openmeld 0.3.221 → 0.3.223

package/dist/{daemon-service-runtime-Kr6Bs2J2.js → daemon-service-runtime-BEfMD5jb.js}

@@ -1,30 +1,50 @@
 #!/usr/bin/env node
 
-import { $ as openMeldManagedVersionDir, A as OPENMELD_HOME_ENV_KEY, Q as openMeldManagedVersionBinaryPath, X as openMeldBinDir, Z as openMeldManagedBinaryPath, a as isOpenMeldOrphanedLockError, ct as resolveOpenMeldEnvPreset, d as runWithHeldLock, dt as resolveOpenMeldServiceScope, i as isOpenMeldLockError, lt as resolveOpenMeldRootDir, t as acquireLock, tt as openMeldVersionsDir } from "./lock-Bsl_ElWy.js";
-import { r as cliBinaryServiceReleaseSchema, t as cliBinaryDeltaPatchSchema } from "./cli-binary-manifest-DiUulkp0.js";
-import { b as openMeldToolsUpdateOperationPhaseSchema, w as openMeldToolsUpdateRequestSourceSchema } from "./local-components-B6SCXZf9.js";
-import { r as readDaemonRuntimeLease } from "./daemon-runtime-lease-BUr4qsLo.js";
-import { a as powerShellEncodedArguments, s as resolveWindowsPowerShellPath } from "./process-identity-CNus0e6E.js";
+import { $ as openMeldManagedVersionBinaryPath, A as OPENMELD_HOME_ENV_KEY, Q as openMeldManagedBinaryPath, X as openMeldBinDir, Z as openMeldManagedBinaryName, a as isOpenMeldOrphanedLockError, d as runWithHeldLock, et as openMeldManagedVersionDir, ft as resolveOpenMeldServiceScope, i as isOpenMeldLockError, lt as resolveOpenMeldEnvPreset, nt as openMeldVersionsDir, t as acquireLock, ut as resolveOpenMeldRootDir } from "./lock-iue1J2xy.js";
+import { i as windowsPublisherNameSchema, n as WINDOWS_PROCESS_HELPER_FILENAME, r as windowsManagedCliInstallationSchema } from "./windows-artifact-DJ9DKjfc.js";
+import { a as cliBinaryServiceReleaseSchema, n as OPENMELD_MACOS_CLI_SIGNING_REQUIREMENT, o as resolveCliBinaryPlatform, r as cliBinaryDeltaPatchSchema, t as OPENMELD_MACOS_CLI_SIGNING_IDENTITY } from "./cli-binary-manifest-CT5X05lk.js";
+import { b as openMeldToolsUpdateOperationPhaseSchema, w as openMeldToolsUpdateRequestSourceSchema } from "./local-components-DleLEzSU.js";
+import { r as readDaemonRuntimeLease } from "./daemon-runtime-lease-1LMeZ6IS.js";
+import { l as resolveWindowsPowerShellPath, o as powerShellEncodedArguments, s as pruneWindowsBinaryBundle } from "./process-identity-BQLdaZdB.js";
+import { n as normalizeCommandEnvironment } from "./process-environment-BWSFeUu6.js";
 import { n as resolveOpenMeldDistribution, t as isBinaryDistribution } from "./distribution-BDQT2ilb.js";
-import { A as getDaemonStatus, C as daemonServiceStableBinaryExecutablePath, D as daemonStatePath, E as daemonServiceUpdateWorkerBinaryExecutablePath, T as daemonServiceStableLauncherPath, U as uninstallDaemon, _ as daemonRuntimeStateRootPath, a as DAEMON_SERVICE_RUNTIME_MODE_ENV, b as daemonServiceLegacyExecutableWrapperPath, g as daemonRuntimeServiceManagerPath, h as daemonRuntimeRootPath, i as DAEMON_SERVICE_RUNTIME_DETACHED_ENV, k as getDaemonRuntimeStatus, l as clearDaemonServiceRuntimeState, n as DAEMON_SERVICE_RUNTIME_AUTO_START_ENV, p as daemonRuntimeBundlesPath, r as DAEMON_SERVICE_RUNTIME_CONTROLLER_ENV, s as DAEMON_SERVICE_RUNTIME_SYSTEM_SERVICE_ENV, t as DAEMON_HEARTBEAT_STALE_MS, v as daemonServiceActiveBundleStatePath, w as daemonServiceStableExecutableWrapperPath, x as daemonServiceRecognizedExecutablePaths$1, y as daemonServiceExecutableWrapperPaths$1 } from "./daemon-state-B44aq2nm.js";
-import { t as assertNoPublishedProductionMutationDuringTests } from "./published-production-safety-dp-fOmmB.js";
-import { i as readDaemonServiceContract } from "./daemon-service-contract-BpOBMGX0.js";
-import { d as compareSemver, l as OPENMELD_VERSION, t as emitDaemonLifecycleEvent, v as package_default } from "./daemon-lifecycle-journal-DcrVY0xb.js";
+import { A as getDaemonStatus, C as daemonServiceStableBinaryExecutablePath, D as daemonStatePath, E as daemonServiceUpdateWorkerBinaryExecutablePath, T as daemonServiceStableLauncherPath, U as uninstallDaemon, _ as daemonRuntimeStateRootPath, a as DAEMON_SERVICE_RUNTIME_MODE_ENV, b as daemonServiceLegacyExecutableWrapperPath, g as daemonRuntimeServiceManagerPath, h as daemonRuntimeRootPath, i as DAEMON_SERVICE_RUNTIME_DETACHED_ENV, k as getDaemonRuntimeStatus, l as clearDaemonServiceRuntimeState, n as DAEMON_SERVICE_RUNTIME_AUTO_START_ENV, p as daemonRuntimeBundlesPath, r as DAEMON_SERVICE_RUNTIME_CONTROLLER_ENV, s as DAEMON_SERVICE_RUNTIME_SYSTEM_SERVICE_ENV, t as DAEMON_HEARTBEAT_STALE_MS, v as daemonServiceActiveBundleStatePath, w as daemonServiceStableExecutableWrapperPath, x as daemonServiceRecognizedExecutablePaths$1, y as daemonServiceExecutableWrapperPaths$1 } from "./daemon-state-Ca0WK5x0.js";
+import { t as assertNoPublishedProductionMutationDuringTests } from "./published-production-safety-C40hKrBA.js";
+import { i as readDaemonServiceContract } from "./daemon-service-contract-GLmAxsq-.js";
+import { d as compareSemver, l as OPENMELD_VERSION, t as emitDaemonLifecycleEvent, v as package_default } from "./daemon-lifecycle-journal-D4uZ-Ykq.js";
+import { a as expectedBinaryServiceFingerprint, c as verifyWindowsServiceSubsystem, l as windowsMaintenanceBinaryPath, o as hashBinaryServiceBundle, s as prepareWindowsMaintenanceBinary } from "./windows-user-task-Io5QuEVR.js";
 import { t as sleep } from "./dist-BLuEEVHh.js";
-import { E as resolveDaemonServiceIdentity, S as resolveDaemonServiceManager } from "./daemon-service-manager-HL4VKbIU.js";
+import { E as resolveDaemonServiceIdentity, S as resolveDaemonServiceManager } from "./daemon-service-manager-C8RUCMDo.js";
 import { createRequire } from "node:module";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { homedir } from "node:os";
-import path, { basename, dirname, isAbsolute, join, relative, sep } from "node:path";
-import { access, chmod, copyFile, cp, lstat, mkdir, readFile, readdir, readlink, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
+import path, { basename, dirname, isAbsolute, join, relative, sep, win32 } from "node:path";
+import { access, chmod, copyFile, cp, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
 import * as z$1 from "zod/v4";
-import { constants } from "node:fs";
+import { constants, createReadStream } from "node:fs";
 import process$1 from "node:process";
 import { execFile, spawn } from "node:child_process";
-import { setTimeout as setTimeout$1 } from "node:timers/promises";
-import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
+import { fileURLToPath } from "node:url";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { gunzipSync } from "node:zlib";
+//#region ../../packages/schemas/dist/schemas/daemon/cli-install-self.js
+const cliInstallSelfResultSchema = z$1.strictObject({
+	schemaVersion: z$1.literal(1),
+	type: z$1.literal("cli.install_self"),
+	result: z$1.enum([
+		"installed",
+		"noop_same_version",
+		"noop_newer_present"
+	]),
+	version: z$1.string().min(1),
+	platform: z$1.string().min(1),
+	managedBinaryPath: z$1.string().min(1),
+	currentPointerPath: z$1.string().min(1),
+	previousVersion: z$1.string().nullable(),
+	forced: z$1.boolean()
+});
+//#endregion
 //#region ../../packages/schemas/dist/schemas/daemon/service-update-job.js
 const OPENMELD_DAEMON_SERVICE_UPDATE_JOB_SCHEMA = "openmeld-daemon-service-update-job-v2";
 const daemonServiceUpdatePreparedBundleSchema = z$1.strictObject({
@@ -163,6 +183,51 @@ function verifyBytes(input) {
 	if (actualSha256 !== input.expectedSha256.toLowerCase()) throw new Error(`${input.label} sha256 mismatch: expected ${input.expectedSha256.toLowerCase()}, received ${actualSha256}`);
 }
 //#endregion
+//#region ../../runtime/local-service/src/windows-artifact-script.ts
+const WINDOWS_ARTIFACT_SIGNATURE_FUNCTION = String.raw`
+function Assert-OpenMeldArtifactSignature([string]$Path, [string]$Publisher) {
+  Import-Module -Name (Join-Path $PSHOME 'Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1') -ErrorAction Stop
+  $path = [IO.Path]::GetFullPath($Path)
+  $signature = Microsoft.PowerShell.Security\Get-AuthenticodeSignature -LiteralPath $path -ErrorAction Stop
+  if ($signature.Status -ne [Management.Automation.SignatureStatus]::Valid -or !$signature.SignerCertificate -or $signature.Path -ine $path) { throw 'OpenMeld update signature is not valid for this file.' }
+  $certificate = $signature.SignerCertificate
+  $matches = if ($Publisher.Contains('=')) { $certificate.Subject -ceq $Publisher } else { $certificate.GetNameInfo([Security.Cryptography.X509Certificates.X509NameType]::SimpleName, $false) -ceq $Publisher }
+  if (!$matches) { throw 'OpenMeld update publisher does not match this installation.' }
+}
+`;
+//#endregion
+//#region ../../runtime/local-service/src/windows-artifact-signature.ts
+const SIGNATURE_VERIFIED = "OPENMELD_AUTHENTICODE_VERIFIED";
+const VERIFY_SCRIPT = `
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+[Console]::OutputEncoding = New-Object Text.UTF8Encoding($false)
+${WINDOWS_ARTIFACT_SIGNATURE_FUNCTION}
+$r = ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:OPENMELD_SIGNATURE_REQUEST)))
+Assert-OpenMeldArtifactSignature $r.path $r.publisherName
+[Console]::Out.Write('OPENMELD_AUTHENTICODE_VERIFIED')
+`;
+/** Shared artifact verifier: every missing/failed/ambiguous OS result rejects. */
+async function verifyWindowsArtifactSignature(path, publisherName, execute = promisify(execFile)) {
+	const publisher = windowsPublisherNameSchema.parse(publisherName);
+	if (!win32.isAbsolute(path) || path.includes("\0")) throw new Error("OpenMeld signature verification requires an absolute Windows file path.");
+	const env = normalizeCommandEnvironment(process.env, "win32");
+	for (const key of Object.keys(env)) if (key.toUpperCase() === "PSMODULEPATH") delete env[key];
+	const result = await execute(resolveWindowsPowerShellPath(env), powerShellEncodedArguments(VERIFY_SCRIPT), {
+		env: {
+			...env,
+			OPENMELD_SIGNATURE_REQUEST: Buffer.from(JSON.stringify({
+				path,
+				publisherName: publisher
+			})).toString("base64")
+		},
+		windowsHide: true,
+		timeout: 3e4,
+		maxBuffer: 16384
+	});
+	if (result.stderr.trim() || result.stdout.trim() !== SIGNATURE_VERIFIED) throw new Error("Windows could not verify the OpenMeld update signature.");
+}
+//#endregion
 //#region ../../runtime/local-service/src/cli-binary-update-artifact.ts
 const HARDENED_RUNTIME_FLAG_RE = /flags=.*runtime/iu;
 const RETRY_AFTER_SECONDS_RE = /^\d+$/u;
@@ -249,14 +314,59 @@ async function downloadCliBinaryUpdateArtifact(input) {
 		recovery
 	});
 }
+/** Prepare the Windows companion in the caller's disposable artifact directory. */
+function allowUnsignedWindowsInternalPreview(env = process.env) {
+	return env.OPENMELD_ENV_PRESET === "prod" && env.OPENMELD_WINDOWS_INTERNAL_PREVIEW === "1" && env.OPENMELD_CLI_BINARY_MANIFEST_URL === "https://openmeld.ai/cli/manifest.json?channel=windows-preview";
+}
+function assertWindowsPreviewPolicy(windows, allowed) {
+	if ("mode" in windows && !allowed) throw integrityError("Unsigned Windows artifacts require the explicit OpenMeld internal preview channel");
+}
+async function prepareCliBinaryProcessHelper(input) {
+	const windows = input.release.windows;
+	if (!windows) {
+		if (process.platform === "win32") throw integrityError("Windows CLI artifacts must declare their process helper");
+		return;
+	}
+	if (process.platform !== "win32") throw integrityError("Windows artifact preparation requires Windows");
+	assertWindowsPreviewPolicy(windows, input.allowUnsignedPreview === true);
+	if (new URL(windows.processHelper.url).origin !== new URL(input.release.url).origin) throw integrityError("Windows process helper returned an unexpected download location");
+	const bytes = await downloadCliBinaryUpdateArtifact({
+		downloadPolicy: input.downloadPolicy,
+		fetchImpl: input.fetchImpl,
+		release: windows.processHelper,
+		plan: resolveFullCliBinaryUpdatePlan(windows.processHelper),
+		onDeltaFallback: () => {}
+	});
+	const helperPath = join(dirname(input.artifactPath), WINDOWS_PROCESS_HELPER_FILENAME);
+	await writeFile(helperPath, bytes, {
+		mode: 448,
+		flag: "wx"
+	});
+	if (!("mode" in windows)) await verifyWindowsArtifactSignature(helperPath, windows.publisherName);
+}
 async function verifyCliBinaryCodeSignature(input) {
+	if (process.platform === "win32") {
+		if (!input.release.windows) throw integrityError("Windows CLI artifacts must declare their publisher and process helper");
+		await verifyWindowsCliBinaryCodeSignature({
+			allowUnsignedPreview: input.allowUnsignedPreview,
+			artifactPath: input.artifactPath,
+			windows: input.release.windows
+		});
+		return;
+	}
+	if (input.release.windows) throw integrityError("signed Windows artifact verification requires Windows");
 	const { codeIdentifier, teamIdentifier } = input.release;
-	if (!(codeIdentifier && teamIdentifier)) return;
+	if (!(codeIdentifier && teamIdentifier)) {
+		if (process.platform !== "darwin" || input.allowUnsignedForDevelopment) return;
+		throw integrityError("binary manifest is missing a verified signing identity");
+	}
+	if (codeIdentifier !== OPENMELD_MACOS_CLI_SIGNING_IDENTITY.codeIdentifier || teamIdentifier !== OPENMELD_MACOS_CLI_SIGNING_IDENTITY.teamIdentifier) throw integrityError("binary manifest has an unexpected signing identity");
 	if (process.platform !== "darwin") throw integrityError("signed OpenMeld CLI verification requires macOS");
 	const verification = await input.runCommand("/usr/bin/codesign", [
 		"--verify",
 		"--strict",
 		"--verbose=2",
+		`-R=${OPENMELD_MACOS_CLI_SIGNING_REQUIREMENT}`,
 		input.artifactPath
 	]);
 	if (verification.code !== 0) throw integrityError(`binary code signature verification failed: ${commandFailureDetails(verification)}`);
@@ -267,14 +377,20 @@ async function verifyCliBinaryCodeSignature(input) {
 	]);
 	if (inspection.code !== 0) throw integrityError(`binary code signature inspection failed: ${commandFailureDetails(inspection)}`);
 	const details = `${inspection.stdout}\n${inspection.stderr}`;
-	for (const expected of [
-		`Identifier=${codeIdentifier}`,
-		`TeamIdentifier=${teamIdentifier}`,
-		"Authority=Developer ID Application:"
-	]) if (!details.includes(expected)) throw integrityError(`binary code signature is missing expected identity: ${expected}`);
+	for (const expected of [`Identifier=${codeIdentifier}`, `TeamIdentifier=${teamIdentifier}`]) if (!details.split("\n").some((line) => line.trim() === expected)) throw integrityError(`binary code signature has the wrong identity: ${expected}`);
+	if (!details.includes("Authority=Developer ID Application:")) throw integrityError("binary code signature is missing a Developer ID authority");
 	if (!HARDENED_RUNTIME_FLAG_RE.test(details)) throw integrityError("binary code signature is missing the hardened runtime");
 	if (!SIGNING_TIMESTAMP_RE.test(details)) throw integrityError("binary code signature is missing a trusted timestamp");
 }
+async function verifyWindowsCliBinaryCodeSignature(input) {
+	assertWindowsPreviewPolicy(input.windows, input.allowUnsignedPreview === true);
+	if ("mode" in input.windows) return;
+	try {
+		await verifyWindowsArtifactSignature(input.artifactPath, input.windows.publisherName);
+	} catch (error) {
+		throw integrityError(`Windows artifact signature verification failed: ${toError(error).message}`);
+	}
+}
 async function downloadCliBinaryDelta(input) {
 	const patchBytes = await downloadBinaryBytesWithRecovery({
 		attemptCeiling: input.attemptCeiling,
@@ -601,7 +717,7 @@ function daemonServiceUpdateWorkerNpmEntryPath(pathInput = {}) {
 }
 async function hasIndependentMaintenanceRegistration(pathInput = {}, platform = process$1.platform, expectedDefinition) {
 	if (platform === "win32") {
-		const { runWindowsUserTask, readWindowsTaskAction } = await import("./windows-user-task-Bx2yYnOM.js");
+		const { runWindowsUserTask, readWindowsTaskAction } = await import("./windows-user-task-B8NcRg_u.js");
 		const task = await runWindowsUserTask({
 			name: resolveDaemonServiceUpdateWorkerIdentity(pathInput).windowsServiceName,
 			legacyScript: resolveDaemonServiceUpdateWorkerWindowsScriptPath(pathInput),
@@ -612,7 +728,7 @@ async function hasIndependentMaintenanceRegistration(pathInput = {}, platform =
 	const registration = await readDaemonServiceUpdateWorkerRegistration(pathInput, platform);
 	if (!registration?.includes("openmeld-independent-maintenance-v1")) return false;
 	if (expectedDefinition !== void 0 && registration !== expectedDefinition) return false;
-	const { parseDaemonServiceEnvironmentFromDefinition } = await import("./daemon-service-manager-B-QrDe5p.js");
+	const { parseDaemonServiceEnvironmentFromDefinition } = await import("./daemon-service-manager-CU-79a4z.js");
 	return resolveOpenMeldRootDir({ env: parseDaemonServiceEnvironmentFromDefinition({
 		controller: platform === "darwin" ? "launchd" : "systemd",
 		definition: registration
@@ -686,6 +802,19 @@ function resolveDaemonServiceUpdateWorkerRegistrationPath(pathInput, platform) {
 	return null;
 }
 async function readDaemonServiceUpdateWorkerRegistration(pathInput, platform) {
+	if (platform === "win32") {
+		const { runWindowsUserTask, readWindowsTaskAction } = await import("./windows-user-task-B8NcRg_u.js");
+		const task = await runWindowsUserTask({
+			name: resolveDaemonServiceUpdateWorkerIdentity(pathInput).windowsServiceName,
+			legacyScript: resolveDaemonServiceUpdateWorkerWindowsScriptPath(pathInput),
+			operation: "status"
+		});
+		if (task.actionArguments) {
+			const action = readWindowsTaskAction(task.actionArguments);
+			return [action.executable, ...action.args].join("\n");
+		}
+		if (!task.legacy) return null;
+	}
 	const registrationPath = resolveDaemonServiceUpdateWorkerRegistrationPath(pathInput, platform);
 	if (registrationPath === null) return null;
 	return await readFile(registrationPath, "utf8").catch((error) => {
@@ -705,7 +834,7 @@ function resolveBundledServiceRelease() {
 	if (selection === void 0) return;
 	const parsed = cliBinaryServiceReleaseSchema.safeParse(selection);
 	if (!parsed.success) throw new Error("The installed CLI contains invalid Service release metadata.");
-	const platform = `${process.platform}-${process.arch}`;
+	const platform = resolveCliBinaryPlatform(process.platform, process.arch);
 	const artifact = parsed.data.platforms[platform];
 	if (!artifact) throw new Error(`The installed CLI has no Service artifact for ${platform}.`);
 	return {
@@ -845,10 +974,14 @@ async function pruneManagedVersions(input) {
 	rollbackVersion ??= [...usableManagedVersions].filter((version) => compareSemver(version, input.currentVersion) < 0).sort((left, right) => compareSemver(right, left))[0] ?? null;
 	if (rollbackVersion) retainedVersions.add(rollbackVersion);
 	for (const protectedVersion of input.protectedVersions ?? []) if (usableManagedVersions.has(protectedVersion)) retainedVersions.add(protectedVersion);
-	await Promise.all(managedVersions.filter((version) => !retainedVersions.has(version)).map((version) => rm(path.join(versionsDir, version), { recursive: true })));
+	for (const version of managedVersions) {
+		if (retainedVersions.has(version)) continue;
+		if (process.platform === "win32") await pruneWindowsBinaryBundle(path.join(versionsDir, version));
+		else await rm(path.join(versionsDir, version), { recursive: true });
+	}
 }
 async function isUsableManagedVersion(version, versionsDir) {
-	const target = path.join(versionsDir, version, "openmeld");
+	const target = path.join(versionsDir, version, openMeldManagedBinaryName());
 	if (!(await stat(target).catch((error) => {
 		if (getErrorCode$1(error) === "ENOENT") return null;
 		throw error;
@@ -862,13 +995,145 @@ function getErrorCode$1(error) {
 	return error && typeof error === "object" && "code" in error ? String(error.code) : null;
 }
 //#endregion
+//#region src/local-components/windows-managed-install.ts
+const INSTALLATION_RECORD = "cli-installation.json";
+const CLI_FILENAME = "openmeld.exe";
+const RETIRED_LAUNCHER = /^\.retired-launcher-[a-f0-9-]{36}\.exe$/u;
+const STAGING_VERSION = /^\.install-[A-Za-z0-9]{6}$/u;
+async function readWindowsManagedCliVersion(root) {
+	const serialized = await readFile(join(root, "bin", INSTALLATION_RECORD), "utf8").catch((error) => {
+		if (hasCode(error, "ENOENT")) return null;
+		throw error;
+	});
+	if (serialized === null) return null;
+	const parsed = windowsManagedCliInstallationSchema.safeParse(JSON.parse(serialized));
+	if (!parsed.success) throw new Error("The managed Windows CLI installation record is invalid. No version was selected.");
+	return parsed.data.version;
+}
+/** Publish the complete immutable directory, never overwrite an in-use image. */
+async function placeWindowsManagedVersion(input) {
+	const { version } = windowsManagedCliInstallationSchema.parse({
+		schemaVersion: 1,
+		version: input.version
+	});
+	const versions = join(input.root, "versions");
+	const destination = join(versions, version);
+	const sources = [{
+		source: input.sourceBinary,
+		name: CLI_FILENAME
+	}, {
+		source: join(dirname(input.sourceBinary), WINDOWS_PROCESS_HELPER_FILENAME),
+		name: WINDOWS_PROCESS_HELPER_FILENAME
+	}];
+	if (await entryExists(destination)) {
+		for (const { source, name } of sources) if (!await sameFileBytes(source, join(destination, name))) throw new Error(`The installed Windows CLI ${version} differs from the selected artifact. Published versions are immutable; acquire a new release instead of overwriting this installation.`);
+		return;
+	}
+	await mkdir(versions, { recursive: true });
+	for (const entry of await readdir(versions, { withFileTypes: true })) if (entry.isDirectory() && STAGING_VERSION.test(entry.name)) await rm(join(versions, entry.name), { recursive: true });
+	const staging = await mkdtemp(join(versions, ".install-"));
+	try {
+		for (const { source, name } of sources) await copyFile(source, join(staging, name));
+		await rename(staging, destination);
+	} finally {
+		await rm(staging, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+/** The caller holds the shared managed-install lock. Record replacement is the commit. */
+async function activateWindowsManagedCli(root, version) {
+	const record = windowsManagedCliInstallationSchema.parse({
+		schemaVersion: 1,
+		version
+	});
+	await reconcileWindowsManagedLauncher(root, version);
+	const destination = join(root, "bin", INSTALLATION_RECORD);
+	const temporary = `${destination}.${randomUUID()}.tmp`;
+	try {
+		await writeFile(temporary, `${JSON.stringify(record)}\n`, {
+			flag: "wx",
+			mode: 384
+		});
+		await rename(temporary, destination);
+	} finally {
+		await rm(temporary, { force: true });
+	}
+}
+/**
+* Repair from the authoritative version record. An interrupted launcher swap
+* can leave bin/openmeld.exe absent; install/maintenance restore it from the
+* immutable version without changing account data or selecting another version.
+*/
+async function reconcileWindowsManagedLauncher(root, version) {
+	windowsManagedCliInstallationSchema.parse({
+		schemaVersion: 1,
+		version
+	});
+	const source = join(root, "versions", version, WINDOWS_PROCESS_HELPER_FILENAME);
+	const bin = join(root, "bin");
+	const launcher = join(bin, CLI_FILENAME);
+	await mkdir(bin, { recursive: true });
+	for (const entry of await readdir(bin, { withFileTypes: true })) if (entry.isFile() && RETIRED_LAUNCHER.test(entry.name)) await removeRetiredLauncher(join(bin, entry.name));
+	if (await sameFileBytes(source, launcher)) return;
+	const temporary = join(bin, `.launcher-${randomUUID()}.tmp`);
+	const retired = join(bin, `.retired-launcher-${randomUUID()}.exe`);
+	await copyFile(source, temporary);
+	let movedPrevious = false;
+	try {
+		if (await entryExists(launcher)) {
+			await rename(launcher, retired);
+			movedPrevious = true;
+		}
+		try {
+			await rename(temporary, launcher);
+		} catch (error) {
+			if (movedPrevious) await rename(retired, launcher);
+			throw error;
+		}
+		if (movedPrevious) await removeRetiredLauncher(retired);
+	} finally {
+		await rm(temporary, { force: true });
+	}
+}
+async function removeRetiredLauncher(file) {
+	await rm(file).catch((error) => {
+		if (hasCode(error, "EPERM") || hasCode(error, "EBUSY")) return;
+		throw error;
+	});
+}
+async function entryExists(file) {
+	return await lstat(file).then(() => true, (error) => {
+		if (hasCode(error, "ENOENT")) return false;
+		throw error;
+	});
+}
+async function sameFileBytes(left, right) {
+	const [leftStat, rightStat] = await Promise.all([lstat(left), lstat(right).catch((error) => {
+		if (hasCode(error, "ENOENT")) return null;
+		throw error;
+	})]);
+	if (!(leftStat.isFile() && rightStat?.isFile()) || leftStat.size !== rightStat.size) return false;
+	const hash = async (file) => {
+		const digest = createHash("sha256");
+		for await (const chunk of createReadStream(file)) digest.update(chunk);
+		return digest.digest("hex");
+	};
+	const [leftHash, rightHash] = await Promise.all([hash(left), hash(right)]);
+	return leftHash === rightHash;
+}
+function hasCode(error, code) {
+	return error !== null && typeof error === "object" && "code" in error && error.code === code;
+}
+//#endregion
 //#region src/local-components/managed-install.ts
 const MANAGED_INSTALL_LOCK_PROFILE = "managed-cli";
 const MANAGED_INSTALL_LOCK_KEY = "install";
 const MANAGED_INSTALL_LOCK_RETRY_DELAY_MS = 100;
 const MANAGED_INSTALL_LOCK_TIMEOUT_MS = 3e4;
 function resolveCliPlatformToken() {
-	return `${process$1.platform}-${process$1.arch}`;
+	return resolveCliBinaryPlatform(process$1.platform, process$1.arch);
 }
 function resolveCliSelfVersion() {
 	return OPENMELD_VERSION;
@@ -884,6 +1149,7 @@ async function isUsableManagedBinary(target) {
 	});
 }
 async function readCurrentPointerVersion(pathInput = {}) {
+	if (process$1.platform === "win32") return await readWindowsManagedCliVersion(resolveOpenMeldRootDir(pathInput));
 	const pointerPath = openMeldManagedBinaryPath(pathInput);
 	const target = await readlink(pointerPath).catch((error) => {
 		if (isErrorWithCode(error, "ENOENT") || isErrorWithCode(error, "EINVAL")) return null;
@@ -894,16 +1160,23 @@ async function readCurrentPointerVersion(pathInput = {}) {
 	const version = path.basename(path.dirname(resolved));
 	return version.length > 0 && path.resolve(resolved) === openMeldManagedVersionBinaryPath(version, pathInput) ? version : null;
 }
-async function readManagedCliInstallation() {
-	const version = await readCurrentPointerVersion();
+async function readManagedCliInstallation(pathInput = {}) {
+	const version = await readCurrentPointerVersion(pathInput);
 	if (!version) return null;
-	const binaryPath = openMeldManagedVersionBinaryPath(version);
+	const binaryPath = openMeldManagedVersionBinaryPath(version, pathInput);
 	if (!await isUsableManagedBinary(binaryPath)) return null;
 	return {
 		version,
 		binaryPath
 	};
 }
+async function reconcileManagedCliLauncher() {
+	if (process$1.platform !== "win32") return;
+	await withManagedInstallTransaction(async () => {
+		const version = await readCurrentPointerVersion();
+		if (version) await reconcileWindowsManagedLauncher(resolveOpenMeldRootDir(), version);
+	});
+}
 /**
 * Install the currently-running binary (process.execPath) into the managed
 * layout and point bin/openmeld at it. Idempotent with semver arbitration:
@@ -957,6 +1230,7 @@ async function pruneManagedInstallVersions(input) {
 	}, pathInput);
 }
 async function performManagedInstallLocked(input) {
+	assertNoPublishedProductionMutationDuringTests({}, "managed CLI installation");
 	const force = input?.force ?? false;
 	const version = resolveCliSelfVersion();
 	const platform = resolveCliPlatformToken();
@@ -975,6 +1249,7 @@ async function performManagedInstallLocked(input) {
 	if (previousVersion !== null) {
 		const comparison = compareSemver(version, previousVersion);
 		if (!force && comparison === 0 && await isUsableManagedBinary(managedBinaryPath)) {
+			if (process$1.platform === "win32") await reconcileWindowsManagedLauncher(resolveOpenMeldRootDir(), previousVersion);
 			await pruneManagedVersions({
 				currentVersion: previousVersion,
 				protectedVersions
@@ -985,6 +1260,7 @@ async function performManagedInstallLocked(input) {
 			};
 		}
 		if (comparison < 0 && !force) {
+			if (process$1.platform === "win32") await reconcileWindowsManagedLauncher(resolveOpenMeldRootDir(), previousVersion);
 			if (!await isUsableManagedBinary(managedBinaryPath)) await placeVersionedBinary(input?.sourceBinaryPath ?? process$1.execPath, version, managedBinaryPath);
 			await pruneManagedVersions({
 				currentVersion: previousVersion,
@@ -1020,6 +1296,14 @@ async function readManagedInstallProtectedVersions(pathInput = {}) {
 	return protectedVersions;
 }
 async function placeVersionedBinary(sourceBinary, version, managedBinaryPath) {
+	if (process$1.platform === "win32") {
+		await placeWindowsManagedVersion({
+			root: resolveOpenMeldRootDir(),
+			version,
+			sourceBinary
+		});
+		return;
+	}
 	await mkdir(openMeldManagedVersionDir(version), { recursive: true });
 	const tmpPath = `${managedBinaryPath}.tmp-${process$1.pid}-${Date.now()}`;
 	await rm(tmpPath, { force: true }).catch(() => void 0);
@@ -1032,6 +1316,10 @@ async function placeVersionedBinary(sourceBinary, version, managedBinaryPath) {
 	await rename(tmpPath, managedBinaryPath);
 }
 async function swapCurrentPointer(currentPointerPath, managedBinaryPath) {
+	if (process$1.platform === "win32") {
+		await activateWindowsManagedCli(resolveOpenMeldRootDir(), path.basename(path.dirname(managedBinaryPath)));
+		return;
+	}
 	await mkdir(openMeldBinDir(), { recursive: true });
 	const relativeTarget = path.relative(path.dirname(currentPointerPath), managedBinaryPath);
 	const tmpPath = `${currentPointerPath}.tmp-${process$1.pid}-${Date.now()}`;
@@ -1040,7 +1328,7 @@ async function swapCurrentPointer(currentPointerPath, managedBinaryPath) {
 	await rename(tmpPath, currentPointerPath);
 }
 function buildInstallSelfJsonPayload(outcome) {
-	return {
+	return cliInstallSelfResultSchema.parse({
 		schemaVersion: 1,
 		type: "cli.install_self",
 		result: outcome.result,
@@ -1050,7 +1338,7 @@ function buildInstallSelfJsonPayload(outcome) {
 		currentPointerPath: outcome.currentPointerPath,
 		previousVersion: outcome.previousVersion,
 		forced: outcome.forced
-	};
+	});
 }
 function isErrorWithCode(error, code) {
 	return error instanceof Error && "code" in error && error.code === code;
@@ -1166,6 +1454,7 @@ function hasBundleContentDrift(input) {
 const DAEMON_ACTIVE_BUNDLE_SCHEMA = "openmeld-daemon-active-bundle-v2";
 const DAEMON_ACTIVE_BUNDLE_LEGACY_SCHEMA = "openmeld-daemon-active-bundle-v1";
 const DAEMON_CLI_ENTRY_NAMES = ["openmeld-dev.js", "openmeld.js"];
+const WINDOWS_MAINTENANCE_BUNDLE_PATTERN = /^maintenance-[0-9a-f]{64}$/u;
 const DAEMON_BUNDLE_SOURCE_KIND_WORKSPACE = "workspace";
 const DAEMON_BUNDLE_SOURCE_KIND_PACKAGE_INSTALL = "package_install";
 const DAEMON_BUNDLE_SOURCE_KIND_NPX_CACHE = "npx_cache";
@@ -1274,7 +1563,7 @@ async function resolveAlignedDaemonActiveBundleEntryPath(input = {}) {
 async function resolveInstalledDaemonBundleFingerprint(state, pathInput = {}) {
 	if (state?.bundleFormat === "binary_v1") {
 		const entryPath = await resolveDaemonBundleEntryPathFromState(state, pathInput);
-		return entryPath ? await hashDaemonBinaryFile(entryPath) : null;
+		return entryPath ? await hashBinaryServiceBundle(entryPath) : null;
 	}
 	if (state?.bundleFormat === "self_contained_v1") {
 		const bundleRootPath = resolveDaemonBundleRootPath(state.bundleId, pathInput);
@@ -1288,6 +1577,7 @@ async function resolveInstalledDaemonBundleFingerprint(state, pathInput = {}) {
 async function resolveDaemonBundleEntryPathFromState(state, pathInput = {}) {
 	if (!state) return null;
 	if (state.bundleFormat === "binary_v1") {
+		if (process$1.platform === "win32") return await pathExists(state.sourceEntryScriptPath) ? state.sourceEntryScriptPath : null;
 		const stableExecutablePath = daemonServiceBinaryExecutablePath(pathInput);
 		if (await pathExists(stableExecutablePath)) return stableExecutablePath;
 		return await pathExists(state.sourceEntryScriptPath) ? state.sourceEntryScriptPath : null;
@@ -1366,14 +1656,15 @@ async function prepareBinaryDaemonServiceBundle(input) {
 	const { daemonVersion } = input;
 	const bundledRelease = resolveBundledServiceRelease();
 	const binaryRelease = input.binaryRelease ?? (bundledRelease?.version === daemonVersion ? bundledRelease : void 0);
-	if (daemonVersion !== resolveCliSelfVersion()) {
+	if (process$1.platform === "win32" || daemonVersion !== resolveCliSelfVersion()) {
 		const active = await readDaemonActiveBundleState();
-		if (active?.bundleFormat === "binary_v1" && active.daemonVersion === daemonVersion && active.sourceDistFingerprint && (!binaryRelease || binaryRelease.sha256 === active.sourceDistFingerprint) && await pathExists(active.sourceEntryScriptPath) && await hashDaemonBinaryFile(active.sourceEntryScriptPath) === active.sourceDistFingerprint) return active;
+		if (active?.bundleFormat === "binary_v1" && active.daemonVersion === daemonVersion && active.sourceDistFingerprint && (!binaryRelease || expectedBinaryServiceFingerprint(binaryRelease) === active.sourceDistFingerprint) && await pathExists(active.sourceEntryScriptPath) && await hashBinaryServiceBundle(active.sourceEntryScriptPath) === active.sourceDistFingerprint) return active;
 	}
 	if (binaryRelease) return await prepareSelectedBinaryDaemonServiceBundle({
 		daemonVersion,
 		release: binaryRelease
 	});
+	if (process$1.platform === "win32") throw new Error("OpenMeld needs the selected Windows background Service artifact. The console CLI cannot replace it.");
 	if (daemonVersion !== resolveCliSelfVersion()) throw new Error(`Cannot prepare OpenMeld Service ${daemonVersion} from CLI ${resolveCliSelfVersion()}. Acquire the selected Service release before preparing the update.`);
 	const outcome = await performManagedInstall();
 	const managedBinaryPath = outcome.managedBinaryPath;
@@ -1405,7 +1696,10 @@ async function prepareSelectedBinaryDaemonServiceBundle(input) {
 	if (input.release.version !== input.daemonVersion) throw new Error("The selected Service artifact does not match the update target.");
 	const bundleId = createBundleId(input.daemonVersion);
 	const bundleRootPath = resolveDaemonBundleRootPath(bundleId);
-	const executablePath = join(bundleRootPath, "openmeld");
+	const windows = input.release.platform.startsWith("windows-");
+	if (process$1.platform === "win32" && input.release.platform !== "windows-x64") throw new Error("The selected Service release is not a Windows x64 artifact.");
+	const executableName = windows ? "openmeld.exe" : "openmeld";
+	const executablePath = join(bundleRootPath, executableName);
 	const onDeltaFallback = (error) => {
 		console.warn("[openmeld.service.artifact_delta_fallback]", error.message);
 	};
@@ -1426,7 +1720,9 @@ async function prepareSelectedBinaryDaemonServiceBundle(input) {
 	try {
 		await writeFile(executablePath, bytes, { mode: 493 });
 		await verifyCliBinaryCodeSignature({
+			allowUnsignedPreview: allowUnsignedWindowsInternalPreview(),
 			artifactPath: executablePath,
+			allowUnsignedForDevelopment: resolveOpenMeldEnvPreset() === "dev-local",
 			release: input.release,
 			runCommand: async (command, args) => {
 				const result = await promisify(execFile)(command, args, { encoding: "utf8" });
@@ -1437,6 +1733,15 @@ async function prepareSelectedBinaryDaemonServiceBundle(input) {
 				};
 			}
 		});
+		await prepareCliBinaryProcessHelper({
+			allowUnsignedPreview: allowUnsignedWindowsInternalPreview(),
+			artifactPath: executablePath,
+			release: input.release,
+			downloadPolicy: DEFAULT_CLI_BINARY_DOWNLOAD_POLICY,
+			fetchImpl: fetch
+		});
+		if (windows) await verifyWindowsServiceSubsystem(executablePath);
+		if (await hashBinaryServiceBundle(executablePath, windows) !== expectedBinaryServiceFingerprint(input.release)) throw new Error("The prepared Service bundle does not match the selected release.");
 	} catch (error) {
 		await rm(bundleRootPath, {
 			recursive: true,
@@ -1450,12 +1755,12 @@ async function prepareSelectedBinaryDaemonServiceBundle(input) {
 		schema: DAEMON_ACTIVE_BUNDLE_SCHEMA,
 		bundleId,
 		daemonVersion: input.daemonVersion,
-		entryScriptRelativePath: "openmeld",
+		entryScriptRelativePath: executableName,
 		bundleFormat: "binary_v1",
 		sourceEntryScriptPath: executablePath,
 		sourcePackageRootPath: bundleRootPath,
 		sourceDistRootPath: bundleRootPath,
-		sourceDistFingerprint: input.release.sha256.toLowerCase(),
+		sourceDistFingerprint: expectedBinaryServiceFingerprint(input.release),
 		sourceKind: DAEMON_BUNDLE_SOURCE_KIND_PACKAGE_INSTALL,
 		createdAt: now,
 		updatedAt: now
@@ -1541,6 +1846,13 @@ async function ensureDaemonServiceStableBinaryExecutable(pathInput = {}) {
 }
 async function ensureDaemonServiceUpdateWorkerBinaryExecutable(preparedBundle, pathInput = {}) {
 	if (preparedBundle.bundleFormat !== "binary_v1") throw new Error("OpenMeld cannot prepare the update worker binary without a binary Service bundle.");
+	if (process$1.platform === "win32") return await runAuditedServiceManagerCarrierMutation({
+		distribution: "binary",
+		operation: "prepare_windows_maintenance_bundle",
+		pathInput,
+		targetPath: windowsMaintenanceBinaryPath(preparedBundle, pathInput),
+		run: async () => await prepareWindowsMaintenanceBinary(preparedBundle, pathInput)
+	});
 	return await ensureVerifiedBinaryCarrier({
 		bundle: preparedBundle,
 		operationName: "update_worker_binary",
@@ -1549,6 +1861,20 @@ async function ensureDaemonServiceUpdateWorkerBinaryExecutable(preparedBundle, p
 	});
 }
 async function clearDaemonServiceUpdateWorkerBinaryExecutable(pathInput = {}) {
+	if (process$1.platform === "win32") {
+		for (const bundleId of await readDirectoryNames(daemonRuntimeBundlesPath(pathInput))) {
+			if (!WINDOWS_MAINTENANCE_BUNDLE_PATTERN.test(bundleId)) continue;
+			const targetPath = resolveDaemonBundleRootPath(bundleId, pathInput);
+			await runAuditedServiceManagerCarrierMutation({
+				distribution: "binary",
+				operation: "remove_windows_maintenance_bundle",
+				pathInput,
+				targetPath,
+				run: async () => await pruneWindowsBinaryBundle(targetPath)
+			});
+		}
+		return;
+	}
 	const targetPath = daemonServiceUpdateWorkerBinaryPath(pathInput);
 	await runAuditedServiceManagerCarrierMutation({
 		distribution: "binary",
@@ -1714,16 +2040,19 @@ async function cleanupInactiveDaemonServiceBundles(input = {}) {
 		...serviceContract?.bundleId ? [serviceContract.bundleId] : [],
 		...runtimeLease?.bundleId ? [runtimeLease.bundleId] : [],
 		...registeredWorkerBundleIds,
-		...pendingUpdate?.preparedBundle.bundleFormat === "self_contained_v1" ? [pendingUpdate.preparedBundle.bundleId] : [],
+		...pendingUpdate?.preparedBundle.bundleFormat !== "legacy_linked_v1" && pendingUpdate ? [pendingUpdate.preparedBundle.bundleId] : [],
 		...input.retainBundleIds ?? []
 	]);
 	const bundleEntries = await readDirectoryNames(daemonRuntimeBundlesPath());
-	await Promise.all(bundleEntries.filter((bundleId) => !retain.has(bundleId)).map(async (bundleId) => {
-		await rm(resolveDaemonBundleRootPath(bundleId), {
+	for (const bundleId of bundleEntries) {
+		if (retain.has(bundleId)) continue;
+		const directory = resolveDaemonBundleRootPath(bundleId);
+		if (process$1.platform === "win32") await pruneWindowsBinaryBundle(directory);
+		else await rm(directory, {
 			recursive: true,
 			force: true
 		});
-	}));
+	}
 }
 async function resolveDaemonBundleSourceProvenance(explicitPath) {
 	const sourceEntryScriptPath = await resolveCliScriptPath(explicitPath);
@@ -2321,7 +2650,7 @@ function getErrorCode(error) {
 }
 //#endregion
 //#region src/local-service/lifecycle/daemon-managed-binary-path.ts
-const MANAGED_BINARY_NAME = "openmeld";
+const MANAGED_BINARY_NAMES = ["openmeld.exe", "openmeld"];
 const PATH_BOUNDARY_PATTERN = /[\s"'<>]/u;
 const TRAILING_SLASHES_PATTERN = /\/+$/u;
 const VERSION_SEGMENT_BOUNDARY_PATTERN = /[\s"'<>/]/u;
@@ -2340,7 +2669,7 @@ function resolveOpenMeldManagedVersionBinaryRootPath(value) {
 	const binaryName = segments.pop();
 	const versionSegment = segments.pop();
 	const versionsDirectory = segments.pop();
-	if (binaryName !== MANAGED_BINARY_NAME || versionsDirectory !== "versions" || !versionSegment || !isValidManagedVersionSegment(versionSegment)) return null;
+	if (!MANAGED_BINARY_NAMES.includes(binaryName ?? "") || versionsDirectory !== "versions" || !versionSegment || !isValidManagedVersionSegment(versionSegment)) return null;
 	const rootPath = segments.join("/");
 	if (rootPath.length > 0) return rootPath;
 	return normalizedPath.startsWith("/") ? "/" : null;
@@ -2351,7 +2680,7 @@ function isManagedVersionBinaryPath(normalizedPath, pathInput) {
 	const segments = normalizedPath.slice(versionsRoot.length).split("/");
 	const versionSegment = segments[0] ?? "";
 	const binaryName = segments[1] ?? "";
-	return segments.length === 2 && versionSegment.length > 0 && binaryName === MANAGED_BINARY_NAME;
+	return segments.length === 2 && versionSegment.length > 0 && MANAGED_BINARY_NAMES.includes(binaryName);
 }
 function containsManagedVersionBinaryPath(normalizedValue, pathInput) {
 	const versionsRoot = normalizeVersionsRoot(pathInput);
@@ -2362,8 +2691,8 @@ function containsManagedVersionBinaryPath(normalizedValue, pathInput) {
 		const versionSeparatorIndex = afterRoot.indexOf("/");
 		if (isPathBoundary(before) && versionSeparatorIndex > 0 && isValidManagedVersionSegment(afterRoot.slice(0, versionSeparatorIndex))) {
 			const afterVersion = afterRoot.slice(versionSeparatorIndex + 1);
-			if (afterVersion.startsWith(MANAGED_BINARY_NAME)) {
-				if (isPathBoundary(afterVersion[8] ?? "")) return true;
+			for (const binaryName of MANAGED_BINARY_NAMES) if (afterVersion.startsWith(binaryName)) {
+				if (isPathBoundary(afterVersion[binaryName.length] ?? "")) return true;
 			}
 		}
 		index = normalizedValue.indexOf(versionsRoot, index + 1);
@@ -2715,11 +3044,28 @@ function collapseLauncherWrapperProcesses(processes) {
 	return collapsedProcesses;
 }
 async function listWindowsProcesses() {
-	const { stdout: output } = await promisify(execFile)(resolveWindowsPowerShellPath(), powerShellEncodedArguments("$ErrorActionPreference='Stop'; [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false); @(Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,CommandLine) | ConvertTo-Json -Compress"), {
+	const script = `
+$ErrorActionPreference='Stop'
+$ProgressPreference='SilentlyContinue'
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+[Console]::Error.WriteLine('openmeld.inventory.query_started')
+$rows = @(Get-CimInstance Win32_Process -Property ProcessId,ParentProcessId,CommandLine | Select-Object ProcessId,ParentProcessId,CommandLine)
+[Console]::Error.WriteLine('openmeld.inventory.query_completed')
+ConvertTo-Json -InputObject $rows -Compress
+`;
+	const startedAt = Date.now();
+	const { stdout: output } = await promisify(execFile)(resolveWindowsPowerShellPath(), powerShellEncodedArguments(script), {
 		encoding: "utf8",
 		windowsHide: true,
 		timeout: 1e4,
 		maxBuffer: 8 * 1024 * 1024
+	}).catch((error) => {
+		const failure = error;
+		const evidence = typeof failure.stderr === "string" ? failure.stderr : "";
+		let phase = "powershell_start";
+		if (evidence.includes("openmeld.inventory.query_completed")) phase = "output";
+		else if (evidence.includes("openmeld.inventory.query_started")) phase = "query";
+		throw new Error(`Windows process inventory failed after ${Date.now() - startedAt}ms (phase=${phase}, code=${String(failure.code ?? "unknown")}, signal=${String(failure.signal ?? "none")}, killed=${String(failure.killed ?? false)}).`, { cause: error });
 	});
 	return parseWindowsProcessInventory(output);
 }
@@ -3091,6 +3437,6 @@ async function readObservedRuntimeState() {
 	});
 }
 //#endregion
-export { resolveBundledServiceRelease as $, prepareDaemonServiceBundle as A, resolveDaemonServiceArtifact as B, daemonServiceExecutableWrapperPath as C, ensureDaemonServiceStableBinaryExecutable as D, discardPreparedDaemonServiceBundle as E, restoreDaemonActiveBundleStateSnapshot as F, readManagedCliInstallation as G, buildInstallSelfJsonPayload as H, runAuditedServiceManagerCarrierMutation as I, DAEMON_SERVICE_UPDATE_JOB_SCHEMA as J, resolveCliSelfVersion as K, verifyDaemonActiveBundleIntegrity as L, resolveAlignedDaemonActiveBundleEntryPath as M, resolveDaemonBundleEntryPathFromState as N, ensureDaemonServiceUpdateWorkerBinaryExecutable as O, resolveInstalledDaemonBundleFingerprint as P, readPendingDaemonServiceUpdate as Q, writeDaemonServiceExecutableWrapper as R, daemonServiceBinaryExecutablePath as S, daemonServiceUpdateWorkerBinaryPath as T, performManagedInstall as U, collectLocalOperationFailure as V, pruneManagedInstallVersions as W, persistPendingDaemonServiceUpdate as X, completePendingDaemonServiceUpdate as Y, readLastDaemonServiceUpdate as Z, matchesExpectedDaemonServiceManagerDefinition as _, resolveDaemonRuntimeState as a, resolveDaemonServiceUpdateWorkerLaunchdPlistPath as at, cleanupInactiveDaemonServiceBundles as b, resolveObservedDaemonRuntimeStatus as c, resolveDaemonServiceUpdateWorkerSystemdUnitPath as ct, inspectLegacySharedDaemonService as d, downloadCliBinaryUpdateArtifact as dt, INDEPENDENT_MAINTENANCE_REGISTRATION as et, listDaemonOwnedProcesses as f, resolveCliBinaryUpdatePlan as ft, assertDaemonMaintenanceInstallationOwnership as g, resolveDaemonBundleIdFromEntryPath as h, readCurrentObservedDaemonRuntimeStatus as i, resolveDaemonServiceUpdateWorkerIdentity as it, readDaemonActiveBundleState as j, isDaemonBundleSourceAllowedForLane as k, resolveObservedRuntimeCommandEntryPath as l, resolveDaemonServiceUpdateWorkerWindowsScriptPath as lt, normalizeDaemonCommandPath as m, getEffectiveDaemonRuntimeStatus as n, daemonServiceUpdateWorkerNpmEntryPath as nt, resolveDaemonServiceManagerForRuntimeState as o, resolveDaemonServiceUpdateWorkerSystemdPathUnitPath as ot, extractDaemonCommandEntryPath as p, verifyCliBinaryCodeSignature as pt, withManagedInstallTransaction as q, readCurrentDaemonRuntimeContext as r, hasIndependentMaintenanceRegistration as rt, waitForDaemonSystemServiceToStop as s, resolveDaemonServiceUpdateWorkerSystemdTimerUnitPath as st, clearDaemonRuntimeStateIfDefinitelyStopped as t, configureDaemonMaintenanceEnvironment as tt, cleanupLegacySharedDaemonServiceState as u, DEFAULT_CLI_BINARY_DOWNLOAD_POLICY as ut, isOpenMeldManagedBinaryPath as v, daemonServiceLauncherPath as w, clearDaemonServiceUpdateWorkerBinaryExecutable as x, activateDaemonServiceBundle as y, writeDaemonServiceLauncher as z };
+export { readPendingDaemonServiceUpdate as $, prepareDaemonServiceBundle as A, resolveDaemonServiceArtifact as B, daemonServiceExecutableWrapperPath as C, ensureDaemonServiceStableBinaryExecutable as D, discardPreparedDaemonServiceBundle as E, restoreDaemonActiveBundleStateSnapshot as F, readManagedCliInstallation as G, buildInstallSelfJsonPayload as H, runAuditedServiceManagerCarrierMutation as I, withManagedInstallTransaction as J, reconcileManagedCliLauncher as K, verifyDaemonActiveBundleIntegrity as L, resolveAlignedDaemonActiveBundleEntryPath as M, resolveDaemonBundleEntryPathFromState as N, ensureDaemonServiceUpdateWorkerBinaryExecutable as O, resolveInstalledDaemonBundleFingerprint as P, readLastDaemonServiceUpdate as Q, writeDaemonServiceExecutableWrapper as R, daemonServiceBinaryExecutablePath as S, daemonServiceUpdateWorkerBinaryPath as T, performManagedInstall as U, collectLocalOperationFailure as V, pruneManagedInstallVersions as W, completePendingDaemonServiceUpdate as X, DAEMON_SERVICE_UPDATE_JOB_SCHEMA as Y, persistPendingDaemonServiceUpdate as Z, matchesExpectedDaemonServiceManagerDefinition as _, resolveDaemonRuntimeState as a, resolveDaemonServiceUpdateWorkerIdentity as at, cleanupInactiveDaemonServiceBundles as b, resolveObservedDaemonRuntimeStatus as c, resolveDaemonServiceUpdateWorkerSystemdTimerUnitPath as ct, inspectLegacySharedDaemonService as d, DEFAULT_CLI_BINARY_DOWNLOAD_POLICY as dt, resolveBundledServiceRelease as et, listDaemonOwnedProcesses as f, allowUnsignedWindowsInternalPreview as ft, assertDaemonMaintenanceInstallationOwnership as g, verifyCliBinaryCodeSignature as gt, resolveDaemonBundleIdFromEntryPath as h, resolveCliBinaryUpdatePlan as ht, readCurrentObservedDaemonRuntimeStatus as i, hasIndependentMaintenanceRegistration as it, readDaemonActiveBundleState as j, isDaemonBundleSourceAllowedForLane as k, resolveObservedRuntimeCommandEntryPath as l, resolveDaemonServiceUpdateWorkerSystemdUnitPath as lt, normalizeDaemonCommandPath as m, prepareCliBinaryProcessHelper as mt, getEffectiveDaemonRuntimeStatus as n, configureDaemonMaintenanceEnvironment as nt, resolveDaemonServiceManagerForRuntimeState as o, resolveDaemonServiceUpdateWorkerLaunchdPlistPath as ot, extractDaemonCommandEntryPath as p, downloadCliBinaryUpdateArtifact as pt, resolveCliSelfVersion as q, readCurrentDaemonRuntimeContext as r, daemonServiceUpdateWorkerNpmEntryPath as rt, waitForDaemonSystemServiceToStop as s, resolveDaemonServiceUpdateWorkerSystemdPathUnitPath as st, clearDaemonRuntimeStateIfDefinitelyStopped as t, INDEPENDENT_MAINTENANCE_REGISTRATION as tt, cleanupLegacySharedDaemonServiceState as u, resolveDaemonServiceUpdateWorkerWindowsScriptPath as ut, isOpenMeldManagedBinaryPath as v, daemonServiceLauncherPath as w, clearDaemonServiceUpdateWorkerBinaryExecutable as x, activateDaemonServiceBundle as y, writeDaemonServiceLauncher as z };
 
-//# sourceMappingURL=daemon-service-runtime-Kr6Bs2J2.js.map
+//# sourceMappingURL=daemon-service-runtime-BEfMD5jb.js.map