local-operator-ui 0.31.28 → 0.31.30

package/out/main/index.js

@@ -102,7 +102,17 @@ const profileFields = zod.z.object({
   instructions: zod.z.string().max(8e3).optional(),
   tools: zod.z.array(zod.z.string().min(1).max(128)).max(256).optional(),
   effort: zod.z.string().max(64).optional(),
-  delegate: zod.z.boolean().optional()
+  delegate: zod.z.boolean().optional(),
+  /*
+   * The action class (`reactive` | `proactive`), the field the Class control
+   * writes. An ENUM rather than a free string, because the route takes a
+   * `Literal` and a spelling this schema let through would be a 422 the
+   * caller could not tell from a bug — the same reasoning `scheduleUnit`
+   * above states. Optional like every other field here: an omitted key means
+   * "leave the class alone" on an update, which is what lets the control send
+   * the class and nothing else.
+   */
+  action_class: zod.z.enum(["reactive", "proactive"]).optional()
 }).strict();
 const teamFields = zod.z.object({
   name: zod.z.string().min(1).max(64).optional(),
@@ -268,6 +278,25 @@ const PROJECT_MILESTONE_NAME_MAX_CHARS = 80;
 const hubItemKind = zod.z.enum(["agent", "team"]);
 const desktopRequestUnion = zod.z.discriminatedUnion("op", [
   zod.z.object({ op: zod.z.literal("capabilities") }).strict(),
+  /*
+   * THE MACHINE'S RUNTIME ROSTER, read for the straggler census a completed
+   * server update reports (`GET /v1/desktop/runtimes`). A GET with a fixed
+   * shape, so the whole request is the op.
+   *
+   * It reads the INVENTORY (`probe=false` in the path composer): the census
+   * asks every row what build it booted with, and the route's per-row loopback
+   * connects answer a different question ("did it answer?") that nothing here
+   * acts on. Skipping them also keeps the response inside the control budget
+   * without depending on the probe pool's own deadline logic.
+   *
+   * THE CONTROL BUDGET IS THE RIGHT ONE, and it is a bound rather than a hope:
+   * the route's own ceiling is the two external reads in front of the
+   * composition (5 s process table + 3 s socket table, stated in `roster.py`),
+   * and `probe=false` skips the per-row connects entirely - so the worst case
+   * is ~8 s, well under the 20 s control deadline. It is NOT on the long-read
+   * list: nothing here fans out to a provider or walks a ledger.
+   */
+  zod.z.object({ op: zod.z.literal("runtimes.list") }).strict(),
   zod.z.object({ op: zod.z.literal("profiles.list") }).strict(),
   zod.z.object({ op: zod.z.literal("profiles.get"), name: profileName }).strict(),
   zod.z.object({ op: zod.z.literal("profiles.install"), name: profileName, requestId }).strict(),
@@ -757,11 +786,38 @@ const desktopRequestUnion = zod.z.discriminatedUnion("op", [
   zod.z.object({
     op: zod.z.literal("sessions.answer"),
     sessionId,
-    epoch: id$1,
-    requestId: id$1,
+    /**
+     * The owner epoch, for the two GATE shapes. Optional here because a queued
+     * ask has no epoch to give — `ask_id` is the other selector and the checks
+     * below require exactly one of the pair.
+     */
+    epoch: id$1.optional(),
+    requestId: id$1.optional(),
     value: zod.z.string().max(32768).optional(),
     approved: zod.z.boolean().optional(),
-    questionIndex: zod.z.number().int().min(0).optional()
+    questionIndex: zod.z.number().int().min(0).optional(),
+    /**
+     * The queued ask's id (`a-3f9c`). Its presence selects the THIRD body shape —
+     * `{ask_id, answers}` or `{ask_id, decline}` — and, per the backend's own
+     * contract, makes `epoch` irrelevant rather than optional-but-checked: an ask
+     * outlives the owner that queued it, so requiring an epoch would refuse
+     * exactly the case the feature exists for (a cold session whose asks are
+     * still open). The single-winner rule that the epoch check used to provide
+     * now lives on the ask log, where the first `answered` event wins.
+     */
+    askId: id$1.optional(),
+    /**
+     * The WHOLE ask's answers, keyed by question id, each a list because a
+     * question may be multi-select.
+     *
+     * One atomic body rather than a per-question stream: the blocking path
+     * answered one question at a time over the wire, and a client that died
+     * part-way left an ask half-settled — the exact state the atomic submit
+     * exists to make unrepresentable.
+     */
+    answers: zod.z.record(zod.z.string(), zod.z.array(zod.z.string().max(32768))).optional(),
+    /** "No answer — decide yourself", the explicit form of today's Esc. */
+    decline: zod.z.boolean().optional()
   }).strict(),
   zod.z.object({
     op: zod.z.literal("sessions.seen"),
@@ -1236,7 +1292,25 @@ const desktopRequestUnion = zod.z.discriminatedUnion("op", [
     sessionId,
     requestId,
     message: zod.z.string().max(2e5).optional(),
-    boundary: zod.z.literal("next_safe").optional()
+    /*
+     * WHERE THE COPY STOPS. `next_safe` is the historical form and the default
+     * (the whole committed conversation, waiting for a turn boundary);
+     * `at_entry` cuts through `entryId` and needs no boundary, because a named
+     * point is already committed.
+     *
+     * `entryId` is bounded rather than patterned for the route's reason -
+     * entry ids are minted in more than one shape and existence in the
+     * CONVERSATION is what decides whether one is real (the route answers an
+     * unknown or foreign id with a refusal, never a fork of the wrong
+     * history) - so this client validates the shape it can and lets the
+     * backend adjudicate the rest.
+     *
+     * BOTH ARE OPTIONAL AND ABSENT IS THE OLD CALL, key for key: a typed
+     * `/fork` and the palette's fork send neither, and the body builder below
+     * omits `entry_id` entirely rather than sending it as null.
+     */
+    boundary: zod.z.enum(["next_safe", "at_entry"]).optional(),
+    entryId: zod.z.string().max(128).optional()
   }).strict(),
   zod.z.object({
     op: zod.z.literal("sessions.stop"),
@@ -1760,6 +1834,20 @@ const desktopRequestUnion = zod.z.discriminatedUnion("op", [
     key: projectKey,
     name: zod.z.string().min(1).max(PROJECT_MILESTONE_NAME_MAX_CHARS)
   }).strict(),
+  /*
+   * The check-in fan-out (`POST /v1/desktop/projects/{project}/request-update`):
+   * ask every linked session to post a progress update. APPENDED to the union
+   * like its siblings, and gated by its OWN capability key
+   * (`features.projects_request_update`) rather than a bump of `projects`: the
+   * tab renders perfectly well against a backend that cannot ask its sessions
+   * for anything, so the version would hide a working surface behind an update
+   * it does not need (the `session_search` rule above). The key is the row's
+   * address (id or name) - the same shape every other projects op takes.
+   */
+  zod.z.object({
+    op: zod.z.literal("projects.request_update"),
+    key: projectKey
+  }).strict(),
   /*
    * AIDA'S CONTROL PLANE: one read and one control op on the same route
    * (`/v1/desktop/aida`), because the rail's row and the composer's `/aida`
@@ -1787,6 +1875,48 @@ const desktopRequestUnion = zod.z.discriminatedUnion("op", [
 ]);
 const desktopRequestSchema = desktopRequestUnion.superRefine(
   (request, ctx) => {
+    if (request.op === "sessions.answer") {
+      if (request.askId !== void 0) {
+        if (!request.askId)
+          ctx.addIssue({
+            code: zod.z.ZodIssueCode.custom,
+            message: "ask_id must be a non-empty string",
+            path: ["askId"]
+          });
+        if (request.decline !== true && !request.answers)
+          ctx.addIssue({
+            code: zod.z.ZodIssueCode.custom,
+            message: "A queued-ask answer needs answers or decline",
+            path: ["answers"]
+          });
+        else if (request.decline === true && request.answers !== void 0)
+          ctx.addIssue({
+            code: zod.z.ZodIssueCode.custom,
+            message: "Supply either answers or decline",
+            path: ["decline"]
+          });
+        else if (request.answers !== void 0 && Object.keys(request.answers).length === 0)
+          ctx.addIssue({
+            code: zod.z.ZodIssueCode.custom,
+            message: "answers must name at least one question",
+            path: ["answers"]
+          });
+        return;
+      }
+      if (!request.epoch)
+        ctx.addIssue({
+          code: zod.z.ZodIssueCode.custom,
+          message: "An epoch is required to answer a gate",
+          path: ["epoch"]
+        });
+      if (!request.requestId)
+        ctx.addIssue({
+          code: zod.z.ZodIssueCode.custom,
+          message: "A request id is required to answer a gate",
+          path: ["requestId"]
+        });
+      return;
+    }
     if (request.op === "sessions.create" && request.purpose === void 0) {
       if (request.cwd === void 0) {
         ctx.addIssue({
@@ -1982,6 +2112,9 @@ const READ_ONLY_OPS = /* @__PURE__ */ new Set([
   "profiles.get",
   "profiles.list",
   "providers.list",
+  // A reader that changes nothing (the route's own docstring): the straggler
+  // census, and the app re-reads it rather than caching a stale count.
+  "runtimes.list",
   "sessions.aside.get",
   "sessions.checkpoints",
   "sessions.failovers",
@@ -2073,6 +2206,8 @@ function desktopEndpoint(request) {
   switch (request.op) {
     case "capabilities":
       return { path: "/v1/capabilities", method: "GET" };
+    case "runtimes.list":
+      return { path: "/v1/desktop/runtimes?probe=false", method: "GET" };
     /*
      * The mesh reads. Both are plain GETs with no parameters at all - the backend
      * reads THIS device's own relay, so there is nothing for the client to scope it
@@ -2406,6 +2541,16 @@ function desktopEndpoint(request) {
         }
       };
     case "sessions.answer":
+      if (request.askId !== void 0)
+        return {
+          path: `/v1/desktop/sessions/${request.sessionId}/answers`,
+          method: "POST",
+          body: {
+            ask_id: request.askId,
+            answers: request.answers,
+            decline: request.decline
+          }
+        };
       return {
         path: `/v1/desktop/sessions/${request.sessionId}/answers`,
         method: "POST",
@@ -2854,7 +2999,17 @@ function desktopEndpoint(request) {
         body: {
           request_id: request.requestId,
           message: request.message,
-          boundary: request.boundary
+          boundary: request.boundary,
+          /*
+           * The route validates the two TOGETHER: `entry_id` with `next_safe`
+           * is a 422, and `at_entry` without one is a 422. This builder does
+           * not police that pairing (the schema above is what a renderer may
+           * send; the route is what adjudicates it), but it does keep the
+           * absent case byte-identical to the call that shipped before the
+           * cut existed - `undefined` is dropped by `JSON.stringify`, so a
+           * `next_safe` fork sends no `entry_id` key at all.
+           */
+          entry_id: request.entryId
         }
       };
     case "sessions.stop":
@@ -3088,6 +3243,11 @@ function desktopEndpoint(request) {
         path: `/v1/desktop/projects/${encodeURIComponent(request.key)}/milestones/${encodeURIComponent(request.name)}`,
         method: "DELETE"
       };
+    case "projects.request_update":
+      return {
+        path: `/v1/desktop/projects/${encodeURIComponent(request.key)}/request-update`,
+        method: "POST"
+      };
     case "aida.status":
       return { path: "/v1/desktop/aida", method: "GET" };
     case "aida.control":
@@ -5733,9 +5893,12 @@ function resolveGlobalInstallPlan(input) {
        * no cost at all before the click (review U3). It named the restart as its
        * cost for the same reason - it was the one destructive thing this path
        * did. It no longer is: on the generation layout the install lands beside
-       * the running build and the server keeps serving the build it loaded until
-       * its own next idle, so the cost is the install and the wait, and no
-       * sentence here may describe a turn being dropped.
+       * the running build and the server MOVES ONTO IT as part of the update -
+       * the in-place serve reload, verified by the serving process's own record
+       * (a restart remains only the fallback for a reload that cannot be proven
+       * to land, and even that cuts no turn) - so the cost is the install and
+       * the wait, and no sentence here may describe a turn being dropped or
+       * defer the move to some later idle.
        *
        * Source build - the same disclosure with the one difference that matters:
        * this route DOES rewrite a tree a live runtime is reading, so its sentence
@@ -5754,7 +5917,7 @@ function resolveGlobalInstallPlan(input) {
        * panels, and in the by-hand panel the next line was the version sentence,
        * so the promise landed on the wrong line (review D5).
        */
-      remedy: managed ? "The app installs the new build beside the one in use and leaves the server you are using on the build it loaded, so nothing in flight is cut off. The server moves onto the new build when it is next idle." : sourceRebuildRoute ? "Rebuilds this checkout with `lop-update`. The app waits for the turns running on this machine to finish first, and the rebuild then reinstalls this install in place - so a turn started while it runs can still be interrupted - and it can take up to half an hour. This install keeps reporting the checkout's version, not the release the app offered." : "This install predates the non-disruptive installer, so update it once from your terminal; that updater rewrites the shared environment in place, which can interrupt sessions mid-turn. The app manages updates after that.",
+      remedy: managed ? "The app installs the new build beside the one in use and moves the server onto it immediately, so nothing in flight is cut off." : sourceRebuildRoute ? "Rebuilds this checkout with `lop-update`. The app waits for the turns running on this machine to finish first, and the rebuild then reinstalls this install in place - so a turn started while it runs can still be interrupted - and it can take up to half an hour. This install keeps reporting the checkout's version, not the release the app offered." : "This install predates the non-disruptive installer, so update it once from your terminal; that updater rewrites the shared environment in place, which can interrupt sessions mid-turn. The app manages updates after that.",
       detail: `${detail}${managed ? provenance : sourceRebuildRoute ? " source build of this machine's checkout; an in-place rebuild." : provenance}`,
       sourceBuild,
       managedRoute: managed ? "entry-point" : sourceRebuildRoute ? "source-build" : null,
@@ -5859,8 +6022,10 @@ function serveRecord(pid, dir) {
 }
 function servingInstallReadings(record) {
   const version = record?.version?.trim() ?? "";
+  const instanceId = record?.instance_id?.trim() ?? "";
   return {
     bootVersion: version === "" ? null : version,
+    instanceId: instanceId === "" ? null : instanceId,
     prefix: record?.prefix?.trim() ?? "",
     installKind: record?.install_kind?.trim() ?? "",
     startedByApp: record?.desktop === true && (record.claim_key ?? "") === ""
@@ -10771,13 +10936,14 @@ class BackendServiceManager {
    * Stop only the captured serve generation, including failed startups. A port
    * or process name is not ownership. Unconfirmed exit blocks replacement.
    */
-  async stop(isRestart = false) {
+  async stop(isRestart = false, options = {}) {
     this.startEpoch++;
     if (!isRestart) this.isAppClosing = true;
     this.disposeStreamRelay();
     this.stopHealthCheck();
     const generation = this.ownedServe;
-    if (generation) await this.stopGeneration(generation, isRestart);
+    if (generation)
+      await this.stopGeneration(generation, isRestart, options.graceMs);
     await this.startPromise;
   }
   captureServe(child) {
@@ -10835,8 +11001,17 @@ class BackendServiceManager {
    * "we signalled it and moved on" would authorise exactly the double-serve
    * this class exists to prevent. An unconfirmed exit keeps ownership, and the
    * caller reports failure instead of proceeding.
+   *
+   * `graceMs` OVERRIDES THE RESTART GRACE FOR ONE CALL (2026-09-30), added for
+   * the update fallback: a serve being stopped because its reload could not be
+   * proven drains for as long as uvicorn waits for its connections (the
+   * server's own wait has no deadline), and the caller that knows the process
+   * is about to be replaced may bound that wait. The ESCALATION is unchanged -
+   * SIGTERM, the (possibly shorter) grace, SIGKILL, the force wait - so an
+   * unresponsive process still fails closed, and a caller that passes nothing
+   * gets the same grace it always got.
    */
-  stopGeneration(generation, isRestart) {
+  stopGeneration(generation, isRestart, graceMs) {
     if (generation.stop) return generation.stop;
     generation.stop = (async () => {
       const waitForExit = (ms) => new Promise((resolve) => {
@@ -10856,7 +11031,7 @@ class BackendServiceManager {
         });
       });
       if (this.canSignal(generation)) generation.child.kill("SIGTERM");
-      const grace = isRestart ? this.shutdownTimeoutMs.restart : this.shutdownTimeoutMs.normal;
+      const grace = graceMs ?? (isRestart ? this.shutdownTimeoutMs.restart : this.shutdownTimeoutMs.normal);
       if (!await waitForExit(grace)) {
         if (this.canSignal(generation)) generation.child.kill("SIGKILL");
         if (!await waitForExit(this.shutdownTimeoutMs.force)) {
@@ -11798,13 +11973,18 @@ class BackendServiceManager {
    * Restart the backend service
    * This method properly handles the restart process to ensure that any pending
    * timeouts from the stop operation don't affect the newly started process
+   *
+   * `options.stopGraceMs` bounds ONE restart's SIGTERM grace (see
+   * `stopGeneration`); it exists for the update fallback, whose process is
+   * already known to be replaced, and callers that pass nothing keep the
+   * default grace exactly as before.
    * @returns Promise resolving to true if the restart was successful, false otherwise
    */
-  restart() {
+  restart(options = {}) {
     if (this.restartPromise) return this.restartPromise;
     this.restartPromise = (async () => {
       try {
-        await this.stop(true);
+        await this.stop(true, { graceMs: options.stopGraceMs });
         if (this.isAppClosing) return false;
         return await this.start();
       } catch (error) {
@@ -12264,14 +12444,22 @@ function reportParksAtQuit(sessions, report) {
     ].join(" ")
   );
 }
-function reportSkippedWhileQuitting(context, requested) {
+function reportSkippedWhileQuitting(context, requested, deferredReopen = false) {
   context.report?.(
     [
       `trigger=${context.trigger}`,
       `mode=${MODE_OF_SHOW[requested]}`,
       `requested=${requested}`,
       ...requesterFields(context),
-      "applied=skipped+quitting"
+      "applied=skipped+quitting",
+      /*
+       * THE COMPLETION TOKEN (#755): this refusal was recorded and will be
+       * completed by one successor instance at the quit's terminal. Present
+       * exactly when the recorder took the record — the create-gate refusals
+       * (banner click, consent reopen, viewer verbs) are not completed and say
+       * nothing extra, and neither does a `never` request.
+       */
+      ...deferredReopen ? ["reopen=deferred"] : []
     ].join(" ")
   );
 }
@@ -12314,13 +12502,15 @@ function readSecondLaunchRequest(input) {
 }
 function applySecondLaunch(request, target2) {
   if (target2.quitting) {
+    const deferredReopen = target2.onRefusedWhileQuitting?.(request) === true;
     reportSkippedWhileQuitting(
       {
         trigger: "second-instance",
         requester: request.requester ?? void 0,
         report: target2.report
       },
-      request.show
+      request.show,
+      deferredReopen
     );
     return;
   }
@@ -13634,6 +13824,14 @@ const METHODS$1 = [
   "tabs",
   "scroll",
   "logs",
+  // The structured read actions (`styles`, `hit_test`, `ancestors`), in
+  // `protocol.py`'s tuple order: page-geometry reads answered by fixed
+  // self-contained page functions (the vendored `driver/geometry-read.ts`),
+  // capped and rounded in the page. This array is the wire's closed gate, so
+  // it must stay byte-comparable with the Python source it mirrors.
+  "styles",
+  "hit_test",
+  "ancestors",
   "request_access",
   "await_access",
   "cancel_access",
@@ -13692,7 +13890,13 @@ const ERROR_CODES = [
   // a command that hangs rather than one that fails.
   ...CONSOLE_ERROR_CODES
 ];
-const HOST_CAPABILITIES = ["download", "upload"];
+const HOST_CAPABILITIES = [
+  "styles",
+  "hit_test",
+  "ancestors",
+  "download",
+  "upload"
+];
 const RUN_DIRNAME = path$1.join("run", "ui-browser");
 const STATE_FILENAME = "host.json";
 const STATE_DIR_MODE = 448;
@@ -19314,6 +19518,135 @@ function clampTimeout(requested) {
   if (!Number.isFinite(wanted) || wanted <= 0) return CAPS.downloadTimeoutS;
   return Math.min(wanted, CAPS.downloadTimeoutMaxS);
 }
+const READ_STYLES_SOURCE = '(selector, properties) => {\n  const DEFAULTS = [\n    "display",\n    "position",\n    "visibility",\n    "opacity",\n    "z-index",\n    "transform",\n    "transform-origin",\n    "top",\n    "right",\n    "bottom",\n    "left",\n    "width",\n    "height",\n    "contain",\n    "filter",\n    "will-change",\n    "overflow",\n    "overflow-x",\n    "overflow-y",\n    "pointer-events"\n  ];\n  const MAX_MATCHES = 5;\n  const MAX_STYLES = 30;\n  const MAX_INLINE = 30;\n  const MAX_IDENTITY = 120;\n  const MAX_VALUE = 200;\n  const all = document.querySelectorAll(selector);\n  if (!all || all.length === 0) return null;\n  const names = DEFAULTS.slice();\n  if (Array.isArray(properties)) {\n    for (let i = 0; i < properties.length && names.length < MAX_STYLES; i++) {\n      const name = String(properties[i] ?? "").trim();\n      if (name && names.indexOf(name) === -1) names.push(name);\n    }\n  }\n  const round2 = (value) => {\n    const rounded = Math.round(value * 100) / 100;\n    return rounded === 0 ? 0 : rounded;\n  };\n  const clip = (value, limit) => value.length > limit ? value.slice(0, limit - 1) + "\\u2026" : value;\n  const rectOf = (el) => {\n    const r = el.getBoundingClientRect();\n    return {\n      x: round2(r.x),\n      y: round2(r.y),\n      top: round2(r.top),\n      right: round2(r.right),\n      bottom: round2(r.bottom),\n      width: round2(r.width),\n      height: round2(r.height)\n    };\n  };\n  const attrOf = (el, name) => clip(el.getAttribute(name) || "", MAX_IDENTITY);\n  const matches = [];\n  const first = Array.from(all).slice(0, MAX_MATCHES);\n  for (const el of first) {\n    const computed = getComputedStyle(el);\n    const styles = {};\n    for (const name of names) {\n      styles[name] = clip(String(computed.getPropertyValue(name) || "").trim(), MAX_VALUE);\n    }\n    const inline = {};\n    const declaration = el.style;\n    let inlineCount = 0;\n    for (let j = 0; j < declaration.length && inlineCount < MAX_INLINE; j++) {\n      const name = declaration.item(j);\n      if (name && name.indexOf("--") === 0) {\n        const key = clip(name, MAX_IDENTITY);\n        if (!(key in inline)) {\n          inline[key] = clip(\n            String(declaration.getPropertyValue(name) || "").trim(),\n            MAX_VALUE\n          );\n          inlineCount += 1;\n        }\n      }\n    }\n    matches.push({\n      tag: clip(el.tagName.toLowerCase(), MAX_IDENTITY),\n      id: attrOf(el, "id"),\n      role: attrOf(el, "role"),\n      className: attrOf(el, "class"),\n      rect: rectOf(el),\n      styles,\n      inline\n    });\n  }\n  return { count: matches.length, matches, truncated: all.length > matches.length };\n}';
+const HIT_TEST_SOURCE = '(x, y) => {\n  const PROPS = ["display", "position", "visibility", "opacity", "z-index", "pointer-events"];\n  const MAX_ELEMENTS = 8;\n  const MAX_IDENTITY = 120;\n  const MAX_VALUE = 200;\n  const px = Number(x);\n  const py = Number(y);\n  if (!Number.isFinite(px) || !Number.isFinite(py)) return null;\n  const stack = document.elementsFromPoint(px, py);\n  if (!stack || stack.length === 0) return null;\n  const round2 = (value) => {\n    const rounded = Math.round(value * 100) / 100;\n    return rounded === 0 ? 0 : rounded;\n  };\n  const clip = (value, limit) => value.length > limit ? value.slice(0, limit - 1) + "\\u2026" : value;\n  const attrOf = (el, name) => clip(el.getAttribute(name) || "", MAX_IDENTITY);\n  const elements = [];\n  for (const el of stack.slice(0, MAX_ELEMENTS)) {\n    const computed = getComputedStyle(el);\n    const styles = {};\n    for (const name of PROPS) {\n      styles[name] = clip(String(computed.getPropertyValue(name) || "").trim(), MAX_VALUE);\n    }\n    const r = el.getBoundingClientRect();\n    elements.push({\n      tag: clip(el.tagName.toLowerCase(), MAX_IDENTITY),\n      id: attrOf(el, "id"),\n      role: attrOf(el, "role"),\n      className: attrOf(el, "class"),\n      rect: {\n        x: round2(r.x),\n        y: round2(r.y),\n        top: round2(r.top),\n        right: round2(r.right),\n        bottom: round2(r.bottom),\n        width: round2(r.width),\n        height: round2(r.height)\n      },\n      styles\n    });\n  }\n  return { count: elements.length, elements };\n}';
+const ANCESTORS_SOURCE = '(selector, depth) => {\n  const PROPS = [\n    "display",\n    "position",\n    "visibility",\n    "overflow",\n    "overflow-x",\n    "overflow-y",\n    "transform",\n    "transform-origin",\n    "contain",\n    "filter",\n    "will-change",\n    "z-index",\n    "isolation",\n    "top",\n    "left"\n  ];\n  const DEFAULT_DEPTH = 12;\n  const MAX_DEPTH = 16;\n  const MAX_IDENTITY = 120;\n  const MAX_VALUE = 200;\n  const el = document.querySelector(selector);\n  if (!el) return null;\n  const wanted = typeof depth === "number" && Number.isFinite(depth) ? Math.floor(depth) : DEFAULT_DEPTH;\n  const bound = Math.max(1, Math.min(MAX_DEPTH, wanted));\n  const round2 = (value) => {\n    const rounded = Math.round(value * 100) / 100;\n    return rounded === 0 ? 0 : rounded;\n  };\n  const clip = (value, limit) => value.length > limit ? value.slice(0, limit - 1) + "\\u2026" : value;\n  const attrOf = (el2, name) => clip(el2.getAttribute(name) || "", MAX_IDENTITY);\n  const chain = [];\n  let node = el;\n  while (node && chain.length < bound) {\n    const computed = getComputedStyle(node);\n    const styles = {};\n    for (const name of PROPS) {\n      styles[name] = clip(String(computed.getPropertyValue(name) || "").trim(), MAX_VALUE);\n    }\n    const r = node.getBoundingClientRect();\n    chain.push({\n      tag: clip(node.tagName.toLowerCase(), MAX_IDENTITY),\n      id: attrOf(node, "id"),\n      role: attrOf(node, "role"),\n      className: attrOf(node, "class"),\n      rect: {\n        x: round2(r.x),\n        y: round2(r.y),\n        top: round2(r.top),\n        right: round2(r.right),\n        bottom: round2(r.bottom),\n        width: round2(r.width),\n        height: round2(r.height)\n      },\n      styles\n    });\n    if (node === document.documentElement) break;\n    node = node.parentElement;\n  }\n  return { count: chain.length, chain };\n}';
+const MAX_REQUESTED_PROPERTIES = 20;
+const DEFAULT_DEPTH = 12;
+const MAX_DEPTH = 16;
+async function runFixed(record, source, args, label) {
+  const code = `(${source})(${args.map((arg) => JSON.stringify(arg)).join(", ")})`;
+  return await deadline(
+    record.view.webContents.executeJavaScriptInIsolatedWorld(
+      ISOLATED_WORLD_ID,
+      [{ code }]
+    ),
+    SCRIPTING_DEADLINE_MS,
+    label
+  );
+}
+function selectorError(selector, error) {
+  if (error instanceof Error && INVALID_SELECTOR.test(error.message)) {
+    return new BridgeCommandError(
+      "element_not_found",
+      `selector ${selector} is not valid`
+    );
+  }
+  return error;
+}
+function structuredResult(name, result) {
+  if (typeof result !== "object" || result === null) {
+    throw new BridgeCommandError(
+      "internal",
+      `the page returned no structured ${name} result`
+    );
+  }
+  return result;
+}
+function requiredSelector(params) {
+  const selector = stringParam(params, "selector");
+  if (!selector) {
+    throw new BridgeCommandError("element_not_found", "selector is required");
+  }
+  return selector;
+}
+function requestedProperties(params) {
+  if (!Array.isArray(params.properties)) return [];
+  return params.properties.filter((entry) => typeof entry === "string").slice(0, MAX_REQUESTED_PROPERTIES);
+}
+async function styles(ctx, params) {
+  const record = ctx.registry.requireSurface(params.tab);
+  const selector = requiredSelector(params);
+  const properties = requestedProperties(params);
+  let result;
+  try {
+    result = await runFixed(
+      record,
+      READ_STYLES_SOURCE,
+      [selector, properties],
+      `styles(${selector})`
+    );
+  } catch (error) {
+    throw selectorError(selector, error);
+  }
+  if (result === null || result === void 0) {
+    throw new BridgeCommandError(
+      "element_not_found",
+      `selector ${selector} matched nothing`
+    );
+  }
+  ctx.registry.touch(record);
+  return { ...structuredResult("styles", result), ...pageOf(record.view) };
+}
+async function hitTest(ctx, params) {
+  const record = ctx.registry.requireSurface(params.tab);
+  const x = numberParam(params, "x");
+  const y = numberParam(params, "y");
+  if (x === void 0 || y === void 0) {
+    throw new BridgeCommandError(
+      "internal",
+      "'hit_test' needs numeric x and y (viewport coordinates)"
+    );
+  }
+  const result = await runFixed(
+    record,
+    HIT_TEST_SOURCE,
+    [x, y],
+    `hit_test(${x}, ${y})`
+  );
+  if (result === null || result === void 0) {
+    throw new BridgeCommandError(
+      "element_not_found",
+      `no element at point (${x}, ${y})`
+    );
+  }
+  ctx.registry.touch(record);
+  return {
+    ...structuredResult("hit_test", result),
+    ...pageOf(record.view)
+  };
+}
+async function ancestors(ctx, params) {
+  const record = ctx.registry.requireSurface(params.tab);
+  const selector = requiredSelector(params);
+  const raw = numberParam(params, "depth");
+  const depth = Math.max(
+    1,
+    Math.min(MAX_DEPTH, raw === void 0 ? DEFAULT_DEPTH : Math.floor(raw))
+  );
+  let result;
+  try {
+    result = await runFixed(
+      record,
+      ANCESTORS_SOURCE,
+      [selector, depth],
+      `ancestors(${selector})`
+    );
+  } catch (error) {
+    throw selectorError(selector, error);
+  }
+  if (result === null || result === void 0) {
+    throw new BridgeCommandError(
+      "element_not_found",
+      `selector ${selector} matched nothing`
+    );
+  }
+  ctx.registry.touch(record);
+  return {
+    ...structuredResult("ancestors", result),
+    ...pageOf(record.view)
+  };
+}
 const MAX_AGENT_TABS = 8;
 const BACKGROUND_VIEWPORT = {
   x: 0,
@@ -20278,6 +20611,12 @@ function factOf(path2) {
 }
 const DOCUMENT_SCOPED = /* @__PURE__ */ new Set([
   "read",
+  // The structured reads (`styles`, `hit_test`, `ancestors`) describe the
+  // CURRENT document exactly as `read` does, so a result that raced a
+  // navigation it did not cause must be discarded the same way.
+  "styles",
+  "hit_test",
+  "ancestors",
   "snapshot",
   "screenshot",
   "click",
@@ -20305,6 +20644,9 @@ const NAVIGATION_ACTIONS = /* @__PURE__ */ new Set(["click", "type"]);
 const TAB_SCOPED = /* @__PURE__ */ new Set([
   "goto",
   "read",
+  "styles",
+  "hit_test",
+  "ancestors",
   "snapshot",
   "screenshot",
   "click",
@@ -20482,6 +20824,12 @@ class BrowserHost {
         return retitle();
       case "read":
         return read(this, params);
+      case "styles":
+        return styles(this, params);
+      case "hit_test":
+        return hitTest(this, params);
+      case "ancestors":
+        return ancestors(this, params);
       case "snapshot":
         return snapshot(this, params);
       case "scroll":
@@ -24238,6 +24586,7 @@ async function startBrowserHost(options) {
       }
     });
     window.contentView.addChildView(view);
+    view.setBounds(BACKGROUND_VIEWPORT);
     view.setVisible(false);
     return view;
   }
@@ -33564,6 +33913,49 @@ function createQuitState() {
     isQuitting: () => quitting
   };
 }
+function successorArgs(entry, facts) {
+  if (entry.kind === "activate") {
+    if (!facts.defaultApp) return [];
+    return withModePin(facts.argv.slice(1), entry.show);
+  }
+  if (entry.argv === null) return [];
+  return withModePin(entry.argv.slice(1), entry.show);
+}
+function withModePin(args, show) {
+  const namesAMode = args.some(
+    (argument) => argument === WINDOW_MODE_FLAG || argument.startsWith(`${WINDOW_MODE_FLAG}=`)
+  );
+  return namesAMode ? [...args] : [...args, `${WINDOW_MODE_FLAG}=${MODE_OF_SHOW[show]}`];
+}
+function defaultSuccessorFacts() {
+  return { defaultApp: process.defaultApp === true, argv: process.argv };
+}
+function createRelaunchPending(options = {}) {
+  const facts = options.facts ?? defaultSuccessorFacts;
+  let pending = null;
+  let scheduled = false;
+  return {
+    hasPending: () => pending !== null,
+    record: (entry) => {
+      if (!canCreateWindowFor(entry.show)) return false;
+      pending = {
+        ...entry,
+        argv: entry.argv === null ? null : [...entry.argv]
+      };
+      return true;
+    },
+    clear: () => {
+      pending = null;
+    },
+    scheduleOnExit: ({ relaunch }) => {
+      if (scheduled) return;
+      const entry = pending;
+      if (entry === null) return;
+      scheduled = true;
+      relaunch(successorArgs(entry, facts()));
+    }
+  };
+}
 function titlebarOptions(platform, chrome) {
   if (platform === "darwin") {
     return { titleBarStyle: "hidden" };
@@ -33599,6 +33991,123 @@ function titlebarOptions(platform, chrome) {
     }
   };
 }
+const UPDATE_REPORT_KEY = "update_report";
+const UPDATE_REPORT_SCHEMA_PREFIX = "update.report.";
+const DAEMON_STATUSES = /* @__PURE__ */ new Set([
+  "refreshed",
+  "already",
+  "failed",
+  "unsupervised"
+]);
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function parseUpdateReport(stdout) {
+  let found = null;
+  for (const line of stdout.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed.startsWith("{") || !trimmed.includes(UPDATE_REPORT_KEY))
+      continue;
+    let payload;
+    try {
+      payload = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    const report = reportFromPayload(payload);
+    if (report) found = report;
+  }
+  return found;
+}
+function reportFromPayload(payload) {
+  if (!isRecord(payload)) return null;
+  const raw = payload[UPDATE_REPORT_KEY];
+  if (!isRecord(raw)) return null;
+  const schema2 = raw.schema;
+  if (typeof schema2 !== "string" || !schema2.startsWith(UPDATE_REPORT_SCHEMA_PREFIX))
+    return null;
+  const installVersion = raw.install_version;
+  const target2 = raw.target;
+  if (typeof installVersion !== "string" || typeof target2 !== "string")
+    return null;
+  const serve = raw.serve;
+  const daemons = raw.daemons;
+  if (!Array.isArray(serve) || !Array.isArray(daemons)) return null;
+  const serveEntries = [];
+  for (const entry of serve) {
+    if (!isRecord(entry)) return null;
+    const { pid, from, to, moved, instance } = entry;
+    if (typeof pid !== "number" || typeof from !== "string" || typeof to !== "string" || typeof moved !== "boolean" || typeof instance !== "string")
+      return null;
+    serveEntries.push({ pid, from, to, moved, instance });
+  }
+  const daemonEntries = [];
+  for (const entry of daemons) {
+    if (!isRecord(entry)) return null;
+    const { name, status: status2, version } = entry;
+    if (typeof name !== "string" || typeof status2 !== "string" || !DAEMON_STATUSES.has(status2) || typeof version !== "string")
+      return null;
+    daemonEntries.push({
+      name,
+      status: status2,
+      version
+    });
+  }
+  return {
+    schema: schema2,
+    install_version: installVersion,
+    target: target2,
+    serve: serveEntries,
+    daemons: daemonEntries
+  };
+}
+function serveMovedOntoBuild(input) {
+  if (!input.healthOk) return false;
+  const before = input.instanceBefore?.trim() ?? "";
+  if (before === "") return false;
+  const after = input.recordAfter.instanceId?.trim() || input.reportServe?.instance.trim() || "";
+  if (after === "" || after === before) return false;
+  return serveOnTarget(
+    input.recordAfter.bootVersion,
+    input.installVersion,
+    input.target
+  );
+}
+function serveOnTarget(bootVersion, installVersion, target2) {
+  const boot = bootVersion?.trim() ?? "";
+  if (boot === "") return false;
+  const wanted = target2?.trim() ?? "";
+  if (wanted !== "") {
+    const order2 = compareVersions(boot, wanted);
+    return order2 !== null && order2 >= 0;
+  }
+  const installed = installVersion?.trim() ?? "";
+  if (installed === "") return false;
+  const order = compareVersions(boot, installed);
+  return order === null ? boot === installed : order >= 0;
+}
+function runtimeStragglerCount(body, current) {
+  const currentBuild = current?.trim() ?? "";
+  if (currentBuild === "") return null;
+  if (!isRecord(body)) return null;
+  const result = body.result;
+  if (!isRecord(result)) return null;
+  const runtimes = result.runtimes;
+  if (!Array.isArray(runtimes)) return null;
+  let count = 0;
+  for (const row of runtimes) {
+    if (!isRecord(row)) continue;
+    const build = typeof row.build_version === "string" ? row.build_version.trim() : "";
+    if (build === "") continue;
+    if (build !== currentBuild) count += 1;
+  }
+  return count;
+}
+function daemonMoveOutcome(report) {
+  if (report === null) return null;
+  const failed = report.daemons.filter(
+    (daemon) => daemon.status === "failed" || daemon.status === "unsupervised"
+  ).map((daemon) => daemon.name);
+  return { source: "report", moved: failed.length === 0, failed };
+}
 const CHROMIUM_TRANSPORT_CODES = [
   "ERR_INTERNET_DISCONNECTED",
   "ERR_NETWORK_CHANGED",
@@ -34388,6 +34897,7 @@ const BETA_VERSION_REGEX = /v\d+\.\d+\.\d+\.beta\.\d+/;
 const ARCHITECTURE_SEPARATOR_REGEX = /\s+/;
 const GLOBAL_UPDATE_TIMEOUT_MS = 15 * 60 * 1e3;
 const SOURCE_REBUILD_TIMEOUT_MS = 30 * 60 * 1e3;
+const UPDATE_RESTART_STOP_GRACE_MS = 5e3;
 const BUNDLE_ID_REGEX = /^[\w.-]+$/;
 const INSTALL_IN_FLIGHT_RECHECK_MS = 1e4;
 const LAUNCHCTL_NOT_LOADED_REGEX = /could not find|no such process/i;
@@ -35847,6 +36357,21 @@ class UpdateService {
     this.ensureWatchdogAfterInFlightQuit(marker);
     return true;
   }
+  /**
+   * Whether this quit's RELAUNCH is already owned by the update lane, as a
+   * read-only question for the quit's own terminal.
+   *
+   * The same fact `quitForInFlightInstall` decides: when a live pending install
+   * exists, the app quits so Squirrel's swap can proceed and the relaunch
+   * watchdog is what brings it back. A second return path arriving at that swap
+   * is exactly the failure both lanes guard against — Squirrel's last check
+   * aborts an install when any instance of the target app is running — so #755's
+   * successor launch (a reopen refused during the quit, completed with
+   * `app.relaunch` at the quit terminal) must stand down while this is true.
+   */
+  inFlightInstallOwnsRelaunch() {
+    return this.inFlightQuitWatchdogEnsured;
+  }
   /**
    * Kill a watchdog still running from the recorded install attempt.
    *
@@ -38877,6 +39402,219 @@ ${heal.removed.join("\n")}`,
   async readFleetSnapshot(backend) {
     return backend.servingSessionFleet();
   }
+  /**
+   * The serving process's own record, both fields from ONE read.
+   *
+   * The post-swap move proof compares an instance token against the pre-swap
+   * one, and a pair assembled from two reads can straddle a republish (a new
+   * instance under the OLD version string, or the reverse) - so the two fields
+   * come out of a single `servingInstall()` call, which reads the record file
+   * once. Absence is both-fields-null, never a papered-over reading: a record
+   * that could not be read proves nothing and the verdict says so.
+   */
+  servingRecordReadings() {
+    const readings = this.backendService?.servingInstall().readings ?? servingInstallReadings(null);
+    return {
+      bootVersion: readings.bootVersion,
+      instanceId: readings.instanceId
+    };
+  }
+  /**
+   * The pre-swap rows still resident in a fresh read, or null when unreadable.
+   *
+   * The liveness count's own arithmetic, in one place because two callers need
+   * it in different shapes (the restart fallback counts from this, the moved
+   * path's fallback counts THROUGH it). A read that could not be taken is null
+   * rather than an empty set: "nothing resident" would be a measured zero, and
+   * an unanswered roster is not a measurement. A cold row (an empty
+   * `liveState`, the catalogue's spelling for a session with no runtime) is not
+   * resident - `isLiveRow` owns that rule, the same one the engagement diff
+   * uses.
+   */
+  stillResidentRows(before, after) {
+    if (after === null) return null;
+    const liveNow = new Set(
+      after.filter((row) => isLiveRow(row)).map((row) => row.sessionId)
+    );
+    return before.filter((row) => isLiveRow(row) && liveNow.has(row.sessionId));
+  }
+  /**
+   * The BUILD-accurate straggler count: runtimes not on the build the server
+   * is on, from the machine's runtime roster, or null when it did not answer.
+   *
+   * THIS IS THE PRIMARY CENSUS since 2026-09-30 (design §5): `GET
+   * /v1/desktop/runtimes?probe=false` returns one row per live runtime with the
+   * `build_version` the runtime's own record (or boot record) carries, so the
+   * count answers the question the notice's sentence makes - "still on the old
+   * version" - from a build reading rather than from a liveness proxy. An empty
+   * `build_version` is UNKNOWN and is not counted (the roster journal's own
+   * rule), and a row whose build equals the current one has already rolled.
+   *
+   * Null (unreadable body, non-200, a transport failure, or no current build to
+   * compare against) sends the caller to the liveness fallback; the failure is
+   * logged here, where the transport error is still in hand. The read is
+   * deliberately per-call rather than cached: it is the one reading whose whole
+   * point is that it moves as runtimes roll, so every completion asks the
+   * machine again. A notice-reopen re-read is NOT wired (review round 1's A1):
+   * no renderer->main census channel exists yet, so the count travels with the
+   * completion it was measured for - recorded as deferred on the PR rather
+   * than claimed here.
+   */
+  async readRuntimeCensus(backend, current) {
+    try {
+      const response = await backend.requestDesktop({ op: "runtimes.list" });
+      if (response.status !== 200) {
+        logger.info(
+          `Runtime roster did not answer (${response.status}); the straggler count falls back to the liveness reading`,
+          LogFileType.UPDATE_SERVICE
+        );
+        return null;
+      }
+      const count = runtimeStragglerCount(response.body, current);
+      if (count === null) {
+        logger.info(
+          "Runtime roster answered with no usable rows; the straggler count falls back to the liveness reading",
+          LogFileType.UPDATE_SERVICE
+        );
+      }
+      return count;
+    } catch (error) {
+      logger.info(
+        `Runtime roster read failed (${error instanceof Error ? error.message : String(error)}); the straggler count falls back to the liveness reading`,
+        LogFileType.UPDATE_SERVICE
+      );
+      return null;
+    }
+  }
+  /**
+   * The straggler count and where it came from: build first, liveness second.
+   *
+   * The build count (`readRuntimeCensus`) is the primary. When the roster does
+   * not answer, the fallback is the EXISTING liveness reading, in whichever
+   * shape the path already has it: the restart fallback passes the rows its own
+   * post-restart read found resident (`resident`), while the moved path passes
+   * the pre-update snapshot (`before`) and this takes one fresh fleet read to
+   * count it. A path with neither - no snapshot, or a fleet read that failed -
+   * answers null/null, which the notice renders as the numberless sentence: a
+   * count that cannot be measured is not a zero.
+   *
+   * The source travels with the count for the RECORD, and for any later reader
+   * that needs to know how it was measured - it does not choose the notice's
+   * words. The notice keeps ONE session-family sentence for both sources
+   * (designer copy consult, 2026-09-30: the producer's vocabulary belongs in
+   * the payload field, never in the reader's sentence), so a build count is not
+   * printed as "N runtimes" and the liveness reading's documented over-count
+   * rides the field beside the count instead of changing the sentence.
+   */
+  async readStragglerCensus(input) {
+    const build = await this.readRuntimeCensus(input.backend, input.current);
+    if (build !== null) return { count: build, source: "build" };
+    let resident;
+    if (input.resident !== void 0) {
+      resident = input.resident;
+    } else if (input.before != null) {
+      resident = this.stillResidentRows(
+        input.before,
+        await this.readFleetSnapshot(input.backend)
+      );
+    } else {
+      resident = null;
+    }
+    if (resident === null) return { count: null, source: null };
+    logger.info(
+      `Straggler count from the liveness reading: ${resident.length} pre-swap session(s) still resident`,
+      LogFileType.UPDATE_SERVICE
+    );
+    return { count: resident.length, source: "liveness" };
+  }
+  /**
+   * The restart fallback's tail for a generation install: ONE read, the
+   * engage, and the resident set - no retire wait (2026-09-30).
+   *
+   * WHY THERE IS NO WAIT HERE. The rebuild route's `reengageDisplacedSessions`
+   * waits for the pre-swap set to retire because a rebuild rewrites the tree a
+   * runtime is reading, so runtimes really do die under it and the wave takes
+   * ~35 s to pass. A serve restart displaces nothing by itself - session
+   * runtimes are detached and survived the bounce (they retire on their own
+   * build check, whenever their next idle is) - and the measured ordinary shape
+   * was an idle-gated fleet that never moved, so the wait burned its full 60 s
+   * grace for an engage it never performed. The re-engage opportunity it
+   * represented is idle's job now (the 2026-09-29 directive), and the honest
+   * statement replaces the wait: engage only the sessions THIS read shows
+   * without a runtime, and count the rest as still resident.
+   *
+   * IDEMPOTENT BY THE SAME READ: the engage set is the difference the one read
+   * shows, so a runtime that came back on its own is never spawned twice.
+   * Returns null when the read could not be taken - not measured, which the
+   * census and the caller's log both carry as such.
+   */
+  async engageDisplacedAfterFallbackRestart(backend, snapshot2) {
+    if (snapshot2 === null) return null;
+    if (snapshot2.length === 0) return [];
+    const after = await this.readFleetSnapshot(backend);
+    const displaced = displacedSessions(snapshot2, after);
+    const engaged = [];
+    const failed = [];
+    for (const row of displaced) {
+      try {
+        if (await this.engageSessionRuntime(backend, row))
+          engaged.push(row.sessionId);
+        else
+          failed.push({
+            sessionId: row.sessionId,
+            reason: "the server did not take the engage"
+          });
+      } catch (error) {
+        failed.push({
+          sessionId: row.sessionId,
+          reason: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+    logger.info(
+      `Re-engaged ${engaged.length} of ${displaced.length} session(s) displaced by the restart${failed.length > 0 ? `; ${failed.length} did not answer (${failed.map((row) => row.sessionId).join(", ")})` : ""}`,
+      LogFileType.UPDATE_SERVICE
+    );
+    if (after === null) return null;
+    return this.stillResidentRows(snapshot2, after);
+  }
+  /**
+   * Say the rollover's evidence, once, where a post-mortem reads it.
+   *
+   * THE HONEST DEGRADE IS THE POINT (task §3): with the updater's structured
+   * report absent - any core build before `update.report.v1` - serve is proven
+   * by its own record and the daemons are BEST-EFFORT. That is said in exactly
+   * those words rather than faked from a line that is not there, because the
+   * alternative (treating an absent report as "daemons fine") is how a
+   * user-visible claim gets made with no evidence behind it. A report that NAMES a
+   * failed daemon is surfaced as a warning beside the same line.
+   *
+   * Names the three inputs the verdict read - the instance pair, the boot
+   * reading, the `/health` answer - so a wrong verdict can be reconstructed
+   * from the log without re-running anything.
+   */
+  logRolloverEvidence(input) {
+    const verdict = input.moved ? "proven moved" : "not proven moved";
+    const facts = `instance ${input.instanceBefore ?? "no reading"} -> ${input.recordAfter.instanceId ?? "no reading"}, boot ${input.recordAfter.bootVersion ?? "no reading"}, /health ${input.healthOk ? "answered" : "did not answer"}`;
+    const daemons = daemonMoveOutcome(input.report);
+    if (daemons === null) {
+      logger.info(
+        `Rollover evidence: serve ${verdict} (${facts}); the updater printed no update.report.v1 line, so the daemons are best-effort with no evidence either way`,
+        LogFileType.UPDATE_SERVICE
+      );
+      return;
+    }
+    logger.info(
+      `Rollover evidence: serve ${verdict} (${facts}); the updater's report says ${daemons.moved ? "every supervised daemon is refreshed or already current" : `these daemons did not refresh: ${daemons.failed.join(", ")}`}`,
+      LogFileType.UPDATE_SERVICE
+    );
+    if (!daemons.moved) {
+      logger.warn(
+        `Daemon refresh incomplete after the update: ${daemons.failed.join(", ")} (named by the update.report.v1 line; serve's own move is a separate reading)`,
+        LogFileType.UPDATE_SERVICE
+      );
+    }
+  }
   /**
    * The build the daemon serving this app BOOTED with, or null when its record
    * carries no reading.
@@ -38898,7 +39636,7 @@ ${heal.removed.join("\n")}`,
    * the same pair rather than about two different questions.
    */
   servingBootVersion() {
-    return this.backendService?.servingInstall().readings.bootVersion ?? null;
+    return this.servingRecordReadings().bootVersion;
   }
   /**
    * The running reading an update event carries to the renderer.
@@ -39269,6 +40007,7 @@ ${heal.removed.join("\n")}`,
       sourceRebuild: rebuildPath
     });
     const rebuildRoute = freshPlan.managedRoute === "source-build" && rebuildPath !== null;
+    const generationInstall = freshPlan.managedRoute === "entry-point";
     if (!consolePath && !rebuildRoute) {
       this.sendToRenderer("backend-update-error", {
         message: "The global install could not be found on this machine, so the update did not run. See the update service log.",
@@ -39281,6 +40020,8 @@ ${heal.removed.join("\n")}`,
     const before = this.readInstallVersionAt(installPath) ?? plan.installedInstallVersion;
     const markerBefore = rebuildRoute ? this.readRebuildMarkerState(installPath) : null;
     const fleetBeforeInstall = rebuildRoute ? await this.readFleetSnapshot(backend) : null;
+    const serveInstanceBefore = generationInstall ? this.servingRecordReadings().instanceId : null;
+    const fleetBeforeUpdate = generationInstall ? await this.readFleetSnapshot(backend) : null;
     if (rebuildRoute && !await this.drainFleetForUpdate({
       backend,
       command: freshPlan.updateCommand ?? null
@@ -39379,9 +40120,63 @@ ${heal.removed.join("\n")}`,
       `Global install updated: ${before ?? "unknown"} -> ${after ?? "unknown"}`,
       LogFileType.UPDATE_SERVICE
     );
-    const generationInstall = freshPlan.managedRoute === "entry-point";
-    const installAlreadyCurrent = !rebuildRoute && before !== null && after !== null && before === after;
-    if (backend.isUsingExternalBackend() || generationInstall && !installAlreadyCurrent) {
+    const updateReport = generationInstall ? parseUpdateReport(run.stdout) : null;
+    let serveRecordAfter = { bootVersion: null, instanceId: null };
+    let serveHealthOk = null;
+    let serveMovedWithoutRestart = false;
+    if (generationInstall) {
+      serveRecordAfter = this.servingRecordReadings();
+      serveHealthOk = await this.checkBackendHealth();
+      serveMovedWithoutRestart = serveMovedOntoBuild({
+        instanceBefore: serveInstanceBefore,
+        recordAfter: serveRecordAfter,
+        installVersion: after,
+        target: target2,
+        reportServe: updateReport?.serve[0] ?? null,
+        healthOk: serveHealthOk
+      });
+      this.logRolloverEvidence({
+        report: updateReport,
+        moved: serveMovedWithoutRestart,
+        instanceBefore: serveInstanceBefore,
+        recordAfter: serveRecordAfter,
+        healthOk: serveHealthOk
+      });
+    }
+    if (serveMovedWithoutRestart) {
+      const census = await this.readStragglerCensus({
+        backend,
+        current: serveRecordAfter.bootVersion ?? after ?? target2,
+        before: fleetBeforeUpdate
+      });
+      logger.info(
+        `The server serving this app moved onto ${serveRecordAfter.bootVersion ?? "the new build"} without a restart (instance changed, /health answered, ${census.count ?? "no"} straggler(s) counted from ${census.source ?? "no"} reading); completing without bouncing it`,
+        LogFileType.UPDATE_SERVICE
+      );
+      this.sendToRenderer("backend-update-completed", {
+        installVersion: after,
+        /*
+         * THE RECORD's reading, not `/health`'s (round 2, T1): the panel
+         * compares these two strings, and only the process's own record
+         * names the build it actually loaded. The moved verdict requires
+         * a boot reading, so this arm cannot send a null it proved.
+         */
+        runningVersion: serveRecordAfter.bootVersion,
+        moved: true,
+        restarted: false,
+        restartable: this.backendIsAppOwned(),
+        /*
+         * FALSE BY CONSTRUCTION, and stated rather than left absent: this arm is
+         * the global install's own updater, so the environment it moved is never
+         * the app's managed one (design D5).
+         */
+        appOwnedEnvironment: false,
+        sessionsOnOldBuild: census.count,
+        sessionsOnOldBuildSource: census.source
+      });
+      return true;
+    }
+    if (backend.isUsingExternalBackend()) {
       const health = await this.getInstalledBackendVersion();
       const running2 = this.eventRunningVersion(health);
       logger.info(
@@ -39392,6 +40187,7 @@ ${heal.removed.join("\n")}`,
         installVersion: after,
         runningVersion: running2,
         restarted: false,
+        moved: false,
         restartable: this.backendIsAppOwned(),
         /*
          * FALSE BY CONSTRUCTION, and stated rather than left absent: this arm is
@@ -39402,13 +40198,21 @@ ${heal.removed.join("\n")}`,
       });
       return true;
     }
+    if (generationInstall) {
+      logger.info(
+        `Install moved to ${after ?? "unknown"}; the serving process's own record does not prove it moved onto the new build (instance ${serveInstanceBefore ?? "no reading"} -> ${serveRecordAfter.instanceId ?? "no reading"}, boot ${serveRecordAfter.bootVersion ?? "no reading"}, /health ${serveHealthOk ? "answered" : "did not answer"}); restarting the daemon this app owns onto it`,
+        LogFileType.UPDATE_SERVICE
+      );
+    }
     logger.info(
       "Restarting backend service onto the updated install...",
       LogFileType.UPDATE_SERVICE
     );
     this.sendToRenderer("backend-update-progress", { phase: "restarting" });
     const fleetBeforeRestart = await this.readFleetSnapshot(backend);
-    const restartSuccess = await backend.restart();
+    const restartSuccess = await backend.restart({
+      stopGraceMs: UPDATE_RESTART_STOP_GRACE_MS
+    });
     if (!restartSuccess) {
       logger.error(
         "Backend service restart failed after the global install update",
@@ -39465,12 +40269,43 @@ ${heal.removed.join("\n")}`,
       fleetBeforeInstall,
       fleetBeforeRestart
     );
-    const reengage = reengageSnapshot !== null ? await this.reengageFleetAfterRestart(backend, reengageSnapshot) : null;
+    let sessionsOnOldBuild;
+    let sessionsOnOldBuildSource;
+    if (rebuildRoute) {
+      const reengage = reengageSnapshot !== null ? await this.reengageFleetAfterRestart(backend, reengageSnapshot) : null;
+      const census = await this.readStragglerCensus({
+        backend,
+        current: after ?? target2,
+        resident: reengage !== null ? reengage.stillResident : null
+      });
+      sessionsOnOldBuild = census.count;
+      sessionsOnOldBuildSource = census.source;
+    } else {
+      const resident = await this.engageDisplacedAfterFallbackRestart(
+        backend,
+        reengageSnapshot
+      );
+      const census = await this.readStragglerCensus({
+        backend,
+        current: reported ?? after ?? target2,
+        resident
+      });
+      sessionsOnOldBuild = census.count;
+      sessionsOnOldBuildSource = census.source;
+    }
     this.sendToRenderer("backend-update-completed", {
       installVersion: after,
       runningVersion: reported,
       restarted: true,
-      sessionsOnOldBuild: reengage?.stillResident.length ?? null
+      /*
+       * The app moved this daemon onto the new build with the restart, and the
+       * distinction is stated where it was proven (`reported` was held
+       * at-or-past the target above). Absent on the rebuild route, which keeps
+       * its version and its own sentence.
+       */
+      ...rebuildRoute ? {} : { moved: true },
+      sessionsOnOldBuild,
+      sessionsOnOldBuildSource
     });
     return true;
   }
@@ -40655,6 +41490,7 @@ function armHeadlessExitDeadline(why) {
     const line = `${why}; the quit did not finish within ${LAUNCHER_EXIT_DEADLINE_MS} ms, exiting`;
     logger.error(`[window-mode] ${line}`, LogFileType.BACKEND);
     console.log(`[window-mode] ${line}`);
+    scheduleReopenAtQuitTerminal();
     electron.app.exit(0);
   }, LAUNCHER_EXIT_DEADLINE_MS);
   deadline2.unref();
@@ -41110,10 +41946,17 @@ const userShellPath = createUserShellPath({
 });
 const backendService = new BackendServiceManager({ userShellPath });
 const quitState = createQuitState();
+const relaunchPending = createRelaunchPending();
 const backendInstaller = new BackendInstaller({
   // The installer's one route back from a cancelled quit: the declined dialog
-  // answer (`./quit-state` owns why there is exactly one such site).
-  onQuitCancelled: () => quitState.cancel()
+  // answer (`./quit-state` owns why there is exactly one such site). The
+  // refused reopen's record is let go BESIDE that release: a cancelled quit
+  // must not leak a spawn into some later, unrelated exit
+  // (`./relaunch-pending` owns why scheduling happens only at the terminal).
+  onQuitCancelled: () => {
+    quitState.cancel();
+    relaunchPending.clear();
+  }
 });
 const reportBackendFailure = (message, fileType) => {
   if (backendService.isShuttingDown()) {
@@ -41338,6 +42181,20 @@ if (!gotTheLock) {
            * `window-raise.ts` owns the refusal and its line).
            */
           quitting: quitState.isQuitting(),
+          /*
+           * #755: A REFUSED SECOND LAUNCH LEAVES A RECORD. The request that would have been
+           * refused whole is one the user made, so beside the refusal it is recorded and
+           * the quit's terminal completes it with one successor instance
+           * (`./relaunch-pending` owns the shape and the exactly-once rule). `commandLine`
+           * is THIS request's own, so what the successor replays cannot drift from what
+           * was refused, and the recorder's answer is what makes the refusal line say
+           * `reopen=deferred` (`window-raise.ts` owns the token).
+           */
+          onRefusedWhileQuitting: (request) => relaunchPending.record({
+            kind: "second-instance",
+            show: request.show,
+            argv: commandLine
+          }),
           openConversation: openConversationInWindow ? (session, request) => openConversationInWindow?.(
             session,
             secondInstanceRequest(request)
@@ -42317,9 +43174,15 @@ electron.app.whenReady().then(async () => {
     reassertDockParticipation();
     if (electron.BrowserWindow.getAllWindows().length === 0) {
       if (quitState.isQuitting()) {
+        const deferredReopen = relaunchPending.record({
+          kind: "activate",
+          show: OPERATOR_SHOW,
+          argv: null
+        });
         reportSkippedWhileQuitting(
           { trigger: "activate", report: reportRaise },
-          OPERATOR_SHOW
+          OPERATOR_SHOW,
+          deferredReopen
         );
         return;
       }
@@ -42383,9 +43246,40 @@ electron.app.on("window-all-closed", () => {
 const QUIT_FAILSAFE_MARGIN_MS = 5e3;
 const QUIT_CLEANUP_FAILSAFE_MS = LAUNCHER_PROBE_WORST_MS + INTERPRETER_RESOLUTION_WORST_MS + OWNED_STOP_WORST_MS + READINESS_POLL_INTERVAL_MS + QUIT_FAILSAFE_MARGIN_MS;
 let backendQuitPending = false;
+let relaunchStandDownLogged = false;
+const scheduleReopenAtQuitTerminal = () => {
+  if (activeUpdateService?.inFlightInstallOwnsRelaunch() === true) {
+    if (relaunchPending.hasPending() && !relaunchStandDownLogged) {
+      relaunchStandDownLogged = true;
+      logger.info(
+        "[relaunch] not scheduling a successor: an in-flight update install owns this quit's relaunch",
+        LogFileType.BACKEND
+      );
+    }
+    return;
+  }
+  relaunchPending.scheduleOnExit({
+    relaunch: (args) => {
+      try {
+        electron.app.relaunch({ args: [...args] });
+        logger.info(
+          `[relaunch] successor scheduled to complete the deferred reopen: ${args.length === 0 ? "(plain reopen)" : args.join(" ")}`,
+          LogFileType.BACKEND
+        );
+      } catch (error) {
+        logger.error(
+          "[relaunch] scheduling the successor failed; the quit continues",
+          LogFileType.BACKEND,
+          error
+        );
+      }
+    }
+  });
+};
 electron.app.on("will-quit", (event) => {
   viewerEndpoint?.close();
   viewerRecord?.stop();
+  scheduleReopenAtQuitTerminal();
   if (backendService.isOwnedCleanupComplete()) return;
   event.preventDefault();
   if (backendQuitPending) return;
@@ -42395,11 +43289,13 @@ electron.app.on("will-quit", (event) => {
       `Owned backend cleanup did not finish within ${QUIT_CLEANUP_FAILSAFE_MS} ms; exiting with failure`,
       LogFileType.BACKEND
     );
+    scheduleReopenAtQuitTerminal();
     electron.app.exit(1);
   }, QUIT_CLEANUP_FAILSAFE_MS);
   failsafe.unref();
   void backendService.stop(false).then(() => {
     clearTimeout(failsafe);
+    scheduleReopenAtQuitTerminal();
     electron.app.exit(0);
   }).catch((error) => {
     clearTimeout(failsafe);
@@ -42408,6 +43304,7 @@ electron.app.on("will-quit", (event) => {
       LogFileType.BACKEND,
       error
     );
+    scheduleReopenAtQuitTerminal();
     electron.app.exit(1);
   });
 });
@@ -42469,5 +43366,8 @@ process.on("uncaughtException", (error) => {
       LogFileType.BACKEND,
       stopError
     );
-  }).finally(() => process.exit(1));
+  }).finally(() => {
+    scheduleReopenAtQuitTerminal();
+    process.exit(1);
+  });
 });