@juspay/neurolink 12.17.0 → 12.17.2

package/dist/cli/commands/proxy.js

@@ -12,7 +12,7 @@ import { logger } from "../../utils/logger.js";
 import { applyAllClients, restoreAllClients, } from "../proxy-clients/registry.js";
 import { resolveProxyConfigPath } from "../../proxy/proxyConfig.js";
 import { redactUrlsInText, sanitizeForLog, } from "../../utils/logSanitize.js";
-import { withTimeout } from "../../utils/async/withTimeout.js";
+import { raceWithAbort, withTimeout, } from "../../utils/async/withTimeout.js";
 import { startProxyHttpTrace } from "../../proxy/proxyTracer.js";
 import { formatUptime, isProcessRunning, StateFileManager, } from "../utils/serverUtils.js";
 import { configureProxyKeepAliveDispatcher } from "../../proxy/proxyDispatcher.js";
@@ -20,19 +20,22 @@ import { ProxyRuntimeConfigStore } from "../../proxy/runtimeConfig.js";
 import { startProxyLogCleanupScheduler } from "../../proxy/logCleanupScheduler.js";
 import { anthropicAccountKeysEqual, createAccountAllowlist, isAccountAllowed, LEGACY_ANTHROPIC_ACCOUNT_KEY, normalizeAnthropicAccountKey, shouldLoadFallbackCredential, } from "../../proxy/accountSelection.js";
 import { resolveProxyStatusAccountIdentity } from "../../proxy/codexAccountUsage.js";
-import { beginProxyRequest, getProxyActivitySnapshot, observeProxyFinalLog, takeProxyResponseObservers, trackProxyResponse, } from "../../proxy/proxyActivity.js";
+import { beginProxyRequest, consumeInternalProxyRequest, releaseProxyRequestAccounting, withProxyFinalLogOwnership, getProxyActivitySnapshot, observeProxyFinalLog, takeProxyResponseObservers, trackProxyResponse, } from "../../proxy/proxyActivity.js";
 import { configureProxyLifecycleLogger, flushProxyLifecycleEvents, persistProxyLifecycleAcceptance, getProxyLifecycleLoggerSnapshot, hashProxyLifecycleSessionId, logProxyLifecycleEvent, } from "../../proxy/proxyLifecycle.js";
-import { describeInstallFailure, getGlobalInstallArgs, isTransientInstallFailure, resolveGlobalInstaller, validateInstalledVersion, } from "../../proxy/globalInstaller.js";
+import { describeInstallFailure, assertProxyServiceInstallIdle, probeProxyLaunchdPresence, inspectProxyPackage, isProxyServiceEnvironmentKey, parseProxyServiceInstallSettings, installStagedProxyPackage, readProxyPackageSelection, resolveProxyWorkerPackage, selectProxyPackage, writeProxyPackageLauncher, isTransientInstallFailure, resolveGlobalInstaller, validateInstalledVersion, } from "../../proxy/globalInstaller.js";
 import { startUpdaterWorkerSupervisor } from "../../proxy/updaterSupervisor.js";
 import { openProxyWorkerLog } from "../../proxy/workerLog.js";
 import { startRollingProxyServer } from "../../proxy/rollingProxyServer.js";
 import { startProxyRestartControl, requestProxySupervisorTelemetry, } from "../../proxy/restartControl.js";
 import { getProxyProcessTelemetry } from "../../proxy/processTelemetry.js";
+import { recordFinalError as recordProxyRuntimeFinalError } from "../../proxy/usageStats.js";
+import { logRequest as logProxyRequestFinal } from "../../proxy/requestLogger.js";
+import { bindProxyClientCancellation } from "../../proxy/proxyClientCancellation.js";
 import { isProxyAuxiliaryRequest } from "../../proxy/proxyRequestKind.js";
 import { spawnProxySocketWorker } from "../../proxy/rollingWorkerProcess.js";
 import { PROXY_ROLLING_SUPERVISOR_ENV, PROXY_SOCKET_WORKER_ENV, } from "../../proxy/rollingWorkerProtocol.js";
 import { attachSocketWorkerProcess } from "../../proxy/socketWorkerRuntime.js";
-import { shouldRefreshStaleSupervisor, waitForProxyUpdateWindow, } from "../../proxy/updateCoordinator.js";
+import { parseProxyRuntimeActivity, isProxyUpdateOwnerCurrent, shouldRefreshStaleSupervisor, waitForProxyUpdateWindow, } from "../../proxy/updateCoordinator.js";
 import { abandonPendingUpdate, clearUpdateDeferral, isVersionSuppressed, loadUpdateState, recordCheck, recordSuccessfulUpdate, recordUpdateDeferred, recordUpdateFailure, recordUpdateInstalled, suppressVersion, } from "../../proxy/updateState.js";
 import { loadProxyEnvFile, resolveProxyEnvFile, } from "../../proxy/proxyEnv.js";
 import { createRequire } from "node:module";
@@ -479,17 +482,7 @@ async function getProxyRuntimeActivity(host, port, timeoutMs = 3_000) {
         if (!response.ok) {
             return null;
         }
-        const payload = (await response.json());
-        const activeRequests = Number(payload.activity?.activeRequests);
-        if (!Number.isFinite(activeRequests) || activeRequests < 0) {
-            return null;
-        }
-        return {
-            activeRequests,
-            lastActivityAt: typeof payload.activity?.lastActivityAt === "string"
-                ? payload.activity.lastActivityAt
-                : null,
-        };
+        return parseProxyRuntimeActivity(await response.json());
     }
     catch {
         return null;
@@ -665,11 +658,12 @@ async function resumeProxyUpdateDrain(host, port, attempts = 3) {
 // ---------------------------------------------------------------------------
 /**
  * Path to a small trampoline script that the plist invokes.
- * The trampoline re-resolves `neurolink` via PATH on every launch,
- * so launchd never gets pinned to a version-specific store path.
+ * The trampoline selects a validated immutable package. The stable launchd
+ * path does not require reinstalling the service to activate another version.
  */
 const TRAMPOLINE_DIR = join(homedir(), ".neurolink", "bin");
 const TRAMPOLINE_PATH = join(TRAMPOLINE_DIR, "neurolink-proxy");
+const PROXY_PACKAGES_DIR = join(homedir(), ".neurolink", "proxy-packages");
 /**
  * Verify a candidate bin path actually runs by invoking `--version` on it.
  * Returns the version string on success, or undefined on any failure.
@@ -691,96 +685,26 @@ function probeBinVersion(binPath) {
 /**
  * Write (or overwrite) the trampoline shell script.
  *
- * Defensive design: the trampoline tries multiple candidates in order and
- * only `exec`s one whose `--version` check succeeds. If every PATH-based
- * candidate is broken (stale shims, missing packages), it falls back to the
- * baked-in `node + script` path that was verified to work at install time.
+ * Selection is explicit: package validation happens before rewriting the
+ * launcher, and launch itself never imports the CLI merely to probe a version.
  */
-function writeTrampoline() {
-    const { writeFileSync, mkdirSync, existsSync, chmodSync } = _require("fs");
-    if (!existsSync(TRAMPOLINE_DIR)) {
-        mkdirSync(TRAMPOLINE_DIR, { recursive: true });
-    }
-    // Baked-in fallback: the specific node + JS script currently running
-    // (guaranteed to work, since we ARE running). Used only if all PATH-based
-    // candidates fail their --version probe.
-    const bakedNode = process.execPath;
-    const bakedScript = process.argv[1] ?? join(__dirname, "..", "index.js");
-    // Shell-escape the baked paths (they shouldn't contain quotes in practice,
-    // but be safe for paths with spaces).
-    const shEscape = (s) => `'${s.replace(/'/g, "'\\''")}'`;
-    const script = `#!/bin/sh
-# Auto-generated by \`neurolink proxy install\` — do not edit.
-# Resolves a working neurolink binary on every launchd invocation so the
-# plist never gets pinned to a broken/stale shim.
-
-BAKED_NODE=${shEscape(bakedNode)}
-BAKED_SCRIPT=${shEscape(bakedScript)}
-
-# IPC workers must preserve the inherited Node channel until the final exec.
-# Do not launch a --version probe subprocess on that descriptor; the parent
-# validates the worker's exact package version before activation instead.
-if [ "\${NEUROLINK_PROXY_TRAMPOLINE_EXEC_ONLY:-0}" = "1" ]; then
-  if [ -n "\${NEUROLINK_BIN:-}" ] && [ -x "$NEUROLINK_BIN" ]; then
-    exec "$NEUROLINK_BIN" "$@"
-  fi
-  for cand in \
-      "$(command -v neurolink 2>/dev/null || true)" \
-      "\${PNPM_HOME:-}/neurolink" \
-      "$HOME/.local/share/pnpm/neurolink" \
-      "$HOME/Library/pnpm/neurolink" \
-      "/usr/local/bin/neurolink" \
-      "/opt/homebrew/bin/neurolink"; do
-    [ -n "$cand" ] && [ -x "$cand" ] && exec "$cand" "$@"
-  done
-  if [ -x "$BAKED_NODE" ] && [ -f "$BAKED_SCRIPT" ]; then
-    exec "$BAKED_NODE" "$BAKED_SCRIPT" "$@"
-  fi
-  exit 127
-fi
-
-# Probe a candidate: must be executable and respond to --version cleanly.
-_try() {
-  [ -n "$1" ] && [ -x "$1" ] || return 1
-  "$1" --version >/dev/null 2>&1 || return 1
-  return 0
+function writeTrampoline(selection, isCurrentOwner) {
+    // Reinstall preserves an already validated proxy-owned selection. A manual
+    // global npm upgrade cannot silently retarget existing worker generations.
+    const selected = selection ??
+        readProxyPackageSelection(PROXY_PACKAGES_DIR) ??
+        inspectProxyPackage(process.argv[1] ?? join(__dirname, "..", "index.js"));
+    writeProxyPackageLauncher(TRAMPOLINE_PATH, selected, isCurrentOwner);
+    selectProxyPackage(PROXY_PACKAGES_DIR, selected, isCurrentOwner);
 }
-
-# 1. Explicit user override (escape hatch for broken environments).
-if [ -n "\${NEUROLINK_BIN:-}" ]; then
-  if _try "$NEUROLINK_BIN"; then
-    exec "$NEUROLINK_BIN" "$@"
-  fi
-  echo "[neurolink-proxy] WARN: NEUROLINK_BIN=$NEUROLINK_BIN is not runnable, trying defaults" >&2
-fi
-
-# 2. PATH-based and common install locations. First working one wins.
-for cand in \\
-    "$(command -v neurolink 2>/dev/null || true)" \\
-    "\${PNPM_HOME:-}/neurolink" \\
-    "$HOME/.local/share/pnpm/neurolink" \\
-    "$HOME/Library/pnpm/neurolink" \\
-    "/usr/local/bin/neurolink" \\
-    "/opt/homebrew/bin/neurolink"; do
-  if _try "$cand"; then
-    exec "$cand" "$@"
-  fi
-done
-
-# 3. Baked-in fallback: the exact node + script that worked at install time.
-#    Always valid at install time; may become stale after package updates
-#    (but at that point the PATH candidates above should work).
-if [ -x "$BAKED_NODE" ] && [ -f "$BAKED_SCRIPT" ]; then
-  exec "$BAKED_NODE" "$BAKED_SCRIPT" "$@"
-fi
-
-echo "[neurolink-proxy] FATAL: no working neurolink binary found." >&2
-echo "[neurolink-proxy] Tried: PATH, \\$PNPM_HOME, \\$HOME/.local/share/pnpm, \\$HOME/Library/pnpm, /usr/local/bin, /opt/homebrew/bin, baked-in install path." >&2
-echo "[neurolink-proxy] Fix: reinstall with 'pnpm add -g @juspay/neurolink' or set NEUROLINK_BIN=/path/to/working/neurolink." >&2
-exit 127
-`;
-    writeFileSync(TRAMPOLINE_PATH, script, { mode: 0o755 });
-    chmodSync(TRAMPOLINE_PATH, 0o755);
+/** Status must remain available when an external installer damages its entrypoint. */
+function readProxyDiskVersion() {
+    try {
+        return inspectProxyPackage(process.argv[1]).version;
+    }
+    catch {
+        return null;
+    }
 }
 function spawnFailOpenGuard(host, port, parentPid) {
     // The guard runs the same version as this process, so process.argv[1]
@@ -892,6 +816,9 @@ async function runProxyTelemetryManager(command, argv) {
                 ["format", "--format"],
                 ["maxRows", "--max-rows"],
                 ["proxyUrl", "--proxy-url"],
+                ["admissionLookbackMinutes", "--admission-lookback-minutes"],
+                ["requestTimeoutMs", "--request-timeout-ms"],
+                ["ingestionGraceMs", "--ingestion-grace-ms"],
             ]) {
                 if (argv[key] !== undefined) {
                     queryArgs.push(option, String(argv[key]));
@@ -1129,15 +1056,22 @@ function registerProxyRequestTracking(app, requestMetadata, readiness) {
             c.req.raw.headers.get("x-claude-code-session-id") ??
             undefined;
         const sessionHash = hashProxyLifecycleSessionId(sessionId);
+        const internal = consumeInternalProxyRequest(c.req.raw.headers.get("x-neurolink-internal-request"));
+        const abortController = new AbortController();
         const metadata = {
-            requestId: crypto.randomUUID(),
+            requestId: internal?.requestId ?? crypto.randomUUID(),
+            parentRequestId: internal?.parentRequestId,
+            accountingScope: internal ? "internal" : "client",
+            usageOwnerRequestId: internal?.requestId,
+            abortController,
             method: c.req.method,
             path: c.req.path,
             startedAt: Date.now(),
             model: "-",
             stream: false,
             toolCount: 0,
-            rejectForUpdate: readiness.drainingForUpdate,
+            // Trusted child work belongs to an already admitted parent request.
+            rejectForUpdate: !internal && readiness.drainingForUpdate,
         };
         requestMetadata.set(c.req.raw, metadata);
         const httpTrace = startProxyHttpTrace(metadata, Object.fromEntries(c.req.raw.headers));
@@ -1149,7 +1083,16 @@ function registerProxyRequestTracking(app, requestMetadata, readiness) {
         const finishActivity = metadata.rejectForUpdate
             ? () => undefined
             : beginProxyRequest();
+        let responseTracking = false;
+        let cancelledBeforeHeaders = false;
+        const deadline = setTimeout(() => abortController.abort(new DOMException("Proxy request deadline exceeded", "TimeoutError")), 900_000);
+        deadline.unref?.();
+        let unbindClient = () => { };
         const finish = () => {
+            clearTimeout(deadline);
+            unbindClient();
+            abortController.signal.removeEventListener("abort", onPreheaderAbort);
+            releaseProxyRequestAccounting(metadata.requestId);
             httpTrace.end(metadata.terminalResult?.responseStatus ?? c.res.status, metadata.terminalResult?.terminalOutcome ?? "unknown", metadata.terminalErrorType);
             stopObservingFinalLog();
             finishActivity();
@@ -1159,12 +1102,77 @@ function registerProxyRequestTracking(app, requestMetadata, readiness) {
             metadata.shareRelease?.();
             requestMetadata.delete(c.req.raw);
         };
+        const onPreheaderAbort = () => {
+            if (responseTracking || cancelledBeforeHeaders) {
+                return;
+            }
+            cancelledBeforeHeaders = true;
+            const timeout = abortController.signal.reason?.name === "TimeoutError";
+            const status = timeout ? 504 : 499;
+            const errorType = timeout ? "request_timeout" : "client_cancelled";
+            if (!metadata.terminalResult && metadata.accountingScope !== "internal") {
+                recordProxyRuntimeFinalError(status, undefined, undefined, {
+                    requestId: metadata.requestId,
+                    errorType,
+                    terminalOutcome: timeout ? "handler_error" : "client_cancelled",
+                    message: timeout
+                        ? "Request deadline exceeded"
+                        : "Client disconnected before response headers",
+                });
+            }
+            void logProxyRequestFinal({
+                timestamp: new Date().toISOString(),
+                requestId: metadata.requestId,
+                method: metadata.method,
+                path: metadata.path,
+                model: metadata.model,
+                stream: metadata.stream,
+                toolCount: metadata.toolCount,
+                account: "",
+                accountType: "proxy-runtime",
+                responseStatus: status,
+                responseTimeMs: Date.now() - metadata.startedAt,
+                errorType,
+                errorMessage: timeout
+                    ? "Request deadline exceeded"
+                    : "Client disconnected before response headers",
+            });
+            logProxyLifecycleEvent({
+                event: "request_terminal",
+                requestId: metadata.requestId,
+                parentRequestId: metadata.parentRequestId,
+                accountingScope: metadata.accountingScope,
+                method: metadata.method,
+                path: metadata.path,
+                model: metadata.model,
+                stream: metadata.stream,
+                sessionHash,
+                elapsedMs: performance.now() - startedMonotonicMs,
+                terminalOutcome: timeout ? "handler_error" : "client_cancelled",
+                transportOutcome: timeout ? "stream_error" : "client_cancelled",
+                finalStatus: status,
+                errorType,
+                telemetryStatus: "complete",
+                outcomeSource: "transport_error",
+            });
+            finishActivity();
+            metadata.shareRelease?.();
+            clearTimeout(deadline);
+            unbindClient();
+        };
+        abortController.signal.addEventListener("abort", onPreheaderAbort, {
+            once: true,
+        });
+        unbindClient = bindProxyClientCancellation(c.req.raw, c.env, abortController);
         // The route adapter populates model/stream/toolCount after parsing. Omit
         // them at acceptance instead of publishing misleading placeholder values;
         // subsequent events carry the parsed metadata under the same request ID.
         try {
             await httpTrace.run(() => persistProxyLifecycleAcceptance({
                 requestId: metadata.requestId,
+                parentRequestId: metadata.parentRequestId,
+                accountingScope: metadata.accountingScope,
+                requestTimeoutMs: 900_000,
                 method: metadata.method,
                 path: metadata.path,
                 sessionHash,
@@ -1172,7 +1180,19 @@ function registerProxyRequestTracking(app, requestMetadata, readiness) {
                 elapsedMs: 0,
                 monotonicMs: startedMonotonicMs,
             }));
-            await httpTrace.run(next);
+            if (abortController.signal.aborted) {
+                c.res = new Response(null, { status: 499 });
+                finish();
+                return;
+            }
+            await httpTrace.run(() => withProxyFinalLogOwnership(metadata.requestId, next));
+            if (cancelledBeforeHeaders) {
+                void c.res.body
+                    ?.cancel(abortController.signal.reason)
+                    .catch(() => undefined);
+                finish();
+                return;
+            }
             const responseStatus = c.res.status;
             logProxyLifecycleEvent({
                 event: "response_headers",
@@ -1199,9 +1219,10 @@ function registerProxyRequestTracking(app, requestMetadata, readiness) {
                 }
             };
             const notifyRouteTerminal = async (details) => {
-                const results = await withTimeout(Promise.allSettled(routeResponseObservers.map(async (observer) => observer.onTerminal?.(details))), 2_000, "Timed out joining proxy response accounting");
+                const results = await withTimeout(Promise.allSettled(routeResponseObservers.map(async (observer) => observer.onTerminal?.(details))), 3_000, "Timed out joining proxy response accounting");
                 return results.some((result) => result.status === "rejected");
             };
+            responseTracking = true;
             c.res = trackProxyResponse(c.res, finish, {
                 onFirstChunk: ({ observedBodyBytes, responseChunks }) => {
                     logProxyLifecycleEvent({
@@ -1243,6 +1264,34 @@ function registerProxyRequestTracking(app, requestMetadata, readiness) {
                     catch {
                         accountingTimedOut = true;
                     }
+                    if (!metadata.terminalResult && responseStatus >= 400) {
+                        if (metadata.accountingScope !== "internal") {
+                            recordProxyRuntimeFinalError(responseStatus, undefined, undefined, {
+                                requestId: metadata.requestId,
+                                errorType: responseStatus === 404
+                                    ? "route_not_found"
+                                    : "request_rejected",
+                                terminalOutcome: "handler_error",
+                            });
+                        }
+                        await logProxyRequestFinal({
+                            timestamp: new Date().toISOString(),
+                            requestId: metadata.requestId,
+                            method: metadata.method,
+                            path: metadata.path,
+                            model: metadata.model,
+                            stream: metadata.stream,
+                            toolCount: metadata.toolCount,
+                            account: "",
+                            accountType: "proxy-runtime",
+                            responseStatus,
+                            responseTimeMs: Date.now() - metadata.startedAt,
+                            errorType: responseStatus === 404
+                                ? "route_not_found"
+                                : "request_rejected",
+                            terminalOutcome: "handler_error",
+                        });
+                    }
                     const final = metadata.terminalResult;
                     const auxiliary = isProxyAuxiliaryRequest(metadata.method, metadata.path);
                     const terminalOutcome = final?.terminalOutcome ??
@@ -1297,9 +1346,16 @@ function registerProxyRequestTracking(app, requestMetadata, readiness) {
                     stopObservingFinalLog();
                     httpTrace.end(final?.responseStatus ?? responseStatus, terminalOutcome, final?.errorType ?? metadata.terminalErrorType);
                 },
-            });
+            }, abortController.signal);
         }
         catch (error) {
+            clearTimeout(deadline);
+            unbindClient();
+            abortController.signal.removeEventListener("abort", onPreheaderAbort);
+            if (cancelledBeforeHeaders) {
+                finish();
+                return;
+            }
             stopObservingFinalLog();
             // Keep metadata available to app.onError, which records the client-facing
             // failure with the same request ID before deleting the WeakMap entry.
@@ -1352,7 +1408,7 @@ export async function createProxyStartApp(params) {
     const { createOpenAIProxyRoutes } = await import("../../server/routes/openaiProxyRoutes.js");
     const { createCodexProxyRoutes } = await import("../../server/routes/codexProxyRoutes.js");
     const { createGeminiProxyRoutes } = await import("../../server/routes/geminiProxyRoutes.js");
-    const { logBodyCapture, logRequest, getRequestLoggerSnapshot } = await import("../../proxy/requestLogger.js");
+    const { logBodyCapture, getRequestLoggerSnapshot } = await import("../../proxy/requestLogger.js");
     const { recordFinalError } = await import("../../proxy/usageStats.js");
     const { admitInboundShareRequest, isGrantRequiredByEnv } = await import("../../proxy/shareGate.js");
     const { runWithShareContext } = await import("../../proxy/shareContext.js");
@@ -1378,15 +1434,17 @@ export async function createProxyStartApp(params) {
         const clientMessage = options?.clientMessage ?? errorMessage;
         const clientErrorType = options?.clientErrorType ?? errorType;
         const attempt = metadata.lastUpstreamAttempt;
-        recordFinalError(status, attempt?.account ?? PROXY_INTERNAL_ACCOUNT_LABEL, attempt?.accountType ?? PROXY_INTERNAL_ACCOUNT_TYPE, {
-            requestId: metadata.requestId,
-            errorType,
-            errorCode: options?.errorCode,
-            terminalOutcome: "handler_error",
-            message: errorMessage,
-        });
+        if (metadata.accountingScope !== "internal" && !metadata.terminalResult) {
+            recordFinalError(status, attempt?.account ?? PROXY_INTERNAL_ACCOUNT_LABEL, attempt?.accountType ?? PROXY_INTERNAL_ACCOUNT_TYPE, {
+                requestId: metadata.requestId,
+                errorType,
+                errorCode: options?.errorCode,
+                terminalOutcome: "handler_error",
+                message: errorMessage,
+            });
+        }
         await Promise.all([
-            logRequest({
+            logProxyRequestFinal({
                 timestamp: new Date().toISOString(),
                 requestId: metadata.requestId,
                 method: metadata.method,
@@ -1449,12 +1507,20 @@ export async function createProxyStartApp(params) {
         metadata.terminalErrorType = telemetryUnavailable
             ? "telemetry_unavailable"
             : "unhandled_proxy_error";
-        await recordRuntimeError(metadata, status, metadata.terminalErrorType, errMsg, {
-            clientMessage: "Proxy internal error",
-            clientErrorType: "api_error",
-            errorCode: metadata.terminalErrorCode,
-        });
-        requestMetadata.delete(c.req.raw);
+        try {
+            await recordRuntimeError(metadata, status, metadata.terminalErrorType, errMsg, {
+                clientMessage: "Proxy internal error",
+                clientErrorType: "api_error",
+                errorCode: metadata.terminalErrorCode,
+            });
+        }
+        finally {
+            // Admission/handler failures may never reach the response tracker. Keep
+            // bridge ownership through final publication, then release this request
+            // only; a child failure must retain its parent's result until delivery.
+            releaseProxyRequestAccounting(metadata.requestId);
+            requestMetadata.delete(c.req.raw);
+        }
         return c.json({
             type: "error",
             error: {
@@ -1506,7 +1572,7 @@ export async function createProxyStartApp(params) {
             if (payload.action === "drain_for_supervisor_refresh") {
                 // A crashed updater must not strand the current rolling worker in
                 // maintenance mode. A successful launchd refresh replaces this process.
-                scheduleSupervisorRefreshResume(35 * 60 * 1000);
+                scheduleSupervisorRefreshResume(90 * 1000);
             }
         }
         else if (payload.action === "resume") {
@@ -1544,7 +1610,10 @@ export async function createProxyStartApp(params) {
             runtimeConfigProvider,
         }
         : params.accountAllowlist);
-    const openaiRouteGroup = createOpenAIProxyRoutes(params.modelRouter, "", params.port, runtimeConfigProvider);
+    const openaiRouteGroup = createOpenAIProxyRoutes(params.modelRouter, "", params.port, runtimeConfigProvider, 
+    // Keep bridge capabilities, accounting and cancellation in this worker
+    // across supervisor generation switches; never re-enter the public listener.
+    (request) => app.fetch(request));
     const codexRouteGroup = createCodexProxyRoutes("");
     const geminiRouteGroup = createGeminiProxyRoutes(params.modelRouter, "", params.port, runtimeConfigProvider);
     const allProxyRoutes = [
@@ -1631,7 +1700,8 @@ export async function createProxyStartApp(params) {
             // secret. Running it through the request gate as well would spend the
             // grant's rate allowance and open a coin hold for a call that consumes no
             // capacity at all.
-            const shareOutcome = c.req.path.startsWith("/peer/")
+            const shareOutcome = metadata?.accountingScope === "internal" ||
+                c.req.path.startsWith("/peer/")
                 ? { kind: "local" }
                 : await admitInboundShareRequest({
                     headers: Object.fromEntries(c.req.raw.headers.entries()),
@@ -1665,7 +1735,7 @@ export async function createProxyStartApp(params) {
                     shareOutcome.release();
                 }
             }
-            const requestAbortController = new AbortController();
+            const requestAbortController = metadata?.abortController ?? new AbortController();
             const ctx = {
                 requestId: metadata?.requestId ?? crypto.randomUUID(),
                 method: c.req.method,
@@ -1700,9 +1770,9 @@ export async function createProxyStartApp(params) {
                     c.header(key, value);
                 }
             };
-            const result = shareContext
-                ? await runWithShareContext(shareContext, () => route.handler(ctx))
-                : await route.handler(ctx);
+            const result = await raceWithAbort(Promise.resolve(shareContext
+                ? runWithShareContext(shareContext, () => route.handler(ctx))
+                : route.handler(ctx)), ctx.abortSignal);
             if (result instanceof Response) {
                 // Streaming responses own their headers; merge in anything the
                 // handler published on the context that the Response lacks. A Response
@@ -2161,6 +2231,10 @@ export async function createProxyStartApp(params) {
                 installedVersion: updateState?.installedVersion ??
                     updateState?.lastUpdateVersion ??
                     null,
+                validatedVersion: updateState?.installedVersion ?? null,
+                selectedPackageVersion: readProxyPackageSelection(PROXY_PACKAGES_DIR)?.version ?? null,
+                diskPackageVersion: readProxyDiskVersion(),
+                candidateVersion: supervisorState?.rolling?.candidate?.expectedVersion ?? null,
                 activatedVersion: PROXY_VERSION,
                 pendingActivationVersion: updateState?.pendingRestartVersion ?? null,
                 pendingRestartVersion: updateState?.pendingRestartVersion ?? null,
@@ -2968,16 +3042,23 @@ async function runLaunchdProxySupervisor(argv, spinner) {
         host,
         port,
         initialVersion: PROXY_VERSION,
-        spawnWorker: (generation, expectedVersion) => spawnProxySocketWorker({
-            generation,
-            expectedVersion,
-            command: TRAMPOLINE_PATH,
-            args: workerArgs,
-            env: {
-                NEUROLINK_PROXY_UPDATE_CONTROL_TOKEN: PROXY_UPDATE_CONTROL_TOKEN,
-                NEUROLINK_PROXY_TRAMPOLINE_EXEC_ONLY: "1",
-            },
-        }),
+        spawnWorker: (generation, expectedVersion) => {
+            const selected = resolveProxyWorkerPackage({
+                packagesDir: PROXY_PACKAGES_DIR,
+                entryScript,
+                expectedVersion,
+            });
+            return spawnProxySocketWorker({
+                generation,
+                expectedVersion,
+                command: selected.nodePath,
+                args: [selected.entryScript, ...workerArgs],
+                env: {
+                    NEUROLINK_PROXY_UPDATE_CONTROL_TOKEN: PROXY_UPDATE_CONTROL_TOKEN,
+                    NEUROLINK_PROXY_TRAMPOLINE_EXEC_ONLY: "1",
+                },
+            });
+        },
         onStateChange: (snapshot) => {
             saveProxySupervisorState({
                 pid: process.pid,
@@ -3507,7 +3588,11 @@ export const proxyStatusCommand = {
                 installedVersion: updateState?.installedVersion ??
                     updateState?.lastUpdateVersion ??
                     null,
-                activatedVersion: supervisorState?.rolling.active?.version ?? null,
+                validatedVersion: updateState?.installedVersion ?? null,
+                selectedPackageVersion: readProxyPackageSelection(PROXY_PACKAGES_DIR)?.version ?? null,
+                diskPackageVersion: readProxyDiskVersion(),
+                candidateVersion: supervisorState?.rolling?.candidate?.expectedVersion ?? null,
+                activatedVersion: supervisorState?.rolling?.active?.version ?? null,
                 pendingActivationVersion: updateState?.pendingRestartVersion ?? null,
                 pendingRestartVersion: updateState?.pendingRestartVersion ?? null,
                 deferredUpdate: updateState?.deferredUpdate ?? null,
@@ -3521,7 +3606,7 @@ export const proxyStatusCommand = {
             const servingWorker = workerRunning &&
                 (supervisorPid
                     ? supervisorRunning &&
-                        (!supervisorState ||
+                        (!supervisorState?.rolling ||
                             supervisorState.rolling.active?.pid === state?.pid)
                     : true);
             if ((state || supervisorState) && (servingWorker || supervisorRunning)) {
@@ -3667,7 +3752,7 @@ export const proxyStatusCommand = {
                     logger.always(`  ${chalk.bold("Last update check:")} ${chalk.cyan(status.lastCheckAt)}`);
                 }
                 if (status.installedVersion) {
-                    logger.always(`  ${chalk.bold("Installed:")}  ${chalk.cyan(`v${status.installedVersion}`)}`);
+                    logger.always(`  ${chalk.bold("Validated:")}  ${chalk.cyan(`v${status.installedVersion}`)}`);
                 }
                 if (status.activatedVersion) {
                     logger.always(`  ${chalk.bold("Activated:")}  ${chalk.cyan(`v${status.activatedVersion}`)}`);
@@ -3773,6 +3858,18 @@ export const proxyTelemetryCommand = {
         .option("proxy-url", {
         type: "string",
         description: "Proxy endpoint used by the read-only doctor",
+    })
+        .option("admission-lookback-minutes", {
+        type: "number",
+        description: "Doctor admission history horizon; must exceed request timeout plus ingestion grace",
+    })
+        .option("request-timeout-ms", {
+        type: "number",
+        description: "Default request deadline for doctor admission reconciliation",
+    })
+        .option("ingestion-grace-ms", {
+        type: "number",
+        description: "Time allowed for telemetry ingestion before reconciliation",
     })
         .option("quiet", {
         type: "boolean",
@@ -3875,12 +3972,12 @@ export const proxyGuardCommand = {
         const UPDATE_CHECK_INTERVAL_MS = 2 * 60 * 60 * 1000; // 2 hours
         const QUIET_THRESHOLD_MS = 120 * 1000; // 2 minutes of silence
         const NATURAL_WINDOW_WAIT_MS = 10 * 60 * 1000; // prefer no admission pause
-        const UPDATE_DRAIN_TIMEOUT_MS = 30 * 60 * 1000; // preserve long streams
+        const UPDATE_DRAIN_TIMEOUT_MS = 30 * 1000; // defer and reopen admission instead of waiting through long streams
         const UPDATE_RETRY_DELAY_MS = 5 * 60 * 1000;
         const UPDATE_RETRY_MAX_DELAY_MS = 30 * 60 * 1000;
         const UPDATE_RETRY_MAX_ATTEMPTS = 4;
         const UPDATE_ACTIVITY_POLL_MS = 10 * 1000;
-        const UPDATE_TIMEOUT_MS = 30 * 1000; // 30 seconds to come healthy
+        const UPDATE_TIMEOUT_MS = 150 * 1000; // include the supervisor candidate readiness deadline
         // Get running version from /health endpoint (with timeout to avoid hanging)
         let runningVersion = PROXY_VERSION; // fallback
         try {
@@ -3929,15 +4026,33 @@ export const proxyGuardCommand = {
                 logger.always(`[updater] WARNING: failed to ${operation}: ${error instanceof Error ? error.message : String(error)}`);
             }
         };
+        const isCurrentUpdateOwner = () => {
+            const runtime = rollingSupervisor
+                ? loadProxySupervisorState()
+                : loadProxyState();
+            return isProxyUpdateOwnerCurrent({
+                stopping: guardStopping,
+                parentPid,
+                updaterPid: process.pid,
+                parentStatus: getProcessStatus(parentPid),
+                runtimePid: runtime?.pid,
+                runtimeUpdaterPid: runtime?.updaterPid,
+            });
+        };
         let updateInProgress = false;
         let updateRestartInProgress = false;
         const runUpdateCheck = async () => {
-            if (guardStopping || updateInProgress) {
+            if (updateInProgress || !isCurrentUpdateOwner()) {
                 return;
             }
             updateInProgress = true;
             let updateVersion = runningVersion;
             let drainActive = false;
+            let previousPackage = readProxyPackageSelection(PROXY_PACKAGES_DIR);
+            if (previousPackage?.version !== runningVersion) {
+                previousPackage = readProxyPackageSelection(PROXY_PACKAGES_DIR, true);
+            }
+            let candidatePackage;
             try {
                 // Lazy-load update modules so they're only imported at check time
                 const { checkForUpdate } = await import("../../proxy/updateChecker.js");
@@ -3979,65 +4094,10 @@ export const proxyGuardCommand = {
                     return;
                 }
                 logger.always(`[updater] update available: ${runningVersion} → ${result.latestVersion}`);
-                if (!rollingSupervisor) {
-                    // Legacy launchd services must become idle before their listener is
-                    // restarted. Rolling services keep the current worker serving while
-                    // the candidate package is installed and validated.
-                    let lastDeferralSignature = "";
-                    const waitForWindow = async (quietWaitMs) => {
-                        const window = await waitForProxyUpdateWindow({
-                            quietThresholdMs: QUIET_THRESHOLD_MS,
-                            quietWaitMs,
-                            drainWaitMs: UPDATE_DRAIN_TIMEOUT_MS,
-                            pollIntervalMs: UPDATE_ACTIVITY_POLL_MS,
-                            getActivity: () => getProxyRuntimeActivity(host, port),
-                            setDraining: async (draining) => {
-                                const changed = await setProxyUpdateDrain(host, port, draining);
-                                if (changed) {
-                                    logger.always(`[updater] ${draining ? "draining new inference requests" : "inference admission resumed"}`);
-                                }
-                                return changed;
-                            },
-                            isStopping: () => guardStopping,
-                            isParentAlive: () => getProcessStatus(parentPid) !== "not_running",
-                            onPhase: (phase, activity) => {
-                                const reason = phase === "waiting_for_quiet" && !activity
-                                    ? "activity_unavailable"
-                                    : phase;
-                                const signature = `${reason}:${activity?.activeRequests ?? "unknown"}`;
-                                if (signature !== lastDeferralSignature) {
-                                    lastDeferralSignature = signature;
-                                    persistUpdaterState("record update deferral", () => recordUpdateDeferred(result.latestVersion, reason, activity?.activeRequests ?? null));
-                                }
-                                logger.debug(`[updater] ${reason} (${activity?.activeRequests ?? "unknown"} active requests)`);
-                            },
-                        });
-                        drainActive = drainActive || window.draining;
-                        return window;
-                    };
-                    let updateWindow = await waitForWindow(NATURAL_WINDOW_WAIT_MS);
-                    if (!updateWindow.ready) {
-                        if (updateWindow.reason === "drain_failed") {
-                            persistUpdaterState("record unavailable update drain", () => recordUpdateDeferred(result.latestVersion, "drain_unavailable", null));
-                        }
-                        scheduleUpdateRetry("update window unavailable", result.latestVersion);
-                        return;
-                    }
-                    // Hold admission closed through install and restart after a quiet
-                    // observation, closing the race with a newly admitted request.
-                    if (!drainActive) {
-                        updateWindow = await waitForWindow(0);
-                        if (!updateWindow.ready) {
-                            scheduleUpdateRetry("update drain unavailable", result.latestVersion);
-                            return;
-                        }
-                    }
-                }
-                else if (!supervisorRefreshOnly) {
-                    logger.always(`[updater] rolling supervisor will keep v${runningVersion} serving during installation`);
+                if (rollingSupervisor && !supervisorRefreshOnly) {
+                    logger.always(`[updater] keeping v${runningVersion} serving while staging the candidate`);
                 }
-                // Refresh after waiting so a long deferral can never install a stale
-                // target while a newer release is already available.
+                // Recheck the target before staging because discovery can be delayed.
                 let pendingRestart = initiallyPendingRestart;
                 if (!supervisorRefreshOnly) {
                     const refreshedResult = await checkForUpdate(runningVersion);
@@ -4056,7 +4116,7 @@ export const proxyGuardCommand = {
                     }
                 }
                 persistUpdaterState("clear update deferral", () => clearUpdateDeferral());
-                logger.always(`[updater] ${supervisorRefreshOnly ? "supervisor reconciliation prepared" : rollingSupervisor ? "rolling activation prepared" : "safe update window acquired"} for v${result.latestVersion}`);
+                logger.always(`[updater] ${supervisorRefreshOnly ? "supervisor reconciliation prepared" : rollingSupervisor ? "rolling activation prepared" : "candidate preparation started"} for v${result.latestVersion}`);
                 // 3. Install update (validate version string before passing to shell)
                 if (!/^\d+\.\d+\.\d+$/.test(result.latestVersion)) {
                     const message = `invalid version format: ${result.latestVersion}`;
@@ -4072,26 +4132,44 @@ export const proxyGuardCommand = {
                     logger.always(`[updater] package-manager candidates: ${installerResolution.tried
                         .map((candidate) => `${candidate.kind}:${candidate.bin}(${candidate.installable ? `v${candidate.version}` : (candidate.reason ?? "unusable")})`)
                         .join(", ")}`);
-                    const installer = installerResolution.installer;
+                    // Staging never writes a global package root, including when this
+                    // updater itself already runs from a private immutable package.
+                    const installer = installerResolution.installer ??
+                        installerResolution.tried.find((candidate) => candidate.working);
                     if (!installer) {
-                        const message = "no package manager has a writable global root and executable directory";
+                        const message = "no working package manager is available for a private staged install";
                         logger.always(`[updater] WARNING: ${message}; skipping this cycle`);
                         persistUpdaterState("record update failure", () => recordUpdateFailure(result.latestVersion, "install", message));
                         return;
                     }
                     logger.always(`[updater] installing @juspay/neurolink@${result.latestVersion} via ${installer.kind} ${installer.bin} (v${installer.version})`);
-                    if (guardStopping || getProcessStatus(parentPid) === "not_running") {
+                    if (!isCurrentUpdateOwner()) {
                         return;
                     }
                     try {
-                        execFileSync(installer.bin, getGlobalInstallArgs(installer.kind, `@juspay/neurolink@${result.latestVersion}`), {
-                            timeout: 120_000,
-                            stdio: "pipe",
+                        // Retain a validated rollback even when migrating from a mutable
+                        // global package whose on-disk version already differs from live.
+                        previousPackage = await installStagedProxyPackage({
+                            version: runningVersion,
+                            packagesDir: PROXY_PACKAGES_DIR,
+                            installer,
+                        });
+                        if (!isCurrentUpdateOwner()) {
+                            return;
+                        }
+                        candidatePackage = await installStagedProxyPackage({
+                            version: result.latestVersion,
+                            packagesDir: PROXY_PACKAGES_DIR,
+                            installer,
+                            onProgress: ({ elapsedMs, outputBytes }) => logger.debug(`[updater] staged install progress elapsedMs=${elapsedMs} outputBytes=${outputBytes}`),
                         });
                     }
                     catch (installErr) {
+                        if (!isCurrentUpdateOwner()) {
+                            return;
+                        }
                         const detail = describeInstallFailure(installErr);
-                        logger.always(`[updater] WARNING: global install failed:\n${detail}`);
+                        logger.always(`[updater] WARNING: staged install failed:\n${detail}`);
                         persistUpdaterState("record update failure", () => recordUpdateFailure(result.latestVersion, "install", detail));
                         if (isTransientInstallFailure(installErr)) {
                             scheduleUpdateRetry("transient install failure", result.latestVersion);
@@ -4102,36 +4180,121 @@ export const proxyGuardCommand = {
                 else if (!supervisorRefreshOnly) {
                     logger.always(`[updater] resuming pending restart for already-installed v${result.latestVersion}`);
                 }
+                // Staging can outlive an operator reinstall or owner replacement.
+                // Never publish or roll back another service's package selection.
+                if (!isCurrentUpdateOwner()) {
+                    return;
+                }
                 // 4. Refresh and validate the stable trampoline. The plist already
                 // points at this path, so it must not be unloaded or rewritten here.
                 if (!supervisorRefreshOnly) {
                     try {
-                        writeTrampoline();
+                        previousPackage ??= inspectProxyPackage(process.argv[1]);
+                        candidatePackage ??=
+                            readProxyPackageSelection(PROXY_PACKAGES_DIR) ?? undefined;
+                        if (!candidatePackage ||
+                            candidatePackage.version !== result.latestVersion) {
+                            // A legacy pending marker may refer to an in-place global install.
+                            // Never guess that it is safe or point a launcher at unverified files.
+                            throw new Error("Pending update has no validated staged package; restaging required");
+                        }
+                        if (previousPackage?.version === runningVersion &&
+                            !pendingRestart) {
+                            selectProxyPackage(PROXY_PACKAGES_DIR, previousPackage, isCurrentUpdateOwner);
+                        }
+                        writeTrampoline(candidatePackage, isCurrentUpdateOwner);
                         const validation = await validateInstalledVersion({
                             binPath: TRAMPOLINE_PATH,
                             expectedVersion: result.latestVersion,
                         });
+                        if (!isCurrentUpdateOwner()) {
+                            return;
+                        }
                         if (validation.version !== result.latestVersion) {
                             const message = `trampoline validation failed after ${validation.attempts} attempts: ${validation.failure ?? "unknown failure"}`;
                             logger.always(`[updater] WARNING: ${message}; restart deferred`);
                             persistUpdaterState("record update failure", () => recordUpdateFailure(result.latestVersion, "validation", message));
                             persistUpdaterState("abandon invalid pending update", () => abandonPendingUpdate(result.latestVersion));
+                            if (previousPackage) {
+                                writeTrampoline(previousPackage, isCurrentUpdateOwner);
+                            }
+                            scheduleUpdateRetry("transient candidate validation failure", result.latestVersion);
                             return;
                         }
                         persistUpdaterState("record installed update", () => recordUpdateInstalled(result.latestVersion));
                         logger.always(`[updater] trampoline validated at v${validation.version} after ${validation.attempts} attempt(s)`);
                     }
                     catch (trampolineError) {
+                        if (!isCurrentUpdateOwner()) {
+                            return;
+                        }
                         const message = trampolineError instanceof Error
                             ? trampolineError.message
                             : String(trampolineError);
                         logger.always(`[updater] WARNING: failed to refresh trampoline; refusing restart: ${message}`);
                         persistUpdaterState("record update failure", () => recordUpdateFailure(result.latestVersion, "validation", message));
                         persistUpdaterState("abandon invalid pending update", () => abandonPendingUpdate(result.latestVersion));
+                        if (previousPackage) {
+                            writeTrampoline(previousPackage, isCurrentUpdateOwner);
+                        }
+                        scheduleUpdateRetry("candidate validation failed; restaging permitted", result.latestVersion);
                         return;
                     }
                 }
-                if (guardStopping || getProcessStatus(parentPid) === "not_running") {
+                if (!rollingSupervisor) {
+                    // Staging and validation finish before closing legacy admission.
+                    // A busy service gets a bounded drain attempt and resumes on failure.
+                    let lastDeferralSignature = "";
+                    const waitForWindow = async (quietWaitMs) => {
+                        const window = await waitForProxyUpdateWindow({
+                            quietThresholdMs: QUIET_THRESHOLD_MS,
+                            quietWaitMs,
+                            drainWaitMs: UPDATE_DRAIN_TIMEOUT_MS,
+                            pollIntervalMs: UPDATE_ACTIVITY_POLL_MS,
+                            getActivity: () => getProxyRuntimeActivity(host, port),
+                            setDraining: async (draining) => {
+                                const changed = await setProxyUpdateDrain(host, port, draining);
+                                if (changed) {
+                                    logger.always(`[updater] ${draining ? "draining new inference requests" : "inference admission resumed"}`);
+                                }
+                                return changed;
+                            },
+                            isStopping: () => guardStopping,
+                            isParentAlive: () => getProcessStatus(parentPid) !== "not_running",
+                            onPhase: (phase, activity) => {
+                                const reason = phase === "waiting_for_quiet" && !activity
+                                    ? "activity_unavailable"
+                                    : phase;
+                                const signature = `${reason}:${activity?.activeRequests ?? "unknown"}`;
+                                if (signature !== lastDeferralSignature) {
+                                    lastDeferralSignature = signature;
+                                    persistUpdaterState("record update deferral", () => recordUpdateDeferred(result.latestVersion, reason, activity?.activeRequests ?? null));
+                                }
+                                logger.debug(`[updater] ${reason} (${activity?.activeRequests ?? "unknown"} active requests)`);
+                            },
+                        });
+                        drainActive = drainActive || window.draining;
+                        return window;
+                    };
+                    let updateWindow = await waitForWindow(NATURAL_WINDOW_WAIT_MS);
+                    if (!updateWindow.ready) {
+                        if (updateWindow.reason === "drain_failed") {
+                            persistUpdaterState("record unavailable update drain", () => recordUpdateDeferred(result.latestVersion, "drain_unavailable", null));
+                        }
+                        scheduleUpdateRetry("update window unavailable", result.latestVersion);
+                        return;
+                    }
+                    // Hold admission closed through restart after a quiet
+                    // observation, closing the race with a newly admitted request.
+                    if (!drainActive) {
+                        updateWindow = await waitForWindow(0);
+                        if (!updateWindow.ready) {
+                            scheduleUpdateRetry("update drain unavailable", result.latestVersion);
+                            return;
+                        }
+                    }
+                }
+                if (!isCurrentUpdateOwner()) {
                     return;
                 }
                 updateRestartInProgress = true;
@@ -4143,6 +4306,10 @@ export const proxyGuardCommand = {
                     else {
                         logger.always(`[updater] requesting rolling activation of v${result.latestVersion}`);
                         try {
+                            if (!isCurrentUpdateOwner()) {
+                                updateRestartInProgress = false;
+                                return;
+                            }
                             process.kill(parentPid, "SIGUSR2");
                         }
                         catch (activationError) {
@@ -4254,6 +4421,10 @@ export const proxyGuardCommand = {
                             scheduleUpdateRetry("supervisor refresh window unavailable", result.latestVersion);
                             return;
                         }
+                        if (!isCurrentUpdateOwner()) {
+                            updateRestartInProgress = false;
+                            return;
+                        }
                         logger.always(`[updater] refreshing launchd supervisor at v${result.latestVersion}`);
                         const uid = process.getuid?.() ?? 501;
                         try {
@@ -4312,30 +4483,34 @@ export const proxyGuardCommand = {
                         ? `rolling candidate failed: ${rollingFailure}`
                         : `proxy did not report v${result.latestVersion} healthy within ${UPDATE_TIMEOUT_MS}ms`;
                     if (rollingSupervisor && !supervisorRefreshOnly) {
+                        if (!isCurrentUpdateOwner()) {
+                            updateRestartInProgress = false;
+                            return;
+                        }
                         try {
-                            const rollbackResolution = resolveGlobalInstaller({
-                                entryScript: process.argv[1],
-                            });
-                            const rollbackInstaller = rollbackResolution.installer;
-                            if (!rollbackInstaller) {
-                                throw new Error("no usable package manager is available for rollback");
+                            if (!previousPackage ||
+                                previousPackage.version !== runningVersion) {
+                                throw new Error("Previous validated package selection is unavailable");
                             }
-                            logger.always(`[updater] rolling activation failed; restoring @juspay/neurolink@${runningVersion}`);
-                            execFileSync(rollbackInstaller.bin, getGlobalInstallArgs(rollbackInstaller.kind, `@juspay/neurolink@${runningVersion}`), { timeout: 120_000, stdio: "pipe" });
-                            writeTrampoline();
+                            logger.always(`[updater] restoring immutable package selection v${runningVersion}`);
+                            writeTrampoline(previousPackage, isCurrentUpdateOwner);
                             const rollbackValidation = await validateInstalledVersion({
                                 binPath: TRAMPOLINE_PATH,
                                 expectedVersion: runningVersion,
                             });
                             if (rollbackValidation.version !== runningVersion) {
-                                throw new Error(`rollback trampoline reported v${rollbackValidation.version ?? "unknown"}; expected v${runningVersion}`);
+                                throw new Error(`Rollback selection did not validate as v${runningVersion}`);
                             }
-                            // Reinstalling the old package is not enough: the supervisor was
+                            // Restoring the old package selection is not enough: the supervisor was
                             // told to activate result.latestVersion, so its recovery loop
                             // keeps demanding the new version against the now-downgraded
                             // installation and can never serve a worker again. Re-point the
                             // supervisor at runningVersion and report success only once it
                             // actually serves that version again.
+                            if (!isCurrentUpdateOwner()) {
+                                updateRestartInProgress = false;
+                                return;
+                            }
                             const rollbackActivated = await activateRollbackVersion(host, port, parentPid, runningVersion, UPDATE_TIMEOUT_MS);
                             if (!rollbackActivated) {
                                 throw new Error(`supervisor did not report v${runningVersion} healthy within ${UPDATE_TIMEOUT_MS}ms after rollback`);
@@ -4367,7 +4542,7 @@ export const proxyGuardCommand = {
                 persistUpdaterState("record update failure", () => recordUpdateFailure(updateVersion, "check", message));
             }
             finally {
-                if (drainActive && !updateRestartInProgress) {
+                if (drainActive && !updateRestartInProgress && isCurrentUpdateOwner()) {
                     const resumed = await resumeProxyUpdateDrain(host, port);
                     if (!resumed && getProcessStatus(parentPid) !== "not_running") {
                         logger.always(`[updater] WARNING: failed to resume inference admission after deferred update`);
@@ -4651,10 +4826,8 @@ function buildLaunchdPath() {
     return [...segments].join(":");
 }
 export function buildProxyLaunchdPlist(port, host, envFile, configFile) {
-    // The plist invokes the trampoline script (a tiny shell wrapper at
-    // ~/.neurolink/bin/neurolink-proxy) which re-resolves the real
-    // `neurolink` binary via PATH on every launch.  This way, launchd
-    // is never pinned to a version-specific pnpm store path.
+    // The stable launcher selects an already validated package without
+    // rewriting the launchd service or its inherited runtime environment.
     const trampolinePath = escapeXml(TRAMPOLINE_PATH);
     const envFileArgs = envFile
         ? `
@@ -4666,20 +4839,11 @@ export function buildProxyLaunchdPlist(port, host, envFile, configFile) {
     <string>--config</string>
     <string>${escapeXml(configFile)}</string>`
         : "";
-    const otelEnvironment = isProxyOtelOnly()
-        ? [
-            "NEUROLINK_PROXY_LOG_SINK",
-            "OTEL_EXPORTER_OTLP_ENDPOINT",
-            "OTEL_EXPORTER_OTLP_LOGS_ENDPOINT",
-            "OTEL_EXPORTER_OTLP_HEADERS",
-            "OTEL_EXPORTER_OTLP_LOGS_HEADERS",
-            "OTEL_SERVICE_NAME",
-            "NEUROLINK_PROXY_SESSION_SECRET",
-        ]
-            .filter((name) => process.env[name] !== undefined)
-            .map((name) => `    <key>${name}</key>\n    <string>${escapeXml(process.env[name])}</string>`)
-            .join("\n")
-        : "";
+    const otelEnvironment = Object.keys(process.env)
+        .filter((name) => isProxyServiceEnvironmentKey(name) && process.env[name] !== undefined)
+        .sort()
+        .map((name) => `    <key>${escapeXml(name)}</key>\n    <string>${escapeXml(process.env[name])}</string>`)
+        .join("\n");
     return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
   "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -4742,12 +4906,10 @@ export const proxyInstallCommand = {
             .option("port", {
             type: "number",
             alias: "p",
-            default: 55669,
             description: "Proxy port",
         })
             .option("host", {
             type: "string",
-            default: "127.0.0.1",
             description: "Proxy host",
         })
             .option("env-file", {
@@ -4763,19 +4925,56 @@ export const proxyInstallCommand = {
             .example("neurolink proxy install -p 9000", "Install on custom port");
     },
     handler: async (argv) => {
-        const port = argv.port ?? 55669;
-        const host = argv.host ?? "127.0.0.1";
         if (process.platform !== "darwin") {
             console.info(chalk.red("proxy install is currently macOS-only (uses launchd)."));
             console.info(chalk.yellow("On Linux, use systemd. On Windows, use Task Scheduler."));
             process.exit(1);
         }
+        const existingSupervisor = loadProxySupervisorState();
+        const existingWorker = loadProxyState();
+        assertProxyServiceInstallIdle({
+            pids: [
+                existingSupervisor?.pid,
+                existingWorker?.pid,
+                existingSupervisor?.rolling?.active?.pid,
+                existingSupervisor?.rolling?.candidate?.pid,
+                ...(existingSupervisor?.rolling?.draining?.map((worker) => worker.pid) ?? []),
+            ].filter((pid) => typeof pid === "number"),
+            getProcessStatus,
+            launchdPresence: probeProxyLaunchdPresence({
+                label: PLIST_LABEL,
+                uid: process.getuid?.() ?? 501,
+            }),
+        });
         const { mkdirSync, existsSync, chmodSync } = await import("fs");
+        let savedSettings = parseProxyServiceInstallSettings(null);
+        if (existsSync(PLIST_PATH)) {
+            // Existing runtime values are defaults, never printed. Refuse to rewrite
+            // an unreadable service rather than silently dropping its OTel settings.
+            const { execFileSync } = await import("node:child_process");
+            try {
+                savedSettings = parseProxyServiceInstallSettings(JSON.parse(execFileSync("plutil", ["-convert", "json", "-o", "-", PLIST_PATH], {
+                    encoding: "utf8",
+                    timeout: 5_000,
+                    stdio: ["ignore", "pipe", "pipe"],
+                })));
+            }
+            catch {
+                // Neither captured plutil output nor JSON parse excerpts may expose
+                // stored exporter authorization headers in a reinstall error.
+                throw new Error("Existing proxy service settings could not be read; refusing reinstall before service changes.");
+            }
+            for (const [name, value] of Object.entries(savedSettings.environment)) {
+                process.env[name] ??= value;
+            }
+        }
+        const port = argv.port ?? savedSettings.port ?? 55669;
+        const host = argv.host ?? savedSettings.host ?? "127.0.0.1";
         const envResolution = resolveProxyEnvFile({
-            explicitEnvFile: argv.envFile,
+            explicitEnvFile: argv.envFile ?? savedSettings.envFile,
         });
         const envFile = envResolution.path;
-        const explicitConfig = argv.config;
+        const explicitConfig = argv.config ?? savedSettings.configFile;
         const configPath = resolveProxyConfigPath(explicitConfig);
         if (explicitConfig && !existsSync(configPath)) {
             console.info(chalk.red(`Proxy config file not found: ${configPath}`));
@@ -4796,20 +4995,17 @@ export const proxyInstallCommand = {
         }
         writeTrampoline();
         console.info(chalk.green(`✓ Trampoline written to ${TRAMPOLINE_PATH}`));
-        // Sanity-check: run the trampoline itself and confirm it resolves to
-        // a working neurolink binary. This catches environments where every
-        // PATH-based candidate is broken AND the baked-in path is unreachable.
+        // Validate selected package metadata without initializing the CLI graph.
+        // Worker startup separately proves readiness before accepting traffic.
         const trampolineVersion = probeBinVersion(TRAMPOLINE_PATH);
         if (!trampolineVersion) {
             console.info(chalk.red(`✗ Trampoline validation failed: ${TRAMPOLINE_PATH} --version did not run cleanly.`));
             console.info(chalk.yellow(`  The launchd service would not be able to start neurolink. Fix your install first.`));
-            console.info(chalk.yellow(`  Try: 'pnpm add -g @juspay/neurolink' or set NEUROLINK_BIN=/path/to/working/neurolink.`));
+            console.info(chalk.yellow(`  Inspect the selected package and reinstall the missing version before retrying.`));
             process.exit(1);
         }
         if (trampolineVersion !== PROXY_VERSION) {
-            console.info(chalk.red(`✗ Trampoline resolves to v${trampolineVersion} but this installer is v${PROXY_VERSION}.`));
-            console.info(chalk.yellow(`  PATH may shadow this installation with an older version. Fix your PATH or set NEUROLINK_BIN.`));
-            process.exit(1);
+            console.info(chalk.yellow(`Retaining selected proxy package v${trampolineVersion}; this service installer is v${PROXY_VERSION}.`));
         }
         console.info(chalk.green(`✓ Trampoline validated (resolves to neurolink v${trampolineVersion})`));
         const plist = buildProxyLaunchdPlist(port, host, envFile, configFile);