Install Manifest Refresher (intervention/binding_refresh.go)

Rebuilds installed software identities while retaining live native processes from previous inventories. Ensures process bindings remain valid during vendor updates or file unlinks.

// Source: https://github.com/superbasedapp/observer | License: Apache-2.0 | Copyright 2026 Gaja AI
// Provided via justclaw.it.com; keep this notice with the code.
package intervention

import "context"

// RefreshInstallManifest rebuilds installed identities while retaining live
// native processes from the previous inventory. Vendor updates commonly unlink
// an executable while an existing session keeps running its old inode. Retained
// targets bind the complete process lifetime, not the removed pathname or an
// inode that might later be reused. Interpreted entrypoints need fresh script
// evidence and cannot inherit this native-executable guarantee.
func RefreshInstallManifest(ctx context.Context, previous InstallManifest, candidates []InstalledCandidate, opts ScanOptions) (InstallM

... (truncated -- full source via MCP)