## System details

- Omarchy: `4.0.2-1`
- Quickshell: `0.3.1-1`
- polkit: `127-3`

## What happened

The Omarchy shell's polkit agent entered a stale/broken state. After that, GUI actions using `pkexec` did not show an authentication dialog and failed immediately.

The Windows VM launcher exposed this as the generic notification:

```text
Windows VM
Failed to start Windows VM
```

This looks similar to #9374, but it is a separate failure mode: the VM directories already had the correct `0700` permissions. Restarting the Omarchy shell restored the polkit dialog and allowed the same command to succeed.

## Journal evidence

The long-running Omarchy shell logged:

```text
Sep 01 09:06:29 omarchy-shell:
failed to register listener: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: An authentication agent already exists for the given subject

Sep 01 09:06:29 omarchy-shell:
failed to register listener on path "/org/omarchy/PolkitAgent"
```

Later, launching `windows-vm.desktop` produced no authentication dialog and exited with the generic failure notification. Running the status command without a graphical agent also showed that authorization could not be obtained:

```text
Error creating textual authentication agent: Error opening current controlling terminal for the process (`/dev/tty'): No such device or address
Could not query the Windows VM (authorization declined?).
```

## Recovery

Running:

```bash
omarchy restart shell
```

started a new shell process, which logged:

```text
omarchy polkit agent registered
```

Immediately afterward, the same `omarchy-windows-vm status` action displayed the authentication dialog and succeeded. Starting the VM also succeeded.

## Reproduction from the broken state

I do not yet have a deterministic one-command reproduction for creating the stale state, but once it occurs the behavior is consistent:

1. The running shell logs `An authentication agent already exists for the given subject` while registering `/org/omarchy/PolkitAgent`.
2. Launch a GUI action that requires `pkexec`, such as the Windows VM launcher.
3. No authentication dialog appears; the action fails immediately.
4. Run `omarchy restart shell` and wait for `omarchy polkit agent registered`.
5. Retry the same action; the dialog appears and authorization succeeds.

Around the initial registration error there was also Quickshell process activity, including a separate Quickshell process that later crashed. This may be related to a graph/service reload or a second agent instance, but I cannot confirm the exact trigger from this incident alone.

## Expected behavior

- Exactly one usable polkit authentication agent should remain registered for the session.
- Reloading/recreating the Quickshell service should unregister or destroy the previous `PolkitAgent` cleanly before registering a replacement.
- If registration fails with `An authentication agent already exists`, the shell should recover instead of leaving GUI `pkexec` calls without a working authentication dialog.

## Possible direction

The polkit service is kept loaded and registers a `PolkitAgent` at `/org/omarchy/PolkitAgent`. It may be worth checking the lifecycle during QML graph/service reloads and ensuring an old listener is unregistered before a replacement is constructed. A registration failure could also trigger a controlled retry/recreation after verifying whether the existing listener is still functional.

Separately, surfacing the underlying `pkexec`/polkit failure in the Windows VM launcher would make this much easier to diagnose than the current generic notification.