Why: probing identity by running the subcommand still launched old RDM builds, and ensure on a missing database created an empty one. A batch update also inherited the caller's AGENT_SYSTEM_* variables. Evidence: python3 -m unittest tests.test_svc_identity tests.test_svc_recover passed (41 tests, 1 skipped). tests.test_svc_lifecycle_isolation caller-env and restart cases passed. Impact: capability probes use version --json only. Established instances refuse a missing identity row until adopt --confirm. update and recover run each service in a clean environment. serve reads a 0600 serve.env and does not inherit the caller environment. Backend and documents pins move to the D1 identity and recovery-plan commits. Refs: recovery plan r3.1 D1; Backend feature/d1-identity-open; RDM feature/d1-version-json Co-authored-by: Cursor <cursoragent@cursor.com>
ui
@ 83e80f5648