failproofai 1.0.4-beta.4 → 1.0.4-beta.6

package/src/audit/index.ts

@@ -794,9 +794,11 @@ async function runAuditInner(opts: RunAuditOptions, startedAt: number): Promise<
     errors === 0 &&
     skipped === 0;
   const newFindingIds = persistLeaks(perTranscript, coversAllHistory);
+  const leakIds = [...new Set(perTranscript.flatMap((t) => (t.leaks ?? []).map((leak) => leak.id)))];
 
   const auditResult: AuditResult = {
     version: 2,
+    leakIds,
     newLeakIds: newFindingIds,
     scannedAt: new Date(startedAt).toISOString(),
     scope: {

package/src/audit/leak-fingerprint.ts

@@ -178,10 +178,8 @@ export function fingerprintSecret(value: string, fallbackLabel = "secret"): Leak
 /**
  * Every id `fingerprintId` can produce, and nothing else.
  *
- * Ids become FILENAMES — one marker file per notified finding, one queue file
- * per pending macOS banner — so an id is a path component, and a path component
- * built from unvalidated input is a directory traversal. Measured: passing
- * `"../../../../tmp/PWNED"` to `markLeakNoticeDelivered` created that file.
+ * Ids become FILENAMES for pending macOS banners, so an id is a path component,
+ * and a path component built from unvalidated input is a directory traversal.
  *
  * Ids are HMAC hex today, so nothing in a normal run can carry a `/`. That is
  * not the same as safe: the record is JSON read off disk, and `leaks.json` is a

package/src/audit/leak-record.ts

@@ -156,15 +156,19 @@ export function upsertFinding(
   if (sighting.at > existing.lastSeen) existing.lastSeen = sighting.at;
   if (sighting.at < existing.firstSeen) existing.firstSeen = sighting.at;
 
-  // Keep the FIRST sightings rather than the most recent. The first exposure is
-  // the one that explains how the credential got into the transcript at all;
-  // later ones are usually the same value being replayed, and a checkpoint
-  // record replaying a prompt is not new information.
-  if (existing.sightings.length < MAX_SIGHTINGS) {
-    const seen = existing.sightings.some(
-      (s) => s.sessionId === sighting.sessionId && s.at === sighting.at,
-    );
-    if (!seen) existing.sightings.push(sighting);
+  // Keep the earliest sighting AND the most recent evidence. The report/email
+  // promises the CLI and timestamp of the latest exposure; keeping only the
+  // first five made those fields stale forever after a busy credential crossed
+  // the cap. Middle sightings are the expendable ones.
+  const seen = existing.sightings.some(
+    (s) => s.sessionId === sighting.sessionId && s.at === sighting.at,
+  );
+  if (!seen) {
+    existing.sightings.push(sighting);
+    existing.sightings.sort((a, b) => a.at.localeCompare(b.at));
+    if (existing.sightings.length > MAX_SIGHTINGS) {
+      existing.sightings.splice(1, existing.sightings.length - MAX_SIGHTINGS);
+    }
   }
   return { record, isNew: false };
 }

package/src/audit/leak-scan.ts

@@ -33,7 +33,7 @@ import { SECRET_PATTERNS } from "../hooks/builtin-policies";
  * `result.leaks` forever, which made a precision fix appear to do nothing on a
  * warm machine. Bump this whenever matching or suppression semantics change.
  */
-export const LEAK_SCAN_VERSION = 5;
+export const LEAK_SCAN_VERSION = 6;
 
 /** One credential value found in one event. */
 export interface SecretMatch {

package/src/audit/leak-store.ts

@@ -46,24 +46,6 @@ interface LeakIdentity {
   salt: string;
   /** Finding ids the user has said are not secrets. */
   dismissed: string[];
-  /**
-   * When the user last actually LOOKED at the leak report, as epoch ms.
-   *
-   * This is what stops the in-CLI notice, and it replaces a per-finding "we
-   * emitted it once" marker that silently lost the alert twice in one day: once
-   * because it was claimed on an event whose channel the host ignores, and once
-   * because hooks were disabled in the project being tested. Both marked every
-   * finding delivered and showed nothing, with no retry, ever.
-   *
-   * Keyed on the user's own action rather than on ours, the failure direction
-   * inverts: a dropped notice simply reappears next session, and the only thing
-   * that silences it is the user opening the report — which is the outcome the
-   * notice exists to produce.
-   *
-   * `identity`, alongside `dismissed`, for the same reason: losing it re-alerts
-   * about credentials somebody has already seen and judged.
-   */
-  reportViewedAt?: number;
 }
 
 /** Mode for both files. They carry no credential, but they do carry a machine
@@ -95,10 +77,6 @@ export function readLeakIdentity(home?: string): LeakIdentity {
     return {
       salt: existing.salt,
       dismissed: existing.dismissed ?? [],
-      reportViewedAt:
-        typeof existing.reportViewedAt === "number" && Number.isFinite(existing.reportViewedAt)
-          ? existing.reportViewedAt
-          : undefined,
     };
   }
   const minted: LeakIdentity = { salt: randomBytes(32).toString("hex"), dismissed: [] };
@@ -146,7 +124,7 @@ export function writeLeakIdentity(identity: LeakIdentity, home?: string): boolea
 function sanitizeFinding(raw: unknown): LeakFinding | null {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
   const f = raw as Record<string, unknown>;
-  // The id becomes a FILENAME (notice markers, the macOS queue), so anything
+  // The id becomes a filename in the macOS notification queue, so anything
   // that is not the exact minted shape disqualifies the whole entry.
   if (typeof f.id !== "string" || !isFindingId(f.id)) return null;
 
@@ -219,29 +197,6 @@ export function writeLeakRecord(record: LeakRecord, home?: string, nowMs = Date.
 }
 
 /** Mark a finding as not-a-secret. Survives a reset; see the module header. */
-/**
- * Record that the user has seen the leak report.
- *
- * Called from the dashboard when it reads the findings, and from the
- * interactive `failproofai audit`, which prints them. Both are the user
- * looking — which is the only signal worth silencing the notice on.
- *
- * Never throws: failing to record a view costs one extra notice, which is the
- * side this whole design errs on.
- */
-export function markLeakReportViewed(home?: string, nowMs = Date.now()): void {
-  try {
-    const identity = readLeakIdentity(home);
-    writeJsonAtomically(
-      auditLeakIdentityFile(home),
-      { ...identity, reportViewedAt: nowMs },
-      { mode: FILE_MODE },
-    );
-  } catch {
-    // See the doc comment: an unrecorded view re-notifies once.
-  }
-}
-
 export function dismissFinding(id: string, home?: string): boolean {
   const identity = readLeakIdentity(home);
   if (identity.dismissed.includes(id)) return true;

package/src/audit/machine-store.ts

@@ -7,9 +7,8 @@
  *  - `machine_id` is what the api-server keys reports on. Regenerate it and the
  *    server sees a brand-new machine, which burns a slot off the account's cap
  *    on every logout and splits one box's history into two.
- *  - `last_reported_at` is how far the last digest reached. Reset it and the
- *    next report re-covers months of history, and the user gets a digest of
- *    everything that ever happened as though it just did.
+ *  - `last_reported_at` is how far the last credential alert reached. Reset it
+ *    and the next report can re-cover old exposures as though they just happened.
  *
  * That is why this is a separate file from `session.json` rather than two more
  * keys in it: signing out deletes the session, and neither of these may go with
@@ -22,7 +21,7 @@
  * `state/telemetry-id` is already a stable per-machine random id and would have
  * been free to reuse. It is deliberately not reused: that id is the anonymous
  * PostHog person, and sending it alongside a verified email address would link
- * the two the moment somebody turns emailed reports on. Opting into a digest
+ * the two the moment somebody adds email alerts. Opting into email
  * should not de-anonymise telemetry, so this feature gets its own id and the
  * two never meet.
  */
@@ -66,8 +65,8 @@ export function readMachineIdentity(home?: string): MachineIdentity | null {
 /**
  * Read the identity, creating it on first call.
  *
- * Only ever called from the reporting path, so a machine that never opts into
- * emailed reports never gets an id at all — there is nothing to mint one for.
+ * Only ever called from the email-reporting path, so a machine without a valid
+ * email identity never gets an id at all — there is nothing to mint one for.
  */
 export function ensureMachineIdentity(home?: string): MachineIdentity {
   const existing = readMachineIdentity(home);
@@ -81,13 +80,13 @@ export function ensureMachineIdentity(home?: string): MachineIdentity {
 }
 
 /**
- * Record how far the last DELIVERED digest reached.
+ * Record how far the last delivered credential alert reached.
  *
  * The value is the server's `next_window_from`, not the window this run
  * scanned. The server is authoritative because it knows which reports actually
  * produced an email — a report held by the cooldown, or one whose send failed,
  * must not advance the watermark or its findings are silently dropped from every
- * future digest.
+ * future alert.
  */
 export function recordReportWatermark(nextWindowFrom: string, home?: string): void {
   const current = ensureMachineIdentity(home);
@@ -105,7 +104,7 @@ export function deleteMachineIdentity(home?: string): void {
 /**
  * A display name for this machine — its hostname.
  *
- * Shown in the digest so somebody with three boxes can tell which one is
+ * Shown in the email alert so somebody with three boxes can tell which one is
  * misbehaving, which is the whole reason it is sent. Falls back to `undefined`
  * rather than a placeholder: the server keeps whatever label it already has when
  * one is omitted, so guessing here would overwrite a good name with a bad one.

package/src/audit/macos-notifier.ts

@@ -255,8 +255,8 @@ export function queueMacNotification(
   body: string,
   home?: string,
 ): boolean {
-  // The id becomes a filename in a watched directory. Same guard, same reason
-  // as `markLeakNoticeDelivered` — see `isFindingId`.
+  // The id becomes a filename in a watched directory, so validate the path
+  // component before resolving it — see `isFindingId`.
   if (!isFindingId(id)) return false;
   const dir = macNotifyDir(home);
   const tmp = resolve(dir, "..", `notify-${id}.tmp`);

package/src/audit/redact-example.ts

@@ -573,6 +573,7 @@ export function redactAuditResult(result: AuditResult, home = homedir()): AuditR
     // Salted, machine-local ids. They carry no path and cannot be reversed to
     // a credential, so they pass through — but the decision is recorded here
     // rather than inherited from a spread.
+    leakIds: result.leakIds,
     newLeakIds: result.newLeakIds,
 
     // Everything below carries a path or user content and is rewritten.
@@ -615,5 +616,6 @@ export const REDACTED_AUDIT_RESULT_KEYS: ReadonlyArray<keyof AuditResult> = [
   "projectsScanned",
   "eventsScanned",
   "enabledBuiltinNames",
+  "leakIds",
   "newLeakIds",
 ];

package/src/audit/report-harm.ts

@@ -1,6 +1,6 @@
 /**
- * The side effect a scheduled audit has that no other audit does: telling the
- * api-server what it found, so a harm digest can be mailed.
+ * The optional remote side effect of a scheduled audit: telling the api-server
+ * about the newest masked credential exposure so an email alert can be sent.
  *
  * Separated from `harm-report.ts` on purpose. That module is pure — result in,
  * payload out — and is where the windowing rules live and are tested. This one
@@ -15,7 +15,7 @@
  * token expired, whose network is down, or whose api-server is having a bad day
  * must keep auditing itself locally and keep showing results on its own
  * dashboard — the local feature does not depend on the remote one, and a person
- * who never enabled emailed reports must never be able to tell this code exists.
+ * who never added an email must never have the local scan depend on this code.
  *
  * ## Why the CHILD does this and not the daemon
  *
@@ -35,6 +35,7 @@ import { activeFindings, readLeakRecord } from "./leak-store";
 import {
   ensureMachineIdentity,
   machineLabel,
+  readMachineIdentity,
   recordReportWatermark,
 } from "./machine-store";
 import type { AuditResult } from "./types";
@@ -42,31 +43,26 @@ import type { AuditResult } from "./types";
 /** What happened, for the one line the scheduled run prints. */
 export type HarmReportOutcome =
   | { kind: "disabled" }
-  | { kind: "consent-required" }
+  | { kind: "no-leak" }
   | { kind: "signed-out" }
-  | { kind: "sent"; hits: number }
-  | { kind: "held"; hits: number; reason: string }
+  | { kind: "sent"; leaks: number }
+  | { kind: "held"; leaks: number; reason: string }
   | { kind: "failed"; error: string };
 
 /**
- * Report this scan's harmful findings, if the user asked for that.
+ * Report this scan's newest credential exposure when an email identity exists.
  *
  * Returns an outcome rather than a boolean so the caller can say something
- * truthful. "held" in particular is not a failure — a machine below the
- * threshold, or inside its cooldown, is working exactly as intended, and a line
- * that called that an error would train people to ignore the line.
+ * truthful. "held" in particular is not a failure — a machine inside its
+ * cooldown is working exactly as intended, and a line that called that an error
+ * would train people to ignore the line.
  */
 export async function reportHarm(result: AuditResult): Promise<HarmReportOutcome> {
-  // ONE switch. `auto` means "scan on a timer AND tell me", because the reason
-  // to put a scan on a timer is to be told — a machine scanning quietly with
-  // nothing to report to is a feature that looks on and does nothing visible.
   let auto = false;
-  let consentedAt: number | undefined;
   let intervalDays = 7;
   try {
     const config = readConfig();
     auto = config.audit.auto;
-    consentedAt = config.audit.reportsConsentedAt;
     // Also the width of a FIRST report's window, so a new machine's opening
     // digest covers the same period every later one will.
     intervalDays = config.audit.intervalDays;
@@ -76,13 +72,18 @@ export async function reportHarm(result: AuditResult): Promise<HarmReportOutcome
   }
   if (!auto) return { kind: "disabled" };
 
-  // `auto` alone is not consent to SEND, on a machine that set it before this
-  // existed. Through 1.0.0 that key meant "scan locally on a timer" — no
-  // account, no network, and the toggle that wrote it said so. Sending is
-  // gated on the separate stamp every current opt-in path writes, so a
-  // machine upgrading into this release keeps scanning and mails nothing until
-  // a person opts in again and sees what that sends. See `audit.reportsConsentedAt`.
-  if (consentedAt === undefined) return { kind: "consent-required" };
+  // Decide whether there is anything emailable before touching auth or the
+  // network. Scheduled scans are local by default; an email identity is an
+  // optional delivery channel, and a scan with no credential leak must make no
+  // report request at all.
+  const prior = readMachineIdentity();
+  const report = buildHarmReport(
+    result,
+    prior?.last_reported_at,
+    intervalDays,
+    activeFindings(readLeakRecord()),
+  );
+  if (report.leaks.length === 0) return { kind: "no-leak" };
 
   const auth = await getValidAccessToken();
   if (!auth) {
@@ -102,18 +103,6 @@ export async function reportHarm(result: AuditResult): Promise<HarmReportOutcome
     return { kind: "failed", error: err instanceof Error ? err.message : String(err) };
   }
 
-  // The leak record is read here rather than carried on the AuditResult: the
-  // digest wants every credential still live in this window, not only the ones
-  // this particular scan happened to re-encounter. A key that leaked last month
-  // and was not touched by today's transcripts is still a key to rotate.
-  const report = buildHarmReport(
-    result,
-    identity.last_reported_at,
-    intervalDays,
-    activeFindings(readLeakRecord()),
-  );
-  const hits = report.harmful.reduce((n, p) => n + p.hits, 0);
-
   try {
     const res = await submitAuditReport(auth.access_token, {
       machine_id: identity.machine_id,
@@ -139,8 +128,8 @@ export async function reportHarm(result: AuditResult): Promise<HarmReportOutcome
     }
 
     return res.emailed
-      ? { kind: "sent", hits }
-      : { kind: "held", hits, reason: res.reason ?? "not_sent" };
+      ? { kind: "sent", leaks: report.leaks.length }
+      : { kind: "held", leaks: report.leaks.length, reason: res.reason ?? "not_sent" };
   } catch (err) {
     // A 401 here means the session died between `getValidAccessToken` and this
     // call — rare, and indistinguishable from any other failure as far as this
@@ -160,19 +149,15 @@ export async function reportHarm(result: AuditResult): Promise<HarmReportOutcome
 export function describeOutcome(outcome: HarmReportOutcome): string | null {
   switch (outcome.kind) {
     case "disabled":
-      return null; // Say nothing at all to the majority who never opted in.
-    case "consent-required":
-      return "failproofai: scheduled scans are on, but emailing what they find needs a fresh opt-in — run `failproofai audit --schedule` (or visit /settings) to turn digests on";
+    case "no-leak":
+      return null;
     case "signed-out":
-      // Names the two places that can actually fix it. It used to say "sign in
-      // from the audit page", which stopped being true when this release moved
-      // that dialog behind "invite a friend".
-      return "failproofai: emailed reports are on but this machine is signed out — run `failproofai audit --schedule` or visit /settings to resume them";
+      return "failproofai: a credential exposure was found, but no email is configured — run `failproofai audit --schedule --email you@example.com`";
     case "sent":
-      return `failproofai: emailed a harm digest (${outcome.hits} finding${outcome.hits === 1 ? "" : "s"})`;
+      return "failproofai: emailed the most recent credential exposure";
     case "held":
-      return `failproofai: ${outcome.hits} finding${outcome.hits === 1 ? "" : "s"} reported, no email (${outcome.reason})`;
+      return `failproofai: credential exposure reported, no email (${outcome.reason})`;
     case "failed":
-      return `failproofai: could not send the harm report: ${outcome.error}`;
+      return `failproofai: could not send the credential alert: ${outcome.error}`;
   }
 }

package/src/audit/schedule-cli.ts

@@ -68,13 +68,9 @@ const dim = (s: string) => wrap(ANSI_DIM, s);
 const bold = (s: string) => wrap(ANSI_BOLD, s);
 
 /**
- * Turn scheduled audits on, signing in first if needed.
- *
- * Scheduling and mailing are ONE decision — the reason to put a scan on a timer
- * is to be told what it found — so this requires a session, exactly as the
- * dashboard's `setAutoAuditAction` does. A timer set with nobody to tell is a
- * switch that reads as on and produces nothing, discoverable only by noticing
- * that no digest ever arrives.
+ * Turn scheduled audits on. Email is optional: `--email` signs in, while a
+ * plain `--schedule` enables the local scan and desktop notification without
+ * prompting for an account.
  *
  * The interval is written and then RE-READ, so what is printed is what the
  * config actually kept — `readIntervalDays` owns the 1..90 clamp and a second
@@ -108,17 +104,13 @@ export async function runScheduleOn(
     if (bad) throw new ScheduleCliError(bad);
   }
 
-  const { user, prompted } = await ensureSignedIn(emailArg);
+  const signedIn = emailArg === undefined
+    ? { user: readAuth()?.user ?? null, prompted: false }
+    : await ensureSignedIn(emailArg);
 
   const next = updateConfig({
-    // Stamped in the SAME call that sets `auto`, never separately: this records
-    // that a person completed a sign-in and read the disclosure printed below,
-    // and it is what `reportHarm` gates sending on. A machine that inherited
-    // `auto` from a release where it meant "scan locally" has no stamp and
-    // sends nothing until it comes through here.
     audit: {
       auto: true,
-      reportsConsentedAt: Date.now(),
       ...(days !== undefined ? { intervalDays: days } : {}),
     },
   });
@@ -134,12 +126,14 @@ export async function runScheduleOn(
   // The list is the real payload from `report-harm.ts`: machine id, hostname,
   // platform, the window bounds and the redacted examples.
   const summary = [
-    `every ${interval} day${interval === 1 ? "" : "s"} · reports to ${user.email}`,
-    "you only hear from it when a scan finds something harmful",
-    "each report sends: finding counts, redacted example commands, this machine's name",
+    `every ${interval} day${interval === 1 ? "" : "s"} · desktop notification on leaks`,
+    signedIn.user
+      ? `masked leak alerts also go to ${signedIn.user.email}`
+      : "email is optional · add it with --email you@example.com",
+    "email contains only the most recent masked credential exposure",
   ];
 
-  if (prompted) {
+  if (signedIn.prompted) {
     // A sign-in just drew the frame, so the result continues it and the `└`
     // closes both at once — rather than the frame ending and a loose line
     // appearing underneath.
@@ -158,7 +152,7 @@ export async function runScheduleOn(
   // exists to make visible.
   warnIfDaemonWontRun();
 
-  if (prompted) {
+  if (signedIn.prompted) {
     outro("failproofai audit --status  ·  when the next scan is due");
   } else {
     process.stdout.write(dim(`\n   failproofai audit --status   when the next scan is due\n\n`));
@@ -217,7 +211,7 @@ export function runScheduleStatus(): void {
 
   // A session whose refresh window has closed cannot mint another access token,
   // so it is a destination in name only. Showing the address for one would tell
-  // somebody their digests are going somewhere they are not.
+  // somebody their alerts are going somewhere they are not.
   const live = auth && auth.refresh_expires_at * 1000 > Date.now() ? auth : null;
   // Beside the schedule, because they are the two halves of "what does this
   // machine do on its own" — one decides whether it scans, the other whether it
@@ -230,19 +224,9 @@ export function runScheduleStatus(): void {
   detail.push(["reports to", live ? live.user.email : dim("— signed out")]);
   if (on && !live) {
     // The state the reporter surfaces as "signed-out". Named here for the same
-    // reason the settings panel names it: the scans keep running, so silence
-    // about the digests would look like the feature failing.
-    detail.push(["", pink("scans continue; digests are paused until you sign in")]);
-  } else if (on && config.audit.reportsConsentedAt === undefined) {
-    // Signed in, scheduled, and still not sending: this machine set `audit.auto`
-    // when it only meant "scan locally", so nothing has consented to the digest
-    // leaving the box. Without this row the status screen would show a healthy
-    // schedule and a live address and still mail nothing, with no explanation
-    // anywhere the user can see.
-    detail.push([
-      "",
-      pink("scans continue; digests need a fresh opt-in — run `--schedule` to turn them on"),
-    ]);
+    // reason the settings panel names it: the scans and desktop notifications
+    // keep running, so silence about email would look like the feature failing.
+    detail.push(["", pink("scans and desktop alerts continue; email alerts are paused")]);
   }
 
   detail.push(["daemon", describeDaemon(daemon)]);

package/src/audit/types.ts

@@ -217,6 +217,11 @@ export interface AuditResult {
    *  Lets the dashboard answer "is this policy already on?" for
    *  detector-mapped policies that may not have hit during this audit. */
   enabledBuiltinNames: string[];
+  /** Ids of credentials encountered by this scan, including ones already in
+   *  the persistent leak record. Scheduled desktop notifications key on this
+   *  list so every completed scan that still sees a leak can notify; the
+   *  narrower `newLeakIds` remains for first-seen-only surfaces. */
+  leakIds?: string[];
   /**
    * Ids of credentials seen for the FIRST time in this scan.
    *

package/src/hooks/configure-wizard.ts

@@ -106,6 +106,7 @@ import {
   type RetryProbe,
 } from "./onboarding-attempt";
 import { acquireOnboardingLock } from "./onboarding-lock";
+import { readConfigRaw, updateConfig } from "./fp-config";
 
 export interface WizardIO {
   stdin?: TTYIn;
@@ -755,6 +756,19 @@ export async function runConfigureWizard(
   // question, and no flag can supply it.
   const preAnswered = Boolean(answers.token);
 
+  // Capture the preference BEFORE the daemon setup writes config.json. A fresh
+  // machine reaches `setDaemonConfigured(true)` with no config file; that helper
+  // necessarily materialises the conservative no-file default (`auto: false`).
+  // Looking after that write cannot distinguish "the user switched it off"
+  // from "setup just wrote its fallback", which is how new installs ended up
+  // with a seven-day scheduler that was explicitly disabled.
+  const initialAudit = readConfigRaw().raw.audit;
+  const hadExplicitAuditAuto =
+    !!initialAudit &&
+    typeof initialAudit === "object" &&
+    !Array.isArray(initialAudit) &&
+    typeof (initialAudit as Record<string, unknown>).auto === "boolean";
+
 
   // Running the wizard itself under sudo configures the WRONG ACCOUNT, and
   // does it silently: homedir() becomes /root, so the hooks land in root's
@@ -1439,6 +1453,20 @@ export async function runConfigureWizard(
   // binary filename are both derived from it.
   if (daemonInstalled) {
     setDaemonConfigured(true, cliVersion);
+    // A completed setup is the default opt-in to the LOCAL seven-day scan. It
+    // does not imply an email address or make a network request: reporting is
+    // independently gated by the signed-in audit identity. Reconfiguration
+    // preserves an explicit `auto: false`, so the user's off switch remains an
+    // off switch instead of being undone whenever they repair or upgrade the
+    // daemon.
+    if (!hadExplicitAuditAuto) {
+      try {
+        updateConfig({ audit: { auto: true } });
+      } catch {
+        // The daemon and hooks are already installed. Keep setup successful;
+        // the status screen will expose that scheduling could not be persisted.
+      }
+    }
     // Only now — the unit points at the new binary, so older ones are no
     // longer referenced by anything. Keeps the previous version for an
     // offline rollback.