dsh-update-status 0.3.2 → 0.4.0

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to this project are documented here.
 
+## 0.4.0 — 2026-10-09
+
+Verified DeepSeek Harness: `0.2.1-alpha.1` (the current release, and the one this profile runs), also `0.2.0-rc.2`, `0.2.0-rc.1`, `0.1.7-rc.2`, `0.1.7-rc.1` and `0.1.7-alpha.2`. Release notes: [`docs/releases/v0.4.0.md`](docs/releases/v0.4.0.md).
+
+- **A restart can no longer turn into an endless respawn loop.** On a real host, a second `dsh web` held port 3080 while the supervised launchd job respawned a process that died with `EADDRINUSE` every 3.3 seconds — 671 failed starts and 677 startup diagnostics in 37 minutes, with nothing in the panel to say so. Every generated definition now carries an explicit failure ceiling: the macOS Agent runs a staged wrapper that gives up after five starts that each die inside 30 seconds (and no longer relies on `KeepAlive`, which can only respawn forever), the systemd unit sets `StartLimitIntervalSec=300` / `StartLimitBurst=10`, and the Windows wrapper applies the same ceiling. Each one logs why it stopped and how to restart it. `tests/service/plan.spec.ts` locks all three in CI.
+- **Restart availability asks the platform who owns the process, and nothing else.** The environment marker is inherited by every descendant, so a process started by another tool looked supervised while launchd was busy respawning a job that could never bind the port. Identity now comes from launchd's tracked `pid` (macOS), the unit's `MainPID` (Linux) or the staged wrapper as this process's parent (Windows), cached for ten seconds; a Host constructed without the probe fails closed. The environment is used only for the explicit marker: the macOS job label does **not** survive into a DSH process behind the staged `/bin/sh` wrapper — the Host reads `XPC_SERVICE_NAME=0` there — so an environment identity check disables the button on the exact setup this plugin installs. Found on a real host after activating the wrapper definition, and fixed the same day.
+- **The panel reports a failing supervisor instead of promising recovery.** A restart storm — recent first-party boot stamps plus DSH's own `startup-*.log` diagnostics — becomes the distinct `supervisor-thrashing` reason in both languages.
+- **`activate` verifies what it started.** It waits for the service to report a running process and fails with the reason if it is already crash-looping, rather than printing success over a spinning job.
+- **An installed service definition can be upgraded.** `install` now authorises replacing a definition or wrapper through its own receipt instead of byte-equality with the new rendering, which would have refused every legitimate upgrade; a path with no receipt is still refused untouched.
+- **The wrapper forwards `SIGTERM`.** `stop`/`uninstall` can no longer leave an orphaned DSH holding the port, which is the very state that creates the loop.
+- **A disabled restart now says how to get the button back.** When supervision is lost (another restart tool's instance took the port, or the wrapper gave up after repeated rapid failures), the panel and the settings card list the refusal reason **and** the two copy-only commands that recover it — `lsof -nP -iTCP:<port> -sTCP:LISTEN` to find the process holding the port, then the service's own recover command (`launchctl kickstart -k …`, or `systemctl --user reset-failed … && … enable --now …`, or the Task Scheduler run). Both come from the installer's own receipt via the new `recoverCommand` in the service plan, so the port and the command are never guessed; when no receipt exists the panel instead points at the supervision setup section. Nothing is executed and no process is killed by the plugin.
+- **The settings section shows when the service started.** *Version & updates* now reports the current DSH Web process's start time, taken from the Host's own clock, so an operator can tell how long the supervised instance has been up — including right after a restart. An older Host that does not send it simply omits the line.
+
 ## 0.3.2 — 2026-10-07
 
 Verified DeepSeek Harness: `0.2.1-alpha.1` (the current release, and the one this profile runs), also `0.2.0-rc.2`, `0.2.0-rc.1`, `0.1.7-rc.2`, `0.1.7-rc.1` and `0.1.7-alpha.2`. Release notes: [`docs/releases/v0.3.2.md`](docs/releases/v0.3.2.md).

package/README.md

@@ -146,7 +146,9 @@ dsh plugin --profile web exec dsh-update-status-service activate \
   --workspace "$PWD"
 ```
 
-`activate` stops if the port is still busy instead of killing anything, so the DSH you are already using is never taken down by surprise. From then on, **Restart** lists what is running, asks for a second confirmation when something is, and lets DSH exit; the service starts it again and the page comes back on its own.
+`activate` stops if the port is still busy instead of killing anything, so the DSH you are already using is never taken down by surprise. It also checks afterwards that the service it just started really took over; a service that begins failing immediately is reported as a failure, not as a success. From then on, **Restart** lists what is running, asks for a second confirmation when something is, and lets DSH exit; the service starts it again and the page comes back on its own.
+
+Only one thing may start DSH Web on that port. If another tool starts its own `dsh web` — a second plugin's restart helper, a `nohup` script — that process holds the port while your service keeps failing to start. The plugin asks your operating system which process the service really owns, so **Restart** stays disabled in that state instead of promising a recovery that cannot happen, and it shows the two copy-only commands that fix it: one to find whoever holds the port, one to give the service back. The generated service also stops after a few failed starts in a row rather than respawning forever, and writes the reason to its log. Settings shows when the service started, so a fresh restart and a long-running instance are easy to tell apart. More detail: [user-service supervision](docs/service-supervision.md).
 
 | Platform | User-level owner | Starts | Restart works after setup | Notes |
 | --- | --- | --- | --- | --- |
@@ -156,7 +158,7 @@ dsh plugin --profile web exec dsh-update-status-service activate \
 
 The generated service files contain absolute paths and **no secrets** — never your API keys, npm tokens, cookies or proxy credentials. Native files, logs, status and removal: [user-service supervision](docs/service-supervision.md). To check Linux or Windows on your own machine: [platform acceptance](docs/platform-acceptance.md).
 
-A restart interrupts running work and does not save it. If DSH cannot list what is running, or was started by hand or by the desktop app, it refuses to restart at all — a web page cannot talk it into it.
+A restart interrupts running work and does not save it. If DSH cannot list what is running, cannot verify that your service owns the current process, or was started by hand or by the desktop app, it refuses to restart at all — a web page cannot talk it into it.
 
 ## LAN / non-loopback pages
 
@@ -177,7 +179,8 @@ Current release: plugin **`0.3.2`** is verified against DeepSeek Harness **`0.2.
 
 | Plugin | Verified DeepSeek Harness | On npm | What that version is |
 | --- | --- | --- | --- |
-| **`0.3.2`** | `0.2.1-alpha.1`, `0.2.0-rc.2`, `0.2.0-rc.1`, `0.1.7-rc.2`, `0.1.7-rc.1`, `0.1.7-alpha.2` | `latest` | Documentation only: the version table and every past release note are now plain language. Behaves exactly like `0.3.1` |
+| **`0.4.0`** | `0.2.1-alpha.1`, `0.2.0-rc.2`, `0.2.0-rc.1`, `0.1.7-rc.2`, `0.1.7-rc.1`, `0.1.7-alpha.2` | `latest` | Restart you can trust: the service stops instead of restarting forever, the button needs the service to really own the process, and a disabled button shows the two commands that recover it. Settings also shows when the service started |
+| **`0.3.2`** | `0.2.1-alpha.1`, `0.2.0-rc.2`, `0.2.0-rc.1`, `0.1.7-rc.2`, `0.1.7-rc.1`, `0.1.7-alpha.2` | published | Documentation only: the version table and every past release note are now plain language. Behaves exactly like `0.3.1` |
 | **`0.3.1`** | `0.2.1-alpha.1`, `0.2.0-rc.2`, `0.2.0-rc.1`, `0.1.7-rc.2`, `0.1.7-rc.1`, `0.1.7-alpha.2` | published | Small polish: the settings page explains Restart too, and a long job name can no longer push the buttons away. |
 | **`0.3.0`** | `0.2.1-alpha.1`, `0.2.0-rc.2`, `0.2.0-rc.1`, `0.1.7-rc.2`, `0.1.7-rc.1`, `0.1.7-alpha.2` | published | Adds **Restart** to the panel, plus the one-command service setup it needs. Without that service the button stays disabled and says why. |
 | **`0.2.1`** | `0.2.1-alpha.1`, `0.2.0-rc.2`, `0.2.0-rc.1`, `0.1.7-rc.2`, `0.1.7-rc.1`, `0.1.7-alpha.2` | published | Hiding the version chip brings DSH’s own name and fish mark back, instead of leaving the brand row blank. |

package/README.zh.md

@@ -145,7 +145,9 @@ dsh plugin --profile web exec dsh-update-status-service activate \
   --workspace "$PWD"
 ```
 
-`activate` 发现端口还被占着就停手，绝不去杀进程，所以你正在用的 DSH 不会被突然掐掉。这之后就交给**重启**按钮：它先列出正在跑的东西，有东西在跑时再问一次，然后才让 DSH 退出；服务把新的拉起来，页面自己回来。
+`activate` 发现端口还被占着就停手，绝不去杀进程，所以你正在用的 DSH 不会被突然掐掉；激活之后它还会确认服务真的接管了——一启动就不停失败的服务会被当作失败报出来，而不是假装成功。这之后就交给**重启**按钮：它先列出正在跑的东西，有东西在跑时再问一次，然后才让 DSH 退出；服务把新的拉起来，页面自己回来。
+
+同一个端口只允许一个启动者。如果别的工具自己拉起了 `dsh web`——另一个插件的重启助手、`nohup` 脚本——那个进程会占着端口，而你的服务会一直启动失败。插件会直接问操作系统「这个服务真正拥有的是哪个进程」，所以这种情况下**重启**按钮会保持禁用，而不是承诺一个做不到的恢复；同时它会给出两条只复制的命令：一条找出谁占着端口，一条把服务交还回去。生成的服务在连续几次启动失败后也会停下来（不再无限重拉），并把原因写进自己的日志。设置页会显示服务启动时间，刚重启和跑了很久的实例一眼就能分清。更多细节见[用户服务监督说明](docs/service-supervision.md)。
 
 | 平台 | 用户级拥有者 | 启动时机 | 接管后页面重启 | 说明 |
 | --- | --- | --- | --- | --- |
@@ -155,7 +157,7 @@ dsh plugin --profile web exec dsh-update-status-service activate \
 
 生成的服务文件里只有绝对路径，**没有密钥**——不会带上你终端里的 API key、npm token、cookie 或代理凭据。原生文件、日志、状态与卸载见[用户服务监督说明](docs/service-supervision.md)；想在 Linux 或 Windows 上自己确认，见[跨平台验收步骤](docs/platform-acceptance.md)。
 
-重启会中断正在跑的工作，且不会保存。如果 DSH 列不出正在跑什么，或者它本来就是终端直启、桌面应用托管的，它会直接拒绝重启——网页端说什么都没用。
+重启会中断正在跑的工作，且不会保存。如果 DSH 列不出正在跑什么、无法确认当前进程确实由你装的服务拥有，或者它本来就是终端直启、桌面应用托管的，它会直接拒绝重启——网页端说什么都没用。
 
 ## 局域网（非回环页面）访问
 
@@ -176,7 +178,8 @@ DSH 对来源不是 loopback（`localhost` / `127.0.0.1`）的页面会关闭 Ho
 
 | 插件版本 | 已验证的 DeepSeek Harness | npm 发布状态 | 该版本是什么 |
 | --- | --- | --- | --- |
-| **`0.3.2`** | `0.2.1-alpha.1`、`0.2.0-rc.2`、`0.2.0-rc.1`、`0.1.7-rc.2`、`0.1.7-rc.1`、`0.1.7-alpha.2` | `latest` | 只改文档：版本对照表和历史发布说明都改成人话。功能与 `0.3.1` 完全一样 |
+| **`0.4.0`** | `0.2.1-alpha.1`、`0.2.0-rc.2`、`0.2.0-rc.1`、`0.1.7-rc.2`、`0.1.7-rc.1`、`0.1.7-alpha.2` | `latest` | 重启变得靠得住：服务连续失败会停下而不是无限重启；按钮要求系统服务真正托管当前进程；禁用时会给出两条可复制的恢复命令。设置页还能看到服务启动时间 |
+| **`0.3.2`** | `0.2.1-alpha.1`、`0.2.0-rc.2`、`0.2.0-rc.1`、`0.1.7-rc.2`、`0.1.7-rc.1`、`0.1.7-alpha.2` | 已发布 | 只改文档：版本对照表和历史发布说明都改成人话。功能与 `0.3.1` 完全一样 |
 | **`0.3.1`** | `0.2.1-alpha.1`、`0.2.0-rc.2`、`0.2.0-rc.1`、`0.1.7-rc.2`、`0.1.7-rc.1`、`0.1.7-alpha.2` | 已发布 | 小补丁：设置页也说明了重启前提，长任务名不再把按钮挤走。 |
 | **`0.3.0`** | `0.2.1-alpha.1`、`0.2.0-rc.2`、`0.2.0-rc.1`、`0.1.7-rc.2`、`0.1.7-rc.1`、`0.1.7-alpha.2` | 已发布 | 面板新增**重启**，以及它需要的那条服务安装命令；没装服务时按钮保持禁用并说明原因。 |
 | **`0.2.1`** | `0.2.1-alpha.1`、`0.2.0-rc.2`、`0.2.0-rc.1`、`0.1.7-rc.2`、`0.1.7-rc.1`、`0.1.7-alpha.2` | 已发布 | 隐藏版本芯片后，品牌行恢复成 DSH 官方的名称与鱼标，而不是变成空白。 |

package/docs/platform-acceptance.md

@@ -30,6 +30,8 @@ It refuses to start while the port is still busy — that is deliberate, so the
 
 Then reopen the Web UI and check that **Restart** in the update panel is enabled (not greyed out). That is the whole acceptance test: restart availability means the running process was recognised as service-managed.
 
+One more check worth doing on a new machine: start something else on the same port (a second `dsh web`), then look at the panel. Restart should go grey within a few seconds, and the panel should show the two copy-only commands that recover it. Stop the extra instance and run the second command; the button comes back. That is the ceiling doing its job — the service tries a few times and then stops instead of filling the log forever.
+
 ## Where to look when something is off
 
 | Platform | Status command |
@@ -37,7 +39,7 @@ Then reopen the Web UI and check that **Restart** in the update panel is enabled
 | Linux | `systemctl --user status dsh-update-status-web.service` and `journalctl --user -u dsh-update-status-web.service -f` |
 | Windows | Task Scheduler → **DSH Update Status Web**, or `schtasks /Query /TN "DSH Update Status Web" /V /FO LIST` |
 
-If **Restart** stays greyed out after activating, the running process was not recognised as the service's process. For an issue report, include the `plan` output and the status output above.
+If **Restart** stays greyed out after activating, the running process was not recognised as the service's process — most often because something else (a restart script, another plugin's helper, a hand-started `dsh web`) is holding the port and the service is failing to start. Check `lsof -nP -iTCP:<port> -sTCP:LISTEN` and the service log before reporting. For an issue report, include the `plan` output and the status output above.
 
 ## Removing it again
 

package/docs/service-supervision.md

@@ -29,7 +29,7 @@ This document describes the explicit, opt-in setup. The plugin never installs a
      --workspace "$PWD"
    ```
 
-   `activate` refuses to run while the requested port is occupied. It never kills an existing process; this prevents an `EADDRINUSE` crash loop.
+   `activate` refuses to run while the requested port is occupied, and it never kills an existing process. After starting the service it also verifies that the service really owns a running process: a service that begins crash-looping makes `activate` fail with that reason instead of reporting success.
 
 6. Reopen the normal Web URL. The update panel should report a restart-capable supervised process. Perform the first real page restart yourself while present, then confirm that the page reconnects.
 
@@ -57,7 +57,20 @@ The CLI stages a current-user plist at:
 ~/Library/LaunchAgents/com.idoall.dsh-update-status.web.plist
 ```
 
-It runs at login (`RunAtLoad`) and keeps DSH alive (`KeepAlive`). The plugin accepts page restart only when both the explicit marker and launchd's `XPC_SERVICE_NAME=com.idoall.dsh-update-status.web` identify the current process. A terminal process that merely has a similarly named environment variable is refused.
+It runs at login (`RunAtLoad`) and starts a small wrapper, also staged by the CLI:
+
+```text
+~/.dsh/dsh-update-status/dsh-web-supervisor.sh
+```
+
+The wrapper — not launchd — owns the restart loop, because `KeepAlive` can only respawn forever: if another launcher holds the port, every respawn dies with `EADDRINUSE` within a couple of seconds and the machine spins. The wrapper counts children that die before 30 seconds, stops after 5 of those in a row, writes why to the service log, and exits instead of respawning. A child that ran longer resets the counter, so ordinary restarts and long uptimes never trip it. The wrapper also forwards `SIGTERM` to its child, so `stop`/`uninstall` cannot leave an orphaned DSH behind holding the port.
+
+The plugin accepts a page restart only when **both** hold:
+
+- the explicit `DSH_WEB_SUPERVISOR=dsh-update-status` marker is present, and
+- launchd reports this process (or its wrapper parent) as the tracked `pid` of the job labelled `com.idoall.dsh-update-status.web`.
+
+The second check is the identity. Every descendant of a supervised process inherits the marker, so a process started by some other tool claims to be supervised while launchd is busy respawning a job that can never bind the port; the tracked pid cannot be inherited. The label is asked for by name rather than read from the environment: launchd does configure `XPC_SERVICE_NAME` for the job, but inside DSH — behind the staged `/bin/sh` wrapper — that variable reads `0`, so an environment check would refuse the very setup this plugin installs.
 
 Useful native inspection commands:
 
@@ -66,7 +79,7 @@ launchctl print "gui/$(id -u)/com.idoall.dsh-update-status.web"
 launchctl kickstart -k "gui/$(id -u)/com.idoall.dsh-update-status.web"
 ```
 
-Use the plugin CLI `stop` or `uninstall`, not `kill`, to intentionally stop a `KeepAlive` service. Killing the DSH child alone asks launchd to start it again.
+If the wrapper gave up, fix the cause (usually a second `dsh web` holding the port), then `launchctl kickstart -k` the job. Killing the wrapper itself is not a way back either: launchd no longer keeps a `KeepAlive` promise for it, which is precisely what bounds the loop — `kickstart` or the next login starts it again. Use the plugin CLI `stop` or `uninstall`, not `kill`, to intentionally stop the service: the wrapper forwards the signal to DSH.
 
 ## Linux — systemd user service
 
@@ -76,13 +89,20 @@ The CLI stages:
 ~/.config/systemd/user/dsh-update-status-web.service
 ```
 
-It uses `Restart=on-failure`, so DSH's restart exit code causes systemd to relaunch it. It is a **user** service: normally it starts after that user logs in.
+It uses `Restart=on-failure`, so DSH's restart exit code causes systemd to relaunch it, and it bounds the loop with `StartLimitIntervalSec=300` / `StartLimitBurst=10`: ten starts inside five minutes stops the unit instead of respawning forever. It is a **user** service: normally it starts after that user logs in.
 
 ```sh
 systemctl --user status dsh-update-status-web.service
 journalctl --user -u dsh-update-status-web.service -f
 ```
 
+If the start limit tripped (usually because a second `dsh web` held the port), fix the cause and clear the limit before starting again:
+
+```sh
+systemctl --user reset-failed dsh-update-status-web.service
+systemctl --user start dsh-update-status-web.service
+```
+
 To keep it alive after logout, a machine administrator may enable user lingering:
 
 ```sh
@@ -99,15 +119,25 @@ The CLI stages a current-user Task Scheduler definition and a PowerShell wrapper
 %LOCALAPPDATA%\dsh-update-status\
 ```
 
-The task starts at user logon with least privilege. The wrapper owns the long-running DSH child and restarts it after an intentional restart or unexpected exit. Use Task Scheduler to inspect the task named **DSH Update Status Web**.
+The task starts at user logon with least privilege. The wrapper owns the long-running DSH child, restarts it after an intentional restart or unexpected exit, and stops after five starts that each die within 30 seconds (the same ceiling as macOS) instead of respawning forever. Use Task Scheduler to inspect the task named **DSH Update Status Web**.
 
 Windows behavior must be verified on a Windows host before it is described as production-supported; use `plan --dry-run` to inspect the generated XML and wrapper first.
 
+## One launcher, one port
+
+Supervision only means something while the service is the only thing starting DSH Web on that port. Any other launcher — a second plugin's restart helper, a `nohup` restart script, a hand-started `dsh web` — takes the port for itself and leaves the service respawning a process that dies immediately. That is the one failure mode this plugin cannot fix from inside a page, so it detects and refuses it instead:
+
+- restart availability requires the platform to report **this** process as the service's own (see each platform above);
+- a restart storm (recent boot stamps plus DSH's own `startup-*.log` diagnostics, four within three minutes) is reported in the panel as its own reason;
+- every generated definition carries a failure ceiling, and the wrapper/log line says which limit was reached.
+
+Recovery is always the same: stop the extra instance, confirm the port is free (`lsof -nP -iTCP:3080 -sTCP:LISTEN`), then restart the service with the platform command above. The plugin never kills that other process for you — but it does hand you both commands: while a restart is refused, the panel and the settings card show the refusal reason followed by the two copy-only lines, taken from the installer's own receipt (the port) and the service plan (`recoverCommand`, which includes `systemctl --user reset-failed` on Linux because the unit's own start limit is what stopped the storm). With no receipt, the panel points at this document instead.
+
 ## Restart behavior and limits
 
 The panel's flow is deliberately conservative:
 
-1. It verifies that the **current** DSH process is supervised.
+1. It verifies that the **current** DSH process is supervised *and* that the platform service owns it.
 2. It lists running agents, jobs, and terminals. If this inspection is incomplete, restart is refused.
 3. If work is running, a second **Force restart** confirmation is required. A restart interrupts that work; it does not save or resume it.
 4. The Host returns an accepted response, then exits with code `42` after a short grace period.

package/lib/client.js

@@ -251,8 +251,28 @@ window.__ModuleLoader__.load({
 				en: "DSH Desktop manages this Host. Quit and reopen the desktop app instead."
 			},
 			"restart.unavailableMismatch": {
-				zh: "检测到监督标记，但当前进程不符合对应平台服务的身份。为安全起见，重启已禁用。",
-				en: "A supervision marker exists, but this process does not match the platform service identity. Restart is disabled for safety."
+				zh: "检测到监督标记，但当前进程不是该平台服务真正启动并持有的那个（例如被另一个重启工具拉起）。重启后无法保证恢复，按钮已禁用。",
+				en: "A supervision marker exists, but this process is not the one that platform service actually started and owns (another restart tool launched it, for example). Restart is disabled so the page cannot strand itself."
+			},
+			"restart.recoverIntro": {
+				zh: "第一行只列出占用端口的进程，不会杀它；请先自行停止它，再执行第二行让监督服务重新接管。",
+				en: "The first line only lists whoever holds the port — it kills nothing. Stop that process yourself, then run the second line to hand supervision back."
+			},
+			"restart.recoverLabel": {
+				zh: "恢复命令",
+				en: "Recovery commands"
+			},
+			"restart.recoverNote": {
+				zh: "仅复制，不会执行，也不会杀任何进程。",
+				en: "Copy only — nothing runs here, and no process is killed."
+			},
+			"restart.recoverInstall": {
+				zh: "尚未安装用户级监督服务；请按 README 的「受监督的重启」一节安装并接管 DSH，之后这个按钮才会启用。",
+				en: "No user-level supervisor is installed. Follow the “Supervised restart” section of the README to install and activate one; this button stays disabled until then."
+			},
+			"restart.unavailableThrashing": {
+				zh: "监督服务正在反复启动失败（检测到重启风暴）。请先停止占用该端口的另一个 DSH 实例，并查看服务日志；在那之前重启可能无法恢复。",
+				en: "The supervisor is repeatedly failing to start (a restart storm was detected). Stop the other DSH instance holding this port and check the service logs; until then a restart may not recover."
 			},
 			"restart.unavailableActivity": {
 				zh: "无法完整读取正在运行的任务。为避免中断未能列出的工作，重启已禁用。",
@@ -313,6 +333,10 @@ window.__ModuleLoader__.load({
 			"settings.readonly": {
 				zh: "此连接的设置为只读；显示状态不受影响。",
 				en: "Settings are read-only on this connection; status display is unchanged."
+			},
+			"settings.serviceStarted": {
+				zh: "服务启动时间",
+				en: "Service started"
 			}
 		};
 		function languageOf() {
@@ -497,6 +521,7 @@ window.__ModuleLoader__.load({
 		function restartUnavailableText(reason) {
 			if (reason === "desktop") return t("restart.unavailableDesktop");
 			if (reason === "supervisor-mismatch") return t("restart.unavailableMismatch");
+			if (reason === "supervisor-thrashing") return t("restart.unavailableThrashing");
 			if (reason === "activity-unavailable") return t("restart.unavailableActivity");
 			if (reason === "timer-unavailable") return t("restart.unavailableTimer");
 			if (reason === "stale-instance") return t("restart.unavailableStale");
@@ -509,6 +534,7 @@ window.__ModuleLoader__.load({
 			}, [restart]);
 			const unavailable = snapshot.status !== null && !snapshot.status.available;
 			const hasActivity = snapshot.activity.length > 0;
+			const recoverable = snapshot.status?.recovery?.commands ?? null;
 			const waiting = snapshot.phase === "waiting";
 			const label = snapshot.phase === "unknown" ? t("restart.loading") : snapshot.phase === "checking" ? t("restart.checking") : snapshot.phase === "armed" ? hasActivity ? t("restart.force") : t("restart.confirm") : waiting ? t("restart.waitingShort") : snapshot.phase === "timeout" ? t("restart.retry") : snapshot.phase === "error" ? t("restart.retry") : t("restart.button");
 			const disabled = snapshot.phase === "unknown" || snapshot.phase === "checking" || waiting || unavailable;
@@ -543,6 +569,21 @@ window.__ModuleLoader__.load({
 					role: "status",
 					children: restartUnavailableText(snapshot.status?.unavailableReason)
 				}),
+				unavailable && recoverable !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: "dus-restart-recover",
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dus-restart-message",
+						children: t("restart.recoverIntro")
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CommandBlock, {
+						command: recoverable,
+						label: t("restart.recoverLabel"),
+						note: t("restart.recoverNote")
+					})]
+				}),
+				unavailable && snapshot.status?.unavailableReason === "not-supervised" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+					className: "dus-restart-message",
+					children: t("restart.recoverInstall")
+				}),
 				snapshot.phase === "armed" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 					className: "dus-restart-message",
 					role: "status",
@@ -614,7 +655,7 @@ window.__ModuleLoader__.load({
 		* The one upgrade command plus its copy affordance, shared by the panel and the
 		* settings section so both surfaces can never disagree about what to run.
 		*/
-		function CommandBlock({ command, disabled = false }) {
+		function CommandBlock({ command, disabled = false, label = t("panel.command"), note = t("panel.commandNote") }) {
 			const commandRef = React.useRef(null);
 			const [copyMessage, setCopyMessage] = React.useState(null);
 			const copy = async () => {
@@ -631,7 +672,7 @@ window.__ModuleLoader__.load({
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
 				/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 					className: "dus-command-label",
-					children: t("panel.command")
+					children: label
 				}),
 				/* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", {
 					ref: commandRef,
@@ -657,7 +698,7 @@ window.__ModuleLoader__.load({
 				}),
 				/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 					className: "dus-note",
-					children: t("panel.commandNote")
+					children: note
 				})
 			] });
 		}
@@ -852,6 +893,7 @@ window.__ModuleLoader__.load({
 		function UpdateSettings({ ui }) {
 			const preferences = useObservable(ui.preferences);
 			const snapshot = useObservable(ui.status);
+			const startedAt = useObservable(ui.restart).status?.startedAt ?? null;
 			const status = snapshot.status;
 			const summary = statusSummary(status, snapshot.loading, snapshot.error);
 			const hasUpdate = status?.hasUpdate === true && status.latestVersion !== null;
@@ -890,13 +932,23 @@ window.__ModuleLoader__.load({
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "dus-settings-card",
 						children: [
-							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
-								className: "dus-settings-hint",
-								children: [
-									t("panel.current"),
-									": ",
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", { children: status?.currentVersion ?? "…" })
-								]
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "dus-settings-pair",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+									className: "dus-settings-hint",
+									children: [
+										t("panel.current"),
+										": ",
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", { children: status?.currentVersion ?? "…" })
+									]
+								}), startedAt !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+									className: "dus-settings-hint",
+									children: [
+										t("settings.serviceStarted"),
+										": ",
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", { children: timeText(startedAt) })
+									]
+								})]
 							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 								className: "dus-state",
@@ -970,13 +1022,18 @@ window.__ModuleLoader__.load({
 			const supervisor = record.supervisor === null ? null : record.supervisor === "launchd" || record.supervisor === "systemd" || record.supervisor === "task-scheduler" || record.supervisor === "unknown" ? record.supervisor : void 0;
 			const unavailableReason = record.unavailableReason === null ? null : record.unavailableReason === "not-supervised" || record.unavailableReason === "desktop" || record.unavailableReason === "supervisor-mismatch" || record.unavailableReason === "activity-unavailable" || record.unavailableReason === "timer-unavailable" || record.unavailableReason === "stale-instance" ? record.unavailableReason : void 0;
 			if (supervisor === void 0 || unavailableReason === void 0) return void 0;
+			if (record.startedAt !== void 0 && (typeof record.startedAt !== "string" || record.startedAt === "")) return void 0;
+			const recovery = record.recovery === void 0 ? void 0 : objectOf(record.recovery);
+			if (record.recovery !== void 0 && (recovery === void 0 || typeof recovery.commands !== "string" || recovery.commands === "")) return void 0;
 			if (record.available && (supervisor === null || unavailableReason !== null)) return void 0;
 			if (!record.available && unavailableReason === null) return void 0;
 			return {
 				instanceId: record.instanceId,
+				...record.startedAt === void 0 ? {} : { startedAt: record.startedAt },
 				available: record.available,
 				supervisor,
-				unavailableReason
+				unavailableReason,
+				...recovery === void 0 ? {} : { recovery: { commands: recovery.commands } }
 			};
 		}
 		function restartActivityOf(value) {
@@ -2073,6 +2130,9 @@ window.__ModuleLoader__.load({
 /* A job label is a whole shell command: clamp it so one long command cannot push
    the panel's buttons off a 390px card. */
 .dus-restart-work li{display:-webkit-box;-webkit-box-orient:vertical;-webkit-line-clamp:2;overflow:hidden}
+/* Recovery steps live under the disabled button and take their own row, like the
+   active-work list: the instruction, the copyable commands, then the no-op note. */
+.dus-restart-recover{flex-basis:100%}
 .dus-command-label{color:var(--dsw-alias-label-secondary);font-size:12px;font-weight:600;margin:0 0 6px}
 .dus-command{background:var(--dsw-specific-input-major);border:1px solid var(--dsw-alias-border-l2);border-radius:8px;display:block;font-family:var(--dsw-font-family-mono,ui-monospace,SFMono-Regular,Menlo,monospace);font-size:11px;line-height:1.5;margin:0;overflow-wrap:anywhere;padding:9px;tab-size:2;user-select:text;white-space:pre-wrap}
 .dus-command:focus{outline:2px solid var(--dsw-alias-state-business-primary);outline-offset:2px}
@@ -2084,6 +2144,16 @@ window.__ModuleLoader__.load({
 .dus-settings-toggle{align-items:flex-start;cursor:pointer;display:flex;gap:10px;font-size:13px;line-height:1.4}
 .dus-settings-toggle input{accent-color:var(--dsw-alias-state-business-primary);height:18px;margin:0;min-height:18px;min-width:18px;width:18px}
 .dus-settings-hint{color:var(--dsw-alias-label-secondary);font-size:12px;line-height:1.45;margin:8px 0 0}
+/* Running version and service start time share one row: version left, start time
+   flush right. Each line asks for a 200px basis, so the row wraps into two stacked
+   lines on a phone-width card instead of squeezing either value — the break is
+   driven by available width, which keeps one declaration correct at every size and
+   needs no width query. min(200px,100%) keeps a very narrow card from overflowing.
+   The 5px bottom margin is the breathing room the status block below used to do
+   without: the hints carry margin:8px 0 0, so the row's own box ends at the text and
+   the green state block sat flush against it. */
+.dus-settings-pair{align-items:baseline;display:flex;flex-wrap:wrap;gap:0 12px;justify-content:space-between;margin:0 0 5px}
+.dus-settings-pair>.dus-settings-hint{flex:0 1 auto;min-width:min(200px,100%);overflow-wrap:anywhere}
 .dus-compat{color:var(--dsw-alias-label-secondary)}
 .dus-compat[data-compatibility=verified]{color:var(--dsw-alias-state-success-primary)}
 .dus-compat[data-compatibility=incompatible]{color:var(--dsw-alias-state-error-primary)}