@askexenow/exe-os 0.9.384 → 0.9.389

package/dist/stack-release-2CXFYVWM.js

@@ -0,0 +1,2770 @@
+#!/usr/bin/env node
+import {
+  writeSignedStackManifest
+} from "./chunk-SLMKLEU6.js";
+import "./chunk-UWVXQEQQ.js";
+import "./chunk-EC5H53YD.js";
+import {
+  assertPreflightGate,
+  runPreflightOnManifest
+} from "./chunk-JBUCA4OX.js";
+import "./chunk-B7WVYLAQ.js";
+import "./chunk-L25OAFOU.js";
+import "./chunk-RT57D7C4.js";
+import "./chunk-FWRPDSO3.js";
+import "./chunk-A7XLR3K7.js";
+import "./chunk-OSVTH3SG.js";
+import "./chunk-MMS2HBRT.js";
+import "./chunk-RH4AH3YB.js";
+import "./chunk-HSGBZSCA.js";
+import "./chunk-JKKZGDLP.js";
+import "./chunk-MLKGABMK.js";
+
+// src/bin/stack-release.ts
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync2, existsSync as existsSync2 } from "fs";
+import { execFile as execFileCb } from "child_process";
+import { promisify as promisify2 } from "util";
+import path3 from "path";
+import { createInterface } from "readline";
+
+// src/lib/release-lock.ts
+import {
+  closeSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import { homedir, hostname as osHostname } from "os";
+import path from "path";
+import process2 from "process";
+var DEFAULT_RELEASE_LOCK_TTL_MS = 2 * 60 * 60 * 1e3;
+function defaultReleaseLockPath() {
+  return path.join(homedir(), ".exe-os", "release.lock");
+}
+function defaultIsPidAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process2.kill(pid, 0);
+    return true;
+  } catch (err) {
+    const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+    return code === "EPERM";
+  }
+}
+function readLock(lockPath) {
+  const raw = readFileSync(lockPath, "utf8");
+  const parsed = JSON.parse(raw);
+  if (typeof parsed.pid !== "number" || typeof parsed.startedAt !== "string" || typeof parsed.targetVersion !== "string" || typeof parsed.branch !== "string" || typeof parsed.hostname !== "string") {
+    throw new Error("lock file is missing required fields");
+  }
+  return parsed;
+}
+function writeLockAtomic(lockPath, lock) {
+  mkdirSync(path.dirname(lockPath), { recursive: true });
+  const fd = openSync(lockPath, "wx", 384);
+  try {
+    writeFileSync(fd, JSON.stringify(lock, null, 2) + "\n", "utf8");
+  } finally {
+    closeSync(fd);
+  }
+}
+function sameLock(a, b) {
+  return a.pid === b.pid && a.startedAt === b.startedAt && a.targetVersion === b.targetVersion && a.branch === b.branch && a.hostname === b.hostname;
+}
+function acquireReleaseLock(opts) {
+  const lockPath = opts.lockPath ?? defaultReleaseLockPath();
+  const ttlMs = opts.ttlMs ?? DEFAULT_RELEASE_LOCK_TTL_MS;
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const isPidAlive = opts.isPidAlive ?? defaultIsPidAlive;
+  const logNote = opts.log ?? (() => {
+  });
+  if (existsSync(lockPath)) {
+    let existing = null;
+    try {
+      existing = readLock(lockPath);
+    } catch (err) {
+      const detail = err instanceof Error ? err.message : String(err);
+      if (!opts.force) {
+        throw new Error(
+          `release lock exists but cannot be read safely (${detail}); re-run with --force to override: ${lockPath}`
+        );
+      }
+      unlinkSync(lockPath);
+      logNote(`release lock force-cleared unreadable lock at ${lockPath}`);
+    }
+    if (existing) {
+      const startedMs = Date.parse(existing.startedAt);
+      if (!Number.isFinite(startedMs) && !opts.force) {
+        throw new Error(
+          `release lock exists with an invalid timestamp (${existing.startedAt}); re-run with --force to override: ${lockPath}`
+        );
+      }
+      const ageMs = Number.isFinite(startedMs) ? now.getTime() - startedMs : Number.POSITIVE_INFINITY;
+      const pidAlive = isPidAlive(existing.pid);
+      const fresh = ageMs < ttlMs && pidAlive;
+      if (fresh && !opts.force) {
+        throw new Error(
+          `release already in progress: pid ${existing.pid} started ${existing.startedAt}; re-run with --force to override`
+        );
+      }
+      unlinkSync(lockPath);
+      if (fresh) {
+        logNote(`release lock force-cleared: pid ${existing.pid} started ${existing.startedAt}`);
+      } else {
+        const reason = !pidAlive ? "pid is not alive" : `older than ${Math.round(ttlMs / 6e4)}m TTL`;
+        logNote(`stale release lock cleared: pid ${existing.pid} started ${existing.startedAt} (${reason})`);
+      }
+    }
+  }
+  const lock = {
+    pid: opts.pid ?? process2.pid,
+    startedAt: now.toISOString(),
+    targetVersion: opts.targetVersion,
+    branch: opts.branch,
+    hostname: opts.hostname ?? osHostname()
+  };
+  try {
+    writeLockAtomic(lockPath, lock);
+  } catch (err) {
+    const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+    if (code === "EEXIST") {
+      throw new Error(`release lock was acquired by another process; re-run when it completes: ${lockPath}`);
+    }
+    throw err;
+  }
+  return {
+    lockPath,
+    lock,
+    release: () => {
+      if (!existsSync(lockPath)) return;
+      try {
+        const current = readLock(lockPath);
+        if (sameLock(current, lock)) unlinkSync(lockPath);
+      } catch {
+      }
+    }
+  };
+}
+
+// src/lib/release-git-sha.ts
+function normalize(sha) {
+  const trimmed = sha?.trim();
+  return trimmed ? trimmed.toLowerCase() : void 0;
+}
+function decideManifestGitSha(sources, previousSha) {
+  const label = normalize(sources.imageLabelSha);
+  const tag = normalize(sources.tagCommitSha);
+  const previous = normalize(previousSha);
+  const warnings = [];
+  if (label) {
+    if (tag && tag !== label) {
+      warnings.push(
+        `image label org.exe.git_sha (${label}) disagrees with the release tag's commit (${tag}). Recording the LABEL \u2014 it describes the bytes actually pinned. The disagreement itself is a release-provenance defect worth chasing (bug 19674e79).`
+      );
+    }
+    return { gitSha: label, source: "image-label", warnings };
+  }
+  if (tag) {
+    warnings.push(
+      `image carries no org.exe.git_sha / org.opencontainers.image.revision label \u2014 recording the release tag's commit (${tag}) instead. This is declarative, not derived: it can only be trusted as far as the release checkout.`
+    );
+    return { gitSha: tag, source: "tag-commit", warnings };
+  }
+  warnings.push(
+    `no git SHA could be derived from the image and none resolved from the release tag \u2014 omitting gitSha (G4 deploy-time provenance will skip this service).`
+  );
+  if (previous) {
+    warnings.push(
+      `DROPPING the carried-forward gitSha ${previous} from the previous stack entry: the image has been re-pinned, so that commit no longer describes this entry. A provenance field is either correct or unknown, never confidently wrong (bug 19674e79).`
+    );
+  }
+  return { gitSha: void 0, source: "unknown", warnings };
+}
+function applyManifestGitSha(entry, sources) {
+  const previous = typeof entry.gitSha === "string" ? entry.gitSha : void 0;
+  const decision = decideManifestGitSha(sources, previous);
+  if (decision.gitSha) entry.gitSha = decision.gitSha;
+  else delete entry.gitSha;
+  return decision;
+}
+
+// scripts/lib/stack-release-repos.mjs
+import { readFileSync as readFileSync2 } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+var DELIVERY_CATALOG_PATH = join(
+  dirname(fileURLToPath(import.meta.url)),
+  "..",
+  "..",
+  "delivery",
+  "catalog.json"
+);
+var STACK_RELEASE_REPO_CONFIGS = Object.freeze([
+  {
+    serviceKey: "exe-os",
+    manifestServiceKey: "exe-os",
+    ghRepo: "AskExe/exe-os",
+    localDir: ".",
+    imageName: "update.askexe.com/askexe/exe-os",
+    releaseWorkflow: "release-stack-image.yml",
+    simpleTag: true,
+    defaultBranch: "main"
+  },
+  {
+    serviceKey: "gateway",
+    manifestServiceKey: "gateway",
+    ghRepo: "AskExe/exe-gateway",
+    localDir: "exe-gateway",
+    imageName: "update.askexe.com/askexe/exe-gateway",
+    releaseWorkflow: "release-image.yml",
+    simpleTag: true,
+    defaultBranch: "main"
+  },
+  {
+    serviceKey: "crm",
+    manifestServiceKey: "crm",
+    ghRepo: "AskExe/exe-crm",
+    localDir: "exe-crm",
+    imageName: "update.askexe.com/askexe/exe-crm",
+    releaseWorkflow: "release-stack-image.yml",
+    simpleTag: true,
+    defaultBranch: "main"
+  },
+  {
+    serviceKey: "erp",
+    manifestServiceKey: "erp",
+    ghRepo: "AskExe/exe-erp",
+    localDir: "exe-erp",
+    imageName: "update.askexe.com/askexe/exe-erp",
+    releaseWorkflow: "release-stack-image.yml",
+    simpleTag: true,
+    defaultBranch: "main"
+  },
+  {
+    serviceKey: "wiki",
+    manifestServiceKey: "wiki",
+    ghRepo: "AskExe/exe-wiki",
+    localDir: "exe-wiki",
+    imageName: "update.askexe.com/askexe/exe-wiki",
+    releaseWorkflow: "release-stack-image.yml",
+    simpleTag: true,
+    defaultBranch: "master"
+  },
+  {
+    serviceKey: "monitor-hub",
+    manifestServiceKey: "monitorHub",
+    ghRepo: "AskExe/exe-monitor",
+    localDir: "exe-monitor",
+    imageName: "update.askexe.com/askexe/exe-monitor-hub",
+    releaseWorkflow: "release-stack-image.yml",
+    simpleTag: true,
+    defaultBranch: "main"
+  },
+  {
+    serviceKey: "monitor-agent",
+    manifestServiceKey: "monitorAgent",
+    ghRepo: "AskExe/exe-monitor",
+    localDir: "exe-monitor",
+    imageName: "update.askexe.com/askexe/exe-monitor-agent",
+    releaseWorkflow: "release-stack-image.yml",
+    simpleTag: true,
+    defaultBranch: "main"
+  },
+  {
+    serviceKey: "exe-build",
+    manifestServiceKey: "exe-build",
+    ghRepo: "AskExe/exe-build",
+    localDir: "exe-build",
+    imageName: "update.askexe.com/askexe/exe-build",
+    releaseWorkflow: "release-stack-image.yml",
+    simpleTag: true,
+    defaultBranch: "main"
+  }
+]);
+var STACK_RECONCILE_APP_IMAGE_REPOS = Object.freeze([
+  // exe-auth is shipped in stack manifests but is not released by
+  // `stack-release`, so it must be covered by G6's exact-repo reconciliation map.
+  {
+    imageName: "update.askexe.com/askexe/exe-auth",
+    ghRepo: "AskExe/exe-auth"
+  },
+  // exe-dashboard: same gap — it was absent from both maps in this file, so
+  // G6's reconcile classified an unstamped dashboard image as "no expected
+  // source repo mapped here" (third-party, informational), exactly the false
+  // pass the "unstamped-third-party" distinction exists to avoid for images
+  // this repo family DOES build.
+  //
+  // 🔴 THE REPO HERE IS THE REPO THE IMAGE IS BUILT IN, NOT THE ONE THAT WILL
+  // EVENTUALLY OWN IT. G6 compares this value against the image's org.exe.repo
+  // label, which the shared release lane stamps with the repository the build
+  // actually ran in. exe-dashboard is still built from `dashboard-page/` INSIDE
+  // AskExe/exe-os (.github/workflows/release-dashboard-image.yml passes
+  // `context: dashboard-page`); AskExe/exe-dashboard exists but its history
+  // extraction is unfinished and nothing is built there yet. The real published
+  // ghcr.io/askexe/exe-dashboard:v0.9.382 carries org.exe.repo=AskExe/exe-os
+  // (recorded verbatim in release-service.yml's G2 arming note), so naming the
+  // destination repo here turns every correctly-stamped dashboard release into
+  // a "wrong-repo image (bug 218b10e4 class)" failure — and simultaneously
+  // makes that signal useless for the one service it would be reporting on.
+  //
+  // release-contract-services.mjs's `ghRepo: "AskExe/exe-dashboard"` is a
+  // different field with a different meaning: it names the repo that OWNS the
+  // service in the migration table. Copying it into this provenance map is how
+  // the wrong value got here.
+  //
+  // When the extraction completes, the lane's `context` flips to `.` and moves
+  // to AskExe/exe-dashboard; flip this with it. A test in
+  // tests/scripts/image-provenance.test.ts reads that `context` and fails if
+  // the two disagree, so this cannot drift silently a second time.
+  {
+    imageName: "update.askexe.com/askexe/exe-dashboard",
+    ghRepo: "AskExe/exe-os"
+  }
+]);
+
+// scripts/check-stack-release-drift.mjs
+import { readFileSync as readFileSync3 } from "fs";
+import path2 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { execFile } from "child_process";
+import { promisify } from "util";
+
+// scripts/lib/release-contract-services.mjs
+var CONTRACT_SERVICES = Object.freeze([
+  {
+    id: "exe-os",
+    releaseComponent: null,
+    // exe-os is the top-level descriptor in this repo
+    manifestService: "exe-os",
+    ghRepo: "AskExe/exe-os",
+    defaultBranch: "main",
+    healthPath: "/health",
+    releaseWorkflow: ".github/workflows/release-stack-image.yml",
+    status: "pending",
+    migrationOrder: 2,
+    gotcha: "release-stack-image.yml has a THIRD job (publish-stack-release) that posts the signed manifest to billing.stack_releases. The shared lane deliberately does not own manifest publication \u2014 that job stays in this repo and runs `needs:` the shared lane's outputs. Migrate only after PR #879 lands, or the build-local->verify->push ordering fix is lost in the rewrite."
+  },
+  {
+    id: "dashboard",
+    releaseComponent: "dashboard",
+    releaseEnvVar: "DASHBOARD_IMAGE_TAG",
+    composeService: "exe-dashboard",
+    manifestService: "dashboard",
+    ghRepo: "AskExe/exe-dashboard",
+    defaultBranch: "main",
+    healthPath: "/health",
+    releaseWorkflow: ".github/workflows/release-dashboard-image.yml",
+    status: "shared",
+    // THE PROOF REPO — migrated in this PR
+    migrationOrder: 0,
+    gotcha: "Future dashboard releases run in AskExe/exe-dashboard with root build context. exe-os publisher workflows are retired; its dashboard-page directory is frozen history. Existing image provenance mappings still name exe-os until a verified standalone image and its immutable deployment pins are switched together. See docs/dashboard-repository-extraction.md."
+  },
+  {
+    id: "gateway",
+    releaseComponent: null,
+    manifestService: "gateway",
+    ghRepo: "AskExe/exe-gateway",
+    defaultBranch: "main",
+    healthPath: "/health",
+    releaseWorkflow: null,
+    status: "pending",
+    migrationOrder: 1,
+    gotcha: "Cleanest migration after dashboard: single container, single Dockerfile, real JSON /health. Its current image tag is the date-stamped v2026.08.07-c15f093-stamped form, NOT vX.Y.Z \u2014 the shared lane's release-contract validator requires the semver tag, so the tag scheme must be converted in the same PR that adopts the lane."
+  },
+  {
+    id: "crm",
+    releaseComponent: null,
+    manifestService: "crm",
+    ghRepo: "AskExe/exe-crm",
+    defaultBranch: "main",
+    healthPath: "/healthz",
+    releaseWorkflow: null,
+    status: "pending",
+    migrationOrder: 3,
+    gotcha: "PROVEN UNTRUSTWORTHY PROVENANCE: image tag v0.9.54 was built from a different commit than git tag v0.9.54, and production ran an image hand-built from a since-deleted branch whose CI failed lint, typecheck, security scan and unit tests. Do NOT reuse any existing tag when adopting the lane \u2014 the immutability gate will refuse it, correctly. Cut a fresh version so the first shared-lane artifact has provenance that is true by construction."
+  },
+  {
+    id: "erp",
+    releaseComponent: "erp",
+    releaseEnvVar: "ERP_IMAGE_TAG",
+    composeService: "exe-erp",
+    manifestService: "erp",
+    ghRepo: "AskExe/exe-erp",
+    defaultBranch: "main",
+    healthPath: "/api/method/ping",
+    releaseWorkflow: null,
+    status: "pending",
+    migrationOrder: 4,
+    gotcha: 'FOUR CONTAINERS SHARE ONE IMAGE (exe-erp, exe-erp-websocket, exe-erp-worker, exe-erp-scheduler differ only by entrypoint). The shared lane builds ONE image, which is correct here \u2014 but the health probe must target the web container only, and the ERP /api/method/ping response is Frappe\'s `{"message":"pong"}`, so the health contract\'s `status` field check needs the `--status-field message` override rather than a waiver.'
+  },
+  {
+    id: "wiki",
+    releaseComponent: null,
+    manifestService: "wiki",
+    ghRepo: "AskExe/exe-wiki",
+    defaultBranch: "master",
+    // NOT main — the one repo that differs
+    healthPath: "/api/ping",
+    releaseWorkflow: null,
+    status: "pending",
+    migrationOrder: 5,
+    gotcha: "TWO traps. (1) Default branch is `master`, so the lane must be called with `default-branch: master` or the ancestry check fails closed on every release. (2) It is an Outline fork and carries INHERITED UPSTREAM TAGS (v0.7x.x) that sort ABOVE ours (v0.9.x is lower than upstream's\u2026 check before assuming) \u2014 the `v*.*.*` trigger will fire on an upstream tag fetched by a sync. Restrict the caller's tag filter to the AskExe release prefix before adoption."
+  },
+  {
+    id: "monitor-hub",
+    releaseComponent: null,
+    manifestService: "monitorHub",
+    ghRepo: "AskExe/exe-monitor",
+    defaultBranch: "main",
+    healthPath: "/api/health",
+    releaseWorkflow: null,
+    status: "pending",
+    migrationOrder: 6,
+    gotcha: "Release workflow has not run since 2026-05-12; v0.9.4 and v0.9.5 were hand-built from a workstation and v0.9.4 carries NO LABELS AT ALL \u2014 permanently untraceable, and the immutability gate cannot retroactively fix it. Do not attempt to re-stamp those tags. Adopt the lane at a NEW version and treat everything <= v0.9.5 as provenance-unknown. One repo publishes TWO images (hub + agent), so it calls the shared lane TWICE."
+  },
+  {
+    id: "monitor-agent",
+    releaseComponent: null,
+    manifestService: "monitorAgent",
+    ghRepo: "AskExe/exe-monitor",
+    defaultBranch: "main",
+    healthPath: null,
+    // ← genuinely absent today; a real, reported conformance gap
+    releaseWorkflow: null,
+    status: "pending",
+    migrationOrder: 7,
+    gotcha: "Has NO healthUrl in the stack manifest at all \u2014 the conformance check reports this as a missing health path rather than waiving it, because 'it's only an agent' is exactly the reasoning that left the dashboard unpinned. The agent must expose a JSON liveness endpoint before it can be marked `shared`. Second image out of AskExe/exe-monitor."
+  },
+  {
+    id: "auth",
+    releaseComponent: null,
+    manifestService: "auth",
+    ghRepo: "AskExe/exe-auth",
+    defaultBranch: "main",
+    // NOT /api/health — exe-auth 404s that path DELIBERATELY. nginx.conf adds an
+    // exact `location = /api/health` so GoTrue's version string is not exposed
+    // to the public internet (fingerprinting), and its comment states health of
+    // the container is the compose healthcheck on `/`. Verified against the
+    // running service: / -> 200, /__version -> 200, /api/health -> 404.
+    //
+    // The stale value here cost a full production rollback on 2026-09-08: the
+    // manifest probed /api/health, got 404, and the all-or-nothing update
+    // reverted ERP, CRM, wiki and exe-os along with auth.
+    healthPath: "/",
+    releaseWorkflow: null,
+    status: "pending",
+    migrationOrder: 8,
+    gotcha: "Not released by `stack-release` at all today (it is in STACK_RECONCILE_APP_IMAGE_REPOS, the escape list for images the release CLI does not cut). The 2026-08-14 incident \u2014 v0.6.0 tagged while production served the vulnerable v0.5.0 \u2014 is exactly the tag->publish gap the shared lane closes. Migrate LAST only because it needs the manifest-publish tail, which lands with exe-os."
+  }
+]);
+var THIRD_PARTY_MANIFEST_SERVICES = Object.freeze([
+  "exe-db",
+  // pgvector/pgvector — upstream Postgres
+  "gotrue",
+  // supabase/gotrue
+  "redis",
+  "clickhouse",
+  "cloudflared",
+  "exe-sso-edge",
+  // stock nginx:alpine
+  "exe-otel-collector"
+  // otel/opentelemetry-collector-contrib
+]);
+
+// scripts/check-stack-release-drift.mjs
+var execFileAsync = promisify(execFile);
+var ROOT = path2.resolve(path2.dirname(fileURLToPath2(import.meta.url)), "..");
+var COMMITTED_MANIFEST = path2.join(ROOT, "deploy", "stack-manifests", "v0.9.json");
+var DEFAULT_MANIFEST_URL = "https://update.askexe.com/v1/stack-manifest.json";
+var GHCR_NAMESPACE = "askexe";
+var GHCR_REPO_BY_SERVICE = {
+  "exe-os": "exe-os",
+  crm: "exe-crm",
+  wiki: "exe-wiki",
+  gateway: "exe-gateway",
+  auth: "exe-auth",
+  erp: "exe-erp",
+  // Bug 1a5fbbcc: dashboard is a first-party image (AskExe/exe-dashboard, its
+  // own entry in scripts/lib/release-contract-services.mjs and its own service
+  // in deploy/stack-manifests/v0.9.json) and had no entry here, so axis 2 could
+  // not look up its newest tag and reported "unknown" for it on every run.
+  dashboard: "exe-dashboard",
+  monitorHub: "exe-monitor-hub",
+  monitorAgent: "exe-monitor-agent",
+  // Third-party / infra, mirrored through the proxy but not released by us.
+  "exe-db": null,
+  gotrue: null,
+  redis: null,
+  clickhouse: null,
+  cloudflared: null,
+  "exe-sso-edge": null,
+  "exe-otel-collector": null
+};
+function auditServiceMapping(manifestServices, mapping = GHCR_REPO_BY_SERVICE, firstPartyServices = /* @__PURE__ */ new Set()) {
+  const findings = [];
+  for (const service of manifestServices) {
+    const mapped = Object.prototype.hasOwnProperty.call(mapping, service) ? mapping[service] : void 0;
+    if (mapped === void 0) {
+      findings.push({
+        service,
+        level: "unknown",
+        message: `${service}: no entry in GHCR_REPO_BY_SERVICE, so the pinned-vs-built axis cannot resolve it and would report "unknown" on every run forever. Add \`` + service + ': "exe-<name>"` for a first-party image, or `' + service + ": null` to declare it deliberately third-party."
+      });
+      continue;
+    }
+    if (mapped === null && firstPartyServices.has(service)) {
+      findings.push({
+        service,
+        level: "unknown",
+        message: `${service}: mapped to null ("third-party, deliberately untracked") but the release contract declares it FIRST-PARTY. null would skip it silently on every run \u2014 map it to its ghcr repo.`
+      });
+    }
+  }
+  return findings;
+}
+function firstPartyManifestServices() {
+  try {
+    return new Set(CONTRACT_SERVICES.map((s) => s.manifestService).filter(Boolean));
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+function tagOf(image) {
+  if (typeof image !== "string") return null;
+  const withoutDigest = image.split("@")[0] ?? "";
+  const lastColon = withoutDigest.lastIndexOf(":");
+  const lastSlash = withoutDigest.lastIndexOf("/");
+  return lastColon > lastSlash ? withoutDigest.slice(lastColon + 1) : null;
+}
+function compareVersionTags(a, b) {
+  const parse = (t) => {
+    const m = /^v(\d+)\.(\d+)\.(\d+)$/.exec(t ?? "");
+    return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+  };
+  const pa = parse(a);
+  const pb = parse(b);
+  if (!pa && !pb) return 0;
+  if (!pa) return -1;
+  if (!pb) return 1;
+  for (let i = 0; i < 3; i++) {
+    if (pa[i] !== pb[i]) return pa[i] - pb[i];
+  }
+  return 0;
+}
+function anchoredReleaseTags(tags, pinnedTag) {
+  const anchor = /^v(\d+)\.\d+\.\d+$/.exec(pinnedTag ?? "");
+  const major = anchor ? anchor[1] : null;
+  const out = [];
+  for (const t of tags ?? []) {
+    const m = /^v(\d+)\.\d+\.\d+$/.exec(t);
+    if (!m) continue;
+    if (major !== null && m[1] !== major) continue;
+    out.push(t);
+  }
+  return out.sort((a, b) => compareVersionTags(b, a));
+}
+function anchoredReleaseTagsNewerThan(tags, pinnedTag) {
+  return anchoredReleaseTags(tags, pinnedTag).filter((t) => compareVersionTags(t, pinnedTag) > 0);
+}
+function newestReleaseTag(tags, pinnedTag) {
+  return anchoredReleaseTags(tags, pinnedTag)[0] ?? null;
+}
+function manifestAuthHeader(env = process.env) {
+  const explicit = env.EXE_STACK_MANIFEST_TOKEN;
+  if (explicit) return explicit.includes(" ") ? explicit : `Bearer ${explicit}`;
+  const pull = (env.EXE_REGISTRY_PROXY_PULL_TOKENS || env.EXE_REGISTRY_PROXY_PULL_TOKEN || "").split(",").map((t) => t.trim()).find(Boolean);
+  if (pull) return `Bearer ${pull}`;
+  if (env.EXE_LICENSE_KEY) return `Bearer ${env.EXE_LICENSE_KEY}`;
+  return null;
+}
+async function fetchServedManifest(url) {
+  const headers = { accept: "application/json" };
+  const auth = manifestAuthHeader();
+  if (auth) headers.authorization = auth;
+  const res = await fetch(url, { headers });
+  if (!res.ok) {
+    throw new Error(
+      `GET ${url} -> ${res.status}. ` + (res.status === 401 ? "The manifest endpoint requires Authorization: Bearer <pull token | license key>. Set EXE_REGISTRY_PROXY_PULL_TOKENS, EXE_LICENSE_KEY, or EXE_STACK_MANIFEST_TOKEN." : "Cannot compare served vs committed without it.")
+    );
+  }
+  return res.json();
+}
+async function ghcrToken() {
+  if (process.env.GHCR_TOKEN) return process.env.GHCR_TOKEN;
+  try {
+    const { stdout } = await execFileAsync("gh", ["auth", "token"]);
+    return stdout.trim();
+  } catch {
+    return null;
+  }
+}
+async function ghcrTags(repo, token) {
+  const res = await fetch(`https://ghcr.io/v2/${GHCR_NAMESPACE}/${repo}/tags/list?n=1000`, {
+    headers: { authorization: `Bearer ${Buffer.from(token, "utf8").toString("base64")}` }
+  });
+  if (!res.ok) throw new Error(`ghcr tags/list ${repo} -> ${res.status}`);
+  const body = await res.json();
+  return body.tags ?? [];
+}
+var OCI_ACCEPT = [
+  "application/vnd.oci.image.index.v1+json",
+  "application/vnd.oci.image.manifest.v1+json",
+  "application/vnd.docker.distribution.manifest.list.v2+json",
+  "application/vnd.docker.distribution.manifest.v2+json"
+].join(", ");
+async function refExists(repo, ref, token) {
+  const head = (path4) => fetch(`https://ghcr.io/v2/${GHCR_NAMESPACE}/${repo}/${path4}`, {
+    method: "HEAD",
+    headers: {
+      accept: OCI_ACCEPT,
+      authorization: `Bearer ${Buffer.from(token, "utf8").toString("base64")}`
+    }
+  });
+  const res = await head(`manifests/${ref}`);
+  if (res.ok) return true;
+  if (res.status !== 404) throw new Error(`ghcr manifests/${ref} -> ${res.status}`);
+  const repoVisible = await fetch(
+    `https://ghcr.io/v2/${GHCR_NAMESPACE}/${repo}/tags/list?n=1`,
+    {
+      headers: {
+        accept: OCI_ACCEPT,
+        authorization: `Bearer ${Buffer.from(token, "utf8").toString("base64")}`
+      }
+    }
+  );
+  if (repoVisible.status === 404 || repoVisible.status === 403) {
+    throw new Error(
+      `cannot see ghcr.io/${GHCR_NAMESPACE}/${repo} at all (manifests/${ref} -> 404, tags/list -> ${repoVisible.status}). ghcr hides packages an authenticated caller cannot read \u2014 404 on a manifest, 403 on the tag list \u2014 so this is an AUTHORISATION gap, not proof the digest is absent \u2014 the token is missing the \`read:packages\` scope. Set GHCR_TOKEN to a PAT that has it; \`gh auth token\` does not. Reported as unverified rather than as a phantom pin, because an unreadable registry is not a registry that says no.`
+    );
+  }
+  if (!repoVisible.ok) throw new Error(`ghcr tags/list for ${repo} -> ${repoVisible.status}`);
+  return false;
+}
+function digestOf(image) {
+  const m = /@(sha256:[a-f0-9]{64})$/.exec(image ?? "");
+  return m ? m[1] : null;
+}
+async function deployedUpdateVersion() {
+  const healthUrl = process.env.EXE_UPDATE_HEALTH_URL || new URL("/health", process.env.EXE_STACK_MANIFEST_URL || DEFAULT_MANIFEST_URL).toString();
+  try {
+    const res = await fetch(healthUrl, { headers: { accept: "application/json" } });
+    if (res.ok) {
+      const body = await res.json();
+      const reported = body?.version ?? body?.appVersion ?? null;
+      if (typeof reported === "string" && reported.length > 0) {
+        return { source: `GET ${healthUrl}`, version: reported.startsWith("v") ? reported : `v${reported}` };
+      }
+    }
+  } catch {
+  }
+  const host = process.env.EXE_UPDATE_SSH_HOST;
+  if (!host) return null;
+  const stdout = await dockerPs(host);
+  if (stdout === null) return null;
+  const line = stdout.split("\n").find((l) => l.startsWith("exe-update "));
+  if (!line) return { source: `ssh ${host}`, version: null };
+  return { source: `ssh ${host}`, version: tagOf(line.split(" ")[1]) };
+}
+var dockerPsCache;
+var UNINSPECTABLE_MARK = "@uninspectable@";
+var DOCKER_INVENTORY_CMD = `docker ps --format '{{.ID}} {{.Names}}' | while read id name; do ref=$(docker inspect -f '{{.Config.Image}}' "$id" 2>/dev/null); if [ -z "$ref" ]; then echo "` + UNINSPECTABLE_MARK + ` $name"; continue; fi; imgid=$(docker inspect -f '{{.Image}}' "$id" 2>/dev/null); digests=; if [ -n "$imgid" ]; then digests=$(docker inspect -f '{{range .RepoDigests}}{{.}} {{end}}' "$imgid" 2>/dev/null); fi; echo "$name $ref $digests"; done`;
+function uninspectableContainers(stdout) {
+  const names = [];
+  for (const line of String(stdout ?? "").split("\n")) {
+    const fields = line.trim().split(/\s+/).filter(Boolean);
+    if (fields[0] === UNINSPECTABLE_MARK) names.push(fields[1] ?? "<unnamed>");
+  }
+  return names;
+}
+function unattributableContainers(stdout) {
+  const names = [];
+  for (const line of String(stdout ?? "").split("\n")) {
+    const fields = line.trim().split(/\s+/).filter(Boolean);
+    if (fields.length === 0 || fields[0] === UNINSPECTABLE_MARK) continue;
+    const image = fields[1];
+    if (!image) continue;
+    const refs = fields.slice(2);
+    const repo = looksLikeImageId(image) ? refs.map(repoPathOf).find(Boolean) ?? null : repoPathOf(image);
+    if (!repo) names.push(fields[0]);
+  }
+  return names;
+}
+async function dockerPs(host) {
+  if (dockerPsCache !== void 0) return dockerPsCache;
+  try {
+    const { stdout } = await execFileAsync("ssh", ["-o", "BatchMode=yes", host, DOCKER_INVENTORY_CMD]);
+    dockerPsCache = stdout;
+  } catch {
+    dockerPsCache = null;
+  }
+  return dockerPsCache;
+}
+function repoPathOf(image) {
+  if (typeof image !== "string") return null;
+  const withoutDigest = image.split("@")[0] ?? "";
+  const lastColon = withoutDigest.lastIndexOf(":");
+  const lastSlash = withoutDigest.lastIndexOf("/");
+  return lastColon > lastSlash ? withoutDigest.slice(0, lastColon) : withoutDigest || null;
+}
+function parseFleetInventory(stdout) {
+  const byRepo = /* @__PURE__ */ new Map();
+  for (const line of String(stdout ?? "").split("\n")) {
+    const fields = line.trim().split(/\s+/).filter(Boolean);
+    if (fields[0] === UNINSPECTABLE_MARK) continue;
+    const image = fields[1];
+    if (!image) continue;
+    const refs = fields.slice(2);
+    const isImageId = looksLikeImageId(image);
+    const repo = isImageId ? refs.map(repoPathOf).find(Boolean) ?? null : repoPathOf(image);
+    if (!repo) continue;
+    const digest = (isImageId ? null : digestOf(image)) ?? refs.map((ref) => repoPathOf(ref) === repo ? digestOf(ref) : null).find(Boolean) ?? null;
+    if (!byRepo.has(repo)) byRepo.set(repo, []);
+    byRepo.get(repo).push({ name: fields[0] ?? "<unnamed>", tag: isImageId ? null : tagOf(image), digest });
+  }
+  return byRepo;
+}
+function looksLikeImageId(field) {
+  if (typeof field !== "string" || field.includes("/") || field.includes("@")) return false;
+  if (/^sha256:[0-9a-f]{12,64}$/i.test(field)) return true;
+  return !field.includes(":") && /^[0-9a-f]{12,64}$/i.test(field);
+}
+function classifyContainer(pinnedTag, pinnedDigest, container) {
+  if (pinnedDigest && container.digest) {
+    return container.digest === pinnedDigest ? ["ok", `${container.name}: ${container.tag ?? "digest-only"} at the pinned digest`] : [
+      "drift",
+      `${container.name}: running ${container.tag ?? "digest-only"} at digest ${container.digest}, but the signed manifest pins ${pinnedDigest}` + (container.tag && container.tag === pinnedTag ? " \u2014 SAME TAG, DIFFERENT BYTES" : "")
+    ];
+  }
+  if (pinnedTag && container.tag && container.tag !== pinnedTag) {
+    return ["drift", `${container.name}: running ${container.tag}, manifest pins ${pinnedTag}`];
+  }
+  if (pinnedDigest) {
+    return [
+      "unknown",
+      `${container.name}: runs ${container.tag ?? "an untagged image"} but reports no repo digest, so its BYTES could not be compared against the pinned ${pinnedDigest}. A matching tag is not proof of matching bytes (bug b817e34c) \u2014 reported as unchecked, not as matching`
+    ];
+  }
+  if (!container.tag) {
+    return [
+      "unknown",
+      `${container.name}: runs a digest-only image and the manifest pin is TAG-ONLY, so there is nothing comparable on either side`
+    ];
+  }
+  return [
+    "ok",
+    `${container.name}: running ${container.tag}, as pinned (the manifest pin is TAG-ONLY, so this compares tags, not bytes \u2014 pin a digest to make it byte-checkable)`
+  ];
+}
+function evaluateFleetDeployment(services, running, uninspectable = null) {
+  const AXIS = "manifest-vs-deployed";
+  if (running === null) {
+    if (uninspectable && uninspectable.length > 0) {
+      return [{
+        axis: AXIS,
+        level: "unknown",
+        message: `the container inventory is INCOMPLETE: ${uninspectable.length} container(s) (${uninspectable.join(", ")}) could not be accounted for \u2014 either the inspect failed (they disappeared between \`docker ps\` and \`docker inspect\`, the signature of A DEPLOY IN FLIGHT, exactly when this axis matters most) or it returned no repository path to file them under (a bare image ID with no RepoDigests, which is what Docker reports once a reference stops resolving to the bytes in use \u2014 i.e. A MOVED TAG). A partial listing cannot answer whether the manifest describes what is deployed: the container missing from it is precisely the one that would have shown drift, and a sibling on the pinned digest would cover for it. Reported as unobserved rather than quietly filtered out (bug fd7535ab).`
+      }];
+    }
+    return [{
+      axis: AXIS,
+      level: "unknown",
+      message: "the running fleet could not be observed, so it is UNKNOWN whether the signed manifest describes what is deployed. Set EXE_UPDATE_SSH_HOST so the container inventory can be read on the stack host. There is deliberately no env var to declare the deployed versions by hand: a value someone typed is not an observation (bug fd7535ab)."
+    }];
+  }
+  const findings = [];
+  for (const [service, svc] of Object.entries(services ?? {})) {
+    if (GHCR_REPO_BY_SERVICE[service] === null) continue;
+    const repo = repoPathOf(svc?.image);
+    const pinnedTag = tagOf(svc?.image);
+    const pinnedDigest = digestOf(svc?.image);
+    if (!repo || !pinnedTag && !pinnedDigest) {
+      findings.push({ axis: AXIS, level: "unknown", message: `${service}: manifest pin "${svc?.image ?? "<none>"}" has no readable repo/tag/digest to compare` });
+      continue;
+    }
+    const containers = running.get(repo) ?? [];
+    if (containers.length === 0) {
+      findings.push({
+        axis: AXIS,
+        level: "unknown",
+        message: `${service}: no running container found for ${repo}. Not observed is not "matches" \u2014 the manifest's claim about this service is unchecked.`
+      });
+      continue;
+    }
+    const verdicts = containers.map((c) => classifyContainer(pinnedTag, pinnedDigest, c));
+    const drifted = verdicts.filter(([lvl]) => lvl === "drift");
+    const unchecked = verdicts.filter(([lvl]) => lvl === "unknown");
+    const pin = `${repo}${pinnedTag ? `:${pinnedTag}` : ""}${pinnedDigest ? `@${pinnedDigest}` : ""}`;
+    if (drifted.length > 0) {
+      findings.push({
+        axis: AXIS,
+        level: "drift",
+        message: `${service}: the signed manifest pins ${pin} but the fleet does not match \u2014 ` + drifted.map(([, d]) => d).join("; ") + '. The manifest does not describe the deployed bytes, so it cannot answer "what is deployed?", and a rollback would move production to a version nobody blessed (bug fd7535ab).'
+      });
+      continue;
+    }
+    if (unchecked.length > 0) {
+      findings.push({
+        axis: AXIS,
+        level: "unknown",
+        message: `${service}: pinned ${pin}; ${unchecked.length} of ${containers.length} container(s) could not be verified \u2014 ${unchecked.map(([, d]) => d).join("; ")}`
+      });
+      continue;
+    }
+    findings.push({ axis: AXIS, level: "ok", message: `${service}: ${verdicts.map(([, d]) => d).join("; ")}` });
+  }
+  if (findings.length === 0) {
+    findings.push({
+      axis: AXIS,
+      level: "unknown",
+      message: "the committed manifest pins no first-party service, so nothing was compared against the fleet"
+    });
+  }
+  return findings;
+}
+function parseMaxAgeDays(raw) {
+  if (raw === void 0 || raw === "") return 7;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n <= 0) return null;
+  return n;
+}
+function evaluateReleaseFreshness(served, maxAgeDays, nowMs) {
+  if (!served) {
+    return ["unknown", "cannot check release freshness without the served manifest (see served-vs-committed above for why it could not be read)"];
+  }
+  const entry = served.stacks?.[served.latest];
+  const releasedAt = entry?.releasedAt ? Date.parse(entry.releasedAt) : NaN;
+  if (!entry || Number.isNaN(releasedAt)) {
+    return ["unknown", `served manifest entry for latest="${served.latest}" has no readable releasedAt timestamp`];
+  }
+  const ageDays = (nowMs - releasedAt) / 864e5;
+  if (ageDays > maxAgeDays) {
+    return [
+      "drift",
+      `newest published stack release (${served.latest}, released ${entry.releasedAt}) is ${ageDays.toFixed(1)} days old, past the ${maxAgeDays}-day threshold. Silence itself is a failure: bug ed73c73f is a 3-month-wide drift that nothing was watching for because no check ever asked whether a release had shipped recently.`
+    ];
+  }
+  return ["ok", `${served.latest} released ${ageDays.toFixed(1)} day(s) ago (<= ${maxAgeDays}d threshold)`];
+}
+function decideExitCode(findings, opts = {}) {
+  const warnOnly = opts.warnOnly === true;
+  const driftCount = findings.filter((f) => f.level === "drift").length;
+  const unknownCount = findings.filter((f) => f.level === "unknown").length;
+  if (driftCount > 0) {
+    if (warnOnly && unknownCount === 0) {
+      return { code: 0, reason: "warn-only", driftCount, unknownCount };
+    }
+    if (warnOnly) {
+      return { code: 3, reason: "unverified", driftCount, unknownCount };
+    }
+    return { code: 1, reason: "drift", driftCount, unknownCount };
+  }
+  if (unknownCount > 0) {
+    return { code: 3, reason: "unverified", driftCount, unknownCount };
+  }
+  return { code: 0, reason: "ok", driftCount, unknownCount };
+}
+function selfTest() {
+  const RED = "\x1B[31m";
+  const GREEN = "\x1B[32m";
+  const OFF = "\x1B[0m";
+  const ok = [{ axis: "pinned-vs-built", level: "ok", message: "current" }];
+  const drift = [
+    { axis: "pinned-vs-built", level: "drift", message: "exe-os: manifest pins v0.9.324 but v0.9.379 shipped" }
+  ];
+  const unverified = [
+    { axis: "served-vs-committed", level: "unknown", message: "GET .../stack-manifest.json -> 401, no credential" }
+  ];
+  const driftAndUnverified = [...drift, ...unverified];
+  const cases = [
+    ["all-ok passes (exit 0)", decideExitCode(ok).code === 0],
+    ["drift fails (exit 1), not exit 3", decideExitCode(drift).code === 1],
+    [
+      "unverified-only fails (exit 3), not exit 1 (bug 4f8fbe9d: never report as drift)",
+      decideExitCode(unverified).code === 3
+    ],
+    [
+      "drift wins over unverified when both present (exit 1)",
+      decideExitCode(driftAndUnverified).code === 1
+    ],
+    [
+      "--warn-only downgrades pure drift to exit 0 (opt-in escape hatch only)",
+      decideExitCode(drift, { warnOnly: true }).code === 0
+    ],
+    [
+      `--warn-only does NOT downgrade unverified-only (exit 3, bug ed73c73f follow-up: warn-only must never suppress "I don't know")`,
+      decideExitCode(unverified, { warnOnly: true }).code === 3
+    ],
+    [
+      "--warn-only does NOT downgrade drift+unverified together either (exit 3, not 0) (bug ed73c73f follow-up: the unverified finding must survive even when drift is present)",
+      decideExitCode(driftAndUnverified, { warnOnly: true }).code === 3
+    ],
+    ["counts are reported alongside the code", (() => {
+      const r = decideExitCode(driftAndUnverified);
+      return r.driftCount === 1 && r.unknownCount === 1;
+    })()]
+  ];
+  const NOW = Date.parse("2026-09-08T00:00:00Z");
+  const DAY = 864e5;
+  const freshManifest = { latest: "0.9.40", stacks: { "0.9.40": { releasedAt: new Date(NOW - 2 * DAY).toISOString() } } };
+  const staleManifest = { latest: "0.9.36", stacks: { "0.9.36": { releasedAt: new Date(NOW - 90 * DAY).toISOString() } } };
+  cases.push(
+    ["release-freshness: recent release is ok", evaluateReleaseFreshness(freshManifest, 7, NOW)[0] === "ok"],
+    [
+      "release-freshness: stale release fails as drift, not unknown (silence is the failure, bug ed73c73f)",
+      evaluateReleaseFreshness(staleManifest, 7, NOW)[0] === "drift"
+    ],
+    [
+      "release-freshness: no served manifest is unknown, never ok",
+      evaluateReleaseFreshness(null, 7, NOW)[0] === "unknown"
+    ],
+    ["parseMaxAgeDays: default (unset) is 7", parseMaxAgeDays(void 0) === 7],
+    [
+      "parseMaxAgeDays: valid numeric string still detects staleness",
+      evaluateReleaseFreshness(staleManifest, parseMaxAgeDays("7"), NOW)[0] === "drift"
+    ],
+    [
+      "parseMaxAgeDays: non-numeric value REFUSES (null), never silently defaults (bug ed73c73f follow-up: NaN compared against anything is false, which OK'd a 90-day-stale manifest under 'invalid')",
+      parseMaxAgeDays("invalid") === null
+    ],
+    [
+      "parseMaxAgeDays: Infinity REFUSES too (every age is <= Infinity, so nothing could ever drift)",
+      parseMaxAgeDays("Infinity") === null
+    ],
+    [
+      "parseMaxAgeDays: zero REFUSES (nonsensical as a monitoring threshold)",
+      parseMaxAgeDays("0") === null
+    ],
+    ["parseMaxAgeDays: negative REFUSES", parseMaxAgeDays("-5") === null]
+  );
+  const DIG_A = "sha256:" + "a".repeat(64);
+  const DIG_B = "sha256:" + "b".repeat(64);
+  const REPO = "update.askexe.com/askexe/exe-crm";
+  const PINS = {
+    crm: { image: `${REPO}:v0.9.53@${DIG_A}` },
+    redis: { image: "redis:7" }
+  };
+  const inv = (...lines) => parseFleetInventory(lines.join("\n") + "\n");
+  const levels = (fs) => fs.map((f) => f.level);
+  const only = (pins, ...lines) => levels(evaluateFleetDeployment(pins, inv(...lines)));
+  cases.push(
+    [
+      "fleet AHEAD of the manifest is DRIFT, not ok (fd7535ab ran newer, not older)",
+      only(PINS, `exe-crm ${REPO}:v0.9.58 ${REPO}@${DIG_B}`).includes("drift")
+    ],
+    [
+      "same tag, DIFFERENT digest is DRIFT \u2014 a matching tag is not proof of matching bytes (codex [P1])",
+      only(PINS, `exe-crm ${REPO}:v0.9.53 ${REPO}@${DIG_B}`).includes("drift")
+    ],
+    [
+      "same tag with NO observable digest is UNKNOWN, never ok, when the pin carries one",
+      only(PINS, `exe-crm ${REPO}:v0.9.53`)[0] === "unknown"
+    ],
+    [
+      "a DIGEST-ONLY container matching the pinned digest is OK \u2014 an absent tag is missing metadata, not a mismatch (codex [P1])",
+      only(PINS, `exe-crm ${REPO}@${DIG_A}`)[0] === "ok"
+    ],
+    [
+      "one verified + one UNVERIFIABLE container is UNKNOWN, not ok \u2014 'somebody matched' is not 'everybody matched' (codex [P1])",
+      only(PINS, `a ${REPO}:v0.9.53 ${REPO}@${DIG_A}`, `b ${REPO}:v0.9.53`)[0] === "unknown"
+    ],
+    [
+      "one verified + one DRIFTED container is DRIFT (worst verdict wins)",
+      only(PINS, `a ${REPO}:v0.9.53 ${REPO}@${DIG_A}`, `b ${REPO}:v0.9.58 ${REPO}@${DIG_B}`)[0] === "drift"
+    ],
+    [
+      "a fleet that matches tag AND digest is ok (a fix that refuses everything is not a fix)",
+      only(PINS, `exe-crm ${REPO}:v0.9.53 ${REPO}@${DIG_A}`).every((l) => l === "ok")
+    ],
+    [
+      "an unobservable fleet is UNKNOWN, never ok",
+      evaluateFleetDeployment(PINS, null)[0].level === "unknown"
+    ],
+    [
+      "a service with no running container is UNKNOWN, never ok (not observed != matches)",
+      only(PINS, "")[0] === "unknown"
+    ],
+    [
+      "third-party images are not compared (redis is version-pinned by hand)",
+      evaluateFleetDeployment(PINS, inv(`exe-crm ${REPO}:v0.9.53 ${REPO}@${DIG_A}`)).length === 1
+    ],
+    [
+      "a digest-only container against a TAG-ONLY pin is UNKNOWN \u2014 nothing comparable either side",
+      only({ crm: { image: `${REPO}:v0.9.53` } }, `exe-crm ${REPO}@${DIG_A}`)[0] === "unknown"
+    ],
+    [
+      "repoPathOf strips both tag and digest",
+      repoPathOf(`${REPO}:v0.9.53@${DIG_A}`) === REPO
+    ]
+  );
+  const manifestServices = Object.keys(
+    JSON.parse(readFileSync3(COMMITTED_MANIFEST, "utf8")).stacks?.[JSON.parse(readFileSync3(COMMITTED_MANIFEST, "utf8")).latest]?.services ?? {}
+  );
+  cases.push(
+    [
+      "service-mapping: every service in the committed manifest is mapped (present-or-null)",
+      auditServiceMapping(manifestServices, GHCR_REPO_BY_SERVICE, firstPartyManifestServices()).length === 0
+    ],
+    [
+      'service-mapping: dashboard resolves to exe-dashboard, not "unknown" (bug 1a5fbbcc)',
+      GHCR_REPO_BY_SERVICE.dashboard === "exe-dashboard"
+    ],
+    [
+      "service-mapping: an UNMAPPED service is reported as unknown, never skipped",
+      (() => {
+        const f = auditServiceMapping(["brandnew"], { crm: "exe-crm" }, /* @__PURE__ */ new Set());
+        return f.length === 1 && f[0].level === "unknown" && f[0].service === "brandnew";
+      })()
+    ],
+    [
+      "service-mapping: a FIRST-PARTY service mapped to null is a finding, not a deliberate skip",
+      (() => {
+        const f = auditServiceMapping(["dashboard"], { dashboard: null }, /* @__PURE__ */ new Set(["dashboard"]));
+        return f.length === 1 && f[0].level === "unknown";
+      })()
+    ],
+    [
+      "service-mapping: a genuinely third-party null mapping is silent",
+      auditServiceMapping(["redis"], { redis: null }, /* @__PURE__ */ new Set()).length === 0
+    ]
+  );
+  let bad = 0;
+  for (const [name, pass] of cases) {
+    console.log(`  ${pass ? GREEN + "\u2713" + OFF : RED + "\u2717" + OFF} ${name}`);
+    if (!pass) bad++;
+  }
+  process.exit(bad === 0 ? 0 : 1);
+}
+async function main() {
+  const argv = process.argv.slice(2);
+  if (argv.includes("--self-test")) return selfTest();
+  const asJson = argv.includes("--json");
+  const warnOnly = argv.includes("--warn-only");
+  const rawMaxAgeDays = process.env.EXE_STACK_RELEASE_MAX_AGE_DAYS;
+  const maxAgeDays = parseMaxAgeDays(rawMaxAgeDays);
+  if (maxAgeDays === null) {
+    console.error(
+      `[drift] EXE_STACK_RELEASE_MAX_AGE_DAYS="${rawMaxAgeDays}" is not a finite, positive number of days \u2014 refusing to run rather than silently falling back to the 7-day default, which would hide this exact misconfiguration (bug ed73c73f follow-up).`
+    );
+    process.exit(2);
+  }
+  const findings = [];
+  const add = (axis, level, message) => findings.push({ axis, level, message });
+  const committed = JSON.parse(readFileSync3(COMMITTED_MANIFEST, "utf8"));
+  const committedEntry = committed.stacks?.[committed.latest];
+  if (!committedEntry) {
+    console.error(`[drift] committed manifest has no entry for latest "${committed.latest}"`);
+    process.exit(2);
+  }
+  const manifestUrl = process.env.EXE_STACK_MANIFEST_URL || DEFAULT_MANIFEST_URL;
+  let served = null;
+  try {
+    served = await fetchServedManifest(manifestUrl);
+    if (served.latest !== committed.latest) {
+      add(
+        "served-vs-committed",
+        "drift",
+        `${manifestUrl} serves latest=${served.latest} but git has latest=${committed.latest}. A stack release was committed and never published \u2014 customers are still reading the older one.`
+      );
+    } else {
+      add("served-vs-committed", "ok", `both at ${committed.latest}`);
+    }
+  } catch (err) {
+    add("served-vs-committed", "unknown", String(err.message ?? err));
+  }
+  for (const finding of auditServiceMapping(
+    Object.keys(committedEntry.services ?? {}),
+    GHCR_REPO_BY_SERVICE,
+    firstPartyManifestServices()
+  )) {
+    add("pinned-vs-built", finding.level, finding.message);
+  }
+  const token = await ghcrToken();
+  if (!token) {
+    add("pinned-vs-built", "unknown", "no GHCR_TOKEN and `gh auth token` failed \u2014 cannot list tags");
+  } else {
+    for (const [service, svc] of Object.entries(committedEntry.services ?? {})) {
+      const repo = GHCR_REPO_BY_SERVICE[service];
+      if (repo === null) continue;
+      if (repo === void 0) continue;
+      const pinned = tagOf(svc.image);
+      let newest;
+      try {
+        const ref = digestOf(svc.image) ?? pinned;
+        if (ref && !await refExists(repo, ref, token)) {
+          add(
+            "pinned-vs-built",
+            "drift",
+            `${service}: PHANTOM PIN \u2014 the manifest pins "${svc.image}" but ${ref} does not exist in ghcr.io/${GHCR_NAMESPACE}/${repo}. Nothing can pull it; the descriptor names bytes nobody built.`
+          );
+          continue;
+        }
+        newest = newestReleaseTag(await ghcrTags(repo, token), pinned);
+      } catch (err) {
+        add("pinned-vs-built", "unknown", `${service}: ${String(err.message ?? err)}`);
+        continue;
+      }
+      if (!newest) {
+        add("pinned-vs-built", "unknown", `${service}: ghcr has no vX.Y.Z release tag at all`);
+        continue;
+      }
+      if (pinned && compareVersionTags(pinned, newest) < 0) {
+        add(
+          "pinned-vs-built",
+          "drift",
+          `${service}: manifest pins ${pinned} but ${newest} has shipped to ghcr.io/${GHCR_NAMESPACE}/${repo}. Customers cannot receive it until a stack release picks it up.`
+        );
+      } else {
+        add("pinned-vs-built", "ok", `${service}: ${pinned ?? "digest-only"} is current`);
+      }
+    }
+  }
+  let deployed = null;
+  try {
+    deployed = await deployedUpdateVersion();
+  } catch (err) {
+    add("serving-code", "unknown", `probe failed: ${String(err.message ?? err)}`);
+  }
+  if (deployed === null) {
+    add(
+      "serving-code",
+      "unknown",
+      'the exe-update service does not report its version: GET /health returns {"ok":true,"service":"exe-registry-proxy",\u2026} with no version field, so a 50-version-stale container passes its own healthcheck. The running service therefore predates bug 887869e3, which added `version` to that payload \u2014 redeploy exe-update, or set EXE_UPDATE_SSH_HOST for the interim ssh probe. There is deliberately no way to declare the version by hand.'
+    );
+  } else if (deployed.version === null) {
+    add("serving-code", "unknown", `no exe-update container found via ${deployed.source}`);
+  } else {
+    const pinned = tagOf(committedEntry.services?.["exe-os"]?.image);
+    if (pinned && compareVersionTags(deployed.version, pinned) < 0) {
+      add(
+        "serving-code",
+        "drift",
+        `exe-update runs ${deployed.version} (via ${deployed.source}) but the manifest pins exe-os ${pinned}. The service serving the update path is older than the update it serves.`
+      );
+    } else {
+      add("serving-code", "ok", `exe-update runs ${deployed.version} (via ${deployed.source})`);
+    }
+  }
+  add(
+    "release-freshness",
+    ...evaluateReleaseFreshness(served, maxAgeDays, Date.now())
+  );
+  const fleetHost = process.env.EXE_UPDATE_SSH_HOST;
+  const fleetPs = fleetHost ? await dockerPs(fleetHost) : null;
+  const blind = fleetPs === null ? [] : [...uninspectableContainers(fleetPs), ...unattributableContainers(fleetPs)];
+  for (const f of evaluateFleetDeployment(
+    committedEntry.services ?? {},
+    fleetPs === null || blind.length > 0 ? null : parseFleetInventory(fleetPs),
+    blind
+  )) {
+    findings.push(f);
+  }
+  const drift = findings.filter((f) => f.level === "drift");
+  const unknown = findings.filter((f) => f.level === "unknown");
+  if (asJson) {
+    console.log(JSON.stringify({ committedLatest: committed.latest, servedLatest: served?.latest ?? null, findings }, null, 2));
+  } else {
+    const icon = { ok: "\u{1F7E2}", drift: "\u{1F534}", unknown: "\u{1F7E0}" };
+    console.log("| axis | status | detail |");
+    console.log("| --- | --- | --- |");
+    for (const f of findings) {
+      console.log(`| ${f.axis} | ${icon[f.level]} ${f.level} | ${f.message.replace(/\|/g, "\\|")} |`);
+    }
+    console.log("");
+    console.log(`${drift.length} drift, ${unknown.length} unknown, ${findings.length - drift.length - unknown.length} ok`);
+  }
+  const decision = decideExitCode(findings, { warnOnly });
+  if (warnOnly && (decision.driftCount > 0 || decision.unknownCount > 0)) {
+    console.error(
+      `[drift] --warn-only: NOT failing the job despite ${decision.driftCount} drift / ${decision.unknownCount} unverified finding(s) above. This flag is a deliberate, time-boxed migration escape hatch and must never be the default invocation (bug ed73c73f).`
+    );
+  } else if (decision.reason === "unverified") {
+    console.error(
+      `[drift] UNVERIFIED, not drift: ${decision.unknownCount} axis could not be observed (see the \u{1F7E0} unknown row(s) above for the missing credential/endpoint). Failing the job because a monitor that cannot see is not a monitor that is passing (bug ed73c73f).`
+    );
+  } else if (decision.reason === "drift") {
+    console.error(`[drift] ${decision.driftCount} drift finding(s) above \u2014 failing the job.`);
+  }
+  process.exit(decision.code);
+}
+if (import.meta.url === `file://${process.argv[1]}`) {
+  main().catch((err) => {
+    console.error(`[drift] ${String(err?.stack ?? err)}`);
+    process.exit(2);
+  });
+}
+
+// src/lib/stack-pin-completeness.ts
+async function evaluatePinCompleteness(services, io, opts = {}) {
+  const report = { violations: [], unknowns: [], ok: [], skipped: [], allowed: [] };
+  for (const [service, entry] of Object.entries(services)) {
+    if (typeof entry?.image !== "string") continue;
+    const repo = Object.hasOwn(io.ghcrRepoForService, service) ? io.ghcrRepoForService[service] : void 0;
+    if (repo === void 0) {
+      report.unknowns.push({ service, repo: "<unmapped>", reason: "no entry in ghcrRepoForService" });
+      continue;
+    }
+    if (repo === null) {
+      report.skipped.push(service);
+      continue;
+    }
+    const pinnedTag = tagOf(entry.image);
+    if (pinnedTag === null) {
+      report.unknowns.push({ service, repo, reason: "cannot order a digest-only pin against registry tags" });
+      continue;
+    }
+    try {
+      const tags = await io.listTags(repo);
+      const newer = anchoredReleaseTagsNewerThan(tags, pinnedTag);
+      let resolved = null;
+      for (const candidate of newer) {
+        if (await io.refExists(repo, candidate)) {
+          resolved = candidate;
+          break;
+        }
+      }
+      if (resolved !== null) {
+        report.violations.push({ service, repo, pinnedTag, shippedTag: resolved });
+      } else if (newer.length > 0) {
+        report.unknowns.push({
+          service,
+          repo,
+          reason: `no shipped tag newer than ${pinnedTag} resolved in the registry \u2014 ${newer.length} newer tag(s) listed (${newer.join(", ")}) but none resolve; verification is UNKNOWN, not current`
+        });
+      } else {
+        report.ok.push(service);
+      }
+    } catch (error) {
+      report.unknowns.push({ service, repo, reason: error instanceof Error ? error.message : String(error) });
+    }
+  }
+  const allowed = new Set(opts.allowStalePins ?? []);
+  report.violations = report.violations.filter((finding) => {
+    if (!allowed.has(finding.service)) return true;
+    report.allowed.push(finding);
+    return false;
+  });
+  report.unknowns = report.unknowns.filter((finding) => {
+    if (!allowed.has(finding.service)) return true;
+    report.allowed.push(finding);
+    return false;
+  });
+  return report;
+}
+function pinCompletenessRefusal(report) {
+  if (report.violations.length === 0 && report.unknowns.length === 0) return null;
+  return [
+    "Refusing stack release: pin completeness failed.",
+    ...report.violations.map((f) => `${f.service} (${f.repo}): pinned ${f.pinnedTag}, newest shipped ${f.shippedTag}`),
+    ...report.unknowns.map((f) => `${f.service} (${f.repo}): unknown \u2014 ${f.reason}`),
+    "Resolve verification failures and pin the newer image via the stack release, or re-run with --allow-stale-pin <service> only after confirming the newer image must not ship."
+  ].join("\n");
+}
+
+// src/bin/stack-release.ts
+var execFile2 = promisify2(execFileCb);
+function manifestServiceKeyOf(repo) {
+  return repo.manifestServiceKey ?? repo.serviceKey;
+}
+var NO_STACK_MANIFEST_SERVICE = /* @__PURE__ */ new Set(["exe-build"]);
+function validateNoStackManifestServiceExemptions(repoConfigs, manifestServiceKeys) {
+  const serviceKeys = new Set(repoConfigs.map((c) => c.serviceKey));
+  for (const serviceKey of NO_STACK_MANIFEST_SERVICE) {
+    if (!serviceKeys.has(serviceKey)) {
+      throw new Error(
+        `NO_STACK_MANIFEST_SERVICE names "${serviceKey}", which is not a STACK_RELEASE_REPO_CONFIGS serviceKey \u2014 fix the exemption list (or add the repo to the configs) so pin handling stays explicit.`
+      );
+    }
+    if (manifestServiceKeys) {
+      const config = repoConfigs.find((c) => c.serviceKey === serviceKey);
+      if (config && manifestServiceKeys.has(manifestServiceKeyOf(config))) {
+        throw new Error(
+          `NO_STACK_MANIFEST_SERVICE lists "${serviceKey}", but the stack manifest now has a services entry for it \u2014 the exemption is stale; remove it so the pin gate tracks the service (bug ed188382).`
+        );
+      }
+    }
+  }
+}
+function classifySuccessfulBuildPin(repo, manifestServiceKeys) {
+  const manifestKey = manifestServiceKeyOf(repo);
+  if (manifestServiceKeys.has(manifestKey)) return { kind: "pin", manifestKey };
+  if (NO_STACK_MANIFEST_SERVICE.has(repo.serviceKey)) {
+    return {
+      kind: "exempt",
+      manifestKey,
+      reason: `${repo.serviceKey} published an image but has no stack-manifest service (listed in NO_STACK_MANIFEST_SERVICE) \u2014 build accepted, nothing to pin`
+    };
+  }
+  return {
+    kind: "refuse",
+    manifestKey,
+    reason: `Cannot pin successful build for ${repo.serviceKey}: manifest service key mismatch \u2014 services[${manifestKey}] is missing (bug ed188382).`
+  };
+}
+validateNoStackManifestServiceExemptions(STACK_RELEASE_REPO_CONFIGS);
+function findExeOsRoot() {
+  const envRoot = process.env.EXE_OS_ROOT;
+  if (envRoot && existsSync2(envRoot)) return path3.resolve(envRoot);
+  let dir = path3.dirname(new URL(import.meta.url).pathname);
+  for (let i = 0; i < 5; i++) {
+    const pkgPath = path3.join(dir, "package.json");
+    if (existsSync2(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
+        if (pkg.name === "@askexenow/exe-os") return dir;
+      } catch {
+      }
+    }
+    dir = path3.dirname(dir);
+  }
+  return path3.resolve(path3.dirname(new URL(import.meta.url).pathname), "..", "..");
+}
+var EXE_OS_ROOT = findExeOsRoot();
+var PARENT_DIR = path3.dirname(EXE_OS_ROOT);
+var MANIFEST_PATH = path3.join(EXE_OS_ROOT, "deploy", "stack-manifests", "v0.9.json");
+function applyRootOverride(rootPath) {
+  const resolved = path3.resolve(rootPath);
+  if (!existsSync2(resolved)) {
+    throw new Error(`--root path does not exist: ${resolved}`);
+  }
+  EXE_OS_ROOT = resolved;
+  PARENT_DIR = path3.dirname(EXE_OS_ROOT);
+  MANIFEST_PATH = path3.join(EXE_OS_ROOT, "deploy", "stack-manifests", "v0.9.json");
+}
+function resolveRepoPath(dirName) {
+  const direct = path3.join(PARENT_DIR, dirName);
+  if (existsSync2(direct)) return direct;
+  const aliases = {
+    "exe-crm": ["openclaw", "exe-crm"],
+    "exe-wiki": ["ink", "exe-wiki"]
+  };
+  const candidates = aliases[dirName];
+  if (candidates) {
+    for (const alias of candidates) {
+      const p = path3.join(PARENT_DIR, alias);
+      if (existsSync2(p)) return p;
+    }
+  }
+  return direct;
+}
+function buildRepoConfigs() {
+  return STACK_RELEASE_REPO_CONFIGS.map(({ localDir, ...repo }) => ({
+    ...repo,
+    localPath: localDir === "." ? EXE_OS_ROOT : resolveRepoPath(localDir)
+  }));
+}
+function parseReleaseArgs(argv) {
+  const flags = {
+    stack: false,
+    dryRun: false,
+    yes: false,
+    repos: null,
+    major: false,
+    minor: false,
+    skipImageVerify: false,
+    allowStalePins: [],
+    allowRed: false,
+    root: null,
+    forceBuildRejected: false,
+    canary: false,
+    allowDirty: false,
+    force: false
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--stack") flags.stack = true;
+    else if (arg === "--dry-run") flags.dryRun = true;
+    else if (arg === "--yes" || arg === "-y") flags.yes = true;
+    else if (arg === "--major") flags.major = true;
+    else if (arg === "--minor") flags.minor = true;
+    else if (arg === "--skip-image-verify") flags.skipImageVerify = true;
+    else if (arg === "--allow-stale-pin" || arg.startsWith("--allow-stale-pin=")) {
+      const service = arg === "--allow-stale-pin" ? argv[++i] : arg.slice("--allow-stale-pin=".length);
+      if (!service?.trim() || service.startsWith("--")) {
+        throw new Error("--allow-stale-pin requires a named manifest service");
+      }
+      flags.allowStalePins.push(service.trim());
+    } else if (arg === "--allow-red") flags.allowRed = true;
+    else if (arg === "--allow-dirty") flags.allowDirty = true;
+    else if (arg === "--canary") flags.canary = true;
+    else if (arg === "--force") flags.force = true;
+    else if (arg === "--repos" && argv[i + 1]) {
+      flags.repos = argv[++i].split(",").map((s) => s.trim()).filter(Boolean);
+    } else if (arg.startsWith("--repos=")) {
+      flags.repos = arg.slice("--repos=".length).split(",").map((s) => s.trim()).filter(Boolean);
+    } else if (arg === "--root" && argv[i + 1]) {
+      flags.root = argv[++i];
+    } else if (arg.startsWith("--root=")) {
+      flags.root = arg.slice("--root=".length);
+    } else if (arg === "--force-build") {
+      flags.forceBuildRejected = true;
+    }
+  }
+  return flags;
+}
+async function git(repoPath, ...args) {
+  const { stdout } = await execFile2("git", ["-C", repoPath, ...args], {
+    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+  });
+  return stdout.trim();
+}
+async function assertCleanWorkingTree(opts) {
+  const gitStatus = opts.gitStatus ?? (() => git(EXE_OS_ROOT, "status", "--porcelain"));
+  const status = (await gitStatus()).trim();
+  if (!status) return;
+  const dirtyPaths = status.split("\n").map((l) => l.trim()).filter(Boolean);
+  if (opts.allowDirty) {
+    console.warn("\n  \x1B[33;1m\u26A0  --allow-dirty: releasing with a DIRTY working tree\x1B[0m");
+    console.warn("  \x1B[33m   Uncommitted changes are present in exe-os and may leak into the release:\x1B[0m");
+    for (const p of dirtyPaths) console.warn(`  \x1B[33m     ${p}\x1B[0m`);
+    console.warn("  \x1B[33m   Use only for break-glass emergencies.\x1B[0m\n");
+    return;
+  }
+  throw new Error(
+    `Refusing to release: the exe-os working tree is not clean (${dirtyPaths.length} dirty path(s)).
+` + dirtyPaths.map((p) => `    ${p}`).join("\n") + `
+Commit, stash, or discard these changes first \u2014 or pass --allow-dirty to override (break-glass).`
+  );
+}
+async function getLastTag(repoPath) {
+  try {
+    return await git(repoPath, "describe", "--tags", "--abbrev=0");
+  } catch {
+    return null;
+  }
+}
+async function getCommitsSinceTag(repoPath, tag) {
+  try {
+    const output = await git(repoPath, "log", `${tag}..HEAD`, "--oneline");
+    return output.split("\n").filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+async function ghRun(args) {
+  const { stdout } = await execFile2("gh", args);
+  return stdout.trim();
+}
+function isStrictSemverTag(tag) {
+  return /^v\d+\.\d+\.\d+$/.test(tag);
+}
+function compareSemver(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+}
+function higherSemver(a, b) {
+  return compareSemver(a, b) >= 0 ? a : b;
+}
+function parseRemoteTagNames(lsRemoteOutput) {
+  return lsRemoteOutput.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => line.split("	")[1] ?? "").filter((ref) => ref.startsWith("refs/tags/")).map((ref) => ref.slice("refs/tags/".length).replace(/\^\{\}$/, ""));
+}
+function highestReleasedVersion(tagNames) {
+  let best = null;
+  for (const tag of tagNames) {
+    if (!isStrictSemverTag(tag)) continue;
+    const version = tag.slice(1);
+    best = best === null ? version : higherSemver(best, version);
+  }
+  return best;
+}
+async function getRemoteReleaseTags(repoPath, gitRunner = git) {
+  try {
+    const out = await gitRunner(repoPath, "ls-remote", "--tags", "origin");
+    return parseRemoteTagNames(out);
+  } catch {
+    return [];
+  }
+}
+async function resolveVersionBasis(repoPath, packageVersion, gitRunner = git) {
+  const highestTag = highestReleasedVersion(await getRemoteReleaseTags(repoPath, gitRunner));
+  return highestTag ? higherSemver(packageVersion, highestTag) : packageVersion;
+}
+async function assertVersionNotAlreadyReleased(repoPath, tag, gitRunner = git) {
+  const out = await gitRunner(repoPath, "ls-remote", "--tags", "origin", `refs/tags/${tag}`);
+  if (out.trim().length > 0) {
+    throw new Error(
+      `refusing to cut ${tag}: this tag already exists on origin. package.json (and/or the computed bump basis) has drifted behind real release history \u2014 resync before releasing. (bug 343af002)`
+    );
+  }
+}
+async function assertReleaseFreshness(opts) {
+  const runGit = opts.gitRunner ?? git;
+  const logFn = opts.log ?? log;
+  const originRef = `origin/${opts.defaultBranch}`;
+  logFn("info", `Freshness gate: fetching origin ${opts.defaultBranch} before publish...`);
+  await runGit(opts.repoPath, "fetch", "origin", opts.defaultBranch);
+  const missing = (await runGit(opts.repoPath, "log", `${opts.releaseCommit}..${originRef}`, "--oneline")).trim();
+  if (missing) {
+    throw new Error(
+      `Freshness gate failed: ${originRef} contains commits not included in release commit ${opts.releaseCommit}.
+Missing-PR list:
+${missing}
+Abort: rebase/re-cut the release from current ${originRef} before publishing.`
+    );
+  }
+  try {
+    await runGit(opts.repoPath, "merge-base", "--is-ancestor", originRef, opts.releaseCommit);
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    throw new Error(
+      `Freshness gate failed: release commit ${opts.releaseCommit} is not a descendant of ${originRef}. Abort: rebase/re-cut the release from current ${originRef} before publishing. (${detail})`
+    );
+  }
+  logFn("ok", `Freshness gate passed: release commit contains current ${originRef}`);
+}
+async function printOpenPrGate(opts) {
+  const baseBranch = opts.baseBranch ?? "main";
+  const runGh = opts.ghRunner ?? ghRun;
+  const logFn = opts.log ?? log;
+  try {
+    const output = await runGh([
+      "pr",
+      "list",
+      "--repo",
+      opts.ghRepo,
+      "--base",
+      baseBranch,
+      "--json",
+      "number,title"
+    ]);
+    const prs = JSON.parse(output);
+    if (prs.length === 0) {
+      logFn("info", `Open PR gate: no open PRs targeting ${baseBranch} in ${opts.ghRepo}`);
+      return;
+    }
+    logFn("warn", `Open PR gate: ${prs.length} open PR(s) targeting ${baseBranch} in ${opts.ghRepo}:`);
+    for (const pr of prs) {
+      const number = typeof pr.number === "number" ? `#${pr.number}` : "#?";
+      logFn("warn", `  ${number} ${pr.title ?? "(untitled)"}`);
+    }
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    logFn("warn", `Open PR gate: unable to list open PRs for ${opts.ghRepo} targeting ${baseBranch}; continuing (${detail})`);
+  }
+}
+function bumpVersion(version, mode) {
+  const parts = version.split(".").map(Number);
+  if (parts.length < 3) throw new Error(`Invalid version: ${version}`);
+  const [major, minor, patch] = parts;
+  switch (mode) {
+    case "major":
+      return `${major + 1}.0.0`;
+    case "minor":
+      return `${major}.${minor + 1}.0`;
+    case "patch":
+    default:
+      return `${major}.${minor}.${patch + 1}`;
+  }
+}
+function readPackageVersion(repoPath) {
+  const pkgPath = path3.join(repoPath, "package.json");
+  if (!existsSync2(pkgPath)) {
+    throw new Error(`Missing package.json at ${pkgPath}`);
+  }
+  const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
+  return pkg.version;
+}
+function readPackageVersionOrNull(repoPath) {
+  const pkgPath = path3.join(repoPath, "package.json");
+  if (!existsSync2(pkgPath)) return null;
+  return readPackageVersion(repoPath);
+}
+function repoName(repo) {
+  return repo.ghRepo.split("/").pop() ?? repo.serviceKey;
+}
+function warnMissingRepoPackage(repo) {
+  const cloned = existsSync2(path3.join(repo.localPath, ".git"));
+  if (!cloned) {
+    log(
+      "warn",
+      `repo not cloned: clone ${repo.ghRepo} or pass --repos to skip ${repoName(repo)} (${repo.localPath} has no .git)`
+    );
+    return;
+  }
+  const pkgPath = path3.join(repo.localPath, "package.json");
+  const cause = !existsSync2(pkgPath) ? `has no root package.json \u2014 it is not a Node project (exe-monitor is Go, exe-build is Rust)` : `has a root package.json with no readable "version" field`;
+  log(
+    "warn",
+    `${repoName(repo)} IS cloned at ${repo.localPath} but ${cause}, so stack-release cannot derive its version and is SKIPPING it. This is NOT a missing checkout (bug a1f45a78). Its manifest pin cannot advance until stack-release reads this repository's version, or until it is released by hand.`
+  );
+}
+function hasPackageJson(repo) {
+  return existsSync2(path3.join(repo.localPath, "package.json"));
+}
+function deriveCloneUrl(repo) {
+  return `https://github.com/${repo.ghRepo}.git`;
+}
+function isCloneTargetSafe(targetPath, parentDir) {
+  const resolvedParent = path3.resolve(parentDir);
+  const resolvedTarget = path3.resolve(targetPath);
+  return resolvedTarget === resolvedParent || resolvedTarget.startsWith(resolvedParent + path3.sep);
+}
+var defaultCloneRunner = async (url, targetPath) => {
+  await execFile2("git", ["clone", url, targetPath], {
+    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+  });
+};
+async function ensureRepoCloned(repo, parentDir = PARENT_DIR, runClone = defaultCloneRunner) {
+  if (hasPackageJson(repo)) return false;
+  const target = repo.localPath;
+  if (!isCloneTargetSafe(target, parentDir)) {
+    throw new Error(
+      `refusing to auto-clone ${repo.ghRepo}: target ${target} is outside resolved root ${parentDir}`
+    );
+  }
+  const url = deriveCloneUrl(repo);
+  log("info", `repo not cloned: auto-cloning ${repo.ghRepo} \u2192 ${target}`);
+  try {
+    await runClone(url, target);
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    throw new Error(`git clone failed for ${repo.ghRepo} (${url} \u2192 ${target}): ${detail}`);
+  }
+  log("ok", `cloned ${repo.ghRepo} \u2192 ${target}`);
+  return true;
+}
+function readStackReleaseJson(repoPath) {
+  const p = path3.join(repoPath, "stack.release.json");
+  if (!existsSync2(p)) return null;
+  return JSON.parse(readFileSync4(p, "utf8"));
+}
+async function detectChanges(repos) {
+  const changes = [];
+  for (const repo of repos) {
+    let currentVersion = readPackageVersionOrNull(repo.localPath);
+    if (!currentVersion) {
+      await ensureRepoCloned(repo);
+      currentVersion = readPackageVersionOrNull(repo.localPath);
+      if (!currentVersion) {
+        warnMissingRepoPackage(repo);
+        continue;
+      }
+    }
+    const basisVersion = await resolveVersionBasis(repo.localPath, currentVersion);
+    if (basisVersion !== currentVersion) {
+      log(
+        "warn",
+        `${repo.serviceKey}: package.json (${currentVersion}) is behind the highest release tag on origin \u2014 using ${basisVersion} as the bump basis`
+      );
+      currentVersion = basisVersion;
+    }
+    const lastTag = await getLastTag(repo.localPath);
+    if (!lastTag) {
+      log("warn", `No tags found in ${repo.serviceKey} \u2014 skipping`);
+      continue;
+    }
+    const commits = await getCommitsSinceTag(repo.localPath, lastTag);
+    if (commits.length === 0) {
+      log("info", `${repo.serviceKey}: no changes since ${lastTag}`);
+      continue;
+    }
+    changes.push({
+      repo,
+      currentVersion,
+      newVersion: "",
+      // filled in step 2
+      commits,
+      tag: ""
+      // filled in step 2
+    });
+  }
+  return changes;
+}
+function rebaseImageTag(image, newVersion) {
+  if (/@sha256:[0-9a-f]{64}/i.test(image)) return image;
+  if (/:v[^:/]+$/.test(image)) {
+    return `${image.replace(/:v[^:/]+$/, "")}:v${newVersion}`;
+  }
+  return `${image}:v${newVersion}`;
+}
+function imageRepoPath(image) {
+  const withoutDigest = image.split("@")[0] ?? image;
+  const lastColon = withoutDigest.lastIndexOf(":");
+  const lastSlash = withoutDigest.lastIndexOf("/");
+  return lastColon > lastSlash ? withoutDigest.slice(0, lastColon) : withoutDigest;
+}
+function mayRebaseComponent(component, componentImage, ownImage) {
+  if (component && typeof component === "object" && component.versionLockstep === true) {
+    return true;
+  }
+  if (typeof ownImage !== "string" || ownImage.length === 0) return false;
+  return imageRepoPath(componentImage) === imageRepoPath(ownImage);
+}
+async function bumpVersions(changes, mode, dryRun) {
+  for (const change of changes) {
+    const newVersion = bumpVersion(change.currentVersion, mode);
+    change.newVersion = newVersion;
+    change.tag = `v${newVersion}`;
+    await assertVersionNotAlreadyReleased(change.repo.localPath, change.tag);
+    if (dryRun) {
+      log("dry", `${change.repo.serviceKey}: ${change.currentVersion} -> ${newVersion}`);
+      continue;
+    }
+    const pkgPath = path3.join(change.repo.localPath, "package.json");
+    const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
+    pkg.version = newVersion;
+    writeFileSync2(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
+    const srf = readStackReleaseJson(change.repo.localPath);
+    if (srf) {
+      srf.version = newVersion;
+      srf.sourceVersion = newVersion;
+      if (typeof srf.image === "string") {
+        srf.image = rebaseImageTag(srf.image, newVersion);
+      }
+      const ownImage = typeof srf.image === "string" ? srf.image : void 0;
+      if (srf.components && typeof srf.components === "object") {
+        const components = srf.components;
+        for (const key of Object.keys(components)) {
+          const val = components[key];
+          if (typeof val === "string") {
+            if (mayRebaseComponent(val, val, ownImage)) {
+              components[key] = rebaseImageTag(val, newVersion);
+            }
+          } else if (val && typeof val === "object" && "image" in val) {
+            const obj = val;
+            if (typeof obj.image === "string" && mayRebaseComponent(obj, obj.image, ownImage)) {
+              obj.image = rebaseImageTag(obj.image, newVersion);
+            }
+          }
+        }
+      }
+      writeFileSync2(
+        path3.join(change.repo.localPath, "stack.release.json"),
+        JSON.stringify(srf, null, 2) + "\n"
+      );
+    }
+    await git(change.repo.localPath, "add", "package.json", "stack.release.json");
+    await git(change.repo.localPath, "commit", "-m", `chore: bump v${newVersion} for stack release`);
+    log("ok", `${change.repo.serviceKey}: bumped ${change.currentVersion} -> ${newVersion} (local commit, push deferred)`);
+  }
+}
+var RELEASE_PR_POLL_JQ = "[.state, .mergeable, .mergeStateStatus] | @tsv";
+async function landViaPR(repoPath, ghRepo, defaultBranch, branch, title) {
+  const pushedSha = await git(repoPath, "rev-parse", "HEAD");
+  await git(repoPath, "push", "--force-with-lease", "origin", `HEAD:refs/heads/${branch}`);
+  try {
+    await ghRun([
+      "pr",
+      "create",
+      "--repo",
+      ghRepo,
+      "--base",
+      defaultBranch,
+      "--head",
+      branch,
+      "--title",
+      title,
+      "--body",
+      "Automated release version bump \u2014 auto-merges when required CI is green."
+    ]);
+  } catch {
+  }
+  const deadline = Date.now() + 30 * 60 * 1e3;
+  let releasePr;
+  for (; ; ) {
+    try {
+      const output = await ghRun([
+        "pr",
+        "list",
+        "--repo",
+        ghRepo,
+        "--head",
+        branch,
+        "--state",
+        "all",
+        "--json",
+        "number,state,headRefOid"
+      ]);
+      releasePr = findPullRequestForHeadSha(JSON.parse(output), pushedSha);
+    } catch {
+    }
+    if (releasePr) break;
+    if (Date.now() > deadline) {
+      throw new Error(
+        `No PR on ${ghRepo} (${branch}) matches released commit ${pushedSha.slice(0, 12)} within 30m \u2014 failing closed rather than attributing another PR's verdict. Aborting release; ${defaultBranch} left untouched.`
+      );
+    }
+    await sleep(15e3);
+  }
+  if (releasePr.state !== "MERGED") {
+    await ghRun(["pr", "merge", String(releasePr.number), "--repo", ghRepo, "--auto", "--squash"]);
+  }
+  let lastMergeable = "";
+  for (; ; ) {
+    const observed = (await ghRun([
+      "pr",
+      "view",
+      String(releasePr.number),
+      "--repo",
+      ghRepo,
+      "--json",
+      "state,mergeable,mergeStateStatus",
+      "-q",
+      RELEASE_PR_POLL_JQ
+    ])).trim();
+    const [state, mergeable = "", mergeStateStatus = ""] = observed.split("	");
+    if (mergeable) lastMergeable = `mergeable=${mergeable} mergeStateStatus=${mergeStateStatus}`;
+    if (state === "MERGED") break;
+    if (mergeable === "CONFLICTING") {
+      throw new Error(
+        `Release PR ${ghRepo}#${releasePr.number} (${branch} @ ${pushedSha.slice(0, 12)}) CONFLICTS with ${defaultBranch}. GitHub cannot compute a merge commit for it, so NO CI will run and auto-merge can never fire \u2014 waiting would not help. Rebase the release branch and re-run. Aborting release; ${defaultBranch} left untouched.`
+      );
+    }
+    if (Date.now() > deadline) {
+      throw new Error(
+        `Release PR ${ghRepo}#${releasePr.number} (${branch} @ ${pushedSha.slice(0, 12)}) did not merge within 30m (${lastMergeable || "mergeability never readable"}). Aborting release; ${defaultBranch} left untouched.`
+      );
+    }
+    await sleep(3e4);
+  }
+  await git(repoPath, "fetch", "origin", defaultBranch);
+  await git(repoPath, "checkout", defaultBranch);
+  await git(repoPath, "reset", "--hard", `origin/${defaultBranch}`);
+}
+async function tagAndTriggerCI(changes, dryRun) {
+  for (const change of changes) {
+    if (dryRun) {
+      log("dry", `Would land ${change.repo.serviceKey} bump via PR + tag ${change.tag}`);
+      continue;
+    }
+    const branch = `release/bump-${change.tag}`;
+    await landViaPR(
+      change.repo.localPath,
+      change.repo.ghRepo,
+      change.repo.defaultBranch,
+      branch,
+      `chore: bump ${change.tag} for stack release`
+    );
+    change.releaseSha = await git(change.repo.localPath, "rev-parse", "HEAD");
+    await assertReleaseFreshness({
+      repoPath: change.repo.localPath,
+      defaultBranch: change.repo.defaultBranch,
+      releaseCommit: change.releaseSha
+    });
+    await printOpenPrGate({ ghRepo: change.repo.ghRepo, baseBranch: "main" });
+    await git(change.repo.localPath, "tag", change.tag);
+    await git(change.repo.localPath, "push", "origin", change.tag);
+    log("ok", `Landed ${change.repo.serviceKey} ${change.tag} via PR + tagged ${change.releaseSha.slice(0, 12)} (green-CI gated)`);
+  }
+}
+async function rollbackFailedReleases(changes, ciStatuses, dryRun) {
+  if (dryRun) return;
+  const failed = changes.filter((c) => {
+    const ci = ciStatuses.find((s) => s.repo.serviceKey === c.repo.serviceKey);
+    return ci && (ci.status !== "completed" || ci.conclusion !== "success");
+  });
+  if (failed.length === 0) return;
+  log("warn", `Rolling back ${failed.length} failed release(s)...`);
+  for (const change of failed) {
+    const name = repoName(change.repo);
+    try {
+      await git(change.repo.localPath, "push", "origin", `:refs/tags/${change.tag}`);
+      log("ok", `Deleted remote tag ${change.tag} from ${name}`);
+    } catch (err) {
+      log("warn", `Could not delete remote tag ${change.tag} from ${name}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    try {
+      await git(change.repo.localPath, "tag", "-d", change.tag);
+    } catch {
+    }
+    try {
+      await git(change.repo.localPath, "revert", "--no-edit", "HEAD");
+      await landViaPR(
+        change.repo.localPath,
+        change.repo.ghRepo,
+        change.repo.defaultBranch,
+        `release/revert-${change.tag}`,
+        `Revert bump ${change.tag} (release CI failed)`
+      );
+      log("ok", `Reverted bump commit for ${name} on ${change.repo.defaultBranch} (via PR)`);
+    } catch (err) {
+      log("fail", `Could not revert bump commit for ${name}: ${err instanceof Error ? err.message : String(err)}. Manual cleanup required.`);
+    }
+  }
+}
+function workflowRunHeadSha(run) {
+  return run.headSha ?? run.head_sha;
+}
+function findPullRequestForHeadSha(prs, pushedSha) {
+  const normalizedSha = pushedSha.toLowerCase();
+  return prs.find((pr) => pr.headRefOid?.toLowerCase() === normalizedSha);
+}
+function findWorkflowRunForHeadSha(runs, releaseSha) {
+  const normalizedReleaseSha = releaseSha.toLowerCase();
+  return runs.find((run) => workflowRunHeadSha(run)?.toLowerCase() === normalizedReleaseSha);
+}
+async function resolveReleaseSha(change) {
+  if (change.releaseSha) return change.releaseSha;
+  try {
+    change.releaseSha = await git(change.repo.localPath, "rev-parse", `${change.tag}^{}`);
+    return change.releaseSha;
+  } catch {
+    return void 0;
+  }
+}
+async function waitForCI(changes, dryRun) {
+  if (dryRun) {
+    return changes.map((c) => ({
+      repo: c.repo,
+      tag: c.tag,
+      status: "completed",
+      conclusion: "success"
+    }));
+  }
+  const TIMEOUT_MS = 15 * 60 * 1e3;
+  const POLL_INTERVAL_MS = 30 * 1e3;
+  const startTime = Date.now();
+  const statuses = changes.map((c) => ({
+    repo: c.repo,
+    tag: c.tag,
+    status: "in_progress"
+  }));
+  log("info", `Waiting for ${changes.length} CI build(s)... (timeout: 15m)`);
+  while (Date.now() - startTime < TIMEOUT_MS) {
+    const pending = statuses.filter((s) => s.status === "in_progress");
+    if (pending.length === 0) break;
+    for (const st of pending) {
+      try {
+        const change = changes.find((c) => c.repo.serviceKey === st.repo.serviceKey && c.tag === st.tag);
+        if (!change) continue;
+        const releaseSha = await resolveReleaseSha(change);
+        if (!releaseSha) continue;
+        const output = await ghRun([
+          "run",
+          "list",
+          "--repo",
+          st.repo.ghRepo,
+          "--workflow",
+          st.repo.releaseWorkflow,
+          "--limit",
+          "50",
+          "--json",
+          "status,conclusion,url,headSha"
+        ]);
+        const runs = JSON.parse(output);
+        const releaseRun = findWorkflowRunForHeadSha(runs, releaseSha);
+        if (!releaseRun) continue;
+        if (releaseRun.status === "completed") {
+          st.status = "completed";
+          st.conclusion = releaseRun.conclusion ?? "unknown";
+          st.url = releaseRun.url;
+          if (st.conclusion === "success") {
+            log("ok", `CI passed: ${st.repo.serviceKey} ${st.tag}`);
+          } else {
+            log("fail", `CI failed: ${st.repo.serviceKey} ${st.tag} (${st.conclusion}) \u2014 ${st.url}`);
+          }
+        }
+      } catch (err) {
+        log("warn", `Failed to check CI for ${st.repo.serviceKey}: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    const stillPending = statuses.filter((s) => s.status === "in_progress");
+    if (stillPending.length === 0) break;
+    log("info", `${stillPending.length} CI build(s) still running... (${Math.round((Date.now() - startTime) / 1e3)}s elapsed)`);
+    await sleep(POLL_INTERVAL_MS);
+  }
+  for (const st of statuses) {
+    if (st.status === "in_progress") {
+      st.status = "timed_out";
+      log("fail", `CI timed out: ${st.repo.serviceKey} ${st.tag}`);
+    }
+  }
+  return statuses;
+}
+var PROXY_REGISTRY = "update.askexe.com";
+var GHCR_REGISTRY = "ghcr.io";
+function shortImageName(imageName) {
+  const parts = imageName.split("/");
+  return parts[parts.length - 1] ?? imageName;
+}
+async function checkRegistryManifest(registry, repo, tag, token) {
+  const url = `https://${registry}/v2/${repo}/manifests/${tag}`;
+  const headers = [
+    "-H",
+    "Accept: application/vnd.oci.image.index.v1+json",
+    // Also accept legacy Docker v2 manifest list / single manifest so the
+    // registry returns a Docker-Content-Digest for non-OCI images too.
+    "-H",
+    "Accept: application/vnd.docker.distribution.manifest.list.v2+json",
+    "-H",
+    "Accept: application/vnd.docker.distribution.manifest.v2+json"
+  ];
+  if (token) {
+    headers.push("-H", `Authorization: Bearer ${token}`);
+  }
+  try {
+    const { stdout } = await execFile2("curl", [
+      "-sS",
+      "-m",
+      "30",
+      "-I",
+      ...headers,
+      url
+    ]);
+    const statusMatch = stdout.match(/^HTTP\/[\d.]+\s+(\d{3})/m);
+    const code = statusMatch ? parseInt(statusMatch[1], 10) : 0;
+    const digestMatch = stdout.match(/^docker-content-digest:\s*(sha256:[0-9a-f]{64})/im);
+    const digest = digestMatch ? digestMatch[1] : void 0;
+    return { status: code, ok: code >= 200 && code < 300, digest };
+  } catch {
+    return { status: 0, ok: false };
+  }
+}
+async function warmProxyCache(imageRef) {
+  try {
+    await execFile2("docker", ["pull", imageRef], { timeout: 12e4 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function resolveImageGitShaLabel(ref, dryRun) {
+  if (!ref || dryRun) return void 0;
+  try {
+    const { readProvenanceLabels } = await import("./stack-generate-manifest-AXI55MEQ.js");
+    const labels = await readProvenanceLabels(ref);
+    return labels["org.exe.git_sha"] ?? labels["org.opencontainers.image.revision"];
+  } catch (err) {
+    log("warn", `Could not read provenance labels from ${ref}: ${err instanceof Error ? err.message : String(err)}`);
+    return void 0;
+  }
+}
+async function resolveDigestViaInspect(imageName, tag) {
+  const shortName = shortImageName(imageName);
+  const refs = [
+    `${GHCR_REGISTRY}/askexe/${shortName}:${tag}`,
+    `${PROXY_REGISTRY}/askexe/${shortName}:${tag}`
+  ];
+  for (const ref of refs) {
+    try {
+      const { stdout } = await execFile2("docker", ["manifest", "inspect", ref, "--verbose"], {
+        timeout: 6e4
+      });
+      const parsed = JSON.parse(stdout);
+      let digest;
+      if (Array.isArray(parsed)) {
+        digest = parsed[0]?.Descriptor?.digest;
+      } else {
+        digest = parsed.Descriptor?.digest;
+      }
+      if (digest && /^sha256:[0-9a-f]{64}$/i.test(digest)) {
+        log("ok", `Resolved digest via docker manifest inspect: ${shortName}:${tag} -> ${digest.slice(0, 19)}...`);
+        return digest;
+      }
+    } catch {
+    }
+  }
+  try {
+    const ghcrRef = `${GHCR_REGISTRY}/askexe/${shortName}:${tag}`;
+    const { stdout } = await execFile2("docker", ["manifest", "inspect", ghcrRef], {
+      timeout: 6e4
+    });
+    const parsed = JSON.parse(stdout);
+    if (parsed.digest && /^sha256:[0-9a-f]{64}$/i.test(parsed.digest)) {
+      log("ok", `Resolved digest via docker manifest inspect (non-verbose): ${shortName}:${tag} -> ${parsed.digest.slice(0, 19)}...`);
+      return parsed.digest;
+    }
+  } catch {
+  }
+  return void 0;
+}
+async function verifyImages(changes, ciStatuses, dryRun) {
+  if (dryRun) {
+    return changes.map((c) => ({
+      repo: c.repo,
+      tag: `v${c.newVersion}`,
+      ghcr: "ok",
+      proxy: "ok"
+    }));
+  }
+  const proxyToken = process.env.EXE_REGISTRY_PROXY_PULL_TOKEN ?? void 0;
+  const results = [];
+  let ghcrToken2 = process.env.GHCR_TOKEN?.trim() || void 0;
+  if (!ghcrToken2) {
+    try {
+      const { stdout } = await execFile2("gh", ["auth", "token"]);
+      ghcrToken2 = stdout.trim();
+    } catch {
+    }
+  }
+  const ghcrBearer = ghcrToken2 ? Buffer.from(ghcrToken2).toString("base64") : void 0;
+  log("info", "Verifying Docker images are pullable (with retry for digest resolution)...");
+  for (const change of changes) {
+    const ci = ciStatuses.find((s) => s.repo.serviceKey === change.repo.serviceKey);
+    if (!ci || ci.status !== "completed" || ci.conclusion !== "success") continue;
+    const tag = `v${change.newVersion}`;
+    const shortName = shortImageName(change.repo.imageName);
+    const proxyRepo = `askexe/${shortName}`;
+    const ghcrRepo = `askexe/${shortName}`;
+    const result = {
+      repo: change.repo,
+      tag,
+      ghcr: "error",
+      proxy: "error"
+    };
+    const GHCR_RETRY_DELAYS = [5e3, 1e4, 2e4, 4e4];
+    let ghcrCheck = { status: 0, ok: false };
+    for (let attempt = 0; attempt <= GHCR_RETRY_DELAYS.length; attempt++) {
+      ghcrCheck = await checkRegistryManifest(GHCR_REGISTRY, ghcrRepo, tag, ghcrBearer);
+      if (ghcrCheck.ok && ghcrCheck.digest) {
+        break;
+      }
+      if (ghcrCheck.status === 401 || ghcrCheck.status === 403) {
+        break;
+      }
+      if (attempt < GHCR_RETRY_DELAYS.length) {
+        const delayMs = GHCR_RETRY_DELAYS[attempt];
+        log("info", `${shortName}:${tag} not yet available on GHCR (HTTP ${ghcrCheck.status}) \u2014 retry in ${delayMs / 1e3}s (${attempt + 1}/${GHCR_RETRY_DELAYS.length})`);
+        await sleep(delayMs);
+      }
+    }
+    if (ghcrCheck.ok) {
+      result.ghcr = "ok";
+      result.digest = ghcrCheck.digest;
+      if (!ghcrCheck.digest) {
+        log("warn", `${shortName}:${tag} is on GHCR but Docker-Content-Digest header missing \u2014 trying docker manifest inspect fallback`);
+        const inspectDigest = await resolveDigestViaInspect(change.repo.imageName, tag);
+        if (inspectDigest) {
+          result.digest = inspectDigest;
+        } else {
+          log("warn", `${shortName}:${tag} \u2014 docker manifest inspect also failed to resolve digest. Manifest entry will be tag-only.`);
+        }
+      }
+    } else if (ghcrCheck.status === 401 || ghcrCheck.status === 403) {
+      log("warn", `GHCR auth returned ${ghcrCheck.status} for ${shortName}:${tag} \u2014 trying docker manifest inspect fallback`);
+      const inspectDigest = await resolveDigestViaInspect(change.repo.imageName, tag);
+      if (inspectDigest) {
+        result.ghcr = "ok";
+        result.digest = inspectDigest;
+        log("ok", `${shortName}:${tag} \u2014 digest resolved via docker manifest inspect despite GHCR HEAD ${ghcrCheck.status}`);
+      } else {
+        result.ghcr = "error";
+        result.detail = `GHCR auth failed (${ghcrCheck.status}) and docker manifest inspect failed \u2014 cannot verify image. Fix gh auth or GHCR_TOKEN.`;
+        log("fail", `GHCR auth returned ${ghcrCheck.status} for ${shortName}:${tag} and inspect fallback failed \u2014 cannot verify`);
+      }
+    } else {
+      result.ghcr = "missing";
+      result.detail = `GHCR returned ${ghcrCheck.status} for ${ghcrRepo}:${tag} after ${GHCR_RETRY_DELAYS.length} retries`;
+      log("fail", `Image NOT FOUND on GHCR after retries: ${shortName}:${tag} \u2014 release may be broken!`);
+    }
+    const proxyCheck = await checkRegistryManifest(PROXY_REGISTRY, proxyRepo, tag, proxyToken);
+    if (proxyCheck.ok) {
+      result.proxy = "ok";
+      if (!result.digest && proxyCheck.digest) {
+        result.digest = proxyCheck.digest;
+      }
+    } else {
+      result.proxy = "pending";
+    }
+    if (result.ghcr === "ok" && result.proxy !== "ok") {
+      log("info", `Warming proxy cache for ${shortName}:${tag}...`);
+      const proxyRef = `${PROXY_REGISTRY}/${proxyRepo}:${tag}`;
+      const warmed = await warmProxyCache(proxyRef);
+      if (warmed) {
+        result.proxy = "ok";
+        log("ok", `Proxy cache warmed: ${shortName}:${tag}`);
+      } else {
+        result.proxy = "pending";
+        log("warn", `Could not warm proxy for ${shortName}:${tag} \u2014 GHCR has it, proxy will cache on first customer pull`);
+      }
+    }
+    if (result.ghcr === "ok" && result.proxy === "ok") {
+      const digestSuffix = result.digest ? ` [${result.digest.slice(0, 19)}...]` : "";
+      log("ok", `Image verified: ${shortName}:${tag} (GHCR + proxy)${digestSuffix}`);
+    } else if (result.ghcr === "ok" && result.proxy === "pending") {
+      log("warn", `Image on GHCR only: ${shortName}:${tag} (proxy will cache on first pull)`);
+    }
+    results.push(result);
+  }
+  return results;
+}
+function printImageVerification(results) {
+  if (results.length === 0) return;
+  console.log("\n  Image verification:");
+  for (const r of results) {
+    const shortName = shortImageName(r.repo.imageName);
+    const ghcrIcon = r.ghcr === "ok" ? "\x1B[32m\u2713\x1B[0m" : "\x1B[31m\u2717\x1B[0m";
+    const proxyIcon = r.proxy === "ok" ? "\x1B[32m\u2713\x1B[0m" : r.proxy === "pending" ? "\x1B[33m~\x1B[0m" : "\x1B[31m\u2717\x1B[0m";
+    const proxyLabel = r.proxy === "pending" ? "pending (first pull will cache)" : r.proxy;
+    console.log(
+      `    ${shortName}:${r.tag}`.padEnd(40) + `${ghcrIcon} GHCR  ${proxyIcon} proxy${r.proxy === "pending" ? ` (${proxyLabel})` : ""}`
+    );
+  }
+  console.log("");
+}
+async function updateStackManifest(changes, ciStatuses, dryRun, imageResults, canary = false, allowStalePins = []) {
+  const manifest = JSON.parse(readFileSync4(MANIFEST_PATH, "utf8"));
+  const currentLatest = manifest.latest;
+  const currentParts = currentLatest.split(".").map(Number);
+  const newStackVersion = `${currentParts[0]}.${currentParts[1]}.${(currentParts[2] ?? 0) + 1}`;
+  const baseEntry = manifest.stacks[currentLatest];
+  const baseServices = baseEntry?.services ?? {};
+  const services = {};
+  for (const [key, svc] of Object.entries(baseServices)) {
+    services[key] = { ...svc };
+  }
+  validateNoStackManifestServiceExemptions(STACK_RELEASE_REPO_CONFIGS, new Set(Object.keys(services)));
+  const successfulChanges = [];
+  const exemptedBuilds = [];
+  for (const change of changes) {
+    const ciStatus = ciStatuses.find((s) => s.repo.serviceKey === change.repo.serviceKey);
+    if (!(ciStatus && ciStatus.status === "completed" && ciStatus.conclusion === "success")) continue;
+    const verdict = classifySuccessfulBuildPin(change.repo, new Set(Object.keys(services)));
+    if (verdict.kind === "exempt") {
+      log("info", verdict.reason);
+      exemptedBuilds.push(change.repo.serviceKey);
+      continue;
+    }
+    if (verdict.kind === "refuse") {
+      throw new Error(verdict.reason);
+    }
+    {
+      const manifestKey = verdict.manifestKey;
+      const svc = services[manifestKey];
+      if (!svc) {
+        throw new Error(`Cannot pin successful build for ${change.repo.serviceKey}: manifest service key mismatch \u2014 services[${manifestKey}] is missing (bug ed188382).`);
+      }
+      successfulChanges.push(change);
+      const tag = `v${change.newVersion}`;
+      const imageTag = `${change.repo.imageName}:${tag}`;
+      let digest = imageResults?.find((r) => r.repo.serviceKey === change.repo.serviceKey)?.digest;
+      if (!digest && !dryRun) {
+        log("info", `No digest from image verification for ${imageTag} \u2014 trying docker manifest inspect fallback (bug 85034df0)`);
+        digest = await resolveDigestViaInspect(change.repo.imageName, tag);
+      }
+      if (!digest && !dryRun) {
+        log("warn", `No content digest resolved for ${imageTag} \u2014 manifest entry will be tag-only and the digest-pinning gate will reject it.`);
+      }
+      svc.image = digest ? `${imageTag}@${digest}` : imageTag;
+      const decision = applyManifestGitSha(svc, {
+        imageLabelSha: await resolveImageGitShaLabel(svc.image, dryRun),
+        tagCommitSha: await resolveReleaseSha(change)
+      });
+      if (!dryRun) {
+        for (const warning of decision.warnings) {
+          log("warn", `${imageTag}: ${warning}`);
+        }
+      }
+    }
+  }
+  if (successfulChanges.length === 0 && !dryRun) {
+    if (exemptedBuilds.length > 0) {
+      log(
+        "info",
+        `No stack-manifest pins to update (only exempt image builds succeeded: ${exemptedBuilds.join(", ")}) \u2014 manifest not updated`
+      );
+    } else {
+      log("warn", "No successful CI builds \u2014 manifest not updated");
+    }
+    return currentLatest;
+  }
+  const NOT_MIRRORED_TO_GHCR = /* @__PURE__ */ new Set(["auth"]);
+  const pinGateMapping = {};
+  for (const [service, repo] of Object.entries(GHCR_REPO_BY_SERVICE)) {
+    pinGateMapping[service] = NOT_MIRRORED_TO_GHCR.has(service) ? null : repo;
+  }
+  for (const service of NOT_MIRRORED_TO_GHCR) {
+    if (!Object.prototype.hasOwnProperty.call(GHCR_REPO_BY_SERVICE, service)) {
+      throw new Error(
+        `NOT_MIRRORED_TO_GHCR names "${service}", which has no entry in GHCR_REPO_BY_SERVICE \u2014 fix the override list (or add the service to the mapping) so the pin gate tracks it correctly.`
+      );
+    }
+  }
+  const token = await ghcrToken();
+  const missingToken = "Cannot verify GHCR pins: set GHCR_TOKEN or configure gh auth token with read:packages.";
+  const report = await evaluatePinCompleteness(services, {
+    ghcrRepoForService: pinGateMapping,
+    listTags: (repo) => {
+      if (!token) throw new Error(missingToken);
+      return ghcrTags(repo, token);
+    },
+    refExists: async (repo, tag) => {
+      if (!token) throw new Error(missingToken);
+      return refExists(repo, tag, token);
+    }
+  }, { allowStalePins });
+  log("info", "Pin completeness: service | pinned | newest shipped | verdict");
+  for (const [service, svc] of Object.entries(services)) {
+    if (typeof svc.image !== "string") continue;
+    const finding = [...report.violations, ...report.unknowns, ...report.allowed].find((f) => f.service === service);
+    const allowed = report.allowed.some((f) => f.service === service);
+    const verdict = allowed ? "ALLOWED (--allow-stale-pin)" : report.skipped.includes(service) ? "skipped" : report.ok.includes(service) ? "ok" : "REFUSE";
+    const shipped = finding && "shippedTag" in finding ? finding.shippedTag : "\u2014 (no newer shipped image verified)";
+    const detail = finding && "reason" in finding ? `: ${finding.reason}` : "";
+    log(allowed ? "warn" : "info", `${service} | ${tagOf(svc.image) ?? "digest-only"} | ${shipped} | ${verdict}${detail}`);
+  }
+  const refusal = pinCompletenessRefusal(report);
+  if (refusal) {
+    log(dryRun ? "warn" : "fail", refusal);
+    if (!dryRun) throw new Error(refusal);
+  }
+  const notesParts = [];
+  for (const change of successfulChanges) {
+    const summaries = change.commits.slice(0, 5).map((c) => {
+      const msg = c.replace(/^[a-f0-9]+ /, "");
+      return msg;
+    });
+    notesParts.push(`${change.repo.serviceKey} v${change.newVersion}: ${summaries.join("; ")}`);
+  }
+  const notes = notesParts.join(". ");
+  const exeOsVersion = readPackageVersion(EXE_OS_ROOT);
+  const newEntry = {
+    version: newStackVersion,
+    releasedAt: (/* @__PURE__ */ new Date()).toISOString().replace(/T.*/, "T00:00:00Z"),
+    notes,
+    npmVersion: exeOsVersion,
+    breakingChanges: [],
+    services,
+    // Staged rollout (release-safety canary hardening): "canary" entries are
+    // published (images pinned + pullable) but NOT promoted for implicit
+    // adoption — see assertRolloutStageAllowed in src/lib/stack-update.ts.
+    rolloutStage: canary ? "canary" : "ga"
+  };
+  if (dryRun) {
+    log("dry", `Would create stack ${newStackVersion} in manifest${canary ? " (CANARY \u2014 latest would NOT be bumped)" : ""}`);
+    log("dry", `Notes: ${notes}`);
+    manifest.stacks[newStackVersion] = newEntry;
+    if (!canary) manifest.latest = newStackVersion;
+    prospectiveManifest = manifest;
+    return newStackVersion;
+  }
+  manifest.stacks[newStackVersion] = newEntry;
+  if (canary) {
+    writeSignedStackManifest(MANIFEST_PATH, manifest, { warn: (msg) => log("warn", msg) });
+    log("ok", `Stack manifest updated: added CANARY ${newStackVersion} (latest unchanged: ${currentLatest})`);
+    log("warn", `${newStackVersion} is a CANARY release. Deploy to a designated canary host with:`);
+    log("warn", `  exe-os stack-update --target ${newStackVersion} --yes`);
+    log("warn", `Then verify health (vps-health-gate / verify-stack) and promote with:`);
+    log("warn", `  exe-os stack-promote --version ${newStackVersion} --yes`);
+  } else {
+    manifest.latest = newStackVersion;
+    writeSignedStackManifest(MANIFEST_PATH, manifest, { warn: (msg) => log("warn", msg) });
+    log("ok", `Stack manifest updated: ${currentLatest} -> ${newStackVersion}`);
+  }
+  return newStackVersion;
+}
+var prospectiveManifest = null;
+function gatePublishWithPreflight(newStackVersion, dryRun, allowRed, releasingServiceKeys = []) {
+  let manifest;
+  try {
+    manifest = dryRun && prospectiveManifest ? prospectiveManifest : JSON.parse(readFileSync4(MANIFEST_PATH, "utf8"));
+  } catch (err) {
+    throw new Error(`Preflight gate: cannot read manifest ${MANIFEST_PATH}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const composeDir = path3.join(EXE_OS_ROOT, "deploy", "compose");
+  const report = runPreflightOnManifest({
+    manifest,
+    stackVersion: newStackVersion,
+    label: `${MANIFEST_PATH} (stack ${newStackVersion})`,
+    envExamplePath: path3.join(composeDir, ".env.example"),
+    composePath: path3.join(composeDir, "docker-compose.yml"),
+    monitorComposePath: path3.join(EXE_OS_ROOT, "deploy", "monitor", "docker-compose.hub.yml")
+  });
+  log(
+    "info",
+    dryRun && prospectiveManifest ? "Running static preflight gate against the manifest this release WOULD write..." : "Running static preflight gate against the freshly-written manifest..."
+  );
+  if (dryRun) {
+    console.log(`  [dry-run] preflight verdict: ${report.verdict} (pass ${report.passed} / warn ${report.warned} / fail ${report.failed})`);
+    if (report.verdict !== "GREEN") {
+      for (const f of report.findings) {
+        if (f.status !== "pass") log(report.verdict === "RED" && f.status === "fail" ? "fail" : "warn", `${f.check}: ${f.message}`);
+      }
+      const releasing = new Set(releasingServiceKeys);
+      const digestFails = report.findings.filter((f) => f.status === "fail" && f.check === "digest-pinning");
+      const unavoidable = digestFails.filter(
+        (f) => (f.offenders ?? []).length > 0 && (f.offenders ?? []).every((o) => releasing.has(String(o).split("=")[0].trim()))
+      );
+      const preExisting = digestFails.filter((f) => !unavoidable.includes(f));
+      if (preExisting.length > 0) {
+        log(
+          "fail",
+          "the digest-pinning failure above names service(s) this release is NOT changing, so it is a REAL unpinned image in the base manifest \u2014 not an artefact of previewing. Fix the pin."
+        );
+      }
+      if (unavoidable.length > 0) {
+        log(
+          "warn",
+          "NOTE: digest-pinning cannot pass in a dry run for the services being released \u2014 their images are built AFTER the tag is pushed, so there is no digest to pin yet. This failure is inherent to previewing, not a defect in the release. Every OTHER check above was evaluated against the manifest this release would actually write."
+        );
+      }
+    }
+    return;
+  }
+  assertPreflightGate(report, {
+    context: "stack-release",
+    allowRed,
+    log: (m) => log("ok", m.replace(/^\[stack-release\]\s*/, "")),
+    warn: (m) => log("warn", m.replace(/^\[stack-release\]\s*/, ""))
+  });
+}
+function gatePreMutationStructure(changes, dryRun, allowRed) {
+  let baseManifest;
+  try {
+    baseManifest = JSON.parse(readFileSync4(MANIFEST_PATH, "utf8"));
+  } catch (err) {
+    throw new Error(`Pre-mutation gate: cannot read manifest ${MANIFEST_PATH}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const currentLatest = baseManifest.latest ?? "";
+  const baseServices = baseManifest.stacks?.[currentLatest]?.services ?? {};
+  const services = {};
+  for (const [key, svc] of Object.entries(baseServices)) services[key] = { ...svc };
+  for (const change of changes) {
+    const svc = services[change.repo.serviceKey];
+    if (svc) svc.image = `${change.repo.imageName}:v${change.newVersion}`;
+  }
+  const currentParts = currentLatest.split(".").map(Number);
+  const simVersion = `${currentParts[0] ?? 0}.${currentParts[1] ?? 9}.${(currentParts[2] ?? 0) + 1}`;
+  const simManifest = {
+    schemaVersion: 1,
+    latest: simVersion,
+    stacks: { [simVersion]: { version: simVersion, services } }
+  };
+  const composeDir = path3.join(EXE_OS_ROOT, "deploy", "compose");
+  const report = runPreflightOnManifest({
+    manifest: simManifest,
+    stackVersion: simVersion,
+    label: `pre-mutation simulated manifest (stack ${simVersion})`,
+    envExamplePath: path3.join(composeDir, ".env.example"),
+    composePath: path3.join(composeDir, "docker-compose.yml"),
+    monitorComposePath: path3.join(EXE_OS_ROOT, "deploy", "monitor", "docker-compose.hub.yml")
+  });
+  const adjusted = {
+    ...report,
+    findings: report.findings.map(
+      (f) => f.check === "digest-pinning" && f.status === "fail" ? { ...f, status: "warn", message: `${f.message} (pending image build \u2014 enforced after build)` } : f
+    )
+  };
+  const failed = adjusted.findings.filter((f) => f.status === "fail").length;
+  const warned = adjusted.findings.filter((f) => f.status === "warn").length;
+  const passed = adjusted.findings.filter((f) => f.status === "pass").length;
+  const verdict = failed > 0 ? "RED" : warned > 0 ? "YELLOW" : "GREEN";
+  const adjustedReport = { ...adjusted, verdict, failed, warned, passed };
+  log("info", "Running pre-mutation structural gate (before any remote push)...");
+  if (dryRun) {
+    console.log(`  [dry-run] pre-mutation verdict: ${adjustedReport.verdict} (pass ${passed} / warn ${warned} / fail ${failed})`);
+    for (const f of adjustedReport.findings) {
+      if (f.status !== "pass") log(f.status === "fail" ? "fail" : "warn", `${f.check}: ${f.message}`);
+    }
+    return;
+  }
+  assertPreflightGate(adjustedReport, {
+    context: "stack-release:pre-mutation",
+    allowRed,
+    log: (m) => log("ok", m.replace(/^\[stack-release:pre-mutation\]\s*/, "")),
+    warn: (m) => log("warn", m.replace(/^\[stack-release:pre-mutation\]\s*/, ""))
+  });
+}
+async function commitAndTagExeOs(newStackVersion, _exeOsChange, dryRun) {
+  if (dryRun) {
+    log("dry", `Would commit manifest + tag exe-os stack-v${newStackVersion}`);
+    return;
+  }
+  const status = await git(EXE_OS_ROOT, "status", "--porcelain", "deploy/stack-manifests/v0.9.json");
+  if (status) {
+    await git(EXE_OS_ROOT, "add", "deploy/stack-manifests/v0.9.json");
+    const commitMsg = `chore: stack release v${newStackVersion}`;
+    await git(EXE_OS_ROOT, "commit", "-m", commitMsg);
+    await landViaPR(EXE_OS_ROOT, "AskExe/exe-os", "main", `release/stack-v${newStackVersion}`, commitMsg);
+    log("ok", `Committed stack manifest v${newStackVersion} (via PR)`);
+  }
+  const stackTag = `stack-v${newStackVersion}`;
+  const releaseCommit = await git(EXE_OS_ROOT, "rev-parse", "HEAD");
+  await assertReleaseFreshness({
+    repoPath: EXE_OS_ROOT,
+    defaultBranch: "main",
+    releaseCommit
+  });
+  await printOpenPrGate({ ghRepo: "AskExe/exe-os", baseBranch: "main" });
+  try {
+    await git(EXE_OS_ROOT, "tag", stackTag);
+    await git(EXE_OS_ROOT, "push", "origin", stackTag);
+    log("ok", `Tagged exe-os ${stackTag}`);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    log("fail", `Failed to tag/push exe-os ${stackTag}: ${message}`);
+    throw new Error(
+      `Aborting: failed to tag/push exe-os ${stackTag}: ${message}. The manifest was committed but the stack-v tag that publishes it was not \u2014 customers will keep reading the previous manifest. Fix the cause and re-run; publishing is idempotent.`
+    );
+  }
+}
+function printSummary(changes, ciStatuses, newStackVersion, dryRun) {
+  const divider = "\u2500".repeat(70);
+  console.log(`
+${divider}`);
+  console.log(`  ${dryRun ? "[DRY RUN] " : ""}Stack Release Summary \u2014 v${newStackVersion}`);
+  console.log(divider);
+  console.log(
+    `  ${"Service".padEnd(14)} ${"Version".padEnd(20)} ${"Commits".padEnd(8)} ${"CI".padEnd(12)}`
+  );
+  console.log(`  ${"\u2500".repeat(14)} ${"\u2500".repeat(20)} ${"\u2500".repeat(8)} ${"\u2500".repeat(12)}`);
+  for (const change of changes) {
+    const ci = ciStatuses.find((s) => s.repo.serviceKey === change.repo.serviceKey);
+    const ciLabel = dryRun ? "\x1B[33mpending\x1B[0m" : ci?.status === "completed" && ci.conclusion === "success" ? "\x1B[32msuccess\x1B[0m" : ci?.status === "timed_out" ? "\x1B[31mtimed out\x1B[0m" : `\x1B[31m${ci?.conclusion ?? ci?.status ?? "unknown"}\x1B[0m`;
+    const versionStr = `${change.currentVersion} -> ${change.newVersion}`;
+    console.log(
+      `  ${change.repo.serviceKey.padEnd(14)} ${versionStr.padEnd(20)} ${String(change.commits.length).padEnd(8)} ${ciLabel}`
+    );
+  }
+  if (changes.length === 0) {
+    console.log("  No changes detected across any repo.");
+  }
+  console.log(divider);
+  if (!dryRun) {
+    const failed = ciStatuses.filter(
+      (s) => s.status !== "completed" || s.conclusion !== "success"
+    );
+    if (failed.length > 0) {
+      console.log("\n  \x1B[31mWarning:\x1B[0m Some CI builds failed. Check the links above.");
+    } else if (changes.length > 0) {
+      console.log(
+        `
+  \x1B[32mAll done.\x1B[0m Customers will pull new images from update.askexe.com on next stack-update.`
+      );
+    }
+  }
+  console.log("");
+}
+function log(level, msg) {
+  const prefix = {
+    info: "\x1B[36m[info]\x1B[0m",
+    ok: "\x1B[32m[ok]\x1B[0m",
+    warn: "\x1B[33m[warn]\x1B[0m",
+    fail: "\x1B[31m[fail]\x1B[0m",
+    dry: "\x1B[35m[dry-run]\x1B[0m"
+  };
+  console.log(`  ${prefix[level]} ${msg}`);
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function confirm(message) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
+    rl.question(`
+  ${message} [y/N] `, (answer) => {
+      rl.close();
+      resolve(answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes");
+    });
+  });
+}
+function nextStackVersionForLock() {
+  try {
+    const manifest = JSON.parse(readFileSync4(MANIFEST_PATH, "utf8"));
+    const parts = String(manifest.latest ?? "0.9.0").split(".").map(Number);
+    return `stack-v${parts[0] ?? 0}.${parts[1] ?? 9}.${(parts[2] ?? 0) + 1}`;
+  } catch {
+    return "stack-vunknown";
+  }
+}
+async function currentReleaseBranch() {
+  try {
+    return await git(EXE_OS_ROOT, "branch", "--show-current") || "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function forceBuildRejection(flags) {
+  if (!flags.forceBuildRejected) return null;
+  return [
+    "--force-build is not supported and has been removed (bug b55695a5).",
+    "It never bypassed any gate: nothing downstream read it, images are built by tag push,",
+    "and docker.yml's green-CI gate stayed fully in force. It only printed a bypass banner.",
+    "Fix the red CI, or cut the release from a green SHA. Re-run without --force-build."
+  ].join("\n");
+}
+async function runStackRelease(flags) {
+  if (!flags.stack) {
+    console.error("Usage: exe-os release --stack [--dry-run] [--repos <list>] [--yes] [--skip-image-verify] [--allow-stale-pin <service>]... [--allow-red] [--allow-dirty] [--canary] [--root <path>] [--force]");
+    process.exit(1);
+  }
+  if (flags.root) {
+    applyRootOverride(flags.root);
+  }
+  const forceBuildError = forceBuildRejection(flags);
+  if (forceBuildError) {
+    console.error(forceBuildError);
+    process.exit(1);
+  }
+  if (flags.force) {
+    console.warn("\n  \x1B[33;1m\u26A0  --force: release mutex override is ACTIVE\x1B[0m");
+    console.warn("  \x1B[33m   This only overrides ~/.exe-os/release.lock; freshness and publish gates still apply.\x1B[0m");
+    console.warn("  \x1B[33m   Use only after verifying no other release is actually running.\x1B[0m\n");
+  }
+  let releaseLock;
+  if (!flags.dryRun) {
+    releaseLock = acquireReleaseLock({
+      targetVersion: nextStackVersionForLock(),
+      branch: await currentReleaseBranch(),
+      force: flags.force,
+      log: (message) => log("warn", message)
+    });
+    log("ok", `Acquired release lock: ${releaseLock.lockPath}`);
+  }
+  try {
+    await assertCleanWorkingTree({ allowDirty: flags.allowDirty || flags.dryRun });
+    console.log(`
+  \x1B[1mexe-os stack release\x1B[0m${flags.dryRun ? " (dry run)" : ""}
+`);
+    const allRepos = buildRepoConfigs();
+    let repos;
+    if (flags.repos) {
+      repos = [];
+      for (const name of flags.repos) {
+        const match = allRepos.find(
+          (r) => r.serviceKey === name || r.ghRepo.endsWith(`/${name}`) || r.ghRepo === name
+        );
+        if (match) {
+          repos.push(match);
+        } else {
+          log("warn", `Unknown repo: ${name} \u2014 skipping`);
+        }
+      }
+      if (repos.length === 0) {
+        throw new Error("No valid repos specified.");
+      }
+    } else {
+      repos = allRepos;
+    }
+    repos = repos.filter((repo) => {
+      if (hasPackageJson(repo)) return true;
+      warnMissingRepoPackage(repo);
+      return false;
+    });
+    log("info", "Detecting changes across repos...");
+    const changes = await detectChanges(repos);
+    if (changes.length === 0) {
+      console.log("\n  No changes detected since last tags. Nothing to release.\n");
+      return;
+    }
+    const bumpMode = flags.major ? "major" : flags.minor ? "minor" : "patch";
+    for (const change of changes) {
+      const newVersion = bumpVersion(change.currentVersion, bumpMode);
+      change.newVersion = newVersion;
+      change.tag = `v${newVersion}`;
+    }
+    console.log("\n  Planned releases:");
+    for (const change of changes) {
+      console.log(
+        `    ${change.repo.serviceKey.padEnd(14)} ${change.currentVersion} -> ${change.newVersion}  (${change.commits.length} commit${change.commits.length === 1 ? "" : "s"})`
+      );
+    }
+    gatePreMutationStructure(changes, flags.dryRun, flags.allowRed);
+    if (!flags.yes && !flags.dryRun) {
+      const ok = await confirm("Proceed with release?");
+      if (!ok) {
+        console.log("  Aborted.\n");
+        return;
+      }
+    }
+    await bumpVersions(changes, bumpMode, flags.dryRun);
+    log("info", "Tagging repos and triggering CI...");
+    await tagAndTriggerCI(changes, flags.dryRun);
+    const ciStatuses = await waitForCI(changes, flags.dryRun);
+    const ciFailures = ciStatuses.filter(
+      (s) => s.status !== "completed" || s.conclusion !== "success"
+    );
+    if (ciFailures.length > 0 && !flags.dryRun) {
+      await rollbackFailedReleases(changes, ciStatuses, flags.dryRun);
+      const ciSuccesses = ciStatuses.filter(
+        (s) => s.status === "completed" && s.conclusion === "success"
+      );
+      if (ciSuccesses.length === 0) {
+        log("fail", "All CI builds failed. Release aborted, all bumps rolled back.");
+        throw new Error("All CI builds failed. Release aborted, all bumps rolled back.");
+      }
+      log("warn", `${ciFailures.length} CI build(s) failed and were rolled back. Continuing with ${ciSuccesses.length} successful build(s).`);
+    }
+    let imageResults = [];
+    if (flags.skipImageVerify) {
+      log("warn", "Image verification skipped (--skip-image-verify)");
+    } else {
+      imageResults = await verifyImages(changes, ciStatuses, flags.dryRun);
+      const failed = imageResults.filter((r) => (r.ghcr === "missing" || r.ghcr === "error") && r.proxy !== "ok");
+      if (failed.length > 0 && !flags.dryRun) {
+        for (const m of failed) {
+          log("fail", `${shortImageName(m.repo.imageName)}:${m.tag} \u2014 GHCR status: ${m.ghcr}, proxy: ${m.proxy} \u2014 cannot release`);
+        }
+        log("fail", "Aborting: images not verified. Fix GHCR auth/CI or use --skip-image-verify to override.");
+        throw new Error("Aborting: images not verified. Fix GHCR auth/CI or use --skip-image-verify to override.");
+      }
+      const pending = imageResults.filter((r) => r.proxy === "pending");
+      if (pending.length > 0) {
+        for (const p of pending) {
+          log("warn", `${shortImageName(p.repo.imageName)}:${p.tag} \u2014 proxy cache pending`);
+        }
+        if (!flags.dryRun) {
+          log("fail", "Aborting: proxy cache not ready for all images. Wait for proxy propagation or use --skip-image-verify.");
+          throw new Error("Aborting: proxy cache not ready for all images. Wait for proxy propagation or use --skip-image-verify.");
+        }
+      }
+      printImageVerification(imageResults);
+    }
+    log("info", "Updating stack manifest...");
+    const newStackVersion = await updateStackManifest(changes, ciStatuses, flags.dryRun, imageResults, flags.canary, flags.allowStalePins);
+    gatePublishWithPreflight(
+      newStackVersion,
+      flags.dryRun,
+      flags.allowRed,
+      changes.map((c) => c.repo.serviceKey)
+    );
+    const exeOsChange = changes.find((c) => c.repo.serviceKey === "exe-os");
+    await commitAndTagExeOs(newStackVersion, exeOsChange, flags.dryRun);
+    printSummary(changes, ciStatuses, newStackVersion, flags.dryRun);
+    if (!flags.skipImageVerify && !flags.dryRun && imageResults.length > 0) {
+      const pendingImages = imageResults.filter((r) => r.proxy === "pending");
+      if (pendingImages.length > 0) {
+        log("info", "Re-checking proxy availability for pending images...");
+        for (const r of pendingImages) {
+          const shortName = shortImageName(r.repo.imageName);
+          const proxyRepo = `askexe/${shortName}`;
+          const proxyToken = process.env.EXE_REGISTRY_PROXY_PULL_TOKEN ?? void 0;
+          const recheck = await checkRegistryManifest(PROXY_REGISTRY, proxyRepo, r.tag, proxyToken);
+          if (recheck.ok) {
+            r.proxy = "ok";
+          }
+        }
+        printImageVerification(imageResults);
+      }
+    }
+  } finally {
+    releaseLock?.release();
+    if (releaseLock) log("ok", `Released release lock: ${releaseLock.lockPath}`);
+  }
+}
+export {
+  NO_STACK_MANIFEST_SERVICE,
+  RELEASE_PR_POLL_JQ,
+  assertCleanWorkingTree,
+  assertReleaseFreshness,
+  assertVersionNotAlreadyReleased,
+  classifySuccessfulBuildPin,
+  compareSemver,
+  deriveCloneUrl,
+  ensureRepoCloned,
+  findPullRequestForHeadSha,
+  findWorkflowRunForHeadSha,
+  forceBuildRejection,
+  getRemoteReleaseTags,
+  higherSemver,
+  highestReleasedVersion,
+  imageRepoPath,
+  isCloneTargetSafe,
+  isStrictSemverTag,
+  manifestServiceKeyOf,
+  mayRebaseComponent,
+  parseReleaseArgs,
+  parseRemoteTagNames,
+  printOpenPrGate,
+  rebaseImageTag,
+  resolveVersionBasis,
+  runStackRelease,
+  validateNoStackManifestServiceExemptions
+};