Native autostart evidence

Predecessor retirement, listener handoff and storage-writer fencing inspect the native service manager before changing automatic-start declarations. A failed inspection is not an empty list of enabled scopes. It authorizes neither retirement nor restoration based on invented state.

These checks run inside existing lifecycle operations, not through a separate manager or bypass command. See missing service reconciliation and storage root handoff for their admission and transaction contracts.

Inspect the lifecycle result

stado optimize run
stado optimize status

The run follows the fleet's declared autonomy policy; it is not an unconditional retire command. Status reads the selected reconciliation receipt. The same receipt is available at GET /api/service/reconciliation and Desktop's Services → Reconciliation view. Read the outcome's detail and native evidence, not just its top-level state. Service reconciliation receipts explains pending effects, failure provenance and partial publication.

What a complete inspection establishes

An all-scope inspection covers system and calling-account user managers on systemd; on launchd it covers system, gui/<calling uid> and user/<calling uid>. Each selected scope must be observed explicitly. A missing or unreadable login domain is not silently omitted. Unsupported managers, invalid identity, conflicting scopes, malformed packets and missing completion remain refusals or observation errors, not successful empty snapshots.

On launchd, Stado reads the canonical system, calling-account home and global agent definitions. A present definition must decode as a plist with the exact requested Label; a present Disabled field must be boolean. Stado checks native metadata before treating a missing path as absent. Failure to inspect a parent directory, read a definition or query print-disabled retains the actual path or scope, native status and cause.

An explicit external disabled override takes precedence over the plist hint. Without one, the optional Disabled hint supplies the definition's loading policy. Conflicting home/global hints or a loaded scope with no observed canonical definition remain unconfirmed. An override can exist even when no canonical definition or loaded job exists; its known flag remains visible.

launchctl's display is not a stable machine API. Stado accepts only a complete recognized disabled-services dictionary. Unsupported formatting or ambiguous escaping is reported with the native output instead of inventing a missing override. Concrete-scope mutation checks read that scope's external override; they do not substitute the calling account's home for another uid's home.

On systemd, Stado checks structured Id, LoadState and ActiveState fields. The returned unit id must identify the exact requested unit. Failed show operations and unsupported load states retain their native output. An explicit not-found observation differs from a failed manager query.

Native systemd enablement	Normalized enabled flag
enabled, enabled-runtime, generated	true
disabled, static, indirect, transient, linked, linked-runtime, masked, masked-runtime, not-found	false
Alias resolution or unsupported/unreadable state	Refusal or observation error; no invented flag

A linked unit is available, not thereby enabled. Generated enablement is implicit rather than a durable enable link. Runtime enablement applies to the current boot. The normalized flag is not a complete native-manager database, link topology, runtime-versus-durable snapshot, or guarantee of rebootability. An enabled state accompanied by a failed native query is not accepted as proof.

Changes, no-ops and failures

A setter names one concrete native scope; any is refused before contacting the host. An explicit matching usable observation permits a no-op. In particular, absence of a launchd override alone does not prove either requested state, so it cannot suppress the native action.

Otherwise Stado requests one native enable/disable action and reads the result back. Native acceptance is not yet verified requested-state success. A known opposite flag is a postcondition failure; unreadable verification remains an observation failure with the accepted action still pending. A transport or unusable action result with no usable execution acknowledgement remains execution_unconfirmed, not a guessed failed host mutation. Preparation and read refusals before action do not claim a mutation request.

Retirement and handoff retain earlier acknowledgements when a later scope fails. Storage fencing and restoration retain accumulated native lifecycle progress in their error context, including when later observation, listener or journal work fails. Original deployment error classifications are preserved. Matching no-ops do not acquire host-mutation credit; an incomplete result never becomes a successful lifecycle completion. No masking, retry loop, new login, or automatic package installation substitutes for a refused native operation.

Retirement distinguishes already_correct from observed absence. Replacement and takeover admission use structured completion evidence, including unknown read refusals. A no-change predecessor is not enrolled for compensating reload; known or unresolved native effects remain eligible for recovery if later work fails. Completion also requires complete final native inactivity and disabled-policy observations under one manager/account. A disabled but active scope is not retired. Known cross-scope conflicts refuse before action rather than silently expanding the public system-preferred bootout selection.

Setters pin native mutation to the manager and calling-account UID observed before the action. A changed identity refuses rather than applying the scope in a different context. Reversible recovery binds reads, stops and restoration to its captured identity and verifies the complete normalized policy afterwards. Recovering a registered but disabled launchd job temporarily enables bootstrap and then restores its disabled policy, including after a failed load. See Recovering retired predecessors; autostart flags alone do not describe which native scopes were active.

Public bootout uses the same containing-domain presence check as activation and autostart inspection, both before action and during completion verification. A missing or unreadable domain refuses observation rather than proving job absence. System-preferred and explicit user selection are unchanged; a system-only public request does not need a UID for an unselected user namespace.

Native references: systemctl state and exit semantics, and the host's launchctl(1), launchd.plist(5), plutil(1) and find(1) manuals.