LaunchAgents now repair from observed state
ensure_personal_schedules already knew when a declared schedule existed on disk. In 5.5.2 it also checks whether launchd actually has the matching service loaded. If the plist is present but the service is missing, NEXO runs launchctl bootstrap and records whether that reload really succeeded.
No more false green on stale launchd entries
Startup also inspects managed com.nexo.* plists and compares the on-disk ProgramArguments to what launchctl reports as loaded. When launchd is still pointing at a stale or temporary path, NEXO now uses the modern bootout plus bootstrap flow and only reports AUTO-REPAIRED after both commands succeed.
If either step fails, startup keeps the warning explicit instead of pretending the machine is healthy. That makes the self-heal path honest enough to trust during real bootstraps, updates, and packaged-runtime repairs.
Headless model selection now defers to the runtime profile
The other half of 5.5.2 removes legacy "opus" and "sonnet" fallback strings from core automation scripts. Passing an empty model now lets run_automation_prompt() resolve the active backend profile, so Codex and Claude headless runs stay aligned with the configured runtime instead of inheriting a stale default from an old script.
Why these two fixes ship together
Both fixes remove a class of hidden drift. One was launchd drift between the plist on disk and the service actually loaded by macOS. The other was runtime drift between the configured automation backend and the hardcoded model name a script might pass. 5.5.2 closes both gaps so packaged jobs behave like the runtime says they should.