openmeld 0.3.263 → 0.3.264

package/dist/{service-BNpxWxYQ.js → service-Cz9hwU7z.js}

@@ -1,40 +1,40 @@
 #!/usr/bin/env node
 
-import { $r as applyAcceptedLeases, An as resolveInstalledCodexLaunchCandidates, Ft as readSavedProfileWorkspaceForAccount, Gn as emitReconcileCompletedEvidence, Gt as summarizeSkippedDaemonProfiles, Ht as createMutableRouteCatalogState, I as listAgentTargetStates, Kn as emitReconcileStartedEvidence, Kt as syncDaemonRouteCatalogState, Lt as resolveConfiguredProfileWorkspacePathForAccount, O as syncDeviceRuntimeStateProjection, Pt as readProfileWorkspaceConfigForAccount, Qr as MIN_HEARTBEAT_INTERVAL_MS, Rt as setCustomProfileWorkspace, Ut as createRouteCatalogFromMutableState, Wn as emitDriftDetectedEvidence, Xr as ADAPTIVE_HEARTBEAT_JITTER_RATIO, Yr as resolveRouteRegistrationReconcileDecision, Zr as MAX_HEARTBEAT_INTERVAL_MS, Zt as isDaemonReconcileInProgressError, _t as removeMissingProjectConnections, ct as ProjectBindingOperationError, ei as applyIntervalJitterMs$1, fn as resolveCatalogSyncSkippedProfilesLogState, in as buildLocalServiceDiagnosticsPayload, jt as ensureOpenMeldManagedProfileWorkspace, kt as resolveRegistryRuntimeAdapterCapabilitySnapshot, lt as ProjectBindingStoreUpdateRequiredError, mt as listProjectConnectionsWithStatus, ni as resolveAdaptiveHeartbeatIntervalMs, or as buildAuthenticatedControlPlaneResponse, pt as listProjectBindings, qn as DaemonServiceRunError, ri as resolveCatalogSyncIntervalMs, ti as pruneStaleLeases, ut as bindProject, vt as removeProjectConnection, wt as resolveLocalProjectConnectionForPath, xt as setDefaultProjectConnection } from "./prepare-provider-runtime-CyIGaDTC.js";
-import { a as resolveBaseUrl, c as resolveExplicitGatewayUrlOrThrow, f as getConfiguredDaemonDispatchLimits, i as normalizeGatewayBaseUrlOrNull, o as resolveBaseUrlOrNull, r as normalizeGatewayBaseUrl } from "./base-url-CLMqlF1w.js";
+import { $r as pruneStaleLeases, An as resolveInstalledCodexLaunchCandidates, Ft as readSavedProfileWorkspaceForAccount, Gn as emitReconcileCompletedEvidence, Gt as summarizeSkippedDaemonProfiles, Ht as createMutableRouteCatalogState, I as listAgentTargetStates, Jr as ADAPTIVE_HEARTBEAT_JITTER_RATIO, Kn as emitReconcileStartedEvidence, Kt as syncDaemonRouteCatalogState, Lt as resolveConfiguredProfileWorkspacePathForAccount, O as syncDeviceRuntimeStateProjection, Pt as readProfileWorkspaceConfigForAccount, Qr as applyIntervalJitterMs$1, Rt as setCustomProfileWorkspace, Ut as createRouteCatalogFromMutableState, Wn as emitDriftDetectedEvidence, Xr as MIN_HEARTBEAT_INTERVAL_MS, Yr as MAX_HEARTBEAT_INTERVAL_MS, Zr as applyAcceptedLeases, Zt as isDaemonReconcileInProgressError, _t as removeMissingProjectConnections, ct as ProjectBindingOperationError, ei as resolveAdaptiveHeartbeatIntervalMs, fn as resolveCatalogSyncSkippedProfilesLogState, in as buildLocalServiceDiagnosticsPayload, ir as buildAuthenticatedControlPlaneResponse, jt as ensureOpenMeldManagedProfileWorkspace, kt as resolveRegistryRuntimeAdapterCapabilitySnapshot, lt as ProjectBindingStoreUpdateRequiredError, mt as listProjectConnectionsWithStatus, pt as listProjectBindings, qn as DaemonServiceRunError, qr as resolveRouteRegistrationReconcileDecision, ti as resolveCatalogSyncIntervalMs, ut as bindProject, vt as removeProjectConnection, wt as resolveLocalProjectConnectionForPath, xt as setDefaultProjectConnection } from "./prepare-provider-runtime-BbJnigvx.js";
+import { a as resolveBaseUrl, c as resolveExplicitGatewayUrlOrThrow, f as getConfiguredDaemonDispatchLimits, i as normalizeGatewayBaseUrlOrNull, o as resolveBaseUrlOrNull, r as normalizeGatewayBaseUrl } from "./base-url-Cno_Uo8f.js";
 import { D as openMeldRootDir, F as resolveOpenMeldRootDir, I as resolveOpenMeldServiceOwnedPathInput, P as resolveOpenMeldEnvPreset, h as isPublishedOpenMeldHome, o as accountsDir, y as normalizeAccountKey } from "./paths-De9xdA2h.js";
-import { r as resolveAuthBaseUrl } from "./auth-url-BheLcWg9.js";
-import { $S as sanitizeDispatchErrorSummary, $s as sessionHistoryRequestFrameSchema, AA as OPENMELD_LOCAL_FOLDER_PICKER_CAPABILITY_HEADER, AF as formatLocalSetupActionDescription, Ax as runtimeTransportRegisterSessionRequestSchema, CM as daemonServiceLaneSchema, Cr as BETTER_AUTH_DEVICE_AUTHORIZATION_GRANT_TYPE, Cx as runtimeTransportLocalAgentControlRefreshCatalogFramePayloadSchema, Dx as runtimeTransportOpenMeldToolsControlFramePayloadSchema, Er as betterAuthDeviceAuthorizationCodeResponseSchema, FA as localFolderPickerHelperProtocolResultSchema, Fb as OPENMELD_ADMISSION_EVIDENCE_HEADER, Gs as sessionHistoryAuditSchema, Hs as SESSION_HISTORY_CAPABILITY_HEADER, I as formatLocalMachineIssueMessage, IA as localFolderPickerHelperResultSchema, Ib as OPENMELD_EXECUTION_ADMISSION_HEADER, Iw as SPACE_WORK_HANDOFF_CAPABILITY_HEADER, Ix as runtimeTransportRouteCatalogChangedFramePayloadSchema, KA as COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY, MA as localFolderPickerDaemonFrameSchema, MF as installedLocalComponentsSnapshotSchema, Mr as betterAuthDeviceAuthorizationTokenResponseSchema, Nb as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH, Nr as betterAuthSessionSnapshotResponseSchema, OE as OPENMELD_COMPUTER_CARE_HEADER, OF as formatLocalComponentsSummaryDescription, Ok as OPENMELD_REASONING_STREAM_HEADER, Ox as runtimeTransportOpenMeldToolsControlResultFramePayloadSchema, SF as resolveCliBinaryPlatform, So as cliJsonOutputEnvelopeSchema, Sx as runtimeTransportLocalAgentControlReadProfileWorkspaceFramePayloadSchema, Tr as betterAuthDeviceAuthorizationCodeRequestSchema, Tx as runtimeTransportLocalAgentControlSetProfileWorkspaceFramePayloadSchema, Wb as localWakeRouteWorkingFolderObservationSchema, Ws as SESSION_HISTORY_RUNTIME_CAPABILITY, Xs as sessionHistoryPolicySchema, YA as computerFileAccessDaemonFrameSchema, _v as LOCAL_EXECUTION_INPUT_CAPABILITY_HEADER, aA as localProjectControlDiscoverProjectsResponseSchema, aT as openMeldDaemonControlPlaneResponseSchema, b as serviceExecutionHostSnapshotSchema, d_ as serviceConnectionEvidenceEventSchema, dj as COMPUTER_POWER_CAPABILITY_HEADER, f_ as serviceConnectionEvidenceJournalSchema, g as serviceExecutionHostMethods, hx as runtimeTransportHeartbeatRequestSchema, jF as formatLocalSetupActionLabel, jr as betterAuthDeviceAuthorizationTokenRequestSchema, kA as LOCAL_FOLDER_PICKER_RUNTIME_CAPABILITY, kF as formatLocalComponentsSummaryLabel, kr as betterAuthDeviceAuthorizationErrorResponseSchema, qA as OPENMELD_RUNTIME_CAPABILITIES_HEADER, tA as localProjectControlDaemonFrameSchema, tc as sessionHistoryResultFrameSchema, v_ as SERVICE_CONNECTION_ID_QUERY_PARAMETER, vv as localExecutionInputFrameSchema, xv as localExecutionInputResponseSchema } from "./dist-YSbIHBnl.js";
-import { C as assessLocalMachineFailure, E as createServiceSpawnPendingIssue, i as isOpenMeldLockError, u as resolveOpenMeldOrphanedLockIssue, x as resolveOpenMeldLaneDescriptor } from "./lock-Cz8h_yJh.js";
-import { i as readProcessStartIdentity, n as isPreciseProcessStartIdentity, t as CURRENT_PROCESS_START_IDENTITY } from "./process-identity-D_VPVruT.js";
-import "./openmeld-dev-environment-POXQHtTN.js";
+import { r as resolveAuthBaseUrl } from "./auth-url-0Y8BrR9l.js";
+import { $s as sessionHistoryRequestFrameSchema, AA as LOCAL_FOLDER_PICKER_RUNTIME_CAPABILITY, AF as formatLocalComponentsSummaryLabel, CF as resolveCliBinaryPlatform, Cr as BETTER_AUTH_DEVICE_AUTHORIZATION_GRANT_TYPE, Cx as runtimeTransportLocalAgentControlReadProfileWorkspaceFramePayloadSchema, Er as betterAuthDeviceAuthorizationCodeResponseSchema, Ex as runtimeTransportLocalAgentControlSetProfileWorkspaceFramePayloadSchema, Fb as OPENMELD_ADMISSION_EVIDENCE_HEADER, Gs as sessionHistoryAuditSchema, Hs as SESSION_HISTORY_CAPABILITY_HEADER, I as formatLocalMachineIssueMessage, IA as localFolderPickerHelperProtocolResultSchema, Ib as OPENMELD_EXECUTION_ADMISSION_HEADER, JA as OPENMELD_RUNTIME_CAPABILITIES_HEADER, LA as localFolderPickerHelperResultSchema, Lw as SPACE_WORK_HANDOFF_CAPABILITY_HEADER, Lx as runtimeTransportRouteCatalogChangedFramePayloadSchema, MF as formatLocalSetupActionLabel, Mr as betterAuthDeviceAuthorizationTokenResponseSchema, NA as localFolderPickerDaemonFrameSchema, NF as installedLocalComponentsSnapshotSchema, Nb as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH, Nr as betterAuthSessionSnapshotResponseSchema, Ox as runtimeTransportOpenMeldToolsControlFramePayloadSchema, So as cliJsonOutputEnvelopeSchema, Tr as betterAuthDeviceAuthorizationCodeRequestSchema, Wb as localWakeRouteWorkingFolderObservationSchema, Ws as SESSION_HISTORY_RUNTIME_CAPABILITY, XA as computerFileAccessDaemonFrameSchema, Xs as sessionHistoryPolicySchema, _v as LOCAL_EXECUTION_INPUT_CAPABILITY_HEADER, b as serviceExecutionHostSnapshotSchema, d_ as serviceConnectionEvidenceEventSchema, eC as sanitizeDispatchErrorSummary, f_ as serviceConnectionEvidenceJournalSchema, fj as COMPUTER_POWER_CAPABILITY_HEADER, g as serviceExecutionHostMethods, gx as runtimeTransportHeartbeatRequestSchema, jA as OPENMELD_LOCAL_FOLDER_PICKER_CAPABILITY_HEADER, jF as formatLocalSetupActionDescription, jr as betterAuthDeviceAuthorizationTokenRequestSchema, jx as runtimeTransportRegisterSessionRequestSchema, kE as OPENMELD_COMPUTER_CARE_HEADER, kF as formatLocalComponentsSummaryDescription, kk as OPENMELD_REASONING_STREAM_HEADER, kr as betterAuthDeviceAuthorizationErrorResponseSchema, kx as runtimeTransportOpenMeldToolsControlResultFramePayloadSchema, nA as localProjectControlDaemonFrameSchema, oA as localProjectControlDiscoverProjectsResponseSchema, oT as openMeldDaemonControlPlaneResponseSchema, qA as COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY, tc as sessionHistoryResultFrameSchema, v_ as SERVICE_CONNECTION_ID_QUERY_PARAMETER, vv as localExecutionInputFrameSchema, wM as daemonServiceLaneSchema, wx as runtimeTransportLocalAgentControlRefreshCatalogFramePayloadSchema, xv as localExecutionInputResponseSchema } from "./dist-BOBe5eOZ.js";
+import { C as assessLocalMachineFailure, E as createServiceSpawnPendingIssue, i as isOpenMeldLockError, u as resolveOpenMeldOrphanedLockIssue, x as resolveOpenMeldLaneDescriptor } from "./lock-y1PCtVSn.js";
+import { i as readProcessStartIdentity, n as isPreciseProcessStartIdentity, t as CURRENT_PROCESS_START_IDENTITY } from "./process-identity-DCYUeRGI.js";
+import "./openmeld-dev-environment-Bx6D1B6_.js";
 import { n as toErrorMessage$5, t as sleep } from "./dist-BLuEEVHh.js";
-import { nr as DAEMON_STREAM_KEEPALIVE_PING, yn as createServiceConnectionEvidenceApi } from "./dist-DY8oLAop.js";
-import { D as createAuthenticationError, E as buildHumanAuthenticationCard, F as resolveCurrentOpenMeldAccountContext, M as resolveAuthenticationReasonFromState, O as extractAuthenticationPromptAction, T as buildCommandAuthenticationPromptMessage$1, a as requireOpenMeldProfile, g as readDaemonCatalogSyncSignal, k as resolveAuthenticationGuidance, n as resolveRuntimeContext, o as resolveOpenMeldProfileOrNull, w as buildAuthenticationStatusLabel, y as clearAllSelectedOpenMeldProfileIds } from "./context-DFf16i-C.js";
+import { nr as DAEMON_STREAM_KEEPALIVE_PING, yn as createServiceConnectionEvidenceApi } from "./dist-CP5KSxWw.js";
+import { D as createAuthenticationError, E as buildHumanAuthenticationCard, F as resolveCurrentOpenMeldAccountContext, M as resolveAuthenticationReasonFromState, O as extractAuthenticationPromptAction, T as buildCommandAuthenticationPromptMessage$1, a as requireOpenMeldProfile, g as readDaemonCatalogSyncSignal, k as resolveAuthenticationGuidance, n as resolveRuntimeContext, o as resolveOpenMeldProfileOrNull, w as buildAuthenticationStatusLabel, y as clearAllSelectedOpenMeldProfileIds } from "./context-NLQSSnf9.js";
 import { a as formatOpenMeldCliTextBlock, n as formatOpenMeldCliCommand, r as formatOpenMeldCliCommands, t as formatInlineOpenMeldCliCommands } from "./cli-entry-command-CR_9QU1i.js";
-import { C as setAuthSession, O as ServiceAccountAdmissionError, T as withAdmittedServiceSession, _ as onAuthSessionCredentialAvailable, a as beginAuthSessionTransition, d as getAuthSessionState, i as assertAuthSessionMutationAvailable, o as buildStoredAuthSessionIdentity, s as clearAuthSession, v as onAuthSessionCredentialObservation } from "./auth-session-B0J2UwSR.js";
+import { C as setAuthSession, O as ServiceAccountAdmissionError, T as withAdmittedServiceSession, _ as onAuthSessionCredentialAvailable, a as beginAuthSessionTransition, d as getAuthSessionState, i as assertAuthSessionMutationAvailable, o as buildStoredAuthSessionIdentity, s as clearAuthSession, v as onAuthSessionCredentialObservation } from "./auth-session-BpRplB8x.js";
 import { n as writeDaemonLocalStateFile, t as readDaemonLocalStateFile } from "./daemon-local-state-file-jOXuXrky.js";
 import { t as isBinaryDistribution } from "./distribution-BDQT2ilb.js";
-import { A as getDaemonStatus, G as withDaemonServiceReconcileLock, H as setDaemonServiceRuntimeState, I as readDaemonServiceRuntimeSnapshot, J as withDaemonServiceStopLock, K as withDaemonServiceRegistrationMutationLock, L as releaseDaemonServiceLifecycleLock, M as isDaemonServiceRuntimeHeartbeatStale, O as ensureDaemonControlPlaneToken, R as resolveDaemonControlPlaneEndpoint, S as daemonServiceRepairJournalPath, U as uninstallDaemon, _ as daemonRuntimeStateRootPath, a as DAEMON_SERVICE_RUNTIME_MODE_ENV, c as acquireDaemonServiceLifecycleLock, f as daemonLifecycleJournalPath, h as daemonRuntimeRootPath, i as DAEMON_SERVICE_RUNTIME_DETACHED_ENV, j as installDaemon, l as clearDaemonServiceRuntimeState, o as DAEMON_SERVICE_RUNTIME_STATE_SCHEMA, q as withDaemonServiceRunLock, z as resolveDaemonServiceRuntimeMetadata } from "./daemon-state-C09DaALw.js";
+import { A as getDaemonStatus, G as withDaemonServiceReconcileLock, H as setDaemonServiceRuntimeState, I as readDaemonServiceRuntimeSnapshot, J as withDaemonServiceStopLock, K as withDaemonServiceRegistrationMutationLock, L as releaseDaemonServiceLifecycleLock, M as isDaemonServiceRuntimeHeartbeatStale, O as ensureDaemonControlPlaneToken, R as resolveDaemonControlPlaneEndpoint, S as daemonServiceRepairJournalPath, U as uninstallDaemon, _ as daemonRuntimeStateRootPath, a as DAEMON_SERVICE_RUNTIME_MODE_ENV, c as acquireDaemonServiceLifecycleLock, f as daemonLifecycleJournalPath, h as daemonRuntimeRootPath, i as DAEMON_SERVICE_RUNTIME_DETACHED_ENV, j as installDaemon, l as clearDaemonServiceRuntimeState, o as DAEMON_SERVICE_RUNTIME_STATE_SCHEMA, q as withDaemonServiceRunLock, z as resolveDaemonServiceRuntimeMetadata } from "./daemon-state-CiTQcAWA.js";
 import { a as outJsonLine, n as sanitizeTerminalDisplayText, o as outLine, t as createPresenter } from "./presenter-DiP7Yh2y.js";
-import { c as buildRequestAuthHeaders, i as AuthRequestCredentialError, l as canAttachAuthTokenToRequest, o as buildOpenMeldProfileRequestHeadersWithAuth, p as deriveAuthBaseUrlFromGatewayUrl, t as createCliApiClientFoundation, u as fingerprintRequestAuthorization } from "./api-client-foundation-6MeNwklv.js";
-import { a as upsertDaemonServiceContract, i as readDaemonServiceContract, n as isDaemonServiceContractIdentityReusable, t as clearDaemonServiceContract } from "./daemon-service-contract-D9gUVdhc.js";
-import { i as writeDaemonRuntimeLease } from "./daemon-runtime-lease-D5f4zLXB.js";
-import { t as resolveOpenMeldEnvironmentTarget } from "./openmeld-environment-target-B0Z7eI6O.js";
-import { t as admitServiceAccountStop } from "./service-account-authorization-CJv1vZzm.js";
-import { S as requestLocalDaemonShutdown, c as runWithDaemonLifecycleCommandJournal, d as compareSemver, i as readLatestDaemonLifecycleOriginEvent, l as OPENMELD_VERSION, n as formatDaemonLifecycleOriginSummary, o as resolveRecentDaemonSignalStopCause, r as readLatestDaemonLifecycleConnectionStateEvent, s as runDaemonServiceManagerAction, t as emitDaemonLifecycleEvent, w as sendLocalDaemonControlPlaneRequest, y as LocalDaemonControlPlaneClientError } from "./daemon-lifecycle-journal-DoAQ-E6K.js";
-import { A as prepareDaemonServiceBundle, G as readManagedCliInstallation, M as resolveAlignedDaemonActiveBundleEntryPath, N as resolveDaemonBundleEntryPathFromState, a as resolveDaemonRuntimeState, b as cleanupInactiveDaemonServiceBundles, f as listDaemonOwnedProcesses, h as resolveDaemonBundleIdFromEntryPath, i as readCurrentObservedDaemonRuntimeStatus, j as readDaemonActiveBundleState, n as getEffectiveDaemonRuntimeStatus, o as resolveDaemonServiceManagerForRuntimeState, p as extractDaemonCommandEntryPath, r as readCurrentDaemonRuntimeContext, s as waitForDaemonSystemServiceToStop, t as clearDaemonRuntimeStateIfDefinitelyStopped, u as cleanupLegacySharedDaemonServiceState, v as isOpenMeldManagedBinaryPath } from "./daemon-service-runtime-LFoUNQQu.js";
-import { r as readWindowsManagedCliInstallation } from "./windows-managed-install-Db8X1tQ4.js";
-import { S as resolveDaemonServiceManager, _ as readDaemonServiceJobCrashExitCode, a as disableDaemonServiceAutostartIfConfigured, c as getDaemonSystemServiceLogPath, f as isDaemonServiceJobSpawnPending, o as formatDaemonServiceJobDiagnosticsEvidence, s as getDaemonServiceLaunchdLabel } from "./daemon-service-manager-BDIsfrfx.js";
-import { A as DEFAULT_RECONNECT_DELAY_MS, C as CONTROLLED_SHUTDOWN_SOCKET_CLOSE_TIMEOUT_MS, D as DAEMON_STREAM_CONNECT_TIMEOUT_MS, F as REGISTER_RESPONSE_TIMEOUT_MS, I as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS, L as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS, M as MAX_RECONNECT_DELAY_MS, N as PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS, O as DAEMON_STREAM_KEEPALIVE_INTERVAL_MS, P as PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS, R as RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS, _ as toErrorMessage$6, b as CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS, c as normalizeHeartbeatIntervalMs, d as normalizeText$1, f as nowIsoString, i as resolvePreferredDaemonDeviceId, j as HEARTBEAT_RESPONSE_TIMEOUT_MS, k as DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS, n as ensureDaemonRuntimePaths, r as resolveDaemonDeviceId, s as emitRunLine, u as normalizeOptionalText$1, v as warnDaemonEvent, w as DAEMON_RUNTIME_CONTRACT_EPOCH, x as CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS, y as CATALOG_SYNC_RETRY_INTERVAL_MS } from "./daemon-device-id-C3UTBv9T.js";
-import { $ as buildDaemonServiceDependencyTitle, At as DAEMON_SERVICE_FULL_ALIGNMENT_ANOMALIES, C as formatDaemonServiceRefreshReliabilityMessage, Ct as ensureDaemonRuntimeContractState, D as writeDaemonStartFailureState, Dt as isVersionDowngrade, E as clearDaemonStartFailureState, Et as resolveDaemonServiceAlignmentDecision, Ft as resolveCurrentDaemonExpectedVersion, It as resolveServiceUpdateUrgency, Lt as assessServerRequiredVersion, Nt as classifyDaemonServiceRunStartability, Pt as classifyDaemonServiceWakeability, Q as buildDaemonServiceDependencySummary, Rt as describeServerRequiredVersionUnavailableReason, S as buildDaemonServiceUpdateRequiredNextStep, Tt as buildDaemonServiceTargetSpec, Ut as ensureDaemonSystemServiceCommandFiles, Vt as assessCliUpdate, W as resolveLocalServiceDemand, Wt as resolveInstalledDaemonSystemServiceCommandSpec, X as buildDaemonServiceDependencyMeaning, Y as buildDaemonServiceDependencyDetails, Z as buildDaemonServiceDependencyNextStep, _t as readCurrentDaemonOwnerSnapshot, a as isDaemonInventoryRunningAndStartReady$1, bt as summarizeDaemonOwnerSnapshot, c as waitForSystemServiceStartup$1, ct as writeOpenMeldToolsMaintenancePolicy, d as captureDaemonServiceEvidenceBestEffort, et as resolveDaemonServiceDependencyDiagnostics, f as formatDaemonFailureContextText, ft as uninstallDaemonServiceUpdateWorker, g as resolveServiceReadiness, gt as hasActiveDaemonOwners, h as resolveDaemonStatusAuthenticationAttention, ht as formatDaemonOwnerSummaryLabel, i as runDaemonServiceLifecycle, jt as DAEMON_SERVICE_REPAIR_ANOMALIES, kt as DAEMON_SERVICE_AUTO_HEAL_ANOMALIES, l as startDaemonSystemServiceWithAutoRepair, lt as ensureDaemonServiceMaintenanceInstalled, m as resolveDaemonStatusAttention, mt as buildDaemonOwnerSnapshotFromObservedState, n as scheduleDaemonServiceUpdate, nt as createOpenMeldToolsUpdateCoordinator, o as isSystemServiceStartupTimeoutError, ot as readOpenMeldToolsMaintenancePolicy, p as resolveDaemonStatusSnapshot, pt as inspectDaemonServiceInventory, r as DaemonServiceLifecycleDrainTimeoutError, s as resolveSystemServiceStartupWaitMs, st as resolveOpenMeldToolsMaintenanceProjection, tt as writeDaemonServiceContract, u as captureDaemonServiceEvidence, v as buildDaemonServiceRefreshNextStep, vt as resolveDaemonStopStrategy, w as formatDaemonServiceUpdateRequiredMessage, wt as readDaemonRuntimeContractRepairReport, x as buildDaemonServiceStatusReadOnlyDetail, y as buildDaemonServiceRefreshPromptMessage, yt as resolveStoppedContractWriteBlockedReason } from "./daemon-service-update-coordinator-4WJr8-5_.js";
-import { Ct as buildAgentOverviewFromContract, Q as getCommandEntryContract, ht as validateDaemonControlTargetInput, t as createAuthLoginGuideError } from "./dual-view-guide-catalog-3LaB18SR.js";
-import { a as formatDaemonServiceDowngradeBlockedRecommendation, d as formatDaemonServiceMissingStatus, f as getDaemonDowngradeBlockedTitle, g as canUseInteractivePrompts, h as resolveOpenMeldToolsUpdateOperationProjection, l as formatDaemonServiceMissingRunStepOne, n as resolveElapsedTimeMs, o as formatDaemonServiceMissingAction, r as formatDaemonDowngradeBlockedNextStep, s as formatDaemonServiceMissingMeaning, t as formatElapsedTime, u as formatDaemonServiceMissingRunStepTwo } from "./elapsed-time-CGeKqTzX.js";
-import { E as queryOpenCodeReadOnly, K as buildRepositoryFingerprint, W as createServiceGitEnvironment, _ as sendDaemonFrame, at as emitDaemonDispatchJournalEvent, ct as readComputerFileAccessPolicy, dt as isSameOrDescendantPath, g as parseDaemonFrame, h as handleDaemonTransportFrame, it as resolveNextRuntimeAgentControllerReportSyncAtMs, k as resolveOpenCodeDatabasePath, lt as resolveComputerFileAccessStorePath, m as createCodexJsonRpcClient, n as assertDispatchOwnedRuntimeServiceMutationAllowed, st as ComputerFileAccessStoreError, ut as updateComputerFileAccessPolicy, v as collectObservedSessionWorkingDirectories } from "./dispatch-owned-runtime-BTK0uuOV.js";
-import { n as createExecutionHostClient, t as ExecutionHostError } from "./channel-7iF6DSp4.js";
-import { t as childExecutionHostChannel } from "./process-channel-DILzf1ek.js";
-import { m as hashBundledSkillAssets, p as computeDirectoryContentHash, u as loadSelectedSkillAssets } from "./state-BlZXA4Rd.js";
-import { n as collectSkillsReadinessSnapshot } from "./installation-inventory-CvtmIZj8.js";
+import { c as buildRequestAuthHeaders, i as AuthRequestCredentialError, l as canAttachAuthTokenToRequest, o as buildOpenMeldProfileRequestHeadersWithAuth, p as deriveAuthBaseUrlFromGatewayUrl, t as createCliApiClientFoundation, u as fingerprintRequestAuthorization } from "./api-client-foundation-a7D_P57X.js";
+import { i as readDaemonServiceContract, n as isDaemonServiceContractIdentityReusable, o as upsertDaemonServiceContract, t as clearDaemonServiceContract } from "./daemon-service-contract-D9Gs4YVs.js";
+import { i as writeDaemonRuntimeLease, r as readDaemonRuntimeLease } from "./daemon-runtime-lease-Bu1vPY5k.js";
+import { t as resolveOpenMeldEnvironmentTarget } from "./openmeld-environment-target-oDaSSRO3.js";
+import { t as admitServiceAccountStop } from "./service-account-authorization-Dh5cBGYr.js";
+import { S as requestLocalDaemonShutdown, c as runWithDaemonLifecycleCommandJournal, d as compareSemver, i as readLatestDaemonLifecycleOriginEvent, l as OPENMELD_VERSION, n as formatDaemonLifecycleOriginSummary, o as resolveRecentDaemonSignalStopCause, r as readLatestDaemonLifecycleConnectionStateEvent, s as runDaemonServiceManagerAction, t as emitDaemonLifecycleEvent, w as sendLocalDaemonControlPlaneRequest, x as requestLocalDaemonServiceUpdateReadiness, y as LocalDaemonControlPlaneClientError } from "./daemon-lifecycle-journal-DfYlngmT.js";
+import { A as prepareDaemonServiceBundle, G as readManagedCliInstallation, M as resolveAlignedDaemonActiveBundleEntryPath, N as resolveDaemonBundleEntryPathFromState, a as resolveDaemonRuntimeState, b as cleanupInactiveDaemonServiceBundles, f as listDaemonOwnedProcesses, h as resolveDaemonBundleIdFromEntryPath, i as readCurrentObservedDaemonRuntimeStatus, j as readDaemonActiveBundleState, n as getEffectiveDaemonRuntimeStatus, o as resolveDaemonServiceManagerForRuntimeState, p as extractDaemonCommandEntryPath, r as readCurrentDaemonRuntimeContext, s as waitForDaemonSystemServiceToStop, t as clearDaemonRuntimeStateIfDefinitelyStopped, u as cleanupLegacySharedDaemonServiceState, v as isOpenMeldManagedBinaryPath } from "./daemon-service-runtime-Dk8OyRtf.js";
+import { r as readWindowsManagedCliInstallation } from "./windows-managed-install-Do1KTI4o.js";
+import { S as resolveDaemonServiceManager, _ as readDaemonServiceJobCrashExitCode, a as disableDaemonServiceAutostartIfConfigured, c as getDaemonSystemServiceLogPath, f as isDaemonServiceJobSpawnPending, o as formatDaemonServiceJobDiagnosticsEvidence, s as getDaemonServiceLaunchdLabel } from "./daemon-service-manager-ChWTp6s8.js";
+import { A as DEFAULT_RECONNECT_DELAY_MS, C as CONTROLLED_SHUTDOWN_SOCKET_CLOSE_TIMEOUT_MS, D as DAEMON_STREAM_CONNECT_TIMEOUT_MS, F as REGISTER_RESPONSE_TIMEOUT_MS, I as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS, L as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS, M as MAX_RECONNECT_DELAY_MS, N as PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS, O as DAEMON_STREAM_KEEPALIVE_INTERVAL_MS, P as PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS, R as RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS, _ as toErrorMessage$6, b as CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS, c as normalizeHeartbeatIntervalMs, d as normalizeText$1, f as nowIsoString, i as resolvePreferredDaemonDeviceId, j as HEARTBEAT_RESPONSE_TIMEOUT_MS, k as DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS, n as ensureDaemonRuntimePaths, r as resolveDaemonDeviceId, s as emitRunLine, u as normalizeOptionalText$1, v as warnDaemonEvent, w as DAEMON_RUNTIME_CONTRACT_EPOCH, x as CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS, y as CATALOG_SYNC_RETRY_INTERVAL_MS } from "./daemon-device-id-Dd-E5NjT.js";
+import { $ as buildDaemonServiceDependencyTitle, At as DAEMON_SERVICE_FULL_ALIGNMENT_ANOMALIES, C as formatDaemonServiceRefreshReliabilityMessage, Ct as ensureDaemonRuntimeContractState, D as writeDaemonStartFailureState, Dt as isVersionDowngrade, E as clearDaemonStartFailureState, Et as resolveDaemonServiceAlignmentDecision, Ft as resolveCurrentDaemonExpectedVersion, Gt as resolveInstalledDaemonSystemServiceCommandSpec, Ht as assessCliUpdate, It as resolveServiceUpdateUrgency, Lt as assessServerRequiredVersion, Nt as classifyDaemonServiceRunStartability, Pt as classifyDaemonServiceWakeability, Q as buildDaemonServiceDependencySummary, Rt as describeServerRequiredVersionUnavailableReason, S as buildDaemonServiceUpdateRequiredNextStep, Tt as buildDaemonServiceTargetSpec, W as resolveLocalServiceDemand, Wt as ensureDaemonSystemServiceCommandFiles, X as buildDaemonServiceDependencyMeaning, Y as buildDaemonServiceDependencyDetails, Z as buildDaemonServiceDependencyNextStep, _t as readCurrentDaemonOwnerSnapshot, a as isDaemonInventoryRunningAndStartReady$1, bt as summarizeDaemonOwnerSnapshot, c as waitForSystemServiceStartup$1, ct as writeOpenMeldToolsMaintenancePolicy, d as captureDaemonServiceEvidenceBestEffort, et as resolveDaemonServiceDependencyDiagnostics, f as formatDaemonFailureContextText, ft as uninstallDaemonServiceUpdateWorker, g as resolveServiceReadiness, gt as hasActiveDaemonOwners, h as resolveDaemonStatusAuthenticationAttention, ht as formatDaemonOwnerSummaryLabel, i as runDaemonServiceLifecycle, jt as DAEMON_SERVICE_REPAIR_ANOMALIES, kt as DAEMON_SERVICE_AUTO_HEAL_ANOMALIES, l as startDaemonSystemServiceWithAutoRepair, lt as ensureDaemonServiceMaintenanceInstalled, m as resolveDaemonStatusAttention, mt as buildDaemonOwnerSnapshotFromObservedState, n as scheduleDaemonServiceUpdate, nt as createOpenMeldToolsUpdateCoordinator, o as isSystemServiceStartupTimeoutError, ot as readOpenMeldToolsMaintenancePolicy, p as resolveDaemonStatusSnapshot, pt as inspectDaemonServiceInventory, r as DaemonServiceLifecycleDrainTimeoutError, s as resolveSystemServiceStartupWaitMs, st as resolveOpenMeldToolsMaintenanceProjection, tt as writeDaemonServiceContract, u as captureDaemonServiceEvidence, v as buildDaemonServiceRefreshNextStep, vt as resolveDaemonStopStrategy, w as formatDaemonServiceUpdateRequiredMessage, wt as readDaemonRuntimeContractRepairReport, x as buildDaemonServiceStatusReadOnlyDetail, y as buildDaemonServiceRefreshPromptMessage, yt as resolveStoppedContractWriteBlockedReason, zt as readCurrentLocalRuntimeReplyReadiness } from "./daemon-service-update-coordinator-CyvjkmsR.js";
+import { Ct as buildAgentOverviewFromContract, Q as getCommandEntryContract, ht as validateDaemonControlTargetInput, t as createAuthLoginGuideError } from "./dual-view-guide-catalog-CSV_FNr4.js";
+import { a as formatDaemonServiceDowngradeBlockedRecommendation, d as formatDaemonServiceMissingStatus, f as getDaemonDowngradeBlockedTitle, g as canUseInteractivePrompts, h as resolveOpenMeldToolsUpdateOperationProjection, l as formatDaemonServiceMissingRunStepOne, n as resolveElapsedTimeMs, o as formatDaemonServiceMissingAction, r as formatDaemonDowngradeBlockedNextStep, s as formatDaemonServiceMissingMeaning, t as formatElapsedTime, u as formatDaemonServiceMissingRunStepTwo } from "./elapsed-time-DFp-tAB8.js";
+import { E as queryOpenCodeReadOnly, K as buildRepositoryFingerprint, W as createServiceGitEnvironment, _ as sendDaemonFrame, at as emitDaemonDispatchJournalEvent, ct as readComputerFileAccessPolicy, dt as isSameOrDescendantPath, g as parseDaemonFrame, h as handleDaemonTransportFrame, it as resolveNextRuntimeAgentControllerReportSyncAtMs, k as resolveOpenCodeDatabasePath, lt as resolveComputerFileAccessStorePath, m as createCodexJsonRpcClient, n as assertDispatchOwnedRuntimeServiceMutationAllowed, st as ComputerFileAccessStoreError, ut as updateComputerFileAccessPolicy, v as collectObservedSessionWorkingDirectories } from "./dispatch-owned-runtime-rL1dMpSL.js";
+import { n as createExecutionHostClient, t as ExecutionHostError } from "./channel-D-a2qCEW.js";
+import { t as childExecutionHostChannel } from "./process-channel-B6Y2-Xau.js";
+import { m as hashBundledSkillAssets, p as computeDirectoryContentHash, u as loadSelectedSkillAssets } from "./state-B3ORUW8a.js";
+import { n as collectSkillsReadinessSnapshot } from "./installation-inventory-87Vo7lnz.js";
 import { createHash, randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
@@ -6482,7 +6482,7 @@ async function runDaemonSocketSession(input) {
 	let consecutiveHeartbeatFailures = 0;
 	let catalogSyncSignalTimer = null;
 	let currentHeartbeatIntervalMs = normalizeHeartbeatIntervalMs(input.heartbeatIntervalMs);
-	let activeConnectionGeneration = Math.max(1, input.reconnectAttempt + 1);
+	let activeConnectionGeneration = input.connectionGeneration ?? 1;
 	let nextCatalogSyncAtMs = 0;
 	let nextProviderConversationProofSyncAtMs = 0;
 	let nextRuntimeAgentControllerReportSyncAtMs = 0;
@@ -6953,7 +6953,7 @@ async function runDaemonSocketSession(input) {
 		});
 	});
 	const registerDaemonSession = async (routeCatalog) => {
-		const connectionGeneration = Math.max(1, input.reconnectAttempt + 1);
+		const connectionGeneration = activeConnectionGeneration;
 		const localComponentsStatus = readSessionLocalComponentsStatus();
 		const registerPayload = runtimeTransportRegisterSessionRequestSchema.safeParse({
 			v: 1,
@@ -7688,8 +7688,17 @@ async function runDaemonSocketSession(input) {
 			throw error;
 		})]);
 		const result = await input.executionHost.call("settleResults", {}).catch(input.failHostShutdown);
-		if (finalHeartbeatError) throw finalHeartbeatError;
-		if (result.status === "connection_closed") return false;
+		if (finalHeartbeatError) emitRunLine({
+			presenter: input.presenter,
+			code: "daemon.run.controlled_shutdown_offline_unconfirmed",
+			text: "Local work drained. The cloud did not confirm the final offline update.",
+			payload: { errorMessage: toErrorMessage$6(finalHeartbeatError) }
+		});
+		if (result.status === "connection_closed") emitRunLine({
+			presenter: input.presenter,
+			code: "daemon.run.controlled_shutdown_results_preserved",
+			text: "Local work drained. Pending results remain on disk for the next Service start."
+		});
 		if (result.status === "timeout") emitRunLine({
 			presenter: input.presenter,
 			code: "daemon.run.controlled_shutdown_result_ack_timeout",
@@ -7980,7 +7989,7 @@ async function resolveLocalComponentsInstallationSource(input = {}) {
 //#region src/local-components/manifest.ts
 const OPENMELD_CLI_COMMAND_CONTRACT_VERSION = "openmeld-cli-command-contract-2026-09-project-work-v1";
 const OPENMELD_SKILLS_CONTRACT_VERSION = "openmeld-skills-contract-2026-09-explicit-space-recipients-v1";
-const OPENMELD_SERVICE_CONTRACT_VERSION = "openmeld-service-contract-2026-09-project-work-v1";
+const OPENMELD_SERVICE_CONTRACT_VERSION = "openmeld-service-contract-2026-10-auth-freshness-v1";
 const LOCAL_COMPONENTS_SNAPSHOT_FILE = "local-components.json";
 const SERVICE_COMPONENT_UPDATE_CODES = /* @__PURE__ */ new Set([
 	"version_outdated",
@@ -8504,6 +8513,13 @@ function createControlledShutdownCoordinator(input) {
 	};
 	return {
 		failHostShutdown,
+		isDraining: () => shutdownAttempt !== null || input.isStopRequested(),
+		async completeQuiescentStop() {
+			if (!shutdownAttempt || input.hasUndrainedWork()) return false;
+			await this.waitForDrain();
+			this.handleSessionCompleted();
+			return true;
+		},
 		waitForDrain() {
 			hostDrain ??= input.drainHost().catch((error) => {
 				hostDrain = null;
@@ -8647,6 +8663,27 @@ async function launchAccountExecutionHost(input) {
 		})
 	});
 }
+async function finishDisconnectedControlledStop(input) {
+	if (input.stopRequested) return true;
+	if (!input.controlledShutdown.isDraining()) return false;
+	try {
+		await input.executionHost.call("health", {});
+	} catch (error) {
+		emitRunLine({
+			presenter: input.presenter,
+			code: "daemon.run.controlled_shutdown_host_unconfirmed",
+			text: `Local work is not confirmed drained: ${toErrorMessage$6(error)}`
+		});
+		return false;
+	}
+	if (!await input.controlledShutdown.completeQuiescentStop()) return false;
+	emitRunLine({
+		presenter: input.presenter,
+		code: "daemon.run.controlled_shutdown_offline",
+		text: "Local work drained. Pending results remain on disk for the next Service start."
+	});
+	return true;
+}
 const runAccountBoundDaemonServiceLoop = async (input) => {
 	await assertDaemonServiceLaunchScope();
 	const baseUrl = await resolveBaseUrl(input.baseUrl);
@@ -8739,6 +8776,7 @@ const runAccountBoundDaemonServiceLoop = async (input) => {
 	let stopRequested = false;
 	const reconnectBackoffDelay = createStopAwareDelay();
 	let reconnectAttempt = 0;
+	let connectionGeneration = 0;
 	let activeSocket = null;
 	let activeCredentialFingerprint = null;
 	const recoverRuntimeReportingAuthentication = createRuntimeReportingAuthenticationRecovery({ requestCarrierHandshake: () => {
@@ -8769,7 +8807,7 @@ const runAccountBoundDaemonServiceLoop = async (input) => {
 		},
 		hasUndrainedWork: () => {
 			const observed = executionHost.snapshot();
-			return !(executionHost.available() && observed?.localQuiescent) || observed.unacknowledgedResultCount > 0;
+			return !(executionHost.available() && observed?.localQuiescent);
 		},
 		isStopRequested: () => stopRequested,
 		markStopping: () => {
@@ -8803,7 +8841,7 @@ const runAccountBoundDaemonServiceLoop = async (input) => {
 			accountCheckedServiceControl: isPreciseProcessStartIdentity(CURRENT_PROCESS_START_IDENTITY),
 			healthPayload: {
 				checkedAt: nowIsoString(),
-				...toHealthProjection(stopRequested ? {
+				...toHealthProjection(controlledShutdown.isDraining() ? {
 					...connectionState.get(),
 					state: "stopping"
 				} : connectionState.get())
@@ -9007,6 +9045,7 @@ const runAccountBoundDaemonServiceLoop = async (input) => {
 					presenter: input.presenter,
 					persistRouteCatalogCache: routeCatalogLoader.persist,
 					reconnectAttempt,
+					connectionGeneration: ++connectionGeneration,
 					routeCatalogState,
 					selectLocalFolders: localFolderPicker.selectFolders,
 					socket: ws,
@@ -9026,7 +9065,12 @@ const runAccountBoundDaemonServiceLoop = async (input) => {
 		} catch (error) {
 			activeSocket = null;
 			requestActiveRouteCatalogSync = null;
-			if (stopRequested) break;
+			if (await finishDisconnectedControlledStop({
+				stopRequested,
+				controlledShutdown,
+				executionHost,
+				presenter: input.presenter
+			})) break;
 			recovery ??= {
 				recoveryId: randomUUID(),
 				disconnectedAt: Date.now()
@@ -10372,6 +10416,35 @@ async function waitForDaemonStartupAlignmentSettlement(input) {
 	return null;
 }
 //#endregion
+//#region src/local-service/lifecycle/service-repair-readiness.ts
+async function isRunningServiceRepairHealthy(input) {
+	const observations = await Promise.all([
+		sendLocalDaemonControlPlaneRequest({
+			request: {
+				v: 1,
+				command: "health"
+			},
+			timeoutMs: 3e3
+		}),
+		readCurrentLocalRuntimeReplyReadiness({ gatewayUrl: input.gatewayUrl }),
+		requestLocalDaemonServiceUpdateReadiness({ timeoutMs: 3e3 })
+	]).catch((error) => {
+		console.warn("[openmeld.service.repair_probe_failed]", { error: toErrorMessage$5(error) });
+		return null;
+	});
+	if (!observations) return false;
+	const [health, readiness] = observations;
+	return health.code === "service.health" && health.payload.state === "ok" && isServiceRepairReadinessCurrent({
+		...input,
+		readiness
+	});
+}
+function isServiceRepairReadinessCurrent(input) {
+	const { readiness } = input;
+	const host = readiness.service.executionHost;
+	return readiness.currentTarget.availability === "resolved" && readiness.currentTarget.deviceId === input.deviceId && readiness.currentTarget.runtimeLane === input.runtimeLane && readiness.service.connected && readiness.service.matchingCurrentRuntime && readiness.service.sessionDeviceId === input.deviceId && readiness.service.sessionLane === input.runtimeLane && readiness.service.executionCompatibility?.status === "compatible" && host?.responsive === true && host.admission === "open" && host.startupReplayPending === false;
+}
+//#endregion
 //#region src/local-service/status/daemon-local-status-snapshot.ts
 async function resolveDaemonLocalStatusSnapshot() {
 	const daemonStatus = await getDaemonStatus();
@@ -12684,6 +12757,17 @@ async function waitForSystemServiceStartup(input) {
 //#endregion
 //#region src/commands/service-stop-command.ts
 const STOP_WAIT_MS = 2e3;
+async function persistUserStopIntent(pid) {
+	const contract = await readDaemonServiceContract();
+	if (!contract) return;
+	const lease = await readDaemonRuntimeLease();
+	if (!lease || pid !== lease.pid || lease.generation !== contract.generation || lease.bundleId !== contract.bundleId) throw new Error("The Service owner changed. Check Service status before trying Stop again.");
+	await upsertDaemonServiceContract({
+		...contract,
+		desiredState: "stopped",
+		autoStart: false
+	}, {}, { expectedCurrentContract: contract });
+}
 function summarizeDaemonStopJournalResult(stopResult) {
 	switch (stopResult.status) {
 		case "stopped": return {
@@ -12835,10 +12919,24 @@ async function stopManagedCurrentLaneDaemonService(input) {
 		signal: "system"
 	};
 }
+async function canRestoreUnsentStopAutostart(error, wasEnabled) {
+	return wasEnabled && error instanceof LocalDaemonControlPlaneClientError && error.code === "daemon.control.endpoint_missing" && (await readDaemonServiceContract())?.desiredState !== "stopped";
+}
+async function settleFailedStopAutostart(input) {
+	const message = toErrorMessage$5(input.error);
+	if (!await canRestoreUnsentStopAutostart(input.error, input.wasEnabled)) return message;
+	try {
+		await input.serviceManager.enableAutostart();
+		return message;
+	} catch (restoreError) {
+		return `${message}; could not restore autostart: ${toErrorMessage$5(restoreError)}`;
+	}
+}
 async function prepareManagedDaemonServiceForStop(input) {
 	const serviceManager = input.ownerSnapshot.serviceManager;
 	if (!serviceManager) return null;
-	const shouldRestoreAutostart = await disableDaemonServiceAutostartIfConfigured({
+	if (input.mode === "interactive") await persistUserStopIntent(input.ownerSnapshot.runtimeStatus.pid);
+	const wasEnabled = await disableDaemonServiceAutostartIfConfigured({
 		manager: serviceManager,
 		status: input.ownerSnapshot.serviceManagerStatus
 	});
@@ -12881,13 +12979,12 @@ async function prepareManagedDaemonServiceForStop(input) {
 			type: "stop.controlled_drain"
 		});
 		if (isCompatibilityFallback) return null;
-		let errorMessage = toErrorMessage$5(error);
-		if (shouldRestoreAutostart) try {
-			await serviceManager.enableAutostart();
-		} catch (restoreError) {
-			errorMessage = `${errorMessage}; failed to restore service autostart: ${toErrorMessage$5(restoreError)}`;
-		}
-		if (input.mode !== "best_effort") throw new Error(`OpenMeld Service stayed running because its final offline status could not be delivered: ${errorMessage}`);
+		const errorMessage = await settleFailedStopAutostart({
+			error,
+			wasEnabled,
+			serviceManager
+		});
+		if (input.mode !== "best_effort") throw new Error(`Stop is not confirmed and may still be in progress. Check Service status before retrying. ${errorMessage}`);
 		return buildDaemonStopWarningResult({
 			reason: "stop_failed",
 			runtimeStatus: input.ownerSnapshot.runtimeStatus,
@@ -13028,6 +13125,7 @@ async function stopCurrentLaneDaemonProcess(input) {
 	}
 	const stopSignal = await resolveDaemonStopSignal(input);
 	if (!stopSignal) return { status: "cancelled" };
+	if (input.mode === "interactive") await persistUserStopIntent(daemonPid);
 	try {
 		return await requestDaemonProcessStop({
 			daemonPid,
@@ -14108,6 +14206,11 @@ async function resolveAlreadyHealthyDaemonRepair(input) {
 	if (effectiveRuntimeStatus === "running") serviceState = "running";
 	else if (effectiveRuntimeStatus === "not_running") serviceState = "stopped";
 	if (!serviceState || desiredState === "background" && serviceState !== "running" || desiredState === "stopped" && serviceState !== "stopped") return null;
+	if (serviceState === "running" && !await isRunningServiceRepairHealthy({
+		deviceId: inventory.serviceContract.deviceId,
+		runtimeLane: inventory.serviceContract.lane,
+		gatewayUrl: inventory.serviceContract.gatewayUrl
+	})) return null;
 	return createDaemonReinstallAlreadyHealthyOutcome({
 		desiredState,
 		serviceState
@@ -14138,7 +14241,11 @@ async function waitForDaemonHealthyAfterReinstall(input) {
 			intent: "reinstall",
 			readDaemonStatus: input.readDaemonStatus
 		}).catch(() => null);
-		if (inventory && isDaemonInventoryRunningAndAligned(inventory)) return inventory.runtimeStatus;
+		if (inventory?.serviceContract && isDaemonInventoryRunningAndAligned(inventory) && await isRunningServiceRepairHealthy({
+			deviceId: inventory.serviceContract.deviceId,
+			runtimeLane: inventory.serviceContract.lane,
+			gatewayUrl: inventory.serviceContract.gatewayUrl
+		})) return inventory.runtimeStatus;
 		lastRuntime = inventory?.runtimeStatus ?? await readCurrentObservedDaemonRuntimeStatus();
 		await sleep(REINSTALL_VERIFY_POLL_MS);
 	}
@@ -14226,16 +14333,19 @@ async function runDaemonStatus(input) {
 	if (input.json === true) {
 		const environmentTarget = await resolveOpenMeldEnvironmentTarget({ gatewayUrl: input.gatewayUrl });
 		const localSnapshot = await resolveDaemonLocalStatusSnapshot();
-		const snapshot = await resolveDaemonStatusSnapshot({
-			localSnapshot,
-			runtime
-		});
-		const channelAssessment = await assessCliUpdate({ environmentTarget });
+		const [snapshot, channelAssessment, serverAssessment] = await Promise.all([
+			resolveDaemonStatusSnapshot({
+				localSnapshot,
+				runtime
+			}),
+			assessCliUpdate({ environmentTarget }),
+			assessServerRequiredVersion({ gatewayUrl: environmentTarget.gatewayUrl })
+		]);
 		emitCliJsonEnvelope(buildDaemonStatusJsonPayload({
 			cliVersion: toDaemonStatusCliVersionPayload(channelAssessment),
 			environmentTarget,
 			localSnapshot,
-			serverRequirementAssessment: await assessServerRequiredVersion({ gatewayUrl: environmentTarget.gatewayUrl }),
+			serverRequirementAssessment: serverAssessment,
 			serverRequirementChannelAssessment: channelAssessment,
 			snapshot
 		}));
@@ -16660,4 +16770,4 @@ function parseDaemonRunMode(rawMode) {
 //#endregion
 export { buildAuthStatusSnapshot as $, buildDaemonStartNeedsAttentionCard as A, resolveDaemonServiceParticipationStatus as B, buildProfileWorkspaceRows as C, createDelayedSpinner as D, emitDaemonAgentOverview as E, emitCliJsonEnvelope as F, ensureCommandAuthenticationOrCancel as G, validateLocalProjectConnectionPath as H, runDaemonStartupPreflight as I, runAuthLogout as J, evaluateCommandAuthentication as K, readDaemonIncidentLogTail as L, buildHumanErrorCopy as M, renderHumanErrorCard as N, shouldEmitAgentOverview as O, renderHumanTextErrorCard as P, buildAuthStatusRows as Q, resolveLocalComponentsStatus as R, buildProfileWorkspacePresentation as S, createQuietPresenter as T, connectWebSocket as U, LocalProjectConnectionError as V, buildCommandAuthenticationPromptMessage as W, runAuthStatus as X, runAuthMenu as Y, exchangeOneTimeTokenAuthSession as Z, buildDaemonBackgroundStartFailure as _, resolveDeviceTokenExpiresAt as _t, runDaemonBackgroundStartForDecision as a, promptTextEntry as at, formatServiceRuntimeHeadline as b, runDaemonInterrupt as c, finishCurrentCommandCheckScope as ct, runDaemonServiceDetached as d, resetCurrentCommandCheckState as dt, formatActiveOrganizationLabel as et, runDaemonSnapshot as f, startCurrentCommandCheckScope as ft, runDaemonUninstall as g, resolveDeviceAuthClientId as gt, runDaemonTeardownStrict as h, requestDeviceToken as ht, runDaemonAutostart as i, buildUnifiedCardFrame as it, runDaemonStartDecisionPrompt as j, buildDaemonStartDeferredCard as k, runDaemonReinstall as l, getCurrentCommandCheckState as lt, runDaemonStop as m, fetchAuthUserSnapshot as mt, isManagedSystemServiceBootstrapRun as n, renderInfoCard as nt, runDaemonCancel as o, isReturnKeypress as ot, runDaemonStatusFlow as p, extractAuthApiErrorMessage as pt, runAuthLogin as q, runDaemon as r, renderTextInfoCard as rt, runDaemonInstall as s, runInteractivePrompt as st, bestEffortStopCurrentLaneDaemonService as t, buildTextInfoCardLines as tt, runDaemonRunAfterEntryChecks as u, isCurrentCommandCheckScopeActive as ut, buildSystemServiceStartupFailureReportFromVerdict as v, revokeAuthAccessToken as vt, reconcileCliVersionView as w, resolveServiceParticipationReadiness as x, formatServiceParticipationReadinessLabel as y, writeInstalledLocalComponentsSnapshot as z };
 
-//# sourceMappingURL=service-BNpxWxYQ.js.map
+//# sourceMappingURL=service-Cz9hwU7z.js.map