@askexenow/exe-os 0.9.396 → 0.9.397

package/dist/{chunk-G3KSUXEA.js → chunk-F63FRP7L.js}

@@ -22,7 +22,7 @@ import {
 import {
   getCachedMonitorIdentity,
   recomputeEnvelopeWrapKey
-} from "./chunk-I4DBM5ME.js";
+} from "./chunk-F6OV7JP2.js";
 
 // src/lib/crypto.ts
 import crypto from "crypto";

package/dist/{chunk-I4DBM5ME.js → chunk-F6OV7JP2.js}

@@ -1,6 +1,6 @@
 import {
   getMasterKey
-} from "./chunk-5AGOX2XD.js";
+} from "./chunk-O22YLZXQ.js";
 
 // src/lib/monitor-identity.ts
 import crypto from "crypto";

package/dist/{chunk-7WDLUCHN.js → chunk-FQMLNMUZ.js}

@@ -1,15 +1,15 @@
 import {
   getActiveAgent
-} from "./chunk-RPOIKNJZ.js";
+} from "./chunk-C44UWID5.js";
 import {
   listTasks
-} from "./chunk-V4RIHICU.js";
+} from "./chunk-Y2DTTZCV.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
 import {
   isCoordinatorName
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-GAUMGWSQ.js";
 
 // src/mcp/tools/list-tasks.ts
 import { z } from "zod";

package/dist/{chunk-QQJI7JGN.js → chunk-FZPJBU3F.js}

@@ -1,18 +1,18 @@
 import {
   updateTask
-} from "./chunk-L2AUCHHJ.js";
+} from "./chunk-7KMFHVKB.js";
 import {
   TASK_ALREADY_CLAIMED_PREFIX,
   TASK_CLAIM_NOT_HELD_PREFIX,
   TASK_PR_TRACEABILITY_REQUIRED_PREFIX,
   TASK_SIDECHAIN_WRITE_BLOCKED_PREFIX
-} from "./chunk-V4RIHICU.js";
+} from "./chunk-Y2DTTZCV.js";
 import {
   getAgentContext
 } from "./chunk-GJV3WDWM.js";
 import {
   isCoordinatorName
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-GAUMGWSQ.js";
 
 // src/mcp/tools/update-task.ts
 import { z } from "zod";
@@ -75,7 +75,7 @@ function registerUpdateTask(server) {
       let callerSession;
       let callerIsSidechain = false;
       try {
-        const { getActiveAgent: getAgent } = await import("./active-agent-7OKWCTDR.js");
+        const { getActiveAgent: getAgent } = await import("./active-agent-GOCTWSHD.js");
         const active = getAgent();
         callerAgentId = active.agentId;
         callerSession = resolveCallerSessionForUpdate();

package/dist/{chunk-DXQIIZQC.js → chunk-GAUMGWSQ.js}

@@ -4,20 +4,20 @@ import {
 import {
   assertValidDbPath
 } from "./chunk-TKDITWDN.js";
+import {
+  listBackups,
+  preBackupCheckpoint
+} from "./chunk-DQQTUIQJ.js";
 import {
   MEMORY_PROJECTION_OUTBOX_INDEX_SQL,
   MEMORY_PROJECTION_OUTBOX_TABLE_SQL,
   MEMORY_PROJECTION_OUTBOX_UNIQUE_INDEX_SQL,
   PROJECTION_CHECKPOINT_TABLE_SQL,
   ensureMemoryWriteIndex
-} from "./chunk-EHDAWQ5P.js";
+} from "./chunk-JO7ZJTFL.js";
 import {
   recordDbOpen
 } from "./chunk-5YEUPUV4.js";
-import {
-  listBackups,
-  preBackupCheckpoint
-} from "./chunk-BKKZN3DJ.js";
 import {
   isPostgresBackendEnabled
 } from "./chunk-YYB5PMTK.js";
@@ -1515,7 +1515,7 @@ async function migrateReflectionDedup(client) {
     "ALTER TABLE memory_reflections ADD COLUMN dedup_key TEXT",
     "migration add memory_reflections.dedup_key"
   );
-  const { reflectionDedupKey } = await import("./memory-reflection-VXFXG55L.js");
+  const { reflectionDedupKey } = await import("./memory-reflection-SU57VEBT.js");
   const keyForRow = (row) => {
     let sources = [];
     try {
@@ -2035,7 +2035,7 @@ async function _attemptBackupRestore(config) {
 `
       );
       try {
-        const { recordDbRestoreEvent } = await import("./db-restore-events-XYL6CGPC.js");
+        const { recordDbRestoreEvent } = await import("./db-restore-events-R5S7XTHX.js");
         recordDbRestoreEvent({
           kind: "auto-restore",
           restoredFrom: backup.name,
@@ -2078,7 +2078,7 @@ async function _attemptBackupRestore(config) {
 `
   );
   try {
-    const { recordDbRestoreEvent } = await import("./db-restore-events-XYL6CGPC.js");
+    const { recordDbRestoreEvent } = await import("./db-restore-events-R5S7XTHX.js");
     recordDbRestoreEvent({
       kind: "restore-failed",
       quarantinePath: corruptPath,
@@ -2337,7 +2337,7 @@ async function initDatabase(config) {
 `
         );
         try {
-          const { recordDbRestoreEvent } = await import("./db-restore-events-XYL6CGPC.js");
+          const { recordDbRestoreEvent } = await import("./db-restore-events-R5S7XTHX.js");
           recordDbRestoreEvent({
             kind: "wal-recovery",
             quarantinePath: backupPath,
@@ -2351,7 +2351,7 @@ async function initDatabase(config) {
 `
         );
         try {
-          const { recordDbRestoreEvent } = await import("./db-restore-events-XYL6CGPC.js");
+          const { recordDbRestoreEvent } = await import("./db-restore-events-R5S7XTHX.js");
           recordDbRestoreEvent({
             kind: "zeroed-no-wal",
             detail: "DB was 0 bytes at startup with no WAL available \u2014 data may be lost"
@@ -2573,7 +2573,7 @@ async function sweepExpiredSoftDeletedMemories(client, options = {}) {
   const purgeArchived = archDays !== void 0;
   const BATCH_SIZE = 2e3;
   const MAX_BATCHES = 500;
-  const { cleanupCardsForMemories, cleanupGraphLinksForMemories } = await import("./graph-rag-YZNY6Z3H.js");
+  const { cleanupCardsForMemories, cleanupGraphLinksForMemories } = await import("./graph-rag-DB5SXSJ6.js");
   const softCutoff = `-${softDays} days`;
   const selectArgsBase = [softCutoff];
   let predicate = `status = 'deleted' AND COALESCE(deleted_at, timestamp) < datetime('now', ?)`;
@@ -2959,7 +2959,7 @@ async function ensureSchema() {
     }
   }
   try {
-    const { checkAndRepairFtsIndexOnce } = await import("./fts-integrity-PHCKKOBC.js");
+    const { checkAndRepairFtsIndexOnce } = await import("./fts-integrity-PL7TKYTM.js");
     await checkAndRepairFtsIndexOnce(client);
   } catch (ftsErr) {
     process.stderr.write(

package/dist/{chunk-LEA7VKPU.js → chunk-GGSXOKK6.js}

@@ -4,18 +4,18 @@ import {
 } from "./chunk-NEHOQ3P2.js";
 import {
   isCrdtSyncEnabled
-} from "./chunk-DSZM7OHM.js";
+} from "./chunk-M65DE5CO.js";
 import {
   orgMembershipsPath,
   orgModeActive
-} from "./chunk-INLY2LLN.js";
+} from "./chunk-SDYIUXW7.js";
 import {
   activeRecipientPubKeys,
   grantsPath,
   isGrantsMacPrimed,
   primeGrantsMacKey,
   warnActiveMonitoringOnce
-} from "./chunk-7UCCSSJO.js";
+} from "./chunk-4MFPPHG4.js";
 import {
   assertGateAndGrantsColocated
 } from "./chunk-NPXIS2RY.js";
@@ -25,7 +25,7 @@ import {
 import {
   GHOST_BEHAVIOR_SQL,
   isGhostBehaviorRow
-} from "./chunk-LNCTMU7Y.js";
+} from "./chunk-HNVYH2WE.js";
 import {
   isTransientDaemonTransportError,
   retryOnDaemonTransportError
@@ -36,17 +36,17 @@ import {
   encryptSyncBlob,
   initSyncCrypto,
   isSyncCryptoInitialized
-} from "./chunk-G3KSUXEA.js";
+} from "./chunk-F63FRP7L.js";
 import {
   getClient,
   isGenuineCorruptionError,
   loadEmployees,
   registerBinSymlinks,
   saveEmployees
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-GAUMGWSQ.js";
 import {
   loadDeviceId
-} from "./chunk-6VMVQ3G7.js";
+} from "./chunk-GTW56AUB.js";
 import {
   EXE_AI_DIR
 } from "./chunk-MMS2HBRT.js";
@@ -72,7 +72,7 @@ var _lastSealOrgMode = null;
 async function getSyncCipher() {
   if (_resolved) return _resolved;
   if (!orgModeActive()) {
-    const mod = await import("./founder-monitor-envelope-RBSOSB6K.js");
+    const mod = await import("./founder-monitor-envelope-OYRYJZBS.js");
     _monitoredWriter = mod.encryptMonitoredSyncBlob;
     _founderModuleLinked = true;
   }
@@ -1283,7 +1283,7 @@ async function cloudSync(config, options) {
           })
         };
         if (shouldUseCrdtMergeForCloudSync()) {
-          const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-RPCGSGIE.js");
+          const { initCrdtDoc, importExistingMemories, readAllMemories } = await import("./crdt-sync-MHQ6XSMO.js");
           initCrdtDoc();
           importExistingMemories(
             pullResult.records.map((rec) => ({
@@ -1844,7 +1844,7 @@ async function cloudSync(config, options) {
     const artifactResult = { pushed: 0, frozen: false, remaining: 0 };
     if (!shouldSkip("artifacts")) {
       try {
-        const { flushArtifactBackups } = await import("./artifact-backup-Q7T3GQFO.js");
+        const { flushArtifactBackups } = await import("./artifact-backup-FDU7UQ5Z.js");
         const flushed = await flushArtifactBackups(cloudArtifactTransport(config));
         artifactResult.pushed = flushed.pushed;
         artifactResult.frozen = flushed.frozen;

package/dist/{chunk-6VMVQ3G7.js → chunk-GTW56AUB.js}

@@ -1,9 +1,9 @@
 import {
   PLAN_LIMITS
-} from "./chunk-A7XLR3K7.js";
+} from "./chunk-3R7UDPVR.js";
 import {
   getDeviceInfo
-} from "./chunk-PKPJ62VF.js";
+} from "./chunk-3JRVKBF2.js";
 import {
   EXE_AI_DIR
 } from "./chunk-MMS2HBRT.js";
@@ -44,6 +44,12 @@ oR8NJBuiITKaerulCXiSiJMX1HP0+h5dHBVfCWQfIVk5BMdsheAMaP806w==
 -----END PUBLIC KEY-----`;
 var LICENSE_PUBLIC_KEYS = [LICENSE_PUBLIC_KEY_PEM_2026_06_17, LICENSE_PUBLIC_KEY_PEM, LICENSE_PUBLIC_KEY_PEM_PREV];
 var LICENSE_JWT_ALG = "ES256";
+var MAX_OFFLINE_TRUST_DAYS = 7;
+function withinOfflineTrustWindow(payload, maxDays) {
+  const iat = payload?.iat;
+  if (typeof iat !== "number" || !Number.isFinite(iat)) return true;
+  return Date.now() < iat * 1e3 + maxDays * 24 * 60 * 60 * 1e3;
+}
 function suppliedNumber(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
@@ -55,6 +61,15 @@ function resolveClientLimits(plan, supplied) {
     memoryLimit: suppliedNumber(supplied?.memories) ?? fallback.memories
   };
 }
+function subscriptionEndClaim(payload) {
+  if (!payload) return null;
+  for (const name of ["license_expires_at", "subscription_ends_at", "subscriptionEndsAt", "sub_exp", "current_period_end"]) {
+    const raw = payload[name];
+    if (typeof raw === "string" && raw.trim()) return raw;
+    if (typeof raw === "number" && Number.isFinite(raw)) return new Date(raw * 1e3).toISOString();
+  }
+  return null;
+}
 function limitsClaim(payload) {
   const claim = payload?.limits;
   if (!claim || typeof claim !== "object") return null;
@@ -247,7 +262,12 @@ async function verifyLicenseJwt(token) {
         valid: true,
         plan,
         email,
-        expiresAt: payload.exp ? new Date(payload.exp * 1e3).toISOString() : null,
+        // Bug f855bcbe: `exp` is this TOKEN's lifetime, not the customer's
+        // subscription. Only a claim that actually means "the subscription ends
+        // then" may fill `expiresAt`; the token's own TTL is reported as what it
+        // is, and nothing renders it as an expiry date.
+        expiresAt: subscriptionEndClaim(payload),
+        proofExpiresAt: payload.exp ? new Date(payload.exp * 1e3).toISOString() : null,
         ...limits
       };
     } catch {
@@ -262,6 +282,7 @@ async function getCachedLicense(expectedKey) {
     const raw = JSON.parse(readFileSync(CACHE_PATH, "utf8"));
     if (!raw.token || typeof raw.token !== "string") return null;
     if (!cacheVouchesForKey(raw, expectedKey)) return null;
+    if (!withinOfflineTrustWindow(readTokenClaims(raw.token), MAX_OFFLINE_TRUST_DAYS)) return null;
     return await verifyLicenseJwt(raw.token);
   } catch {
     return null;
@@ -269,15 +290,14 @@ async function getCachedLicense(expectedKey) {
 }
 async function getGraceVerifiedLicense(graceDays = 7, expectedKey) {
   try {
-    if (expectedKey) {
-      const rawCache = readCacheFile();
-      if (!rawCache || !cacheVouchesForKey(rawCache, expectedKey)) return null;
-    }
+    const rawCache = readCacheFile();
+    if (!rawCache || !cacheVouchesForKey(rawCache, expectedKey)) return null;
     const token = readCachedLicenseToken();
     if (!token) return null;
     const payloadB64 = token.split(".")[1];
     if (!payloadB64) return null;
     const payload = JSON.parse(Buffer.from(payloadB64, "base64url").toString());
+    if (!withinOfflineTrustWindow(payload, graceDays)) return null;
     const expMs = (payload.exp ?? 0) * 1e3;
     if (Date.now() >= expMs + graceDays * 24 * 60 * 60 * 1e3) return null;
     let verified = null;
@@ -305,13 +325,23 @@ async function getGraceVerifiedLicense(graceDays = 7, expectedKey) {
       valid: true,
       plan,
       email: verified.sub ?? "",
-      expiresAt: verified.exp ? new Date(verified.exp * 1e3).toISOString() : null,
+      expiresAt: subscriptionEndClaim(verified),
+      proofExpiresAt: verified.exp ? new Date(verified.exp * 1e3).toISOString() : null,
       ...limits
     };
   } catch {
     return null;
   }
 }
+function readTokenClaims(token) {
+  try {
+    const payloadB64 = token.split(".")[1];
+    if (!payloadB64) return void 0;
+    return JSON.parse(Buffer.from(payloadB64, "base64url").toString());
+  } catch {
+    return void 0;
+  }
+}
 function readCacheFile() {
   try {
     if (!existsSync(CACHE_PATH)) return null;
@@ -336,9 +366,23 @@ function licenseKeyFingerprint(apiKey) {
   return createHash("sha256").update(apiKey.trim(), "utf8").digest("hex");
 }
 function cacheVouchesForKey(raw, expectedKey) {
-  if (!expectedKey) return true;
+  const bound = expectedKey ?? licenseKeyOnDisk();
   if (typeof raw.keyFp !== "string" || !raw.keyFp) return true;
-  return raw.keyFp === licenseKeyFingerprint(expectedKey);
+  if (!bound) return false;
+  return raw.keyFp === licenseKeyFingerprint(bound);
+}
+function licenseKeyOnDisk() {
+  const key = loadLicense();
+  if (key) return key;
+  try {
+    const configPath = path.join(EXE_AI_DIR, "config.json");
+    if (!existsSync(configPath)) return null;
+    const raw = JSON.parse(readFileSync(configPath, "utf8"));
+    const mirrored = raw.cloud?.apiKey;
+    return mirrored && mirrored.trim() ? mirrored.trim() : null;
+  } catch {
+    return null;
+  }
 }
 function cacheResponse(token, apiKey) {
   try {
@@ -835,7 +879,8 @@ async function maybeRefreshLicense(opts) {
 }
 function buildPlanChangeNotice(oldPlan, license) {
   const empLimit = license.employeeLimit === -1 ? "unlimited" : String(license.employeeLimit);
-  return `Plan changed: ${oldPlan} \u2192 ${license.plan}. Employee limit now ${empLimit} \u2014 you're upgraded, nothing else to do.`;
+  const seatShaped = license.employeeLimit === (PLAN_LIMITS.free?.employees ?? 1) && license.plan !== "free";
+  return `Plan changed: ${oldPlan} \u2192 ${license.plan}. ` + (seatShaped ? `Employee limit is ${empLimit} \u2014 that axis follows your OWN plan, not the organisation's. Memories, devices and backup follow the organisation's plan.` : `Employee limit now ${empLimit} \u2014 you're upgraded, nothing else to do.`);
 }
 function isFeatureAllowed(license, feature) {
   switch (feature) {
@@ -844,7 +889,7 @@ function isFeatureAllowed(license, feature) {
     case "wiki":
       return license.plan !== "free";
     case "unlimited_employees":
-      return license.plan === "team" || license.plan === "agency" || license.plan === "enterprise";
+      return license.employeeLimit === -1;
   }
 }
 function mirrorLicenseKey(apiKey) {

package/dist/{chunk-X5FCZYWK.js → chunk-GUZOREJ4.js}

@@ -4,10 +4,10 @@ import {
 } from "./chunk-IZWMWJZT.js";
 import {
   fastDbInit
-} from "./chunk-NRR6VAG2.js";
+} from "./chunk-X7VWZ4ZI.js";
 import {
   getClient
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-GAUMGWSQ.js";
 
 // src/lib/global-procedures.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-D2ZII4AG.js → chunk-GW67QP3K.js}

@@ -4,10 +4,10 @@ import {
 import {
   reserveVersions,
   vectorToBlob
-} from "./chunk-V4JWFJZR.js";
+} from "./chunk-P4C3BX2L.js";
 import {
   getClient
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-GAUMGWSQ.js";
 
 // src/lib/documents.ts
 import crypto from "crypto";
@@ -85,7 +85,7 @@ async function resolveWorkspace(slug_or_id, name, ownerAgentId) {
   }
   if (owner) {
     try {
-      const { grantWikiAccess } = await import("./wiki-acl-PKJLSR6U.js");
+      const { grantWikiAccess } = await import("./wiki-acl-CXFMQHKZ.js");
       await grantWikiAccess(owner, id, "admin", owner);
     } catch {
     }
@@ -111,7 +111,7 @@ async function resolveDefaultWorkspaceId(cwd) {
   const client = getClient();
   let projectName;
   try {
-    const { getProjectName } = await import("./project-name-5D6ZQNAY.js");
+    const { getProjectName } = await import("./project-name-2GN2XXVD.js");
     projectName = getProjectName(cwd);
   } catch {
     return null;
@@ -230,7 +230,7 @@ async function ingestDocument(input) {
   }
   let ingestingIdentity = null;
   try {
-    const { getActiveAgent } = await import("./active-agent-7OKWCTDR.js");
+    const { getActiveAgent } = await import("./active-agent-GOCTWSHD.js");
     ingestingIdentity = getActiveAgent().agentId || null;
   } catch {
   }
@@ -308,7 +308,7 @@ async function ingestDocument(input) {
   await client.batch([documentStmt, ...chunkStmts], "write");
   const embedded = vectors.filter((v) => v !== null).length;
   const originalTexts = input.chunks.map((c) => c.text);
-  import("./doc-graph-extractor-VVSMYOR3.js").then(
+  import("./doc-graph-extractor-KNX2SMZH.js").then(
     ({ extractAndStoreDocumentGraph }) => extractAndStoreDocumentGraph(documentId, originalTexts)
   ).catch((err) => {
     process.stderr.write(

package/dist/{chunk-LNCTMU7Y.js → chunk-HNVYH2WE.js}

@@ -4,14 +4,14 @@ import {
 } from "./chunk-W5BFPFVY.js";
 import {
   vectorToSqlLiteral
-} from "./chunk-V4JWFJZR.js";
+} from "./chunk-P4C3BX2L.js";
 import {
   blobToVector
 } from "./chunk-OTVEIJUQ.js";
 import {
   getClient,
   sanitizeBehaviorContent
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-GAUMGWSQ.js";
 
 // src/lib/behaviors.ts
 import crypto from "crypto";

package/dist/{chunk-4NOGWIBA.js → chunk-HSEBRWE2.js}

@@ -1,15 +1,15 @@
 import {
   derivePartnerSealIdentityFromMaster
-} from "./chunk-TQJMG65I.js";
+} from "./chunk-RC6Q5KSW.js";
 import {
   derivePartnerSignIdentityFromMaster,
   displayFingerprint,
   ed25519PrivateKeyFromSeed,
   ed25519PublicKeyFromRaw
-} from "./chunk-LGNDHTDP.js";
+} from "./chunk-MB3XK7YW.js";
 import {
   getMasterKey
-} from "./chunk-5AGOX2XD.js";
+} from "./chunk-O22YLZXQ.js";
 
 // src/lib/org-key-epoch.ts
 import crypto, { sign as edSign, verify as edVerify } from "crypto";

package/dist/{chunk-B6CBN6EF.js → chunk-HWP3WCLC.js}

@@ -724,6 +724,14 @@ async function checkLiveArtifactMatchesManifest(composeFile, manifestPath, expec
     }
   }
   if (declared.length === 0) {
+    if (expected?.composeServices !== void 0) {
+      return {
+        check,
+        status: "fail",
+        message: "selected artifact comparison has no signed declaration \u2014 comparison did NOT run",
+        verdicts: { disagrees: 1 }
+      };
+    }
     return {
       check,
       status: "warn",
@@ -731,10 +739,23 @@ async function checkLiveArtifactMatchesManifest(composeFile, manifestPath, expec
     };
   }
   const names = [];
+  const selected = expected?.composeServices === void 0 ? null : new Set(expected.composeServices);
+  const scopedFailure = (message) => ({
+    check,
+    status: "fail",
+    message,
+    verdicts: { disagrees: 1 }
+  });
+  if (selected && (selected.size === 0 || selected.size !== expected.composeServices.length)) {
+    return scopedFailure("invalid selected compose service scope \u2014 comparison did NOT run");
+  }
+  const found = /* @__PURE__ */ new Set();
   try {
     const dir = path.dirname(composeFile);
     const file = path.basename(composeFile);
-    const raw = execSync(`docker compose -f "${file}" ps --format json`, {
+    const override = path.join(dir, "docker-compose.override.yml");
+    const composeFiles = selected && existsSync(override) ? `-f "${file}" -f "${path.basename(override)}"` : `-f "${file}"`;
+    const raw = execSync(`docker compose ${composeFiles} ps --format json`, {
       cwd: dir,
       timeout: CHECK_TIMEOUT_MS,
       encoding: "utf8",
@@ -743,18 +764,26 @@ async function checkLiveArtifactMatchesManifest(composeFile, manifestPath, expec
     for (const line of raw.trim().split("\n").filter(Boolean)) {
       try {
         const c = JSON.parse(line);
+        const service = c.Service || c.service;
+        if (selected && (!service || !selected.has(service))) continue;
         const name = c.Name || c.name;
+        if (selected && name) found.add(service);
         if (name) names.push(name);
       } catch {
       }
     }
   } catch (err) {
+    if (selected) return scopedFailure(`could not enumerate selected containers: ${err instanceof Error ? err.message : String(err)} \u2014 comparison did NOT run`);
     return {
       check,
       status: "warn",
       message: `could not enumerate containers: ${err instanceof Error ? err.message : String(err)} \u2014 comparison did NOT run`
     };
   }
+  if (selected) {
+    const missing = [...selected].filter((service) => !found.has(service));
+    if (missing.length > 0) return scopedFailure(`selected compose service(s) absent: ${missing.join(", ")} \u2014 comparison did NOT run`);
+  }
   if (names.length === 0) {
     return { check, status: "warn", message: "no containers enumerated \u2014 comparison did NOT run" };
   }
@@ -772,8 +801,14 @@ async function checkLiveArtifactMatchesManifest(composeFile, manifestPath, expec
   const observed = [];
   for (const name of names) {
     const configured = inspect([name, "--format", "{{ .Config.Image }}"]);
-    if (!configured) continue;
+    if (!configured) {
+      if (selected) return scopedFailure(`selected container ${name} has no inspectable image \u2014 comparison did NOT run`);
+      continue;
+    }
     const imageId = inspect([name, "--format", "{{ .Image }}"]);
+    if (selected && !imageId) {
+      return scopedFailure(`selected container ${name} has no inspectable running image ID \u2014 comparison did NOT run`);
+    }
     let ref = configured;
     if (imageId) {
       const digestsRaw = inspect([imageId, "--format", "{{ json .RepoDigests }}"]);
@@ -782,9 +817,15 @@ async function checkLiveArtifactMatchesManifest(composeFile, manifestPath, expec
         if (Array.isArray(parsed) && parsed.length > 0) {
           const repo = (configured.split("@")[0] ?? "").replace(/:[^/:]+$/, "");
           const list = parsed.filter((x) => typeof x === "string");
+          if (selected && list.length === 0) {
+            return scopedFailure(`selected container ${name} has no inspectable image digest \u2014 comparison did NOT run`);
+          }
           ref = list.find((d) => d.startsWith(`${repo}@`)) ?? list[0] ?? configured;
+        } else if (selected) {
+          return scopedFailure(`selected container ${name} has no inspectable image digest \u2014 comparison did NOT run`);
         }
       } catch {
+        if (selected) return scopedFailure(`selected container ${name} has no parseable image digest \u2014 comparison did NOT run`);
       }
     }
     observed.push({ container: name, ref });
@@ -810,7 +851,12 @@ async function checkLiveArtifactMatchesManifest(composeFile, manifestPath, expec
   return {
     check,
     status: "fail",
-    verdicts: { ...report.counts },
+    // In a signed retained update every inspected container was selected for
+    // delivery. An undeclared or provenance-unknown selected image is just as
+    // unsafe as a same-repo digest mismatch. The updater's fatal gate keys on
+    // `disagrees`, so normalize all selected non-agreement findings to that
+    // fatal count while preserving the detailed verdicts in the message.
+    verdicts: selected ? { ...report.counts, disagrees: Math.max(report.counts.disagrees, report.findings.length) } : { ...report.counts },
     message: `${report.findings.length} artifact(s) are not what ${source} pins: ` + report.findings.map((f) => `${f.service} [${f.verdict}]`).join(", ") + `. Running: ${report.findings.map((f) => `${f.service}=${f.running?.digest ?? f.running?.ref ?? "(nothing running)"}`).join(", ")}`
   };
 }
@@ -849,7 +895,8 @@ async function runVerifyStack(options) {
   if (Date.now() > deadline) return summarize(results);
   addResult(await checkLiveArtifactMatchesManifest(composeFile, void 0, {
     stackVersion: options?.stackVersion,
-    declared: options?.expectedArtifacts
+    declared: options?.expectedArtifacts,
+    composeServices: options?.artifactComposeServices
   }));
   if (Date.now() > deadline) return summarize(results);
   addResult(await checkSsoSessionContract(env, deployed));

package/dist/{chunk-KBCUHYHP.js → chunk-I3MPYHFM.js}

@@ -1,12 +1,12 @@
 import {
   storeBehavior
-} from "./chunk-LNCTMU7Y.js";
+} from "./chunk-HNVYH2WE.js";
 import {
   resolveAnthropicAuth
 } from "./chunk-VGMACSEV.js";
 import {
   getClient
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-GAUMGWSQ.js";
 import {
   loadConfig
 } from "./chunk-MMS2HBRT.js";

package/dist/{chunk-Y5ZD4CTB.js → chunk-ITV2CEFW.js}

@@ -2,7 +2,7 @@ import {
   getClient,
   isCoordinatorName,
   loadEmployeesSync
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-GAUMGWSQ.js";
 
 // src/lib/steward-gate.ts
 import crypto from "crypto";

package/dist/{chunk-BJ3ZQAIL.js → chunk-IV63ZWK6.js}

@@ -1,6 +1,6 @@
 import {
   loadEmployees
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-GAUMGWSQ.js";
 
 // src/lib/agent-symlinks.ts
 import os from "os";

package/dist/{chunk-6FWHAROQ.js → chunk-JI7TFGJY.js}

@@ -8,14 +8,14 @@ import {
   resolveExeSession,
   sendIntercom,
   strictSessionScopeFilter
-} from "./chunk-V4RIHICU.js";
+} from "./chunk-Y2DTTZCV.js";
 import {
   parseMessage,
   serializeMessage
 } from "./chunk-TDF2XKLK.js";
 import {
   recordOrchestrationEventBestEffort
-} from "./chunk-OGJCUMSM.js";
+} from "./chunk-2YESHX5N.js";
 import {
   getSessionKey
 } from "./chunk-CVYC6DUW.js";
@@ -24,7 +24,7 @@ import {
 } from "./chunk-BTSWFMEH.js";
 import {
   getClient
-} from "./chunk-DXQIIZQC.js";
+} from "./chunk-GAUMGWSQ.js";
 
 // src/lib/messaging.ts
 import crypto from "crypto";