@@ -8,13 +8,15 @@ import * as Exit from "effect/Exit";
 import * as Logger from "effect/Logger";
 import * as Option from "effect/Option";
 import * as References from "effect/References";
+import * as Terminal from "effect/Terminal";
 
 import {
   acquireRelayClientForLink,
   formatHeadlessAuthorizationPrompt,
   formatRelayClientReady,
   headlessSessionConfig,
   isPublishAgentActivityEnabledValue,
+  recoverBootServiceOffer,
   reportCloudDisconnectResults,
 } from "./connect.ts";
 
@@ -54,6 +56,13 @@ it.effect("detects headless operation from individual SSH config values", () =>
   }),
 );
 
+it.effect("treats cancelling optional background setup as a successful skip", () =>
+  Effect.gen(function* () {
+    const result = yield* recoverBootServiceOffer(Effect.fail(new Terminal.QuitError({})));
+    assert.isFalse(result);
+  }),
+);
+
 it.effect("does not install the relay client when the user declines the managed download", () =>
   Effect.gen(function* () {
     let installCalls = 0;
 
@@ -98,7 +98,7 @@ const authorizeCli = Effect.fn("cloud.cli.authorize")(function* (options: {
   if (!useOutOfBandOAuth) {
     const authorization = yield* tokens.get;
     if (authorization._tag === "Authorized") {
-      return null;
+      return authorization.token.identity ?? null;
     }
     yield* Console.log("\nHeadless mode enabled. A new authorization link is ready below.");
   }
@@ -112,7 +112,7 @@ const authorizeCli = Effect.fn("cloud.cli.authorize")(function* (options: {
     ),
   );
   if (Option.isSome(existing)) {
-    return null;
+    return existing.value.identity ?? null;
   }
   const { token, identity } = yield* CliTokenManager.outOfBandOAuthLogin(
     promptForOutOfBandOAuthCode,
@@ -712,6 +712,21 @@ const offerBootService = Effect.gen(function* () {
   return true;
 });
 
+export const recoverBootServiceOffer = <R>(
+  offer: Effect.Effect<boolean, BootService.BootServiceError | Terminal.QuitError, R>,
+) =>
+  offer.pipe(
+    Effect.catchTags({
+      QuitError: () => Effect.succeed(false),
+      BootServiceUnsupportedError: (error) =>
+        Console.log(`Skipping background setup: ${error.message}`).pipe(Effect.as(false)),
+      BootServiceCommandError: (error) =>
+        Console.warn(`Background setup did not finish: ${error.message}`).pipe(Effect.as(false)),
+      BootServiceInstallError: (error) =>
+        Console.warn(`Background setup did not finish: ${error.message}`).pipe(Effect.as(false)),
+    }),
+  );
+
 export const connectCommand = Command.make("connect", {
   ...projectLocationFlags,
   headless: headlessFlag,
@@ -733,20 +748,7 @@ export const connectCommand = Command.make("connect", {
 
         // Connect itself already succeeded; a boot-service failure must not
         // fail the command, just tell the user what happened and move on.
-        const background = yield* offerBootService.pipe(
-          Effect.catchTags({
-            BootServiceUnsupportedError: (error) =>
-              Console.log(`Skipping background setup: ${error.message}`).pipe(Effect.as(false)),
-            BootServiceCommandError: (error) =>
-              Console.warn(`Background setup did not finish: ${error.message}`).pipe(
-                Effect.as(false),
-              ),
-            BootServiceInstallError: (error) =>
-              Console.warn(`Background setup did not finish: ${error.message}`).pipe(
-                Effect.as(false),
-              ),
-          }),
-        );
+        const background = yield* recoverBootServiceOffer(offerBootService);
         yield* Console.log(
           background
             ? "\n✓ Background service ready\n\nT3 Code will stay reachable after you log out."
 
@@ -185,6 +185,7 @@ it.layer(NodeServices.layer)("CliTokenManager.outOfBandOAuthLogin", (it) => {
 
       assert.equal(token.accessToken, "access-token-1");
       assert.equal(token.refreshToken, "refresh-token-1");
+      assert.equal(token.identity, "[email protected]");
       // The id_token's email claim is surfaced so connect can show the account.
       assert.equal(identity, "[email protected]");
 
 
@@ -120,6 +120,7 @@ const PersistedToken = Schema.Struct({
   accessToken: Schema.String,
   refreshToken: Schema.String,
   expiresAtEpochMs: Schema.Number,
+  identity: Schema.optional(Schema.String),
 });
 export type PersistedToken = typeof PersistedToken.Type;
 
@@ -251,13 +252,15 @@ const exchangeToken = Effect.fn("cloud.cli_token.exchange")(function* (
     Effect.flatMap(HttpClientResponse.schemaBodyJson(OAuthTokenResponse)),
   );
   const now = yield* Clock.currentTimeMillis;
+  const identity = idTokenIdentity(response.id_token);
   return {
     token: {
       accessToken: response.access_token,
       refreshToken: response.refresh_token ?? params.refresh_token ?? "",
       expiresAtEpochMs: now + response.expires_in * 1_000,
+      ...(identity === null ? {} : { identity }),
     } satisfies PersistedToken,
-    identity: idTokenIdentity(response.id_token),
+    identity,
   };
 });
 
@@ -357,7 +360,9 @@ export const make = Effect.gen(function* () {
       refresh_token: token.refreshToken,
       client_id: metadata.clientId,
     });
-    return refreshed;
+    return refreshed.identity === undefined && token.identity !== undefined
+      ? { ...refreshed, identity: token.identity }
+      : refreshed;
   });
 
   const login = Effect.fn("cloud.cli_token.login")(function* () {
 
@@ -27,7 +27,10 @@ interface RecordedCommand {
 
 const makeRecordingRunnerLayer = (
   commands: Array<RecordedCommand>,
-  options?: { readonly failCommand?: string },
+  options?: {
+    readonly failCommand?: string;
+    readonly failWhen?: (command: string, args: ReadonlyArray<string>) => boolean;
+  },
 ) =>
   Layer.succeed(
     ProcessRunner.ProcessRunner,
@@ -36,7 +39,9 @@ const makeRecordingRunnerLayer = (
         Effect.sync(() => {
           assert.isUndefined(input.env);
           commands.push({ command: input.command, args: input.args });
-          const failed = input.command === options?.failCommand;
+          const failed =
+            input.command === options?.failCommand ||
+            options?.failWhen?.(input.command, input.args) === true;
           return {
             stdout: "",
             stderr: failed ? `${input.command} exploded` : "",
@@ -152,6 +157,11 @@ it("flags package-manager cache entry points as ephemeral", () => {
     BootService.isEphemeralCacheEntry("/home/theo/.bun/install/cache/[email protected]/dist/bin.mjs"),
   );
   assert.isFalse(BootService.isEphemeralCacheEntry("/usr/local/lib/node_modules/t3/dist/bin.mjs"));
+  assert.isFalse(
+    BootService.isEphemeralCacheEntry(
+      "/home/theo/dev/pnpm/dlx-tools/t3/node_modules/t3/dist/bin.mjs",
+    ),
+  );
   assert.isFalse(
     BootService.isEphemeralCacheEntry(
       "/home/theo/.t3/runtime/versions/0.0.27/node_modules/t3/dist/bin.mjs",
@@ -234,6 +244,29 @@ it.layer(NodeServices.layer)("BootService", (it) => {
     }),
   );
 
+  it.effect("reinstalls a pinned runtime when its entry point is missing", () =>
+    Effect.gen(function* () {
+      const { dirs, fs, path } = yield* makeTestContext();
+      const commands: Array<RecordedCommand> = [];
+      const service = yield* BootService.make({
+        baseDir: dirs.baseDir,
+        logsDir: dirs.logsDir,
+        cliVersion: "0.0.27",
+        host: makeHost("/home/theo/.npm/_npx/abc/node_modules/t3/dist/bin.mjs"),
+      }).pipe(Effect.provide(makeRecordingRunnerLayer(commands)), provideHostRefs(dirs.home));
+
+      const plan = yield* service.install;
+      yield* fs.makeDirectory(path.dirname(plan.t3EntryPath), { recursive: true });
+      yield* fs.writeFileString(plan.t3EntryPath, "#!/usr/bin/env node\n");
+      yield* fs.remove(plan.t3EntryPath);
+      commands.length = 0;
+
+      yield* service.install;
+
+      assert.isTrue(commands.some(({ command }) => command === "npm"));
+    }),
+  );
+
   it.effect("reads executable metadata from host process references", () =>
     Effect.gen(function* () {
       const { dirs } = yield* makeTestContext();
@@ -376,6 +409,95 @@ it.layer(NodeServices.layer)("BootService", (it) => {
       );
       const status = yield* service.status;
       assert.isFalse(status.installed);
+      assert.isTrue(
+        commands.some(
+          ({ command, args }) =>
+            command === "systemctl" && args.join(" ") === "--user disable --now t3code.service",
+        ),
+      );
+    }),
+  );
+
+  it.effect("restores the previous unit when a repair cannot activate", () =>
+    Effect.gen(function* () {
+      const { dirs, fs, path } = yield* makeTestContext();
+      const initialCommands: Array<RecordedCommand> = [];
+      const initialService = yield* BootService.make({
+        baseDir: dirs.baseDir,
+        logsDir: dirs.logsDir,
+        cliVersion: "0.0.27",
+        host: makeHost(dirs.stableEntry),
+      }).pipe(
+        Effect.provide(makeRecordingRunnerLayer(initialCommands)),
+        provideHostRefs(dirs.home),
+      );
+      yield* initialService.install;
+
+      const unitPath = path.join(dirs.home, ".config", "systemd", "user", "t3code.service");
+      const previousUnit = yield* fs.readFileString(unitPath);
+      const replacementEntry = path.join(dirs.home, "replacement-bin.mjs");
+      yield* fs.writeFileString(replacementEntry, "#!/usr/bin/env node\n");
+      const repairCommands: Array<RecordedCommand> = [];
+      const repairService = yield* BootService.make({
+        baseDir: dirs.baseDir,
+        logsDir: dirs.logsDir,
+        cliVersion: "0.0.28",
+        host: makeHost(replacementEntry),
+      }).pipe(
+        Effect.provide(makeRecordingRunnerLayer(repairCommands, { failCommand: "loginctl" })),
+        provideHostRefs(dirs.home),
+      );
+
+      const error = yield* repairService.install.pipe(Effect.flip);
+
+      assert.isTrue(isCommandError(error));
+      assert.equal(yield* fs.readFileString(unitPath), previousUnit);
+      assert.isTrue(
+        repairCommands.some(
+          ({ command, args }) =>
+            command === "systemctl" && args.join(" ") === "--user restart t3code.service",
+        ),
+      );
+    }),
+  );
+
+  it.effect("keeps the unit when stopping it during uninstall fails", () =>
+    Effect.gen(function* () {
+      const { dirs, fs, path } = yield* makeTestContext();
+      const installCommands: Array<RecordedCommand> = [];
+      const installedService = yield* BootService.make({
+        baseDir: dirs.baseDir,
+        logsDir: dirs.logsDir,
+        cliVersion: "0.0.27",
+        host: makeHost(dirs.stableEntry),
+      }).pipe(
+        Effect.provide(makeRecordingRunnerLayer(installCommands)),
+        provideHostRefs(dirs.home),
+      );
+      yield* installedService.install;
+
+      const uninstallCommands: Array<RecordedCommand> = [];
+      const failingService = yield* BootService.make({
+        baseDir: dirs.baseDir,
+        logsDir: dirs.logsDir,
+        cliVersion: "0.0.27",
+        host: makeHost(dirs.stableEntry),
+      }).pipe(
+        Effect.provide(
+          makeRecordingRunnerLayer(uninstallCommands, {
+            failWhen: (command, args) =>
+              command === "systemctl" && args.includes("disable") && args.includes("--now"),
+          }),
+        ),
+        provideHostRefs(dirs.home),
+      );
+
+      const error = yield* failingService.uninstall.pipe(Effect.flip);
+
+      assert.isTrue(isCommandError(error));
+      assert.isTrue(
+        yield* fs.exists(path.join(dirs.home, ".config", "systemd", "user", "t3code.service")),
+      );
     }),
   );