@p4code/cli 0.2.4 → 0.2.5

package/dist/bin.mjs

@@ -237,7 +237,7 @@ const make$87 = () => {
 const layer$79 = Layer.sync(NetService, make$87);
 //#endregion
 //#region package.json
-var version = "0.2.4";
+var version = "0.2.5";
 //#endregion
 //#region src/config.ts
 /**
@@ -964,6 +964,41 @@ const PortSchema = Schema$1.Int.check(Schema$1.isBetween({
 }));
 const IsoDateTime = Schema$1.String;
 /**
+* Wire codec for server→client arrays whose element unions grow over time (new
+* literal members, new struct variants). Decoding drops elements this build
+* cannot decode instead of failing the whole payload — a client has to keep
+* decoding configs sent by servers newer than itself, and rejecting the payload
+* would take the connection down over data the client could not act on anyway.
+* Encoding is the plain array encoding.
+*/
+const ForwardCompatibleArray = (element) => {
+	const decodeElement = Schema$1.decodeUnknownOption(element);
+	return Schema$1.Array(Schema$1.Unknown).pipe(Schema$1.decodeTo(Schema$1.Array(element), SchemaTransformation.transform({
+		decode: (values) => values.filter((value) => Option.isSome(decodeElement(value))),
+		encode: (values) => values
+	})));
+};
+/**
+* Wire codec for a scalar literal union that grows over time.
+*
+* The sibling of {@link ForwardCompatibleArray}, for the case where the union
+* is a field inside a struct rather than an array element: dropping the value
+* is not an option, so an unrecognised literal decodes to `fallback` instead of
+* failing the struct - and with it every struct that contains it.
+*
+* The fallback has to be a member this build already renders as "nothing
+* actionable here", never one that asserts something specific about a state
+* this build cannot know.
+*/
+const LiteralWithFallback = (members, fallback) => {
+	const literals = Schema$1.Literals(members);
+	const decodeLiteral = Schema$1.decodeUnknownOption(literals);
+	return Schema$1.String.pipe(Schema$1.decodeTo(literals, SchemaTransformation.transform({
+		decode: (value) => Option.isSome(decodeLiteral(value)) ? value : fallback,
+		encode: (value) => value
+	})));
+};
+/**
 * Construct a branded identifier. Enforces non-empty trimmed strings
 */
 const makeEntityId = (brand) => {
@@ -8018,19 +8053,18 @@ const KeybindingsInvalidEntryIssue = Schema$1.Struct({
 	message: TrimmedNonEmptyString,
 	index: Schema$1.Number
 });
-const ServerConfigIssue = Schema$1.Union([KeybindingsMalformedConfigIssue, KeybindingsInvalidEntryIssue]);
-const ServerConfigIssues = Schema$1.Array(ServerConfigIssue);
-const ServerProviderState = Schema$1.Literals([
+const ServerConfigIssues = ForwardCompatibleArray(Schema$1.Union([KeybindingsMalformedConfigIssue, KeybindingsInvalidEntryIssue]));
+const ServerProviderState = LiteralWithFallback([
 	"ready",
 	"warning",
 	"error",
 	"disabled"
-]);
-const ServerProviderAuthStatus = Schema$1.Literals([
+], "warning");
+const ServerProviderAuthStatus = LiteralWithFallback([
 	"authenticated",
 	"unauthenticated",
 	"unknown"
-]);
+], "unknown");
 const ServerProviderAuth = Schema$1.Struct({
 	status: ServerProviderAuthStatus,
 	type: Schema$1.optional(TrimmedNonEmptyString),
@@ -8080,11 +8114,11 @@ const ServerProviderSkill = Schema$1.Struct({
 */
 const ServerProviderAvailability = Schema$1.Literals(["available", "unavailable"]);
 const ServerProviderContinuation = Schema$1.Struct({ groupKey: TrimmedNonEmptyString });
-const ServerProviderVersionAdvisoryStatus = Schema$1.Literals([
+const ServerProviderVersionAdvisoryStatus = LiteralWithFallback([
 	"unknown",
 	"current",
 	"behind_latest"
-]);
+], "unknown");
 const ServerProviderVersionAdvisory = Schema$1.Struct({
 	status: ServerProviderVersionAdvisoryStatus,
 	currentVersion: Schema$1.NullOr(TrimmedNonEmptyString),
@@ -8094,14 +8128,14 @@ const ServerProviderVersionAdvisory = Schema$1.Struct({
 	checkedAt: Schema$1.NullOr(IsoDateTime),
 	message: Schema$1.NullOr(TrimmedNonEmptyString)
 });
-const ServerProviderUpdateStatus = Schema$1.Literals([
+const ServerProviderUpdateStatus = LiteralWithFallback([
 	"idle",
 	"queued",
 	"running",
 	"succeeded",
 	"failed",
 	"unchanged"
-]);
+], "idle");
 const ServerProviderUpdateState = Schema$1.Struct({
 	status: ServerProviderUpdateStatus,
 	startedAt: Schema$1.NullOr(IsoDateTime),
@@ -8141,7 +8175,7 @@ const ServerProvider = Schema$1.Struct({
 	versionAdvisory: Schema$1.optionalKey(ServerProviderVersionAdvisory),
 	updateState: Schema$1.optionalKey(ServerProviderUpdateState)
 });
-const ServerProviders = Schema$1.Array(ServerProvider);
+const ServerProviders = ForwardCompatibleArray(ServerProvider);
 /**
 * Treat the optional `availability` as "available" when absent. This is
 * the rule legacy producers (which omit the field) and new producers
@@ -8311,7 +8345,7 @@ const ServerConfig = Schema$1.Struct({
 	keybindings: ResolvedKeybindingsConfig,
 	issues: ServerConfigIssues,
 	providers: ServerProviders,
-	availableEditors: Schema$1.Array(EditorId),
+	availableEditors: ForwardCompatibleArray(EditorId),
 	observability: ServerObservability,
 	settings: ServerSettings,
 	/** Whether shell subscriptions can emit an opt-in catch-up completion marker. */
@@ -13030,6 +13064,136 @@ const make$80 = Effect.gen(function* () {
 });
 const layer$72 = Layer.effect(PairingGrantStore, make$80).pipe(Layer.provideMerge(layer$73));
 //#endregion
+//#region src/persistence/DatabaseSnapshot.ts
+/**
+* DatabaseSnapshot - pre-migration snapshot of the SQLite database.
+*
+* A failed migration used to be unrecoverable: the layer that runs migrations
+* is built during startup, so a migration that throws exits the process, the
+* supervisor (launchd KeepAlive, systemd Restart=always) starts the same broken
+* build again, and `effect_sql_migrations` has already advanced past what the
+* previous release understands - so reinstalling the old CLI does not recover
+* it either.
+*
+* This module gives the migration runner something to fall back to. Before a
+* boot that has migrations to apply, the database is snapshotted with SQLite's
+* own `VACUUM INTO`, which writes one consistent file without needing the WAL
+* and shared-memory sidecars. If the migration then fails, a marker is written
+* and the process exits; the *next* boot restores the snapshot before the
+* database is opened.
+*
+* Restoring on the next boot rather than in the failing process is what makes
+* this survive a power cut: the marker is written before any live file is
+* touched, and the restore is idempotent, so an interrupted restore simply
+* resumes.
+*
+* @module DatabaseSnapshot
+*/
+/** SQLite spreads a live database across the main file plus these sidecars. */
+const DB_SIDECAR_SUFFIXES = ["-wal", "-shm"];
+const BACKUP_DIR_NAME = "db-backup";
+const SNAPSHOT_FILE_NAME = "state.sqlite";
+const STAGING_FILE_NAME = "state.sqlite.staging";
+const RESTORE_MARKER_FILE_NAME = ".restore-pending";
+/**
+* One snapshot slot, beside the database it protects.
+*
+* Beside rather than under `<baseDir>/runtime` so a snapshot always lands on
+* the same filesystem as the database - `rename` is only atomic within one -
+* and so a dev run under `<baseDir>/dev` can never restore over live state.
+*/
+const databaseSnapshotPaths = Effect.fn("databaseSnapshotPaths")(function* (dbPath) {
+	const path = yield* Path.Path;
+	const backupDir = path.join(path.dirname(dbPath), BACKUP_DIR_NAME);
+	return {
+		backupDir,
+		snapshotPath: path.join(backupDir, SNAPSHOT_FILE_NAME),
+		stagingPath: path.join(backupDir, STAGING_FILE_NAME),
+		markerPath: path.join(backupDir, RESTORE_MARKER_FILE_NAME)
+	};
+});
+/**
+* fsync a path so the rename or copy above it survives a power cut. Directory
+* handles cannot be opened for writing, so both files and directories are
+* opened read-only and synced through the descriptor.
+*/
+const syncPath = (target) => Effect.scoped(Effect.gen(function* () {
+	yield* (yield* (yield* FileSystem.FileSystem).open(target, { flag: "r" })).sync;
+}));
+/**
+* Snapshot the database unless one is already there.
+*
+* Never overwrites: after a failed migration the live database may already
+* carry half of that migration, and the existing snapshot is the only copy of
+* the schema the previous release can still read.
+*/
+const captureDatabaseSnapshot = Effect.fn("captureDatabaseSnapshot")(function* (dbPath) {
+	const fs = yield* FileSystem.FileSystem;
+	const sql = yield* SqlClient.SqlClient;
+	const paths = yield* databaseSnapshotPaths(dbPath);
+	if (yield* fs.exists(paths.snapshotPath)) return;
+	yield* fs.makeDirectory(paths.backupDir, { recursive: true });
+	yield* fs.remove(paths.stagingPath, { force: true });
+	yield* sql`VACUUM INTO ${paths.stagingPath}`;
+	yield* syncPath(paths.stagingPath);
+	yield* fs.rename(paths.stagingPath, paths.snapshotPath);
+	yield* syncPath(paths.backupDir);
+});
+/**
+* Record that the live database must be replaced by the snapshot.
+*
+* Written before anything touches a live file, so a crash between here and the
+* restore leaves the next boot able to tell that the database is not trusted.
+*/
+const markDatabaseRestorePending = Effect.fn("markDatabaseRestorePending")(function* (dbPath) {
+	const fs = yield* FileSystem.FileSystem;
+	const paths = yield* databaseSnapshotPaths(dbPath);
+	if (yield* fs.exists(paths.markerPath)) return;
+	yield* fs.makeDirectory(paths.backupDir, { recursive: true });
+	yield* Effect.scoped(Effect.gen(function* () {
+		yield* (yield* fs.open(paths.markerPath, { flag: "wx" })).sync;
+	}));
+	yield* syncPath(paths.backupDir);
+});
+const databaseRestorePending = Effect.fn("databaseRestorePending")(function* (dbPath) {
+	const fs = yield* FileSystem.FileSystem;
+	const paths = yield* databaseSnapshotPaths(dbPath);
+	return yield* fs.exists(paths.markerPath);
+});
+/**
+* Put the snapshot back, if one is pending. Call before the database is opened.
+*
+* Idempotent by construction: the marker is cleared only after the snapshot is
+* fully copied and synced, so an interrupted restore repeats harmlessly on the
+* next boot rather than leaving a half-copied database in place.
+*/
+const restoreDatabaseSnapshotIfPending = Effect.fn("restoreDatabaseSnapshotIfPending")(function* (dbPath) {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const paths = yield* databaseSnapshotPaths(dbPath);
+	if (!(yield* fs.exists(paths.markerPath))) return false;
+	if (!(yield* fs.exists(paths.snapshotPath))) {
+		yield* fs.remove(paths.markerPath, { force: true });
+		return false;
+	}
+	yield* fs.copyFile(paths.snapshotPath, dbPath);
+	yield* syncPath(dbPath);
+	for (const suffix of DB_SIDECAR_SUFFIXES) yield* fs.remove(`${dbPath}${suffix}`, { force: true });
+	yield* syncPath(path.dirname(dbPath));
+	yield* fs.remove(paths.markerPath, { force: true });
+	yield* fs.remove(paths.snapshotPath, { force: true });
+	yield* syncPath(paths.backupDir);
+	return true;
+});
+/** Drop a snapshot the migrations no longer need. */
+const discardDatabaseSnapshot = Effect.fn("discardDatabaseSnapshot")(function* (dbPath) {
+	const fs = yield* FileSystem.FileSystem;
+	const paths = yield* databaseSnapshotPaths(dbPath);
+	yield* fs.remove(paths.markerPath, { force: true });
+	yield* fs.remove(paths.snapshotPath, { force: true });
+	yield* fs.remove(paths.stagingPath, { force: true });
+});
+//#endregion
 //#region src/persistence/Migrations/001_OrchestrationEvents.ts
 var _001_OrchestrationEvents_default = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
@@ -14922,6 +15086,59 @@ const runMigrations = Effect.fn("runMigrations")(function* ({ toMigrationInclusi
 	yield* migrations.length === 0 ? Effect.logDebug("Database schema is current") : Effect.log("Migrations ran successfully").pipe(Effect.annotateLogs({ migrations }));
 	return executedMigrations;
 });
+/**
+* Highest migration already recorded in the database, or 0 for a database that
+* has never been migrated.
+*
+* Read from `sqlite_master` first because the tracking table does not exist on
+* a first boot, and a missing-table error here would be indistinguishable from
+* a real failure.
+*/
+const latestAppliedMigrationId = Effect.fn("latestAppliedMigrationId")(function* () {
+	const sql = yield* SqlClient.SqlClient;
+	if ((yield* sql`SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'effect_sql_migrations'`).length === 0) return 0;
+	return (yield* sql`SELECT max(migration_id) AS id FROM effect_sql_migrations`)[0]?.id ?? 0;
+});
+/**
+* Run migrations with a snapshot to fall back to.
+*
+* Only a boot that actually has migrations to apply pays for the snapshot, so a
+* normal restart still opens the database and serves immediately.
+*
+* On failure the snapshot is deliberately *not* restored here: the database is
+* still open on this connection, and a restore under an open connection is how
+* a half-copied file gets read. The marker written instead makes the next boot
+* restore it before anything opens the database, which is also what makes an
+* interrupted restore resume rather than corrupt.
+*/
+const runGuardedMigrations = Effect.fn("runGuardedMigrations")(function* (input) {
+	const appliedId = yield* latestAppliedMigrationId();
+	const throughId = input.options?.toMigrationInclusive;
+	const targetId = migrationEntries.filter(([id]) => throughId === void 0 || id <= throughId).reduce((highest, [id]) => id > highest ? id : highest, 0);
+	if (targetId <= appliedId) {
+		yield* discardSnapshotQuietly(input.dbPath);
+		return yield* runMigrations(input.options);
+	}
+	yield* Effect.log("Snapshotting the database before migrations").pipe(Effect.annotateLogs({
+		appliedMigrationId: appliedId,
+		targetMigrationId: targetId
+	}));
+	yield* captureDatabaseSnapshot(input.dbPath).pipe(Effect.tapCause((cause) => Effect.logError("Refusing to migrate without a database snapshot").pipe(Effect.annotateLogs({
+		dbPath: input.dbPath,
+		cause
+	}))));
+	const executed = yield* runMigrations(input.options).pipe(Effect.tapCause(() => markDatabaseRestorePending(input.dbPath).pipe(Effect.andThen(Effect.logError("Migration failed; the database will be restored on the next start").pipe(Effect.annotateLogs({
+		appliedMigrationId: appliedId,
+		targetMigrationId: targetId
+	}))), Effect.tapError((cause) => Effect.logError("Could not mark the database for restore").pipe(Effect.annotateLogs({ cause }))), Effect.ignore)));
+	yield* discardSnapshotQuietly(input.dbPath);
+	return executed;
+});
+/**
+* A snapshot that cannot be deleted is wasted disk, not a reason to refuse to
+* start - the schema it protected is already applied by the time this runs.
+*/
+const discardSnapshotQuietly = (dbPath) => discardDatabaseSnapshot(dbPath).pipe(Effect.tapError((cause) => Effect.logWarning("Could not discard the database snapshot").pipe(Effect.annotateLogs({ cause }))), Effect.ignore);
 Layer.effectDiscard(runMigrations());
 //#endregion
 //#region src/persistence/Layers/Sqlite.ts
@@ -14934,17 +15151,27 @@ const makeRuntimeSqliteLayer = Effect.fn("makeRuntimeSqliteLayer")(function* (co
 	const loader = defaultSqliteClientLoaders[runtime];
 	return (yield* Effect.promise(loader)).layer(config);
 }, Layer.unwrap);
-const setup$1 = Layer.effectDiscard(Effect.gen(function* () {
+const applyPragmas = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	yield* sql`PRAGMA journal_mode = WAL;`;
 	yield* sql`PRAGMA foreign_keys = ON;`;
-	yield* runMigrations();
-}));
+});
+const setupFile = (dbPath) => Layer.effectDiscard(applyPragmas.pipe(Effect.andThen(runGuardedMigrations({ dbPath }))));
+/**
+* The in-memory database used by tests has no file to snapshot and nothing that
+* survives the process to restore.
+*
+* A separate layer rather than a nullable path, so the memory setup keeps
+* needing nothing but `SqlClient`: sharing one function would put the file
+* path's `FileSystem | Path` requirement into every test layer built on it.
+*/
+const setupMemory = Layer.effectDiscard(applyPragmas.pipe(Effect.andThen(runMigrations())));
 const makeSqlitePersistenceLive = Effect.fn("makeSqlitePersistenceLive")(function* (dbPath) {
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	yield* fs.makeDirectory(path.dirname(dbPath), { recursive: true });
-	return Layer.provideMerge(setup$1, makeRuntimeSqliteLayer({
+	yield* restoreDatabaseSnapshotIfPending(dbPath).pipe(Effect.tap((restored) => restored ? Effect.logWarning("Restored the database snapshot left by a failed migration") : Effect.void));
+	return Layer.provideMerge(setupFile(dbPath), makeRuntimeSqliteLayer({
 		filename: dbPath,
 		spanAttributes: {
 			"db.name": path.basename(dbPath),
@@ -14952,7 +15179,7 @@ const makeSqlitePersistenceLive = Effect.fn("makeSqlitePersistenceLive")(functio
 		}
 	}));
 }, Layer.unwrap);
-Layer.provideMerge(setup$1, makeRuntimeSqliteLayer({ filename: ":memory:" }));
+Layer.provideMerge(setupMemory, makeRuntimeSqliteLayer({ filename: ":memory:" }));
 const layerConfig = Layer.unwrap(Effect.map(Effect.service(ServerConfig$1), ({ dbPath }) => makeSqlitePersistenceLive(dbPath)));
 const INTERNAL_ADMINISTRATIVE_BOOTSTRAP_SUBJECT = "administrative-bootstrap";
 const serverAuthInternalErrorContext = { cause: Schema$1.Defect() };
@@ -29913,11 +30140,14 @@ const make$64 = Effect.fn("cloud.boot_service.make")(function* (input) {
 			baseDir: input.baseDir
 		};
 	}).pipe(Effect.mapError((cause) => new BootServiceInstallError({ cause })), Effect.withSpan("cloud.boot_service.status"));
+	const readUnit = fs.exists(unitPath).pipe(Effect.flatMap((exists) => exists ? fs.readFileString(unitPath).pipe(Effect.map(Option.some)) : Effect.succeed(Option.none())), Effect.mapError((cause) => new BootServiceInstallError({ cause })), Effect.withSpan("cloud.boot_service.read_unit"));
 	return BootService.of({
 		install,
 		uninstall,
 		restart,
 		status,
+		readUnit,
+		revertUnit: rollbackFailedInstall,
 		logPath
 	});
 });
@@ -31570,7 +31800,15 @@ const PersistedServerRuntimeState = Schema$1.Struct({
 	host: Schema$1.optional(Schema$1.String),
 	port: Schema$1.Int,
 	origin: Schema$1.String,
-	startedAt: Schema$1.String
+	startedAt: Schema$1.String,
+	/**
+	* Which build wrote this. `p4c service update` restarts the service and then
+	* has to tell whether what came back is the new build or the old one still
+	* running - the pid alone cannot say that.
+	*
+	* Optional so a file written by an older server still decodes.
+	*/
+	cliVersion: Schema$1.optional(Schema$1.String)
 });
 var ServerRuntimeStateError = class extends Schema$1.TaggedErrorClass()("ServerRuntimeStateError", {
 	operation: Schema$1.Literals([
@@ -31596,7 +31834,8 @@ const makePersistedServerRuntimeState = (input) => Effect.map(DateTime.now, (now
 	...input.config.host ? { host: input.config.host } : {},
 	port: input.port,
 	origin: runtimeOriginForConfig(input.config, input.port),
-	startedAt: DateTime.formatIso(now)
+	startedAt: DateTime.formatIso(now),
+	cliVersion: version
 }));
 const persistServerRuntimeState = (input) => writeFileStringAtomically({
 	filePath: input.path,
@@ -33014,7 +33253,8 @@ const ICON_SOURCE_FILES = [
 	"src/index.html"
 ];
 const LINK_ICON_HTML_RE = /<link\b(?=[^>]*\brel=["'](?:icon|shortcut icon)["'])(?=[^>]*\bhref=["']([^"'?]+))[^>]*>/i;
-const LINK_ICON_OBJ_RE = /(?=[^}]*\brel\s*:\s*["'](?:icon|shortcut icon)["'])(?=[^}]*\bhref\s*:\s*["']([^"'?]+))[^}]*/i;
+const ICON_REL_RE = /\brel\s*:\s*["'](?:icon|shortcut icon)["']/i;
+const ICON_HREF_RE = /\bhref\s*:\s*["']([^"'?]+)/i;
 var ProjectFaviconResolutionError = class extends Schema$1.TaggedErrorClass()("ProjectFaviconResolutionError", {
 	operation: Schema$1.Literals([
 		"normalize-workspace",
@@ -33036,8 +33276,11 @@ var ProjectFaviconResolver = class extends Context.Service()("@p4code/cli/projec
 function extractIconHref(source) {
 	const htmlMatch = source.match(LINK_ICON_HTML_RE);
 	if (htmlMatch?.[1]) return htmlMatch[1];
-	const objMatch = source.match(LINK_ICON_OBJ_RE);
-	if (objMatch?.[1]) return objMatch[1];
+	for (const run of source.split("}")) {
+		if (!ICON_REL_RE.test(run)) continue;
+		const hrefMatch = run.match(ICON_HREF_RE);
+		if (hrefMatch?.[1]) return hrefMatch[1];
+	}
 	return null;
 }
 const optionOnNotFound$1 = (effect) => effect.pipe(Effect.map(Option.some), Effect.catchTags({ PlatformError: (error) => error.reason._tag === "NotFound" ? Effect.succeed(Option.none()) : Effect.fail(error) }));
@@ -33942,7 +34185,16 @@ Object.freeze({
 	fromEnd: 0
 });
 //#endregion
-//#region ../../node_modules/.pnpm/@pierre+diffs@1.3.0-beta.5_patch_hash=7cb6da88544119adda056b2f46f43956f99326227732da0b3_3b51331382fbad9d080c5033ee1e2a6a/node_modules/@pierre/diffs/dist/utils/cleanLastNewline.js
+//#region ../../node_modules/.pnpm/@pierre+diffs@1.3.5_patch_hash=ab83d1300a2b500057de1efef105e40b3766e14e1859523715f5205d_75eb9e5f35bdb1c1e149107bc7dcf802/node_modules/@pierre/diffs/dist/utils/getHunkSideBoundaries.js
+/** Converts a unified hunk side's start/count into its consumed-file range. */
+function getHunkSideStartBoundary(start, count) {
+	return start - (count === 0 ? 0 : 1);
+}
+function getHunkSideEndBoundary(start, count) {
+	return getHunkSideStartBoundary(start, count) + count;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@pierre+diffs@1.3.5_patch_hash=ab83d1300a2b500057de1efef105e40b3766e14e1859523715f5205d_75eb9e5f35bdb1c1e149107bc7dcf802/node_modules/@pierre/diffs/dist/utils/cleanLastNewline.js
 function cleanLastNewline(contents) {
 	let end = contents.length;
 	if (contents.charCodeAt(end - 1) === 10) {
@@ -33952,7 +34204,7 @@ function cleanLastNewline(contents) {
 	return contents.slice(0, end);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@pierre+diffs@1.3.0-beta.5_patch_hash=7cb6da88544119adda056b2f46f43956f99326227732da0b3_3b51331382fbad9d080c5033ee1e2a6a/node_modules/@pierre/diffs/dist/utils/detachString.js
+//#region ../../node_modules/.pnpm/@pierre+diffs@1.3.5_patch_hash=ab83d1300a2b500057de1efef105e40b3766e14e1859523715f5205d_75eb9e5f35bdb1c1e149107bc7dcf802/node_modules/@pierre/diffs/dist/utils/detachString.js
 const stringDetachEncoder = new TextEncoder();
 const stringDetachDecoder = new TextDecoder("utf-8", { ignoreBOM: true });
 const SURROGATE_CODE_UNIT_PATTERN = /[\uD800-\uDFFF]/;
@@ -33970,7 +34222,152 @@ function detachString(value) {
 	return stringDetachDecoder.decode(stringDetachBuffer.subarray(0, written));
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@pierre+diffs@1.3.0-beta.5_patch_hash=7cb6da88544119adda056b2f46f43956f99326227732da0b3_3b51331382fbad9d080c5033ee1e2a6a/node_modules/@pierre/diffs/dist/utils/parsePatchFiles.js
+//#region ../../node_modules/.pnpm/@pierre+diffs@1.3.5_patch_hash=ab83d1300a2b500057de1efef105e40b3766e14e1859523715f5205d_75eb9e5f35bdb1c1e149107bc7dcf802/node_modules/@pierre/diffs/dist/utils/realignChangeContent.js
+const MAX_ALIGNMENT_COMPARISONS = 4096;
+const MIN_IMPROVEMENT_PER_PAIR = .5;
+/**
+* Re-split count-mismatched change blocks in every hunk so paired lines are
+* chosen by content similarity instead of position, then slide blank-line
+* insert/delete blocks to the top of their blank run. Mutates `hunks` in
+* place; rendered row counts are unchanged (a split block covers the same
+* split/unified rows as the original).
+*/
+function realignChangeContentBySimilarity(diff) {
+	for (const hunk of diff.hunks) {
+		for (let index = 0; index < hunk.hunkContent.length; index++) {
+			const content = hunk.hunkContent[index];
+			if (content.type !== "change") continue;
+			const replacement = realignChangeBlock(diff, content);
+			if (replacement != null) {
+				hunk.hunkContent.splice(index, 1, ...replacement);
+				index += replacement.length - 1;
+			}
+		}
+		slideBlankBoundaryBlocksUp(hunk, diff);
+	}
+}
+/**
+* Slide pure insert/delete blocks made entirely of blank lines to the top of
+* the blank run they sit in. Adding or removing a blank line next to
+* existing blanks is ambiguous, and the diff library reports the change at
+* the run's bottom — so pressing Enter at the end of a line marks a blank
+* *below* the caret as inserted while the caret's own new line renders as
+* context. Sliding up anchors the change to the content above it (the caret
+* line after an Enter) instead.
+*
+* The slide is all-or-nothing: it only applies when the block comes to rest
+* directly beneath remaining in-hunk content. A slide that would consume the
+* hunk's entire leading context was stopped by the hunk's edge — a context
+* window cut, not the top of the blank run — and that landing spot is
+* arbitrary, so the block keeps the library's bottom-of-run anchor (which
+* sits against the content below the run). Non-blank blocks never slide, so
+* code that merely ends like its neighbor (an added function before an
+* identical `}`) keeps the library's canonical position.
+*/
+function slideBlankBoundaryBlocksUp(hunk, diff) {
+	const { hunkContent } = hunk;
+	for (let index = 1; index < hunkContent.length; index++) {
+		const block = hunkContent[index];
+		const previous = hunkContent[index - 1];
+		if (block.type !== "change" || block.additions > 0 && block.deletions > 0 || previous.type !== "context") continue;
+		const isInsert = block.additions > 0;
+		const lines = isInsert ? diff.additionLines : diff.deletionLines;
+		const blockStart = isInsert ? block.additionLineIndex : block.deletionLineIndex;
+		const blockLength = isInsert ? block.additions : block.deletions;
+		const unit = lines[blockStart] ?? "";
+		if (unit.trim() !== "") continue;
+		let uniform = true;
+		for (let offset = 1; offset < blockLength; offset++) if (lines[blockStart + offset] !== unit) {
+			uniform = false;
+			break;
+		}
+		if (!uniform) continue;
+		let slide = 0;
+		while (slide < previous.lines && diff.additionLines[previous.additionLineIndex + previous.lines - 1 - slide] === unit) slide++;
+		if (slide === 0) continue;
+		if (index === 1 && slide === previous.lines) continue;
+		block.additionLineIndex -= slide;
+		block.deletionLineIndex -= slide;
+		const blockAdditionEnd = block.additionLineIndex + block.additions;
+		const blockDeletionEnd = block.deletionLineIndex + block.deletions;
+		const next = hunkContent[index + 1];
+		if (next?.type === "context") {
+			next.lines += slide;
+			next.additionLineIndex = blockAdditionEnd;
+			next.deletionLineIndex = blockDeletionEnd;
+		} else hunkContent.splice(index + 1, 0, {
+			type: "context",
+			lines: slide,
+			additionLineIndex: blockAdditionEnd,
+			deletionLineIndex: blockDeletionEnd
+		});
+		previous.lines -= slide;
+		if (previous.lines === 0) {
+			hunkContent.splice(index - 1, 1);
+			index--;
+		}
+	}
+}
+function realignChangeBlock(diff, content) {
+	const { deletions, additions, deletionLineIndex, additionLineIndex } = content;
+	const pairCount = Math.min(deletions, additions);
+	const surplus = Math.abs(additions - deletions);
+	if (pairCount === 0 || surplus === 0 || pairCount * (surplus + 1) > MAX_ALIGNMENT_COMPARISONS) return null;
+	const strippedDeletions = [];
+	for (let line = 0; line < deletions; line++) strippedDeletions.push(stripWhitespace(diff.deletionLines[deletionLineIndex + line] ?? ""));
+	const strippedAdditions = [];
+	for (let line = 0; line < additions; line++) strippedAdditions.push(stripWhitespace(diff.additionLines[additionLineIndex + line] ?? ""));
+	const additionsAreLonger = additions > deletions;
+	let bestOffset = 0;
+	let bestScore = -1;
+	for (let offset = 0; offset <= surplus; offset++) {
+		let score = 0;
+		for (let pair = 0; pair < pairCount; pair++) score += lineSimilarity(strippedDeletions[pair + (additionsAreLonger ? 0 : offset)], strippedAdditions[pair + (additionsAreLonger ? offset : 0)]);
+		if (offset === 0) bestScore = score + pairCount * MIN_IMPROVEMENT_PER_PAIR;
+		else if (score > bestScore) {
+			bestScore = score;
+			bestOffset = offset;
+		}
+	}
+	if (bestOffset === 0) return null;
+	const blocks = [];
+	const pushBlock = (blockDeletions, blockAdditions, blockDeletionIndex, blockAdditionIndex) => {
+		if (blockDeletions > 0 || blockAdditions > 0) blocks.push({
+			type: "change",
+			deletions: blockDeletions,
+			additions: blockAdditions,
+			deletionLineIndex: blockDeletionIndex,
+			additionLineIndex: blockAdditionIndex
+		});
+	};
+	if (additionsAreLonger) {
+		pushBlock(0, bestOffset, deletionLineIndex, additionLineIndex);
+		pushBlock(pairCount, pairCount, deletionLineIndex, additionLineIndex + bestOffset);
+		pushBlock(0, additions - pairCount - bestOffset, deletionLineIndex + pairCount, additionLineIndex + bestOffset + pairCount);
+	} else {
+		pushBlock(bestOffset, 0, deletionLineIndex, additionLineIndex);
+		pushBlock(pairCount, pairCount, deletionLineIndex + bestOffset, additionLineIndex);
+		pushBlock(deletions - pairCount - bestOffset, 0, deletionLineIndex + bestOffset + pairCount, additionLineIndex + pairCount);
+	}
+	return blocks;
+}
+const WHITESPACE = /\s+/g;
+function stripWhitespace(line) {
+	return line.replace(WHITESPACE, "");
+}
+function lineSimilarity(a, b) {
+	if (a === b) return 1;
+	const maxLength = Math.max(a.length, b.length);
+	const minLength = Math.min(a.length, b.length);
+	if (minLength === 0) return 0;
+	let prefix = 0;
+	while (prefix < minLength && a[prefix] === b[prefix]) prefix++;
+	let suffix = 0;
+	while (suffix < minLength - prefix && a[a.length - 1 - suffix] === b[b.length - 1 - suffix]) suffix++;
+	return (prefix + suffix) / maxLength;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@pierre+diffs@1.3.5_patch_hash=ab83d1300a2b500057de1efef105e40b3766e14e1859523715f5205d_75eb9e5f35bdb1c1e149107bc7dcf802/node_modules/@pierre/diffs/dist/utils/parsePatchFiles.js
 function processPatch(data, cacheKeyPrefix, throwOnError) {
 	try {
 		return _processPatch(data, cacheKeyPrefix, throwOnError);
@@ -34046,9 +34443,9 @@ function _processFile(fileDiffString, { cacheKey, isGitDiff = GIT_DIFF_FILE_BREA
 			if (currentFile.deletionLines.length === 1 && oldFile?.contents === "") currentFile.deletionLines.length = 0;
 			for (const line of lines) {
 				if (line.startsWith("diff --git")) {
-					const filenameMatch$1 = line.trim().match(ALTERNATE_FILE_NAMES_GIT);
-					const prevName = filenameMatch$1?.[1] ?? filenameMatch$1?.[2];
-					const name = filenameMatch$1?.[3] ?? filenameMatch$1?.[4];
+					const filenameMatch = line.trim().match(ALTERNATE_FILE_NAMES_GIT);
+					const prevName = filenameMatch?.[1] ?? filenameMatch?.[2];
+					const name = filenameMatch?.[3] ?? filenameMatch?.[4];
 					if (prevName == null || name == null) {
 						if (throwOnError) throw Error("parsePatchContent: invalid git diff header");
 						else console.error("parsePatchContent: invalid git diff header", line);
@@ -34195,9 +34592,9 @@ function _processFile(fileDiffString, { cacheKey, isGitDiff = GIT_DIFF_FILE_BREA
 		if (throwOnError && (parsedAdditionLines !== hunkData.additionCount || parsedDeletionLines !== hunkData.deletionCount)) throw Error("parsePatchContent: hunk line count mismatch");
 		hunkData.additionLines = additionLines;
 		hunkData.deletionLines = deletionLines;
-		hunkData.collapsedBefore = Math.max(hunkData.additionStart - 1 - lastHunkEnd, 0);
+		hunkData.collapsedBefore = Math.max(getHunkSideStartBoundary(hunkData.additionStart, hunkData.additionCount) - lastHunkEnd, 0);
 		currentFile.hunks.push(hunkData);
-		lastHunkEnd = hunkData.additionStart + hunkData.additionCount - 1;
+		lastHunkEnd = getHunkSideEndBoundary(hunkData.additionStart, hunkData.additionCount);
 		for (const content of hunkData.hunkContent) if (content.type === "context") {
 			hunkData.splitLineCount += content.lines;
 			hunkData.unifiedLineCount += content.lines;
@@ -34214,9 +34611,9 @@ function _processFile(fileDiffString, { cacheKey, isGitDiff = GIT_DIFF_FILE_BREA
 	if (throwOnError && isPartial && !isGitDiff && currentFile.hunks.length === 0) throw Error("parsePatchContent: unified file has no hunks");
 	if (currentFile.hunks.length > 0 && !isPartial && currentFile.additionLines.length > 0 && currentFile.deletionLines.length > 0) {
 		const lastHunk = currentFile.hunks[currentFile.hunks.length - 1];
-		const lastHunkEnd$1 = lastHunk.additionStart + lastHunk.additionCount - 1;
+		const lastHunkEnd = getHunkSideEndBoundary(lastHunk.additionStart, lastHunk.additionCount);
 		const totalFileLines = currentFile.additionLines.length;
-		const collapsedAfter = Math.max(totalFileLines - lastHunkEnd$1, 0);
+		const collapsedAfter = Math.max(totalFileLines - lastHunkEnd, 0);
 		currentFile.splitLineCount += collapsedAfter;
 		currentFile.unifiedLineCount += collapsedAfter;
 	}
@@ -34227,6 +34624,7 @@ function _processFile(fileDiffString, { cacheKey, isGitDiff = GIT_DIFF_FILE_BREA
 		else if (oldFile != null && oldFile.contents !== "" && (newFile == null || newFile.contents === "")) currentFile.type = "deleted";
 	}
 	if (currentFile.type !== "rename-pure" && currentFile.type !== "rename-changed") currentFile.prevName = void 0;
+	realignChangeContentBySimilarity(currentFile);
 	return currentFile;
 }
 /**
@@ -38884,7 +39282,7 @@ const LINEAR_ISSUE_FIELDS = [
 * a Linear workspace is edited by people at human speed rather than by agents
 * at machine speed.
 */
-const POLL_INTERVAL$1 = Duration.seconds(30);
+const POLL_INTERVAL$2 = Duration.seconds(30);
 /** Linear's cap on one page. Asking for more is an error, not a bigger page. */
 const LINEAR_PAGE_LIMIT = 250;
 const LINEAR_LIST_TOOL = "list_issues";
@@ -39136,7 +39534,7 @@ const makeLinearTaskRepository = Effect.gen(function* () {
 			taskId
 		});
 	}).pipe(Effect.ignoreCause({ log: true }));
-	yield* Effect.forever(pollOnce.pipe(Effect.andThen(Effect.sleep(POLL_INTERVAL$1)))).pipe(Effect.forkScoped);
+	yield* Effect.forever(pollOnce.pipe(Effect.andThen(Effect.sleep(POLL_INTERVAL$2)))).pipe(Effect.forkScoped);
 	return {
 		create,
 		upsert,
@@ -42121,7 +42519,7 @@ const COMMON_DEV_PORTS = Object.freeze([
 	8888,
 	9e3
 ]);
-const POLL_INTERVAL = Duration.seconds(3);
+const POLL_INTERVAL$1 = Duration.seconds(3);
 const LSOF_TIMEOUT_MS = 5e3;
 const WINDOWS_LISTENER_TIMEOUT_MS = 5e3;
 const terminalOwnerKey = (owner) => `${owner.threadId}\u0000${owner.terminalId}`;
@@ -42296,7 +42694,7 @@ const make$46 = Effect.gen(function* PortDiscoveryMake() {
 			lastSnapshot: next
 		}])) yield* broadcast(next);
 	}, Effect.catchCause((cause) => Effect.logWarning("preview port scan failed", Cause.pretty(cause))));
-	yield* Effect.forkScoped(pollTick().pipe(Effect.repeat(Schedule.spaced(POLL_INTERVAL))));
+	yield* Effect.forkScoped(pollTick().pipe(Effect.repeat(Schedule.spaced(POLL_INTERVAL$1))));
 	const acquireRetention = Effect.fn("PortDiscovery.retain")(function* () {
 		if (yield* Ref.modify(stateRef, (state) => [state.retainCount === 0, {
 			...state,
@@ -63703,7 +64101,7 @@ function readScheduledWakeAt(input, completedAt) {
 	if (typeof delaySeconds !== "number" || !Number.isFinite(delaySeconds) || delaySeconds < 0) return;
 	const completedAtMs = Date.parse(completedAt);
 	if (Number.isNaN(completedAtMs)) return;
-	return new Date(completedAtMs + delaySeconds * 1e3).toISOString();
+	return DateTime.formatIso(DateTime.makeUnsafe(completedAtMs + delaySeconds * 1e3));
 }
 function isClaudeTaskTool(toolName) {
 	return toolName === "TaskCreate" || toolName === "TaskUpdate" || toolName === "TaskList";
@@ -103781,6 +104179,142 @@ const reconcileWithNewBinary = Effect.fn("cli.selfUpdate.reconcileWithNewBinary"
 	});
 });
 //#endregion
+//#region src/service/updateHealth.ts
+/**
+* Waiting for a restarted service to actually come back.
+*
+* `launchctl kickstart -k` returning 0 means launchd accepted the restart
+* request, not that the child booted; `systemctl restart` is the same. The
+* server already records where it is listening once its HTTP server is up, so
+* that file - written by the very process the update is about - is the honest
+* signal that the new build works.
+*
+* @module ServiceUpdateHealth
+*/
+/**
+* Long enough for a cold start that has migrations to apply, short enough that
+* a broken update is reported while the operator is still watching.
+*/
+const SERVICE_START_TIMEOUT = Duration.seconds(90);
+const POLL_INTERVAL = Duration.millis(500);
+/**
+* Poll until the expected build reports itself listening, the database is
+* marked for restore, or the timeout runs out.
+*
+* A restore marker ends the wait immediately: the migration guard writes it
+* only when the new build failed to migrate, and every later restart repeats
+* that failure, so there is nothing to wait for.
+*/
+const awaitServiceStart = Effect.fn("awaitServiceStart")(function* (input) {
+	const deadline = DateTime.addDuration(yield* DateTime.now, input.timeout ?? SERVICE_START_TIMEOUT);
+	while (true) {
+		const runtimeState = yield* readPersistedServerRuntimeState(input.serverRuntimeStatePath);
+		if (Option.isSome(runtimeState)) {
+			const state = runtimeState.value;
+			const startedAt = DateTime.makeUnsafe(state.startedAt);
+			if (state.cliVersion === input.expectedVersion && DateTime.isGreaterThanOrEqualTo(startedAt, input.startedAfter)) return {
+				_tag: "started",
+				port: state.port
+			};
+		}
+		if (yield* databaseRestorePending(input.dbPath).pipe(Effect.orElseSucceed(() => false))) return { _tag: "migration-failed" };
+		if (DateTime.isGreaterThanOrEqualTo(yield* DateTime.now, deadline)) return { _tag: "timeout" };
+		yield* Effect.sleep(POLL_INTERVAL);
+	}
+});
+//#endregion
+//#region src/service/updateState.ts
+/**
+* ServiceUpdateState - what the last service update did, and how it ended.
+*
+* `launchctl kickstart` and `systemctl restart` both return 0 as soon as the
+* supervisor accepts the request, which says nothing about whether the child
+* actually booted. Without a record written by the update itself, a service
+* that dies on every start - a failed migration being the case this exists for
+* - looks like a successful update from the command line.
+*
+* The file is small and written atomically, so a crash mid-update leaves either
+* the previous contents or the new ones, never a half-written record.
+*
+* @module ServiceUpdateState
+*/
+/**
+* - `updating`: an update is in flight; a file left in this state means the
+*   updating command itself died before it could record an outcome.
+* - `rolled-back`: the new build did not come up and the previous unit was put
+*   back.
+* - `failed`: the new build did not come up and nothing could be reverted -
+*   the case where an in-place package upgrade left no previous build on disk.
+*/
+const ServiceUpdateStatus = Schema$1.Literals([
+	"idle",
+	"updating",
+	"rolled-back",
+	"failed"
+]);
+const ServiceUpdateState = Schema$1.Struct({
+	version: Schema$1.Literal(1),
+	status: ServiceUpdateStatus,
+	/** Version the service is expected to be running now. */
+	activeVersion: Schema$1.String,
+	/** Version an in-flight update is moving to. */
+	pendingVersion: Schema$1.optional(Schema$1.String),
+	recordedAt: Schema$1.String,
+	/** Why an update ended the way it did, for `service status` to repeat. */
+	detail: Schema$1.optional(Schema$1.String)
+});
+const SERVICE_UPDATE_STATE_FILE = "service-state.json";
+const serviceUpdateStatePath = Effect.fn("serviceUpdateStatePath")(function* (baseDir) {
+	return (yield* Path.Path).join(baseDir, "runtime", SERVICE_UPDATE_STATE_FILE);
+});
+const ServiceUpdateStateJson = Schema$1.fromJsonString(ServiceUpdateState);
+const decodeServiceUpdateState = Schema$1.decodeUnknownEffect(ServiceUpdateStateJson);
+const encodeServiceUpdateState = Schema$1.encodeEffect(ServiceUpdateStateJson);
+/**
+* Read the record, or none.
+*
+* Every failure reads as none: a missing file is the normal first-update case,
+* and a corrupt one must not be the reason an update refuses to run.
+*/
+const readServiceUpdateState = Effect.fn("readServiceUpdateState")(function* (baseDir) {
+	const fs = yield* FileSystem.FileSystem;
+	const statePath = yield* serviceUpdateStatePath(baseDir);
+	const contents = yield* fs.readFileString(statePath).pipe(Effect.option);
+	if (Option.isNone(contents)) return Option.none();
+	const trimmed = contents.value.trim();
+	if (trimmed.length === 0) return Option.none();
+	return yield* decodeServiceUpdateState(trimmed).pipe(Effect.map(Option.some), Effect.catchCause((cause) => Effect.logWarning("Ignoring an unreadable service update record").pipe(Effect.annotateLogs({
+		statePath,
+		cause
+	}), Effect.as(Option.none()))));
+});
+const writeServiceUpdateState = Effect.fn("writeServiceUpdateState")(function* (input) {
+	const statePath = yield* serviceUpdateStatePath(input.baseDir);
+	const now = yield* DateTime.now;
+	const state = {
+		version: 1,
+		status: input.status,
+		activeVersion: input.activeVersion,
+		...input.pendingVersion === void 0 ? {} : { pendingVersion: input.pendingVersion },
+		recordedAt: DateTime.formatIso(now),
+		...input.detail === void 0 ? {} : { detail: input.detail }
+	};
+	yield* writeFileStringAtomically({
+		filePath: statePath,
+		contents: `${yield* encodeServiceUpdateState(state)}\n`
+	});
+	return state;
+});
+/** One line for `service status`, or null when the last update went fine. */
+function describeServiceUpdateState(state) {
+	switch (state.status) {
+		case "idle": return null;
+		case "updating": return `Last update to @p4code/cli@${state.pendingVersion ?? "unknown"} did not finish. Run \`p4c service update\` again.`;
+		case "rolled-back": return `Last update to @p4code/cli@${state.pendingVersion ?? "unknown"} was rolled back to @p4code/cli@${state.activeVersion}${state.detail === void 0 ? "" : `: ${state.detail}`}`;
+		case "failed": return `Last update to @p4code/cli@${state.pendingVersion ?? "unknown"} failed and could not be reverted${state.detail === void 0 ? "" : `: ${state.detail}`}`;
+	}
+}
+//#endregion
 //#region src/cli/service.ts
 const isBootServiceCommandError = Schema$1.is(BootServiceCommandError);
 const bootServiceLayer = (config) => layer$55({
@@ -103788,6 +104322,84 @@ const bootServiceLayer = (config) => layer$55({
 	logsDir: config.logsDir,
 	cliVersion: version
 }).pipe(Layer.provide(layer$61));
+/**
+* The update installed a build that never reported itself listening.
+*
+* A typed failure rather than a printed warning: `p4c service update` exiting 0
+* after a rolled-back update is the same lie as a supervisor reporting success
+* for a process that died on start.
+*/
+var ServiceUpdateNotHealthyError = class extends Schema$1.TaggedErrorClass()("ServiceUpdateNotHealthyError", {
+	attemptedVersion: Schema$1.String,
+	previousVersion: Schema$1.String,
+	rolledBack: Schema$1.Boolean,
+	detail: Schema$1.String
+}) {
+	get message() {
+		return this.rolledBack ? `Update to @p4code/cli@${this.attemptedVersion} was rolled back to @p4code/cli@${this.previousVersion}: ${this.detail}.` : `Update to @p4code/cli@${this.attemptedVersion} failed and could not be reverted: ${this.detail}.`;
+	}
+};
+/**
+* Update the service and then wait to see whether it came back.
+*
+* `launchctl kickstart` and `systemctl restart` report that the supervisor
+* accepted the request, not that the child booted - so an update that installs
+* a build which dies on every start used to print success while the machine
+* respawned a broken server every few seconds. This waits for the new build to
+* report itself listening and puts the previous unit back if it never does.
+*/
+const updateServiceGuarded = Effect.fn("cli.service.updateGuarded")(function* (input) {
+	const service = yield* BootService;
+	const status = yield* service.status;
+	const previousUnit = yield* service.readUnit;
+	const paths = yield* deriveServerPaths(status.baseDir, void 0);
+	const runningState = yield* readPersistedServerRuntimeState(paths.serverRuntimeStatePath);
+	const recordedState = yield* readServiceUpdateState(status.baseDir);
+	const previousVersion = Option.flatMap(runningState, (state) => Option.fromNullishOr(state.cliVersion)).pipe(Option.orElse(() => Option.map(recordedState, (state) => state.activeVersion)), Option.getOrElse(() => "unknown"));
+	const startedAfter = yield* DateTime.now;
+	yield* writeServiceUpdateState({
+		baseDir: status.baseDir,
+		status: "updating",
+		activeVersion: previousVersion,
+		pendingVersion: input.cliVersion
+	});
+	const result = yield* reconcileService();
+	if (!result.changed) yield* service.restart;
+	const outcome = yield* awaitServiceStart({
+		serverRuntimeStatePath: paths.serverRuntimeStatePath,
+		dbPath: paths.dbPath,
+		expectedVersion: input.cliVersion,
+		startedAfter,
+		...input.timeout === void 0 ? {} : { timeout: input.timeout }
+	});
+	if (outcome._tag === "started") {
+		yield* writeServiceUpdateState({
+			baseDir: status.baseDir,
+			status: "idle",
+			activeVersion: input.cliVersion
+		});
+		return {
+			_tag: "started",
+			result
+		};
+	}
+	const detail = outcome._tag === "migration-failed" ? "a database migration failed, and the database was restored to the previous schema" : "the updated service did not start in time";
+	const installedUnit = yield* service.readUnit;
+	yield* service.revertUnit(previousUnit);
+	const rolledBack = Option.isSome(previousUnit) && Option.getOrElse(installedUnit, () => "") !== previousUnit.value;
+	yield* writeServiceUpdateState({
+		baseDir: status.baseDir,
+		status: rolledBack ? "rolled-back" : "failed",
+		activeVersion: rolledBack ? previousVersion : input.cliVersion,
+		pendingVersion: input.cliVersion,
+		detail
+	});
+	return {
+		_tag: rolledBack ? "rolled-back" : "failed",
+		detail,
+		previousVersion
+	};
+});
 /** Install, update, or repair the service using the CLI version running this command. */
 const reconcileService = Effect.fn("cli.service.reconcile")(function* () {
 	const service = yield* BootService;
@@ -103817,7 +104429,7 @@ function formatReconcileSuccess(input) {
 		...input.platform === "darwin" && !input.previouslyInstalled ? [LAUNCH_AGENT_LOGIN_NOTE] : []
 	].join("\n");
 }
-function formatServiceStatus(status, cliVersion) {
+function formatServiceStatus(status, cliVersion, lastUpdate) {
 	if (!status.supported) return "P4Code service\n  Status: unavailable on this machine\n  Supported on: Linux with systemd, macOS with launchd";
 	if (!status.installed) return "P4Code service\n  Status: not installed\n  Next: Run `p4c service install`.";
 	return [
@@ -103826,6 +104438,7 @@ function formatServiceStatus(status, cliVersion) {
 		`  Unit: ${status.unitPath}`,
 		`  Data: ${status.baseDir}`,
 		`  Logs: ${status.logPath}`,
+		...lastUpdate ? [`  Last update: ${lastUpdate}`] : [],
 		...status.current ? [] : ["  Next: Run `p4c service update`."]
 	].join("\n");
 }
@@ -103891,15 +104504,24 @@ const serviceInstallCommand = Command.make("install", {
 	tailscaleServePort: flags.tailscaleServePort
 }))));
 const serviceUpdateCommand = Command.make("update", projectLocationFlags).pipe(Command.withDescription("Update or repair the background service so it runs this CLI build, then restart it."), Command.withHandler((flags) => runServiceCommand(flags, Effect.gen(function* () {
-	const result = yield* reconcileService();
-	if (!result.changed) {
-		yield* (yield* BootService).restart;
+	const outcome = yield* updateServiceGuarded({ cliVersion: version });
+	if (outcome._tag !== "started") {
+		const service = yield* BootService;
+		yield* Console.error(`Logs: ${service.logPath}`);
+		return yield* new ServiceUpdateNotHealthyError({
+			attemptedVersion: version,
+			previousVersion: outcome.previousVersion,
+			rolledBack: outcome._tag === "rolled-back",
+			detail: outcome.detail
+		});
+	}
+	if (!outcome.result.changed) {
 		yield* Console.log(`Restarted the P4Code service on @p4code/cli@${version}.`);
 		return;
 	}
 	yield* Console.log(formatReconcileSuccess({
-		previouslyInstalled: result.previouslyInstalled,
-		plan: result.plan,
+		previouslyInstalled: outcome.result.previouslyInstalled,
+		plan: outcome.result.plan,
 		cliVersion: version,
 		platform: yield* HostProcessPlatform
 	}));
@@ -103960,8 +104582,12 @@ const serviceSelfUpdateCommand = Command.make("self-update", {
 	yield* Console.log(`Service now runs @p4code/cli@${installed}.`);
 }))));
 const serviceStatusCommand = Command.make("status", projectLocationFlags).pipe(Command.withDescription("Show whether the P4Code background service is installed."), Command.withHandler((flags) => runServiceCommand(flags, Effect.gen(function* () {
-	const service = yield* BootService;
-	yield* Console.log(formatServiceStatus(yield* service.status, version));
+	const status = yield* (yield* BootService).status;
+	const recorded = yield* readServiceUpdateState(status.baseDir);
+	yield* Console.log(formatServiceStatus(status, version, Option.match(recorded, {
+		onNone: () => null,
+		onSome: describeServiceUpdateState
+	})));
 }))));
 Effect.gen(function* () {
 	const { supported, installed, current } = yield* (yield* BootService).status;