- askConfirm short-circuits non-interactively in --dry-run (prints what would be asked) - systemd node resolution order: existing unit's pinned binary > newest nvm node > PATH lookup excluding hermes-agent runtimes > process.execPath. On the live box this keeps the unit byte-identical (true idempotency for the service section).