[pcvantol]

Purpose

The released 0.3.7 helper now owns the fixed ServiceManagement label. PR #559 corrected the CLI signing identity for the next release, but the existing transition accepts only the historical 0.2.4 parent. This adds an exact, idle-only transition for a signed older released helper so 0.3.8 can replace 0.3.7 after independent idle readback.

Changes

• Reuse the existing locked unregister/absence/register/recovery sequence for the 0.2.4 qualification parent and released parents from 0.3.7 onward.
• Require the fixed job's independent signed parent readback to be strictly older than the sealed current release, with repeated state = not running and runs = 0 before unregister. Deny downgrade, same-version, missing, mismatched, running or approval-pending states.
• Expose helper replace-idle in the released CLI with explicit confirmation and fresh verified-release check. No caller-supplied label, path or target.
• Cover consent, native status, stale release, duplicate, interruption and fail-closed target cases.

Local qualification

• sh scripts/validate.sh: PASS.
• Native Swift full suites: 1,257 core and 28 CLI tests, zero failures.
• Strict executable-line coverage for every tracked production Swift file: PASS >80.2%; changed files 82.11%, 82.29%, 92.01%, 91.88% respectively.
• git diff --check: PASS.

This is source-only. It does not reboot, unregister or replace the live helper. The public 0.3.7 XPC route remains fail-closed until a newly signed/notarized release and live transition qualify. Frozen read-only producers: Forge 2.7.39 and EP 2.3.106. Same L1 assignment and PR #75 lineage; no Mission-3, CENTRAL reset or T0.