local-operator-ui 0.28.0 → 0.28.2

package/out/main/index.js

@@ -5511,7 +5511,7 @@ function reapSupersededGenerations(options, keep, now = Date.now()) {
     } catch {
       continue;
     }
-    const survivors = new Set(kept ? [kept] : []);
+    const survivors = new Set(kept ?? []);
     const generations = [];
     for (const name of names) {
       const path2 = path$1.join(root, name);
@@ -5673,40 +5673,73 @@ async function prepareManagedPython(options, install) {
     const state = inspectManagedSelection(options);
     if (state.kind === "ready") return state.selection;
     const superseded = state.kind === "missing" ? state.detail : null;
-    const published = state.kind === "missing" ? state.published : void 0;
-    const root = managedPythonRoot(options);
-    reapSupersededGenerations(options, {
-      runtime: published && publishedRuntimeIsReusable(options, published) ? published.runtime : void 0
-    });
-    const { runtime, id: id2 } = await prepareRuntime(options);
-    await promises.mkdir(environmentsRoot(options), { recursive: true, mode: 448 });
-    realDirectory(environmentsRoot(options));
-    const venv = path$1.join(environmentsRoot(options), `${id2}-${node_crypto.randomUUID()}`);
-    if (!await install(venv, pythonPath(runtime)))
-      throw new Error(
-        "Backend preparation did not complete. Your previous environment and data were preserved."
-      );
-    const env = withPythonBytecodeCache({ ...process.env }, options.support);
-    const backendVersion = await smokeEnvironment(venv, env);
-    const selection = {
-      format: FORMAT,
-      runtimeId: id2,
-      runtime,
-      venv,
-      backendVersion
-    };
-    const bytes = `${JSON.stringify(selection)}
+    const published = state.kind === "missing" ? state.published : null;
+    return publishGeneration(options, install, published, superseded, false);
+  });
+}
+async function publishGeneration(options, install, published, superseded, keepPublished) {
+  const root = managedPythonRoot(options);
+  reapSupersededGenerations(options, {
+    runtime: published && (keepPublished || publishedRuntimeIsReusable(options, published)) ? [published.runtime] : [],
+    venv: keepPublished && published ? [published.venv] : []
+  });
+  const { runtime, id: id2 } = await prepareRuntime(options);
+  await promises.mkdir(environmentsRoot(options), { recursive: true, mode: 448 });
+  realDirectory(environmentsRoot(options));
+  const venv = path$1.join(environmentsRoot(options), `${id2}-${node_crypto.randomUUID()}`);
+  if (!await install(venv, pythonPath(runtime)))
+    throw new Error(
+      "Backend preparation did not complete. Your previous environment and data were preserved."
+    );
+  const env = withPythonBytecodeCache({ ...process.env }, options.support);
+  const backendVersion = await smokeEnvironment(venv, env);
+  const selection = {
+    format: FORMAT,
+    runtimeId: id2,
+    runtime,
+    venv,
+    backendVersion
+  };
+  const bytes = `${JSON.stringify(selection)}
 `;
-    await promises.writeFile(path$1.join(venv, READY), bytes, { flag: "wx", mode: 384 });
-    const temporary = path$1.join(root, `.selection-${node_crypto.randomUUID()}.json`);
-    await promises.writeFile(temporary, bytes, { flag: "wx", mode: 384 });
-    await promises.rename(temporary, path$1.join(root, POINTER));
-    reapSupersededGenerations(options, { runtime, venv });
-    if (superseded)
-      console.warn(
-        `Replaced an unusable managed Python selection: ${superseded}`
-      );
-    return selection;
+  await promises.writeFile(path$1.join(venv, READY), bytes, { flag: "wx", mode: 384 });
+  const temporary = path$1.join(root, `.selection-${node_crypto.randomUUID()}.json`);
+  await promises.writeFile(temporary, bytes, { flag: "wx", mode: 384 });
+  await promises.rename(temporary, path$1.join(root, POINTER));
+  reapSupersededGenerations(options, {
+    runtime: keepPublished && published ? [runtime, published.runtime] : [runtime],
+    venv: keepPublished && published ? [venv, published.venv] : [venv]
+  });
+  if (superseded)
+    console.warn(
+      `Replaced an unusable managed Python selection: ${superseded}`
+    );
+  return selection;
+}
+function publishedBackendVersion(options) {
+  return readManagedSelection(options)?.backendVersion ?? null;
+}
+function managedSelectionSatisfies(options, target2, isNewer) {
+  if (!target2) return true;
+  const published = publishedBackendVersion(options);
+  if (published === null) return false;
+  return !isNewer(target2, published);
+}
+async function updateManagedPython(options, install, decision) {
+  return locked(managedPythonRoot(options), async () => {
+    const state = inspectManagedSelection(options);
+    const published = state.kind === "ready" ? state.selection : null;
+    if (published && managedSelectionSatisfies(options, decision.target, decision.isNewer))
+      return { selection: published, replaced: false, previous: null };
+    const previous = published ?? (state.kind === "missing" ? state.published : null);
+    const selection = await publishGeneration(
+      options,
+      install,
+      previous,
+      state.kind === "missing" ? state.detail : null,
+      true
+    );
+    return { selection, replaced: true, previous };
   });
 }
 function isLegacyManagedCommand(command, support) {
@@ -8308,6 +8341,19 @@ class BackendServiceManager {
     return this.restartPromise;
   }
 }
+function managedPythonOptions() {
+  return {
+    support: path$1.join(
+      electron.app.getPath("home"),
+      "Library",
+      "Application Support",
+      "Local Operator"
+    ),
+    resources: !electron.app.isPackaged ? path$1.join(process.cwd(), "resources") : path$1.join(process.resourcesPath),
+    packaged: electron.app.isPackaged,
+    arch: process.arch
+  };
+}
 const linuxInstallScriptRaw = '#!/bin/bash\n# Local Operator Backend Installation Script for Linux\n# This script sets up a virtual environment for the Local Operator backend\n# without requiring sudo or admin privileges.\n\n# Exit on error, undefined variables, and failed pipe commands\nset -e  # Exit immediately if a command exits with a non-zero status\nset -u  # Error on unset variables\nset -o pipefail  # Fail if any command in a pipe fails\n\n# Configuration\n# Variables APP_NAME and MIN_PYTHON_VERSION removed as they were unused\nVENV_NAME="local-operator-venv"\nAPP_DATA_DIR="${HOME}/.config/local-operator"\nVENV_PATH="${APP_DATA_DIR}/${VENV_NAME}"\nLOG_FILE="${APP_DATA_DIR}/backend-install.log"\nTIMESTAMP=$(date +"%Y-%m-%d_%H-%M-%S")\n\n# Which environment this installs into - the app\'s decision, handed in. See the\n# macOS script for why the script must not re-derive it (a packaged and an\n# unpackaged instance use different environments, and only the app knows which\n# it is); `LOCAL_OPERATOR_VENV_PATH` is set from `managedVenvPath`.\n: "${LOCAL_OPERATOR_VENV_PATH:=$VENV_PATH}"\nVENV_PATH="$LOCAL_OPERATOR_VENV_PATH"\n\n# Keep CPython\'s bytecode cache out of the application directory.\n#\n# Same reason as the macOS script: an interpreter writing __pycache__/*.pyc\n# beside its own stdlib sources writes into the installed tree. Linux does not\n# code-seal the app the way macOS does, so this is uniformity and hygiene here\n# rather than the load-bearing fix it is on macOS - but it is also the value a\n# standalone run of this script has to agree with, because the app and the\n# script must not disagree about where bytecode goes.\n: "${PYTHONPYCACHEPREFIX:=${APP_DATA_DIR}/python-bytecode-cache}"\nexport PYTHONPYCACHEPREFIX\n\n# The refusal half of the pair, set rather than merged with whatever the caller\n# had: CPython reads the flag before its first import, so nothing this script\n# runs - `-m venv`, pip, the venv they create - can write a `__pycache__` at\n# all. Kept in step with the app\'s `withPythonBytecodeCache`, which sets both\n# variables on every python it spawns.\nexport PYTHONDONTWRITEBYTECODE=1\n\n# Create app data directory if it doesn\'t exist\nif ! mkdir -p "${APP_DATA_DIR}"; then\n  echo "ERROR: Unable to create app data directory at ${APP_DATA_DIR}"\n  echo "Please check permissions and try again."\n  exit 1\nfi\n\n# Handle cleanup on script exit\ncleanup() {\n  # Remove any temporary files created during execution\n  if [ -f "${APP_DATA_DIR}/get-pip.py" ]; then\n    rm -f "${APP_DATA_DIR}/get-pip.py"\n  fi\n  if [ -n "${FFMPEG_TEMP_ARCHIVE:-}" ] && [ -f "${FFMPEG_TEMP_ARCHIVE}" ]; then\n    log "Removing temporary FFmpeg archive: ${FFMPEG_TEMP_ARCHIVE}"\n    rm -f "${FFMPEG_TEMP_ARCHIVE}"\n  fi\n  echo "$(date): Cleanup completed."\n}\n\n# Set trap only for manual interruption (SIGINT, SIGTERM), not normal exits\ntrap cleanup SIGINT SIGTERM\n\n\n# Start logging\nexec > >(tee -a "${LOG_FILE}") 2>&1\necho "[${TIMESTAMP}]: Starting Local Operator backend installation..."\necho "[${TIMESTAMP}]: System information: $(uname -a)"\n\n# Function to log messages with timestamp (defined later, but used by FFmpeg section)\n_log_internal() {\n  local internal_timestamp\n  internal_timestamp=$(date +"%Y-%m-%d %H:%M:%S")\n  echo "[${internal_timestamp}] $1"\n}\n\n# --- FFmpeg Installation ---\nBIN_DIR="${APP_DATA_DIR}/bin"\nFFMPEG_BIN="${BIN_DIR}/ffmpeg" # Path to ffmpeg binary\n\n_log_internal "Ensuring bin directory exists: ${BIN_DIR}"\nif ! mkdir -p "${BIN_DIR}"; then\n    _log_internal "ERROR: Unable to create bin directory at ${BIN_DIR}"\n    exit 1\nfi\n\n# Check if FFmpeg is already installed and executable\nif [ -f "${FFMPEG_BIN}" ] && [ -x "${FFMPEG_BIN}" ]; then\n    _log_internal "FFmpeg already installed at ${FFMPEG_BIN}. Skipping download."\nelse\n    _log_internal "FFmpeg not found or not executable. Attempting to download and install FFmpeg..."\n\n    FFMPEG_DOWNLOAD_URL=""\n\n    LINUX_ARCH=$(uname -m)\n    if [[ "${LINUX_ARCH}" == "x86_64" ]]; then\n        FFMPEG_DOWNLOAD_URL="https://github.com/eugeneware/ffmpeg-static/releases/download/b6.0/ffmpeg-linux-x64"\n    elif [[ "${LINUX_ARCH}" == "aarch64" ]] || [[ "${LINUX_ARCH}" == "arm64" ]]; then\n        FFMPEG_DOWNLOAD_URL="https://github.com/eugeneware/ffmpeg-static/releases/download/b6.0/ffmpeg-linux-arm64"\n    else\n        _log_internal "Error: Unsupported CPU architecture for FFmpeg download: ${LINUX_ARCH}"\n        exit 1\n    fi\n\n    _log_internal "Downloading FFmpeg from: ${FFMPEG_DOWNLOAD_URL}"\n    if command -v curl >/dev/null 2>&1; then\n        if ! curl -L "${FFMPEG_DOWNLOAD_URL}" -o "${FFMPEG_BIN}"; then\n            _log_internal "Error: Failed to download FFmpeg using curl from ${FFMPEG_DOWNLOAD_URL}"\n            exit 1\n        fi\n    elif command -v wget >/dev/null 2>&1; then\n        if ! wget -O "${FFMPEG_BIN}" "${FFMPEG_DOWNLOAD_URL}"; then\n            _log_internal "Error: Failed to download FFmpeg using wget from ${FFMPEG_DOWNLOAD_URL}"\n            exit 1\n        fi\n    else\n        _log_internal "Error: Neither curl nor wget found. Cannot download FFmpeg."\n        exit 1\n    fi\n    _log_internal "FFmpeg binary downloaded successfully to ${FFMPEG_BIN}"\n\n    chmod +x "${FFMPEG_BIN}"\n    _log_internal "Set executable permissions for ${FFMPEG_BIN}"\n\n    # Verify FFmpeg is executable after download\n    if [ ! -f "${FFMPEG_BIN}" ] || [ ! -x "${FFMPEG_BIN}" ]; then\n        _log_internal "Error: FFmpeg binary not found or not executable after download."\n        exit 1\n    fi\nfi\n\n_log_internal "FFmpeg installation complete. FFmpeg binary is at: ${FFMPEG_BIN}"\n\n# Function to check if a command exists\ncommand_exists() {\n  command -v "$1" >/dev/null 2>&1\n}\n\n# Function to log messages with timestamp\nlog() {\n  local timestamp\n  timestamp=$(date +"%Y-%m-%d %H:%M:%S")\n  echo "[${timestamp}] $1"\n}\n\n# Function to display error messages and exit\nerror_exit() {\n  log "ERROR: $1" >&2\n  exit "${2:-1}"\n}\n\n# Function to check if Python binary is valid for current architecture\nis_valid_python_binary() {\n  local python_path="$1"\n  \n  # First check if file exists and is executable\n  if [ ! -f "${python_path}" ] || [ ! -x "${python_path}" ]; then\n    return 1\n  fi\n  \n  # Try to run a simple Python command to verify it works on current architecture\n  "${python_path}" -c "print(\'Testing Python executable\')" >/dev/null 2>&1\n  return $?\n}\n\n# Check for network connectivity to key servers\ncheck_connectivity() {\n  log "Checking network connectivity..."\n  local servers=("pypi.org" "bootstrap.pypa.io")\n  local has_connectivity=false\n  \n  for server in "${servers[@]}"; do\n    if command_exists curl; then\n      if curl --connect-timeout 5 -s "https://${server}" -o /dev/null; then\n        has_connectivity=true\n        break\n      fi\n    elif command_exists wget; then\n      if wget --timeout=5 -q --spider "https://${server}"; then\n        has_connectivity=true\n        break\n      fi\n    fi\n  done\n  \n  if [ "$has_connectivity" = false ]; then\n    log "WARNING: Network connectivity issues detected. This may affect installation."\n  else\n    log "Network connectivity confirmed."\n  fi\n}\n\n# Call connectivity check\ncheck_connectivity\n\n# Check if PYTHON_BIN is already set by the installer\nif [ -n "${PYTHON_BIN:-}" ]; then\n  log "Using Python executable provided by installer: ${PYTHON_BIN}"\n  # Verify the provided Python binary works on this architecture\n  if ! is_valid_python_binary "${PYTHON_BIN}"; then\n    log "Warning: The provided Python binary is not compatible with this system architecture."\n    log "Will attempt to find a system Python installation instead."\n    PYTHON_BIN=""\n  fi\nfi\n\n# If PYTHON_BIN is empty or invalid, try to find a suitable Python installation\nif [ -z "${PYTHON_BIN:-}" ] || ! is_valid_python_binary "${PYTHON_BIN:-}"; then\n  # Try to find a suitable Python installation\n  log "Looking for a suitable Python installation..."\n  \n  # Try multiple possible locations to find Python\n  POSSIBLE_PYTHON_PATHS=(\n    # System paths first (more likely to be compatible with current architecture)\n    "/usr/local/bin/python3.12"\n    "/usr/bin/python3.12"\n    "/usr/local/bin/python3"\n    "/usr/bin/python3"\n    # From environment variable (set by the installer)\n    "${ELECTRON_RESOURCE_PATH:-}/python/bin/python3"\n    # Development paths\n    "$(dirname "$0")/../../../resources/python/bin/python3"\n    "$(pwd)/resources/python/bin/python3"\n  )\n\n  # Find the first Python that exists and is version 3.12+ and works on this architecture\n  PYTHON_BIN=""\n  for path in "${POSSIBLE_PYTHON_PATHS[@]}"; do\n    # Skip empty paths that might come from unset environment variables\n    if [ -z "${path}" ]; then\n      continue\n    fi\n    \n    if is_valid_python_binary "${path}"; then\n      # Check Python version\n      if PY_VERSION=$("${path}" -c "import sys; print(f\'{sys.version_info.major}.{sys.version_info.minor}\')" 2>/dev/null); then\n        MAJOR=$(echo "${PY_VERSION}" | cut -d. -f1)\n        MINOR=$(echo "${PY_VERSION}" | cut -d. -f2)\n        if [ "${MAJOR}" -eq 3 ] && [ "${MINOR}" -ge 12 ]; then\n          PYTHON_BIN="${path}"\n          log "Found suitable Python ${PY_VERSION} at ${path}"\n          break\n        else\n          log "Python at ${path} is version ${PY_VERSION}, which is below the required 3.12+"\n        fi\n      fi\n    else\n      if [ -f "${path}" ]; then\n        log "Python at ${path} exists but is not compatible with this system architecture"\n      fi\n    fi\n  done\n\n  # If we couldn\'t find a suitable Python, exit with error\n  if [ -z "${PYTHON_BIN:-}" ]; then\n    error_exit "No suitable Python installation found (version 3.12 or higher required).\\nPlease install Python 3.12 or higher before running this script.\\nYou can install Python from https://www.python.org/downloads/"\n  fi\nfi\n\necho "Using Python: $PYTHON_BIN"\n"$PYTHON_BIN" --version || {\n  echo "Error: Failed to run Python. Please ensure it is executable and accessible."\n  echo "System architecture: $(uname -m)"\n  echo "Python binary architecture: $(file "$PYTHON_BIN" 2>/dev/null || echo \'Unable to determine\')"\n  exit 1\n}\n\n# Detect the Linux distribution to provide specific instructions\nif command_exists lsb_release; then\n  DISTRO=$(lsb_release -is)\n  DISTRO_VERSION=$(lsb_release -rs)\n  echo "Detected Linux distribution: $DISTRO $DISTRO_VERSION"\nelif [ -f /etc/os-release ]; then\n  DISTRO=$(grep -oP \'(?<=^ID=).+\' /etc/os-release | tr -d \'"\')\n  DISTRO_VERSION=$(grep -oP \'(?<=^VERSION_ID=).+\' /etc/os-release | tr -d \'"\')\n  echo "Detected Linux distribution: $DISTRO $DISTRO_VERSION"\nelse\n  DISTRO="unknown"\n  echo "Unable to detect Linux distribution"\nfi\n\n# Check if Python has venv module and ensurepip available\nlog "Checking for venv module and ensurepip availability..."\nVENV_AVAILABLE=0\nENSUREPIP_AVAILABLE=0\n\n"${PYTHON_BIN}" -c "import venv" > /dev/null 2>&1 || VENV_AVAILABLE=1\n"${PYTHON_BIN}" -c "import ensurepip" > /dev/null 2>&1 || ENSUREPIP_AVAILABLE=1\n\n# If venv is still not available, try to use virtualenv as a fallback\nif [ $VENV_AVAILABLE -ne 0 ]; then\n  echo "venv module is not available. Checking for virtualenv as an alternative..."\n  \n  # Check if virtualenv is already installed\n  if "$PYTHON_BIN" -c "import virtualenv" > /dev/null 2>&1; then\n    echo "virtualenv is available, will use it instead of venv"\n  else\n    echo "ERROR: Neither venv nor virtualenv is available."\n    echo "Python 3.12 and venv should be installed as package dependencies."\n    echo "Please ensure Python 3.12 and venv are properly installed on your system."\n    exit 1\n  fi\nfi\n\n# Create virtual environment if it doesn\'t exist\nif [ ! -d "$VENV_PATH" ]; then\n  echo "Creating virtual environment at $VENV_PATH..."\n  # Remove any potentially corrupted virtual environment\n  if [ -e "$VENV_PATH" ]; then\n    echo "Removing existing but potentially corrupted venv directory..."\n    rm -rf "$VENV_PATH"\n  fi\n  \n  # Make sure parent directory exists and is writable\n  mkdir -p "$(dirname "$VENV_PATH")"\n  \n  # Try different methods to create a virtual environment\n  VENV_CREATE_STATUS=1\n  \n  # First try with venv if available\n  if [ $VENV_AVAILABLE -eq 0 ] && [ $ENSUREPIP_AVAILABLE -eq 0 ]; then\n    echo "Creating virtual environment using venv module..."\n    "$PYTHON_BIN" -m venv "$VENV_PATH"\n    VENV_CREATE_STATUS=$?\n  fi\n  \n  # If venv failed, try virtualenv\n  if [ $VENV_CREATE_STATUS -ne 0 ]; then\n    echo "venv creation failed with status $VENV_CREATE_STATUS. Falling back to virtualenv..."\n    if command_exists virtualenv; then\n      virtualenv -p "$PYTHON_BIN" "$VENV_PATH"\n      VENV_CREATE_STATUS=$?\n    elif "$PYTHON_BIN" -m pip list | grep -q virtualenv; then\n      "$PYTHON_BIN" -m virtualenv -p "$PYTHON_BIN" "$VENV_PATH"\n      VENV_CREATE_STATUS=$?\n    else\n      echo "ERROR: Both venv and virtualenv are unavailable or failed."\n      echo "Python 3.12 and venv should be installed as package dependencies."\n      echo "Please ensure Python 3.12 and venv are properly installed on your system."\n      echo "You can install Python 3.12 from https://www.python.org/downloads/"\n      exit 1\n    fi\n  fi\n  \n  # Check if virtual environment creation was successful\n  if [ $VENV_CREATE_STATUS -ne 0 ]; then\n    log "ERROR: Failed to create virtual environment. Exit code: $VENV_CREATE_STATUS"\n    log "Virtual environment path: $VENV_PATH"\n    log "Python binary used: $PYTHON_BIN"\n    ls -la "$(dirname "$VENV_PATH")" || true\n    log "Python executable permissions:"\n    ls -la "$PYTHON_BIN" || true\n    \n    # Check for common issues\n    log "Checking for common virtual environment creation issues..."\n    \n    # Check disk space\n    df -h "$(dirname "$VENV_PATH")" || true\n    \n    # Check if directory is writable\n    if [ ! -w "$(dirname "$VENV_PATH")" ]; then\n      log "ERROR: Directory $(dirname "$VENV_PATH") is not writable"\n    fi\n    \n    # Try to create a minimal virtual environment manually as a last resort\n    log "Attempting to create a minimal virtual environment manually..."\n    mkdir -p "$VENV_PATH/bin" || error_exit "Could not create directory $VENV_PATH/bin"\n    echo "#!/bin/bash" > "$VENV_PATH/bin/activate"\n    echo "export VIRTUAL_ENV=\\"$VENV_PATH\\"" >> "$VENV_PATH/bin/activate"\n    echo "export PATH=\\"$VENV_PATH/bin:\\$PATH\\"" >> "$VENV_PATH/bin/activate"\n    echo "unset PYTHONHOME" >> "$VENV_PATH/bin/activate"\n    chmod +x "$VENV_PATH/bin/activate" || error_exit "Could not set execute permissions on activate script"\n    \n    # Create symlinks to the system Python\n    ln -sf "$PYTHON_BIN" "$VENV_PATH/bin/python" || log "WARNING: Failed to create symlink for python"\n    ln -sf "$PYTHON_BIN" "$VENV_PATH/bin/python3" || log "WARNING: Failed to create symlink for python3"\n    \n    # Try to bootstrap pip\n    log "Bootstrapping pip in the minimal virtual environment..."\n    if command_exists curl; then\n      curl -s https://bootstrap.pypa.io/get-pip.py -o "$APP_DATA_DIR/get-pip.py" || log "WARNING: Failed to download get-pip.py"\n    elif command_exists wget; then\n      wget -q -O "$APP_DATA_DIR/get-pip.py" https://bootstrap.pypa.io/get-pip.py || log "WARNING: Failed to download get-pip.py"\n    else\n      log "ERROR: Neither curl nor wget available to download get-pip.py"\n      error_exit "Installation cannot continue without being able to download pip"\n    fi\n    \n    # shellcheck disable=SC1090\n    source "$VENV_PATH/bin/activate" && python "$APP_DATA_DIR/get-pip.py" --no-warn-script-location\n    \n    if [ ! -f "$VENV_PATH/bin/pip" ]; then\n      error_exit "Failed to create even a minimal virtual environment."\n    else\n      log "Created a minimal virtual environment as a fallback."\n    fi\n  else\n    log "Successfully created virtual environment"\n  fi\nfi\n\n# Verify the virtual environment structure\necho "Verifying virtual environment structure..."\nif [ ! -f "$VENV_PATH/bin/python" ]; then\n  echo "Python executable missing in virtual environment, creating symlink..."\n  ln -sf "$PYTHON_BIN" "$VENV_PATH/bin/python"\nfi\n\nif [ ! -f "$VENV_PATH/bin/pip" ]; then\n  echo "pip missing in virtual environment, attempting to bootstrap it..."\n  curl -s https://bootstrap.pypa.io/get-pip.py -o "$APP_DATA_DIR/get-pip.py"\n  "$VENV_PATH/bin/python" "$APP_DATA_DIR/get-pip.py" --no-warn-script-location\n  \n  if [ ! -f "$VENV_PATH/bin/pip" ]; then\n    echo "ERROR: Failed to bootstrap pip in the virtual environment"\n    exit 1\n  fi\nfi\n\necho "Virtual environment structure verified"\n\n# Activate virtual environment and install local-operator\necho "Installing local-operator in virtual environment..."\nsource "$VENV_PATH/bin/activate"\n\necho "Upgrading pip..."\npython -m pip install --upgrade pip || {\n  echo "WARNING: Failed to upgrade pip. Will try to continue with existing pip version."\n  pip --version\n}\n\n# Check network connectivity to PyPI\necho "Checking network connectivity to PyPI..."\nif command_exists curl; then\n  curl -s https://pypi.org/pypi/local-operator/json -o /dev/null || {\n    echo "WARNING: Could not reach PyPI. Network connectivity issues might prevent installation."\n  }\nelif command_exists wget; then\n  wget -q --spider https://pypi.org/pypi/local-operator/json || {\n    echo "WARNING: Could not reach PyPI. Network connectivity issues might prevent installation."\n  }\nfi\n\necho "Installing local-operator package..."\npython -m pip install --verbose local-operator || {\n  echo "ERROR: Failed to install local-operator package. Exit code: $?"\n  echo "Python version:"\n  python --version\n  echo "pip version:"\n  pip --version\n  echo "Available pip packages:"\n  pip list\n  exit 1\n}\necho "local-operator installation successful"\n\n# Verify installation\nif [ -f "$VENV_PATH/bin/local-operator" ]; then\n  log "Local Operator backend installed successfully!"\n  \n  # Show more information about the installed binary\n  ls -la "$VENV_PATH/bin/local-operator" || true\n  file "$VENV_PATH/bin/local-operator" 2>/dev/null || log "Note: \'file\' command not available"\n  \n  # Try to run the version command with full error output\n  log "Testing local-operator binary..."\n  "$VENV_PATH/bin/local-operator" --version || {\n    log "ERROR: local-operator binary exists but failed to execute. Exit code: $?"\n    log "Binary details:"\n    file "$VENV_PATH/bin/local-operator" 2>/dev/null || log "Note: \'file\' command not available"\n    log "Binary permissions:"\n    ls -la "$VENV_PATH/bin/local-operator" || true\n    log ""\n    log "This could be due to missing dependencies or architecture incompatibility."\n    log "Try running the binary manually to see specific errors."\n    \n    # Don\'t exit here - just warn the user\n    log "WARNING: Installation completed but binary verification failed."\n  }\n  \n  # Create a summary of the installation\n  SUMMARY_FILE="${APP_DATA_DIR}/installation-summary-${TIMESTAMP}.txt"\n  {\n    echo "=== Local Operator Backend Installation Summary ==="\n    echo "Timestamp: $(date)"\n    echo "Python Version: $("${PYTHON_BIN}" --version 2>&1)"\n    echo "Virtual Environment: ${VENV_PATH}"\n    echo "Binary Location: ${VENV_PATH}/bin/local-operator"\n    echo "To activate the virtual environment, run: source ${VENV_PATH}/bin/activate"\n    echo "To test the installation, run: ${VENV_PATH}/bin/local-operator --version"\n    echo "Log file: ${LOG_FILE}"\n    echo "=================================================="\n  } > "${SUMMARY_FILE}"\n  \n  log "Installation summary saved to: ${SUMMARY_FILE}"\nelse\n  log "Error: Failed to install Local Operator backend. Binary not found."\n  log "Contents of bin directory:"\n  ls -la "$VENV_PATH/bin/" || true\n  log "Check the log file for details: ${LOG_FILE}"\n  error_exit "Installation failed. Binary not installed properly."\nfi\n\nlog "Installation completed successfully at $(date)"\n\n# Clean up temporary files now that installation is complete\ncleanup\n\n# Print final instructions\nlog ""\nlog "=== INSTALLATION COMPLETE ==="\nlog "You can now use the Local Operator backend by running: ${VENV_PATH}/bin/local-operator"\nlog "Installation directory: ${VENV_PATH}"\nlog "Log file: ${LOG_FILE}"\nlog "================================"\n';
 const macosInstallScriptRaw = '#!/bin/bash\n# Local Operator Backend Installation Script for macOS\n# This script uses the bundled standalone Python and sets up a virtual environment for the Local Operator backend.\n\nset -e  # Exit immediately if a command exits with a non-zero status\n\n# Configuration\nAPP_NAME="Local Operator"\nVENV_NAME="local-operator-venv"\nAPP_DATA_DIR="${LOCAL_OPERATOR_SUPPORT_PATH:-$HOME/Library/Application Support/$APP_NAME}"\nVENV_PATH="$APP_DATA_DIR/$VENV_NAME"\nLOG_FILE="$APP_DATA_DIR/backend-install.log"\n\n# Which environment this installs into. The path is the app\'s decision, not this\n# script\'s: a packaged install and an unpackaged one must not share an\n# environment (the venv is built on whatever interpreter the instance resolves,\n# and the installed bundle\'s stdlib lives inside the code-sealed .app), and only\n# the app knows which one it is. The app passes its answer in\n# (`LOCAL_OPERATOR_VENV_PATH`, set from `managedVenvPath` in\n# src/main/backend/venv-paths.ts).\n#\n# macOS REFUSES a standalone run rather than falling back, and the asymmetry with\n# the Linux and Windows scripts is deliberate. Their default is the packaged name,\n# which is harmless there; here it is the exact environment this split exists to\n# stop a second instance from writing into - the measured failure is a dev-venv\n# interpreter whose stdlib is `/Applications/Local Operator.app/Contents/\n# Resources/python_aarch64`, so a silent default would rebuild that venv and\n# `pip install` into it, which is what R1 of the review caught. A caller that\n# cannot name the environment is a caller that should not be installing into one.\n: "${LOCAL_OPERATOR_VENV_PATH:?Pass the resolved managed environment path (see venv-paths.ts); this script will not guess which instance it belongs to}"\nVENV_PATH="$LOCAL_OPERATOR_VENV_PATH"\n\n# Keep CPython\'s bytecode cache out of the application bundle.\n#\n# The bundled interpreter writes __pycache__/*.pyc beside the stdlib sources it\n# imports, and those sources live inside the code-signed .app - which is the\n# build\'s own extraResource. Every such write is a change to a sealed resource:\n# measured on an installed 0.17.3, `codesign --verify --deep` reported 308\n# `file added:` violations, all of them .pyc, and ShipIt then refuses the\n# in-place update with -67028 errSecCSBadBundleFormat. A file codesign reports\n# as *added* can be deleted and the seal comes back; a *modified* one cannot,\n# which is why nothing may ship a .pyc at all. The app sets this variable when\n# it spawns us; defaulting it here keeps a standalone run of this script in\n# agreement with the app about where bytecode goes. It is not a complete answer:\n# the app does not spawn every python that runs this interpreter, and a python\n# started by something else - a shell, a CLI script, an agent - has no prefix at\n# all (measured: a venv over this tree wrote 25 .pyc into it that way). The half\n# that covers those is the app\'s seal on the tree itself\n# (src/main/python-bytecode-cache.ts), which a standalone run of this script does\n# not apply. $HOME is the right place for the cache for the same reason the venv\n# lives there: it is never inside the thing that gets signed and swapped.\n: "${PYTHONPYCACHEPREFIX:=$APP_DATA_DIR/python-bytecode-cache}"\nexport PYTHONPYCACHEPREFIX\n\n# And the refusal half of the same pair, so a standalone run of this script\n# cannot write bytecode into the bundle even where the redirect above does not\n# apply - a relative or unwritable prefix, or a child that drops the variable.\n# CPython reads the flag before its first import, so this script\'s own\n# `python -m venv`, its pip runs and the venv they create all compile without\n# writing a `__pycache__` anywhere. Measured on CPython: `0` and the empty\n# string are the two falsy spellings, so the value is set rather than merged\n# with whatever the caller had.\nexport PYTHONDONTWRITEBYTECODE=1\n\n# The architecture block that used to live here computed and logged the name of\n# a directory for an in-bundle search this script no longer performs: every run\n# announced which architecture-named directory it was about to use, and then\n# installed from `PYTHON_BIN` anyway - the line stated the opposite of how the\n# script finds Python, and the names it computed were used nowhere else (review\n# N1). Which interpreter to build the environment with is the caller\'s decision,\n# checked immediately below.\n\n# The app prepares a complete external runtime before invoking this script.\n# Searching /Applications here would reintroduce legacy-bundle execution during\n# migration. Standalone callers must make the same explicit path decision.\n: "${PYTHON_BIN:?Pass an external prepared Python executable}"\ncase "$PYTHON_BIN" in\n  *.app/*) echo "Refusing to execute Python inside an application bundle" >&2; exit 1 ;;\nesac\n\n# Create app data directory if it doesn\'t exist\nmkdir -p "$APP_DATA_DIR"\n\n# Start logging - capture everything and ensure it\'s visible to parent process\nexec > >(tee -a "$LOG_FILE") 2> >(tee -a "$LOG_FILE" >&2)\necho "=============================================="\necho "$(date): Starting Local Operator backend installation..."\necho "=============================================="\necho "Python bin path: $PYTHON_BIN"\necho "Virtual environment path: $VENV_PATH"\necho "App data directory: $APP_DATA_DIR"\necho "Log file: $LOG_FILE"\necho "=============================================="\n\n# --- FFmpeg Installation ---\nBIN_DIR="$APP_DATA_DIR/bin"\nFFMPEG_BIN="$BIN_DIR/ffmpeg"\n\necho "Ensuring bin directory exists: $BIN_DIR"\nmkdir -p "$BIN_DIR"\n\n# Check if FFmpeg is already installed and executable\nif [ -f "$FFMPEG_BIN" ] && [ -x "$FFMPEG_BIN" ]; then\n    echo "FFmpeg already installed at $FFMPEG_BIN. Skipping download."\nelse\n    echo "FFmpeg not found or not executable. Attempting to download and install FFmpeg..."\n\n    # The architecture, read here because this URL is the one place left that needs\n    # it: the environment is built on `PYTHON_BIN`, handed in above, so nothing\n    # else in this script derives anything from `uname -m`. The block that used to\n    # compute it at the top of the file was removed with the in-bundle interpreter\n    # search it existed for (review N1) - and that removal took this variable with\n    # it while this block still read it, so `$ARCH` was empty for every caller,\n    # including the app, and any install on a machine without a cached ffmpeg\n    # exited 1 here, before the venv was ever created. Measured: `bash\n    # src/main/backend/scripts/macos-install-script.sh` with `PYTHON_BIN` set stops\n    # on "Unsupported CPU architecture for FFmpeg download:".\n    ARCH=$(uname -m)\n\n    FFMPEG_DOWNLOAD_URL=""\n\n    if [[ "$ARCH" == "x86_64" ]]; then\n        FFMPEG_DOWNLOAD_URL="https://github.com/eugeneware/ffmpeg-static/releases/download/b6.0/ffmpeg-mac-x64"\n    elif [[ "$ARCH" == "arm64" ]] || [[ "$ARCH" == "aarch64" ]]; then\n        FFMPEG_DOWNLOAD_URL="https://github.com/eugeneware/ffmpeg-static/releases/download/b6.0/ffmpeg-mac-arm64"\n    else\n        echo "Error: Unsupported CPU architecture for FFmpeg download: $ARCH"\n        exit 1\n    fi\n\n    echo "Downloading FFmpeg from: $FFMPEG_DOWNLOAD_URL"\n    if curl -L "$FFMPEG_DOWNLOAD_URL" -o "$FFMPEG_BIN"; then\n        echo "FFmpeg downloaded successfully to $FFMPEG_BIN"\n        chmod +x "$FFMPEG_BIN"\n        echo "Set executable permissions for $FFMPEG_BIN"\n    else\n        echo "Error: Failed to download FFmpeg from $FFMPEG_DOWNLOAD_URL"\n        exit 1\n    fi\n\n    # Verify FFmpeg is executable after download\n    if [ ! -f "$FFMPEG_BIN" ] || [ ! -x "$FFMPEG_BIN" ]; then\n        echo "Error: FFmpeg binary not found or not executable after download."\n        exit 1\n    fi\nfi\n\necho "FFmpeg installation complete. FFmpeg binary is at: $FFMPEG_BIN"\n# --- End FFmpeg Installation ---\n\n# Verify bundled Python exists\nif [ ! -f "$PYTHON_BIN" ]; then\n  echo "Error: Bundled Python not found at $PYTHON_BIN"\n  echo "Please ensure standalone Python is properly installed in the application resources."\n  exit 1\nfi\n\n# Make sure Python binary is executable\necho "Using bundled Python: $PYTHON_BIN"\n"$PYTHON_BIN" --version\n\n# Check if Python has venv module available\necho "Checking for venv module availability..."\n"$PYTHON_BIN" -m venv --help > /dev/null 2>&1 || {\n  echo "ERROR: Python venv module not available in the Python installation"\n  echo "Python details:"\n  "$PYTHON_BIN" --version\n  "$PYTHON_BIN" -c "import sys; print(\'Prefix:\', sys.prefix); print(\'Exec Prefix:\', sys.exec_prefix)"\n  "$PYTHON_BIN" -c "import sys; print(\'Modules path:\'); print(\'\\n\'.join(sys.path))"\n  exit 1\n}\necho "venv module is available"\n\n# Create virtual environment if it doesn\'t exist\nif [ ! -d "$VENV_PATH" ]; then\n  echo "Creating virtual environment at $VENV_PATH..."\n  # Never repair a path we did not create. Preparation allocates a fresh final\n  # pathname; a collision is evidence to preserve, not a reason to delete it.\n  if [ -e "$VENV_PATH" ] || [ -L "$VENV_PATH" ]; then\n    echo "Refusing to replace an existing environment path: $VENV_PATH" >&2\n    exit 1\n  fi\n  \n  # Make sure parent directory exists and is writable\n  mkdir -p "$(dirname "$VENV_PATH")"\n  \n  # Create the virtual environment with verbosity\n  "$PYTHON_BIN" -m venv "$VENV_PATH" || {\n    echo "ERROR: Failed to create virtual environment. Exit code: $?"\n    echo "Virtual environment path: $VENV_PATH"\n    echo "Python binary used: $PYTHON_BIN"\n    ls -la "$(dirname "$VENV_PATH")"\n    echo "Python executable permissions:"\n    ls -la "$PYTHON_BIN"\n    exit 1\n  }\n  echo "Successfully created virtual environment"\nfi\n\n# Verify the virtual environment structure\necho "Verifying virtual environment structure..."\nif [ ! -f "$VENV_PATH/bin/python" ] || [ ! -f "$VENV_PATH/bin/pip" ]; then\n  echo "ERROR: Virtual environment is missing critical components"\n  echo "Contents of virtual environment directory:"\n  ls -la "$VENV_PATH"\n  if [ -d "$VENV_PATH/bin" ]; then\n    echo "Contents of bin directory:"\n    ls -la "$VENV_PATH/bin"\n  fi\n  exit 1\nfi\necho "Virtual environment structure verified"\n\n# Activate virtual environment and install local-operator\necho "Installing local-operator in virtual environment..."\nsource "$VENV_PATH/bin/activate"\n\necho "Upgrading pip..."\npython -m pip install --upgrade pip || {\n  echo "ERROR: Failed to upgrade pip. Exit code: $?"\n  echo "pip version before failing:"\n  pip --version\n  exit 1\n}\necho "pip upgrade successful:"\npip --version\n\n# Check network connectivity to PyPI\necho "Checking network connectivity to PyPI..."\ncurl -s https://pypi.org/pypi/local-operator/json -o /dev/null || {\n  echo "WARNING: Could not reach PyPI. Network connectivity issues might prevent installation."\n  echo "Attempting to ping common domains to diagnose network issues:"\n  ping -c 1 google.com || echo "Cannot ping google.com"\n  ping -c 1 pypi.org || echo "Cannot ping pypi.org"\n}\n\necho "Installing local-operator package..."\npython -m pip install --upgrade --verbose local-operator || {\n  echo "ERROR: Failed to install local-operator package. Exit code: $?"\n  echo "Python version:"\n  python --version\n  echo "pip version:"\n  pip --version\n  echo "Available pip packages:"\n  pip list\n  echo "Pip config:"\n  pip config list\n  echo "Network diagnosis:"\n  curl -I https://pypi.org || echo "Cannot reach PyPI server"\n  exit 1\n}\necho "local-operator installation successful"\n\n# Verify installation\nif [ -f "$VENV_PATH/bin/local-operator" ]; then\n  echo "Local Operator backend installed successfully!"\n  \n  # Show more information about the installed binary\n  ls -la "$VENV_PATH/bin/local-operator"\n  file "$VENV_PATH/bin/local-operator"\n  \n  # Try to run the version command with full error output\n  echo "Testing local-operator binary..."\n  "$VENV_PATH/bin/local-operator" --version || {\n    echo "ERROR: local-operator binary exists but failed to execute. Exit code: $?"\n    echo "Binary details:"\n    file "$VENV_PATH/bin/local-operator"\n    echo "Binary permissions:"\n    ls -la "$VENV_PATH/bin/local-operator"\n    echo "Dependencies:"\n    if command -v otool >/dev/null; then\n      otool -L "$VENV_PATH/bin/local-operator" || echo "Could not get dependencies with otool"\n    fi\n    exit 1\n  }\nelse\n  echo "Error: Failed to install Local Operator backend. Binary not found."\n  echo "Contents of bin directory:"\n  ls -la "$VENV_PATH/bin/"\n  exit 1\nfi\n\necho "$(date): Installation completed successfully."\n';
 const windowsInstallScriptRaw = `# Local Operator Backend Installation Script for Windows
@@ -8670,9 +8716,13 @@ const SETUP_FAILURE_CAUSES = [
     "A file the setup needed was missing, which usually means the download or the copy did not finish."
   ]
 ];
+function setupFailureCause(error) {
+  const raw = error instanceof Error ? error.message : String(error);
+  return SETUP_FAILURE_CAUSES.find(([pattern]) => pattern.test(raw))?.[1] ?? null;
+}
 function backendSetupFailureDetail(error, support) {
   const raw = error instanceof Error ? error.message : String(error);
-  const cause = SETUP_FAILURE_CAUSES.find(([pattern]) => pattern.test(raw))?.[1] ?? "The backend could not be set up on this Mac.";
+  const cause = setupFailureCause(error) ?? "The backend could not be set up on this Mac.";
   return [
     `What happened: ${cause}`,
     `The app recorded: ${raw}`,
@@ -8828,17 +8878,7 @@ class BackendInstaller {
    * @returns Promise resolving to true if the backend was installed successfully, false otherwise
    */
   managedOptions() {
-    return {
-      support: path$1.join(
-        electron.app.getPath("home"),
-        "Library",
-        "Application Support",
-        "Local Operator"
-      ),
-      resources: this.resourcesPath,
-      packaged: electron.app.isPackaged,
-      arch: process.arch
-    };
+    return managedPythonOptions();
   }
   async install() {
     if (process.platform !== "darwin") return this.installEnvironment();
@@ -16520,6 +16560,7 @@ const BETA_VERSION_REGEX = /v\d+\.\d+\.\d+\.beta\.\d+/;
 const BUNDLE_ID_REGEX = /^[\w.-]+$/;
 const INSTALL_IN_FLIGHT_RECHECK_MS = 1e4;
 const LAUNCHCTL_NOT_LOADED_REGEX = /could not find|no such process/i;
+const APP_OWNED_PUBLISH_HEADROOM_BYTES = 450 * 1024 * 1024;
 const SEAL_PROBE_TIMEOUT_MS = 45e3;
 const STARTUP_SEAL_PROBE_DELAY_MS = 15e3;
 const POST_WAKE_CHECK_DELAY_MS = 2e4;
@@ -16559,6 +16600,9 @@ function runCommand(command, args, options = {}) {
     );
   });
 }
+function installerOutputOf(run) {
+  return [run.stderr.trim(), run.stdout.trim()].filter((part) => part.length > 0).join("\n").trim();
+}
 function serverUpdateLogPath() {
   return path$1.join(logger.getLogPath(), LogFileType.UPDATE_SERVICE);
 }
@@ -18837,7 +18881,17 @@ ${heal.removed.join("\n")}`,
     return {
       canManageUpdate: true,
       updateCommand: "pip install --upgrade local-operator",
-      remedy: "Updating the server will improve AI functionality.",
+      /*
+       * A REAL CONSEQUENCE, not the benefit sentence a second time (UX U2). This
+       * string rendered through `managedCostSentence`, and the panel above it
+       * already carries the static line about AI functionality, security and
+       * bugs - so the offer showed the same filler twice, in two lengths, and the
+       * one sentence that has to be here (what the press does to the server the
+       * reader is talking to) was missing on the only arm whose press now
+       * publishes a generation and restarts a daemon. It is the managed global
+       * arm's own wording, aimed at this arm's mechanism.
+       */
+      remedy: "The app publishes a new server environment and then restarts the server it started, so a turn that is in flight is dropped while the server comes back. This can take a minute or two.",
       detail: `The app started this server itself (${startupMode}).`,
       sourceBuild: false,
       /*
@@ -18991,7 +19045,14 @@ ${heal.removed.join("\n")}`,
            */
           eventRunning: this.eventRunningVersion(runningVersion),
           silent,
-          releaseRead: false
+          releaseRead: false,
+          /*
+           * The ownership reading is local too, so the offline pass carries it as
+           * well: the control this event may offer must be offered, or withheld,
+           * on exactly the reading an online check uses. An offline machine whose
+           * environment is the app's own still gets its restart.
+           */
+          appOwnedEnvironment: this.appOwnsInstall(startupMode, serving)
         });
         return { status: "unavailable", info: null };
       }
@@ -19111,6 +19172,16 @@ ${heal.removed.join("\n")}`,
            * other two events already carry. It travels here too.
            */
           restartable: this.backendIsAppOwned(),
+          /*
+           * AND WHOSE INSTALL A PRESS WOULD MOVE (design D5), which is the other
+           * ownership reading: `restartable` is true here on a global install too,
+           * where the app supervises a daemon it did not install. The mode alone
+           * cannot answer it either - a GLOBAL_INSTALL launch can be serving from
+           * the app's OWN managed environment, and since #318 landed that arm IS
+           * routed to the publish path below - so the reading is the mode plus the
+           * serving install's own root.
+           */
+          appOwnedEnvironment: this.appOwnsInstall(startupMode, serving),
           /* `silent` is the whole difference between the two callers: the periodic
              and start-up checks pass `true`, the IPC handlers behind the buttons
              pass `false`. The renderer needs to know which one it is answering,
@@ -19139,7 +19210,8 @@ ${heal.removed.join("\n")}`,
          * affirmation above both turn on it - so the panel may call the install
          * current. The offline caller passes false for exactly that reason.
          */
-        releaseRead: true
+        releaseRead: true,
+        appOwnedEnvironment: this.appOwnsInstall(startupMode, serving)
       });
       return { status: channel.status, info: null };
     } catch (error) {
@@ -19398,36 +19470,6 @@ ${heal.removed.join("\n")}`,
       return false;
     }
   }
-  /**
-   * Bring the previous server back after a failed upgrade, and say whether it
-   * actually came back.
-   *
-   * A failure here must not leave the user with no backend at all: whatever pip
-   * did or did not do, the environment usually still holds a working install, so
-   * start it again and then ask /health rather than assuming. The answer is not
-   * cosmetic: `pip install --upgrade` uninstalls before it installs, so a
-   * mid-install failure can leave the package absent, and telling the user "the
-   * previous server is still running" when it is not is a claim we had no
-   * evidence for (review R6).
-   */
-  async restartBackendAfterFailedUpgrade() {
-    try {
-      await this.backendService?.start();
-      const healthy = await this.checkBackendHealth();
-      logger.info(
-        healthy ? "Restarted the previous backend after a failed update" : "The backend did not answer its health check after a failed update",
-        LogFileType.UPDATE_SERVICE
-      );
-      return healthy;
-    } catch (error) {
-      logger.error(
-        "Could not restart the backend after a failed update:",
-        LogFileType.UPDATE_SERVICE,
-        error
-      );
-      return false;
-    }
-  }
   /**
    * Poll /health until it reports `targetVersion`, bounded by a timeout.
    *
@@ -19573,6 +19615,14 @@ ${heal.removed.join("\n")}`,
    * panel's own rule - "a reading that cannot be taken is silence" - applied to one
    * clause of it). Every caller that did read the release, and every pre-existing
    * reader of this event, sees the payload it always saw.
+   *
+   * AND WHOSE INSTALL A PRESS WOULD MOVE (design D5) travels with the pair, because
+   * this event opens the one panel that ACTS: `restartable` says who started the
+   * DAEMON, which is also true in GLOBAL_INSTALL mode, while the control the panel may
+   * offer is a publish-and-restart the app performs only on its own environment. So
+   * both ownership readings ride one payload, and BOTH callers pass both - the offline
+   * pass measures this reading locally like the rest of the pair, so a machine that
+   * reports no network is not the machine that loses its restart control.
    */
   sendBackendSkewNotice(options) {
     const { installedVersion, eventRunning, silent, releaseRead } = options;
@@ -19582,12 +19632,56 @@ ${heal.removed.join("\n")}`,
         version: installedVersion,
         runningVersion: eventRunning,
         /** Whether the app may restart the daemon that is behind. */
-        restartable: this.backendIsAppOwned()
+        restartable: this.backendIsAppOwned(),
+        /*
+         * WHOSE INSTALL THE PANEL'S PRESS WOULD MOVE (design D5). `restartable`
+         * above answers who started the DAEMON and is true on a global install too,
+         * where the press behind that control runs the install's own updater rather
+         * than the restart its label promises - so the control the renderer may offer
+         * needs this second reading beside it. It travels on this event rather than in
+         * a second send, because this is the event whose panel acts.
+         */
+        appOwnedEnvironment: options.appOwnedEnvironment
       };
       if (!releaseRead) payload.releaseRead = false;
       this.mainWindow.webContents.send("backend-update-not-available", payload);
     }
   }
+  /**
+   * Whether the INSTALL this app would move is the app's own managed environment.
+   *
+   * THE SECOND OWNERSHIP READING, and it is deliberately not `backendIsAppOwned`
+   * (design D5). That one asks who started the DAEMON, and it answers yes in
+   * `GLOBAL_INSTALL` mode as well: the app spawns and supervises a daemon whose
+   * install is a uv tool / pipx / global one, so the app owns the process and not
+   * the environment. The two questions diverge on exactly that machine, and the
+   * skew panel's restart control is decided by this one, because `update-backend`
+   * on a global install runs the install's own updater (an install, not a restart)
+   * or lands on the by-hand panel - a control whose label promises a restart the
+   * press does not perform.
+   *
+   * `APP_BUNDLED_VENV` is the app's own environment by construction and
+   * `NOT_STARTED` has no daemon at all, so neither has anything to ask the serving
+   * root about. `GLOBAL_INSTALL` and `EXISTING_SERVER` BOTH consult it rather than
+   * being decided by the mode (review R8, which caught this paragraph saying the
+   * opposite of the switch below): the mode answers who LAUNCHED the process, and
+   * a process launched elsewhere can still read the app's managed tree - an
+   * adopted daemon serving out of it is an install this app may move, and that was
+   * the operator's own machine (design D5, #318). Both arms are stated rather than
+   * left to a default so a new mode has to be classified here on purpose instead of
+   * inheriting an answer.
+   */
+  appOwnsInstall(startupMode, serving) {
+    switch (startupMode) {
+      case LocalOperatorStartupMode.APP_BUNDLED_VENV:
+        return true;
+      case LocalOperatorStartupMode.GLOBAL_INSTALL:
+      case LocalOperatorStartupMode.EXISTING_SERVER:
+        return serving?.appOwned === true;
+      case LocalOperatorStartupMode.NOT_STARTED:
+        return false;
+    }
+  }
   /**
    * The version the resolved global install reports on disk, or null.
    *
@@ -19647,16 +19741,19 @@ ${heal.removed.join("\n")}`,
     return run;
   }
   /**
-   * True while an app-driven update of the global install is running.
+   * True while an app-driven server update is running, whichever install it moves.
    *
    * The guard is here and not on the surfaces that ask for the update, because
    * their flags are per-surface: the offer holds `checking` and the run panel holds
-   * `updatingBackend`, so a press on each of them reached `updateGlobalInstall`
-   * twice and the second `lop update` ran beside the first against one install root
-   * (review R1-8). The bundled path never needed one because it stops the backend
-   * first, which serialises it by accident; nothing on this path stops anything.
+   * `updatingBackend`, so a press on each of them reached an updater twice and the
+   * second install ran beside the first against one tree (review R1-8).
+   *
+   * Both layouts need it now. The global path never stopped anything; the app-owned
+   * path used to serialise itself by accident (it stopped the daemon first) and
+   * stops nothing since it began publishing a generation instead of writing into
+   * the live tree.
    */
-  globalUpdateInFlight = false;
+  serverUpdateInFlight = false;
   /**
    * Update the resolved global install, then restart the daemon this app owns.
    *
@@ -19673,7 +19770,7 @@ ${heal.removed.join("\n")}`,
    * exactly as the pip path does (`didUpgradeLand`).
    */
   async updateGlobalInstall(backend, plan, target2) {
-    if (this.globalUpdateInFlight) {
+    if (this.serverUpdateInFlight) {
       logger.warn(
         "A global install update is already running; refusing to start a second beside it",
         LogFileType.UPDATE_SERVICE
@@ -19685,11 +19782,11 @@ ${heal.removed.join("\n")}`,
       });
       return false;
     }
-    this.globalUpdateInFlight = true;
+    this.serverUpdateInFlight = true;
     try {
       return await this.runGlobalUpdateAttempt(backend, plan, target2);
     } finally {
-      this.globalUpdateInFlight = false;
+      this.serverUpdateInFlight = false;
     }
   }
   /** The attempt itself, under the guard above. */
@@ -19745,7 +19842,13 @@ ${tail}` : ""}`,
         installVersion: after,
         runningVersion: running,
         restarted: false,
-        restartable: this.backendIsAppOwned()
+        restartable: this.backendIsAppOwned(),
+        /*
+         * FALSE BY CONSTRUCTION, and stated rather than left absent: this arm is
+         * the global install's own updater, so the environment it moved is never
+         * the app's managed one (design D5).
+         */
+        appOwnedEnvironment: false
       });
       return true;
     }
@@ -19849,6 +19952,13 @@ ${tail}` : ""}`,
       restarted: false,
       unattended: true,
       restartable: this.backendIsAppOwned(),
+      /*
+       * False, and it is also the honest answer to UX U3: the marker is written
+       * on the global path only, and this reader compares it against
+       * `readGlobalInstallVersion()` - the install the global updater moves -
+       * so nothing here is a statement about the app's own environment.
+       */
+      appOwnedEnvironment: false,
       before: marker.before
     });
   }
@@ -19893,6 +20003,9 @@ ${tail}` : ""}`,
             serving
           );
           const target2 = targetVersion ?? this.lastPublishedBackendVersion ?? null;
+          if (serving.appOwned) {
+            return await this.updateAppOwnedEnvironment(targetVersion ?? null);
+          }
           if (plan.canManageUpdate) {
             return await this.updateGlobalInstall(
               this.backendService,
@@ -19938,198 +20051,360 @@ ${tail}` : ""}`,
           });
           return false;
       }
-      if (!this.backendService.isUsingExternalBackend()) {
-        logger.info(
-          "Stopping backend service before update...",
-          LogFileType.UPDATE_SERVICE
-        );
-        this.backendService.setAutoUpdating(true);
-        await this.backendService.stop(true);
-        logger.info(
-          "Backend service stopped successfully",
-          LogFileType.UPDATE_SERVICE
-        );
-      }
-      let pythonPath2 = "";
-      const venvPath = this.backendService?.getVenvPath();
-      if (venvPath && electron.app.isPackaged) {
-        const venvBinDir = process.platform === "win32" ? "Scripts" : "bin";
-        const pythonName = process.platform === "win32" ? "python.exe" : "python3";
-        pythonPath2 = path$1.join(venvPath, venvBinDir, pythonName);
+      return await this.updateAppOwnedEnvironment(targetVersion ?? null);
+    } catch (error) {
+      logger.error(
+        "Error updating backend:",
+        LogFileType.UPDATE_SERVICE,
+        error
+      );
+      if (this.backendService && !this.backendService.isUsingExternalBackend()) {
+        try {
+          logger.info(
+            "Attempting to restart backend service after update failure...",
+            LogFileType.UPDATE_SERVICE
+          );
+          await this.backendService.start();
+        } catch (restartError) {
+          logger.error(
+            "Failed to restart backend service after update failure:",
+            LogFileType.UPDATE_SERVICE,
+            restartError
+          );
+        }
       }
-      if (!pythonPath2 || !fs.existsSync(pythonPath2)) {
-        logger.error(
-          // `managedVenvPath` answers with a sentinel when no environment has
-          // been published, and "no Python at …/no-environment-selected" sent a
-          // reader to a directory-shaped path that nothing creates (review N3).
-          isUnpreparedVenvPath(venvPath ?? "") ? "Cannot update the bundled backend: no environment has been selected for this instance yet" : `Cannot update the bundled backend: no Python at ${pythonPath2 || "an unknown path"}`,
-          LogFileType.UPDATE_SERVICE
-        );
-        await this.restartBackendAfterFailedUpgrade();
-        this.sendToRenderer("backend-update-error", {
-          message: "The bundled server's Python environment could not be found, so the update did not run. Please reinstall the application.",
+      if (this.mainWindow && !this.mainWindow.isDestroyed() && this.mainWindow.webContents && !this.mainWindow.webContents.isDestroyed()) {
+        this.mainWindow.webContents.send("backend-update-error", {
+          // Cleaned at the source, for the reason written on the check-phase
+          // report above.
+          message: stripErrorPrefixes(error.message),
           phase: "update",
           logPath: serverUpdateLogPath()
         });
-        return false;
       }
-      const pip = buildPipUpgradeCommand(pythonPath2, targetVersion ?? null);
-      const versionBefore = await this.readBundledBackendVersion(pythonPath2);
-      logger.info(
-        `Executing pip command: ${pip.display}`,
+      return false;
+    }
+  }
+  /**
+   * Move the app's OWN managed environment onto the release the app means to run.
+   *
+   * The shape, and its order is load-bearing (design section 5): land the new build
+   * in a tree nothing is reading, tell the consumer the build moved, let it leave
+   * at its own boundary. `updateManagedPython` builds a NEW generation beside the
+   * published one, smokes it there, and only then flips `selected-environment.json`
+   * atomically - so a daemon that is serving keeps reading the tree it loaded, and
+   * no file it has open is ever written.
+   *
+   * The guard is the one the global path uses, for the reason that one's own
+   * comment gives: the surfaces that ask for an update hold per-surface flags, so a
+   * press on each reaches an updater twice. The old bundled path was serialised by
+   * accident - it stopped the daemon first - and this one stops nothing, so it
+   * needs the guard on purpose.
+   */
+  async updateAppOwnedEnvironment(targetVersion) {
+    if (this.serverUpdateInFlight) {
+      logger.warn(
+        "A server update is already running; refusing to start a second beside it",
         LogFileType.UPDATE_SERVICE
       );
-      const pipRun = await runCommand(pip.command, pip.args, {
-        timeoutMs: 15 * 60 * 1e3,
-        env: this.pythonSpawnEnv()
+      this.sendToRenderer("backend-update-error", {
+        message: "A server update is already running. Let it finish before starting another.",
+        phase: "update",
+        logPath: serverUpdateLogPath()
       });
-      logger.info(
-        `pip stdout:
-${pipRun.stdout.trim()}`,
+      return false;
+    }
+    this.serverUpdateInFlight = true;
+    try {
+      return await this.runAppOwnedUpdateAttempt(targetVersion);
+    } finally {
+      this.serverUpdateInFlight = false;
+    }
+  }
+  /** The attempt itself, under the guard above. */
+  async runAppOwnedUpdateAttempt(targetVersion) {
+    const backend = this.backendService;
+    if (!backend) {
+      logger.error(
+        "An app-managed environment update was asked for with no backend service reference",
         LogFileType.UPDATE_SERVICE
       );
-      if (pipRun.stderr.trim().length > 0) {
-        logger.warn(
-          `pip stderr:
-${pipRun.stderr.trim()}`,
-          LogFileType.UPDATE_SERVICE
-        );
-      }
-      const versionAfter = await this.readBundledBackendVersion(pythonPath2);
-      const upgradeLanded = pipRun.exitCode === 0 && didUpgradeLand({
-        before: versionBefore,
-        after: versionAfter,
-        target: targetVersion ?? null
+      this.sendToRenderer("backend-update-error", {
+        message: "The app has no server to update right now. Restart Local Operator and try again.",
+        phase: "update",
+        logPath: serverUpdateLogPath()
+      });
+      return false;
+    }
+    const options = managedPythonOptions();
+    const target2 = targetVersion ?? this.lastPublishedBackendVersion ?? await this.getLatestPypiVersion() ?? null;
+    if (!target2) {
+      logger.error(
+        "An app-managed environment update was asked for with no release to move to: no caller target, no published reading, and PyPI could not be read",
+        LogFileType.UPDATE_SERVICE
+      );
+      this.sendToRenderer("backend-update-error", {
+        message: "The app could not read which release to install, so it left its server environment alone. Check the connection and try again.",
+        phase: "update",
+        logPath: serverUpdateLogPath()
       });
-      if (!upgradeLanded) {
+      return false;
+    }
+    const before = publishedBackendVersion(options);
+    const willPublish = before === null || this.isNewerVersion(target2, before);
+    if (willPublish) {
+      const free = this.freeBytesAt(managedPythonRoot(options));
+      if (free !== null && free < APP_OWNED_PUBLISH_HEADROOM_BYTES) {
+        const neededMb = Math.ceil(
+          APP_OWNED_PUBLISH_HEADROOM_BYTES / 1024 / 1024
+        );
+        const freeMb = Math.floor(free / 1024 / 1024);
         logger.error(
-          `Backend upgrade did not land: pip exited ${pipRun.exitCode}; version ${versionBefore ?? "unknown"} -> ${versionAfter ?? "unknown"}`,
+          `Refusing the app-managed environment update: ${freeMb} MB free where ${neededMb} MB is needed`,
           LogFileType.UPDATE_SERVICE
         );
-        const serverIsBack = await this.restartBackendAfterFailedUpgrade();
         this.sendToRenderer("backend-update-error", {
-          message: pipRun.exitCode !== 0 ? serverIsBack ? "The server update failed to install. The previously installed server is running again; see the update service log for pip's output." : "The server update failed to install and the server did not come back up. Restart Local Operator, and see the update service log for pip's output." : `The server update to ${targetVersion ?? "the new release"} did not take effect: the server is still on ${versionAfter ?? "its previous version"}. See the update service log for pip's output, then try again.`,
+          message: `The server update needs about ${neededMb} MB of free space on this disk, and ${freeMb} MB is free, so the app left the environment serving this app alone. Free some space and try again.`,
           phase: "update",
           logPath: serverUpdateLogPath()
         });
         return false;
       }
-      logger.info(
-        `Backend package upgraded: ${versionBefore ?? "unknown"} -> ${versionAfter}`,
+    }
+    logger.info(
+      `Updating the app-managed environment (published ${before ?? "no reading"}, target ${target2}, publishes: ${willPublish})`,
+      LogFileType.UPDATE_SERVICE
+    );
+    this.sendToRenderer("backend-update-progress", {
+      phase: willPublish ? "installing" : "restarting"
+    });
+    let outcome;
+    try {
+      outcome = await updateManagedPython(
+        options,
+        (venv, python) => this.installEnvironmentInto(venv, python, target2),
+        {
+          target: target2,
+          isNewer: (candidate, subject) => this.isNewerVersion(candidate, subject)
+        }
+      );
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      const cause = setupFailureCause(error);
+      logger.error(
+        `The app-managed environment update published nothing: ${reason}`,
         LogFileType.UPDATE_SERVICE
       );
+      this.sendToRenderer("backend-update-error", {
+        message: `The server update did not install, so the environment serving this app was left as it was.${cause ? ` ${cause}` : ""}${reason ? `
+
+${reason}` : ""}`,
+        phase: "update",
+        logPath: serverUpdateLogPath()
+      });
+      return false;
+    }
+    const installVersion = outcome.selection.backendVersion;
+    logger.info(
+      outcome.replaced ? `Published a new app-managed environment generation: ${before ?? "none"} -> ${installVersion}; the generation it supersedes stays on disk at ${outcome.previous?.venv ?? "no previous generation"}` : `The published app-managed environment already satisfies ${target2}; nothing was installed (published ${installVersion})`,
+      LogFileType.UPDATE_SERVICE
+    );
+    const servingBeforeRestart = await this.getInstalledBackendVersion();
+    const movedTheServer = outcome.replaced || servingBeforeRestart !== installVersion;
+    if (!movedTheServer) {
       logger.info(
-        "Restarting backend service after update...",
+        `The published environment already satisfies ${target2} and the server serving this app already reports ${servingBeforeRestart}; nothing to move, so it was not restarted`,
         LogFileType.UPDATE_SERVICE
       );
-      const restartSuccess = await this.backendService.restart();
-      if (restartSuccess) {
-        logger.info(
-          "Backend service restarted successfully after update",
-          LogFileType.UPDATE_SERVICE
-        );
-        this.backendService.setAutoUpdating(false);
-        const isRunningAfterRestart = await this.checkBackendHealth();
-        if (!isRunningAfterRestart) {
-          logger.error(
-            "Backend service reported successful restart but health check failed",
-            LogFileType.UPDATE_SERVICE
-          );
-          logger.info(
-            "Attempting to start backend service again...",
-            LogFileType.UPDATE_SERVICE
-          );
-          await this.backendService.start();
-          const finalHealthCheck = await this.checkBackendHealth();
-          if (!finalHealthCheck) {
-            logger.error(
-              "Backend service failed to start after multiple attempts",
-              LogFileType.UPDATE_SERVICE
-            );
-            if (this.mainWindow) {
-              this.mainWindow.webContents.send("backend-update-error", {
-                message: "Backend was updated but failed to restart properly. Please restart the application.",
-                phase: "update",
-                logPath: serverUpdateLogPath()
-              });
-            }
-            return false;
-          }
-        }
-      } else {
-        logger.error(
-          "Failed to restart backend service after update",
-          LogFileType.UPDATE_SERVICE
-        );
-        this.backendService.setAutoUpdating(false);
-        if (this.mainWindow) {
-          this.mainWindow.webContents.send("backend-update-error", {
-            message: "Backend was updated but failed to restart. Please restart the application.",
-            phase: "update",
-            logPath: serverUpdateLogPath()
-          });
-        }
-        return false;
-      }
-      const reportedVersion = await this.waitForBackendVersion(
-        targetVersion ?? null
-      );
-      if (reportedVersion == null) {
-        logger.error(
-          `Backend did not report version ${targetVersion ?? "the new one"} after the update`,
-          LogFileType.UPDATE_SERVICE
-        );
-        this.sendToRenderer("backend-update-error", {
-          message: `The server restarted but did not report ${targetVersion ? `version ${targetVersion}` : "the updated version"}. Check the update service log, then try again.`,
-          phase: "update",
-          logPath: serverUpdateLogPath()
-        });
-        return false;
-      }
-      logger.info(
-        `Backend reports version ${reportedVersion} after the update`,
+      this.sendToRenderer("backend-update-completed", {
+        installVersion,
+        runningVersion: servingBeforeRestart,
+        restarted: false,
+        restartable: this.backendIsAppOwned(),
+        appOwnedEnvironment: true
+      });
+      return true;
+    }
+    logger.info(
+      "Restarting backend service onto the published environment...",
+      LogFileType.UPDATE_SERVICE
+    );
+    if (willPublish) {
+      this.sendToRenderer("backend-update-progress", { phase: "restarting" });
+    }
+    backend.setAutoUpdating(true);
+    const restarted = await backend.restart();
+    backend.setAutoUpdating(false);
+    const healthy = restarted ? await this.checkBackendHealth() : false;
+    if (!restarted || !healthy) {
+      logger.error(
+        `The environment is published at ${installVersion} but the backend did not come back onto it (restart ${restarted ? "succeeded" : "failed"}, health ${healthy ? "ok" : "did not answer"})`,
         LogFileType.UPDATE_SERVICE
       );
-      logger.info(
-        "Backend update and restart completed successfully",
+      const serving = await this.getInstalledBackendVersion();
+      this.sendToRenderer("backend-update-completed", {
+        installVersion,
+        runningVersion: serving,
+        restarted: false,
+        restartable: this.backendIsAppOwned(),
+        appOwnedEnvironment: true,
+        /*
+         * THE MISSING READING IS THE NEWS (UX U1). `serving === null` is not only
+         * "no comparison available": it is a restart the app performed ITSELF, on
+         * an environment it owns, after which the process it stopped did not
+         * answer. Without this field the renderer's funnel declined - correctly,
+         * by its own rule, for want of a reading - and the press was answered by
+         * the fall-through success toast, "Server update completed successfully",
+         * about a server that is not running. That is the same class of claim as
+         * the operator's original report (a surface asserting what it had not
+         * proved), which is why this branch exists rather than a softer sentence
+         * on it.
+         *
+         * AND WITH `restartable` READ RATHER THAN ASSUMED (review R8) this field is
+         * no longer only a shape a future producer could send: on an adopted daemon
+         * whose restart did not take, `restartable` is false here, so the renderer's
+         * `!actionRestartsTheServer` arm - "Nothing is serving this conversation
+         * until that server is running again" - PAINTS. Design D14 filed that string
+         * as copy no producer could reach; the arm is now reachable through this one.
+         */
+        serverDidNotComeBack: serving === null
+      });
+      return true;
+    }
+    const running = await this.waitForBackendVersion(installVersion);
+    if (running === null) {
+      const serving = await this.getInstalledBackendVersion();
+      logger.error(
+        `The environment is published at ${installVersion} but the server serving this app reports ${serving ?? "no reading"}`,
         LogFileType.UPDATE_SERVICE
       );
-      if (this.mainWindow && !this.mainWindow.isDestroyed() && this.mainWindow.webContents && !this.mainWindow.webContents.isDestroyed()) {
-        this.mainWindow.webContents.send("backend-update-completed");
-      }
+      this.sendToRenderer("backend-update-completed", {
+        installVersion,
+        runningVersion: serving,
+        restarted: false,
+        restartable: this.backendIsAppOwned(),
+        appOwnedEnvironment: true
+        /*
+         * This arm is NOT `serverDidNotComeBack` even when `serving` is null, and
+         * the difference is what the app knows: the daemon answered the health
+         * probe a moment ago (that is the branch above this one), so a missing
+         * reading here is a version read that failed rather than a server that
+         * never came back, and the panel may not claim the second.
+         *
+         * AND THE SUCCESS TOAST IS DELIBERATE HERE (UX U7, which asked for this
+         * decision to be RECORDED where the reason already is rather than for a new
+         * state). The completion is a claim about the update, and the update is what
+         * happened: the environment moved, the app restarted the daemon onto it and
+         * the daemon answered the probe - the only thing unread is WHICH build that
+         * running process reports. The alternatives are worse rather than more
+         * honest: a panel keyed on "a reading failed" would put a standing failed-
+         * tone surface in front of a server that is up and serving, and it would
+         * have to be dismissed by a user who has nothing to do about it, while the
+         * sentence the toast carries says nothing about the build either way. What
+         * the app may not do is CLAIM a build it did not read, and it does not.
+         */
+      });
       return true;
-    } catch (error) {
+    }
+    logger.info(
+      `The server serving this app reports ${running} after the app-managed environment update`,
+      LogFileType.UPDATE_SERVICE
+    );
+    this.sendToRenderer("backend-update-completed", {
+      installVersion,
+      runningVersion: running,
+      restarted: true
+    });
+    return true;
+  }
+  /**
+   * Install a release into a freshly created environment, and say whether it landed
+   * there.
+   *
+   * The two commands are the ones this app's own install script runs for the same
+   * steps - create the environment on the managed runtime's interpreter, then
+   * `pip install` into it - aimed at the generation the caller has just minted, and
+   * pinned to the release the user was offered.
+   *
+   * It is deliberately NOT the install script itself. That one is the interactive
+   * first run: it builds a modal progress window and it calls `app.exit(1)` when
+   * the user cancels that window, so reaching for it here would put a second window
+   * and a quit path inside an update - and an update that can quit the app is not
+   * an update that leaves the runtimes running.
+   *
+   * `didUpgradeLand` rather than the exit code, for the reason it exists: pip
+   * reports success when the requirement is already satisfied, and it can exit 0
+   * having installed for a different interpreter, so the version read back out of
+   * THIS environment is the only thing that answers whether the user got the
+   * release they were offered.
+   *
+   * EVERY FAILING STEP HERE THROWS, and the caller's `false` is not this arm's to
+   * send (review R6). The callback contract is `Promise<boolean>` because the
+   * first-run installer shares it, but a boolean carries no words, and the words are
+   * the whole remedy on a full disk: `publishGeneration` turns `false` into a fixed
+   * sentence that `SETUP_FAILURE_CAUSES` does not match, so a publish that ran out of
+   * space reached the reader with no disk-space remedy on it. Throwing the child's
+   * captured output keeps that table's matching text intact end to end.
+   */
+  async installEnvironmentInto(venv, python, target2) {
+    const created = await runCommand(python, ["-m", "venv", venv], {
+      timeoutMs: 10 * 60 * 1e3,
+      env: this.pythonSpawnEnv()
+    });
+    if (created.exitCode !== 0) {
+      const output = installerOutputOf(created);
       logger.error(
-        "Error updating backend:",
-        LogFileType.UPDATE_SERVICE,
-        error
+        `Could not create the update environment at ${venv}: ${output}`,
+        LogFileType.UPDATE_SERVICE
+      );
+      throw new Error(
+        `Could not create the update environment at ${venv}.
+
+${output}`
+      );
+    }
+    const interpreter = path$1.join(
+      venv,
+      process.platform === "win32" ? "Scripts" : "bin",
+      process.platform === "win32" ? "python.exe" : "python"
+    );
+    const pip = buildPipUpgradeCommand(interpreter, target2);
+    logger.info(
+      `Installing into the new environment: ${pip.display}`,
+      LogFileType.UPDATE_SERVICE
+    );
+    const run = await runCommand(pip.command, pip.args, {
+      timeoutMs: 15 * 60 * 1e3,
+      env: this.pythonSpawnEnv()
+    });
+    logger.info(
+      `Install stdout:
+${run.stdout.trim()}`,
+      LogFileType.UPDATE_SERVICE
+    );
+    if (run.stderr.trim().length > 0) {
+      logger.warn(
+        `Install stderr:
+${run.stderr.trim()}`,
+        LogFileType.UPDATE_SERVICE
       );
-      if (this.backendService && !this.backendService.isUsingExternalBackend()) {
-        try {
-          logger.info(
-            "Attempting to restart backend service after update failure...",
-            LogFileType.UPDATE_SERVICE
-          );
-          await this.backendService.start();
-        } catch (restartError) {
-          logger.error(
-            "Failed to restart backend service after update failure:",
-            LogFileType.UPDATE_SERVICE,
-            restartError
-          );
-        }
-      }
-      if (this.mainWindow && !this.mainWindow.isDestroyed() && this.mainWindow.webContents && !this.mainWindow.webContents.isDestroyed()) {
-        this.mainWindow.webContents.send("backend-update-error", {
-          // Cleaned at the source, for the reason written on the check-phase
-          // report above.
-          message: stripErrorPrefixes(error.message),
-          phase: "update",
-          logPath: serverUpdateLogPath()
-        });
-      }
-      return false;
     }
+    const installed = await this.readBundledBackendVersion(interpreter);
+    if (!didUpgradeLand({ before: null, after: installed, target: target2 })) {
+      const output = installerOutputOf(run);
+      logger.error(
+        `The new environment is not on ${target2}: it reports ${installed ?? "no readable version"}; the installer's own output follows:
+${output}`,
+        LogFileType.UPDATE_SERVICE
+      );
+      throw new Error(
+        `The environment was created but ${target2} did not land in it; the installer reports ${installed ?? "no readable version"}.
+
+${output}`
+      );
+    }
+    ensureVenvBytecodeGuard(venv);
+    return true;
   }
   /**
    * Check for all updates (UI and backend)