@b00dea/cockpit 0.0.0-stage → 0.1.0

package/dist/environment/runtime.js

@@ -0,0 +1,2335 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { platform } from 'node:os';
+import { dirname, isAbsolute, normalize, relative, resolve, sep } from 'node:path';
+import { parseDocument } from 'yaml';
+import { authenticatedExecutionOutcome } from '../environment-exec/execute.js';
+import { MAX_COLD_START_SECONDS } from '../schema.js';
+import { consumeMachineFloorConfigProjection } from '../config/load.js';
+import { tryParseJson, RefusalError, DOCKER_CLIENT_ENVIRONMENT, ENVIRONMENT_CODES, errorCause, isCanonicalTimestamp, OBSERVATION_REASON_BYTE_LIMIT, snapshotEnvironmentObservation, HOST_PROCESS_CONTROL_ENV, snapshotExecutionPlan, snapshotExecutionStep, snapshotJson, } from './contract.js';
+import { compareBindSources, composeProjectDirectory } from './compose-topology.js';
+import { isResolvedDockerExecutable, resolvedDockerExecutable, resolvedExecutable } from './executable.js';
+import {} from './claims.js';
+import { stackId as deriveStackId } from './identity.js';
+import { inspectPortLeaseProjection, observePortListeners, revalidatePortLeaseProjection, } from './ports.js';
+import { cockpitCommand } from '../fix-catalogue.js';
+import { consumeSetupCheckoutProjection } from './setup-observation.js';
+import { composeProcessEnvironment } from './compose-environment.js';
+import { exactOwnKeys } from '../exact-keys.js';
+const OWNER = 'runtime-planning';
+export const observationDeclarations = Object.freeze([
+    { id: 'runtime-availability', owner: OWNER, postures: ['mounted', 'host'], stages: [{ stage: 'bootstrap', disposition: 'required' }, { stage: 'steady', disposition: 'required' }], code: ENVIRONMENT_CODES.RUNTIME_UNAVAILABLE, isIssued: isRuntimeObservation, issuedAt: observationIssuedAt },
+    { id: 'runtime-measurement', owner: OWNER, postures: ['environment', 'mounted', 'host'], stages: [{ stage: 'bootstrap', disposition: 'required' }, { stage: 'steady', disposition: 'required' }], code: ENVIRONMENT_CODES.RUNTIME_UNMEASURED, isIssued: isRuntimeObservation, issuedAt: observationIssuedAt },
+    { id: 'mount-posture', owner: OWNER, postures: ['mounted', 'host'], stages: [{ stage: 'bootstrap', disposition: 'required' }, { stage: 'steady', disposition: 'required' }], code: ENVIRONMENT_CODES.MOUNT_POSTURE_UNAVAILABLE, isIssued: isRuntimeObservation, issuedAt: observationIssuedAt },
+]);
+export const runtimeHealthObservationDeclarations = Object.freeze([
+    { id: 'runtime-mount-materialization', owner: OWNER, postures: ['running-stack'], stages: [{ stage: 'bootstrap', disposition: 'required' }, { stage: 'steady', disposition: 'required' }], code: ENVIRONMENT_CODES.MOUNT_MATERIALIZATION_UNAVAILABLE, isIssued: isRuntimeObservation, issuedAt: observationIssuedAt },
+    { id: 'runtime-port-family', owner: OWNER, postures: ['running-stack'], stages: [{ stage: 'bootstrap', disposition: 'not-applicable', reason: 'ports are leased after the first seed' }, { stage: 'steady', disposition: 'required' }], code: ENVIRONMENT_CODES.PORT_FAMILY_COLLISION, isIssued: isRuntimeObservation, issuedAt: observationIssuedAt },
+]);
+const issuedObservations = new WeakMap();
+const issuedRuntimePlans = new WeakMap();
+function issueObservation(value) {
+    const snapshot = snapshotEnvironmentObservation(value);
+    if (!snapshot || snapshot.owner !== OWNER)
+        throw new RefusalError('runtime observation is malformed');
+    issuedObservations.set(snapshot, Date.now());
+    return snapshot;
+}
+export function isRuntimeObservation(value) {
+    return value !== null && typeof value === 'object' && issuedObservations.has(value);
+}
+function observationIssuedAt(value) {
+    return value !== null && typeof value === 'object' ? issuedObservations.get(value) : undefined;
+}
+export function observeRuntimeExecution(input) {
+    let plan;
+    let suppliedOutcome;
+    let owned;
+    try {
+        plan = input.plan;
+        suppliedOutcome = input.outcome;
+        owned = snapshotJson(issuedRuntimePlans.get(plan));
+    }
+    catch {
+        throw new RefusalError('runtime execution evidence is not authentic');
+    }
+    const values = owned && typeof owned === 'object' && !Array.isArray(owned) ? owned : undefined;
+    const contract = issuedRuntimePlans.get(plan);
+    const step = plan?.steps?.[0];
+    const outcome = step ? authenticatedExecutionOutcome(suppliedOutcome, step) : undefined;
+    if (!contract || !step || !outcome || typeof values?.stackId !== 'string' || !/^stack:[a-f0-9]{64}$/.test(values.stackId)
+        || !Number.isSafeInteger(values.coldStartLimitMillis) || values.coldStartLimitMillis < 1) {
+        throw new RefusalError('runtime execution evidence is not authentic');
+    }
+    if (!Array.isArray(values.expectedMountSources) || values.expectedMountSources.length > 4_096
+        || new Set(values.expectedMountSources).size !== values.expectedMountSources.length
+        || values.expectedMountSources.some((path) => typeof path !== 'string' || !isAbsolute(path) || normalize(path) !== path || path.includes('\0'))) {
+        throw new RefusalError('runtime mount expectation is malformed');
+    }
+    const stackId = values.stackId;
+    const coldStartLimitMillis = values.coldStartLimitMillis;
+    const expectedMountSources = values.expectedMountSources;
+    const observedAt = outcome.receipt?.finishedAt;
+    if (!observedAt || !isCanonicalTimestamp(observedAt))
+        throw new RefusalError('runtime execution evidence is not authentic');
+    const runtimeAvailable = outcome.kind === 'complete';
+    const observations = [issueObservation({
+            code: ENVIRONMENT_CODES.RUNTIME_UNAVAILABLE, owner: OWNER, stackId, source: step.argv0,
+            observed: { state: 'available', value: runtimeAvailable, observedAt }, expectation: { kind: 'equal', value: true },
+            applicability: { state: 'required', posture: 'mounted' }, freshness: { state: 'current' }, remedy: 'restore the declared runtime executable and retry the bounded probe',
+        })];
+    let mountObserved;
+    if (contract.operation !== 'validate' || outcome.kind !== 'complete') {
+        mountObserved = { state: 'unavailable', reason: 'mount evidence requires a successful runtime validation plan', observedAt };
+    }
+    else {
+        let sources;
+        let mountCause = '';
+        try {
+            const source = new TextDecoder('utf-8', { fatal: true }).decode(outcome.stdout);
+            const parsed = parseDocument(source).toJS();
+            const values = [];
+            if (!parsed || typeof parsed !== 'object' || !parsed.services || typeof parsed.services !== 'object'
+                || Object.keys(parsed.services).length > 4_096)
+                throw new RefusalError('invalid services');
+            for (const service of Object.values(parsed.services)) {
+                if (!service || typeof service !== 'object' || !Array.isArray(service.volumes) || service.volumes.length > 4_096)
+                    continue;
+                for (const volume of service.volumes) {
+                    if (typeof volume === 'string') {
+                        const source = volume.split(':', 1)[0];
+                        if (isAbsolute(source) && normalize(source) === source && !source.includes('\0'))
+                            values.push(source);
+                    }
+                    else if (volume && typeof volume === 'object' && volume.type === 'bind'
+                        && typeof volume.source === 'string')
+                        values.push(volume.source);
+                }
+            }
+            sources = [...new Set(values)].sort();
+        }
+        catch (error) {
+            mountCause = `: ${errorCause(error)}`;
+        }
+        mountObserved = sources
+            ? { state: 'available', value: mountSourcesMatch(sources, expectedMountSources), observedAt }
+            : { state: 'failed', reason: `runtime mount output is malformed or unreadable${mountCause}`, observedAt };
+    }
+    observations.push(issueObservation({
+        code: ENVIRONMENT_CODES.MOUNT_POSTURE_UNAVAILABLE, owner: OWNER, stackId, source: step.id,
+        observed: mountObserved, expectation: { kind: 'equal', value: true }, applicability: { state: 'required', posture: 'mounted' },
+        freshness: { state: 'current' }, remedy: 'restore the declared checkout mount sources',
+    }));
+    if (contract.operation === 'up') {
+        const startedAt = outcome.receipt?.startedAt;
+        const duration = startedAt ? Date.parse(observedAt) - Date.parse(startedAt) : Number.NaN;
+        observations.push(issueObservation({
+            code: ENVIRONMENT_CODES.MACHINE_COLD_START_EXCEEDED, owner: OWNER, stackId, source: step.id,
+            observed: Number.isSafeInteger(duration) && duration >= 0
+                ? { state: 'available', value: duration, observedAt }
+                : { state: 'failed', reason: 'runtime receipt timestamps are incoherent', observedAt },
+            expectation: { kind: 'maximum', value: coldStartLimitMillis }, applicability: { state: 'required', posture: 'environment' },
+            freshness: { state: 'current' }, remedy: 'restore the declared cold-start budget',
+        }));
+    }
+    return observations;
+}
+const UNRESOLVED_TOKEN = /(?<!\$)\$(?:\{[^}]*\}|[A-Za-z_][A-Za-z0-9_]*)|\{\{[^}]*\}\}/;
+// A cockpit's own Compose file interpolates from the environment cockpit hands Compose: the leased
+// [ports.bases] variables and the sibling directory variables, nothing else. A reference with an
+// explicit default is the file's own choice; any other reference would resolve to empty, so it
+// stays refused.
+function composeTokensResolved(source, portNames) {
+    const tokens = source.match(new RegExp(UNRESOLVED_TOKEN.source, 'g')) ?? [];
+    return tokens.every((token) => {
+        const match = token.match(/^\$\{([A-Za-z_][A-Za-z0-9_]*)(?:(:?[-?])[^}]*)?\}$/);
+        return match !== null && (match[2]?.endsWith('-') === true || portNames.includes(match[1]));
+    });
+}
+const PROJECT_NAME = /^[a-z0-9][a-z0-9_-]*$/;
+const REMOTE_REFERENCE = /^[A-Za-z][A-Za-z0-9+.-]*:/;
+const MAX_TIMEOUT_MS = 300_000;
+const OUTPUT_LIMIT_BYTES = 65_536;
+const RUNTIME_OPERATIONS = ['validate', 'up', 'down'];
+const SHA256 = /^[a-f0-9]{64}$/;
+const VERSION = /^\d+\.\d+\.\d+$/;
+// What Docker and Compose print: a numeric core and an optional vendor suffix, such as Docker
+// Desktop's `2.29.7-desktop.1`. Accepting only the bare core refused every Docker Desktop runtime.
+// Floors and comparisons use the core; the full string stays as evidence.
+const OBSERVED_VERSION = /^(\d+\.\d+\.\d+)(?:[-+][0-9A-Za-z.-]+)?$/;
+/** The numeric core of a version Docker or Compose printed, or undefined when it has none. */
+export function observedVersionCore(value) {
+    return value.match(OBSERVED_VERSION)?.[1];
+}
+function captureOwnValues(value, keys) {
+    try {
+        if (value === null || typeof value !== 'object' || Array.isArray(value) || !exactOwnKeys(value, keys))
+            return undefined;
+        const descriptors = Object.getOwnPropertyDescriptors(value);
+        const captured = {};
+        for (const key of keys) {
+            const descriptor = descriptors[key];
+            if (!descriptor || !('value' in descriptor))
+                return undefined;
+            captured[key] = descriptor.value;
+        }
+        return captured;
+    }
+    catch {
+        // A throwing accessor or proxy trap makes the input unreadable, which the caller refuses.
+        return undefined;
+    }
+}
+function runtimeAdapterInput(value) {
+    const baseKeys = ['runtime', 'composeVersion', 'executable', 'operation', 'cwd', 'composeFiles', 'projectName', 'env', 'ports', 'labels', 'timeoutMs'];
+    const ownedKeys = [...baseKeys, 'stackId', 'coldStartLimitMillis', 'expectedMountSources'];
+    if (value === null || typeof value !== 'object' || Array.isArray(value)
+        || !([baseKeys, [...baseKeys, 'activeProfiles'], ownedKeys, [...ownedKeys, 'activeProfiles']]
+            .some((keys) => exactOwnKeys(value, keys))))
+        return undefined;
+    const input = value;
+    if (input.runtime === null || typeof input.runtime !== 'object' || !exactOwnKeys(input.runtime, ['name', 'version', 'executableSha256'])
+        || Object.values(input.runtime).some((part) => typeof part !== 'string')
+        || !isResolvedDockerExecutable(input.executable)
+        || !Array.isArray(input.composeFiles) || !Array.isArray(input.ports)
+        || input.env === null || typeof input.env !== 'object' || Array.isArray(input.env)
+        || input.labels === null || typeof input.labels !== 'object' || Array.isArray(input.labels)
+        || Object.entries(input.env).some(([key, part]) => key.length === 0 || typeof part !== 'string')
+        || Object.entries(input.labels).some(([key, part]) => key.length === 0 || typeof part !== 'string')
+        || input.ports.some((port) => typeof port !== 'number')
+        || typeof input.composeVersion !== 'string' || typeof input.operation !== 'string' || typeof input.cwd !== 'string'
+        || typeof input.projectName !== 'string' || typeof input.timeoutMs !== 'number'
+        || input.stackId !== undefined && (typeof input.stackId !== 'string' || !/^stack:[a-f0-9]{64}$/.test(input.stackId))
+        || input.coldStartLimitMillis !== undefined && (!Number.isSafeInteger(input.coldStartLimitMillis) || input.coldStartLimitMillis < 1)
+        || input.expectedMountSources !== undefined && (!Array.isArray(input.expectedMountSources)
+            || input.expectedMountSources.length > 4_096
+            || new Set(input.expectedMountSources).size !== input.expectedMountSources.length
+            || input.expectedMountSources.some((path) => typeof path !== 'string' || !isAbsolute(path) || normalize(path) !== path || path.includes('\0')))
+        || input.activeProfiles !== undefined && (!Array.isArray(input.activeProfiles)
+            || input.activeProfiles.length > 64 || new Set(input.activeProfiles).size !== input.activeProfiles.length
+            || input.activeProfiles.some((profile) => typeof profile !== 'string' || !SERVICE_ID.test(profile)))
+        || input.composeFiles.some((artifact) => artifact === null || typeof artifact !== 'object'
+            || !exactOwnKeys(artifact, ['reference', 'canonicalPath', 'source', 'sha256'])
+            || Object.values(artifact).some((part) => typeof part !== 'string')))
+        return undefined;
+    return {
+        ...input,
+        ...(input.expectedMountSources === undefined
+            ? {}
+            : { expectedMountSources: [...input.expectedMountSources].sort() }),
+        ...(input.activeProfiles === undefined ? {} : { activeProfiles: [...input.activeProfiles].sort() }),
+    };
+}
+export function classifyResolvedRuntimeLiterals(values) {
+    let captured;
+    try {
+        if (!Array.isArray(values))
+            return 'unsafe';
+        const length = values.length;
+        const keys = Object.keys(values);
+        if (!Number.isSafeInteger(length) || length < 0 || length > 4_096
+            || keys.length !== length || keys.some((key, index) => key !== String(index)))
+            return 'unsafe';
+        captured = keys.map((key) => values[key]);
+    }
+    catch {
+        // A throwing accessor or proxy trap makes the list unsafe, which the caller refuses.
+        return 'unsafe';
+    }
+    const owned = snapshotJson(captured);
+    if (!Array.isArray(owned) || owned.some((value) => typeof value !== 'string'))
+        return 'unsafe';
+    if (owned.some((value) => UNRESOLVED_TOKEN.test(value)))
+        return 'unresolved';
+    if (owned.some((value) => value.includes('\0')))
+        return 'unsafe';
+    return 'resolved';
+}
+function refusal(code, message, target) {
+    return {
+        kind: 'refusal',
+        status: 2,
+        diagnostics: [{ severity: 'error', code, message, target }],
+        result: null,
+    };
+}
+const issuedMachineFloorEvidence = new WeakSet();
+const issuedMachineFloorAuthorities = new WeakMap();
+export function issueMachineFloorAuthority(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)
+        || !exactOwnKeys(input, ['configuration', 'checkout']))
+        return undefined;
+    const configurationDescriptor = Object.getOwnPropertyDescriptor(input, 'configuration');
+    const checkoutDescriptor = Object.getOwnPropertyDescriptor(input, 'checkout');
+    if (!configurationDescriptor || !('value' in configurationDescriptor)
+        || !checkoutDescriptor || !('value' in checkoutDescriptor))
+        return undefined;
+    const configuration = consumeMachineFloorConfigProjection(configurationDescriptor.value);
+    const checkout = consumeSetupCheckoutProjection(checkoutDescriptor.value);
+    if (!configuration || !checkout || configuration.cockpitName !== checkout.cockpitName
+        || configuration.source.path !== checkout.source.path
+        || configuration.source.sha256 !== checkout.source.sha256
+        || configuration.source.byteLength !== checkout.source.byteLength)
+        return undefined;
+    const floor = {
+        memoryBytes: configuration.floor.runtimeMemoryMb * 1_024 * 1_024,
+        cpuMillis: configuration.floor.runtimeCpus * 1_000,
+        freeDiskBytes: configuration.floor.freeDiskMb * 1_024 * 1_024,
+    };
+    if (Object.values(floor).some((value) => !Number.isSafeInteger(value) || value < 1))
+        return undefined;
+    const authority = { kind: 'machine-floor-authority' };
+    issuedMachineFloorAuthorities.set(authority, Object.freeze({
+        stackId: deriveStackId({ cockpitId: checkout.cockpitId, checkoutId: checkout.checkoutId, variant: { kind: 'shared' } }),
+        checkoutPath: dirname(configuration.source.path),
+        configSha256: configuration.runtimeSha256,
+        floor: Object.freeze(floor),
+    }));
+    return { authority, checkout };
+}
+export function isMachineFloorEvidence(value) {
+    return value !== null && typeof value === 'object' && issuedMachineFloorEvidence.has(value);
+}
+const MACHINE_FLOOR_ENV = new Set(['PATH', 'DOCKER_HOST', 'DOCKER_CONTEXT', 'DOCKER_TLS_VERIFY', 'DOCKER_CERT_PATH']);
+// Keep the filesystem query inside the bounded executor; a filesystem stall must not hold the CLI.
+const DISK_CAPACITY_COLLECTOR = `
+import { statfsSync } from 'node:fs'
+if (process.argv.length !== 2) throw new RefusalError('Disk capacity requires one filesystem path')
+const status = statfsSync(process.argv[1], { bigint: true })
+const bytes = status.bsize * status.bavail
+if (status.bsize <= 0n || status.bavail < 0n || bytes > BigInt(Number.MAX_SAFE_INTEGER)) {
+    throw new RefusalError('Available filesystem capacity is outside the supported byte range')
+}
+process.stdout.write(bytes.toString() + '\\n')
+`;
+function safeMachineFloorEnvironment(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        && Object.entries(value).every(([name, item]) => MACHINE_FLOOR_ENV.has(name) && typeof item === 'string' && !item.includes('\0'));
+}
+function machineFloorEnvironment(value) {
+    return Object.fromEntries(Object.entries(value).filter(([name]) => MACHINE_FLOOR_ENV.has(name)));
+}
+/**
+ * Name the container runtime product from one `docker info` reading, or null when it is not one we
+ * recognise. The identity selects this machine's runtime measurement, so a wrong match would
+ * admit a runtime on another product's measurement; anything unrecognised therefore stays null.
+ *
+ * Provenance of each rule: `orbstack` was observed on a host running OrbStack (OperatingSystem
+ * "OrbStack", Name "orbstack", OSType "linux"). The `docker-desktop`, `colima`, `rancher-desktop` and
+ * `docker-engine` rules are derived from those vendors' documented `docker info` output and have not
+ * been probed on a host here.
+ */
+export function runtimeIdentity(input) {
+    if (input.operatingSystem === 'Docker Desktop')
+        return 'docker-desktop';
+    if (input.operatingSystem === 'OrbStack')
+        return 'orbstack';
+    // Colima names its VM after the profile: "colima" or "colima-<profile>".
+    if (input.name.startsWith('colima'))
+        return 'colima';
+    // Rancher Desktop runs its engine in a Lima VM named "lima-rancher-desktop".
+    if (input.name.endsWith('rancher-desktop'))
+        return 'rancher-desktop';
+    // On a Linux host the daemon is the host's own Docker Engine; on macOS an unrecognised
+    // OperatingSystem is some other VM product and must not borrow this identity.
+    if (input.hostPlatform === 'linux' && input.osType === 'linux')
+        return 'docker-engine';
+    return null;
+}
+const DOCKER_IDENTITY_FORMAT = '[{{json .OperatingSystem}},{{json .Name}},{{json .OSType}}]';
+function dockerIdentityFields(text) {
+    // Unparsable identity output yields no fields; the caller reports the probe as unauthenticated output.
+    const parsed = tryParseJson(text);
+    if (!Array.isArray(parsed) || parsed.length !== 3)
+        return undefined;
+    const [operatingSystem, name, osType] = parsed;
+    const bounded = (value, limit) => typeof value === 'string'
+        && value.length > 0 && value.length <= limit && !/[\u0000-\u001f\u007f]/.test(value);
+    return bounded(operatingSystem, 128) && bounded(name, 128) && bounded(osType, 16)
+        ? [operatingSystem, name, osType] : undefined;
+}
+function runtimeVersionUnavailable(reason) {
+    return { kind: 'unavailable', code: ENVIRONMENT_CODES.RUNTIME_UNAVAILABLE, reason };
+}
+// The runtime answered, so starting it is the wrong remedy: the installed tool prints a version
+// that floors and measurements cannot compare.
+function runtimeVersionUnparseable(tool, command, printed) {
+    return {
+        kind: 'unavailable',
+        code: ENVIRONMENT_CODES.RUNTIME_UNAVAILABLE,
+        reason: `${tool} reported version ${JSON.stringify(printed.slice(0, 64))} from \`${command}\`, which has no numeric X.Y.Z core`,
+        fix: 'install a Docker Engine and Docker Compose release whose `docker version --format {{.Server.Version}}` and `docker compose version --short` print X.Y.Z (a suffix such as -desktop.1 is fine), then retry',
+    };
+}
+const issuedDockerRuntimeObservations = new WeakSet();
+const issuedRuntimeMeasurementAdmissions = new WeakMap();
+const issuedRuntimeMeasurementProbeAuthorities = new WeakMap();
+export function issueRuntimeMeasurementProbeAuthority(observation) {
+    if (!observation || typeof observation !== 'object' || observation.kind !== 'complete'
+        || !issuedDockerRuntimeObservations.has(observation))
+        throw new RefusalError('runtime measurement probe evidence is not authentic');
+    const authority = { kind: 'runtime-measurement-probe-authority' };
+    issuedRuntimeMeasurementProbeAuthorities.set(authority, observation);
+    return authority;
+}
+export function runtimeMeasurementProbeObservation(authority, executableSha256) {
+    const issued = authority && typeof authority === 'object' ? issuedRuntimeMeasurementProbeAuthorities.get(authority) : undefined;
+    if (authority && typeof authority === 'object')
+        issuedRuntimeMeasurementProbeAuthorities.delete(authority);
+    const age = issued ? Date.now() - Date.parse(issued.observedAt) : Number.NaN;
+    return issued && issued.runtime.executableSha256 === executableSha256
+        && age >= 0 && age <= 300_000 ? issued : undefined;
+}
+function runtimeUnmeasured(reason) {
+    return { kind: 'unavailable', code: ENVIRONMENT_CODES.RUNTIME_UNMEASURED, reason };
+}
+/** A floor cockpit writes: a bare numeric core. */
+export function isVersionFloor(value) {
+    return VERSION.test(value);
+}
+/** Whether a version Docker or Compose printed is at least `floor`; false when either is malformed. */
+export function versionAtLeast(actual, floor) {
+    const core = observedVersionCore(actual);
+    if (core === undefined || !isVersionFloor(floor))
+        return false;
+    const left = core.split('.').map(Number);
+    const right = floor.split('.').map(Number);
+    for (let index = 0; index < left.length; index += 1) {
+        if (left[index] !== right[index])
+            return left[index] > right[index];
+    }
+    return true;
+}
+export function admitRuntimeMeasurement(observation, measurements) {
+    if (!observation || typeof observation !== 'object' || !issuedDockerRuntimeObservations.has(observation)
+        || observation.kind !== 'complete')
+        return runtimeUnmeasured('Docker runtime evidence is unavailable or unauthenticated');
+    const refuse = (reason) => {
+        const result = runtimeUnmeasured(reason);
+        issuedRuntimeMeasurementAdmissions.set(result, observation);
+        return result;
+    };
+    const identity = observation.runtimeIdentity;
+    const dockerInfo = `docker info: OperatingSystem ${JSON.stringify(observation.operatingSystem)}, Name ${JSON.stringify(observation.name)}, `
+        + `OSType ${JSON.stringify(observation.osType)}; engine ${observation.runtime.version}; host ${observation.hostPlatform}`;
+    const rows = measurements.kind === 'read' ? measurements.rows : [];
+    const listed = rows.map((row) => `${row.runtime} on ${JSON.stringify(row.daemon.slice(0, 40))} (engine ${row.engineVersion.slice(0, 32)}, Compose floor ${row.composeFloor})`);
+    const listedRows = listed.length === 0 ? 'none'
+        : `${listed.slice(0, 4).join(', ')}${listed.length > 4 ? ` and ${listed.length - 4} more` : ''}`;
+    // Every refusal names what was detected and what this machine's record holds, so the operator can
+    // act on the message alone; the remedy is always a fresh measurement of this exact runtime. The
+    // reason also travels in an observation, whose text is byte-bounded, so the row list yields first.
+    const detail = (reason, action) => {
+        const full = `${reason} (${dockerInfo}; measured in ${measurements.path}: ${listedRows}). ${action}`;
+        return Buffer.byteLength(full) <= OBSERVATION_REASON_BYTE_LIMIT ? full
+            : `${reason} (${dockerInfo}; measured in ${measurements.path}: ${rows.length}). ${action}`;
+    };
+    const remeasure = (reason) => refuse(detail(reason, `Measure it on this machine with: ${cockpitCommand('runtime measure', { args: '--image <local-image>' })}`));
+    if (!identity) {
+        return refuse(detail('Docker runtime is not a recognised product, so no measurement can apply', 'Report these docker info values to the cockpit maintainers so the runtime can be identified'));
+    }
+    if (measurements.kind === 'unreadable') {
+        return remeasure(`This machine's runtime measurement record is unreadable: ${measurements.reason}; a new measurement replaces it`);
+    }
+    const row = rows.find((candidate) => candidate.runtime === identity && candidate.daemon === observation.name);
+    if (!row)
+        return remeasure(`Runtime ${identity} on daemon ${JSON.stringify(observation.name)} has not been measured on this machine`);
+    // A measurement certifies the engine it ran against; an upgraded or downgraded engine is a
+    // different runtime until it passes the probe too.
+    if (row.engineVersion !== observation.runtime.version) {
+        return remeasure(`Runtime ${identity} was measured with engine ${row.engineVersion} and now runs engine ${observation.runtime.version}`);
+    }
+    if (!VERSION.test(row.composeFloor) || !versionAtLeast(observation.composeVersion, row.composeFloor)) {
+        return remeasure(`Runtime ${identity} runs Docker Compose ${observation.composeVersion}, below the measured floor ${row.composeFloor}`);
+    }
+    const result = { kind: 'admitted', runtimeIdentity: identity,
+        measurement: `${identity} on ${JSON.stringify(observation.name)}, engine ${row.engineVersion}, Compose floor ${row.composeFloor}, measured ${row.measuredOn}` };
+    issuedRuntimeMeasurementAdmissions.set(result, observation);
+    return result;
+}
+export function observeRuntimeMeasurement(admission, stackId) {
+    const runtime = admission && typeof admission === 'object' ? issuedRuntimeMeasurementAdmissions.get(admission) : undefined;
+    if (!runtime || typeof stackId !== 'string' || !/^stack:[a-f0-9]{64}$/.test(stackId)) {
+        throw new RefusalError('runtime measurement admission is not authentic');
+    }
+    return issueObservation({
+        code: ENVIRONMENT_CODES.RUNTIME_UNMEASURED,
+        owner: OWNER,
+        stackId,
+        // An admitted runtime names the measurement that admitted it, so doctor says which runtime is measured.
+        source: admission.kind === 'admitted' ? admission.measurement : runtime.operatingSystem,
+        observed: admission.kind === 'admitted'
+            ? { state: 'available', value: true, observedAt: runtime.observedAt }
+            : { state: 'unavailable', reason: admission.reason, observedAt: runtime.observedAt },
+        expectation: { kind: 'equal', value: true },
+        applicability: { state: 'required', posture: 'mounted' },
+        freshness: { state: 'current' },
+        remedy: 'measure this runtime on this machine: a passing candidate and a rejected broken control for its exact engine and Compose floor',
+    });
+}
+export async function observeDockerRuntime(rawInput, execute) {
+    let input;
+    try {
+        const captured = snapshotJson(rawInput);
+        if (!captured || typeof captured !== 'object' || Array.isArray(captured)
+            || !exactOwnKeys(captured, ['executable', 'cwd', 'env', 'timeoutMs'])) {
+            return runtimeVersionUnavailable('Docker runtime version input is malformed');
+        }
+        const candidate = captured;
+        const executable = resolvedDockerExecutable(candidate.executable);
+        if (!executable || typeof candidate.cwd !== 'string' || !isAbsolute(candidate.cwd)
+            || normalize(candidate.cwd) !== candidate.cwd || candidate.cwd.includes('\0')
+            || !safeMachineFloorEnvironment(candidate.env)
+            || !Number.isSafeInteger(candidate.timeoutMs) || candidate.timeoutMs < 1 || candidate.timeoutMs > 30_000
+            || typeof execute !== 'function') {
+            return runtimeVersionUnavailable('Docker runtime version input needs a resolved executable, local working directory, and bounded environment');
+        }
+        input = { ...candidate, executable, env: { ...candidate.env } };
+    }
+    catch (error) {
+        return runtimeVersionUnavailable(`Docker runtime version input is unreadable: ${errorCause(error)}`);
+    }
+    const batchId = randomBytes(16).toString('hex');
+    const step = (id, args, stdoutLimitBytes = 128) => ({
+        id,
+        argv: [input.executable.canonicalPath, ...args],
+        argv0: input.executable.invocationPath,
+        cwd: input.cwd,
+        env: input.env,
+        timeoutMs: input.timeoutMs,
+        stdoutLimitBytes,
+        stderrLimitBytes: 512,
+        paths: [],
+        ports: [],
+        labels: { purpose: id, batchId },
+        expected: [],
+        consumedFiles: [{
+                path: input.executable.canonicalPath, sha256: input.executable.sha256,
+                maxBytes: 536_870_912, argvIndexes: [0], executable: true,
+                executionMode: input.executable.executionMode,
+            }],
+        filesystemChecks: [],
+        compensation: [],
+    });
+    const versionStep = step('runtime:docker-server-version', ['version', '--format', '{{.Server.Version}}']);
+    const composeStep = step('runtime:docker-compose-version', ['compose', 'version', '--short']);
+    // One reading supplies every identity field, so they describe the same daemon. JSON-encoding each
+    // field keeps a hostname or product label containing separators from shifting the others.
+    const identityStep = step('runtime:docker-operating-system', ['info', '--format', DOCKER_IDENTITY_FORMAT], 512);
+    // Set only by the probe that threw; every later step returns as soon as a probe fails.
+    let probeCause = '';
+    const readText = async (probe, limit = 128) => {
+        let raw;
+        try {
+            raw = await execute(probe);
+        }
+        catch (error) {
+            probeCause = `: ${errorCause(error)}`;
+            return undefined;
+        }
+        const outcome = authenticatedExecutionOutcome(raw, probe);
+        if (!outcome || outcome.kind !== 'complete' || outcome.stderr.byteLength !== 0)
+            return undefined;
+        try {
+            const value = new TextDecoder('utf-8', { fatal: true }).decode(outcome.stdout).trim();
+            return value.length > 0 && value.length <= limit && !value.includes('\0')
+                ? { value, observedAt: outcome.receipt.finishedAt } : undefined;
+        }
+        catch {
+            // Undecodable output yields no reading; the caller reports the probe as unauthenticated output.
+            return undefined;
+        }
+    };
+    const server = await readText(versionStep);
+    if (!server)
+        return runtimeVersionUnavailable('Docker server version probe failed or returned unauthenticated output' + probeCause);
+    if (!OBSERVED_VERSION.test(server.value))
+        return runtimeVersionUnparseable('Docker Engine', 'docker version --format {{.Server.Version}}', server.value);
+    const compose = await readText(composeStep);
+    if (!compose)
+        return runtimeVersionUnavailable('Docker Compose version probe failed or returned unauthenticated output' + probeCause);
+    if (!OBSERVED_VERSION.test(compose.value))
+        return runtimeVersionUnparseable('Docker Compose', 'docker compose version --short', compose.value);
+    const identityText = await readText(identityStep, 512);
+    const fields = identityText === undefined ? undefined : dockerIdentityFields(identityText.value);
+    if (!identityText || !fields)
+        return runtimeVersionUnavailable('Docker identity probe (docker info OperatingSystem, Name, OSType) failed or returned unauthenticated output' + probeCause);
+    const [operatingSystem, name, osType] = fields;
+    const hostPlatform = platform();
+    const result = {
+        kind: 'complete',
+        runtime: { name: 'docker', version: server.value, executableSha256: input.executable.sha256 },
+        runtimeIdentity: runtimeIdentity({ operatingSystem, name, osType, hostPlatform }),
+        operatingSystem,
+        name,
+        osType,
+        hostPlatform,
+        composeVersion: compose.value,
+        observedAt: [server.observedAt, compose.observedAt, identityText.observedAt].sort().at(-1),
+    };
+    issuedDockerRuntimeObservations.add(result);
+    return result;
+}
+function machineFloorPlanInput(value) {
+    try {
+        if (value !== null && typeof value === 'object' && !Array.isArray(value)
+            && exactOwnKeys(value, ['runtimePlan', 'diskExecutable', 'timeoutMs', 'authority'])) {
+            const runtimeDescriptor = Object.getOwnPropertyDescriptor(value, 'runtimePlan');
+            if (!runtimeDescriptor || !('value' in runtimeDescriptor))
+                return undefined;
+            const runtime = issuedRuntimePlans.get(runtimeDescriptor.value);
+            const snapshot = snapshotJson({
+                diskExecutable: value.diskExecutable,
+                timeoutMs: value.timeoutMs,
+            });
+            const authorityDescriptor = Object.getOwnPropertyDescriptor(value, 'authority');
+            const authority = authorityDescriptor && 'value' in authorityDescriptor
+                ? issuedMachineFloorAuthorities.get(authorityDescriptor.value) : undefined;
+            if (!runtime || !snapshot || typeof snapshot !== 'object' || Array.isArray(snapshot))
+                return undefined;
+            const candidate = snapshot;
+            const diskExecutable = resolvedExecutable(candidate.diskExecutable);
+            const env = machineFloorEnvironment(runtime.env);
+            if (!diskExecutable || !safeMachineFloorEnvironment(env)
+                || !authority || authority.stackId !== runtime.stackId || authority.configSha256 !== runtime.configSha256
+                || !Number.isSafeInteger(candidate.timeoutMs) || candidate.timeoutMs < 1 || candidate.timeoutMs > 30_000)
+                return undefined;
+            return {
+                runtimeExecutable: runtime.runtimeExecutable, diskExecutable, cwd: runtime.cwd,
+                env, timeoutMs: candidate.timeoutMs, stackId: runtime.stackId,
+                floor: authority.floor,
+            };
+        }
+        const snapshot = snapshotJson(value);
+        if (snapshot === undefined || snapshot === null || typeof snapshot !== 'object' || Array.isArray(snapshot)
+            || !([['runtimeExecutable', 'diskExecutable', 'cwd', 'env', 'timeoutMs'],
+                ['runtimeExecutable', 'diskExecutable', 'cwd', 'env', 'timeoutMs', 'authority']]
+                .some((keys) => exactOwnKeys(value, keys))))
+            return undefined;
+        const candidate = snapshot;
+        const runtimeExecutable = resolvedDockerExecutable(candidate.runtimeExecutable);
+        const diskExecutable = resolvedExecutable(candidate.diskExecutable);
+        if (runtimeExecutable === undefined || diskExecutable === undefined || typeof candidate.cwd !== 'string'
+            || !isAbsolute(candidate.cwd) || normalize(candidate.cwd) !== candidate.cwd || candidate.cwd.includes('\0')
+            || !safeMachineFloorEnvironment(candidate.env)
+            || !Number.isInteger(candidate.timeoutMs) || candidate.timeoutMs <= 0 || candidate.timeoutMs > 30_000)
+            return undefined;
+        const authorityDescriptor = Object.getOwnPropertyDescriptor(value, 'authority');
+        const authority = authorityDescriptor && 'value' in authorityDescriptor
+            ? issuedMachineFloorAuthorities.get(authorityDescriptor.value) : undefined;
+        if (authorityDescriptor && (!authority || candidate.cwd !== authority.checkoutPath))
+            return undefined;
+        return {
+            runtimeExecutable, diskExecutable, cwd: candidate.cwd,
+            env: { ...candidate.env }, timeoutMs: candidate.timeoutMs,
+            ...(authority ? { stackId: authority.stackId, floor: authority.floor } : {}),
+        };
+    }
+    catch {
+        // A throwing accessor or proxy trap makes the input malformed, which the caller refuses.
+        return undefined;
+    }
+}
+function machineFloorRefusal(code, message, target) {
+    return refusal(code, message, target);
+}
+/** Measures the container runtime's memory and CPU and the checkout's free disk. */
+export async function measureMachineFloor(rawInput, execute) {
+    const planned = machineFloorPlan(rawInput);
+    if (planned.kind !== 'preview')
+        return planned;
+    const [resources, disk] = planned.plan.steps;
+    const evidence = machineFloorEvidence(planned.contract, await execute(resources), await execute(disk));
+    return evidence ? { kind: 'complete', evidence } : { kind: 'unavailable' };
+}
+function machineFloorPlan(rawInput) {
+    const input = machineFloorPlanInput(rawInput);
+    if (input === undefined) {
+        return machineFloorRefusal(ENVIRONMENT_CODES.RUNTIME_UNMEASURED, 'machine-floor collectors require canonical digest-bound executables and a bounded timeout', 'machine-floor');
+    }
+    const { runtimeExecutable, diskExecutable } = input;
+    const makeStep = (id, argv, executable) => ({
+        id, argv: [...argv], argv0: executable.invocationPath, cwd: input.cwd,
+        env: { ...input.env }, timeoutMs: input.timeoutMs, stdoutLimitBytes: 4096, stderrLimitBytes: 4096,
+        paths: [], ports: [], labels: { collector: id }, expected: [],
+        consumedFiles: [{ path: executable.canonicalPath, sha256: executable.sha256, maxBytes: 536_870_912, argvIndexes: [0], executable: true, executionMode: executable.executionMode }],
+        filesystemChecks: [],
+        compensation: [],
+    });
+    const steps = [
+        makeStep('runtime:measure:resources', [runtimeExecutable.canonicalPath, 'info', '--format', '{{json .MemTotal}}|{{json .NCPU}}'], runtimeExecutable),
+        makeStep('runtime:measure:free-disk', [diskExecutable.canonicalPath, '--input-type=module', '-e', DISK_CAPACITY_COLLECTOR, input.cwd], diskExecutable),
+    ];
+    const plan = snapshotExecutionPlan({ steps });
+    if (plan === undefined)
+        return machineFloorRefusal(ENVIRONMENT_CODES.RUNTIME_UNMEASURED, 'machine-floor collectors did not produce a valid execution plan', input.cwd);
+    return { kind: 'preview', plan, contract: {
+            ...(input.stackId ? { stackId: input.stackId } : {}),
+            ...(input.floor ? { floor: input.floor } : {}),
+        } };
+}
+function machineFloorEvidence(contract, resources, disk) {
+    if (resources.kind !== 'complete' || disk.kind !== 'complete')
+        return undefined;
+    let resourceText;
+    let diskText;
+    try {
+        resourceText = new TextDecoder('utf-8', { fatal: true }).decode(resources.stdout).trim();
+        diskText = new TextDecoder('utf-8', { fatal: true }).decode(disk.stdout);
+    }
+    catch {
+        // Undecodable output yields no measurement, which the caller reports as unavailable.
+        return undefined;
+    }
+    const resourceMatch = resourceText.match(/^(\d+)\|(\d+(?:\.\d{1,3})?)$/);
+    if (!resourceMatch || !/^(?:0|[1-9]\d{0,15})\n$/.test(diskText) || disk.stderr.byteLength !== 0)
+        return undefined;
+    const memoryBytes = Number(resourceMatch[1]);
+    const cpuMillis = Number(resourceMatch[2]) * 1_000;
+    const freeDiskBytes = Number(diskText);
+    if (![memoryBytes, cpuMillis, freeDiskBytes].every((value) => Number.isSafeInteger(value) && value >= 0))
+        return undefined;
+    const evidence = {
+        memoryBytes, cpuMillis, freeDiskBytes,
+        observedAt: resources.receipt.finishedAt > disk.receipt.finishedAt ? resources.receipt.finishedAt : disk.receipt.finishedAt,
+        ...(contract.stackId ? { stackId: contract.stackId } : {}),
+        ...(contract.floor ? { floor: contract.floor } : {}),
+    };
+    issuedMachineFloorEvidence.add(evidence);
+    return evidence;
+}
+function localComposePath(cwd, source) {
+    if (source.reference.length === 0
+        || isAbsolute(source.reference)
+        || REMOTE_REFERENCE.test(source.reference)
+        || source.reference.includes('\\')
+        || source.reference.includes('\0'))
+        return undefined;
+    const target = resolve(cwd, source.reference);
+    const fromCwd = relative(cwd, source.canonicalPath);
+    if (target !== source.canonicalPath || fromCwd === '..' || fromCwd.startsWith(`..${sep}`) || isAbsolute(fromCwd))
+        return undefined;
+    return source.canonicalPath;
+}
+function composeArgv(command, files, projectDirectory, projectName, operation, activeProfiles) {
+    const fileArgs = files.flatMap((file) => ['--file', file]);
+    const profileArgs = activeProfiles.flatMap((profile) => ['--profile', profile]);
+    const operationArgs = operation === 'validate'
+        ? ['config', '--quiet']
+        : operation === 'up'
+            ? ['up', '--detach', '--wait']
+            : ['down', '--remove-orphans'];
+    return [...command, '--project-directory', projectDirectory, ...fileArgs, '--project-name', projectName, ...profileArgs, ...operationArgs];
+}
+function composeStep(input, files, projectDirectory, operation, compensation) {
+    const step = {
+        id: `runtime:docker-compose:${operation}:${input.projectName}`,
+        argv: [...composeArgv([input.executable.canonicalPath, 'compose'], files, projectDirectory, input.projectName, operation, input.activeProfiles ?? [])],
+        argv0: input.executable.invocationPath,
+        cwd: input.cwd,
+        env: { ...input.env },
+        timeoutMs: input.timeoutMs,
+        stdoutLimitBytes: OUTPUT_LIMIT_BYTES,
+        stderrLimitBytes: OUTPUT_LIMIT_BYTES,
+        paths: [...files],
+        ports: [...input.ports],
+        labels: { ...input.labels, operation, runtime: input.runtime.name, composeVersion: input.composeVersion },
+        expected: [],
+        consumedFiles: [
+            { path: input.executable.canonicalPath, sha256: input.executable.sha256, maxBytes: 536_870_912, argvIndexes: [0], executable: true, executionMode: input.executable.executionMode },
+            ...input.composeFiles.map(({ canonicalPath: path, sha256 }, index) => ({ path, sha256, maxBytes: 1_048_576, argvIndexes: [5 + index * 2], executable: false })),
+        ],
+        filesystemChecks: [],
+        compensation: [...compensation],
+    };
+    return step;
+}
+function exactInputValues(input) {
+    return [
+        input.executable.canonicalPath,
+        input.executable.invocationPath,
+        input.cwd,
+        input.projectName,
+        ...Object.keys(input.env),
+        ...Object.values(input.env),
+        ...Object.keys(input.labels),
+        ...Object.values(input.labels),
+        ...(input.activeProfiles ?? []),
+    ];
+}
+function hasUnresolvedInput(input) {
+    return classifyResolvedRuntimeLiterals(exactInputValues(input)) === 'unresolved';
+}
+function localBuildContext(value) {
+    return typeof value === 'string' && value.length > 0 && !value.includes('\0')
+        && !/^[a-z][a-z0-9+.-]*:/i.test(value) && !/^[^/\s]+@[^:]+:/i.test(value);
+}
+function composeBuildContextsSafe(source) {
+    try {
+        if (Buffer.byteLength(source) > 1_048_576)
+            return false;
+        const document = parseDocument(source, { merge: true });
+        if (document.errors.length > 0 || document.warnings.length > 0)
+            return false;
+        const root = document.toJS({ maxAliasCount: 100 });
+        if (root === null || typeof root !== 'object' || Array.isArray(root))
+            return false;
+        const rootRecord = root;
+        if (rootRecord.include !== undefined)
+            return false;
+        const services = rootRecord.services;
+        if (services === undefined)
+            return true;
+        if (services === null || typeof services !== 'object' || Array.isArray(services))
+            return false;
+        for (const service of Object.values(services)) {
+            if (service === null || typeof service !== 'object' || Array.isArray(service))
+                return false;
+            const serviceRecord = service;
+            if (serviceRecord.extends !== undefined)
+                return false;
+            const build = serviceRecord.build;
+            if (build === undefined)
+                continue;
+            if (typeof build === 'string') {
+                if (!localBuildContext(build))
+                    return false;
+                continue;
+            }
+            if (build === null || typeof build !== 'object' || Array.isArray(build))
+                return false;
+            const buildRecord = build;
+            if (buildRecord.context !== undefined && !localBuildContext(buildRecord.context))
+                return false;
+            const additional = buildRecord.additional_contexts;
+            if (additional === undefined)
+                continue;
+            if (Array.isArray(additional)) {
+                if (additional.some((entry) => typeof entry !== 'string' || !entry.includes('=') || !localBuildContext(entry.slice(entry.indexOf('=') + 1))))
+                    return false;
+            }
+            else if (additional !== null && typeof additional === 'object') {
+                if (Object.values(additional).some((entry) => !localBuildContext(entry)))
+                    return false;
+            }
+            else
+                return false;
+        }
+        return true;
+    }
+    catch {
+        // Unparsable Compose source is not a local-build declaration; the caller refuses it.
+        return false;
+    }
+}
+export function createRuntimeAdapter(rawInput, authority) {
+    let input = runtimeAdapterInput(snapshotJson(rawInput));
+    if (input === undefined)
+        return refusal(ENVIRONMENT_CODES.RUNTIME_UNMEASURED, 'runtime input must be bounded readable JSON data', 'runtime-input');
+    const capturedAuthority = authority === undefined ? undefined
+        : captureOwnValues(authority, ['ownComposeFiles', 'cockpitId', 'stackId'])
+            ?? captureOwnValues(authority, ['ownComposeFiles', 'cockpitId', 'stackId', 'portLeaseProjection'])
+            ?? captureOwnValues(authority, ['ownComposeFiles', 'cockpitId', 'stackId', 'siblingDirectories'])
+            ?? captureOwnValues(authority, ['ownComposeFiles', 'cockpitId', 'stackId', 'portLeaseProjection', 'siblingDirectories']);
+    const ownComposeFiles = capturedAuthority?.ownComposeFiles === true;
+    const suppliedPortProjection = capturedAuthority?.portLeaseProjection;
+    const portProjection = suppliedPortProjection === undefined ? undefined : inspectPortLeaseProjection(suppliedPortProjection);
+    if ((authority !== undefined && (!capturedAuthority || !ownComposeFiles))
+        || (suppliedPortProjection !== undefined && portProjection === undefined)) {
+        return refusal(ENVIRONMENT_CODES.RUNTIME_UNMEASURED, 'runtime artifact authority is malformed', 'runtime-input');
+    }
+    let interpolatedNames = [];
+    if (portProjection !== undefined) {
+        const originalEnv = input.env;
+        const entries = Object.entries(portProjection.lease.ports).sort(([left], [right]) => left.localeCompare(right));
+        const projectedPorts = entries.map(([, port]) => port).sort((left, right) => left - right);
+        const requestedPorts = [...input.ports].sort((left, right) => left - right);
+        if (input.stackId !== undefined && input.stackId !== portProjection.lease.stackId
+            || entries.length === 0 || entries.some(([name]) => !/^[A-Z][A-Z0-9_]*$/.test(name)
+            || HOST_PROCESS_CONTROL_ENV.test(name) || Object.hasOwn(originalEnv, name))
+            || JSON.stringify(projectedPorts) !== JSON.stringify(requestedPorts)) {
+            return refusal(ENVIRONMENT_CODES.RUNTIME_UNMEASURED, 'runtime port authority does not match the stack', input.projectName);
+        }
+        interpolatedNames = entries.map(([name]) => name);
+        input = {
+            ...input,
+            env: { ...originalEnv, ...Object.fromEntries(entries.map(([name, port]) => [name, String(port)])) },
+        };
+    }
+    // Sibling directories reach Compose the way the lease does: as named variables every derived
+    // step keeps, so `${API_DIR}` in a cockpit's own file resolves instead of falling back.
+    const suppliedSiblings = snapshotJson(capturedAuthority?.siblingDirectories);
+    if (suppliedSiblings !== undefined) {
+        const originalEnv = input.env;
+        const entries = suppliedSiblings !== null && typeof suppliedSiblings === 'object' && !Array.isArray(suppliedSiblings)
+            ? Object.entries(suppliedSiblings).sort(([left], [right]) => left.localeCompare(right)) : undefined;
+        if (entries === undefined || entries.some(([name, path]) => !/^[A-Z][A-Z0-9_]*$/.test(name)
+            || HOST_PROCESS_CONTROL_ENV.test(name) || Object.hasOwn(originalEnv, name)
+            || typeof path !== 'string' || !isAbsolute(path) || normalize(path) !== path || path.includes('\0'))) {
+            return refusal(ENVIRONMENT_CODES.RUNTIME_UNMEASURED, 'runtime sibling directory authority is malformed', input.projectName);
+        }
+        interpolatedNames = [...interpolatedNames, ...entries.map(([name]) => name)];
+        input = { ...input, env: { ...originalEnv, ...Object.fromEntries(entries) } };
+    }
+    if (ownComposeFiles) {
+        const runtimeStackId = capturedAuthority?.stackId;
+        const runtimeCockpitId = capturedAuthority?.cockpitId;
+        if (typeof runtimeStackId !== 'string' || !/^stack:[a-f0-9]{64}$/.test(runtimeStackId)
+            || typeof runtimeCockpitId !== 'string' || !/^cockpit:[a-z0-9][a-z0-9-]*:[a-f0-9]{64}$/.test(runtimeCockpitId)) {
+            return refusal(ENVIRONMENT_CODES.RUNTIME_UNMEASURED, 'runtime identity labels are unavailable', input.projectName);
+        }
+        interpolatedNames = [...interpolatedNames, 'COCKPIT_OWNER_ID', 'COCKPIT_STACK_ID'];
+        input = { ...input, env: { ...input.env,
+                COCKPIT_OWNER_ID: runtimeCockpitId, COCKPIT_STACK_ID: runtimeStackId } };
+    }
+    if (hasUnresolvedInput(input)) {
+        return refusal(ENVIRONMENT_CODES.RUNTIME_UNMEASURED, 'runtime plan contains an unresolved placeholder', 'runtime-input');
+    }
+    if (classifyResolvedRuntimeLiterals(exactInputValues(input)) === 'unsafe'
+        || Object.keys(input.env).some((name) => name.startsWith('COMPOSE_'))) {
+        return refusal(ENVIRONMENT_CODES.RUNTIME_UNMEASURED, 'runtime plan contains an unsafe literal or a compose environment override', 'runtime-input');
+    }
+    input = { ...input, env: composeProcessEnvironment(input.env) };
+    if (!isAbsolute(input.cwd)) {
+        return refusal(ENVIRONMENT_CODES.RUNTIME_UNMEASURED, 'runtime working directory must be absolute', input.cwd);
+    }
+    if (input.runtime.name !== 'docker' || !RUNTIME_OPERATIONS.includes(input.operation)) {
+        return refusal(ENVIRONMENT_CODES.RUNTIME_UNMEASURED, 'runtime and operation must be explicitly supported', `${input.runtime.name}:${input.operation}`);
+    }
+    if (!isResolvedDockerExecutable(input.executable)
+        || input.executable.sha256 !== input.runtime.executableSha256
+        || !OBSERVED_VERSION.test(input.runtime.version)
+        || !OBSERVED_VERSION.test(input.composeVersion)
+        || !PROJECT_NAME.test(input.projectName)) {
+        return refusal(ENVIRONMENT_CODES.RUNTIME_UNMEASURED, 'runtime command or project name is invalid', input.projectName);
+    }
+    if (!Number.isInteger(input.timeoutMs) || input.timeoutMs <= 0 || input.timeoutMs > MAX_TIMEOUT_MS) {
+        return refusal(ENVIRONMENT_CODES.RUNTIME_UNMEASURED, 'runtime timeout must be bounded to at most five minutes', String(input.timeoutMs));
+    }
+    if (input.ports.some((port) => !Number.isInteger(port) || port < 1 || port > 65_535)
+        || new Set(input.ports).size !== input.ports.length) {
+        return refusal(ENVIRONMENT_CODES.RUNTIME_UNMEASURED, 'runtime ports must be unique resolved host ports', input.projectName);
+    }
+    if (input.composeFiles.length === 0) {
+        return refusal(ENVIRONMENT_CODES.RUNTIME_UNMEASURED, 'runtime plan needs at least one local compose file', input.cwd);
+    }
+    const unresolvedCompose = input.composeFiles.find((source) => UNRESOLVED_TOKEN.test(source.reference));
+    if (unresolvedCompose !== undefined) {
+        return refusal(ENVIRONMENT_CODES.RUNTIME_UNMEASURED, 'compose reference contains an unresolved placeholder', unresolvedCompose.reference);
+    }
+    const files = [];
+    for (const source of input.composeFiles) {
+        // Only the cockpit's own Compose files, declared as such by readiness, interpolate.
+        if ((UNRESOLVED_TOKEN.test(source.source) && !(ownComposeFiles && composeTokensResolved(source.source, interpolatedNames)))
+            || source.source.includes('\0')) {
+            return refusal(ENVIRONMENT_CODES.RUNTIME_UNMEASURED, 'compose artifact contains unresolved or unsafe data', source.reference);
+        }
+        if (createHash('sha256').update(source.source).digest('hex') !== source.sha256) {
+            return refusal(ENVIRONMENT_CODES.RUNTIME_UNMEASURED, 'compose artifact digest does not match its source', source.reference);
+        }
+        if (!composeBuildContextsSafe(source.source)) {
+            return refusal(ENVIRONMENT_CODES.RUNTIME_COMPOSE_REMOTE, 'compose build contexts must be local, parseable, and structurally supported', source.reference);
+        }
+        const local = localComposePath(input.cwd, source);
+        if (local === undefined) {
+            return refusal(ENVIRONMENT_CODES.RUNTIME_COMPOSE_REMOTE, 'compose references must be confined local files; remote and escaped references are refused', source.reference);
+        }
+        files.push(local);
+    }
+    // A cockpit's own files resolve their relative paths as Compose does for the first file it is
+    // given; without that authority the plan runs from the given directory.
+    const projectDirectory = ownComposeFiles ? composeProjectDirectory(input.cwd, files) : input.cwd;
+    const compensation = input.operation === 'up'
+        ? [composeStep(input, files, projectDirectory, 'down', [])]
+        : [];
+    const step = composeStep(input, files, projectDirectory, input.operation, compensation);
+    const plan = snapshotExecutionPlan({ steps: [step] });
+    if (plan === undefined)
+        return refusal(ENVIRONMENT_CODES.RUNTIME_UNMEASURED, 'runtime input did not produce a valid execution plan', input.projectName);
+    if (input.stackId && input.coldStartLimitMillis && input.expectedMountSources) {
+        issuedRuntimePlans.set(plan, Object.freeze({
+            operation: input.operation,
+            stackId: input.stackId,
+            coldStartLimitMillis: input.coldStartLimitMillis,
+            expectedMountSources: Object.freeze([...input.expectedMountSources]),
+            runtimeExecutable: Object.freeze({ ...input.executable }),
+            cwd: input.cwd,
+            env: Object.freeze({ ...input.env }),
+            runtimeVersion: input.runtime.version,
+            composeVersion: input.composeVersion,
+            projectName: input.projectName,
+            activeProfiles: Object.freeze([...(input.activeProfiles ?? [])]),
+            configSha256: input.labels.configSha256 ?? '',
+            interpolatedNames,
+            ...(portProjection === undefined ? {} : { portLeaseProjection: portProjection }),
+        }));
+    }
+    return {
+        kind: 'preview',
+        status: 0,
+        diagnostics: [],
+        result: { runtime: input.runtime.name, operation: input.operation, projectName: input.projectName },
+        plan,
+    };
+}
+const issuedTopologyEvidence = new WeakMap();
+const MAX_TOPOLOGY_BYTES = 1_048_576;
+const MAX_TOPOLOGY_SERVICES = 4_096;
+const MAX_TOPOLOGY_EDGES = 16_384;
+// One `up` starts every service inside a single observation window: the declared cold start plus
+// headroom for stop graces and the ordinary probes around each start.
+export const OBSERVATION_WINDOW_HEADROOM_MS = 300_000;
+const MAX_OBSERVATION_WINDOW_MS = MAX_COLD_START_SECONDS * 1_000 + OBSERVATION_WINDOW_HEADROOM_MS;
+// `compose stop` waits up to each service's stop grace (Compose default 10s) before it kills a
+// process that ignores SIGTERM, which a shell or Node.js running as PID 1 does. It stops dependents
+// before their dependencies, one dependency level at a time, so the grace is paid once per level. A
+// stop held to the ordinary 10s command budget timed out on such a service and left the drain
+// attempt for repair; one grace for a two-level stack timed out the same way.
+const COMPOSE_STOP_GRACE_MS = 10_000;
+function dependencyLevels(services) {
+    const levels = new Map();
+    const level = (id) => {
+        const known = levels.get(id);
+        if (known !== undefined)
+            return known;
+        const value = 1 + Math.max(0, ...(services.get(id)?.dependsOn ?? []).map(level));
+        levels.set(id, value);
+        return value;
+    };
+    return Math.max(1, ...[...services.keys()].map(level));
+}
+const SERVICE_ID = /^[a-z0-9][a-z0-9_.-]*$/;
+const CONTAINER_ID = /^[a-f0-9]{64}$/;
+const SHORT_CONTAINER_ID = /^[a-f0-9]{12}$/;
+function unavailableReason(base, error) {
+    return error === undefined ? base : `${base}: ${errorCause(error)}`;
+}
+function unavailableTopology(reason = 'runtime topology is unavailable') {
+    return { kind: 'unavailable', reason };
+}
+function canonicalWindow(value) {
+    try {
+        const captured = captureOwnValues(value, ['startedAt', 'expiresAt']);
+        const startedAtValue = captured?.startedAt;
+        const expiresAtValue = captured?.expiresAt;
+        if (typeof startedAtValue !== 'string' || typeof expiresAtValue !== 'string'
+            || !isCanonicalTimestamp(startedAtValue) || !isCanonicalTimestamp(expiresAtValue))
+            return undefined;
+        const startedAt = Date.parse(startedAtValue);
+        const expiresAt = Date.parse(expiresAtValue);
+        if (!Number.isFinite(startedAt) || !Number.isFinite(expiresAt)
+            || Math.abs(expiresAt - startedAt) > MAX_OBSERVATION_WINDOW_MS)
+            return undefined;
+        return { startedAt: startedAtValue, expiresAt: expiresAtValue };
+    }
+    catch {
+        // A throwing accessor or proxy trap makes the window malformed, which the caller refuses.
+        return undefined;
+    }
+}
+function runtimeCommandEnvironment(env, interpolatedNames) {
+    const allowed = new Set([...DOCKER_CLIENT_ENVIRONMENT, ...interpolatedNames]);
+    return Object.fromEntries(Object.entries(env).filter(([name]) => allowed.has(name)));
+}
+function runtimeComposeEnvironment(env, interpolatedNames) {
+    return composeProcessEnvironment(runtimeCommandEnvironment(env, interpolatedNames));
+}
+function derivedComposeStep(base, id, operation, operationArgs, stdoutLimitBytes, issuanceId, timeoutLimitMs = MAX_OBSERVATION_WINDOW_MS, spawnNotAfter, interpolatedNames = []) {
+    const configIndex = base.argv.lastIndexOf('config');
+    const suffix = base.argv.slice(configIndex);
+    if (configIndex < 1 || !(suffix.length === 2 && suffix[1] === '--quiet')
+        && !(suffix.length === 4 && suffix[1] === '--format' && suffix[2] === 'json'
+            && suffix[3] === '--no-env-resolution'))
+        return undefined;
+    const env = runtimeComposeEnvironment(base.env, interpolatedNames);
+    const step = {
+        ...base,
+        id,
+        argv: [...base.argv.slice(0, configIndex), ...operationArgs],
+        env,
+        timeoutMs: Math.min(base.timeoutMs, MAX_OBSERVATION_WINDOW_MS, timeoutLimitMs),
+        ...(spawnNotAfter === undefined ? {} : { spawnNotAfter }),
+        stdoutLimitBytes,
+        stderrLimitBytes: OUTPUT_LIMIT_BYTES,
+        ports: [],
+        labels: { ...base.labels, operation, issuanceId },
+        compensation: [],
+    };
+    return snapshotExecutionPlan({ steps: [step] })?.steps[0];
+}
+/**
+ * Reads the stack's services through `compose config` from a validated runtime plan, and binds the
+ * topology to that plan, the observation window and the declared bind sources.
+ */
+export async function observeRuntimeTopology(input) {
+    const { runtimePlan, stackId, configSha256, batchId } = input;
+    const runtime = issuedRuntimePlans.get(runtimePlan);
+    const base = runtimePlan.steps[0];
+    const window = canonicalWindow(input.observationWindow);
+    if (!runtime || runtime.operation !== 'validate' || !base || !window
+        || stackId !== runtime.stackId || !SHA256.test(configSha256) || !SHA256.test(batchId)
+        || base.labels.stackId !== stackId || base.labels.configSha256 !== configSha256
+        || base.labels.batchId !== batchId || base.labels.composeVersion !== runtime.composeVersion
+        || base.cwd !== runtime.cwd || base.argv0 !== runtime.runtimeExecutable.invocationPath)
+        return unavailableTopology();
+    const issuanceId = randomBytes(32).toString('hex');
+    const step = derivedComposeStep(base, `runtime:docker-compose:topology:${runtime.projectName}`, 'config', ['config', '--format', 'json', '--no-env-resolution'], MAX_TOPOLOGY_BYTES, issuanceId, MAX_OBSERVATION_WINDOW_MS, undefined, runtime.interpolatedNames);
+    if (!step)
+        return unavailableTopology();
+    const contract = { runtimePlan, runtime, stackId, configSha256, batchId, observationWindow: window };
+    return admitRuntimeTopology(contract, step, await input.execute(step));
+}
+function healthcheckEnabled(value) {
+    if (value === undefined)
+        return false;
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const healthcheck = value;
+    if (Object.prototype.hasOwnProperty.call(healthcheck, 'disable') && typeof healthcheck.disable !== 'boolean')
+        return undefined;
+    if (Object.prototype.hasOwnProperty.call(healthcheck, 'test')) {
+        if (!Array.isArray(healthcheck.test) || healthcheck.test.length > MAX_TOPOLOGY_SERVICES
+            || healthcheck.test.some((part) => !(typeof part === 'string' && part.length <= OUTPUT_LIMIT_BYTES)
+                && typeof part !== 'boolean' && !(typeof part === 'number' && Number.isFinite(part))))
+            return undefined;
+    }
+    return healthcheck.disable !== true && !(Array.isArray(healthcheck.test) && healthcheck.test[0] === 'NONE');
+}
+function dependencyNames(value) {
+    if (value === undefined)
+        return [];
+    if (Array.isArray(value)) {
+        if (value.some((item) => typeof item !== 'string' || !SERVICE_ID.test(item)))
+            return undefined;
+        return [...new Set(value)].sort();
+    }
+    if (value === null || typeof value !== 'object')
+        return undefined;
+    const names = Object.keys(value);
+    if (names.some((name) => !SERVICE_ID.test(name)))
+        return undefined;
+    return [...new Set(names)].sort();
+}
+function profileNames(value) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) || value.length > MAX_TOPOLOGY_SERVICES
+        || value.some((name) => typeof name !== 'string' || !SERVICE_ID.test(name)))
+        return undefined;
+    return [...new Set(value)].sort();
+}
+function bindMountSources(value) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) || value.length > MAX_TOPOLOGY_EDGES)
+        return undefined;
+    const sources = [];
+    for (const item of value) {
+        if (item === null || typeof item !== 'object' || Array.isArray(item))
+            return undefined;
+        const volume = item;
+        if (volume.type !== 'bind')
+            continue;
+        if (typeof volume.source !== 'string' || !isAbsolute(volume.source)
+            || normalize(volume.source) !== volume.source || volume.source.includes('\0'))
+            return undefined;
+        sources.push(volume.source);
+    }
+    return [...new Set(sources)].sort();
+}
+function bindMounts(value) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) || value.length > MAX_TOPOLOGY_EDGES)
+        return undefined;
+    const mounts = [];
+    for (const item of value) {
+        if (item === null || typeof item !== 'object' || Array.isArray(item))
+            return undefined;
+        const volume = item;
+        if (volume.type !== 'bind')
+            continue;
+        if (typeof volume.source !== 'string' || !isAbsolute(volume.source)
+            || normalize(volume.source) !== volume.source || volume.source.includes('\0')
+            || typeof volume.target !== 'string' || !CONTAINER_PATH.test(volume.target))
+            return undefined;
+        mounts.push({ source: volume.source, target: volume.target });
+    }
+    const identities = mounts.map(({ source, target }) => `${source}\0${target}`);
+    if (new Set(identities).size !== identities.length)
+        return undefined;
+    return [...mounts].sort((left, right) => `${left.source}\0${left.target}`.localeCompare(`${right.source}\0${right.target}`));
+}
+const PUBLISHED_HOSTS = new Set(['127.0.0.1', '::1', '0.0.0.0', '::']);
+function composePublishedPorts(value) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) || value.length > MAX_TOPOLOGY_EDGES)
+        return undefined;
+    const ports = [];
+    for (const item of value) {
+        if (item === null || typeof item !== 'object' || Array.isArray(item))
+            return undefined;
+        const row = item;
+        const target = row.target;
+        const rawPublished = row.published;
+        const published = typeof rawPublished === 'string' && /^[1-9]\d{0,4}$/.test(rawPublished)
+            ? Number(rawPublished) : rawPublished;
+        const hostIp = row.host_ip ?? '0.0.0.0';
+        const protocol = row.protocol ?? 'tcp';
+        if (!Number.isSafeInteger(target) || target < 1 || target > 65_535
+            || !Number.isSafeInteger(published) || published < 1 || published > 65_535
+            || typeof hostIp !== 'string' || !PUBLISHED_HOSTS.has(hostIp) || protocol !== 'tcp')
+            return undefined;
+        ports.push({
+            hostIp: hostIp,
+            target: target,
+            published: published,
+            protocol: 'tcp',
+        });
+    }
+    const identities = ports.map(({ hostIp, target, published, protocol }) => `${hostIp}\0${published}\0${target}\0${protocol}`);
+    if (new Set(identities).size !== identities.length)
+        return undefined;
+    return [...ports].sort((left, right) => `${left.hostIp}\0${left.published}\0${left.target}`.localeCompare(`${right.hostIp}\0${right.published}\0${right.target}`));
+}
+const RUNTIME_VOLUME = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
+const CONTAINER_PATH = /^\/(?!.*(?:^|\/)\.\.?(?:\/|$))(?!.*[\\\x00-\x1f\x7f])\S+$/;
+function runtimeVolumeNames(value) {
+    if (value === undefined)
+        return new Map();
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const entries = Object.entries(value);
+    if (entries.length > MAX_TOPOLOGY_EDGES)
+        return undefined;
+    const names = new Map();
+    for (const [source, candidate] of entries) {
+        if (!SERVICE_ID.test(source) || candidate === null || typeof candidate !== 'object' || Array.isArray(candidate))
+            return undefined;
+        const name = candidate.name;
+        if (typeof name !== 'string' || !RUNTIME_VOLUME.test(name))
+            return undefined;
+        names.set(source, name);
+    }
+    return names;
+}
+function namedVolumeMounts(value, volumeNames) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) || value.length > MAX_TOPOLOGY_EDGES)
+        return undefined;
+    const mounts = [];
+    for (const item of value) {
+        if (item === null || typeof item !== 'object' || Array.isArray(item))
+            return undefined;
+        const volume = item;
+        if (volume.type !== 'volume')
+            continue;
+        const source = volume.source;
+        const target = volume.target;
+        const name = typeof source === 'string' ? volumeNames.get(source) : undefined;
+        if (typeof source !== 'string' || !SERVICE_ID.test(source) || !name
+            || typeof target !== 'string' || !CONTAINER_PATH.test(target))
+            return undefined;
+        mounts.push({ source, name, target });
+    }
+    const identities = mounts.map(({ source, target }) => `${source}\0${target}`);
+    if (new Set(identities).size !== identities.length)
+        return undefined;
+    return [...mounts].sort((left, right) => `${left.source}\0${left.target}`.localeCompare(`${right.source}\0${right.target}`));
+}
+// Compose prints labels as a mapping, but as a `KEY=VALUE` list once an override merges labels into
+// a service that already has some; reading only the mapping refused every such merged service.
+function composeLabels(value) {
+    if (!Array.isArray(value))
+        return value;
+    const entries = [];
+    for (const item of value) {
+        if (typeof item !== 'string' || !item.includes('='))
+            return null;
+        entries.push([item.slice(0, item.indexOf('=')), item.slice(item.indexOf('=') + 1)]);
+    }
+    const labels = Object.fromEntries(entries);
+    return Object.keys(labels).length === entries.length ? labels : null;
+}
+function parseTopology(stdout, stackId, configSha256, activeProfiles) {
+    try {
+        const source = new TextDecoder('utf-8', { fatal: true }).decode(stdout);
+        const parsed = JSON.parse(source);
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return undefined;
+        const rawServices = parsed.services;
+        if (rawServices === null || typeof rawServices !== 'object' || Array.isArray(rawServices))
+            return undefined;
+        const volumeNames = runtimeVolumeNames(parsed.volumes);
+        if (!volumeNames)
+            return undefined;
+        const declaredNames = Object.keys(rawServices);
+        if (declaredNames.length === 0 || declaredNames.length > MAX_TOPOLOGY_SERVICES || declaredNames.some((name) => !SERVICE_ID.test(name)))
+            return undefined;
+        const profiles = new Map();
+        for (const name of declaredNames) {
+            const raw = rawServices[name];
+            if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
+                return undefined;
+            const selected = profileNames(raw.profiles);
+            if (!selected)
+                return undefined;
+            profiles.set(name, selected);
+        }
+        const active = new Set(activeProfiles);
+        const names = declaredNames.filter((name) => {
+            const serviceProfiles = profiles.get(name) ?? [];
+            return serviceProfiles.length === 0 || serviceProfiles.some((profile) => active.has(profile));
+        });
+        if (names.length === 0)
+            return undefined;
+        names.sort();
+        const known = new Set(names);
+        const byId = new Map();
+        const runtimeHealth = new Map();
+        let edgeCount = 0;
+        for (const id of names) {
+            const raw = rawServices[id];
+            if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
+                return undefined;
+            const service = raw;
+            const dependsOn = dependencyNames(service.depends_on);
+            const mounts = bindMountSources(service.volumes);
+            const exactBindMounts = bindMounts(service.volumes);
+            const namedMounts = namedVolumeMounts(service.volumes, volumeNames);
+            const publishedPorts = composePublishedPorts(service.ports);
+            const healthcheck = healthcheckEnabled(service.healthcheck);
+            const labels = composeLabels(service.labels);
+            if (!dependsOn || !mounts || !exactBindMounts || !namedMounts || !publishedPorts || healthcheck === undefined || dependsOn.includes(id) || dependsOn.some((name) => !known.has(name))
+                || labels === null || typeof labels !== 'object' || Array.isArray(labels)
+                || labels['dev.b0dea.cockpit.stack-id'] !== stackId
+                || labels['dev.b0dea.cockpit.config-sha256'] !== configSha256)
+                return undefined;
+            edgeCount += dependsOn.length + mounts.length + namedMounts.length + publishedPorts.length;
+            if (edgeCount > MAX_TOPOLOGY_EDGES)
+                return undefined;
+            byId.set(id, {
+                id,
+                dependsOn,
+                bindMountSources: mounts,
+                namedVolumeMounts: namedMounts,
+                healthcheck,
+            });
+            runtimeHealth.set(id, { bindMounts: exactBindMounts, publishedPorts });
+        }
+        const indegree = new Map(names.map((name) => [name, byId.get(name)?.dependsOn.length ?? 0]));
+        const dependents = new Map(names.map((name) => [name, []]));
+        for (const service of byId.values())
+            for (const dependency of service.dependsOn)
+                dependents.get(dependency)?.push(service.id);
+        for (const values of dependents.values())
+            values.sort();
+        const ready = names.filter((name) => indegree.get(name) === 0);
+        const order = [];
+        while (ready.length > 0) {
+            const next = ready.shift();
+            if (next === undefined)
+                return undefined;
+            order.push(next);
+            for (const dependent of dependents.get(next) ?? []) {
+                const remaining = (indegree.get(dependent) ?? 0) - 1;
+                indegree.set(dependent, remaining);
+                if (remaining === 0) {
+                    ready.push(dependent);
+                    ready.sort();
+                }
+            }
+        }
+        if (order.length !== names.length)
+            return undefined;
+        return { services: names.map((name) => byId.get(name)), order, byId, runtimeHealth };
+    }
+    catch {
+        // A malformed declaration shape yields no topology, which the caller reports as unavailable.
+        return undefined;
+    }
+}
+function mountSourcesMatch(binds, declared) {
+    const { missing, unexpected } = compareBindSources(binds, declared);
+    return missing.length === 0 && unexpected.length === 0;
+}
+function admitRuntimeTopology(contract, step, outcome) {
+    const unavailable = () => unavailableTopology();
+    if (outcome.kind !== 'complete' || outcome.stderr.byteLength !== 0 || !outcome.receipt)
+        return unavailable();
+    const { startedAt, finishedAt } = outcome.receipt;
+    const windowStart = Date.parse(contract.observationWindow.startedAt);
+    const windowEnd = Date.parse(contract.observationWindow.expiresAt);
+    const receiptStart = Date.parse(startedAt);
+    const receiptEnd = Date.parse(finishedAt);
+    const now = Date.now();
+    if (!isCanonicalTimestamp(startedAt) || !isCanonicalTimestamp(finishedAt)
+        || windowStart > receiptStart || receiptStart > receiptEnd || receiptEnd > now || receiptEnd > windowEnd
+        || now < windowStart || now > windowEnd)
+        return unavailable();
+    const projected = parseTopology(outcome.stdout, contract.stackId, contract.configSha256, contract.runtime.activeProfiles);
+    if (!projected)
+        return unavailable();
+    const mounts = compareBindSources(projected.services.flatMap(({ bindMountSources }) => bindMountSources), contract.runtime.expectedMountSources);
+    // The caller can name the sibling or host path behind each difference; a bare refusal here
+    // left `up` reporting only that readiness authority was unavailable.
+    if (mounts.missing.length > 0 || mounts.unexpected.length > 0)
+        return {
+            kind: 'unavailable',
+            reason: 'the bind mounts Compose resolves differ from the declared mount sources',
+            mounts,
+        };
+    const topology = {
+        stackId: contract.stackId,
+        configSha256: contract.configSha256,
+        batchId: contract.batchId,
+        runtimeVersion: contract.runtime.runtimeVersion,
+        composeVersion: contract.runtime.composeVersion,
+        executableSha256: contract.runtime.runtimeExecutable.sha256,
+        projectName: contract.runtime.projectName,
+        cwd: contract.runtime.cwd,
+        observationWindow: contract.observationWindow,
+        services: projected.services,
+    };
+    issuedTopologyEvidence.set(topology, {
+        ...contract,
+        step,
+        order: projected.order,
+        services: projected.byId,
+        runtimeHealth: projected.runtimeHealth,
+    });
+    const observations = [
+        issueObservation({
+            code: ENVIRONMENT_CODES.RUNTIME_UNAVAILABLE,
+            owner: OWNER,
+            stackId: contract.stackId,
+            source: step.argv0,
+            observed: { state: 'available', value: true, observedAt: finishedAt },
+            expectation: { kind: 'equal', value: true },
+            applicability: { state: 'required', posture: 'mounted' },
+            freshness: { state: 'current' },
+            remedy: 'restore the declared runtime executable and retry the bounded probe',
+        }),
+        issueObservation({
+            code: ENVIRONMENT_CODES.MOUNT_POSTURE_UNAVAILABLE,
+            owner: OWNER,
+            stackId: contract.stackId,
+            source: step.id,
+            observed: { state: 'available', value: true, observedAt: finishedAt },
+            expectation: { kind: 'equal', value: true },
+            applicability: { state: 'required', posture: 'mounted' },
+            freshness: { state: 'current' },
+            remedy: 'restore every declared bind source and refuse undeclared host binds',
+        }),
+    ];
+    return { kind: 'complete', step, topology, observations };
+}
+export function isRuntimeTopologyEvidence(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    const contract = issuedTopologyEvidence.get(value);
+    const now = Date.now();
+    return contract !== undefined && Date.parse(contract.observationWindow.startedAt) <= now
+        && now <= Date.parse(contract.observationWindow.expiresAt);
+}
+export function resolveRuntimeServiceOrder(topology) {
+    const contract = topology !== null && typeof topology === 'object' ? issuedTopologyEvidence.get(topology) : undefined;
+    const now = Date.now();
+    return contract && Date.parse(contract.observationWindow.startedAt) <= now
+        && now <= Date.parse(contract.observationWindow.expiresAt) ? [...contract.order] : [];
+}
+export function projectRuntimeExecutionEnvironment(topology, namespace) {
+    const contract = topology !== null && typeof topology === 'object' ? issuedTopologyEvidence.get(topology) : undefined;
+    if (namespace !== undefined && (!contract?.runtime.portLeaseProjection
+        || !inspectPortLeaseProjection(contract.runtime.portLeaseProjection, namespace)))
+        return undefined;
+    const now = Date.now();
+    return contract && Date.parse(contract.observationWindow.startedAt) <= now
+        && now <= Date.parse(contract.observationWindow.expiresAt)
+        ? runtimeCommandEnvironment(contract.runtime.env, contract.runtime.interpolatedNames)
+        : undefined;
+}
+function projectRuntimeExecutionStep(step, slot) {
+    const argv = step.argv.map((value, index) => slot?.index === index
+        ? { kind: 'runtime-container-id', service: slot.service }
+        : value);
+    if (argv.length === 0 || slot && (slot.index < 0 || slot.index >= argv.length))
+        return undefined;
+    const compensation = step.compensation.map((item) => projectRuntimeExecutionStep(item));
+    if (compensation.some((item) => item === undefined))
+        return undefined;
+    return {
+        argv: argv,
+        argv0: step.argv0,
+        cwd: step.cwd,
+        env: { ...step.env },
+        timeoutCeilingMs: step.timeoutMs,
+        stdoutLimitBytes: step.stdoutLimitBytes,
+        stderrLimitBytes: step.stderrLimitBytes,
+        paths: [...step.paths],
+        ports: [...step.ports],
+        expected: step.expected.map((item) => ({ ...item })),
+        consumedFiles: step.consumedFiles.map((item) => ({ ...item, argvIndexes: [...item.argvIndexes] })),
+        filesystemChecks: step.filesystemChecks.map((item) => ({ ...item })),
+        compensation: compensation,
+    };
+}
+// Observations, evidence and failures a service step produced, which failure logs, the lifecycle
+// planner and the health readers take back by identity.
+const issuedRuntimeServiceObservations = new WeakMap();
+const consumedRuntimeServiceFailureObservations = new WeakSet();
+const issuedRuntimeServiceEvidence = new WeakMap();
+const issuedRuntimeServiceFailures = new WeakMap();
+function runtimeServiceLookupSteps(topologyContract, service, issuanceId) {
+    const status = derivedComposeStep(topologyContract.step, `runtime:docker-compose:status:${service.id}`, 'ps', ['ps', '--format', 'json', '--all', service.id], OUTPUT_LIMIT_BYTES, issuanceId, MAX_OBSERVATION_WINDOW_MS, undefined, topologyContract.runtime.interpolatedNames);
+    const identity = derivedComposeStep(topologyContract.step, `runtime:docker-compose:identity:${service.id}`, 'ps', ['ps', '--quiet', '--all', service.id], 128, issuanceId, MAX_OBSERVATION_WINDOW_MS, undefined, topologyContract.runtime.interpolatedNames);
+    return status && identity ? { status, identity } : undefined;
+}
+function runtimeServiceInitialSteps(topologyContract, service, issuanceId) {
+    // `up --wait` returns only once the service runs and its healthcheck passes, after Compose has
+    // built or pulled its image, and the declared cold_start_seconds bounds exactly that. The
+    // ordinary command budget does not: a first `up` was killed and reported "did not become
+    // healthy" seconds before its container turned healthy. When the service's configuration
+    // changed since its container was created, `up` first stops that container and pays its stop
+    // grace; a start without that grace was killed mid-recreate, leaving the replacement container
+    // created but never started.
+    const start = derivedComposeStep({ ...topologyContract.step, timeoutMs: COMPOSE_STOP_GRACE_MS
+            + Math.max(topologyContract.step.timeoutMs, topologyContract.runtime.coldStartLimitMillis) }, `runtime:docker-compose:start:${service.id}`, 'up', ['--progress', 'quiet', 'up', '--detach', '--wait', '--no-deps', service.id], OUTPUT_LIMIT_BYTES, issuanceId, MAX_OBSERVATION_WINDOW_MS, undefined, topologyContract.runtime.interpolatedNames);
+    // A service that failed its start under a restart policy restarts forever until `down`. The
+    // failed `up` stops it and keeps the container, so its logs stay readable and the next `up`
+    // starts it again.
+    const stop = derivedComposeStep({ ...topologyContract.step, timeoutMs: COMPOSE_STOP_GRACE_MS + topologyContract.step.timeoutMs }, `runtime:docker-compose:stop:${service.id}`, 'stop', ['--progress', 'quiet', 'stop', service.id], OUTPUT_LIMIT_BYTES, issuanceId, MAX_OBSERVATION_WINDOW_MS, undefined, topologyContract.runtime.interpolatedNames);
+    const lookup = runtimeServiceLookupSteps(topologyContract, service, issuanceId);
+    return start && stop && lookup ? { start, stop, ...lookup } : undefined;
+}
+function runtimeServiceContract(topology, serviceId) {
+    const topologyContract = issuedTopologyEvidence.get(topology);
+    const service = topologyContract?.services.get(serviceId);
+    const now = Date.now();
+    return topologyContract && service && SERVICE_ID.test(serviceId)
+        && now >= Date.parse(topologyContract.observationWindow.startedAt)
+        && now <= Date.parse(topologyContract.observationWindow.expiresAt)
+        ? { topology, topologyContract, service } : undefined;
+}
+function classifyComposeStatus(stdout, projectName, service) {
+    if (stdout.byteLength === 0)
+        return { kind: 'empty' };
+    try {
+        const source = new TextDecoder('utf-8', { fatal: true }).decode(stdout);
+        const lines = source.split('\n');
+        if (lines.at(-1) === '')
+            lines.pop();
+        if (lines.length !== 1 || lines[0]?.length === 0)
+            return { kind: 'malformed' };
+        const parsed = JSON.parse(lines[0]);
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return { kind: 'malformed' };
+        const value = parsed;
+        if (typeof value.ID !== 'string' || !SHORT_CONTAINER_ID.test(value.ID)
+            || value.Project !== projectName || value.Service !== service)
+            return { kind: 'malformed' };
+        return { kind: 'valid', value: value.ID };
+    }
+    catch {
+        // Unparsable output is the malformed verdict.
+        return { kind: 'malformed' };
+    }
+}
+function parseComposeStatus(stdout, projectName, service) {
+    const result = classifyComposeStatus(stdout, projectName, service);
+    return result.kind === 'valid' ? result.value : undefined;
+}
+function classifyContainerIdentity(stdout, shortId) {
+    if (stdout.byteLength === 0)
+        return { kind: 'empty' };
+    try {
+        const source = new TextDecoder('utf-8', { fatal: true }).decode(stdout);
+        const lines = source.split('\n');
+        if (lines.at(-1) === '')
+            lines.pop();
+        if (lines.length !== 1 || !CONTAINER_ID.test(lines[0] ?? '') || !lines[0]?.startsWith(shortId))
+            return { kind: 'malformed' };
+        return { kind: 'valid', value: lines[0] };
+    }
+    catch {
+        // Undecodable output is the malformed verdict.
+        return { kind: 'malformed' };
+    }
+}
+function parseContainerIdentity(stdout, shortId) {
+    const result = classifyContainerIdentity(stdout, shortId);
+    return result.kind === 'valid' ? result.value : undefined;
+}
+function parseRuntimeServiceLookup(status, identity, projectName, service) {
+    if (status.byteLength === 0)
+        return identity.byteLength === 0 ? { kind: 'missing' } : undefined;
+    const shortId = parseComposeStatus(status, projectName, service);
+    const containerId = shortId ? parseContainerIdentity(identity, shortId) : undefined;
+    return shortId && containerId ? { kind: 'present', shortId, containerId } : undefined;
+}
+function receiptWithinWindow(outcome, window, now) {
+    const startedAt = outcome.receipt.startedAt;
+    const finishedAt = outcome.receipt.finishedAt;
+    const windowStart = Date.parse(window.startedAt);
+    const windowEnd = Date.parse(window.expiresAt);
+    const receiptStart = Date.parse(startedAt);
+    const receiptEnd = Date.parse(finishedAt);
+    return isCanonicalTimestamp(startedAt) && isCanonicalTimestamp(finishedAt)
+        && windowStart <= receiptStart && receiptStart <= receiptEnd && receiptEnd <= now
+        && receiptEnd <= windowEnd && windowStart <= now && now <= windowEnd;
+}
+// `.Id` is a key of the inspect JSON, not of Docker's typed result, so Docker runs this template on
+// the raw JSON. There a container without a healthcheck has no State.Health key, and a field access
+// on a missing key fails the whole inspect; `index` yields nothing instead.
+const CONTAINER_INSPECT_FORMAT = '{"ID":{{json .Id}},"State":{{json .State.Status}},"Health":{{with index .State "Health"}}{{json .Status}}{{else}}""{{end}},"Labels":{"dev.b0dea.cockpit.stack-id":{{json (index .Config.Labels "dev.b0dea.cockpit.stack-id")}},"dev.b0dea.cockpit.config-sha256":{{json (index .Config.Labels "dev.b0dea.cockpit.config-sha256")}},"com.docker.compose.project":{{json (index .Config.Labels "com.docker.compose.project")}},"com.docker.compose.service":{{json (index .Config.Labels "com.docker.compose.service")}}},"Mounts":{{json .Mounts}},"Ports":{{json .NetworkSettings.Ports}}}';
+function runtimeServiceInspectStep(topologyContract, service, containerId, issuanceId, timeoutMs) {
+    const executable = topologyContract.runtime.runtimeExecutable;
+    return snapshotExecutionPlan({ steps: [{
+                id: `runtime:docker-container:health:${service.id}`,
+                argv: [executable.canonicalPath, 'container', 'inspect', '--format', CONTAINER_INSPECT_FORMAT, containerId],
+                argv0: executable.invocationPath,
+                cwd: topologyContract.runtime.cwd,
+                env: runtimeCommandEnvironment(topologyContract.runtime.env, topologyContract.runtime.interpolatedNames),
+                timeoutMs,
+                stdoutLimitBytes: OUTPUT_LIMIT_BYTES,
+                stderrLimitBytes: OUTPUT_LIMIT_BYTES,
+                paths: [],
+                ports: [],
+                labels: {
+                    stackId: topologyContract.stackId,
+                    configSha256: topologyContract.configSha256,
+                    batchId: topologyContract.batchId,
+                    service: service.id,
+                    containerId,
+                    runtimeVersion: topologyContract.runtime.runtimeVersion,
+                    composeVersion: topologyContract.runtime.composeVersion,
+                    executableSha256: executable.sha256,
+                    projectName: topologyContract.runtime.projectName,
+                    issuanceId,
+                },
+                expected: [],
+                consumedFiles: [{
+                        path: executable.canonicalPath,
+                        sha256: executable.sha256,
+                        maxBytes: 536_870_912,
+                        argvIndexes: [0],
+                        executable: true,
+                        executionMode: executable.executionMode,
+                    }],
+                filesystemChecks: [],
+                compensation: [],
+            }] })?.steps[0];
+}
+export function projectRuntimeLifecycle(topology) {
+    const contract = issuedTopologyEvidence.get(topology);
+    const now = Date.now();
+    if (!contract || now < Date.parse(contract.observationWindow.startedAt)
+        || now > Date.parse(contract.observationWindow.expiresAt))
+        return undefined;
+    const services = [];
+    for (const serviceId of contract.order) {
+        const service = contract.services.get(serviceId);
+        if (!service)
+            return undefined;
+        const initial = runtimeServiceInitialSteps(contract, service, randomBytes(32).toString('hex'));
+        const inspect = runtimeServiceInspectStep(contract, service, '0'.repeat(64), randomBytes(32).toString('hex'), Math.min(contract.step.timeoutMs, MAX_OBSERVATION_WINDOW_MS));
+        if (!initial || !inspect)
+            return undefined;
+        const start = projectRuntimeExecutionStep(initial.start);
+        const status = projectRuntimeExecutionStep(initial.status);
+        const identity = projectRuntimeExecutionStep(initial.identity);
+        const projectedInspect = projectRuntimeExecutionStep(inspect, { index: inspect.argv.length - 1, service: service.id });
+        if (!start || !status || !identity || !projectedInspect)
+            return undefined;
+        services.push({
+            id: service.id,
+            start,
+            status,
+            identity,
+            inspect: projectedInspect,
+            healthAcceptance: { state: 'running', health: service.healthcheck ? 'healthy' : null },
+        });
+    }
+    const semantics = {
+        stackId: contract.stackId,
+        configSha256: contract.configSha256,
+        runtimeVersion: contract.runtime.runtimeVersion,
+        composeVersion: contract.runtime.composeVersion,
+        projectName: contract.runtime.projectName,
+        topology: {
+            order: [...contract.order],
+            services: topology.services.map((service) => ({
+                id: service.id,
+                dependsOn: [...service.dependsOn],
+                bindMountSources: [...service.bindMountSources],
+                namedVolumeMounts: service.namedVolumeMounts?.map((mount) => ({ ...mount })) ?? [],
+                healthcheck: service.healthcheck,
+            })),
+        },
+        runtimeChecks: {
+            coldStartLimitMillis: contract.runtime.coldStartLimitMillis,
+            expectedMountSources: [...contract.runtime.expectedMountSources],
+        },
+        services,
+    };
+    if (Buffer.byteLength(JSON.stringify(semantics), 'utf8') > MAX_TOPOLOGY_BYTES)
+        return undefined;
+    return { topology, semantics };
+}
+const CONTAINER_STATES = new Set(['created', 'running', 'restarting', 'paused', 'exited', 'dead', 'removing']);
+const CONTAINER_HEALTH = new Set(['', 'healthy', 'starting', 'unhealthy']);
+function inspectedBindMounts(value) {
+    if (!Array.isArray(value) || value.length > MAX_TOPOLOGY_EDGES)
+        return undefined;
+    const mounts = [];
+    for (const item of value) {
+        if (item === null || typeof item !== 'object' || Array.isArray(item))
+            return undefined;
+        const row = item;
+        if (row.Type !== 'bind')
+            continue;
+        if (typeof row.Source !== 'string' || !isAbsolute(row.Source) || normalize(row.Source) !== row.Source
+            || row.Source.includes('\0') || typeof row.Destination !== 'string' || !CONTAINER_PATH.test(row.Destination))
+            return undefined;
+        mounts.push({ source: row.Source, target: row.Destination });
+    }
+    const identities = mounts.map(({ source, target }) => `${source}\0${target}`);
+    if (new Set(identities).size !== identities.length)
+        return undefined;
+    return [...mounts].sort((left, right) => `${left.source}\0${left.target}`.localeCompare(`${right.source}\0${right.target}`));
+}
+function inspectedPublishedPorts(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const entries = Object.entries(value);
+    if (entries.length > MAX_TOPOLOGY_EDGES)
+        return undefined;
+    const ports = [];
+    for (const [key, bindings] of entries) {
+        const match = key.match(/^([1-9]\d{0,4})\/(tcp|udp)$/);
+        if (!match || Number(match[1]) > 65_535)
+            return undefined;
+        if (bindings === null)
+            continue;
+        if (!Array.isArray(bindings) || bindings.length > MAX_TOPOLOGY_EDGES)
+            return undefined;
+        if (match[2] !== 'tcp')
+            return undefined;
+        for (const binding of bindings) {
+            if (binding === null || typeof binding !== 'object' || Array.isArray(binding))
+                return undefined;
+            const row = binding;
+            const published = typeof row.HostPort === 'string' && /^[1-9]\d{0,4}$/.test(row.HostPort)
+                ? Number(row.HostPort) : undefined;
+            if (typeof row.HostIp !== 'string' || !PUBLISHED_HOSTS.has(row.HostIp)
+                || published === undefined || published > 65_535)
+                return undefined;
+            ports.push({
+                hostIp: row.HostIp,
+                target: Number(match[1]),
+                published,
+                protocol: 'tcp',
+            });
+        }
+    }
+    const identities = ports.map(({ hostIp, target, published }) => `${hostIp}\0${published}\0${target}`);
+    if (new Set(identities).size !== identities.length)
+        return undefined;
+    return [...ports].sort((left, right) => `${left.hostIp}\0${left.published}\0${left.target}`.localeCompare(`${right.hostIp}\0${right.published}\0${right.target}`));
+}
+function parseRuntimeServiceInspection(stdout, contract) {
+    try {
+        const source = new TextDecoder('utf-8', { fatal: true }).decode(stdout);
+        const parsed = JSON.parse(source);
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return undefined;
+        const value = parsed;
+        const labels = value.Labels;
+        const mounts = inspectedBindMounts(value.Mounts);
+        const ports = inspectedPublishedPorts(value.Ports);
+        if (value.ID !== contract.containerId || typeof value.State !== 'string' || typeof value.Health !== 'string'
+            || !CONTAINER_STATES.has(value.State) || !CONTAINER_HEALTH.has(value.Health)
+            || labels === null || typeof labels !== 'object' || Array.isArray(labels)
+            || labels['com.docker.compose.project'] !== contract.topologyContract.runtime.projectName
+            || labels['com.docker.compose.service'] !== contract.service.id
+            || labels['dev.b0dea.cockpit.config-sha256'] !== contract.topologyContract.configSha256
+            || labels['dev.b0dea.cockpit.stack-id'] !== contract.topologyContract.stackId
+            || !contract.service.healthcheck && value.Health !== '' || !mounts || !ports)
+            return undefined;
+        return {
+            containerId: value.ID,
+            state: value.State,
+            health: value.Health === '' ? null : value.Health,
+            bindMounts: mounts,
+            publishedPorts: ports,
+        };
+    }
+    catch {
+        // A malformed inspection shape yields no observation, which the caller reports as unavailable.
+        return undefined;
+    }
+}
+async function inspectRuntimeService(contract, execute) {
+    const window = contract.topologyContract.observationWindow;
+    const step = runtimeServiceInspectStep(contract.topologyContract, contract.service, contract.containerId, randomBytes(32).toString('hex'), Math.min(contract.topologyContract.step.timeoutMs, Math.max(1, Date.parse(window.expiresAt) - Date.now())));
+    if (!step)
+        return { kind: 'failure' };
+    const outcome = await execute(step);
+    const value = outcome.kind === 'complete' && outcome.stderr.byteLength === 0
+        ? parseRuntimeServiceInspection(outcome.stdout, contract) : undefined;
+    if (!value)
+        return runtimeServiceFailure(contract, 'inspect', outcome, contract.identityFinishedAt, contract.containerId);
+    if (!receiptWithinWindow(outcome, window, Date.now())
+        || Date.parse(contract.identityFinishedAt) > Date.parse(outcome.receipt.startedAt))
+        return { kind: 'failure' };
+    const observation = {
+        stackId: contract.topologyContract.stackId,
+        configSha256: contract.topologyContract.configSha256,
+        batchId: contract.topologyContract.batchId,
+        runtimeVersion: contract.topologyContract.runtime.runtimeVersion,
+        composeVersion: contract.topologyContract.runtime.composeVersion,
+        executableSha256: contract.topologyContract.runtime.runtimeExecutable.sha256,
+        projectName: contract.topologyContract.runtime.projectName,
+        service: contract.service.id,
+        containerId: value.containerId,
+        state: value.state,
+        health: value.health,
+        observedAt: outcome.receipt.finishedAt,
+        observationWindow: window,
+    };
+    issuedRuntimeServiceObservations.set(observation, { ...contract, inspection: value });
+    return { kind: 'observed', observation };
+}
+/** The step's failure as log evidence, or a failure without logs when its timing cannot be placed. */
+function runtimeServiceFailure(contract, stage, outcome, previousFinishedAt, containerId, stop) {
+    const observedAt = failedBoundaryObservedAt(outcome, contract.topologyContract.observationWindow, previousFinishedAt);
+    const context = observedAt ? runtimeServiceFailureContext(contract, stage, observedAt, containerId) : undefined;
+    if (!context)
+        return { kind: 'failure', ...stop ? { stop } : {} };
+    const logs = {};
+    issuedRuntimeServiceFailures.set(logs, context);
+    return { kind: 'failure', logs, ...stop ? { stop } : {} };
+}
+/**
+ * Starts one service with `up --wait`, finds its container through Compose and inspects it. Each
+ * step must finish inside the topology's observation window and after the one before it.
+ */
+export async function startRuntimeService(input) {
+    const contract = runtimeServiceContract(input.topology, input.service);
+    const steps = contract && runtimeServiceInitialSteps(contract.topologyContract, contract.service, randomBytes(32).toString('hex'));
+    if (!contract || !steps)
+        return { kind: 'failure' };
+    const { projectName } = contract.topologyContract.runtime;
+    const window = contract.topologyContract.observationWindow;
+    const clean = (outcome, after) => outcome.kind === 'complete' && outcome.stderr.byteLength === 0 && receiptWithinWindow(outcome, window, Date.now())
+        && (after === undefined || Date.parse(after) <= Date.parse(outcome.receipt.startedAt));
+    const failed = (stage, outcome, after) => runtimeServiceFailure(contract, stage, outcome, after, null, steps.stop);
+    const start = await input.execute(steps.start);
+    if (start.kind === 'refusal' || start.stderr.byteLength !== 0)
+        return failed('start', start);
+    if (!clean(start))
+        return { kind: 'failure', stop: steps.stop };
+    const status = await input.execute(steps.status);
+    const shortId = status.kind === 'complete' && status.stderr.byteLength === 0
+        ? classifyComposeStatus(status.stdout, projectName, contract.service.id) : { kind: 'empty' };
+    if (shortId.kind === 'empty')
+        return failed('status', status, start.receipt.finishedAt);
+    if (shortId.kind === 'malformed' || !clean(status, start.receipt.finishedAt))
+        return { kind: 'failure', stop: steps.stop };
+    const identity = await input.execute(steps.identity);
+    const containerId = identity.kind === 'complete' && identity.stderr.byteLength === 0
+        ? classifyContainerIdentity(identity.stdout, shortId.value) : { kind: 'empty' };
+    if (containerId.kind === 'empty')
+        return failed('identity', identity, status.receipt.finishedAt);
+    if (containerId.kind === 'malformed' || !clean(identity, status.receipt.finishedAt))
+        return { kind: 'failure', stop: steps.stop };
+    const inspected = await inspectRuntimeService({
+        ...contract, containerId: containerId.value,
+        startStartedAt: start.receipt.startedAt, identityFinishedAt: identity.receipt.finishedAt,
+    }, input.execute);
+    return inspected.kind === 'stale' ? inspected : { ...inspected, stop: steps.stop };
+}
+/**
+ * Re-reads a service an earlier run started: stale when Compose no longer has the recorded
+ * container, otherwise the container's current inspection.
+ */
+export async function revalidateRuntimeService(input) {
+    const contract = runtimeServiceContract(input.topology, input.service);
+    const steps = contract && CONTAINER_ID.test(input.expectedContainerId)
+        ? runtimeServiceLookupSteps(contract.topologyContract, contract.service, randomBytes(32).toString('hex')) : undefined;
+    if (!contract || !steps)
+        return { kind: 'failure' };
+    const { projectName } = contract.topologyContract.runtime;
+    const window = contract.topologyContract.observationWindow;
+    const status = await input.execute(steps.status);
+    if (status.kind !== 'complete' || status.stderr.byteLength !== 0 || !receiptWithinWindow(status, window, Date.now()))
+        return { kind: 'failure' };
+    const shortId = classifyComposeStatus(status.stdout, projectName, contract.service.id);
+    if (shortId.kind === 'malformed')
+        return { kind: 'failure' };
+    if (shortId.kind === 'empty' || !input.expectedContainerId.startsWith(shortId.value))
+        return { kind: 'stale' };
+    const identity = await input.execute(steps.identity);
+    if (identity.kind !== 'complete' || identity.stderr.byteLength !== 0 || !receiptWithinWindow(identity, window, Date.now())
+        || Date.parse(status.receipt.finishedAt) > Date.parse(identity.receipt.startedAt))
+        return { kind: 'failure' };
+    const observed = parseRuntimeServiceLookup(status.stdout, identity.stdout, projectName, contract.service.id);
+    if (!observed)
+        return { kind: 'failure' };
+    if (observed.kind === 'missing' || observed.containerId !== input.expectedContainerId)
+        return { kind: 'stale' };
+    return inspectRuntimeService({ ...contract, containerId: observed.containerId, identityFinishedAt: identity.receipt.finishedAt }, input.execute);
+}
+/** The observation as healthy-service evidence, or undefined when the service is not running healthy. */
+export function admitRuntimeServiceHealth(observation) {
+    const contract = issuedRuntimeServiceObservations.get(observation);
+    const now = Date.now();
+    if (!contract || now < Date.parse(contract.topologyContract.observationWindow.startedAt)
+        || now > Date.parse(contract.topologyContract.observationWindow.expiresAt)
+        || observation.state !== 'running'
+        || (contract.service.healthcheck ? observation.health !== 'healthy' : observation.health !== null))
+        return undefined;
+    const evidence = {
+        stackId: observation.stackId,
+        configSha256: observation.configSha256,
+        batchId: observation.batchId,
+        runtimeVersion: observation.runtimeVersion,
+        composeVersion: observation.composeVersion,
+        executableSha256: observation.executableSha256,
+        projectName: observation.projectName,
+        service: observation.service,
+        containerId: observation.containerId,
+        state: 'running',
+        health: observation.health === 'healthy' ? 'healthy' : null,
+        observedAt: observation.observedAt,
+        observationWindow: observation.observationWindow,
+    };
+    issuedRuntimeServiceEvidence.set(evidence, contract);
+    return evidence;
+}
+export function isRuntimeServiceEvidence(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    const contract = issuedRuntimeServiceEvidence.get(value);
+    const now = Date.now();
+    return contract !== undefined && Date.parse(contract.topologyContract.observationWindow.startedAt) <= now
+        && now <= Date.parse(contract.topologyContract.observationWindow.expiresAt);
+}
+export function observeRuntimeMountMaterialization(input) {
+    const captured = captureOwnValues(input, ['topology', 'services', 'observedAt']);
+    const topologyValue = captured?.topology;
+    const topology = topologyValue && typeof topologyValue === 'object' ? issuedTopologyEvidence.get(topologyValue) : undefined;
+    const observedAt = captured?.observedAt;
+    if (!topology)
+        throw new RefusalError('runtime mount evidence is not authentic');
+    const fail = (reason) => issueObservation({
+        code: ENVIRONMENT_CODES.MOUNT_MATERIALIZATION_UNAVAILABLE,
+        owner: OWNER,
+        stackId: topology.stackId,
+        source: topology.runtime.projectName,
+        observed: { state: 'unavailable', reason, observedAt: typeof observedAt === 'string' && isCanonicalTimestamp(observedAt) ? observedAt : new Date().toISOString() },
+        expectation: { kind: 'equal', value: true },
+        applicability: { state: 'required', posture: 'running-stack' },
+        freshness: { state: 'current' },
+        remedy: 'restore the exact declared bind mounts and re-observe every runtime service',
+    });
+    if (!Array.isArray(captured?.services) || captured.services.length !== topology.services.size
+        || typeof observedAt !== 'string' || !isCanonicalTimestamp(observedAt)) {
+        return fail('runtime mount evidence is incomplete or unauthenticated');
+    }
+    const now = Date.now();
+    if (now < Date.parse(topology.observationWindow.startedAt) || now > Date.parse(topology.observationWindow.expiresAt)
+        || Date.parse(observedAt) < Date.parse(topology.observationWindow.startedAt)
+        || Date.parse(observedAt) > Math.min(now, Date.parse(topology.observationWindow.expiresAt))) {
+        return fail('runtime mount evidence is outside its current observation window');
+    }
+    const seen = new Set();
+    for (const evidence of captured.services) {
+        const contract = evidence && typeof evidence === 'object' ? issuedRuntimeServiceEvidence.get(evidence) : undefined;
+        if (!contract || contract.topologyContract !== topology || seen.has(contract.service.id)
+            || evidence.observedAt > observedAt || !isRuntimeServiceEvidence(evidence)) {
+            return fail('runtime mount evidence is incomplete or unauthenticated');
+        }
+        seen.add(contract.service.id);
+        const expected = topology.runtimeHealth.get(contract.service.id)?.bindMounts;
+        if (!expected || JSON.stringify(expected) !== JSON.stringify(contract.inspection.bindMounts)) {
+            return issueObservation({
+                code: ENVIRONMENT_CODES.MOUNT_MATERIALIZATION_UNAVAILABLE,
+                owner: OWNER,
+                stackId: topology.stackId,
+                source: `${topology.runtime.projectName}:${contract.service.id}`,
+                observed: { state: 'available', value: false, observedAt },
+                expectation: { kind: 'equal', value: true },
+                applicability: { state: 'required', posture: 'running-stack' },
+                freshness: { state: 'current' },
+                remedy: 'restore the exact declared bind mounts and recreate the affected service',
+            });
+        }
+    }
+    if (seen.size !== topology.services.size)
+        return fail('runtime mount evidence is incomplete or unauthenticated');
+    return issueObservation({
+        code: ENVIRONMENT_CODES.MOUNT_MATERIALIZATION_UNAVAILABLE,
+        owner: OWNER,
+        stackId: topology.stackId,
+        source: `${topology.runtime.projectName}:runtime-mounts`,
+        observed: { state: 'available', value: true, observedAt },
+        expectation: { kind: 'equal', value: true },
+        applicability: { state: 'required', posture: 'running-stack' },
+        freshness: { state: 'current' },
+        remedy: 'restore the exact declared bind mounts and recreate the affected service',
+    });
+}
+function currentRuntimeServices(topology, values) {
+    if (!Array.isArray(values) || values.length !== topology.services.size)
+        return undefined;
+    const services = new Map();
+    for (const evidence of values) {
+        const contract = evidence && typeof evidence === 'object' ? issuedRuntimeServiceEvidence.get(evidence) : undefined;
+        if (!contract || contract.topologyContract !== topology || services.has(contract.service.id)
+            || !isRuntimeServiceEvidence(evidence))
+            return undefined;
+        services.set(contract.service.id, { evidence, contract });
+    }
+    return services.size === topology.services.size ? services : undefined;
+}
+function exactRuntimePorts(expected, actual) {
+    const remaining = new Set(actual.map(({ hostIp, target, published }) => `${hostIp}\0${published}\0${target}`));
+    for (const row of expected) {
+        const identity = `${row.hostIp}\0${row.published}\0${row.target}`;
+        if (row.hostIp !== '0.0.0.0') {
+            if (!remaining.delete(identity))
+                return false;
+            continue;
+        }
+        if (!remaining.delete(identity))
+            return false;
+        remaining.delete(`::\0${row.published}\0${row.target}`);
+    }
+    return remaining.size === 0;
+}
+export async function observeRuntimePortFamily(input) {
+    const captured = captureOwnValues(input, ['topology', 'services', 'namespace', 'listenerTimeoutMs', 'revalidate']);
+    const topologyValue = captured?.topology;
+    const topology = topologyValue && typeof topologyValue === 'object' ? issuedTopologyEvidence.get(topologyValue) : undefined;
+    if (!topology)
+        throw new RefusalError('runtime port evidence is not authentic');
+    const now = new Date().toISOString();
+    const unavailable = (reason, observedAt = now) => issueObservation({
+        code: ENVIRONMENT_CODES.PORT_FAMILY_COLLISION,
+        owner: OWNER,
+        stackId: topology.stackId,
+        source: topology.runtime.projectName,
+        observed: { state: 'unavailable', reason, observedAt },
+        expectation: { kind: 'equal', value: true },
+        applicability: { state: 'required', posture: 'running-stack' },
+        freshness: { state: 'current' },
+        remedy: 'restore the retained port lease and the exact declared runtime publication',
+    });
+    try {
+        const services = currentRuntimeServices(topology, captured?.services);
+        const namespace = captured?.namespace;
+        const timeoutMs = captured?.listenerTimeoutMs;
+        const revalidate = captured?.revalidate;
+        const projection = topology.runtime.portLeaseProjection;
+        const lease = projection && namespace ? inspectPortLeaseProjection(projection, namespace) : undefined;
+        if (!services || !namespace || !lease || typeof revalidate !== 'function'
+            || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 30_000
+            || !await revalidatePortLeaseProjection({ projection: lease, namespace })) {
+            return unavailable('runtime port evidence is incomplete or unauthenticated');
+        }
+        const leased = new Set(Object.values(lease.lease.ports));
+        const published = new Set();
+        const listeners = [];
+        const listenerKeys = new Set();
+        for (const [serviceId, current] of services) {
+            const expected = topology.runtimeHealth.get(serviceId)?.publishedPorts;
+            if (!expected || !exactRuntimePorts(expected, current.contract.inspection.publishedPorts)) {
+                return unavailable(`runtime port publication differs from the declared topology for ${serviceId}`);
+            }
+            const rows = current.contract.inspection.publishedPorts;
+            for (const row of rows) {
+                if (!leased.has(row.published))
+                    return unavailable(`runtime published port ${row.published} is outside the retained lease`);
+                published.add(row.published);
+                const key = `${row.hostIp}\0${row.published}`;
+                if (listenerKeys.has(key))
+                    return unavailable('runtime publication contains a duplicate host address');
+                listenerKeys.add(key);
+                // Compose reports a `::` companion beside every 0.0.0.0 publication, but some
+                // runtimes forward only IPv4 loopback, so requiring ::1 to listen failed healthy
+                // stacks. The IPv4 row still proves the listener; a companion is not required.
+                if (row.hostIp === '::' && rows.some((other) => other.hostIp === '0.0.0.0'
+                    && other.published === row.published && other.target === row.target))
+                    continue;
+                listeners.push({ hostIp: row.hostIp, port: row.published, expected: 'listening' });
+            }
+        }
+        for (const port of leased) {
+            if (published.has(port))
+                continue;
+            listeners.push({ hostIp: '127.0.0.1', port, expected: 'free' });
+            listeners.push({ hostIp: '::1', port, expected: 'free' });
+        }
+        if (listeners.length === 0)
+            return unavailable('retained port lease contains no observable ports');
+        const observed = await observePortListeners({ bindings: listeners, timeoutMs: timeoutMs });
+        if (observed.kind !== 'complete')
+            return unavailable(observed.reason);
+        const mismatched = observed.rows.filter((row, index) => row.listening !== (listeners[index]?.expected === 'listening'));
+        if (mismatched.length > 0) {
+            const named = mismatched.slice(0, 8).map(({ probeHost, port, listening }) => listening
+                ? `${probeHost === '::1' ? `[${probeHost}]` : probeHost}:${port} has a listener outside the stack`
+                : `${probeHost === '::1' ? `[${probeHost}]` : probeHost}:${port} has no stack listener`);
+            return issueObservation({
+                code: ENVIRONMENT_CODES.PORT_FAMILY_COLLISION, owner: OWNER, stackId: topology.stackId,
+                source: `${topology.runtime.projectName}:runtime-ports`,
+                observed: { state: 'available', value: false, observedAt: observed.observedAt },
+                expectation: { kind: 'equal', value: true }, applicability: { state: 'required', posture: 'running-stack' },
+                freshness: { state: 'current' },
+                remedy: `${named.join('; ')}${mismatched.length > named.length ? `; and ${mismatched.length - named.length} more` : ''}: `
+                    + 'stop the process holding a leased port (find it with `lsof -nP -iTCP:<port> -sTCP:LISTEN`), '
+                    + 'or restart the stack with `npx --no cockpit up --config <your cockpit.toml>` to restore a missing listener',
+            });
+        }
+        if (!await revalidatePortLeaseProjection({ projection: lease, namespace })) {
+            return unavailable('retained port lease changed during listener observation', observed.observedAt);
+        }
+        const afterValues = await revalidate();
+        const after = currentRuntimeServices(topology, afterValues);
+        if (!after || after.size !== services.size)
+            return unavailable('runtime service identity changed during listener observation', observed.observedAt);
+        for (const [serviceId, before] of services) {
+            const current = after.get(serviceId);
+            if (!current || current.evidence === before.evidence || current.evidence.containerId !== before.evidence.containerId
+                || Date.parse(current.evidence.observedAt) < Date.parse(observed.observedAt)
+                || JSON.stringify(current.contract.inspection.bindMounts) !== JSON.stringify(before.contract.inspection.bindMounts)
+                || JSON.stringify(current.contract.inspection.publishedPorts) !== JSON.stringify(before.contract.inspection.publishedPorts)) {
+                return unavailable('runtime service identity changed during listener observation', observed.observedAt);
+            }
+        }
+        if (!await revalidatePortLeaseProjection({ projection: lease, namespace })) {
+            return unavailable('retained port lease changed during service revalidation', observed.observedAt);
+        }
+        return issueObservation({
+            code: ENVIRONMENT_CODES.PORT_FAMILY_COLLISION, owner: OWNER, stackId: topology.stackId,
+            source: `${topology.runtime.projectName}:runtime-ports`, observed: { state: 'available', value: true, observedAt: observed.observedAt },
+            expectation: { kind: 'equal', value: true }, applicability: { state: 'required', posture: 'running-stack' },
+            freshness: { state: 'current' }, remedy: 'restore the retained port lease and the exact declared runtime publication',
+        });
+    }
+    catch (error) {
+        return unavailable(unavailableReason('runtime port observation failed closed', error));
+    }
+}
+export function observeRuntimeServiceColdStart(input) {
+    try {
+        const captured = captureOwnValues(input, ['services']);
+        const services = captured?.services;
+        if (!Array.isArray(services) || services.length < 1 || services.length > MAX_TOPOLOGY_SERVICES) {
+            throw new RefusalError('runtime cold-start evidence is not authentic');
+        }
+        let topology;
+        let startedAt = Number.POSITIVE_INFINITY;
+        let finishedAt = Number.NEGATIVE_INFINITY;
+        let source = '';
+        const observedServices = new Set();
+        for (const evidence of services) {
+            const contract = evidence !== null && typeof evidence === 'object'
+                ? issuedRuntimeServiceEvidence.get(evidence)
+                : undefined;
+            if (!contract || topology && contract.topologyContract !== topology
+                || observedServices.has(evidence.service)
+                || !isRuntimeServiceEvidence(evidence)
+                || !isCanonicalTimestamp(contract.startStartedAt)
+                || !isCanonicalTimestamp(evidence.observedAt)) {
+                throw new RefusalError('runtime cold-start evidence is not authentic');
+            }
+            topology ??= contract.topologyContract;
+            observedServices.add(evidence.service);
+            const serviceStart = Date.parse(contract.startStartedAt);
+            const serviceFinish = Date.parse(evidence.observedAt);
+            if (serviceStart > serviceFinish)
+                throw new RefusalError('runtime cold-start evidence is not authentic');
+            if (serviceStart < startedAt) {
+                startedAt = serviceStart;
+                source = evidence.service;
+            }
+            finishedAt = Math.max(finishedAt, serviceFinish);
+        }
+        if (!topology)
+            throw new RefusalError('runtime cold-start evidence is not authentic');
+        const duration = finishedAt - startedAt;
+        const observedAt = new Date(finishedAt).toISOString();
+        return issueObservation({
+            code: ENVIRONMENT_CODES.MACHINE_COLD_START_EXCEEDED,
+            owner: OWNER,
+            stackId: topology.stackId,
+            source,
+            observed: Number.isSafeInteger(duration) && duration >= 0
+                ? { state: 'available', value: duration, observedAt }
+                : { state: 'failed', reason: 'runtime receipt timestamps are incoherent', observedAt },
+            expectation: { kind: 'maximum', value: topology.runtime.coldStartLimitMillis },
+            applicability: { state: 'required', posture: 'environment' },
+            freshness: { state: 'current' },
+            remedy: 'restore the declared cold-start budget',
+        });
+    }
+    catch (error) {
+        if (error instanceof RefusalError && error.message === 'runtime cold-start evidence is not authentic')
+            throw error;
+        throw new RefusalError('runtime cold-start evidence is not authentic');
+    }
+}
+function runtimeServiceFailureContext(contract, stage, observedAt, containerId) {
+    const topology = contract.topologyContract;
+    const step = snapshotExecutionPlan({ steps: [topology.step] })?.steps[0];
+    const configIndex = step?.argv.lastIndexOf('config') ?? -1;
+    const suffix = step?.argv.slice(configIndex);
+    if (!step || configIndex < 2 || step.argv[1] !== 'compose'
+        || !(suffix?.length === 4 && suffix[1] === '--format' && suffix[2] === 'json'
+            && suffix[3] === '--no-env-resolution'))
+        return undefined;
+    return {
+        stage,
+        stackId: topology.stackId,
+        configSha256: topology.configSha256,
+        batchId: topology.batchId,
+        runtimeVersion: topology.runtime.runtimeVersion,
+        composeVersion: topology.runtime.composeVersion,
+        executableSha256: topology.runtime.runtimeExecutable.sha256,
+        projectName: topology.runtime.projectName,
+        service: contract.service.id,
+        containerId,
+        observedAt,
+        observationWindow: topology.observationWindow,
+        executable: { ...topology.runtime.runtimeExecutable },
+        cwd: topology.runtime.cwd,
+        env: runtimeComposeEnvironment(topology.runtime.env, topology.runtime.interpolatedNames),
+        composeArgvPrefix: step.argv.slice(1, configIndex),
+        paths: step.paths,
+        consumedFiles: step.consumedFiles,
+        filesystemChecks: step.filesystemChecks,
+    };
+}
+function failedBoundaryObservedAt(outcome, window, previousFinishedAt) {
+    const now = Date.now();
+    const windowStart = Date.parse(window.startedAt);
+    const windowEnd = Date.parse(window.expiresAt);
+    if (now < windowStart || now > windowEnd)
+        return undefined;
+    if (!outcome.receipt)
+        return outcome.kind === 'refusal' && !outcome.execution.started && outcome.execution.signal === null
+            && (!previousFinishedAt || Date.parse(previousFinishedAt) <= now)
+            ? new Date(now).toISOString()
+            : undefined;
+    const startedAt = outcome.receipt.startedAt;
+    const finishedAt = outcome.receipt.finishedAt;
+    if (!isCanonicalTimestamp(startedAt) || !isCanonicalTimestamp(finishedAt)
+        || Date.parse(startedAt) < windowStart || Date.parse(startedAt) > Date.parse(finishedAt)
+        || Date.parse(finishedAt) > now || Date.parse(finishedAt) > windowEnd
+        || previousFinishedAt && Date.parse(previousFinishedAt) > Date.parse(startedAt))
+        return undefined;
+    return finishedAt;
+}
+export function consumeRuntimeServiceFailureForLogs(evidence) {
+    if (!evidence || typeof evidence !== 'object')
+        return undefined;
+    const context = issuedRuntimeServiceFailures.get(evidence);
+    if (!context)
+        return undefined;
+    issuedRuntimeServiceFailures.delete(evidence);
+    return context;
+}
+export function consumeRuntimeServiceObservationForFailureLogs(value) {
+    try {
+        const contract = value !== null && typeof value === 'object' ? issuedRuntimeServiceObservations.get(value) : undefined;
+        const now = Date.now();
+        if (!contract || consumedRuntimeServiceFailureObservations.has(value)
+            || now < Date.parse(contract.topologyContract.observationWindow.startedAt)
+            || now > Date.parse(contract.topologyContract.observationWindow.expiresAt))
+            return undefined;
+        const env = runtimeCommandEnvironment(contract.topologyContract.runtime.env, contract.topologyContract.runtime.interpolatedNames);
+        const context = {
+            observation: value,
+            executable: { ...contract.topologyContract.runtime.runtimeExecutable },
+            cwd: contract.topologyContract.runtime.cwd,
+            env,
+        };
+        consumedRuntimeServiceFailureObservations.add(value);
+        return context;
+    }
+    catch {
+        // A throwing accessor or proxy trap makes the failure observation unusable, which the caller refuses.
+        return undefined;
+    }
+}
+function unavailableRuntimeStop(error) {
+    return { kind: 'unavailable', reason: unavailableReason('runtime stop evidence is unavailable', error) };
+}
+function receiptWithin(outcome, notBefore, notAfter) {
+    const receipt = outcome.receipt;
+    return receipt !== undefined && isCanonicalTimestamp(receipt.startedAt) && isCanonicalTimestamp(receipt.finishedAt)
+        && Date.parse(receipt.startedAt) >= Date.parse(notBefore)
+        && Date.parse(receipt.startedAt) <= Date.parse(receipt.finishedAt)
+        && Date.parse(receipt.finishedAt) <= Date.parse(notAfter)
+        && Date.parse(receipt.finishedAt) <= Date.now();
+}
+/**
+ * Runs the drain's runtime-stop action: `compose stop` under the attempt's execution fence, then a
+ * fresh `ps` that must find nothing running, and settles the attempt as the outcome to publish.
+ */
+export async function stopRuntime(input) {
+    const topology = issuedTopologyEvidence.get(input.topology);
+    const { reservation, attempt, fence } = input.attempt;
+    const now = Date.now();
+    if (!topology || attempt.status !== 'active' || reservation.attempt?.attemptId !== attempt.attemptId
+        || reservation.stackId !== topology.stackId
+        || reservation.configSha256 !== topology.configSha256
+        || attempt.currentStage !== 'runtime-stop' || attempt.currentTarget !== reservation.stackId
+        || now < Date.parse(topology.observationWindow.startedAt)
+        || now > Date.parse(topology.observationWindow.expiresAt)
+        || now < Date.parse(attempt.committedAt) || now > Date.parse(attempt.validThrough))
+        return unavailableRuntimeStop();
+    const step = derivedComposeStep({ ...topology.step, timeoutMs: topology.step.timeoutMs + COMPOSE_STOP_GRACE_MS * dependencyLevels(topology.services) }, `runtime:docker-compose:stop:${topology.runtime.projectName}`, 'stop', ['--progress', 'quiet', 'stop'], OUTPUT_LIMIT_BYTES, reservation.generation, Date.parse(attempt.validThrough) - now, attempt.validThrough, topology.runtime.interpolatedNames);
+    if (!step)
+        return unavailableRuntimeStop();
+    const stopped = await input.execute({ ...step, executionFence: fence });
+    if (stopped.kind === 'refusal') {
+        // Only a stop that provably never started leaves the stack as it was.
+        if (stopped.receipt !== undefined || stopped.execution.started || stopped.execution.signal !== null
+            || stopped.execution.exitCode === 0)
+            return unavailableRuntimeStop();
+        return { kind: 'not-started', code: stopped.code, outcome: { kind: 'failure', reservation, failedAt: new Date().toISOString() }, fence };
+    }
+    if (stopped.stderr.byteLength !== 0 || !receiptWithin(stopped, attempt.committedAt, attempt.validThrough))
+        return unavailableRuntimeStop();
+    const observationStep = derivedComposeStep(topology.step, `runtime:docker-compose:stopped:${topology.runtime.projectName}`, 'ps-stopped', ['ps', '--format', 'json', '--status', 'running'], OUTPUT_LIMIT_BYTES, reservation.generation, MAX_OBSERVATION_WINDOW_MS, undefined, topology.runtime.interpolatedNames);
+    if (!observationStep)
+        return unavailableRuntimeStop();
+    const observed = await input.execute(observationStep);
+    if (observed.kind !== 'complete' || observed.stderr.byteLength !== 0 || observed.stdout.byteLength !== 0
+        || !receiptWithin(observed, stopped.receipt.finishedAt, attempt.validThrough))
+        return unavailableRuntimeStop();
+    const fact = {
+        purpose: reservation.purpose,
+        stackId: reservation.stackId,
+        configSha256: reservation.configSha256,
+        planDigest: reservation.planDigest,
+        operationBasis: reservation.operationBasis,
+        coordinationRevision: reservation.coordinationRevision,
+        reservationId: reservation.reservationId,
+        reservedAt: reservation.reservedAt,
+        generation: reservation.generation,
+        attemptId: attempt.attemptId,
+        attemptRevision: attempt.committedRevision,
+        attemptCommittedAt: attempt.committedAt,
+        validThrough: attempt.validThrough,
+        actionIndex: attempt.actionIndex,
+        currentTarget: attempt.currentTarget,
+        currentStage: attempt.currentStage,
+        observedAt: observed.receipt.finishedAt,
+    };
+    return { kind: 'stopped', outcome: { kind: 'success', reservation, fact }, fence };
+}