[backrunner]

Removing AIPass can leave AI tools pointing at a local proxy that no longer runs. Restore the external configuration writes owned by the uninstalling installation, preserve later user edits, and keep replacement installs attached to the proxy.

• Keep encrypted, device-protected reversal receipts that work with the vault locked. Preserve recovery ownership across ordinary rollback and repeated uninstall; remove dormant proxy entries without changing direct credentials or shared model selections.
• Preflight every resource, apply conservative JSON/TOML three-way restoration, retain encrypted interrupted transactions, and stop on conflicts or unverified originals. Use current archived native credentials only after validating account identity. Redact malformed TOML errors so configuration values cannot enter uninstall logs.
• Serialize writes and startup transaction replay with uninstall. Stop owned services before capturing native originals and reject restoration while an Agent remains on an affected vault. Require protocol 21 so older resident writers cannot bypass recovery receipts.
• Add the explicit macOS uninstaller. Distinguish Windows NSIS replacement through /UPDATE and /AIPASS_REPLACE; fix passive maintenance selection and canonicalize executable aliases when finding owned login entries. Pin the MIT-licensed Tauri template with an upstream hash and reviewed patches.

Validation:

• Native macOS with Homebrew Rust: cargo fmt --all -- --check, cargo clippy --workspace --all-targets -- -D warnings, cargo test --workspace and cargo build --workspace passed. 1254 tests passed with 4 existing ignored tests; the final fixture adjustment was rechecked separately.
• Node 26: frozen install, license audit, lint/repository checks, typecheck, tests and build passed. Embedded control-panel output unchanged.
• Fresh ad hoc signed app, DMG and updater archive: DMG integrity and all five 960x640 startup/update scenarios passed with signature verification enabled. Proxy files and encrypted recovery receipts remained byte-identical.
• Native Windows CI: workspace Clippy/tests/build, production-process recovery locking, actual CLI/Agent recovery, installed main/tray startup, manual upgrade/downgrade, reinstall, updater mode, interrupted replacement and real locked-vault uninstall passed.
• Native Linux CI: workspace checks, packaged startup, official Cursor/Pi integration and signed AppImage update/failure recovery passed.
• Experiments used disposable HOME/vendor directories, synthetic configurations, an isolated macOS Keychain and an independent build directory. No existing personal tool configuration or installed application was used.

macOS drag-to-Trash cannot reliably execute recovery; use the packaged uninstaller. Replacement intent requires the updated Windows installer handoff; historical installers cannot establish manual downgrade intent. Missing originals or conflicting user edits stop automatic restoration and retain recovery data. No merge, tag or release is included.