712,6 @@
       "sha256": "46303e5db720a3f0b9ed8ecab75b9c6ea3c4a644f3805c6ae465e2fb9bd23fef",
       "bytes": 5705
     },
-    {
-      "path": "chunk-3SXU7KLW.js",
-      "sha256": "9df2f153a553b1270f7a9011d4f081732ea89b9ac2b042cb149b14f4ed44da22",
-      "bytes": 252039
-    },
     {
       "path": "chunk-3VW5ZP2F.js",
       "sha256": "9eb8516063b9279b0556d589f9d7e3024b554ed2cf60cc84a58c32a193e85744",
@@ -792,6 +782,11 @@
       "sha256": "c2e2367cffa3e57666f0307f2374f6ca8cbf2f07ba45b7361d680e8271be90ec",
       "bytes": 3297
     },
+    {
+      "path": "chunk-5OWHYOIF.js",
+      "sha256": "7321323a90b487e2f95b3f6c6dd72a177e546aa7aace189d3f725f879fa560c5",
+      "bytes": 7587
+    },
     {
       "path": "chunk-5V7BD7Z4.js",
       "sha256": "ca37d6e8b8481a988ed41264e604ce992de1d8d63fff23e07b3d2367cba5af21",
@@ -1102,6 +1097,11 @@
       "sha256": "cf3ce4cf6c9cdba17a8a5e3d9f0c78ae42f1cb72f1a06608cc8da1fb27f06a76",
       "bytes": 3292
     },
+    {
+      "path": "chunk-DYFTZWG2.js",
+      "sha256": "72d0060a08f4996dfe65b4fe9718b00fc053f2bfd2747d176f7a4539954ec4fc",
+      "bytes": 261313
+    },
     {
       "path": "chunk-E23LNUWJ.js",
       "sha256": "6d692be7ac73bf481e7013c4b948b70acd8282234f645d562457754afaa7a02e",
@@ -1663,9 +1663,9 @@
       "bytes": 3317
     },
     {
-      "path": "chunk-PRCJG3PK.js",
-      "sha256": "cd4c509a50c7fa4c72cb7a1d62c216f49024b671c65c8b032d4ef664b7da49e7",
-      "bytes": 40844
+      "path": "chunk-PS77SULS.js",
+      "sha256": "6c337e635c575f47a50c8587d2bfa2fcdd0ebfdf43a967f38170ce684ff63dbb",
+      "bytes": 3766
     },
     {
       "path": "chunk-PYS43F2X.js",
@@ -1762,6 +1762,11 @@
       "sha256": "627baf16bbe786e186075ad51849ac4460738fb2e185216bddefca23d2ae55b2",
       "bytes": 11048
     },
+    {
+      "path": "chunk-RLUDQYOA.js",
+      "sha256": "5e1fb642dcb8ed9d6fdb95fae00346afafff51fddd4b60d2b11c1c878d7b1c3b",
+      "bytes": 40844
+    },
     {
       "path": "chunk-RT57D7C4.js",
       "sha256": "054f2262b18d6c727b18c7bc34491d1d30f20d4d8fb42eb21704ac9c190e5477",
@@ -1862,11 +1867,6 @@
       "sha256": "56262268c24e15325112a9d2d1dd785dea9fe96ac44e0c14ff243edd1fbd7e04",
       "bytes": 76651
     },
-    {
-      "path": "chunk-TVSIS36M.js",
-      "sha256": "c12d360e3677fc87730097aab294f995d40c3bb8daf837fbe1856f258cc2a742",
-      "bytes": 3766
-    },
     {
       "path": "chunk-TWMWHDOY.js",
       "sha256": "d1a4b120060e1bda1c09919ff863fbb281c71f017d89b31f47e8df07587814c0",
@@ -2574,7 +2574,7 @@
     },
     {
       "path": "hooks/manifest.json",
-      "sha256": "ba4ff8f10ee0055e5a4c3ea79bc8ea9c7f0154d0d7b53cdac2a7f72e901cdd03",
+      "sha256": "4140c8729b945f17c2a19a259a8aa0a1e3f753237a95e005be4362d4fb90cc4f",
       "bytes": 1841
     },
     {
@@ -2879,7 +2879,7 @@
     },
     {
       "path": "lib/registry-proxy.js",
-      "sha256": "6b15ba1cbdc4ee922891ad866daf9cc80cce74e01ccbc924e75960a52da8f9c0",
+      "sha256": "94c2d851ff177536c9e0def91d5d55c740005ae6c96b9ee4b9543852a470d25f",
       "bytes": 749
     },
     {
@@ -3463,8 +3463,8 @@
       "bytes": 111
     },
     {
-      "path": "stack-generate-manifest-QWU7Q4MJ.js",
-      "sha256": "24720f91471c9be72ceb98ad60530cc267b389b7f6124cddb84070be1a7367b0",
+      "path": "stack-generate-manifest-H6LJQ2HV.js",
+      "sha256": "d790293379cf08251382c3076496f39824ddb800e345e24ef00fff1d21e36335",
       "bytes": 56960
     },
     {
@@ -3473,18 +3473,18 @@
       "bytes": 4761
     },
     {
-      "path": "stack-promote-26RFMNSB.js",
-      "sha256": "74b8353d0871bb8fd1b64c449498920d8ecfbe623ad76f65fdec038de34575de",
+      "path": "stack-promote-4EF7RNIV.js",
+      "sha256": "d9db50f30a0a97cbe56b4e566be8e9c1327d9ecb5c96a6a46967bf57ea76f8a9",
       "bytes": 7425
     },
     {
-      "path": "stack-release-7YHSLY7J.js",
-      "sha256": "27806d515012b3af2d4c85f87f6dfd439ba46e01dac917cbf95e60cf0fcece2c",
+      "path": "stack-release-YCNRPK6R.js",
+      "sha256": "bd26b47386fa7849325c313b30e2eb0ee8f0ba77ea8dcaf95256fb0241a824bd",
       "bytes": 117550
     },
     {
-      "path": "stack-update-DTMW7GMW.js",
-      "sha256": "d05d7f8051ba0503d7ffa650eb5d85b08e841d94c08263c07eea5b0874770d99",
+      "path": "stack-update-2F464W3N.js",
+      "sha256": "8be2553c248e2067f8f4a0a0f342513af5080b88b79ce9b22ce07cf7a73bf5ce",
       "bytes": 7863
     },
     {

package/dist/{chunk-33CHRORT.js → chunk-5OWHYOIF.js}

@@ -212,7 +212,7 @@ async function main(args) {
   console.log("[health-gate] Starting rollback...");
   restorePreDeployBackup();
   try {
-    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-DTMW7GMW.js");
+    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-2F464W3N.js");
     const paths = defaultStackPaths();
     await rollbackStackUpdate({
       manifestRef: paths.manifestRef,

package/dist/{chunk-3SXU7KLW.js → chunk-DYFTZWG2.js}

@@ -120,6 +120,163 @@ ${remedy}
   return gaps;
 }
 
+// src/lib/retained-compose-health.ts
+function parseRecords(raw) {
+  if (raw === null || !raw.trim())
+    throw new Error("--retain-compose health state unavailable");
+  const trimmed = raw.trim().replace(/^\ufeff/, "");
+  let records;
+  try {
+    const parsed = JSON.parse(trimmed);
+    records = Array.isArray(parsed) ? parsed : [parsed];
+  } catch {
+    try {
+      records = trimmed.split("\n").filter(Boolean).map((line) => JSON.parse(line));
+    } catch {
+      throw new Error("--retain-compose health state could not be parsed");
+    }
+  }
+  if (records.length === 0 || records.some(
+    (record) => !record || typeof record !== "object" || Array.isArray(record)
+  )) {
+    throw new Error(
+      "--retain-compose health state contains no usable containers"
+    );
+  }
+  return records;
+}
+function parseRetainedContainerHealth(raw) {
+  const containers = /* @__PURE__ */ new Map();
+  for (const record of parseRecords(raw)) {
+    const service = String(record.Service ?? "").trim();
+    if (!service || containers.has(service))
+      throw new Error(
+        "--retain-compose health state has missing or duplicate service names"
+      );
+    containers.set(service, {
+      service,
+      id: String(record.ID ?? "").trim(),
+      state: String(record.State ?? "").trim().toLowerCase(),
+      health: String(record.Health ?? "").trim().toLowerCase(),
+      restartCount: record.RestartCount === void 0 || record.RestartCount === null ? null : Number(record.RestartCount),
+      exitCode: record.ExitCode === void 0 || record.ExitCode === null || String(record.ExitCode).trim() === "" ? null : Number.isInteger(Number(record.ExitCode)) ? Number(record.ExitCode) : null
+    });
+  }
+  return containers;
+}
+function parseRenderedServices(renderedCompose) {
+  let services;
+  try {
+    const parsed = JSON.parse(renderedCompose ?? "");
+    if (!parsed.services || typeof parsed.services !== "object" || Array.isArray(parsed.services))
+      throw new Error();
+    services = parsed.services;
+  } catch {
+    throw new Error("--retain-compose rendered dependency graph unavailable");
+  }
+  return services;
+}
+function retainedCriticalServices(renderedCompose, selectedService, requiredCore, selectedCompanions = []) {
+  const services = parseRenderedServices(renderedCompose);
+  const critical = /* @__PURE__ */ new Set();
+  const visit = (service) => {
+    if (!services[service])
+      throw new Error(
+        `--retain-compose required service ${service} absent from rendered Compose`
+      );
+    if (critical.has(service)) return;
+    critical.add(service);
+    const deps = services[service].depends_on;
+    if (deps !== void 0 && !Array.isArray(deps) && (typeof deps !== "object" || deps === null)) {
+      throw new Error(
+        `--retain-compose dependencies for ${service} could not be parsed`
+      );
+    }
+    const names = Array.isArray(deps) ? deps : Object.keys(deps ?? {});
+    for (const name of names) {
+      if (typeof name !== "string")
+        throw new Error(
+          `--retain-compose dependencies for ${service} could not be parsed`
+        );
+      visit(name);
+    }
+  };
+  visit(selectedService);
+  for (const service of selectedCompanions) visit(service);
+  for (const service of requiredCore) visit(service);
+  return critical;
+}
+function retainedCompletedDependencies(renderedCompose, critical, selectedService, requiredCore, selectedCompanions = []) {
+  const services = parseRenderedServices(renderedCompose);
+  const inbound = /* @__PURE__ */ new Map();
+  for (const parent of critical) {
+    const dependencies = services[parent]?.depends_on;
+    if (!dependencies) continue;
+    const entries = Array.isArray(dependencies) ? dependencies.map((name) => [
+      String(name),
+      { condition: "service_started" }
+    ]) : Object.entries(dependencies);
+    for (const [name, value] of entries) {
+      if (!critical.has(name)) continue;
+      const condition = value && typeof value === "object" ? String(
+        value.condition ?? "service_started"
+      ) : "service_started";
+      inbound.set(name, [...inbound.get(name) ?? [], condition]);
+    }
+  }
+  const roots = /* @__PURE__ */ new Set([selectedService, ...selectedCompanions, ...requiredCore]);
+  return new Set(
+    [...inbound].filter(
+      ([name, conditions]) => !roots.has(name) && // Compose's omitted restart policy is "no". An explicit policy
+      // that restarts the job is not a completed one-shot dependency.
+      (services[name]?.restart === void 0 || services[name]?.restart === "no") && conditions.length > 0 && conditions.every(
+        (condition) => condition === "service_completed_successfully"
+      )
+    ).map(([name]) => name)
+  );
+}
+function retainedContainerIsHealthy(container, completedDependency = false) {
+  return !!container && !!container.id && (completedDependency ? container.state === "exited" && container.exitCode === 0 : container.state === "running" && (container.health === "" || container.health === "healthy")) && (container.restartCount === null || Number.isFinite(container.restartCount) && container.restartCount <= 2);
+}
+function assessRetainedHealthBefore(witness) {
+  const failures = [];
+  for (const service of witness.critical) {
+    if (!retainedContainerIsHealthy(
+      witness.containers.get(service),
+      witness.completedDependencies?.has(service)
+    ))
+      failures.push(service);
+  }
+  for (const [service, container] of witness.containers) {
+    if (!witness.critical.has(service) && !retainedContainerIsHealthy(container) && !container.id) {
+      failures.push(`${service} (unhealthy container identity unavailable)`);
+    }
+  }
+  return failures;
+}
+function assessRetainedHealthAfter(before, after) {
+  const failures = [];
+  for (const service of before.critical) {
+    if (!retainedContainerIsHealthy(
+      after.get(service),
+      before.completedDependencies?.has(service)
+    ))
+      failures.push(service);
+  }
+  for (const [service, current] of after) {
+    if (before.critical.has(service) || retainedContainerIsHealthy(current))
+      continue;
+    const prior = before.containers.get(service);
+    if (!prior || retainedContainerIsHealthy(prior) || !prior.id || prior.id !== current.id || prior.state !== current.state || prior.health !== current.health || prior.restartCount !== current.restartCount) {
+      failures.push(service);
+    }
+  }
+  for (const service of before.containers.keys()) {
+    if (!after.has(service)) failures.push(`${service} (disappeared)`);
+  }
+  return [...new Set(failures)];
+}
+
 // src/lib/stack-lock-derive.ts
 import { spawnSync } from "child_process";
 var GIT_SHA_LABEL = "org.exe.git_sha";
@@ -2320,8 +2477,9 @@ function assertRetainedComposePlan(input, plan, liveComposeRaw, envRaw, processE
   if (service.migrations || plan.release.migrations) {
     throw new Error("--retain-compose cannot run service or release migrations");
   }
-  if (expandComposeServicesWithSidecars([service.composeService ?? name]).length !== 1) {
-    throw new Error("--retain-compose requires a service with no companion sidecars");
+  const composeServices = expandComposeServicesWithSidecars([service.composeService ?? name]);
+  if (composeServices.length > 1 && !(name === "crm" && composeServices.length === 2 && composeServices[0] === "exe-crm" && composeServices[1] === "exe-crm-worker")) {
+    throw new Error("--retain-compose requires a service with no unsupported companion sidecars");
   }
   if (!service.env || plan.changes.length !== 1 || plan.changes[0].service !== name || plan.changes[0].key !== service.env) {
     throw new Error("--retain-compose requires exactly one selected image-pin change");
@@ -2342,16 +2500,17 @@ function assertRetainedComposePlan(input, plan, liveComposeRaw, envRaw, processE
   } else if (config.composeOverrideSha256) {
     throw new Error("--retain-compose refused: signed compose override is absent from the live stack");
   }
-  const imageExpression = liveOverrideRaw === null ? parseComposeServiceImages(liveComposeRaw).get(service.composeService ?? name) : parseComposeServiceImages(liveOverrideRaw).get(service.composeService ?? name) ?? parseComposeServiceImages(liveComposeRaw).get(service.composeService ?? name);
-  if (!imageExpression || !envRefsInImageExpression(imageExpression).includes(service.env)) {
-    throw new Error("--retain-compose refused: selected service compose image does not use its signed image pin");
-  }
-  const plannedImage = resolveComposeImageExpression(
-    imageExpression,
-    parseEnv(patchEnv(envRaw, { [service.env]: plan.changes[0].after }))
-  );
-  if (plannedImage !== plan.changes[0].after) {
-    throw new Error("--retain-compose refused: rendered selected service image differs from signed image pin");
+  const baseImages = parseComposeServiceImages(liveComposeRaw);
+  const overrideImages = liveOverrideRaw === null ? /* @__PURE__ */ new Map() : parseComposeServiceImages(liveOverrideRaw);
+  const plannedEnv = parseEnv(patchEnv(envRaw, { [service.env]: plan.changes[0].after }));
+  for (const composeService of composeServices) {
+    const imageExpression = overrideImages.get(composeService) ?? baseImages.get(composeService);
+    if (!imageExpression || !envRefsInImageExpression(imageExpression).includes(service.env)) {
+      throw new Error(`--retain-compose refused: selected service ${composeService} compose image does not use its signed image pin`);
+    }
+    if (resolveComposeImageExpression(imageExpression, plannedEnv) !== plan.changes[0].after) {
+      throw new Error(`--retain-compose refused: rendered selected service ${composeService} image differs from signed image pin`);
+    }
   }
   const env = parseEnv(envRaw);
   const monitorKey = env.get("EXE_MONITOR_KEY") ?? "";
@@ -3791,18 +3950,20 @@ ${lines.join("\n")}`
     if (options.retainCompose) {
       const [name, service] = Object.entries(plan.release.services)[0];
       const composeArgs2 = composeArgsForStack(options.composeFile, options.envFile);
-      assertRetainedComposeRunningService(
-        composeArgs2,
-        service.composeService ?? name,
-        options.composePsCapture ?? defaultComposePsCapture
-      );
-      assertRetainedComposeRenderedImage(
-        composeArgs2,
-        service.composeService ?? name,
-        service.env,
-        plan.changes[0].after,
-        options.composeConfigCapture ?? defaultComposeConfigCapture
-      );
+      for (const target of expandComposeServicesWithSidecars([service.composeService ?? name])) {
+        assertRetainedComposeRunningService(
+          composeArgs2,
+          target,
+          options.composePsCapture ?? defaultComposePsCapture
+        );
+        assertRetainedComposeRenderedImage(
+          composeArgs2,
+          target,
+          service.env,
+          plan.changes[0].after,
+          options.composeConfigCapture ?? defaultComposeConfigCapture
+        );
+      }
     }
     const hostState = listHostComposeServices(
       composeArgsForStack(options.composeFile, options.envFile),
@@ -3953,6 +4114,25 @@ ${lines.join("\n")}`
     options.preDeployBackup(plan.targetVersion);
   } catch {
   }
+  let retainedHealthBaseline;
+  if (options.retainCompose) {
+    const [selectedName, selectedEntry] = Object.entries(plan.release.services)[0];
+    const selected = selectedEntry.composeService ?? selectedName;
+    const selectedCompanions = expandComposeServicesWithSidecars([selected]).slice(1);
+    const requiredCore = Object.entries(targetRelease.services).filter(([, service]) => service.required === true && service.category === "core").map(([name, service]) => service.composeService ?? name);
+    const args = composeArgsForStack(options.composeFile, options.envFile);
+    const rendered = (options.composeConfigCapture ?? defaultComposeConfigCapture)(args, process.env);
+    const critical = retainedCriticalServices(rendered, selected, requiredCore, selectedCompanions);
+    const completedDependencies = retainedCompletedDependencies(rendered, critical, selected, requiredCore, selectedCompanions);
+    const rawHealth = (options.composePsCapture ?? defaultComposePsCapture)(args);
+    retainedHealthBaseline = { critical, completedDependencies, containers: parseRetainedContainerHealth(rawHealth) };
+    const failures = assessRetainedHealthBefore(retainedHealthBaseline);
+    if (failures.length > 0) throw new Error(`--retain-compose health gate failed before update: ${failures.join(", ")}`);
+    const preexisting = [...retainedHealthBaseline.containers.values()].filter((container) => !critical.has(container.service) && (container.state !== "running" || container.health === "unhealthy" || container.restartCount !== null && container.restartCount > 2));
+    for (const container of preexisting) {
+      console.warn(`[stack-update] Pre-existing unrelated unhealthy container (unchanged identity required): ${container.service}`);
+    }
+  }
   const stackDir = path.dirname(options.envFile);
   const configBackup = preBootstrapBackup ?? backupStackConfig(stackDir, options.composeFile, envRaw, now);
   const updateBackupDir = configBackup.updateBackupDir;
@@ -4296,7 +4476,7 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
     for (const service of restartOrder) {
       restartIndex++;
       const endRestart = startPhase(`restart ${service}`);
-      const manifestServiceName = Object.entries(plan.release.services).find(([name, svc]) => (svc.composeService ?? name) === service)?.[0] ?? service;
+      const manifestServiceName = resolveOwningManifestService(service, plan.release.services);
       if (bundledIsolation && (failedComposeServices.has(service) || failedManifestServices.has(resolveOwningManifestService(service, plan.release.services)))) {
         continue;
       }
@@ -4310,12 +4490,13 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
         continue;
       }
       if (options.retainCompose) {
+        const owner = plan.release.services[manifestServiceName];
         assertRetainedComposeFilesUnchanged(options.composeFile, composeRaw, retainedOverrideHash);
         assertRetainedComposeRunningService(composeArgs, service, options.composePsCapture ?? defaultComposePsCapture);
         assertRetainedComposeRenderedImage(
           composeArgs,
           service,
-          plan.release.services[manifestServiceName].env,
+          owner.env,
           plan.changes[0].after,
           options.composeConfigCapture ?? defaultComposeConfigCapture
         );
@@ -4426,6 +4607,15 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
         endPhase3();
       }
     }
+    if (retainedHealthBaseline) {
+      const after = parseRetainedContainerHealth(
+        (options.composePsCapture ?? defaultComposePsCapture)(composeArgs)
+      );
+      const regressions = assessRetainedHealthAfter(retainedHealthBaseline, after);
+      if (regressions.length > 0) {
+        throw new Error(`--retain-compose health regression after update: ${regressions.join(", ")}`);
+      }
+    }
     {
       const cfIngressConfigPath = path.join(path.dirname(options.composeFile), "cloudflared", "config.yml");
       const cfIngressConfigYml = existsSync(cfIngressConfigPath) ? readFileSync(cfIngressConfigPath, "utf8") : null;
@@ -4673,9 +4863,12 @@ Fix these before the stack is safe to operate.`);
         const composeService = service.composeService ?? name;
         try {
           syncImagePinsWithProcessEnv(envRaw, [service.env]);
-          exec("docker", [...composeArgs, "up", "-d", "--no-deps", composeService]);
-          console.error(`[stack-update] Scoped fallback restored ${composeService} after rollback error: ${rbReason}`);
-          rollbackDetail += `; scoped fallback restored ${composeService}`;
+          const restored = expandComposeServicesWithSidecars([composeService]);
+          for (const target of restored) {
+            exec("docker", [...composeArgs, "up", "-d", "--no-deps", target]);
+          }
+          console.error(`[stack-update] Scoped fallback restored ${restored.join(", ")} after rollback error: ${rbReason}`);
+          rollbackDetail += `; scoped fallback restored ${restored.join(", ")}`;
         } catch (scopedError) {
           console.error(`[stack-update] Scoped fallback failed for ${composeService}: ${errorMessage(scopedError)}`);
           rollbackDetail += `; scoped fallback failed for ${composeService}: ${errorMessage(scopedError)}`;
@@ -5484,6 +5677,11 @@ function loadDefaultPublicKey() {
 }
 
 export {
+  parseRetainedContainerHealth,
+  retainedCriticalServices,
+  retainedCompletedDependencies,
+  retainedContainerIsHealthy,
+  assessRetainedHealthBefore,
   resolveServiceHealthTimeout,
   serviceSelectionPath,
   loadServiceSelection,

package/dist/{chunk-TVSIS36M.js → chunk-PS77SULS.js}

@@ -1,6 +1,6 @@
 import {
   canonicalizeStackManifest
-} from "./chunk-3SXU7KLW.js";
+} from "./chunk-DYFTZWG2.js";
 
 // src/lib/stack-manifest-write.ts
 import { readFileSync, statSync, writeFileSync } from "fs";

package/dist/{chunk-PRCJG3PK.js → chunk-RLUDQYOA.js}

@@ -138,7 +138,7 @@ async function assertManifestSignature(manifest, publicKeyPem) {
       "manifest carries no `signature`. Fleets that enforce EXE_STACK_PUBLIC_KEY reject unsigned manifests, so publishing one would ship a release no host can install. Re-sign with the custodied key: node scripts/sign-stack-manifest.mjs deploy/stack-manifests/v0.9.json"
     );
   }
-  const { verifyStackManifestSignature } = await import("./stack-update-DTMW7GMW.js");
+  const { verifyStackManifestSignature } = await import("./stack-update-2F464W3N.js");
   try {
     verifyStackManifestSignature(manifest, publicKeyPem);
   } catch (err) {

package/dist/hooks/manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "generatedAt": "2026-09-23T21:11:44.253Z",
+  "generatedAt": "2026-09-23T23:35:24.596Z",
   "hashes": {
     "bug-report-worker.js": "7c5f5951fe30192e374d9047c3a7f2975a879a5951457aafea5db95d5d6be6af",
     "codex-stop-task-finalizer.js": "f963449525e068ebf3f04a2950adf21464de71774b60165a84d69621a5eca30a",

package/dist/lib/registry-proxy.js

@@ -11,7 +11,7 @@ import {
   resolveRegistryProxyBuildIdentity,
   resolveStackManifestChannel,
   runRegistryProxy
-} from "../chunk-PRCJG3PK.js";
+} from "../chunk-RLUDQYOA.js";
 import "../chunk-MLKGABMK.js";
 export {
   SERVED_VERSION_PATH,

package/dist/{stack-generate-manifest-QWU7Q4MJ.js → stack-generate-manifest-H6LJQ2HV.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-TVSIS36M.js";
-import "./chunk-3SXU7KLW.js";
+} from "./chunk-PS77SULS.js";
+import "./chunk-DYFTZWG2.js";
 import "./chunk-EC5H53YD.js";
 import "./chunk-YYRI2AGK.js";
 import "./chunk-L25OAFOU.js";

package/dist/{stack-promote-26RFMNSB.js → stack-promote-4EF7RNIV.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-TVSIS36M.js";
-import "./chunk-3SXU7KLW.js";
+} from "./chunk-PS77SULS.js";
+import "./chunk-DYFTZWG2.js";
 import "./chunk-EC5H53YD.js";
 import "./chunk-YYRI2AGK.js";
 import "./chunk-L25OAFOU.js";

package/dist/{stack-release-7YHSLY7J.js → stack-release-YCNRPK6R.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-TVSIS36M.js";
-import "./chunk-3SXU7KLW.js";
+} from "./chunk-PS77SULS.js";
+import "./chunk-DYFTZWG2.js";
 import "./chunk-EC5H53YD.js";
 import {
   assertPreflightGate,
@@ -2028,7 +2028,7 @@ async function warmProxyCache(imageRef) {
 async function resolveImageGitShaLabel(ref, dryRun) {
   if (!ref || dryRun) return void 0;
   try {
-    const { readProvenanceLabels } = await import("./stack-generate-manifest-QWU7Q4MJ.js");
+    const { readProvenanceLabels } = await import("./stack-generate-manifest-H6LJQ2HV.js");
     const labels = await readProvenanceLabels(ref);
     return labels["org.exe.git_sha"] ?? labels["org.opencontainers.image.revision"];
   } catch (err) {

package/dist/{stack-update-DTMW7GMW.js → stack-update-2F464W3N.js}

@@ -132,7 +132,7 @@ import {
   waitForHttpOk,
   warnUnmanagedManifestServices,
   withStackUpdateOperationLock
-} from "./chunk-3SXU7KLW.js";
+} from "./chunk-DYFTZWG2.js";
 import "./chunk-EC5H53YD.js";
 import "./chunk-YYRI2AGK.js";
 import "./chunk-L25OAFOU.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.392",
+  "version": "0.9.394",
   "description": "AI employee operating system \u2014 persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",