mcp-pacemaker 2.0.2 → 2.1.0

package/CHANGELOG.md

@@ -7,7 +7,77 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-Target release: **2.0.2**. This candidate has not yet been published.
+## [2.1.0] - 2026-10-12
+
+Target release: 2.1.0. This candidate has not yet been published.
+
+### Added
+
+- Explicit managed `upgrade --to`, read-only plans, isolated `--sxs` instances with
+  retained OS-assigned listeners, stable launchers, admission control and a durable
+  activation/recovery journal. Bare `upgrade` and `--self` remain compatible.
+- Preserve ports and host wiring during managed replacement; retain the previous
+  package and restrict rollback to verified, unchanged pre-admission state.
+- Add one-time restart-only migration for the exact Windows 1.3.0 registration,
+  with interactive uncertainty acknowledgement, held process identities, partial
+  observed-descendant receipts and scoped task/CLI rollback. No machine reboot.
+- Refuse unsupported or unknown supervisor/autostart identities before interruption.
+- Add explicit Windows original-account upgrades with a task-only administrator
+  controller and authenticated original-user worker. Keep current-user scope as
+  the default, preserve task security/account settings, and refuse unavailable or
+  changed logged-on session identity. Real elevated two-account qualification
+  remains required; `--all-users` is unsupported.
+
+### Fixed
+
+- Contain Windows bridge descendants in a kill-on-close Job Object before any
+  workload starts, preventing nested cmd/Node trees from surviving abrupt bridge
+  loss. Fail startup if containment cannot be established.
+- Preserve existing task security during legacy migration instead of resubmitting
+  its owner, allowing an ordinary user to update an eligible Administrators-owned
+  task without changing its permissions.
+- Handle Task Scheduler's equivalent XML serialization during post-write checks
+  and restoration, including rediscovery after rollback. Keep raw revision
+  preconditions, original backups and complete resource-security checks intact.
+- Avoid Windows upgrade-authorization failures caused by slow thread enumeration
+  and already-terminated thread records while retaining complete identity and
+  authority checks.
+- Capture larger legacy process trees with bounded discovery and distinguish
+  reused parent PIDs from proven descendant relationships.
+- Recheck shared-session test cooldown deadlines after early timer delivery before
+  acquiring a replacement generation.
+- Wait for the metrics test process and its stdio to close before removing fixture files.
+- Pin the Windows process-lifetime and task-channel helpers to their own packaged directory
+  instead of inheriting the caller's working directory. A process's working directory cannot
+  be removed on Windows, so a detached helper previously blocked removal of the instance,
+  configuration and staging directories with `EPERM`.
+- Report the native refusal reason when the task channel declines a request, instead of a
+  bare refusal with no cause.
+
+### Security
+
+- Refuse elevated or unverified default Windows upgrade and recovery before
+  staging, task writes or runtime launch, preserving the original runtime authority.
+- Raise the CLI's `smol-toml` floor to `1.9.0`.
+- Move the dashboard build to Tailwind CSS `4.3.3`, removing the vulnerable
+  `braces` and `postcss-selector-parser` dependency paths, and pin `source-map-js`
+  to `1.2.2`.
+- Retire the 2.0.2 producer exception from fresh native and OSV scans. New releases
+  require complete clean producer evidence; historical receipts retain their
+  original source bindings and expiry.
+
+### Changed
+
+- **Breaking for privileged callers.** The bridge, supervisor and default upgrades now verify
+  the caller before any runtime work and refuse an elevated or root caller at startup with
+  `User-runtime execution refused: …`. This is not Windows-only and not upgrade-only: on Linux
+  and macOS a `root` process is refused, which includes the default user in most container
+  images. There is no override; run as an ordinary account. Shipping this in a minor release is
+  deliberate — the previous behaviour let a bridge run with authority it could not verify.
+- Update the Tailwind PostCSS adapter, class-merging dependency, generated dashboard
+  assets and license attribution while retaining the existing theme configuration.
+
+## [2.0.2] - 2026-10-06
 
 ### Fixed
 
@@ -475,6 +545,10 @@ one is a trap for anyone building something similar.
 - Do not report a teardown the bridge initiated as a crash. `taskkill /F` exits non-zero, so
   every recycle, idle reap and session close was recorded as a failure, burying real ones.
 
+[Unreleased]: https://github.com/girishkvs/mcp-pacemaker/compare/v2.1.0...HEAD
+[2.1.0]: https://github.com/girishkvs/mcp-pacemaker/releases/tag/v2.1.0
+[2.0.2]: https://github.com/girishkvs/mcp-pacemaker/releases/tag/v2.0.2
+[2.0.1]: https://github.com/girishkvs/mcp-pacemaker/releases/tag/v2.0.1
 [2.0.0]: https://github.com/girishkvs/mcp-pacemaker/releases/tag/v2.0.0
 [1.3.0]: https://github.com/girishkvs/mcp-pacemaker/releases/tag/v1.3.0
 [1.2.0]: https://github.com/girishkvs/mcp-pacemaker/releases/tag/v1.2.0

package/CONTRIBUTING.md

@@ -18,12 +18,16 @@ part of its security posture. The setup CLI and the dashboard may use dependenci
 
 ## Lockfiles must resolve to the public registry
 
-CI fails any lockfile containing a `resolved` URL outside `registry.npmjs.org`. If you work
-behind a private mirror, re-resolve before committing:
+CI fails any lockfile containing a `resolved` URL outside `registry.npmjs.org`.
+Do not bypass a required registry policy to produce those URLs. Restore through the
+approved registry and preserve exact package names, versions and verified archive
+integrities when canonicalizing mirror-specific URLs for the public lockfile.
+Hosted CI must still restore the resulting lock from its configured registry.
 
-```bash
-npm install --registry https://registry.npmjs.org
-```
+For npm 12 mirrors whose metadata and tarball URLs have different prefixes,
+`replace-registry-host` supports command-local URL-prefix mapping back through the
+approved registry. This does not require relaxing `allow-remote`, disabling TLS,
+changing global settings or committing a private registry configuration.
 
 ## Tests
 
@@ -35,8 +39,13 @@ Tests are `node:test` only, no framework. Each test file that starts a bridge ow
 ports, because files run in parallel; the current allocation is listed at the top of
 `test/auth-token.test.mjs`. Pick unused ones for a new file.
 
-Before submitting, run the complete `npm test` command with its normal file concurrency.
-Focused or serialized runs help diagnose failures but do not replace that run. Record the
+Before submitting, run the complete `npm test` command with its normal file concurrency
+(`--test-concurrency=4`, matching the four vCPUs on hosted runners). CI and the local
+publication gate go through `npm run test:contract -- <name>` instead, which adds the
+execution-context preflight and, on Windows, splits the suite into the ordinary-account lane
+and the session lane; `npm run test:contract -- source --check` reports what a lane would run
+without running it. Focused or serialized runs help diagnose failures but do not replace that
+run. Record the
 exact Node and npm versions, OS, architecture, and command; matching only the Node major is
 not enough to reproduce a CI failure.
 
@@ -63,6 +72,14 @@ platform; Windows also exercises the real executable. Those checks do not replac
 byte-for-byte rebuild, and a rolling CI image may not contain the recorded compiler.
 No compiler or PowerShell host runs in the production config-write path.
 
+Windows bridge lifetime containment uses a **separate** packaged helper. Build
+and byte-for-byte verify it with `tools/windows-process-lifetime/build.ps1` and
+`-Verify`; see its README for the ownership and failure contract. Do not change
+the immutable config-security helper to update the lifetime helper. Run both
+`test/windows-process-lifetime.test.mjs` and `test/windows-lifetime-startup.test.mjs`
+on supported Windows/Node versions. They retain owned PID/creation-time cleanup
+receipts and TCP heartbeat observations outside Git.
+
 Batch tests must cover the full five-second trailing debounce, merging complete snapshots,
 Reload now, requests during a flip, stale active revisions, whole-batch Cancel/Undo and late
 commit outcomes. Use controlled clocks for scheduling boundaries and real file/HTTP cases for
@@ -77,9 +94,17 @@ sleeping a fixed interval.
 
 ## Real-version compatibility gates
 
+The dashboard uses the Tailwind 4 PostCSS adapter. Its optimizer stays disabled
+until generated selectors and license attribution have been checked; Vite still
+minifies the final CSS. Keep the inline Vite and standalone PostCSS settings
+consistent, and run the UI tests before regenerating the dashboard and notices.
+
 These are separate, mandatory CI gates, not substitutes for `npm test`. The root CI job runs
-CLI/API pairs on Windows, Linux and macOS with Node 20, 22 and 24. The Linux/Node 22 UI
-job runs one Chromium browser matrix after building the dashboard.
+CLI/API pairs on Linux and macOS with Node 20, 22 and 24. The Windows pair runs in the
+`windows-ordinary` job through `tools/windows-ci/ci-ordinary-user.ps1 -Contract compatibility`,
+which prepares, exercises and removes its fixtures inside a disposable standard account: the
+fixtures record the temp root that owns them, so an administrator-prepared pair is refused. The
+Linux/Node 22 UI job runs one Chromium browser matrix after building the dashboard.
 
 ```bash
 npm ci
@@ -111,13 +136,14 @@ The same harness runs in both maintained branches:
 
 | Preparation | Selected legacy / current pair |
 |---|---|
-| Default in the selected 2.0.2 checkout | Immutable 1.3.0 / packed 2.0.2 |
+| Default in the selected 2.1.0 checkout | Immutable 1.3.0 / packed 2.1.0 |
 | Default in the 1.3.1 checkout | Packed 1.3.1 / immutable 2.0.0 |
 | `npm run compat:prepare:baseline` | Immutable 1.3.0 / immutable 2.0.0 |
-| `npm run compat:prepare -- --peer-root <opposite-patch-checkout>` | Packed 1.3.1 / packed 2.0.2 |
+| `npm run compat:prepare -- --peer-root <opposite-patch-checkout>` | Packed explicit 1.x peer / packed 2.1.0 |
 
-These selections are not qualification evidence. The selected 1.3.1/2.0.2 pair
-requires fresh exact-byte gates; earlier 1.3.1/2.0.1 results remain historical.
+These selections are not qualification evidence. The 2.1.0 candidate requires fresh
+exact-byte gates; selecting it does not select an opposite-major patch pair.
+Earlier 1.3.1/2.0.2 and 1.3.1/2.0.1 results remain historical.
 
 Run both API and browser gates for the explicit patch pair before publishing either complete
 dual-major release set. The two default CI pairs alone do not establish that combined result.

package/README.md

@@ -9,6 +9,10 @@ have their own dependencies.
 [Report a problem](https://github.com/girishkvs/mcp-pacemaker/issues) ·
 [Release notes](https://github.com/girishkvs/mcp-pacemaker/releases)
 
+> This README describes **2.1.0**. Verify its npm availability before installing;
+> a source branch or GitHub tag is not proof of publication.
+> See the [release changes](CHANGELOG.md).
+
 MCP hosts — editors (VS Code, Cursor, Claude Desktop) **and** CLIs (Claude Code, Copilot CLI,
 Codex, Gemini) — run stdio MCP servers as child processes. When the host restarts, crashes, or
 exits (every one-shot CLI run), **those servers die**. `mcp-pacemaker` runs your servers as
@@ -26,16 +30,24 @@ is separate planned work.
 
 ## Quick start
 
-Install **mcp-pacemaker 2.0.2** from npm. Use a maintained **Node.js 22 or 24**
+Install **mcp-pacemaker 2.1.0** from npm. Use a maintained **Node.js 22 or 24**
 release; Windows also needs PowerShell 7 and Windows Script Host.
 See [installation requirements](#install) before setup.
 
 ```bash
-npm install -g mcp-pacemaker@2.0.2
+npm view mcp-pacemaker@2.1.0 version
+npm install -g mcp-pacemaker@2.1.0
 mcp-pacemaker --version
 ```
 
-The version check prints `2.0.2` without running setup.
+The version check prints `2.1.0` without running setup.
+
+> **Run it as an ordinary user.** From 2.1.0 the bridge, supervisor and default upgrades
+> refuse a privileged caller *at startup* — a non-administrator terminal on Windows and a
+> **non-root** session on Linux/macOS, including the default `root` user in most containers.
+> A refused start prints `User-runtime execution refused: …`. There is no override; run as a
+> normal user instead. See the [user-runtime contract](docs/execution-context.md).
+
 Before setup, have a readable JSON host configuration containing server definitions, or
 prepare [`~/.mcp-pacemaker/servers.json`](#serversjson). Supported import sources are
 `vscode`, `cursor`, `claude` (Claude Desktop), `copilot-cli` and `gemini`.
@@ -150,13 +162,22 @@ Use a maintained **Node.js 22 or 24** release. Node 20 remains a compatibility t
 end-of-life, not a recommended secure runtime. The bridge has no npm runtime dependencies;
 the setup CLI and dashboard have their own dependencies.
 
+**Run as an ordinary user.** From 2.1.0 the bridge, supervisor and default upgrades verify the
+caller before any runtime work and refuse elevated or root callers at startup with
+`User-runtime execution refused: …`. On Linux and macOS that includes `root`, which is the
+default user in most container images, so run the bridge as a normal account there. The
+[user-runtime contract](docs/execution-context.md) describes what is checked and why; explicit
+Windows account administration has a separate
+[controller/worker path](docs/account-upgrades.md).
+
 Install the released package from [npm](https://www.npmjs.com/package/mcp-pacemaker).
 Its repository link should point to
 [`girishkvs/mcp-pacemaker`](https://github.com/girishkvs/mcp-pacemaker).
 Use an exact version for a repeatable installation:
 
 ```bash
-npm install -g mcp-pacemaker@2.0.2
+npm view mcp-pacemaker@2.1.0 version
+npm install -g mcp-pacemaker@2.1.0
 mcp-pacemaker --version
 ```
 
@@ -214,12 +235,16 @@ for exact pairs; only the exact executed pairs are covered.
 | `install --client <host> [--port N]` | Wire one host (its own `--port` gives it its own bridge) |
 | `emit --client <host>` | Print the config entries without writing anything |
 | `start` / `stop` | Start or stop bridges (`--port` for one, else all) |
-| `upgrade [--self]` | Re-wire hosts; `--self` only prints same-major, exact-version installation guidance |
+| `upgrade --to <version> [--plan] [--yes]` | Stage and replace one managed installation, including its CLI, preserving port/config/host wiring |
+| `upgrade --to <version> --sxs [--port N]` | Keep the old instance and start an isolated new one; omitted port is OS-assigned |
+| `upgrade --recover` | Resume or roll back an interrupted managed replacement from its durable journal |
+| `[--instance <directory>]` | Select one installation when discovery finds several; valid before or after the command |
+| `upgrade [--self]` | Legacy host repair; `--self` still prints same-major installation guidance only |
 | `update-check [--json]` | Compare the installed version with its maintained npm channel |
 | `uninstall` | Stop managed bridges, remove auto-start, restore available host-file `.bak` copies; native entries are not restored |
 
-> Package installation does not upgrade a running backend. `upgrade` rewires host configuration;
-> it does not replace package files, restart an adopted backend, or update its autostart path.
+> Package installation alone does not upgrade a running backend. Use explicit `upgrade --to`
+> for managed replacement. Bare `upgrade` retains the older host-repair behavior.
 
 > On start, pacemaker **probes the port**: it *adopts* an existing pacemaker bridge and *refuses to collide* with a foreign service (the wizard offers another port).
 
@@ -244,6 +269,227 @@ restored; record their original definitions separately and restore them through
 
 ### Replacing or rolling back a running installation
 
+These managed-upgrade commands require **2.1.0 or newer**.
+Version 2.0.2 does not include them.
+
+Run the bridge, supervisor, default upgrades and recovery as an **ordinary user**:
+a normal, non-administrator terminal on Windows and a non-root session on Linux/macOS.
+The [user-runtime contract](docs/execution-context.md) rejects privileged or
+unverified callers before runtime work, so a replacement does not inherit different
+authority. Read-only plans remain available. Explicit Windows account administration has a separate
+[controller/worker path and qualification requirements](docs/account-upgrades.md).
+
+For a **stable managed instance created by this implementation**:
+
+```bash
+mcp-pacemaker upgrade --to <exact-version> --plan
+mcp-pacemaker upgrade --to <exact-version>
+# Noninteractive confirmation of the displayed local plan:
+mcp-pacemaker upgrade --to <exact-version> --yes
+
+# Keep the existing service and host wiring:
+mcp-pacemaker upgrade --to <exact-version> --sxs
+mcp-pacemaker upgrade --to <exact-version> --sxs --port 9001
+```
+
+`--to` requires canonical stable SemVer, not `latest`, a range, or a Git/file spec.
+Selecting another major is explicit and printed in the plan; it is not a compatibility
+claim. The target must ship the managed admission/readiness protocol. Older targets
+without that protocol are rejected before interruption, including for automatic SxS ports.
+
+Normal upgrades preserve the selected port: `--port` is valid **only with `--sxs`**.
+Without an SxS port, the actual new loopback listener binds port 0 and stays open;
+the OS-selected port is displayed and saved for later starts. The read-only plan says
+“OS-assigned,” not a guessed port. An explicitly requested busy port fails without adoption.
+SxS gets separate config, nonce, logs and session files. It preserves the source working
+directory for relative server commands and does not rewire any host or enable pooling.
+
+When discovery finds multiple instances, use the exact directory printed by setup/upgrade:
+
+```bash
+mcp-pacemaker upgrade --instance <directory> --to <exact-version> --plan
+mcp-pacemaker start --instance <directory>
+mcp-pacemaker stop --instance <directory>
+```
+
+`--instance <directory>` and `--instance=<directory>` work before or after the
+command. Selection is normalized once, including paths with spaces; conflicting
+selectors or port/config overrides are rejected before an action. Text after `--`
+is not interpreted as a selector. An invalid explicit selection never falls back
+to the default instance.
+CLI port options use canonical decimal integers from 1 to 65535; scientific notation, hex,
+signs, surrounding whitespace and zero-padded spellings are rejected before requests.
+
+Selected `start`, `stop`, `reload`, `prewarm`, `status`, `doctor`, `top`, `logs`,
+`dashboard`, version/help, and upgrade commands use the same instance context.
+The TUI's recycle key uses that instance's port **and nonce directory**; logs use
+its config directory. Bare `mcp-pacemaker --instance <directory>` shows status
+even when SxS has no host-wiring state. Host setup/removal commands (`init`,
+`import`, `install`, `uninstall`) are refused with `--instance`; selection alone
+does not authorize rewriting host configuration or changing autostart.
+Generated prewarm Cancel/Undo commands retain the selected instance and config,
+so they resolve the same CLI version and nonce directory. Windows commands use
+an encoded PowerShell launcher with an explicit native argument list to preserve
+spaces, quotes and shell characters; unmanaged `--config` commands remain supported.
+
+The stable per-instance launcher selects checked version directories. Upgrades never
+overwrite a running package or rewrite per-version autostart tasks. The previous selection
+and package are retained. The existing command entry point dispatches to the committed
+version's CLI and its own dependencies: ordinary `--version`, `status`, `update-check`
+and the next `upgrade` use that version. An unfinished activation keeps the previous
+CLI available for recovery; rollback restores that CLI selection. SxS does not change
+the default CLI. Use `--instance <directory>` to select its CLI explicitly.
+
+Target dependencies are resolved into a private lock and restored with npm's archive
+integrity checks before interruption. Both the lock and installed dependency files enter
+the checked version inventory. Target CLI startup and version are checked before quiescing.
+The target archive and resolved CLI dependencies require SHA-512 integrity metadata.
+SHA-1-only or missing integrity information is rejected before interruption; the
+upgrader does not downgrade its checks to accommodate a registry.
+Acquisition uses the configured npm registry, or explicit
+`--registry`, with no registry fallback or global npm changes. Existing npm permissions,
+TLS, release-age policy and URL-prefix mapping remain in effect; lifecycle scripts are
+disabled for acquisition. For npm 12 mirrors, use your approved command-local
+`replace-registry-host` full-URL-prefix mapping back through that registry—not a
+hard-coded mirror URL or public-registry bypass.
+
+Download, archive integrity, package/engine/native-binary checks and an owned packaged
+startup check finish before interruption. Admission then closes and waits up to eight
+seconds for safe work to drain. Open MCP sessions and unresolved config transactions
+currently cause a refusal; close/settle them and retry. No uncertain tool call or failed
+configuration commit is replayed. This is a **short restart**, not socket handoff or
+zero downtime. Clients and dashboard tabs may need a reload.
+
+The supervisor persists admission hold **before** forwarding quiesce. A lost reply,
+failed drain, bridge crash or replacement child does not release it. Only explicit
+resume/recovery or a verified activation opens admission again. Upgrade stop is tied to
+the drained generation; any replacement generation must remain held.
+
+The activation journal blocks unattended starts after an interrupted transition.
+Selection and launch intent are separate durable transitions. A selected target that
+was provably never launched can recover using the exact previous stopped-generation
+receipt. After launch intent, an empty port alone is not shutdown proof.
+Recovery parses bounded instance/journal identities before checking executable
+bytes. It fully verifies and runs the retained recovery CLI, so a damaged or
+missing target file cannot prevent a safe pre-launch rollback. A damaged previous
+package, stale identity or unknown journal still causes a refusal.
+
+| Journal state | Recovery boundary |
+|---|---|
+| Prepared / quiescing | Explicitly resume the matching previous service |
+| Stopping | Reconcile the exact drained generation |
+| Stopped / selecting / selected | Require the previous completed-stop receipt; the target has no launch intent |
+| Launching | Require a new held generation and verified shutdown; no empty-port inference |
+| Rollback-selecting / rollback-selected | Require the durable rollback stop proof before selecting/restarting previous code |
+| Rollback-launching | Require proof for the newly launched previous generation; otherwise refuse |
+| Admitting / admitting-rollback | Admission may have occurred; no automatic rollback |
+| Committed / rolled-back / aborted | No interrupted activation remains |
+
+Automatic rollback is restricted to startup failure before target admission, with
+unchanged configuration bytes, identity and security and verified shutdown. If admission
+may have occurred, recovery refuses rather than overwriting user state.
+
+```bash
+mcp-pacemaker upgrade --recover --instance <directory> --yes
+```
+
+A crash can leave `upgrade.lock`. Recovery does not steal it based on a reusable PID.
+Verify the original upgrader has exited, preserve the journal, and remove only that
+instance's lock before recovery. Keep packages, configuration and transaction files.
+Journal writes are file-flushed and atomically renamed; Windows directory-entry
+durability across power loss is not claimed.
+
+### One-time Windows 1.3 restart migration
+
+The normal `upgrade --to <exact-version>` confirmation also supports the exact known
+**1.3.0 Windows supervisor/launcher and per-user task shape**, with one port in the
+existing install state. Invoke an upgrade-capable CLI from a separate durable package;
+do not overwrite the running 1.3 package first. `--plan` remains read-only.
+
+This transition restarts **Pacemaker, not Windows**. Pause callers before confirming.
+The interactive confirmation states that clients will disconnect and 1.3 cannot drain
+or certify every in-flight HTTP outcome. Zero reported sessions or child PIDs does not
+prove that HTTP calls finished. Ordinary `--yes` and unattended invocation refuse this
+transition; there is no separate maintenance flag and no automatic call replay.
+
+Target package, CLI dependencies, native identities and packaged startup are verified
+before downtime. A separate broker retains handles for the selected supervisor, bridge
+and a bounded set of provably owned descendants. Only the verified selected task is
+held. Stop uses those handles and verifies their exit before starting the held target
+on the same port. It does not use a name/PID kill or assume task disable stopped the
+running supervisor. Configuration, host wiring and port remain unchanged; the existing
+CLI entry dispatches the newly selected managed CLI.
+
+Preparation stays outside managed discovery until the instance identity and recovery
+journal are durable; the prepared directory is then published together. A pre-journal
+I/O failure leaves the old installation discoverable. Failed preparation is retained,
+not guessed safe to delete. A terminal rolled-back/aborted candidate is excluded only
+after its bounded journal and legacy-source binding validate, so damaged target files
+do not prevent retrying the still-running legacy installation.
+
+The task's **resource owner and full security descriptor** are separate from its run-as
+account. Planning and every task operation require owner/group/DACL/SACL/integrity
+inspection through Task Scheduler. If the required security read is denied or unsupported,
+migration refuses before touching the task; it does not enable privileges or elevate.
+Existing-task updates preserve security rather than reassigning its owner: they clear
+only the temporary definition's embedded descriptor, pass no replacement security
+descriptor, disable automatic principal-ACE edits, and verify the complete raw resource
+descriptor again afterward. Protected backups retain the original raw descriptor and XML.
+Restoration requires exact equality of all non-XML registration/security fields and
+Task Scheduler-normalized XML, ignoring only the exact embedded
+`Task/RegistrationInfo/SecurityDescriptor` representation. Raw revision preconditions,
+backups and the actual returned XML/hash are not rewritten; other metadata or XML drift refuses.
+Concurrent or uncertain security changes require inspection, not permission repair.
+The resource owner may be the runtime user or canonical builtin Administrators;
+that does not change the run-as account. Default scope remains **current user**,
+but Windows execution and recovery require a freshly verified ordinary caller
+before staging or mutation; an elevated or unverified caller refuses rather than
+launching a runtime with different authority. Read-only planning is unchanged.
+Explicit original-account administration uses a task-only
+trusted controller and an original-user worker; see
+[account upgrade scope and qualification](docs/account-upgrades.md).
+`--all-users` is explicitly unsupported.
+
+The legacy receipt reports `legacyRootStopVerified`, `observedDescendantsStopped` and
+`treeCompleteness: "unproven"` separately. This is **not** the modern Job Object
+complete-descendant proof. Historical or uncaptured orphan processes cannot be fully
+attributed; they are left untouched and the limitation is reported without claiming an
+orphan count. The new managed runtime contains future children from birth.
+
+Unknown package/task shapes, changed owner/generation/configuration, a failed captured
+process stop, or a foreign listener prevent activation. A foreign listener is never
+stopped. Original code and protected configuration/task backups are retained. A verified
+pre-admission target failure can restore the original CLI and scoped task and verify a
+fresh legacy backend; uncertain launch, registration or admission outcomes require
+explicit recovery. No configuration is deleted or replayed.
+
+| Legacy journal phase | Recovery boundary |
+|---|---|
+| `legacy-prepared` / `legacy-held` | Verify the original generations and unchanged state; restore only the recorded task hold |
+| `legacy-holding` | Task write outcome may be unknown; inspect before recovery |
+| `legacy-stopping` | Read-only captured-generation absence check; an incomplete observed set refuses recovery |
+| `legacy-stopped` | Revalidate partial stop and free port before safe old-version rollback |
+| `legacy-launching` / `legacy-wiring` | Require modern held-target shutdown proof; a closed port alone is insufficient |
+| `legacy-admitting` | Traffic may have entered; no automatic rollback |
+| Legacy rollback intent phases | An interrupted task/CLI/launch outcome is reported as uncertain, not retried blindly |
+| `legacy-rolled-back` / `legacy-aborted` | Original installation remains selected; the staged managed candidate stays dormant |
+
+A killed migration can also leave the profile's `legacy-upgrade/upgrade.lock`.
+Verify that exact upgrader has exited before removing its lock; never steal it by PID
+guessing. Preserve the journal and backup files.
+
+This adapter does not support direct unregistered bridges, other legacy versions,
+multiple legacy ports, Linux/macOS registrations, or legacy-source SxS. Targets must
+declare `legacyRestartProtocol: 1`; older published targets without it refuse before
+legacy downtime.
+
+Managed SxS keeps its own verified package copy as well as separate runtime state.
+If a crash happens during port-0 startup before the port is durably recorded, recovery
+reports an unknown launch outcome rather than marking it safely aborted. Preserve
+that instance and its journal until readiness or shutdown can be verified.
+
+For an older installation requiring a separately verified manual migration:
+
 Do not overwrite a package directory while its supervisor or bridge is running. Workers and
 native helpers can load later, and dashboard assets are read from disk: replacement can mix
 old and new code even when the original process still reports its old version.
@@ -260,7 +506,8 @@ other major there replaces it. Separate ports do not isolate credentials, nonces
 session files: manual side-by-side operation needs separate durable code roots and separate
 configuration directories, plus separate host/HOME state for CLI-managed setup.
 `init/import --config` selects a source host configuration, not an isolated runtime profile.
-There is no package `--profile` or `MCP_HOME` switch. Do not use an unscoped stop/uninstall
+There is no package `--profile` or `MCP_HOME` switch; managed SxS uses explicit instance
+directories instead. Do not use an unscoped stop/uninstall
 operation when another instance must remain running.
 
 ## Dashboards

package/THIRD_PARTY_NOTICES.txt

@@ -192,7 +192,7 @@ SOFTWARE.
  */
 
 ==============================================================================
-tailwindcss@3.4.19
+tailwindcss@4.3.3
 Declared license: MIT
 
 --- LICENSE ---
@@ -218,33 +218,6 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
---- lib/css/LICENSE ---
-MIT License
-
-Copyright (c) Nicolas Gallagher
-Copyright (c) Jonathan Neal
-Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)
-Copyright (c) Adam Wathan
-Copyright (c) Jonathan Reinink
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
 ==============================================================================
 vite@7.3.6
 Declared license: MIT