@ours.network/install 1.2.1-nightly.40 → 1.2.1-nightly.42

package/README.md

@@ -314,6 +314,24 @@ build. `server status` reports the pending phase; `server stop` remains availabl
 Other mutations refuse until activation completes. There is no automatic rollback
 of application state after publication.
 
+For Docker updates interrupted by the Notifications provenance omission in older
+installers, use an installer containing the recovery helper and resume with
+`ours-install server update --mode docker --state-dir /path/to/installation --compatible`.
+Retain any original `--sources` input; do not substitute a newer candidate.
+This uses the compatibility attestation saved in the pending update. Passing the
+flag again cannot authorize a transition that did not originally record it.
+The helper requires the four core markers to match the retained candidate and
+Notifications to match its retained previous build, including every recorded
+context, lockfile and dependency-tree byte. It preserves a Notifications-only
+backup with the original provenance, repairs that marker atomically with the
+complete state tree, and resumes preparation and the original running subset.
+It also recognizes a completed state exchange whose journal still says `prepared`;
+untouched source state continues through normal migration. Missing retained
+evidence, arbitrary mixed generations, unsafe files and unclean service exits
+remain errors. Keep the installation, candidate and backups intact on refusal.
+An `all update` requires a running daemon for client verification, so complete
+this server recovery first, then repeat `all update` to refresh clients.
+
 
 New builds retain `build-context.json` alongside their original lockfile and dependency
 tree. The context binds the original record bytes to verified vendor tar names,
@@ -637,7 +655,7 @@ Existing installation records keep their ports and identities. A listener acquir
 by another process after preflight still causes startup to fail safely; no foreign
 process is stopped and no retained installation is silently moved.
 
-Workspace setup pins Fleet `1.2.0-nightly.52` with its recorded registry integrity. This release includes first-time Fleet setup through the host API for the account App, direct App access to the workspace services with the device credential, v2 positional one-use grants and automatic QR/connection-code output from `ours-fleet setup-tunnel`, optional private file/stdin inputs for legacy v1 payloads, a separate `ours-fleet link-device` command for additional devices, host prerequisite checks before the one-time workspace proof (`setup-tunnel --check`), `setup-tunnel --resume` to finish a setup that stopped after the host saved its private pending setup record (not when the proof's answer was lost, or after the setup window expired with an unconfirmed non-default port), and persists the available Fleet loopback port used by the workspace tunnel. It also accepts a setup-generated configuration left behind after the host enrollment state was removed, runs the host Codex when it is at least as new as the packaged one, offers only the Codex models the signed-in account can use, and removes the temporary setup contact after confirmation. Fleet serves no pages and opens no browser: every screen is in the App. Fleet also serves the workspace notification routes, produces notifications through the server gateway with the imported producer credential, accepts the App's device credential on the notification presence socket so an open App receives no push, and defaults agent wakes to `monitor.interrupt: after_tool` (Hermes: no interrupt; role snapshots saved before this default keep no interrupt). Existing installation identities and configured ports remain retained; a retained-port collision fails safely.
+Workspace setup pins Fleet `1.2.0-nightly.54` with its recorded registry integrity. This release includes first-time Fleet setup through the host API for the account App, direct App access to the workspace services with the device credential, v2 positional one-use grants and automatic QR/connection-code output from `ours-fleet setup-tunnel`, optional private file/stdin inputs for legacy v1 payloads, a separate `ours-fleet link-device` command for additional devices, host prerequisite checks before the one-time workspace proof (`setup-tunnel --check`), `setup-tunnel --resume` to finish a setup that stopped after the host saved its private pending setup record (not when the proof's answer was lost, or after the setup window expired with an unconfirmed non-default port), and persists the available Fleet loopback port used by the workspace tunnel. It also accepts a setup-generated configuration left behind after the host enrollment state was removed, runs the host Codex when it is at least as new as the packaged one, offers only the Codex models the signed-in account can use, and removes the temporary setup contact after confirmation. Fleet serves no pages and opens no browser: every screen is in the App. Fleet also serves the workspace notification routes, produces notifications through the server gateway with the imported producer credential, accepts the App's device credential on the notification presence socket so an open App receives no push, and defaults agent wakes to `monitor.interrupt: after_tool` (Hermes: no interrupt; role snapshots saved before this default keep no interrupt). Existing installation identities and configured ports remain retained; a retained-port collision fails safely.
 
 ### App tunnel setup prerelease sequencing
 
@@ -654,7 +672,7 @@ connection code automatically; the App checks readiness and opens the code field
 Private `--file`/`--stdin` transports remain optional and are the only transports
 for legacy v1 payloads with long-lived credentials.
 
-The nightly installer release manifest selects published Fleet `1.2.0-nightly.52`
+The nightly installer release manifest selects published Fleet `1.2.0-nightly.54`
 and its actual registry integrity through the normal release manifest/source-policy
 generators. This release includes v2 argument and private-input support. The former
 nightly.41 selection predates this capability. Merge and publish the repinned

package/assets/release-lock.json

@@ -8,13 +8,13 @@
       "name": "ours-release-set-verification",
       "version": "0.0.0",
       "dependencies": {
-        "@ours.network/claude-code": "1.2.0-nightly.12",
+        "@ours.network/claude-code": "1.2.0-nightly.13",
         "@ours.network/cli": "2.8.1-nightly.15",
-        "@ours.network/codex": "1.2.0-nightly.12",
+        "@ours.network/codex": "1.2.0-nightly.13",
         "@ours.network/cowork": "1.3.3-nightly.20261005.f549477",
         "@ours.network/daemon": "3.8.1-nightly.9",
-        "@ours.network/fleet": "1.2.0-nightly.52",
-        "@ours.network/mcp": "1.2.0-nightly.12",
+        "@ours.network/fleet": "1.2.0-nightly.54",
+        "@ours.network/mcp": "1.2.0-nightly.13",
         "@ours.network/messenger-server": "1.0.31-nightly.17",
         "@ours.network/notifications": "0.3.1-nightly.2",
         "@ours.network/sdk": "3.8.1-nightly.17",
@@ -908,13 +908,13 @@
       }
     },
     "node_modules/@ours.network/claude-code": {
-      "version": "1.2.0-nightly.12",
-      "resolved": "https://registry.npmjs.org/@ours.network/claude-code/-/claude-code-1.2.0-nightly.12.tgz",
-      "integrity": "sha512-122cnztQqVkXvXy4y4zJQAVVD5gBTqdj5gkf2dTVnR/g0Nzw5uBxdch0xkhyluqmjN74MHuklv2YRr9Gs8vbbQ==",
+      "version": "1.2.0-nightly.13",
+      "resolved": "https://registry.npmjs.org/@ours.network/claude-code/-/claude-code-1.2.0-nightly.13.tgz",
+      "integrity": "sha512-KnVGMyZAL9i8vqFTvI3V6OEpbOqk4YH106jfeB0JlTCRkk0Oy5H1rx764GucIxmYCiasAF1NKExHe2tDLlmiXQ==",
       "license": "FSL-1.1-Apache-2.0",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0",
-        "@ours.network/mcp": "1.2.0-nightly.12",
+        "@ours.network/mcp": "1.2.0-nightly.13",
         "@ours.network/sdk": "3.8.1-nightly.17",
         "ws": "^8.21.0",
         "zod": "^3.25.76"
@@ -939,13 +939,13 @@
       }
     },
     "node_modules/@ours.network/codex": {
-      "version": "1.2.0-nightly.12",
-      "resolved": "https://registry.npmjs.org/@ours.network/codex/-/codex-1.2.0-nightly.12.tgz",
-      "integrity": "sha512-O3emBbe4KXfD9nDsgjN3Z8J11aSMz4KAdiZo4EPZIqEypOXCaRnbZqpuJpd14FZpFHSHGEfel6KgP0mZYFYtRA==",
+      "version": "1.2.0-nightly.13",
+      "resolved": "https://registry.npmjs.org/@ours.network/codex/-/codex-1.2.0-nightly.13.tgz",
+      "integrity": "sha512-m5tcTu6QoMhrcrKgglTyG+nxe1nwRLc2t7nPJcjVRqf/5m8e9CRGqXssrioOAS/wD7qGKl2jPVwJr/0ZmMltVQ==",
       "license": "FSL-1.1-Apache-2.0",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0",
-        "@ours.network/mcp": "1.2.0-nightly.12",
+        "@ours.network/mcp": "1.2.0-nightly.13",
         "@ours.network/sdk": "3.8.1-nightly.17",
         "ws": "^8.21.0",
         "zod": "^3.25.76"
@@ -1002,15 +1002,15 @@
       }
     },
     "node_modules/@ours.network/fleet": {
-      "version": "1.2.0-nightly.52",
-      "resolved": "https://registry.npmjs.org/@ours.network/fleet/-/fleet-1.2.0-nightly.52.tgz",
-      "integrity": "sha512-nIwGknps0FBDhdtivXAFalRbZ67XHAdNcs6AiTBE0ULYeLcohdfqoFqyAS0iZQPUeEUhxkPTKfVuESKeQKP/ow==",
+      "version": "1.2.0-nightly.54",
+      "resolved": "https://registry.npmjs.org/@ours.network/fleet/-/fleet-1.2.0-nightly.54.tgz",
+      "integrity": "sha512-Sh3t8iRGBoYzbyslS+IKuqQ573Zn+M0GVhR0cGepy/hlyNMAwXD2TBM+j7d8QiA1+ALugkMhKnanivE97JBmhQ==",
       "license": "FSL-1.1-Apache-2.0",
       "dependencies": {
         "@agentclientprotocol/sdk": "^1.3.0",
         "@fastify/websocket": "^11.2.0",
         "@ours.network/cli": "2.8.1-nightly.15",
-        "@ours.network/mcp": "1.2.0-nightly.12",
+        "@ours.network/mcp": "1.2.0-nightly.13",
         "@ours.network/sdk": "3.8.1-nightly.17",
         "commander": "^12.1.0",
         "fastify": "^5.4.0",
@@ -1031,12 +1031,12 @@
       }
     },
     "node_modules/@ours.network/mcp": {
-      "version": "1.2.0-nightly.12",
-      "resolved": "https://registry.npmjs.org/@ours.network/mcp/-/mcp-1.2.0-nightly.12.tgz",
-      "integrity": "sha512-ZvwCaIgMaMcUrLhWNaWWOErIHwtvQyOZHfophf+rrjnlG0eBpBwmwQPuABS7jPuQvi69pBIT4jUWN3CArgxzRQ==",
+      "version": "1.2.0-nightly.13",
+      "resolved": "https://registry.npmjs.org/@ours.network/mcp/-/mcp-1.2.0-nightly.13.tgz",
+      "integrity": "sha512-/SxWOeiQfOu0i+jV3su2khYQ4eUCH+exe6CjSUZ9u5FmTUfXmg7cBnPOzFT2PKbNulsSLf9vnU+QBGBwSa/Iag==",
       "license": "FSL-1.1-Apache-2.0",
       "dependencies": {
-        "@modelcontextprotocol/sdk": "^1.0.4",
+        "@modelcontextprotocol/sdk": "^1.29.0",
         "@ours.network/sdk": "3.8.1-nightly.17",
         "zod": "^3.23.8"
       },

package/assets/release.json

@@ -1,7 +1,7 @@
 {
   "schema": 1,
   "channel": "nightly",
-  "installerVersion": "1.2.1-nightly.40",
+  "installerVersion": "1.2.1-nightly.42",
   "packages": {
     "@ours.network/sdk": {
       "version": "3.8.1-nightly.17",
@@ -28,20 +28,20 @@
       "integrity": "sha512-OjnrJ8ZuOfKYT4KAmiRLU7czfiuacs6rShwOvvqxqBaUKcs1UwjsYwHARNb6erMxG4am3xxcE0ItahL+d2vt4A=="
     },
     "@ours.network/fleet": {
-      "version": "1.2.0-nightly.52",
-      "integrity": "sha512-nIwGknps0FBDhdtivXAFalRbZ67XHAdNcs6AiTBE0ULYeLcohdfqoFqyAS0iZQPUeEUhxkPTKfVuESKeQKP/ow=="
+      "version": "1.2.0-nightly.54",
+      "integrity": "sha512-Sh3t8iRGBoYzbyslS+IKuqQ573Zn+M0GVhR0cGepy/hlyNMAwXD2TBM+j7d8QiA1+ALugkMhKnanivE97JBmhQ=="
     },
     "@ours.network/mcp": {
-      "version": "1.2.0-nightly.12",
-      "integrity": "sha512-ZvwCaIgMaMcUrLhWNaWWOErIHwtvQyOZHfophf+rrjnlG0eBpBwmwQPuABS7jPuQvi69pBIT4jUWN3CArgxzRQ=="
+      "version": "1.2.0-nightly.13",
+      "integrity": "sha512-/SxWOeiQfOu0i+jV3su2khYQ4eUCH+exe6CjSUZ9u5FmTUfXmg7cBnPOzFT2PKbNulsSLf9vnU+QBGBwSa/Iag=="
     },
     "@ours.network/codex": {
-      "version": "1.2.0-nightly.12",
-      "integrity": "sha512-O3emBbe4KXfD9nDsgjN3Z8J11aSMz4KAdiZo4EPZIqEypOXCaRnbZqpuJpd14FZpFHSHGEfel6KgP0mZYFYtRA=="
+      "version": "1.2.0-nightly.13",
+      "integrity": "sha512-m5tcTu6QoMhrcrKgglTyG+nxe1nwRLc2t7nPJcjVRqf/5m8e9CRGqXssrioOAS/wD7qGKl2jPVwJr/0ZmMltVQ=="
     },
     "@ours.network/claude-code": {
-      "version": "1.2.0-nightly.12",
-      "integrity": "sha512-122cnztQqVkXvXy4y4zJQAVVD5gBTqdj5gkf2dTVnR/g0Nzw5uBxdch0xkhyluqmjN74MHuklv2YRr9Gs8vbbQ=="
+      "version": "1.2.0-nightly.13",
+      "integrity": "sha512-KnVGMyZAL9i8vqFTvI3V6OEpbOqk4YH106jfeB0JlTCRkk0Oy5H1rx764GucIxmYCiasAF1NKExHe2tDLlmiXQ=="
     },
     "@ours.network/daemon": {
       "version": "3.8.1-nightly.9",

package/assets/scripts/maintenance/recover-notifications.mjs

@@ -0,0 +1,36 @@
+/** Non-secret retained build evidence arrives on stdin, never in argv/env. */
+import * as fs from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { runStateOperation } from './state-operation.mjs';
+
+// The shipped state-operation service is read_only without a /tmp tmpfs, and
+// retained Compose definitions cannot gain one. /dev/shm stays a writable
+// in-memory mount there, so evidence never enters the stored-state volume.
+function scratch() {
+  for (const base of [tmpdir(), '/dev/shm']) {
+    try { return fs.mkdtempSync(join(base, 'ours-notifications-recovery-')); }
+    catch (error) { if (!['EROFS', 'EACCES', 'ENOENT'].includes(error.code)) throw error; }
+  }
+  throw new Error('No writable private scratch directory for recovery evidence');
+}
+const root = scratch();
+fs.chmodSync(root, 0o700);
+try {
+  const evidence = JSON.parse(fs.readFileSync(0, 'utf8'));
+  if (!evidence || Object.keys(evidence).sort().join(',') !== 'phase,previous,target'
+    || !['prepared', 'state-updated', 'runtime-activated'].includes(evidence.phase)) throw new Error('Invalid recovery evidence');
+  for (const name of ['previous', 'target']) {
+    const records = evidence[name], names = Object.keys(records).sort();
+    if (!['dependency-tree.json,package-lock.json', 'build-context.json,dependency-tree.json,package-lock.json'].includes(names.join(','))) throw new Error('Invalid recovery record set');
+    const directory = join(root, name); fs.mkdirSync(directory, { mode: 0o700 });
+    for (const file of names) {
+      if (typeof records[file] !== 'string') throw new Error('Invalid recovery record bytes');
+      fs.writeFileSync(join(directory, file), Buffer.from(records[file], 'base64'), { flag: 'wx', mode: 0o600 });
+    }
+  }
+  const result = await runStateOperation(['recover-notifications', 'server', '--compatible'], {
+    ...process.env, OURS_PREVIOUS_BUILD_ROOT: join(root, 'previous'), OURS_EXPECTED_BUILD_ROOT: join(root, 'target'), OURS_RECOVERY_PHASE: evidence.phase,
+  });
+  console.log(JSON.stringify(result));
+} finally { fs.rmSync(root, { recursive: true }); }

package/assets/scripts/maintenance/state-operation.mjs

@@ -37,11 +37,12 @@ export async function runStateOperation(argv, env = process.env, checkpoints = {
   const operation = argv[0];
   const paired = domain === 'daemon' && ['backup', 'restore', 'reset'].includes(operation);
   const commonTree = domain === 'server' || paired;
-  if (compatible && !['restore', 'update'].includes(operation)) fail('compatibility attestation applies only to update or restore');
-  if (domain === 'server' && !['backup', 'restore', 'update', 'rebuild'].includes(operation)) fail('full-server scope supports only backup, restore, update and rebuild');
+  const recovery = operation === 'recover-notifications' && domain === 'server' && compatible;
+  if (compatible && !['restore', 'update'].includes(operation) && !recovery) fail('compatibility attestation applies only to update or restore');
+  if (domain === 'server' && !['backup', 'restore', 'update', 'rebuild'].includes(operation) && !recovery) fail('full-server scope supports only backup, restore, update and rebuild');
   if (operation === 'rebuild' && domain !== 'server') fail('rebuild selects the complete server');
   const adopt = operation === 'init' && argv[2] === '--adopt-existing';
-  const valid = (['init', 'update', 'rebuild'].includes(operation) && argv.length === 2) || (adopt && argv.length === 3) || (['backup', 'restore'].includes(operation) && argv.length === 3) || (operation === 'reset' && argv.length === 3 && argv[2] === '--confirm');
+  const valid = ((['init', 'update', 'rebuild'].includes(operation) || recovery) && argv.length === 2) || (adopt && argv.length === 3) || (['backup', 'restore'].includes(operation) && argv.length === 3) || (operation === 'reset' && argv.length === 3 && argv[2] === '--confirm');
   if (!valid) fail('usage: init DOMAIN | backup DOMAIN LABEL | restore DOMAIN LABEL | reset DOMAIN --confirm | update DOMAIN');
   const uid = process.getuid(), gid = process.getgid();
   if (!uid || !gid) fail('state maintenance requires a non-root UID and GID');
@@ -184,6 +185,52 @@ export async function runStateOperation(argv, env = process.env, checkpoints = {
     try { if (!sameInode(fs.fstatSync(fd), fs.fstatSync(check))) fail('domain state changed while acquiring its lock'); }
     finally { fs.closeSync(check); }
     let records;
+    if (recovery) {
+      // Only the installer supplies the retained transition's previous and
+      // candidate records. Never infer compatibility from a mixed live tree.
+      const previous = readRecords(selected('OURS_PREVIOUS_BUILD_ROOT'), false);
+      const expected = readRecords(selected('OURS_EXPECTED_BUILD_ROOT'), false);
+      if (!sameRecords(target, expected)) fail('recovery runtime differs from the retained candidate');
+      const core = APPLICATIONS.map(name => readRecords(join(live, name, PROVENANCE)));
+      const oldCore = core.every(records => sameRecords(records, previous));
+      const newCore = core.every(records => sameRecords(records, target));
+      if (!newCore && !(env.OURS_RECOVERY_PHASE === 'prepared' && oldCore)) fail('recovery core provenance differs from the retained candidate');
+      for (const name of ['mcp', 'credentials']) privateStat(join(live, name), true, 0o700);
+      const notifications = join(live, 'notifications'), marker = join(notifications, PROVENANCE);
+      if (!exists(notifications)) return { stateUpdated: newCore };
+      privateStat(notifications, true, 0o700);
+      if (!exists(marker)) { scanSource(notifications, { uid, gid }); return { stateUpdated: newCore }; }
+      privateStat(marker, true, 0o700);
+      if (!fs.readdirSync(marker).length) { scanSource(notifications, { uid, gid }); return { stateUpdated: newCore }; }
+      const retained = readRecords(marker);
+      if (newCore && sameRecords(retained, target)) return { stateUpdated: true }; // Already repaired, including retries after exchange.
+      if (!sameRecords(retained, previous)) fail('recovery notification provenance differs from the retained previous build');
+      if (!newCore) return { stateUpdated: false }; // Prepared journal with untouched state: use the regular state operation.
+      prepare(); layout();
+      const archive = labelPath(`pre-notifications-recovery-${new Date().toISOString().replace(/[-:.]/g, '')}-${randomBytes(4).toString('hex')}`);
+      checkpoints.beforeBackup?.();
+      await createArchive(notifications, archive, { domain: 'notifications', uid, gid, provenance: previous });
+      checkpoints.afterBackup?.();
+      const staging = join(maintenance, `recovery-${randomBytes(12).toString('hex')}`);
+      try {
+        const entries = scanSource(live, { uid, gid });
+        copyTree(live, staging);
+        // Ordinary maintenance emits private copies; recovery retains every
+        // accepted payload mode and timestamp outside the replaced marker.
+        for (const entry of entries.reverse()) {
+          const path = entry.name === 'state' ? staging : join(staging, entry.name.slice(6));
+          fs.chmodSync(path, Number(entry.st.mode) & 0o777);
+          setMtimeNs(path, entry.st.mtimeNs);
+        }
+        const replacement = join(staging, 'notifications', PROVENANCE);
+        fs.rmSync(replacement, { recursive: true }); mkdir(replacement);
+        for (const name of recordNames(target)) writeRecord(join(replacement, name), target[name]);
+        setMtimeNs(dirname(replacement), fs.lstatSync(notifications, { bigint: true }).mtimeNs);
+        validateTree(staging, target);
+        replace(staging);
+      } finally { if (exists(staging)) fs.rmSync(staging, { recursive: true }); }
+      return { stateUpdated: true };
+    }
     if (domain === 'server') { records = readRecords(join(live, 'daemon', PROVENANCE)); validateTree(live, records); }
     else if (paired) { records = readRecords(join(live, 'daemon', PROVENANCE)); privateStat(join(live, 'mcp'), true, 0o700); }
     else if (operation !== 'init') records = readRecords(join(live, PROVENANCE));

package/assets/sources.json

@@ -2,7 +2,7 @@
   "release": {
     "schema": 1,
     "channel": "nightly",
-    "installerVersion": "1.2.1-nightly.40",
+    "installerVersion": "1.2.1-nightly.42",
     "packages": {
       "@ours.network/sdk": {
         "version": "3.8.1-nightly.17",
@@ -29,20 +29,20 @@
         "integrity": "sha512-OjnrJ8ZuOfKYT4KAmiRLU7czfiuacs6rShwOvvqxqBaUKcs1UwjsYwHARNb6erMxG4am3xxcE0ItahL+d2vt4A=="
       },
       "@ours.network/fleet": {
-        "version": "1.2.0-nightly.52",
-        "integrity": "sha512-nIwGknps0FBDhdtivXAFalRbZ67XHAdNcs6AiTBE0ULYeLcohdfqoFqyAS0iZQPUeEUhxkPTKfVuESKeQKP/ow=="
+        "version": "1.2.0-nightly.54",
+        "integrity": "sha512-Sh3t8iRGBoYzbyslS+IKuqQ573Zn+M0GVhR0cGepy/hlyNMAwXD2TBM+j7d8QiA1+ALugkMhKnanivE97JBmhQ=="
       },
       "@ours.network/mcp": {
-        "version": "1.2.0-nightly.12",
-        "integrity": "sha512-ZvwCaIgMaMcUrLhWNaWWOErIHwtvQyOZHfophf+rrjnlG0eBpBwmwQPuABS7jPuQvi69pBIT4jUWN3CArgxzRQ=="
+        "version": "1.2.0-nightly.13",
+        "integrity": "sha512-/SxWOeiQfOu0i+jV3su2khYQ4eUCH+exe6CjSUZ9u5FmTUfXmg7cBnPOzFT2PKbNulsSLf9vnU+QBGBwSa/Iag=="
       },
       "@ours.network/codex": {
-        "version": "1.2.0-nightly.12",
-        "integrity": "sha512-O3emBbe4KXfD9nDsgjN3Z8J11aSMz4KAdiZo4EPZIqEypOXCaRnbZqpuJpd14FZpFHSHGEfel6KgP0mZYFYtRA=="
+        "version": "1.2.0-nightly.13",
+        "integrity": "sha512-m5tcTu6QoMhrcrKgglTyG+nxe1nwRLc2t7nPJcjVRqf/5m8e9CRGqXssrioOAS/wD7qGKl2jPVwJr/0ZmMltVQ=="
       },
       "@ours.network/claude-code": {
-        "version": "1.2.0-nightly.12",
-        "integrity": "sha512-122cnztQqVkXvXy4y4zJQAVVD5gBTqdj5gkf2dTVnR/g0Nzw5uBxdch0xkhyluqmjN74MHuklv2YRr9Gs8vbbQ=="
+        "version": "1.2.0-nightly.13",
+        "integrity": "sha512-KnVGMyZAL9i8vqFTvI3V6OEpbOqk4YH106jfeB0JlTCRkk0Oy5H1rx764GucIxmYCiasAF1NKExHe2tDLlmiXQ=="
       },
       "@ours.network/daemon": {
         "version": "3.8.1-nightly.9",
@@ -87,19 +87,19 @@
     },
     "@ours.network/fleet": {
       "type": "npm",
-      "version": "1.2.0-nightly.52"
+      "version": "1.2.0-nightly.54"
     },
     "@ours.network/mcp": {
       "type": "npm",
-      "version": "1.2.0-nightly.12"
+      "version": "1.2.0-nightly.13"
     },
     "@ours.network/codex": {
       "type": "npm",
-      "version": "1.2.0-nightly.12"
+      "version": "1.2.0-nightly.13"
     },
     "@ours.network/claude-code": {
       "type": "npm",
-      "version": "1.2.0-nightly.12"
+      "version": "1.2.0-nightly.13"
     },
     "@ours.network/daemon": {
       "type": "npm",

package/lib/build-transition.mjs

@@ -19,6 +19,7 @@ export async function serverBuildTransition(record, args, effects) {
     effects.writeJson(path, JSON.stringify(record, null, 2) + '\n');
   };
   let transition = record.buildTransition;
+  const resuming = !!transition;
   if (!transition) {
     const candidate = await stage('Prepare the updated runtime', () => effects.prepareServerBuild(record, args));
     try {
@@ -41,11 +42,23 @@ export async function serverBuildTransition(record, args, effects) {
   // A failed readiness check can leave some new services running. Every retry
   // excludes those writers again and retains the original requested running set.
   await stage('Stop services before updating stored state', () => effects.retireServerBuildRuntime(record));
+  const recover = resuming && record.mode === 'docker' && transition.operation === 'update' && transition.compatible;
+  if (recover && transition.phase === 'prepared'
+    && await stage('Verify and recover retained Notifications provenance', () => effects.recoverServerBuildNotifications(record, candidate, 'prepared'))) {
+    transition = { ...transition, phase: 'state-updated' };
+    save(transition);
+  }
   if (transition.phase === 'prepared') {
     await stage('Update stored state while retaining identities and credentials', () => effects.updateServerBuildState(record, candidate, transition.compatible, transition.operation));
     transition = { ...transition, phase: 'state-updated' };
     save(transition);
   }
+  // Old installers omitted Notifications from the already completed state
+  // operation. The shipped helper validates both retained generations before
+  // repairing that one domain; the candidate and all lifecycle guards remain.
+  if (recover) {
+    await stage('Verify and recover retained Notifications provenance', () => effects.recoverServerBuildNotifications(record, candidate, transition.phase));
+  }
   if (transition.phase === 'state-updated') {
     await stage('Activate the prepared runtime', () => effects.publishServerBuild(record, candidate));
     transition = { ...transition, phase: 'runtime-activated' };

package/lib/effects.mjs

@@ -408,7 +408,7 @@ export function realEffects({ write, ttyFd, env = process.env, home = homedir(),
     // invocation only and never to the installer's own process: a state
     // directory selected by one run must not leak into anything the operator
     // starts afterwards.
-    run: async (cmd, args, { env: extraEnv = null, stream = false, cwd, sensitive = false, allowCodes = [], timeout } = {}) => {
+    run: async (cmd, args, { env: extraEnv = null, stream = false, cwd, sensitive = false, allowCodes = [], timeout, input } = {}) => {
       // Always built from this layer's OWN env rather than left to spawnSync's
       // implicit inheritance, so what a child receives is a property of the
       // effects object a caller constructed and not of whatever ambient shell
@@ -421,7 +421,8 @@ export function realEffects({ write, ttyFd, env = process.env, home = homedir(),
         cwd,
         timeout,
         encoding: 'utf8',
-        stdio: [...(stream ? ['ignore', 'inherit', 'inherit'] : ['ignore', 'pipe', 'pipe']), ...(installationLockFd === null ? [] : [installationLockFd])],
+        input,
+        stdio: [...(stream ? [input === undefined ? 'ignore' : 'pipe', 'inherit', 'inherit'] : [input === undefined ? 'ignore' : 'pipe', 'pipe', 'pipe']), ...(installationLockFd === null ? [] : [installationLockFd])],
         env: childEnv,
       });
       if (r.error) {
@@ -1002,6 +1003,38 @@ export function networkEffects(effects) {
         });
       }
     },
+    async recoverServerBuildNotifications(record, candidate, phase) {
+      const transition = record.buildTransition;
+      if (record.mode !== 'docker' || transition?.operation !== 'update' || !transition.compatible
+        || !['prepared', 'state-updated', 'runtime-activated'].includes(phase)
+        || transition.phase !== phase
+        || transition.candidate.root !== candidate.root) throw new Error('Notifications recovery requires the retained compatible Docker update');
+      const previous = join(candidate.root, 'previous-build');
+      privateDirectory(previous);
+      let active = phase === 'runtime-activated' ? record.workDir : candidate.workDir;
+      // Publication can move both directories before its journal save. Resume
+      // from the protected active copy only when the previous runtime was kept.
+      if (phase === 'state-updated' && !existsSync(candidate.workDir)) {
+        privateDirectory(join(candidate.root, 'previous-runtime'));
+        active = record.workDir;
+      }
+      privateDirectory(active);
+      const encode = directory => Object.fromEntries(Object.entries(readBuildRecords(directory, { privateFiles: true })).map(([name, bytes]) => [name, bytes.toString('base64')]));
+      const input = JSON.stringify({ phase, previous: encode(previous), target: encode(active) });
+      // Execute shipped maintenance against the retained image and its selected
+      // volume/user contract. No image retag, build replacement or host bind mount.
+      const source = readFileSync(join(INSTALLER_ASSETS, 'scripts/maintenance/state-operation.mjs'), 'utf8')
+        .replaceAll("from './", "from 'file:///opt/ours/docker/");
+      const module = `data:text/javascript;base64,${Buffer.from(source).toString('base64')}`;
+      const helper = readFileSync(join(INSTALLER_ASSETS, 'scripts/maintenance/recover-notifications.mjs'), 'utf8')
+        .replace("'./state-operation.mjs'", JSON.stringify(module));
+      const result = await compose({ ...record, workDir: active }, ['run', '--rm', '--no-deps', '-T', '--entrypoint', 'node', 'state-operation', '--input-type=module', '-e', helper], {
+        input, env: { OURS_MAINTENANCE_IMAGE: `${candidate.project}:maintenance`, OURS_STATE_DOMAIN: 'server', OURS_LIVE_ROOT: '/storage/state' },
+      });
+      const recovered = JSON.parse(result.stdout);
+      if (!recovered || Object.keys(recovered).join(',') !== 'stateUpdated' || typeof recovered.stateUpdated !== 'boolean') throw new Error('Invalid Notifications recovery result');
+      return recovered.stateUpdated;
+    },
     async publishServerBuild(record, candidate) {
       const previous = join(candidate.root, 'previous-runtime');
       if (record.mode === 'docker') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/install",
-  "version": "1.2.1-nightly.40",
+  "version": "1.2.1-nightly.42",
   "private": false,
   "description": "The all-in-one ours.network installer: one shared daemon, MCP, cowork, Telegram, Fleet initialization, harness plugins, Human identity, progress UI, and guided next steps.",
   "type": "module",