[incognitojam]

Remote and combined updates asked for confirmation even when every affected thread would resume. Proceed directly only when every required activity check succeeds and no work would be interrupted. Quit retains its existing active-work confirmation.

Carry explicit consent through the update request and recheck unconfirmed updates before the final service or desktop handoff. New terminal work, waiting requests, non-continuable threads, provider installs, shared devices, or failed inspections require consent; a changed remote desktop keeps its download ready for a confirmed retry. Rechecks after provider installation stay silent unless they find a blocker. Older or incomplete desktop coverage still requires confirmation.

Exercised safe service and remote desktop updates, mixed safe/unsafe hosts, cancellation, late results, new blockers during preparation, omitted consent, exact-version local installs, and retry after a refused handoff. A real browser pass kept the later safe check invisible and dispatched the update; a newly discovered blocker produced one actionable confirmation and Cancel dispatched nothing. Service and native updater harnesses exercised authoritative handoff checks. Actual OS installer relaunch and native mobile rendering were not performed; a local mobile type check is blocked by the pre-existing missing react-native-pdf-jsi dependency.

Depends on #1079. The preceding layers are #1077 (local restart policy), #1078 (combined dialog and single local consent), and #1079 (remote desktop coverage). Skipped-result summaries are independent in #1076.

Known limitation: selecting two environments owned by the same remote desktop can repeat anonymous sibling counts. This is conservative and does not permit an unsafe restart.

---

Written by an agent (Codex, gpt-6.1-sol).

[github-actions]

Upstream divergence

Both sides are compared with upstream at the in-order tip 3982f20ce4. Excludes .repos/ and pnpm-lock.yaml.

Measure	Base	This PR	Change
Upstream files the fork changes	1,691	1,691	0
Lines changed in them	92,612	93,294	+682
Upstream files the fork removes	49	49	0
Fork-only files	667	667	0
Fork-only lines	120,434	121,062	+628

Upstream files whose difference changes (20)

File	Change	Now differs by
apps/web/src/components/ServerUpdateAction.browser.test.tsx	+197	464 lines
apps/server/src/cloud/selfUpdate.test.ts	+179	246 lines
apps/desktop/src/updates/DesktopRemoteUpdates.test.ts	+99	222 lines
apps/server/src/cloud/selfUpdate.ts	+46	65 lines
apps/desktop/src/updates/DesktopUpdates.ts	+41	170 lines
apps/web/src/components/ServerUpdateAction.tsx	+37	461 lines
apps/server/src/desktopUpdate/DesktopAppUpdate.test.ts	+21	140 lines
apps/web/src/components/sidebar/SidebarUpdatePill.tsx	+16	321 lines
docs/user/updating.md	+10	167 lines
apps/desktop/src/updates/DesktopRemoteUpdates.ts	+9	49 lines
packages/contracts/src/resourceTelemetry.ts	+6	123 lines
apps/server/src/desktopUpdate/DesktopAppUpdate.ts	+5	54 lines
apps/server/src/resourceTelemetry/DesktopTelemetryReceiver.ts	+4	60 lines
apps/web/src/components/sidebar/useUpdateEverything.ts	+4	153 lines
apps/desktop/src/ipc/methods/updates.ts	+2	22 lines
packages/contracts/src/server.ts	+2	29 lines
apps/mobile/src/features/settings/SettingsEnvironmentDetailRouteScreen.tsx	+1	106 lines
apps/web/src/components/sidebar/updateEverything.logic.ts	+1	11 lines
docs/user/telemetry.md	+1	113 lines
packages/contracts/src/ipc.ts	+1	78 lines

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	4.9 KiB	—	6.8 KiB	✅
Codex	Thread snapshot wire	—	3.8 KiB	—	4.9 KiB	✅
Codex	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Codex	Live turn WebSocket decoded	—	20.8 KiB	—	29.3 KiB	✅
Codex	Live turn messages	—	1	—	8	✅
Claude	Total thread wire	—	5.0 KiB	—	6.8 KiB	✅
Claude	Thread snapshot wire	—	3.8 KiB	—	4.9 KiB	✅
Claude	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Claude	Live turn WebSocket decoded	—	21.2 KiB	—	29.3 KiB	✅
Claude	Live turn messages	—	1	—	8	✅

Baseline: unavailable · PR result: 4e897f8 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.