@askexenow/exe-os 0.9.372 → 0.9.374

package/dist/{chunk-GU62SNDH.js → chunk-ZGYNKA3O.js}

@@ -1,8 +1,12 @@
+import {
+  readImageLabel
+} from "./chunk-GHR4ZPJ7.js";
 import {
   clearDeployStalenessAlert,
+  deployStalenessAlertPath,
   evaluateDeployStaleness,
   writeDeployStalenessAlert
-} from "./chunk-TX3Q2GIL.js";
+} from "./chunk-C5HUMAA7.js";
 import {
   REVISION_LABEL,
   VERSION_LABEL,
@@ -11,77 +15,17 @@ import {
 } from "./chunk-L25OAFOU.js";
 import {
   loadLicense
-} from "./chunk-DKBPCOU4.js";
+} from "./chunk-L6RXG36J.js";
 
 // src/lib/stack-update.ts
-import { execFileSync, spawnSync as spawnSync2 } from "child_process";
+import { execFileSync, spawnSync } from "child_process";
 import { createVerify, randomBytes, verify as verifySignature } from "crypto";
 import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "fs";
 import http from "http";
 import https from "https";
+import net from "net";
 import path from "path";
 import { fileURLToPath } from "url";
-
-// scripts/lib/resolve-image-labels.mjs
-import { spawnSync } from "child_process";
-var defaultRunner = (cmd, args) => spawnSync(cmd, args, { encoding: "utf8", timeout: 6e4 });
-function repositoryOf(ref) {
-  if (typeof ref !== "string") return ref;
-  const at = ref.indexOf("@");
-  if (at !== -1) return ref.slice(0, at);
-  const slash = ref.lastIndexOf("/");
-  const colon = ref.lastIndexOf(":");
-  if (colon > slash) return ref.slice(0, colon);
-  return ref;
-}
-function amd64ChildDigest(rawJson) {
-  let doc;
-  try {
-    doc = typeof rawJson === "string" ? JSON.parse(rawJson) : rawJson;
-  } catch {
-    return void 0;
-  }
-  if (!doc || !Array.isArray(doc.manifests)) return void 0;
-  const isLinuxAmd64 = (m) => m?.platform?.os === "linux" && m?.platform?.architecture === "amd64";
-  const anyAmd64 = (m) => m?.platform?.architecture === "amd64" && m?.platform?.os !== "unknown";
-  const pick = doc.manifests.find(isLinuxAmd64) ?? doc.manifests.find(anyAmd64);
-  const digest = pick?.digest;
-  return typeof digest === "string" && digest.length > 0 ? digest : void 0;
-}
-function resolvePlatformRef(imageRef, { runner } = {}) {
-  const run = runner ?? defaultRunner;
-  const res = run("docker", ["buildx", "imagetools", "inspect", imageRef, "--raw"]);
-  if (!res || res.status !== 0) return imageRef;
-  const raw = (res.stdout ?? "").toString();
-  const childDigest = amd64ChildDigest(raw);
-  if (!childDigest) return imageRef;
-  return `${repositoryOf(imageRef)}@${childDigest}`;
-}
-function readLabelOff(platformRef, label, { runner } = {}) {
-  const run = runner ?? defaultRunner;
-  const res = run("docker", [
-    "buildx",
-    "imagetools",
-    "inspect",
-    platformRef,
-    "--format",
-    `{{ index .Config.Labels "${label}" }}`
-  ]);
-  if (!res || res.status !== 0) return void 0;
-  const out = (res.stdout ?? "").toString().trim();
-  return out === "" || out === "<no value>" ? void 0 : out;
-}
-function resolveImageLabels(imageRef, labels, { runner } = {}) {
-  const platformRef = resolvePlatformRef(imageRef, { runner });
-  const out = {};
-  for (const label of labels) out[label] = readLabelOff(platformRef, label, { runner });
-  return out;
-}
-function readImageLabel(imageRef, label, opts = {}) {
-  return resolveImageLabels(imageRef, [label], opts)[label];
-}
-
-// src/lib/stack-update.ts
 var SLOW_SERVICE_HEALTH_DEFAULTS = {
   // Frappe `bench migrate` on every boot can take well over the 180s default.
   "exe-erp": 900
@@ -239,6 +183,69 @@ function isCloudflaredTunnelMisconfigured(composeFile, envFile) {
   }
   return true;
 }
+var INGRESS_DEFAULT_PORTS = { http: 80, https: 443 };
+function stripYamlScalar(raw) {
+  let v = raw.trim();
+  v = v.replace(/\s+#.*$/, "").trim();
+  if (v.startsWith('"') && v.endsWith('"') || v.startsWith("'") && v.endsWith("'")) {
+    v = v.slice(1, -1);
+  }
+  return v.trim();
+}
+function parseCloudflaredIngressTargets(configYml) {
+  const lines = configYml.split(/\r?\n/);
+  const targets = [];
+  let inIngress = false;
+  let ingressIndent = -1;
+  let currentHostname;
+  const flushService = (serviceRaw) => {
+    const service = stripYamlScalar(serviceRaw);
+    const m = /^([a-z][a-z0-9+.\-]*):\/\/(?:\[([^\]]+)\]|([^/:\s]+))(?::(\d+))?/i.exec(service);
+    if (!m) return;
+    const scheme = (m[1] ?? "").toLowerCase();
+    const host = m[2] ?? m[3] ?? "";
+    const port = m[4] ? Number(m[4]) : INGRESS_DEFAULT_PORTS[scheme];
+    if (!host) return;
+    if (port === void 0 || !Number.isFinite(port) || port <= 0 || port > 65535) return;
+    targets.push({ hostname: currentHostname, service, host, port });
+  };
+  for (const raw of lines) {
+    if (raw.trim() === "" || raw.trim().startsWith("#")) continue;
+    const indent = raw.length - raw.replace(/^\s*/, "").length;
+    if (!inIngress) {
+      if (/^ingress\s*:\s*$/.test(raw.trim())) {
+        inIngress = true;
+        ingressIndent = indent;
+      }
+      continue;
+    }
+    if (indent <= ingressIndent && !raw.trim().startsWith("-")) {
+      inIngress = false;
+      continue;
+    }
+    const t = raw.trim();
+    if (t.startsWith("-")) {
+      currentHostname = void 0;
+      const item = t.replace(/^-\s*/, "");
+      const hm = /^hostname\s*:\s*(.+)$/i.exec(item);
+      const sm = /^service\s*:\s*(.+)$/i.exec(item);
+      if (hm) currentHostname = stripYamlScalar(hm[1] ?? "");
+      else if (sm) flushService(sm[1] ?? "");
+    } else {
+      const hm = /^hostname\s*:\s*(.+)$/i.exec(t);
+      const sm = /^service\s*:\s*(.+)$/i.exec(t);
+      if (hm) currentHostname = stripYamlScalar(hm[1] ?? "");
+      else if (sm) flushService(sm[1] ?? "");
+    }
+  }
+  return targets;
+}
+async function findUnreachableIngressTargets(targets, probe) {
+  const results = await Promise.all(
+    targets.map(async (t) => ({ t, reachable: await probe(t.host, t.port) }))
+  );
+  return results.filter((r) => !r.reachable).map((r) => r.t);
+}
 function resolveTransitiveDeps(selected, depsMap) {
   const resolved = new Set(selected);
   const queue = [...selected];
@@ -448,9 +455,10 @@ async function rollbackStackUpdate(options) {
   const rollbackEnvRaw = readFileSync(rollbackEnv, "utf8");
   const rollbackEnvMap = parseEnv(rollbackEnvRaw);
   const preUpdateImageDefaults = lockData?.preUpdateImageDefaults ?? {};
+  let processSyncKeys = [];
   if (scopedServiceNames.length > 0 && lockData?.services) {
     const scopedEnvKeys = scopedServiceNames.map((serviceName) => lockData.services[serviceName].env).filter((key) => Boolean(key));
-    const mutatedEnvKeys = lockData.mutatedEnvKeys ?? [];
+    const mutatedEnvKeys = options.isolateEnvScope ? [] : lockData.mutatedEnvKeys ?? [];
     const restoreEnvKeys = [.../* @__PURE__ */ new Set([...scopedEnvKeys, ...mutatedEnvKeys])];
     const scopedUpdates = {};
     const scopedRemovals = [];
@@ -478,6 +486,7 @@ async function rollbackStackUpdate(options) {
     }
     const patched = patchEnv(readFileSync(options.envFile, "utf8"), scopedUpdates);
     writeSecretFile(options.envFile, removeEnvKeys(patched, scopedRemovals));
+    processSyncKeys = restoreEnvKeys;
   } else {
     console.log(`[stack-update] Restoring env from ${rollbackEnv}`);
     writeSecretFile(options.envFile, rollbackEnvRaw);
@@ -500,6 +509,50 @@ async function rollbackStackUpdate(options) {
         writeSecretFile(options.envFile, patchEnv(readFileSync(options.envFile, "utf8"), repins));
       }
     }
+    processSyncKeys = Object.values(lockData?.services ?? {}).map((svc) => svc.env).filter((key) => Boolean(key));
+  }
+  {
+    const imagePinKeys = new Set(
+      Object.values(lockData?.services ?? {}).map((svc) => svc.env).filter((key) => Boolean(key))
+    );
+    const restored = syncImagePinsWithProcessEnv(
+      readFileSync(options.envFile, "utf8"),
+      processSyncKeys.filter((key) => imagePinKeys.has(key))
+    );
+    if (restored.pinned.length > 0 || restored.cleared.length > 0) {
+      console.log(
+        `[stack-update] ROLLBACK: re-synced image ref(s) in the deploy environment (restored: ${restored.pinned.join(", ") || "none"}; cleared: ${restored.cleared.join(", ") || "none"})`
+      );
+    }
+  }
+  {
+    const restoredEnvRaw = readFileSync(options.envFile, "utf8");
+    const restoredEnvMap = parseEnv(restoredEnvRaw);
+    const binUpdates = {};
+    const binRemovals = [];
+    for (const serviceKey of ["monitorHub", "monitorAgent"]) {
+      const binKey = MONITOR_HEALTH_BIN_ENV[serviceKey];
+      const imageEnvKey = MONITOR_IMAGE_TAG_ENV[serviceKey];
+      const rollbackImage = restoredEnvMap.get(imageEnvKey)?.trim();
+      if (rollbackImage) {
+        binUpdates[binKey] = monitorHealthBinForImage(serviceKey, rollbackImage);
+      } else if (restoredEnvMap.has(binKey)) {
+        binRemovals.push(binKey);
+      }
+    }
+    if (Object.keys(binUpdates).length > 0 || binRemovals.length > 0) {
+      const patched = patchEnv(restoredEnvRaw, binUpdates);
+      writeSecretFile(options.envFile, removeEnvKeys(patched, binRemovals));
+    }
+    const restoredBins = syncImagePinsWithProcessEnv(
+      readFileSync(options.envFile, "utf8"),
+      Object.values(MONITOR_HEALTH_BIN_ENV)
+    );
+    if (restoredBins.pinned.length > 0 || restoredBins.cleared.length > 0) {
+      console.log(
+        `[stack-update] ROLLBACK: re-synced monitor healthcheck bin path(s) in the deploy environment (restored: ${restoredBins.pinned.join(", ") || "none"}; cleared: ${restoredBins.cleared.join(", ") || "none"})`
+      );
+    }
   }
   const composeArgs = composeArgsForStack(options.composeFile, options.envFile);
   if (lockData?.services) {
@@ -519,8 +572,10 @@ async function rollbackStackUpdate(options) {
   }
   console.log("[stack-update] Restarting services with previous images\u2026");
   if (scopedServiceNames.length > 0 && lockData?.services) {
-    for (const serviceName of scopedServiceNames) {
-      const composeServiceName = lockData.services[serviceName]?.composeService ?? serviceName;
+    const scopedComposeServices = expandComposeServicesWithSidecars(
+      scopedServiceNames.map((serviceName) => lockData.services[serviceName]?.composeService ?? serviceName)
+    );
+    for (const composeServiceName of scopedComposeServices) {
       exec("docker", [...composeArgs, "up", "-d", "--remove-orphans", "--no-deps", composeServiceName]);
     }
   } else {
@@ -552,6 +607,43 @@ async function rollbackStackUpdate(options) {
       );
     }
   }
+  const rolledBackComposeServices = scopedServiceNames.length > 0 && lockData?.services ? [...new Set(expandComposeServicesWithSidecars(scopedServiceNames.map((name) => lockData.services[name]?.composeService ?? name)))] : [...new Set(Object.entries(lockData?.services ?? {}).map(([name, svc]) => svc.composeService ?? name))];
+  try {
+    await verifyComposeServicesRunning(
+      composeArgs,
+      rolledBackComposeServices,
+      options.healthTimeoutSecs ?? 180,
+      options.composePsCapture
+    );
+    if (rolledBackComposeServices.length > 0) {
+      console.log(`[stack-update] \u2713 Post-rollback health verified: ${rolledBackComposeServices.length} service(s) running & healthy.`);
+    }
+  } catch (healthErr) {
+    const healthReason = healthErr instanceof Error ? healthErr.message : String(healthErr);
+    const runningVersion = lockData?.previousVersion ?? lockData?.stackVersion ?? "unknown";
+    const attemptedVersion = lockData?.targetVersion ?? lockData?.stackVersion ?? "unknown";
+    writeDeployStalenessAlert({
+      detectedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      runningVersion,
+      targetVersion: attemptedVersion,
+      attemptedAt: lockData?.updatedAt,
+      failedServices: rolledBackComposeServices,
+      totalServices: rolledBackComposeServices.length,
+      sampleError: healthReason.slice(0, 240),
+      reason: `ROLLBACK LANDED UNHEALTHY: the stack was rolled back toward ${runningVersion} but the rolled-back service(s) did not come back running & healthy. The rollback did NOT succeed \u2014 production is likely degraded and needs manual attention (bug 879aad12).`,
+      recovery: {
+        inspect: "docker compose ps --all \u2014 inspect the rolled-back service(s) that failed to become healthy.",
+        retry: "Fix the underlying cause, then re-run the deploy or rollback; a healthy landing clears this alert.",
+        acknowledge: `Delete ${deployStalenessAlertPath()} to silence it deliberately.`
+      }
+    });
+    await postDeployAudit(options, "rollback_unhealthy", attemptedVersion, runningVersion, healthReason, {
+      failedServices: rolledBackComposeServices
+    });
+    throw new Error(
+      `Rollback restarted services but they did not become healthy \u2014 rollback FAILED (bug 879aad12): ${healthReason}`
+    );
+  }
   if (!options.serviceName && lockData) {
     writeStackUpdateLock(lockFilePath, {
       ...lockData,
@@ -606,7 +698,7 @@ function isExecFormMigration(migrationCommand) {
 }
 function isComposeServiceRunning(composeArgs, composeServiceName) {
   try {
-    const result = spawnSync2("docker", [...composeArgs, "ps", "--quiet", composeServiceName], {
+    const result = spawnSync("docker", [...composeArgs, "ps", "--quiet", composeServiceName], {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 1e4
@@ -638,6 +730,20 @@ function expandComposeServicesWithSidecars(primaryComposeServices) {
   }
   return expanded;
 }
+function resolveOwningManifestService(composeService, services) {
+  const direct = Object.entries(services).find(
+    ([name, svc]) => name === composeService || (svc.composeService ?? name) === composeService
+  );
+  if (direct) return direct[0];
+  const primary = Object.entries(COMPOSE_SIDECARS).find(([, sidecars]) => sidecars.includes(composeService))?.[0];
+  if (primary) {
+    const owner = Object.entries(services).find(
+      ([name, svc]) => name === primary || (svc.composeService ?? name) === primary
+    );
+    if (owner) return owner[0];
+  }
+  return composeService;
+}
 function cloneReleaseWithServices(release, serviceNames) {
   const wanted = new Set(serviceNames);
   const services = {};
@@ -896,7 +1002,18 @@ function parseRequiredEnvRefs(composeRaw) {
   }
   return [...refs.entries()].map(([key, message]) => ({ key, message }));
 }
-function deriveRequiredEnvValue(key, env) {
+function resolveManifestImagePin(key, release) {
+  if (!release) return void 0;
+  for (const service of Object.values(release.services ?? {})) {
+    if (service?.env !== key) continue;
+    const image = service.image?.trim();
+    if (image) return image;
+  }
+  return void 0;
+}
+function deriveRequiredEnvValue(key, env, release) {
+  const manifestPin = resolveManifestImagePin(key, release);
+  if (manifestPin) return manifestPin;
   const nonEmpty = (k) => {
     const v = env.get(k);
     return v && v.trim() !== "" ? v.trim() : void 0;
@@ -935,14 +1052,34 @@ function deriveRequiredEnvValue(key, env) {
       return void 0;
   }
 }
-function detectMissingRequiredEnvVars(composeRaw, envRaw) {
+function requiredImagePinKeys(composeRaw, release) {
+  return parseRequiredEnvRefs(composeRaw).map((ref) => ref.key).filter((key) => resolveManifestImagePin(key, release) !== void 0);
+}
+function syncImagePinsWithProcessEnv(envRaw, keys, processEnv = process.env) {
+  const env = parseEnv(envRaw);
+  const pinned = [];
+  const cleared = [];
+  for (const key of new Set(keys)) {
+    const value = env.get(key)?.trim();
+    if (value) {
+      if (processEnv[key] === value) continue;
+      processEnv[key] = value;
+      pinned.push(key);
+    } else if (processEnv[key] !== void 0) {
+      delete processEnv[key];
+      cleared.push(key);
+    }
+  }
+  return { pinned, cleared };
+}
+function detectMissingRequiredEnvVars(composeRaw, envRaw, release) {
   const env = parseEnv(envRaw);
   const derived = {};
   const unresolvable = [];
   for (const ref of parseRequiredEnvRefs(composeRaw)) {
     const current = env.get(ref.key);
     if (current !== void 0 && current.trim() !== "") continue;
-    const value = deriveRequiredEnvValue(ref.key, env);
+    const value = deriveRequiredEnvValue(ref.key, env, release);
     if (value !== void 0 && value.trim() !== "") {
       derived[ref.key] = value;
     } else {
@@ -951,6 +1088,32 @@ function detectMissingRequiredEnvVars(composeRaw, envRaw) {
   }
   return { derived, unresolvable };
 }
+var MONITOR_HEALTH_BIN_ENV = {
+  monitorHub: "MONITOR_HUB_HEALTH_BIN",
+  monitorAgent: "MONITOR_AGENT_HEALTH_BIN"
+};
+var MONITOR_IMAGE_TAG_ENV = {
+  monitorHub: "MONITOR_HUB_IMAGE_TAG",
+  monitorAgent: "MONITOR_AGENT_IMAGE_TAG"
+};
+var STOCK_BESZEL_MONITOR_VERSIONS = /* @__PURE__ */ new Set(["0.9.5"]);
+function monitorImageVersion(imageRef) {
+  const noDigest = imageRef.split("@")[0] ?? imageRef;
+  const lastSlash = noDigest.lastIndexOf("/");
+  const lastColon = noDigest.lastIndexOf(":");
+  const tag = lastColon > lastSlash ? noDigest.slice(lastColon + 1) : "";
+  const match = /^v?(\d+\.\d+\.\d+)/.exec(tag);
+  return match ? match[1] : void 0;
+}
+function isStockBeszelMonitorImage(imageRef) {
+  const version = monitorImageVersion(imageRef);
+  return version !== void 0 && STOCK_BESZEL_MONITOR_VERSIONS.has(version);
+}
+function monitorHealthBinForImage(serviceKey, imageRef) {
+  const stock = isStockBeszelMonitorImage(imageRef);
+  if (serviceKey === "monitorHub") return stock ? "/beszel" : "/app/beszel";
+  return stock ? "/agent" : "/app/beszel-agent";
+}
 function createStackUpdatePlan(manifest, envRaw, targetVersion, serviceNames, selection, composeRaw) {
   const version = targetVersion ?? manifest.latest;
   const manifestRelease = manifest.stacks[version];
@@ -967,6 +1130,16 @@ function createStackUpdatePlan(manifest, envRaw, targetVersion, serviceNames, se
       changes.push({ key: service.env, before, after, service: serviceName });
     }
   }
+  for (const serviceKey of ["monitorHub", "monitorAgent"]) {
+    const monitorService = release.services[serviceKey];
+    if (!monitorService?.image) continue;
+    const binKey = MONITOR_HEALTH_BIN_ENV[serviceKey];
+    const binBefore = env.get(binKey);
+    const binAfter = monitorHealthBinForImage(serviceKey, monitorService.image);
+    if (binBefore !== binAfter) {
+      changes.push({ key: binKey, before: binBefore, after: binAfter, service: serviceKey });
+    }
+  }
   return {
     manifest,
     release,
@@ -1021,6 +1194,18 @@ function stripImageDigest(image) {
 function imagePullRef(image) {
   return isThirdPartyImage(image) ? stripImageDigest(image) : image;
 }
+function manifestInspectRef(image) {
+  const trimmed = image.trim();
+  const digest = imageDigest(trimmed);
+  if (!digest) return trimmed;
+  const name = stripImageDigest(trimmed);
+  const lastSlash = name.lastIndexOf("/");
+  const ref = lastSlash >= 0 ? name.slice(lastSlash + 1) : name;
+  const colon = ref.indexOf(":");
+  if (colon < 0) return trimmed;
+  const tagless = lastSlash >= 0 ? name.slice(0, lastSlash + 1) + ref.slice(0, colon) : ref.slice(0, colon);
+  return `${tagless}@${digest}`;
+}
 function isMutableTag(tag) {
   if (!tag) return true;
   return /^(latest|stable|main|master|edge|nightly|dev|develop|rolling|current)$/i.test(tag);
@@ -1173,7 +1358,7 @@ function collectImageAvailabilityIssues(plan) {
     let inspectOutput = "";
     for (let attempt = 1; attempt <= maxAttempts; attempt++) {
       try {
-        const result = spawnSync2("docker", ["manifest", "inspect", image, "--verbose"], {
+        const result = spawnSync("docker", ["manifest", "inspect", manifestInspectRef(image), "--verbose"], {
           stdio: ["ignore", "pipe", "pipe"],
           timeout: 3e4
         });
@@ -1188,7 +1373,7 @@ function collectImageAvailabilityIssues(plan) {
           console.log(
             `[stack-update] Image ${image} not yet available on proxy (attempt ${attempt}/${maxAttempts}), retrying in ${delayMs / 1e3}s\u2026 (bug d11c9809)`
           );
-          spawnSync2("sleep", [String(delayMs / 1e3)], { stdio: "ignore" });
+          spawnSync("sleep", [String(delayMs / 1e3)], { stdio: "ignore" });
         }
       } catch {
         inspected = true;
@@ -1253,6 +1438,165 @@ ${details}
 Emergency override requires --break-glass <reason> and writes an audit file.`
   );
 }
+function parseComposeServiceImages(composeRaw) {
+  const images = /* @__PURE__ */ new Map();
+  let inServices = false;
+  let current = null;
+  for (const line of composeRaw.split(/\r?\n/)) {
+    if (!line.trim() || line.trim().startsWith("#")) continue;
+    const indent = line.length - line.trimStart().length;
+    const trimmed = line.trim();
+    if (indent === 0) {
+      inServices = /^services:\s*$/.test(trimmed);
+      current = null;
+      continue;
+    }
+    if (!inServices) continue;
+    if (indent === 2 && /^[a-zA-Z0-9_.-]+:\s*$/.test(trimmed)) {
+      current = trimmed.replace(/:\s*$/, "");
+      continue;
+    }
+    if (!current) continue;
+    const match = trimmed.match(/^image:\s*(.+?)\s*(?:#.*)?$/);
+    if (match) images.set(current, match[1].trim().replace(/^['"]|['"]$/g, ""));
+  }
+  return images;
+}
+function imageDigest(image) {
+  return image.match(/@(sha256:[a-f0-9]{64})$/i)?.[1]?.toLowerCase();
+}
+function envRefsInImageExpression(expr) {
+  return [...expr.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)/g)].map((m) => m[1]);
+}
+function manifestCoveredComposeServices(release, composeImages, env) {
+  const covered = /* @__PURE__ */ new Set();
+  const pinVars = /* @__PURE__ */ new Map();
+  const manifestRefs = /* @__PURE__ */ new Set();
+  const manifestDigests = /* @__PURE__ */ new Set();
+  for (const [name, service] of Object.entries(release.services)) {
+    const composeName = service.composeService ?? name;
+    covered.add(name);
+    covered.add(composeName);
+    for (const sidecar of COMPOSE_SIDECARS[composeName] ?? []) covered.add(sidecar);
+    if (service.env) pinVars.set(service.env, composeName);
+    const image = service.image.trim();
+    manifestRefs.add(image);
+    manifestRefs.add(stripImageDigest(image));
+    const digest = imageDigest(image);
+    if (digest) manifestDigests.add(digest);
+  }
+  for (const [composeService, expr] of composeImages) {
+    if (covered.has(composeService)) continue;
+    if (envRefsInImageExpression(expr).some((key) => pinVars.has(key))) {
+      covered.add(composeService);
+      continue;
+    }
+    const resolved = resolveComposeImageExpression(expr, env);
+    if (!resolved) continue;
+    const digest = imageDigest(resolved);
+    if (digest && manifestDigests.has(digest)) covered.add(composeService);
+    else if (manifestRefs.has(resolved)) covered.add(composeService);
+  }
+  return covered;
+}
+function collectManifestDeliveryIssues(input) {
+  const issues = [];
+  const env = parseEnv(input.envRaw);
+  const composeImages = parseComposeServiceImages(input.composeRaw);
+  const covered = manifestCoveredComposeServices(input.release, composeImages, env);
+  const report = (service, origin, detail) => {
+    issues.push({
+      service,
+      origin,
+      reason: "absent-from-manifest",
+      message: `${origin === "host" ? "Running service" : "Compose service"} "${service}" is NOT in signed stack manifest ${input.targetVersion}. ${detail} An image the signed manifest does not pin is not deployable. Publish it to the manifest (exe-os stack-release) and re-cut the manifest, or remove the service from the host.`
+    });
+  };
+  for (const [composeService, expr] of composeImages) {
+    if (covered.has(composeService)) continue;
+    const resolved = resolveComposeImageExpression(expr, env);
+    if (!resolved) continue;
+    report(composeService, "compose", `It would deploy ${resolved}, which no manifest entry pins.`);
+  }
+  for (const hostService of input.hostServices ?? []) {
+    if (covered.has(hostService)) continue;
+    report(hostService, "host", "It is running on this host with no manifest entry behind it.");
+  }
+  for (const [name, service] of Object.entries(input.release.services)) {
+    const image = service.image.trim();
+    if (imageDigest(image)) continue;
+    if (isThirdPartyImage(image)) continue;
+    issues.push({
+      service: service.composeService ?? name,
+      origin: "compose",
+      reason: "unpinned-image",
+      message: `Manifest ${input.targetVersion} entry "${name}" pins image ${image} with no @sha256: digest. A tag can be repointed at different bytes after review, and a tag whose release failed does not resolve at all. Re-cut the manifest with a resolved digest for ${name}.`
+    });
+  }
+  return issues;
+}
+function manifestDeliveryBreakGlassServices(explicit) {
+  const raw = explicit ?? process.env.EXE_STACK_ALLOW_UNMANIFESTED_SERVICES ?? "";
+  return new Set(raw.split(",").map((s) => s.trim()).filter(Boolean));
+}
+function manifestDeliveryBreakGlassBanner(bypassed) {
+  const border = "=".repeat(72);
+  return [
+    "",
+    border,
+    "  !!!  SIGNED-MANIFEST DELIVERY GATE BYPASSED  !!!",
+    border,
+    "  These services are being deployed WITHOUT being pinned by the signed",
+    "  stack manifest. Nobody vouched for the bytes they will run:",
+    ...bypassed.map((issue) => `    - ${issue.service} (${issue.origin}): ${issue.reason}`),
+    "",
+    "  Authorised by --allow-unmanifested-services / EXE_STACK_ALLOW_UNMANIFESTED_SERVICES.",
+    "  Break-glass only. Publish these to the signed manifest and remove the override.",
+    border,
+    ""
+  ].join("\n");
+}
+function assertSignedManifestDeliveryGate(input) {
+  const warn = input.warn ?? ((message) => console.warn(message));
+  if (!input.release || typeof input.release.services !== "object" || input.release.services === null) {
+    throw new Error(
+      `Signed-manifest delivery gate: stack release ${input.targetVersion} has no services block. Refusing to deploy \u2014 a manifest that cannot be read cannot pin anything.`
+    );
+  }
+  if (Object.keys(input.release.services).length === 0) {
+    throw new Error(
+      `Signed-manifest delivery gate: stack release ${input.targetVersion} pins ZERO services. Refusing to deploy \u2014 an empty manifest release vouches for nothing.`
+    );
+  }
+  if (input.hostServicesUnavailable) {
+    warn(
+      `[stack-update] \u26A0\uFE0F  Signed-manifest delivery gate: could NOT enumerate running containers on this host. Services running outside compose cannot be checked against manifest ${input.targetVersion} on this run. The compose-declared half of the gate still applies.`
+    );
+  }
+  const issues = collectManifestDeliveryIssues({
+    release: input.release,
+    targetVersion: input.targetVersion,
+    composeRaw: input.composeRaw,
+    envRaw: input.envRaw,
+    hostServices: input.hostServices
+  });
+  if (issues.length === 0) return;
+  const allowed = manifestDeliveryBreakGlassServices(input.allowUnmanifestedServices);
+  const bypassed = issues.filter((i) => i.reason === "absent-from-manifest" && allowed.has(i.service));
+  const blocking = issues.filter((i) => !bypassed.includes(i));
+  if (bypassed.length > 0) warn(manifestDeliveryBreakGlassBanner(bypassed));
+  if (blocking.length === 0) return;
+  const details = blocking.map((i) => `- [${i.reason}] ${i.message}`).join("\n");
+  const absent = blocking.filter((i) => i.reason === "absent-from-manifest").map((i) => i.service);
+  throw new Error(
+    `Signed-manifest delivery gate REFUSED this deploy (stack ${input.targetVersion}).
+Every update goes to the signed stack manifest FIRST, then deploys. An image the manifest does not pin by digest is not deployable.
+${details}
+` + (absent.length > 0 ? `Emergency override for the ${absent.length} unmanifested service(s), which must be named explicitly:
+  exe-os stack-update --allow-unmanifested-services ${absent.join(",")} --yes
+  (or EXE_STACK_ALLOW_UNMANIFESTED_SERVICES=${absent.join(",")}). It is logged loudly at the point of use.` : `Re-cut the signed manifest with resolved digests, then re-run.`)
+  );
+}
 function writeBreakGlassAudit(plan, issues, options) {
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const stamp = now().toISOString().replace(/[:.]/g, "-");
@@ -1352,7 +1696,7 @@ async function verifyManifestImagesAvailable(plan, options) {
       let ok = false;
       for (let attempt = 1; attempt <= maxAttempts; attempt++) {
         try {
-          exec("docker", ["manifest", "inspect", image]);
+          exec("docker", ["manifest", "inspect", manifestInspectRef(image)]);
           ok = true;
           break;
         } catch (err) {
@@ -1539,7 +1883,7 @@ A first-party image whose version label does not match its tag cannot be traced
 }
 var PROBE_TIMEOUT_MS = 1e4;
 function commandSucceeds(cmd, args = []) {
-  const res = spawnSync2(cmd, args, {
+  const res = spawnSync(cmd, args, {
     stdio: "ignore",
     timeout: PROBE_TIMEOUT_MS,
     killSignal: "SIGKILL"
@@ -1547,7 +1891,7 @@ function commandSucceeds(cmd, args = []) {
   return res.status === 0;
 }
 function shellSucceeds(command) {
-  const res = spawnSync2("sh", ["-lc", command], {
+  const res = spawnSync("sh", ["-lc", command], {
     stdio: "ignore",
     timeout: PROBE_TIMEOUT_MS,
     killSignal: "SIGKILL"
@@ -1953,7 +2297,7 @@ function hardenHost(exec) {
   return result;
 }
 function hardenUfw(exec, result) {
-  const whichUfw = spawnSync2("which", ["ufw"], { stdio: ["pipe", "pipe", "pipe"], timeout: 5e3 });
+  const whichUfw = spawnSync("which", ["ufw"], { stdio: ["pipe", "pipe", "pipe"], timeout: 5e3 });
   const ufwInstalled = whichUfw.status === 0;
   if (!ufwInstalled) {
     if (!existsSync("/etc/os-release")) {
@@ -1978,7 +2322,7 @@ function hardenUfw(exec, result) {
       return;
     }
   }
-  const statusResult = spawnSync2("ufw", ["status", "verbose"], {
+  const statusResult = spawnSync("ufw", ["status", "verbose"], {
     encoding: "utf8",
     stdio: ["pipe", "pipe", "pipe"],
     timeout: 1e4
@@ -2130,7 +2474,7 @@ function hardenSsh(exec, result) {
 }
 function areStackContainersRunning(composeFile, envFile) {
   try {
-    const result = spawnSync2("docker", [...composeArgsForStack(composeFile, envFile), "ps", "-q"], {
+    const result = spawnSync("docker", [...composeArgsForStack(composeFile, envFile), "ps", "-q"], {
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 15e3
     });
@@ -2174,7 +2518,7 @@ function assertBindMountsExist(stackDir) {
 function assertVolumesIntact() {
   const missing = [];
   for (const vol of CRITICAL_VOLUMES) {
-    const result = spawnSync2("docker", ["volume", "inspect", `exe-os_${vol}`], {
+    const result = spawnSync("docker", ["volume", "inspect", `exe-os_${vol}`], {
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 5e3,
       killSignal: "SIGKILL"
@@ -2190,13 +2534,13 @@ function assertVolumesIntact() {
   }
 }
 function warnLegacyDaemonVolume() {
-  const legacy = spawnSync2("docker", ["volume", "inspect", "exe-os_exed_data"], {
+  const legacy = spawnSync("docker", ["volume", "inspect", "exe-os_exed_data"], {
     stdio: ["pipe", "pipe", "pipe"],
     timeout: 5e3,
     killSignal: "SIGKILL"
     // SIGTERM'd docker CLIs on a hung daemon linger as orphans
   });
-  const current = spawnSync2("docker", ["volume", "inspect", "exe-os_exe_os_data"], {
+  const current = spawnSync("docker", ["volume", "inspect", "exe-os_exe_os_data"], {
     stdio: ["pipe", "pipe", "pipe"],
     timeout: 5e3,
     killSignal: "SIGKILL"
@@ -2378,7 +2722,7 @@ async function runStackUpdate(options) {
   });
   assertBreakingChangesAllowed(plan, options.allowedBreakingChangeIds ?? []);
   assertDeploymentScopeAllowed(plan, options.deploymentPersona ?? "customer");
-  const requiredEnvValidation = options.dryRun ? { derived: {}, unresolvable: [] } : detectMissingRequiredEnvVars(stagedCompose.raw, envRaw);
+  const requiredEnvValidation = options.dryRun ? { derived: {}, unresolvable: [] } : detectMissingRequiredEnvVars(stagedCompose.raw, envRaw, targetRelease);
   const migratedEnvVars = requiredEnvValidation.derived;
   if (requiredEnvValidation.unresolvable.length > 0) {
     const lines = requiredEnvValidation.unresolvable.map((r) => `  - ${r.key}${r.message ? ` (${r.message})` : ""}`);
@@ -2392,6 +2736,18 @@ ${lines.join("\n")}`
     ...migratedEnvVars,
     ...Object.fromEntries(plan.changes.map((c) => [c.key, c.after]))
   });
+  const processPinned = syncImagePinsWithProcessEnv(plannedEnvRaw, requiredImagePinKeys(stagedCompose.raw, targetRelease));
+  if (processPinned.pinned.length > 0) {
+    console.log(
+      `[stack-update] Pinned validated image ref(s) into the deploy environment: ${processPinned.pinned.join(", ")}`
+    );
+  }
+  const processHealthBins = syncImagePinsWithProcessEnv(plannedEnvRaw, Object.values(MONITOR_HEALTH_BIN_ENV));
+  if (processHealthBins.pinned.length > 0 || processHealthBins.cleared.length > 0) {
+    console.log(
+      `[stack-update] Synced monitor healthcheck bin path(s) into the deploy environment: ${[...processHealthBins.pinned, ...processHealthBins.cleared].join(", ")}`
+    );
+  }
   assertProductionDeployGate(plan, plannedEnvRaw, composeRaw, {
     breakGlassReason: options.breakGlassReason,
     breakGlassAuditFile: options.breakGlassAuditFile,
@@ -2399,6 +2755,21 @@ ${lines.join("\n")}`
     now,
     envFile: options.envFile
   });
+  {
+    const hostState = listHostComposeServices(
+      composeArgsForStack(options.composeFile, options.envFile),
+      options.composePsCapture ?? defaultComposePsCapture
+    );
+    assertSignedManifestDeliveryGate({
+      release: manifest.stacks[plan.targetVersion],
+      targetVersion: plan.targetVersion,
+      composeRaw,
+      envRaw: plannedEnvRaw,
+      hostServices: hostState.services,
+      hostServicesUnavailable: hostState.unavailable,
+      allowUnmanifestedServices: options.allowUnmanifestedServices
+    });
+  }
   const previousVersion = readCurrentStackVersion(lockFile);
   if (options.verifyImages) {
     const endPhase = startPhase("verify images");
@@ -2754,9 +3125,14 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       ...RESTART_ORDER.filter((service) => scopedComposeServices.includes(service)),
       ...scopedComposeServices.filter((service) => !RESTART_ORDER.includes(service))
     ];
-    const preSnapshot = spawnSync2("docker", ["ps", "--format", "json"], { encoding: "utf8", timeout: 1e4 });
+    const preSnapshot = spawnSync("docker", ["ps", "--format", "json"], { encoding: "utf8", timeout: 1e4 });
     const preContainerCount = preSnapshot.stdout?.split("\n").filter(Boolean).length ?? 0;
     console.log(`[stack-update] Pre-update snapshot: ${preContainerCount} containers`);
+    const bundledIsolation = Object.keys(plan.release.services).length > 1;
+    const failedManifestServices = /* @__PURE__ */ new Set();
+    const failedComposeServices = /* @__PURE__ */ new Set();
+    const isolationRollbackErrors = [];
+    const partialHealthWarnings = [];
     let restartedAnyService = false;
     progress.resetCounter(restartOrder.length);
     progress.startPhase("restart");
@@ -2765,15 +3141,18 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       restartIndex++;
       const endRestart = startPhase(`restart ${service}`);
       const manifestServiceName = Object.entries(plan.release.services).find(([name, svc]) => (svc.composeService ?? name) === service)?.[0] ?? service;
-      const psResult = spawnSync2("docker", [...composeArgs, "ps", "--quiet", service], {
+      if (bundledIsolation && (failedComposeServices.has(service) || failedManifestServices.has(resolveOwningManifestService(service, plan.release.services)))) {
+        continue;
+      }
+      const serviceDefined = options.composeServiceExists ? options.composeServiceExists(service) : spawnSync("docker", [...composeArgs, "ps", "--quiet", service], {
         encoding: "utf8",
         stdio: ["pipe", "pipe", "pipe"],
         timeout: 1e4
-      });
-      if (psResult.status !== 0) continue;
+      }).status === 0;
+      if (!serviceDefined) continue;
       progress.logServiceStep(restartIndex, service, "Restarting");
       if (service === "exe-wiki") {
-        const guard = spawnSync2(
+        const guard = spawnSync(
           "docker",
           [...composeArgs, "run", "--rm", "--no-deps", "exe-wiki-schema-guard"],
           { encoding: "utf8", stdio: ["pipe", "inherit", "inherit"], timeout: 12e4 }
@@ -2788,19 +3167,19 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       restartedAnyService = true;
       updateServiceStatus(lockFile, manifestServiceName, "restarted", now);
       const maxWait = resolveServiceHealthTimeout(service, plan.release, options.healthTimeoutSecs);
-      let healthy = false;
-      for (let i = 0; i < maxWait; i++) {
-        const inspectResult = spawnSync2(
+      const probeHealth = options.inspectContainerHealth ?? ((svc) => {
+        const inspectResult = spawnSync(
           "docker",
-          ["inspect", "--format", "{{.State.Health.Status}}", service],
+          ["inspect", "--format", "{{.State.Health.Status}}", svc],
           { encoding: "utf8", timeout: 5e3 }
         );
-        const status = inspectResult.stdout?.trim();
-        if (status === "healthy") {
-          healthy = true;
-          break;
-        }
-        if (status === "" || inspectResult.status !== 0) {
+        if (inspectResult.status !== 0) return null;
+        return inspectResult.stdout?.trim() ?? "";
+      });
+      let healthy = false;
+      for (let i = 0; i < maxWait; i++) {
+        const status = probeHealth(service);
+        if (status === null || status === "" || status === "healthy") {
           healthy = true;
           break;
         }
@@ -2810,7 +3189,27 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
         const failMsg = `Service ${service} failed health check after ${maxWait}s`;
         progress.logServiceFailure(service, failMsg, options.composeFile);
         updateServiceStatus(lockFile, manifestServiceName, "failed", now, failMsg);
-        throw new Error(`${failMsg} \u2014 aborting update`);
+        if (!bundledIsolation) {
+          throw new Error(`${failMsg} \u2014 aborting update`);
+        }
+        const owner = resolveOwningManifestService(service, plan.release.services);
+        console.error(
+          `[stack-update] ISOLATED ROLLBACK (bug a5e29168): ${service} failed its health gate \u2014 reverting only ${owner} and its sidecars; the rest of the batch stays deployed.`
+        );
+        try {
+          await rollbackStackUpdate({ ...options, lockFile, serviceName: owner, isolateEnvScope: true });
+          console.error(`[stack-update] Isolated rollback of ${owner} complete; batch continues.`);
+        } catch (isoErr) {
+          const isoReason = isoErr instanceof Error ? isoErr.message : String(isoErr);
+          console.error(`[stack-update] Isolated rollback of ${owner} did not land healthy: ${isoReason}`);
+          isolationRollbackErrors.push(`${owner}: ${isoReason}`);
+        }
+        failedManifestServices.add(owner);
+        for (const cs of expandComposeServicesWithSidecars([plan.release.services[owner]?.composeService ?? owner])) {
+          failedComposeServices.add(cs);
+        }
+        updateServiceStatus(lockFile, owner, "failed", now, failMsg);
+        continue;
       }
       if (service === "exe-db") {
         applyPostgresInitSql(composeArgs, options.envFile, options.composeFile, exec);
@@ -2823,7 +3222,7 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
     if (!restartedAnyService) {
       exec("docker", [...composeArgs, "up", "-d", "--remove-orphans"]);
     }
-    const postSnapshot = spawnSync2("docker", ["ps", "--format", "json"], { encoding: "utf8", timeout: 1e4 });
+    const postSnapshot = spawnSync("docker", ["ps", "--format", "json"], { encoding: "utf8", timeout: 1e4 });
     const postContainerCount = postSnapshot.stdout?.split("\n").filter(Boolean).length ?? 0;
     console.log(`[stack-update] Post-update snapshot: ${postContainerCount} containers (was ${preContainerCount})`);
     if (postContainerCount < preContainerCount) {
@@ -2834,7 +3233,7 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       try {
         await verifyComposeServicesRunning(
           composeArgs,
-          restartOrder,
+          restartOrder.filter((s) => !failedComposeServices.has(s)),
           options.healthTimeoutSecs ?? 180,
           options.composePsCapture
         );
@@ -2842,9 +3241,38 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
         endPhase3();
       }
     }
+    {
+      const cfIngressConfigPath = path.join(path.dirname(options.composeFile), "cloudflared", "config.yml");
+      const cfIngressConfigYml = existsSync(cfIngressConfigPath) ? readFileSync(cfIngressConfigPath, "utf8") : null;
+      await verifyIngressTargetsReachable(
+        cfIngressConfigYml,
+        defaultIngressReachabilityProbe,
+        makeDefaultComposeServiceProbe(composeArgs)
+      );
+    }
     const stackEnv = existsSync(options.envFile) ? parseEnv(readFileSync(options.envFile, "utf8")) : void 0;
-    await verifyReleaseHealth(plan.release, options.healthRetries ?? 12, options.healthDelayMs ?? 5e3, stackEnv);
-    const releasePostMigrations = plan.release.migrations?.post;
+    const partialRun = failedManifestServices.size > 0;
+    if (partialRun) {
+      console.error(
+        `[stack-update] SKIPPING RELEASE-LEVEL POST-DEPLOY WORK (bug a5e29168): ${failedManifestServices.size} service(s) were rolled back in isolation (${[...failedManifestServices].join(", ")}), so the stack is mixed-version and has NOT fully reached ${plan.targetVersion}.
+  Skipped: release post-migrations, post-deploy health gate, volume-integrity assert, post-deploy verification, host hardening. The release health-URL probe still runs for the services that stayed deployed, but only to report \u2014 it can no longer abort the batch.
+  Re-run (or --resume) once the rolled-back service(s) are fixed so these run against a uniform ${plan.targetVersion} stack.`
+      );
+    }
+    if (partialRun) {
+      try {
+        await verifyReleaseHealth(plan.release, options.healthRetries ?? 12, options.healthDelayMs ?? 5e3, stackEnv, failedManifestServices);
+      } catch (healthErr) {
+        const reason = healthErr instanceof Error ? healthErr.message : String(healthErr);
+        console.error(
+          `[stack-update] Release health probe failed on the partial stack (NOT rolling back the batch \u2014 bug a5e29168): ${reason}`
+        );
+        partialHealthWarnings.push(reason);
+      }
+    } else {
+      await verifyReleaseHealth(plan.release, options.healthRetries ?? 12, options.healthDelayMs ?? 5e3, stackEnv, failedManifestServices);
+    }
+    const releasePostMigrations = partialRun ? void 0 : plan.release.migrations?.post;
     if (releasePostMigrations && releasePostMigrations.length > 0) {
       const endReleasePost = startPhase("release post-migrations");
       try {
@@ -2864,8 +3292,49 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       console.warn(`[stack-update] \u26A0 Overlay re-apply step failed (non-fatal): ${reason}`);
     }
     for (const serviceName of Object.keys(plan.release.services)) {
+      if (failedManifestServices.has(serviceName)) continue;
       updateServiceStatus(lockFile, serviceName, "completed", now);
     }
+    if (partialRun) {
+      progress.logOverallSummary();
+      printPhaseSummary();
+      const failedList = [...failedManifestServices];
+      const appliedList = Object.keys(plan.release.services).filter((s) => !failedManifestServices.has(s));
+      console.error(
+        `[stack-update] PARTIAL UPDATE (bug a5e29168): ${appliedList.length} service(s) deployed to ${plan.targetVersion}; ${failedList.length} rolled back in isolation and left on the previous image.
+  Applied:     ${appliedList.join(", ") || "(none)"}
+  Rolled back: ${failedList.join(", ")}` + (isolationRollbackErrors.length > 0 ? `
+  Rollback warnings:
+    - ${isolationRollbackErrors.join("\n    - ")}` : ""),
+        partialHealthWarnings.length > 0 ? `
+  Health-probe warnings (services left deployed but NOT answering their health URL):
+    - ${partialHealthWarnings.join("\n    - ")}` : ""
+      );
+      const partialLock = readStackUpdateLock(lockFile) ?? {};
+      writeStackUpdateLock(lockFile, {
+        ...partialLock,
+        previousVersion,
+        updatedAt: now().toISOString(),
+        backupEnvFile: partialLock.backupEnvFile ?? backupEnvFile,
+        backupComposeFile: partialLock.backupComposeFile ?? backupComposeFile,
+        backupComposeOverrideFile: partialLock.backupComposeOverrideFile ?? backupComposeOverrideFile,
+        hadComposeOverrideFile: partialLock.hadComposeOverrideFile ?? hadComposeOverrideFile,
+        mutatedEnvKeys: partialLock.mutatedEnvKeys ?? mutatedEnvKeys,
+        preUpdateImageDefaults: partialLock.preUpdateImageDefaults ?? configBackup.preUpdateImageDefaults,
+        services: { ...fullTargetPlan.release.services, ...partialLock.services ?? {}, ...plan.release.services }
+      });
+      const partialStaleness = evaluateDeployStaleness(readStackUpdateLock(lockFile), now);
+      if (partialStaleness) writeDeployStalenessAlert(partialStaleness);
+      await postDeployAudit(
+        options,
+        "partial",
+        plan.targetVersion,
+        previousVersion,
+        `Isolated rollback of: ${failedList.join(", ")}`,
+        { applied: appliedList.length, rolledBack: failedList.length }
+      );
+      return { status: "partial", targetVersion: plan.targetVersion, changes: plan.changes, backupEnvFile, lockFile, serviceStatus: readStackUpdateLock(lockFile)?.serviceStatus };
+    }
     try {
       if (!options.healthGate) {
         throw new Error("healthGate hook not provided");
@@ -3097,9 +3566,10 @@ function resolveHealthHost(serviceName, service, env) {
   }
   return expandEnvRefs(service.healthHost, env ?? /* @__PURE__ */ new Map());
 }
-async function verifyReleaseHealth(release, retries, delayMs, env) {
+async function verifyReleaseHealth(release, retries, delayMs, env, skipServices) {
   for (const [serviceName, service] of Object.entries(release.services)) {
     if (!service.healthUrl) continue;
+    if (skipServices?.has(serviceName)) continue;
     const hostHeader = resolveHealthHost(serviceName, service, env);
     await waitForHttpOk(service.healthUrl, retries, delayMs, serviceName, hostHeader);
   }
@@ -3107,7 +3577,7 @@ async function verifyReleaseHealth(release, retries, delayMs, env) {
 var defaultComposePsCapture = (composeArgs) => {
   let result;
   try {
-    result = spawnSync2("docker", [...composeArgs, "ps", "--all", "--format", "json"], {
+    result = spawnSync("docker", [...composeArgs, "ps", "--all", "--format", "json"], {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 2e4
@@ -3118,6 +3588,37 @@ var defaultComposePsCapture = (composeArgs) => {
   if (result.error || typeof result.status !== "number" || result.status !== 0) return null;
   return result.stdout?.toString() ?? "";
 };
+function listHostComposeServices(composeArgs, capture = defaultComposePsCapture) {
+  const stdout = capture(composeArgs);
+  if (stdout === null) return { services: [], unavailable: true };
+  const trimmed = stdout.trim().replace(/^/, "");
+  if (!trimmed) return { services: [], unavailable: false };
+  const records = [];
+  if (trimmed.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (Array.isArray(parsed)) records.push(...parsed);
+    } catch {
+    }
+  }
+  if (records.length === 0) {
+    for (const line of trimmed.split("\n")) {
+      const l = line.trim();
+      if (!l) continue;
+      try {
+        records.push(JSON.parse(l));
+      } catch {
+      }
+    }
+  }
+  if (records.length === 0) return { services: [], unavailable: true };
+  const services = /* @__PURE__ */ new Set();
+  for (const obj of records) {
+    const service = String(obj.Service ?? "").trim();
+    if (service) services.add(service);
+  }
+  return { services: [...services], unavailable: false };
+}
 function snapshotComposeServiceStates(composeArgs, wantedServices, capture) {
   const stdout = capture(composeArgs);
   if (stdout === null) return null;
@@ -3215,6 +3716,116 @@ Inspect with: docker compose ps --all`
     await new Promise((r) => setTimeout(r, 3e3));
   }
 }
+var INGRESS_PROBE_TIMEOUT_MS = 4e3;
+var defaultDockerCapture = (args) => {
+  let result;
+  try {
+    result = spawnSync("docker", args, { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 2e4 });
+  } catch (err) {
+    return { unavailable: true, status: null, stdout: "", stderr: err instanceof Error ? err.message : String(err) };
+  }
+  if (result.error) {
+    return { unavailable: true, status: null, stdout: "", stderr: result.error.message };
+  }
+  return {
+    unavailable: false,
+    status: typeof result.status === "number" ? result.status : null,
+    stdout: result.stdout?.toString() ?? "",
+    stderr: result.stderr?.toString() ?? ""
+  };
+};
+function isDockerDaemonUnavailable(stderr) {
+  const s = stderr.toLowerCase();
+  return s.includes("cannot connect to the docker daemon") || s.includes("is the docker daemon running") || s.includes("docker daemon is not running") || s.includes("error during connect") || s.includes("permission denied while trying to connect to the docker daemon");
+}
+function isComposeNetworkHost(host) {
+  const h = host.trim().toLowerCase();
+  if (h === "" || h === "localhost") return false;
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(h)) return false;
+  if (h.includes(":")) return false;
+  if (h.includes(".")) return false;
+  return true;
+}
+function isCloudflaredLoopbackHost(host) {
+  let h = host.trim().toLowerCase();
+  if (h === "") return false;
+  if (h === "localhost") return true;
+  if (h.startsWith("[") && h.endsWith("]")) h = h.slice(1, -1);
+  if (h === "::1" || h === "0:0:0:0:0:0:0:1") return true;
+  h = h.replace(/^::ffff:/, "");
+  if (/^127(?:\.\d{1,3}){3}$/.test(h)) return true;
+  return false;
+}
+function makeDefaultComposeServiceProbe(composeArgs, capture = defaultDockerCapture, hostProbe = defaultIngressReachabilityProbe) {
+  return async (service, port) => {
+    const ps = capture([...composeArgs, "ps", "-q", service]);
+    if (ps.unavailable || ps.status !== 0 && isDockerDaemonUnavailable(ps.stderr)) {
+      console.warn(`[stack-update] cloudflared ingress: cannot query docker for compose service '${service}'; treating as reachable (indeterminate)`);
+      return true;
+    }
+    const containerId = ps.stdout.trim().split(/\r?\n/)[0]?.trim() ?? "";
+    if (!containerId) return false;
+    const ins = capture(["inspect", "-f", "{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}", containerId]);
+    if (ins.unavailable || ins.status !== 0 && isDockerDaemonUnavailable(ins.stderr)) {
+      console.warn(`[stack-update] cloudflared ingress: cannot inspect container for compose service '${service}'; treating as reachable (indeterminate)`);
+      return true;
+    }
+    const ip = ins.stdout.trim().split(/\s+/).find((x) => x !== "") ?? "";
+    if (!ip) return false;
+    return hostProbe(ip, port);
+  };
+}
+function defaultIngressReachabilityProbe(host, port) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const socket = net.connect({ host, port });
+    const done = (reachable) => {
+      if (settled) return;
+      settled = true;
+      socket.destroy();
+      resolve(reachable);
+    };
+    socket.setTimeout(INGRESS_PROBE_TIMEOUT_MS);
+    socket.once("connect", () => done(true));
+    socket.once("timeout", () => done(false));
+    socket.once("error", (err) => {
+      if (err && (err.code === "ENOTFOUND" || err.code === "EAI_AGAIN")) done(true);
+      else done(false);
+    });
+  });
+}
+async function verifyIngressTargetsReachable(configYml, probe = defaultIngressReachabilityProbe, composeProbe) {
+  if (!configYml || configYml.trim() === "") return;
+  const targets = parseCloudflaredIngressTargets(configYml);
+  if (targets.length === 0) return;
+  const loopbackTargets = targets.filter((t) => isCloudflaredLoopbackHost(t.host));
+  const probeTargets = targets.filter((t) => !isCloudflaredLoopbackHost(t.host));
+  const effectiveProbe = composeProbe ? (host, port) => isComposeNetworkHost(host) ? composeProbe(host, port) : probe(host, port) : probe;
+  const probedUnreachable = await findUnreachableIngressTargets(probeTargets, effectiveProbe);
+  if (loopbackTargets.length === 0 && probedUnreachable.length === 0) {
+    console.log(`[stack-update] \u2713 cloudflared ingress: all ${targets.length} target(s) reachable`);
+    return;
+  }
+  const fmt = (t) => `${t.host}:${t.port}${t.hostname ? ` (hostname ${t.hostname})` : ""} [service ${t.service}]`;
+  const sections = [];
+  if (probedUnreachable.length > 0) {
+    sections.push(
+      `target(s) not accepting TCP connections:
+  - ${probedUnreachable.map(fmt).join("\n  - ")}
+\`cloudflared tunnel ingress validate\` only checks rule syntax; a rule pointing at a dead port validates cleanly and then 502s every request. Fix the target service/port (or remove the rule) and re-deploy.`
+    );
+  }
+  if (loopbackTargets.length > 0) {
+    sections.push(
+      `loopback target(s) unreachable from the cloudflared container:
+  - ${loopbackTargets.map(fmt).join("\n  - ")}
+cloudflared runs as a bridge-network container, so 127.0.0.1/localhost resolves to the tunnel container itself \u2014 not the deploy host where the app port is published \u2014 and every request 502s. Address the service by its docker-compose service name (e.g. \`http://exe-dashboard:PORT\`) and re-deploy.`
+    );
+  }
+  throw new Error(
+    `Cloudflared ingress reachability check failed (bug 57fcb5bf) \u2014 ${sections.join("\n\n")}`
+  );
+}
 async function waitForHttpOk(url, retries, delayMs, label, hostHeader) {
   let last = "";
   for (let i = 0; i < retries; i++) {
@@ -3329,7 +3940,7 @@ function parseComposeVolumeNames(composeRaw) {
   return names;
 }
 function volumeHasComposeProjectLabel(volumeName, projectName) {
-  const res = spawnSync2(
+  const res = spawnSync(
     "docker",
     ["volume", "inspect", volumeName, "--format", '{{ index .Labels "com.docker.compose.project" }}'],
     { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 1e4 }
@@ -3358,7 +3969,7 @@ function detectDanglingVolumes(scope) {
       byName.set(name, { name, driver: driver ?? "local", size: "" });
     }
   };
-  const labeled = spawnSync2(
+  const labeled = spawnSync(
     "docker",
     [
       "volume",
@@ -3373,7 +3984,7 @@ function detectDanglingVolumes(scope) {
     { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 3e4 }
   );
   if (labeled.status === 0 && labeled.stdout?.trim()) ingest(labeled.stdout, false);
-  const all = spawnSync2(
+  const all = spawnSync(
     "docker",
     ["volume", "ls", "--filter", "dangling=true", "--format", "{{.Name}}	{{.Driver}}"],
     { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 3e4 }
@@ -3388,14 +3999,14 @@ function detectDanglingVolumes(scope) {
 }
 function getVolumeSize(volumeName) {
   try {
-    const inspectResult = spawnSync2(
+    const inspectResult = spawnSync(
       "docker",
       ["volume", "inspect", volumeName, "--format", "{{.Mountpoint}}"],
       { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 1e4 }
     );
     const mountpoint = inspectResult.stdout?.trim();
     if (!mountpoint || inspectResult.status !== 0) return "unknown";
-    const duResult = spawnSync2(
+    const duResult = spawnSync(
       "du",
       ["-sh", mountpoint],
       { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 1e4 }
@@ -3424,7 +4035,7 @@ function removeDanglingVolumes(volumes, scope) {
       );
       continue;
     }
-    const checkResult = spawnSync2(
+    const checkResult = spawnSync(
       "docker",
       ["volume", "ls", "--filter", "dangling=true", "--filter", `name=^${vol.name}$`, "--format", "{{.Name}}"],
       { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], timeout: 1e4 }
@@ -3512,6 +4123,8 @@ export {
   parseComposeServiceNames,
   isUsableTunnelToken,
   isCloudflaredTunnelMisconfigured,
+  parseCloudflaredIngressTargets,
+  findUnreachableIngressTargets,
   resolveTransitiveDeps,
   filterServicesBySelection,
   buildDefaultServiceSelection,
@@ -3525,6 +4138,7 @@ export {
   runReleaseMigrations,
   isExecFormMigration,
   expandComposeServicesWithSidecars,
+  resolveOwningManifestService,
   composeArgsForStack,
   parseStackManifest,
   loadStackManifest,
@@ -3538,7 +4152,13 @@ export {
   resolveServerImageOverride,
   applyServerImageOverrideResolution,
   parseRequiredEnvRefs,
+  resolveManifestImagePin,
+  requiredImagePinKeys,
+  syncImagePinsWithProcessEnv,
   detectMissingRequiredEnvVars,
+  MONITOR_HEALTH_BIN_ENV,
+  MONITOR_IMAGE_TAG_ENV,
+  monitorHealthBinForImage,
   createStackUpdatePlan,
   isUnpinnedImageBreakGlassEnabled,
   isStrictDigestEnabled,
@@ -3546,10 +4166,17 @@ export {
   isThirdPartyImage,
   stripImageDigest,
   imagePullRef,
+  manifestInspectRef,
   collectProductionDeployGateIssues,
   collectImageAvailabilityIssues,
   assertDeploymentScopeAllowed,
   assertProductionDeployGate,
+  parseComposeServiceImages,
+  manifestCoveredComposeServices,
+  collectManifestDeliveryIssues,
+  manifestDeliveryBreakGlassServices,
+  manifestDeliveryBreakGlassBanner,
+  assertSignedManifestDeliveryGate,
   assertRolloutStageAllowed,
   assertBreakingChangesAllowed,
   verifyManifestImagesAvailable,
@@ -3569,7 +4196,13 @@ export {
   expandEnvRefs,
   resolveHealthHost,
   verifyReleaseHealth,
+  listHostComposeServices,
   verifyComposeServicesRunning,
+  isComposeNetworkHost,
+  isCloudflaredLoopbackHost,
+  makeDefaultComposeServiceProbe,
+  defaultIngressReachabilityProbe,
+  verifyIngressTargetsReachable,
   waitForHttpOk,
   httpStatus,
   defaultStackPaths,