chore: merge train 260821 — land #2289 (service restart without re-registering)

README.md

@@ -208,7 +208,7 @@ Qwen Cloud, SiliconFlow, and more. Full list: `ocx init` or the
 ocx init                       # interactive setup (writes config, wires Codex, offers the shim)
 ocx start [--port 10100]       # start the proxy in the foreground
 ocx stop                       # stop + restore native Codex
-ocx service [install|start|stop|status|uninstall|remove]  # background service
+ocx service [install|repair|restart|start|stop|status|uninstall|remove]  # background service
 ocx codex-shim install         # start the proxy on demand whenever `codex` launches
 ocx health [--json]            # check immediate proxy liveness
 ocx ready [--json] [--wait [--timeout <seconds>]]  # check post-sync readiness

devlog/_plan/260821_bug_merge_train/000_triage_matrix.md

@@ -9,7 +9,7 @@ adversarial xai/grok-4.6 subagent verdicts, and a final green dev CI gate.
 | PR | Title | Head | Behind dev | Draft | CI on head | Existing review state |
 |----|-------|------|-----------:|-------|------------|----------------------|
 | #2294 | fix(release): reject credential-bearing SSH remotes | 71598fa45 + hardening 2cdfba24d (train-stacked) | 3 | yes | green | MERGED to train; grok blocker fixed; re-verdict PASS; landing on dev |
-| #2289 | fix(service): restart existing installs w/o re-register | 240fc9364 (fix/2287-service-restart) | 9 | yes | green incl. Service lifecycle | none; Closes #2287 |
+| #2289 | fix(service): restart existing installs w/o re-register | 2df92a270 + locale sync 174f03b60 (train-stacked) | 2 | yes | green incl. Service lifecycle | MERGED to train; grok P2 fixed; re-verdict PASS; Closes #2287 |
 | #2295 | fix(codex): recover zero-byte coordinator remnants | 6d5f0cf2c (ingw/fix-zero-byte-coordinator-2291) | 0 | yes | green | MERGED to train 728ca1e8b; suite green; landing on dev |
 | #2270 | fix(responses): apply_patch on routed Responses | 398b7ade4 (fix/apply-patch-routed-lowering) | 48 | yes | Ingwannu: two CHANGES_REQUESTED resolved on this head; third review says no remaining technical blocker | Linux shards green |
 | #2281 | fix: call_id thought-signature replay for Claude Code | b31f3dbed (fix/claude-code-thought-signature-replay) | 50 | no (review-ready + hygiene-blocked label) | BLOCKED state | CodeRabbit minor: normalize promptCacheKey via anthropicSessionKeyFromParts before storing as clientThreadId (core.ts ~1888-1896); lidge-jun review priority 63/80 confirms repro |

devlog/_plan/260821_bug_merge_train/050_merge_2289.md

@@ -2,3 +2,37 @@
 
 Rebase (9 behind) absorbs #2295's registry.ts/lifecycle.md hunks. Review: bare 'ocx service' idempotency, repair/restart alias routing (src/service.ts, src/cli/registry.ts), Windows WINDOWS_SCHTASKS_CREATE_ACCESS_DENIED path, 8-locale docs consistency.
 Verify: bun test tests/cli-help.test.ts tests/service.test.ts tests/winsw.test.ts, bun run typecheck, FULL SUITE (bun run test) pre-merge; Service lifecycle CI green on head. grok verdict. Merge, push --no-verify, dev CI green. Close #2287 with landing commit.
+
+## Plan (live head 2df92a270 — 2 commits over base 401c24f7; merged into train as 6e1202fa5)
+
+The branch was already rebased by its author onto a recent dev (401c24f7), so
+the historical rebase concern is resolved; the train merge took it cleanly.
+Scope: src/service.ts +136/-, src/cli/registry.ts +5, 8-locale lifecycle.md
+sync, structure doc, focused tests (+89). Steps:
+1. Adversarial review (inherited model): idempotent restart semantics,
+   fail-closed unknown installation state, Windows schtasks access-denied
+   path, docs/behavior parity across locales.
+2. Local gates: service/cli-help/winsw tests, typecheck, privacy:scan.
+3. lidge full suite at merged head; land via train PR to dev; close #2287.
+
+## Review (Euclid, inherited model) — GO-WITH-FIXES (blockers=0) → P2 fixed → re-verdict PASS
+
+Clean: bare `ocx service` idempotency (installed → repair, actively
+refreshed + serving-verified, never silently blessed); unknown-state is a
+pre-validated fail-closed exit(1) with actionable guidance; Windows tri-state
+probe never guesses absence; the #2287 wedge (unknown collapsed into absent →
+elevated re-registration) is genuinely closed.
+
+P2 fixed (commit 174f03b60): English-source Windows fail-closed caveat was
+missing from all 7 translations — added to ko/ja/fr/ru/tr/zh-cn/zh-tw per
+repo docs-sync rule. Re-verdict: PASS.
+
+Accepted residuals (P3, pre-existing or non-blocking): end-to-end
+serviceCommand wiring test, darwin/linux hook-based probe tests, localized
+access-denied markers beyond en/de.
+
+Gates at train head 174f03b60: service/cli-help/winsw tests 174/174 +
+cli-help 13/13, typecheck pass, privacy:scan pass. lidge r8 hit a single
+SIGTERM-shutdown timeout (20s wall cap; known timing-sensitive test, passes
+locally and in isolation on both hosts); full-suite re-run r8b executed as
+the merge gate.

docs-site/src/content/docs/fr/reference/cli/lifecycle.md

@@ -146,15 +146,16 @@ Invalide le cache local du sélecteur de modèles de Codex afin qu’il soit rec
 
 ## Service d’arrière-plan
 
-### `ocx service [install|repair|start|stop|status|uninstall|remove]`
+### `ocx service [install|repair|restart|start|stop|status|uninstall|remove]`
 
 Exécute opencodex comme service d’arrière-plan géré à l’ouverture de session — **launchd** sous macOS, **unité utilisateur systemd** sous Linux et **Task Scheduler** sous Windows — qui démarre automatiquement à la connexion et redémarre après un plantage. Les services définissent `OCX_SERVICE=1` afin qu’un redémarrage ne réécrive pas inutilement la configuration Codex.
 
 | Sous-commande | Action |
 | --- | --- |
-| aucune | Crée ou met à jour le service, puis le démarre. |
+| aucune | Installe et démarre le service s’il est absent ; sinon, actualise et redémarre le service existant sans le réenregistrer. |
 | `install` | Crée et démarre le service. L’enregistrement exige une élévation sous Windows. |
 | `repair` | Actualise sur place un service installé et le redémarre, sans le réenregistrer. |
+| `restart` | Alias de `repair`. |
 | `start` | Démarre un service installé. |
 | `stop` | Arrête le service et rétablit le fonctionnement natif de Codex. |
 | `status` | Affiche les diagnostics du service et du proxy, ainsi que les chemins des journaux. |
@@ -165,10 +166,13 @@ Exécute opencodex comme service d’arrière-plan géré à l’ouverture de se
 ocx service
 ocx service install
 ocx service repair
+ocx service restart
 ocx service status
 ocx service uninstall
 ```
 
+Sous Windows, un `ocx service` nu n'exécute le chemin d'installation qu'après avoir prouvé l'absence à la fois du Task Scheduler et de WinSW. Si l'une des requêtes de statut est inconcluante, il refuse d'enregistrer quoi que ce soit et demande d'exécuter `ocx service status` ; n'utilisez un `ocx service install` explicite qu'après avoir confirmé l'absence.
+
 Avant de signaler une réussite, `install`, `start` et `repair` vérifient, sur les trois plateformes, qu’un proxy répond effectivement sur le port inscrit dans le service installé. Elles attendent jusqu’à 20 secondes, puis affichent le port utilisé :
 
 ```text

docs-site/src/content/docs/ja/reference/cli/lifecycle.md

@@ -150,15 +150,16 @@ Codex のローカル モデル ピッカー キャッシュを無効にし、
 
 ## バックグラウンドサービス
 
-### `ocx service [install|repair|start|stop|status|uninstall|remove]`
+### `ocx service [install|repair|restart|start|stop|status|uninstall|remove]`
 
 opencodex を、ログイン時に自動起動し、クラッシュ時に自動再起動するログイン管理バックグラウンド サービス (macOS **launchd**、Linux **systemd ユーザー ユニット**、Windows **タスク スケジューラ**) として実行します。サービスは `OCX_SERVICE=1` を設定して実行されるため、再起動によって Codex 設定が変更されることはありません。
 
 |サブコマンド |アクション |
 | --- | --- |
-|なし |サービスを作成/更新して開始します。 |
+|なし |未インストールなら作成して開始し、既存なら再登録せずに更新して再起動します。 |
 | `install` |サービスを作成して開始します。 |
 | `repair` | 既存のサービスを再登録せずに更新して再起動します。 |
+| `restart` | `repair` の別名です。 |
 | `start` |インストールされているサービスを開始します。 |
 | `stop` |サービスを停止し、ネイティブ Codex を復元します。 |
 | `status` |サービスとプロキシの診断とログ パスをレポートします。 |
@@ -169,10 +170,13 @@ opencodex を、ログイン時に自動起動し、クラッシュ時に自動
 ocx service
 ocx service install
 ocx service repair
+ocx service restart
 ocx service status
 ocx service uninstall
 ```
 
+Windows では、bare `ocx service` は、タスク スケジューラと WinSW の両方について不在が確認された後にのみ、インストール パスを実行します。どちらかのステータス照会が不確実な場合、何も登録せず、`ocx service status` の実行を案内します。不在を確認した後にのみ、明示的な `ocx service install` を使用してください。
+
 Windows では、`ocx service status` は、ID 検証済みの OpenCodex プロキシの到達可能性とは別に、タスク スケジューラの登録を報告します。ローカライズされた `schtasks` テーブルは出力されないため、概要は Windows コード ページ間で読み取れるままです。
 
 Windows では、タスク スケジューラ エントリを作成するには昇格が必要です。認識されたローカライズされたアクセス拒否テキストは、既存のガイダンス パスを維持します。そのテキストが判読できない場合、フォールバックには、所有されているコマンド形状 `/create /tn opencodex-proxy /xml <non-empty-path> /f`、ステータス 1、および確認済みの非昇格トークンが必要です。ダッシュボードのスタートアップ セーフティ アクションは、UAC を自動的に要求できるようになります。そのフォールバックがトークンの状態を判断できない場合、元のスケジューラ エラーが保持されます。外部タスクおよび操作は、自動昇格マーカーを発行することはできません。ダッシュボードの UAC プロンプトを承認するか、管理者特権の PowerShell ウィンドウで `ocx service install` を再実行します。

docs-site/src/content/docs/ko/reference/cli/lifecycle.md

@@ -193,17 +193,18 @@ Codex의 로컬 모델 선택기 캐시를 무효화하여, 활성 opencodex 카
 
 ## 백그라운드 서비스
 
-### `ocx service [install|repair|start|stop|status|uninstall|remove]`
+### `ocx service [install|repair|restart|start|stop|status|uninstall|remove]`
 
 로그인 관리형 백그라운드 서비스로 opencodex를 실행합니다(macOS **launchd**, Linux **systemd** 사용자
 유닛, Windows **Task Scheduler**). 로그인 시 자동 시작하고 충돌 시 자동 재시작합니다. 서비스 실행은
 `OCX_SERVICE=1`을 설정하므로 재시작해도 Codex 설정이 흔들리지 않습니다.
 
 | 하위 명령 | 동작 |
 | --- | --- |
-| 없음 | 서비스를 생성/업데이트하고 시작합니다. |
+| 없음 | 서비스가 없으면 설치하고 시작하며, 이미 있으면 재등록하지 않고 새로 고쳐 재시작합니다. |
 | `install` | 서비스를 생성하고 시작합니다. |
 | `repair` | 설치된 서비스를 다시 등록하지 않고 제자리에서 새로 고친 뒤 재시작합니다. |
+| `restart` | `repair`의 별칭입니다. |
 | `start` | 설치된 서비스를 시작합니다. |
 | `stop` | 서비스를 중지하고 기본 Codex를 복원합니다. |
 | `status` | 서비스와 프록시 진단, 로그 경로를 보고합니다. |
@@ -214,10 +215,15 @@ Codex의 로컬 모델 선택기 캐시를 무효화하여, 활성 opencodex 카
 ocx service
 ocx service install
 ocx service repair
+ocx service restart
 ocx service status
 ocx service uninstall
 ```
 
+Windows에서는 bare `ocx service`가 Task Scheduler와 WinSW 양쪽 모두 부재가 입증된 후에만 설치
+경로를 실행합니다. 상태 조회 중 하나라도 불확실하면 아무것도 등록하지 않고 `ocx service status`
+실행을 안내합니다. 부재를 확인한 뒤에만 명시적인 `ocx service install`을 사용하세요.
+
 Windows에서는 `ocx service status`가 Task Scheduler 등록 상태를 ID가 검증된 OpenCodex 프록시
 도달 가능성과 별도로 보고합니다. 로컬라이즈된 `schtasks` 표는 출력하지 않으므로, 요약은 Windows
 코드 페이지에서도 읽기 쉽습니다.

docs-site/src/content/docs/reference/cli/lifecycle.md

@@ -215,7 +215,7 @@ same stale-`app-server` warning and optional `--restart-codex` behavior as `ocx
 
 ## Background service
 
-### `ocx service [install|repair|start|stop|status|uninstall|remove]`
+### `ocx service [install|repair|restart|start|stop|status|uninstall|remove]`
 
 Run opencodex as a login-managed background service (macOS **launchd**, Linux **systemd user unit**,
 Windows **Task Scheduler**) that auto-starts on login and auto-restarts on crash. Service runs set
@@ -228,19 +228,25 @@ run `ocx service repair` to refresh the task with the restored package paths.
 
 | Subcommand | Action |
 | --- | --- |
-| none | Create/update and start the service. |
+| none | Install and start when absent; otherwise refresh and restart the existing service without re-registering it. |
 | `install` | Create and start the service. Registers it, which on Windows needs elevation. |
 | `repair` | Refresh an installed service in place and restart it, without re-registering it. |
+| `restart` | Alias of `repair`. |
 | `start` | Start an installed service. |
 | `stop` | Stop the service and restore native Codex. |
 | `status` | Report service and proxy diagnostics plus log paths. |
 | `uninstall` | Remove the service and restore native Codex. |
 | `remove` | Alias of `uninstall`. |
 
+On Windows, a bare `ocx service` runs the install path only after both Task Scheduler and WinSW are
+proven absent. If either status query is inconclusive, it refuses to register anything and asks you
+to run `ocx service status`; use explicit `ocx service install` only after confirming absence.
+
 ```bash
 ocx service
 ocx service install
 ocx service repair
+ocx service restart
 ocx service status
 ocx service uninstall
 ```

docs-site/src/content/docs/ru/reference/cli/lifecycle.md

@@ -209,7 +209,7 @@ opencodex. Предупреждение о stale-`app-server` и optional `--res
 
 ## Фоновая служба
 
-### `ocx service [install|repair|start|stop|status|uninstall|remove]`
+### `ocx service [install|repair|restart|start|stop|status|uninstall|remove]`
 
 Запустить opencodex как login-managed background service (macOS **launchd**, Linux **systemd user
 unit**, Windows **Task Scheduler**), которая автоматически стартует при логине и сама
@@ -218,9 +218,10 @@ unit**, Windows **Task Scheduler**), которая автоматически 
 
 | Подкоманда | Действие |
 | --- | --- |
-| none | Создать/обновить и запустить службу. |
+| none | Установить и запустить службу, если её нет; иначе обновить и перезапустить существующую службу без повторной регистрации. |
 | `install` | Создать и запустить службу. |
 | `repair` | Обновить установленную службу на месте и перезапустить её без повторной регистрации. |
+| `restart` | Псевдоним команды `repair`. |
 | `start` | Запустить уже установленную службу. |
 | `stop` | Остановить службу и восстановить native Codex. |
 | `status` | Показать диагностику службы и прокси, а также пути к логам. |
@@ -231,10 +232,13 @@ unit**, Windows **Task Scheduler**), которая автоматически 
 ocx service
 ocx service install
 ocx service repair
+ocx service restart
 ocx service status
 ocx service uninstall
 ```
 
+На Windows bare `ocx service` выполняет путь установки только после того, как отсутствие подтверждено и для Task Scheduler, и для WinSW. Если любой из запросов статуса не даёт определённого ответа, он отказывается что-либо регистрировать и предлагает выполнить `ocx service status`; явный `ocx service install` используйте только после подтверждения отсутствия.
+
 На Windows `ocx service status` отдельно показывает регистрацию в Task Scheduler и
 identity-проверенную достижимость прокси OpenCodex. Он не печатает локализованную таблицу
 `schtasks`, чтобы сводка оставалась читаемой на любых code page Windows.

docs-site/src/content/docs/tr/reference/cli/lifecycle.md

@@ -232,7 +232,7 @@ ve isteğe bağlı `--restart-codex` davranışı geçerlidir.
 
 ## Arka plan servisi
 
-### `ocx service [install|repair|start|stop|status|uninstall|remove]`
+### `ocx service [install|repair|restart|start|stop|status|uninstall|remove]`
 
 opencodex'i oturum açmada otomatik başlayan ve çökmede otomatik yeniden başlayan
 oturumla yönetilen bir arka plan servisi (macOS **launchd**, Linux **systemd
@@ -242,9 +242,10 @@ yapılandırmasını dalgalandırmaz.
 
 | Alt komut | Eylem |
 | --- | --- |
-| none | Servisi oluşturun/güncelleyin ve başlatın. |
+| none | Servis yoksa kurup başlatın; varsa yeniden kaydetmeden yenileyip yeniden başlatın. |
 | `install` | Servisi oluşturun ve başlatın. Kaydeder, bu da Windows'ta yükseltme gerektirir. |
 | `repair` | Kurulu bir servisi yerinde yenileyin ve yeniden kaydetmeden yeniden başlatın. |
+| `restart` | `repair` komutunun takma adıdır. |
 | `start` | Kurulu bir servisi başlatın. |
 | `stop` | Servisi durdurun ve yerel Codex'i geri yükleyin. |
 | `status` | Servis ve proxy tanılamalarını artı günlük yollarını bildirin. |
@@ -255,10 +256,13 @@ yapılandırmasını dalgalandırmaz.
 ocx service
 ocx service install
 ocx service repair
+ocx service restart
 ocx service status
 ocx service uninstall
 ```
 
+Windows'ta bare `ocx service`, yükleme yolunu ancak Task Scheduler ve WinSW'nin her ikisinin de yok olduğu kanıtlandıktan sonra çalıştırır. Durum sorgularından herhangi biri belirsizse hiçbir şey kaydetmeyi reddeder ve `ocx service status` çalıştırmanızı ister; yalnızca yokluk doğrulandıktan sonra açık `ocx service install` kullanın.
+
 `install`, `start` ve `repair`, başarı bildirmeden önce kurulu servise
 yerleştirilmiş portta bir proxy'nin gerçekten yanıt verdiğini onaylar — her üç
 platformda da. 20 saniyeye kadar beklerler ve ardından sunulan portu
@@ -435,5 +439,3 @@ ocx update --tag preview
 Yeni sürümler, [Sürüm iş
 akışı](https://github.com/lidge-jun/opencodex/actions/workflows/release.yml)
 bunları npm'de yayınladığında kullanılabilir hale gelir.
-
-