@devrouter/cli 0.0.60 → 0.0.62

package/dist/devrouter.js

@@ -630,9 +630,9 @@ function tryReclaimStaleLock(lockPath, staleLinkPath, livenessCache) {
     throw error;
   }
   try {
-    const record3 = parseLockRecord(import_node_fs3.default.readFileSync(fd, "utf-8"));
-    if (record3.owner && isLockOwnerLive(record3.owner, livenessCache)) {
-      return { kind: "live", pid: record3.owner.pid, acquiredAtMs: record3.acquiredAtMs };
+    const record4 = parseLockRecord(import_node_fs3.default.readFileSync(fd, "utf-8"));
+    if (record4.owner && isLockOwnerLive(record4.owner, livenessCache)) {
+      return { kind: "live", pid: record4.owner.pid, acquiredAtMs: record4.acquiredAtMs };
     }
     const staleStat = import_node_fs3.default.fstatSync(fd);
     if (staleStat.nlink !== 1) {
@@ -724,12 +724,12 @@ function acquireFileLock(lockPath, options) {
         continue;
       }
       const acquiredAtMs = Date.now();
-      const record3 = `${owner}:${acquiredAtMs}`;
-      import_node_fs3.default.writeFileSync(candidatePath, `${record3}
+      const record4 = `${owner}:${acquiredAtMs}`;
+      import_node_fs3.default.writeFileSync(candidatePath, `${record4}
 `, "utf-8");
       try {
         import_node_fs3.default.linkSync(candidatePath, lockPath);
-        return record3;
+        return record4;
       } catch (error) {
         if (error.code !== "EEXIST") {
           throw error;
@@ -1350,11 +1350,11 @@ function listHostRouteState() {
 function upsertHostRoute(input2) {
   return withStateLock(() => {
     const routes = readHostRouteStateLocked();
-    const id2 = buildHostRouteId(input2.repoPath, input2.name);
-    const existing = routes.find((route) => route.id === id2);
+    const id3 = buildHostRouteId(input2.repoPath, input2.name);
+    const existing = routes.find((route) => route.id === id3);
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const next = hostRouteFromInput(input2, existing, now);
-    const remaining = routes.filter((route) => route.id !== id2);
+    const remaining = routes.filter((route) => route.id !== id3);
     remaining.push(next);
     remaining.sort((a, b) => a.name.localeCompare(b.name) || a.repoPath.localeCompare(b.repoPath));
     writeState(remaining);
@@ -1388,10 +1388,10 @@ function replaceHostRoutesForRepo(repoPath, inputs) {
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const replacements = inputs.map((input2) => {
-      const id2 = buildHostRouteId(input2.repoPath, input2.name);
+      const id3 = buildHostRouteId(input2.repoPath, input2.name);
       return hostRouteFromInput(
         input2,
-        routes.find((route) => route.id === id2),
+        routes.find((route) => route.id === id3),
         now
       );
     });
@@ -1402,10 +1402,10 @@ function replaceHostRoutesForRepo(repoPath, inputs) {
     return replacements;
   });
 }
-function removeHostRouteById(id2) {
+function removeHostRouteById(id3) {
   return withStateLock(() => {
     const routes = readHostRouteStateLocked();
-    const next = routes.filter((route) => route.id !== id2);
+    const next = routes.filter((route) => route.id !== id3);
     if (next.length === routes.length) {
       return false;
     }
@@ -2450,7 +2450,7 @@ function loadRepoConfig(repoPath, read = (file) => import_node_fs6.default.readF
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.60" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.62" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -3424,29 +3424,29 @@ var init_reliability_contract = __esm({
 });
 
 // src/core/reliability-operation-store.ts
-function identityKey(identity) {
-  if (!import_node_path10.default.isAbsolute(identity.repoPath) || import_node_path10.default.resolve(identity.repoPath) !== identity.repoPath || identity.repoPath.includes("\0") || identity.workspace !== null && !isReliabilityId(identity.workspace) || !["devpod", "devsy"].includes(identity.provider)) {
+function identityKey(identity2) {
+  if (!import_node_path10.default.isAbsolute(identity2.repoPath) || import_node_path10.default.resolve(identity2.repoPath) !== identity2.repoPath || identity2.repoPath.includes("\0") || identity2.workspace !== null && !isReliabilityId(identity2.workspace) || !["devpod", "devsy"].includes(identity2.provider)) {
     throw new Error("Invalid reliability workspace identity.");
   }
-  return (0, import_node_crypto6.createHash)("sha256").update(identity.repoPath).digest("hex");
+  return (0, import_node_crypto6.createHash)("sha256").update(identity2.repoPath).digest("hex");
 }
-function reliabilityOperationPath(identity) {
-  return import_node_path10.default.join(DEVROUTER_HOME, "reliability", `${identityKey(identity)}.json`);
+function reliabilityOperationPath(identity2) {
+  return import_node_path10.default.join(DEVROUTER_HOME, "reliability", `${identityKey(identity2)}.json`);
 }
 function keys(value, expected) {
   if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !expected.includes(key))) {
     throw new Error("Reliability record contains unsupported fields.");
   }
 }
-function validate(record3, identity) {
-  keys(record3, ["version", "identity", "revision", "state", "worker", "effectSequence", "outcome"]);
-  keys(record3.identity, ["repoPath", "workspace", "provider"]);
-  if (record3.version !== 1 || record3.identity.repoPath !== identity.repoPath || record3.identity.workspace !== identity.workspace || record3.identity.provider !== identity.provider || !isReliabilityCounter(record3.revision) || !isReliabilityCounter(record3.effectSequence)) {
+function validate(record4, identity2) {
+  keys(record4, ["version", "identity", "revision", "state", "worker", "effectSequence", "outcome"]);
+  keys(record4.identity, ["repoPath", "workspace", "provider"]);
+  if (record4.version !== 1 || record4.identity.repoPath !== identity2.repoPath || record4.identity.workspace !== identity2.workspace || record4.identity.provider !== identity2.provider || !isReliabilityCounter(record4.revision) || !isReliabilityCounter(record4.effectSequence)) {
     throw new Error("Reliability record has invalid version, ownership, or counters.");
   }
-  const state = record3.state;
+  const state = record4.state;
   assertReliabilityState(state);
-  if (state.environmentId !== identityKey(identity) || state.executionPolicy !== "manual") {
+  if (state.environmentId !== identityKey(identity2) || state.executionPolicy !== "manual") {
     throw new Error("Reliability record does not grant manual authority for this workspace.");
   }
   keys(state, [
@@ -3490,24 +3490,24 @@ function validate(record3, identity) {
       throw new Error("Reliability operation and retained result disagree.");
     }
   }
-  if (record3.outcome !== null) {
-    keys(record3.outcome, ["operationId", "status", "exitCode", "transport"]);
-    keys(record3.outcome.transport, ["exitCode", "signal"]);
-    const outcome = record3.outcome;
+  if (record4.outcome !== null) {
+    keys(record4.outcome, ["operationId", "status", "exitCode", "transport"]);
+    keys(record4.outcome.transport, ["exitCode", "signal"]);
+    const outcome = record4.outcome;
     const validExit = (value) => Number.isInteger(value) && Number(value) >= 0 && Number(value) <= 255;
     if (outcome.operationId !== state.operation?.id || !["completed", "not-started", "completion-unknown"].includes(outcome.status) || (outcome.status === "completed" ? !validExit(outcome.exitCode) : outcome.exitCode !== null) || outcome.transport.exitCode !== null && !validExit(outcome.transport.exitCode) || outcome.transport.signal !== null && (typeof outcome.transport.signal !== "string" || !/^SIG[A-Z0-9]{1,16}$/.test(outcome.transport.signal))) {
       throw new Error("Reliability execution outcome is invalid.");
     }
   }
-  if (record3.worker !== null) {
-    keys(record3.worker, ["id", "operationId", "pid", "birth"]);
-    if (!isReliabilityId(record3.worker.id) || !isReliabilityId(record3.worker.operationId) || typeof record3.worker.birth !== "string" || !/^(proc|ps):[a-zA-Z0-9]+$/.test(record3.worker.birth) || !isReliabilityCounter(record3.worker.pid) || record3.worker.pid === 0 || record3.worker.operationId !== state.operation?.id) {
+  if (record4.worker !== null) {
+    keys(record4.worker, ["id", "operationId", "pid", "birth"]);
+    if (!isReliabilityId(record4.worker.id) || !isReliabilityId(record4.worker.operationId) || typeof record4.worker.birth !== "string" || !/^(proc|ps):[a-zA-Z0-9]+$/.test(record4.worker.birth) || !isReliabilityCounter(record4.worker.pid) || record4.worker.pid === 0 || record4.worker.operationId !== state.operation?.id) {
       throw new Error("Reliability worker identity is invalid.");
     }
   }
 }
-function readReliabilityOperation(identity) {
-  const file = reliabilityOperationPath(identity);
+function readReliabilityOperation(identity2) {
+  const file = reliabilityOperationPath(identity2);
   let descriptor;
   try {
     descriptor = import_node_fs9.default.openSync(
@@ -3526,27 +3526,27 @@ function readReliabilityOperation(identity) {
     const bytes = Buffer.alloc(MAX_RECORD_BYTES + 1);
     const count = import_node_fs9.default.readSync(descriptor, bytes, 0, bytes.length, 0);
     if (count > MAX_RECORD_BYTES) throw new Error("Reliability record exceeds its byte limit.");
-    const record3 = JSON.parse(
+    const record4 = JSON.parse(
       bytes.subarray(0, count).toString("utf8")
     );
-    validate(record3, identity);
-    return record3;
+    validate(record4, identity2);
+    return record4;
   } finally {
     import_node_fs9.default.closeSync(descriptor);
   }
 }
-function persist(record3) {
-  validate(record3, record3.identity);
-  const contents = `${JSON.stringify(record3)}
+function persist(record4) {
+  validate(record4, record4.identity);
+  const contents = `${JSON.stringify(record4)}
 `;
   if (Buffer.byteLength(contents) > MAX_RECORD_BYTES)
     throw new Error("Reliability record exceeds its byte limit.");
-  const file = reliabilityOperationPath(record3.identity);
+  const file = reliabilityOperationPath(record4.identity);
   try {
     writeFileAtomically(file, contents);
   } catch (error) {
-    const reread = readReliabilityOperation(record3.identity);
-    if (!reread || JSON.stringify(reread) !== JSON.stringify(record3)) throw error;
+    const reread = readReliabilityOperation(record4.identity);
+    if (!reread || JSON.stringify(reread) !== JSON.stringify(record4)) throw error;
     const descriptor = import_node_fs9.default.openSync(file, import_node_fs9.default.constants.O_RDONLY | import_node_fs9.default.constants.O_NOFOLLOW);
     try {
       import_node_fs9.default.fsyncSync(descriptor);
@@ -3561,38 +3561,38 @@ function persist(record3) {
     }
   }
 }
-function updateReliabilityOperation(identity, operation) {
-  const file = reliabilityOperationPath(identity);
+function updateReliabilityOperation(identity2, operation) {
+  const file = reliabilityOperationPath(identity2);
   import_node_fs9.default.mkdirSync(import_node_path10.default.dirname(file), { recursive: true, mode: 448 });
   return withFileLockSync(`${file}.lock`, { activity: "reliability intent", waitMs: 2e3 }, () => {
-    const record3 = readReliabilityOperation(identity) ?? {
+    const record4 = readReliabilityOperation(identity2) ?? {
       version: 1,
-      identity: { ...identity },
+      identity: { ...identity2 },
       revision: 0,
-      state: createReliabilityState(identityKey(identity), 0, "manual"),
+      state: createReliabilityState(identityKey(identity2), 0, "manual"),
       worker: null,
       effectSequence: 0,
       outcome: null
     };
-    if (record3.revision === Number.MAX_SAFE_INTEGER)
+    if (record4.revision === Number.MAX_SAFE_INTEGER)
       throw new Error("Reliability record revision is exhausted.");
-    const result = operation(record3);
+    const result = operation(record4);
     if (result && typeof result.then === "function") {
       throw new Error("Reliability record updates must be synchronous.");
     }
-    validate(record3, identity);
-    record3.revision += 1;
-    persist(record3);
+    validate(record4, identity2);
+    record4.revision += 1;
+    persist(record4);
     return result;
   });
 }
-function withReliabilityObservationFence(identity, expectedRevision, publish) {
-  const file = reliabilityOperationPath(identity);
-  const before = readReliabilityOperation(identity);
+function withReliabilityObservationFence(identity2, expectedRevision, publish) {
+  const file = reliabilityOperationPath(identity2);
+  const before = readReliabilityOperation(identity2);
   if (!before || before.revision !== expectedRevision)
     throw new Error("Reliability observation fence changed or is absent.");
   return withFileLockSync(`${file}.lock`, { activity: "observer publication", waitMs: 100 }, () => {
-    const current = readReliabilityOperation(identity);
+    const current = readReliabilityOperation(identity2);
     if (!current || current.revision !== expectedRevision)
       throw new Error("Reliability observation fence changed or is absent.");
     const result = publish(current);
@@ -3731,8 +3731,8 @@ var init_controller_monitor = __esm({
         if (this.stopped) return;
         const snapshot = this.sessions.read();
         const current = new Set(snapshot.environments.map((env) => env.id));
-        for (const [id2, abort] of this.active) if (!current.has(id2)) abort.abort();
-        for (const id2 of this.lastStarted.keys()) if (!current.has(id2)) this.lastStarted.delete(id2);
+        for (const [id3, abort] of this.active) if (!current.has(id3)) abort.abort();
+        for (const id3 of this.lastStarted.keys()) if (!current.has(id3)) this.lastStarted.delete(id3);
         const now = this.clock();
         const candidates = snapshot.environments.filter(
           (env) => !this.active.has(env.id) && now - (this.lastStarted.get(env.id) ?? -Infinity) >= 5e3
@@ -3852,10 +3852,10 @@ async function observeControllerProcess(containerId, name, signal) {
     ],
     signal
   );
-  const identity = output2.trim();
-  if (!/^[1-9][0-9]* [0-9]+ [a-zA-Z0-9][a-zA-Z0-9._:-]{0,4095}$/.test(identity))
+  const identity2 = output2.trim();
+  if (!/^[1-9][0-9]* [0-9]+ [a-zA-Z0-9][a-zA-Z0-9._:-]{0,4095}$/.test(identity2))
     throw new Error("Process observation is unavailable.");
-  return identity;
+  return identity2;
 }
 var PROCESS_OBSERVATION;
 var init_controller_process_observation = __esm({
@@ -4260,10 +4260,17 @@ function parseDockerLines(stdout) {
   }
   return lines;
 }
-function runManagedStopDocker(args) {
-  const result = (0, import_node_child_process6.spawnSync)("docker", args, {
+function runManagedStopDocker(args, endpoint, timeoutMs = MANAGED_STOP_DOCKER_TIMEOUT_MS) {
+  if (endpoint !== void 0) assertManagedStopEndpoint(endpoint);
+  const env = { ...process.env };
+  if (endpoint !== void 0) {
+    delete env.DOCKER_CONTEXT;
+    delete env.DOCKER_HOST;
+  }
+  const result = (0, import_node_child_process6.spawnSync)("docker", endpoint ? ["--host", endpoint, ...args] : args, {
+    ...endpoint ? { env } : {},
     encoding: "utf-8",
-    timeout: MANAGED_STOP_DOCKER_TIMEOUT_MS,
+    timeout: timeoutMs,
     maxBuffer: MANAGED_STOP_DOCKER_MAX_BUFFER
   });
   if (result.error || result.status !== 0) {
@@ -4274,17 +4281,21 @@ function runManagedStopDocker(args) {
   }
   return result.stdout;
 }
-function listManagedStopContainerIds(composeProject) {
-  const stdout = runManagedStopDocker([
-    "ps",
-    "-a",
-    "--no-trunc",
-    "--filter",
-    `label=${MANAGED_STOP_COMPOSE_LABEL}=${composeProject}`,
-    "--format",
-    "{{.ID}}"
-  ]);
+function listManagedStopContainerIds(composeProject, endpoint) {
+  const stdout = runManagedStopDocker(
+    [
+      "ps",
+      "-a",
+      "--no-trunc",
+      "--filter",
+      `label=${MANAGED_STOP_COMPOSE_LABEL}=${composeProject}`,
+      "--format",
+      "{{.ID}}"
+    ],
+    endpoint
+  );
   const ids = parseDockerLines(stdout);
+  if (ids.length > 256) throw new Error("Managed stop population exceeds its bound.");
   ids.forEach(assertFullContainerId);
   assertUniqueContainerIds(ids);
   return ids;
@@ -4378,13 +4389,11 @@ function validateManagedStopSnapshot(value, composeProject) {
     networks: {}
   };
 }
-function inspectManagedStopPopulation(ids, composeProject) {
-  const stdout = runManagedStopDocker([
-    "inspect",
-    "--format",
-    MANAGED_STOP_INSPECT_TEMPLATE,
-    ...ids
-  ]);
+function inspectManagedStopPopulation(ids, composeProject, endpoint) {
+  const stdout = runManagedStopDocker(
+    ["inspect", "--format", MANAGED_STOP_INSPECT_TEMPLATE, ...ids],
+    endpoint
+  );
   const lines = parseDockerLines(stdout);
   if (lines.length !== ids.length) {
     throw new Error("Managed stop Docker inspection returned an incomplete population.");
@@ -4412,22 +4421,22 @@ function requireSameContainerPopulation(expected, actual) {
     throw new Error("Managed stop Docker inspection observed a changed population.");
   }
   const expectedSet = new Set(expected);
-  if (actual.some((id2) => !expectedSet.has(id2))) {
+  if (actual.some((id3) => !expectedSet.has(id3))) {
     throw new Error("Managed stop Docker inspection observed a changed population.");
   }
 }
-function inspectManagedStopContainers(composeProject) {
+function inspectManagedStopContainers(composeProject, endpoint) {
   if (typeof composeProject !== "string" || composeProject.length === 0 || composeProject !== composeProject.trim() || !MANAGED_STOP_PROJECT_PATTERN.test(composeProject)) {
     throw new Error("Managed stop Docker inspection requires a safe Compose project.");
   }
-  const listedIds = listManagedStopContainerIds(composeProject);
+  const listedIds = listManagedStopContainerIds(composeProject, endpoint);
   if (listedIds.length === 0) {
-    const confirmedIds2 = listManagedStopContainerIds(composeProject);
+    const confirmedIds2 = listManagedStopContainerIds(composeProject, endpoint);
     requireSameContainerPopulation(listedIds, confirmedIds2);
     return [];
   }
-  const snapshots = inspectManagedStopPopulation(listedIds, composeProject);
-  const confirmedIds = listManagedStopContainerIds(composeProject);
+  const snapshots = inspectManagedStopPopulation(listedIds, composeProject, endpoint);
+  const confirmedIds = listManagedStopContainerIds(composeProject, endpoint);
   requireSameContainerPopulation(listedIds, confirmedIds);
   return snapshots;
 }
@@ -4450,7 +4459,7 @@ function inspectWorkspaceContainers(options) {
         `docker ps failed: ${(listed.stderr || listed.stdout || listed.error?.message || "unknown error").trim()}`
       );
     }
-    ids = listed.stdout.split(/\r?\n/).map((id2) => id2.trim()).filter(Boolean);
+    ids = listed.stdout.split(/\r?\n/).map((id3) => id3.trim()).filter(Boolean);
   }
   if (ids.length === 0) return [];
   const template = options?.withSize ? SIZE_INSPECT_TEMPLATE : SAFE_INSPECT_TEMPLATE;
@@ -4514,6 +4523,121 @@ function resolveRunningWorkspaceContainer(repoPath) {
   }
   return { id: container.id, workspacePath: repoMount.Destination };
 }
+function supportsManagedStopBaseline(endpoint) {
+  if (!endpoint || endpoint.length > 4096 || endpoint.trim() !== endpoint || [...endpoint].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127)) {
+    throw new Error("Docker endpoint is malformed.");
+  }
+  if (endpoint.startsWith("unix://")) {
+    if (!endpoint.startsWith("unix:///") || endpoint.length === 8 || import_node_path14.default.normalize(endpoint.slice(7)) !== endpoint.slice(7)) {
+      throw new Error("Docker endpoint is malformed.");
+    }
+    return true;
+  }
+  if (/\s/.test(endpoint)) throw new Error("Docker endpoint is malformed.");
+  if (/^npipe:\/\/\/\/\.\/pipe\/[a-zA-Z0-9_.-]+$/.test(endpoint)) return false;
+  let url;
+  try {
+    url = new URL(endpoint);
+  } catch {
+    throw new Error("Docker endpoint is malformed.");
+  }
+  if (url.protocol !== "tcp:" && url.protocol !== "ssh:" || !url.hostname || url.password || url.search || url.hash || url.protocol === "tcp:" && (url.username || url.pathname && url.pathname !== "/") || url.port && (!/^\d+$/.test(url.port) || Number(url.port) < 1 || Number(url.port) > 65535)) {
+    throw new Error("Docker endpoint is malformed or unsupported.");
+  }
+  return false;
+}
+function assertManagedStopEndpoint(endpoint) {
+  if (!supportsManagedStopBaseline(endpoint)) {
+    throw new Error("Managed stop requires an exact local Docker endpoint.");
+  }
+}
+function parseManagedStopJson(output2) {
+  try {
+    return JSON.parse(output2);
+  } catch {
+    throw new Error("Managed stop Docker response is malformed.");
+  }
+}
+function resolveManagedStopEndpoint() {
+  const endpoint = process.env.DOCKER_HOST && !process.env.DOCKER_CONTEXT ? process.env.DOCKER_HOST : parseManagedStopJson(
+    runManagedStopDocker([
+      "context",
+      "inspect",
+      "--format",
+      "{{json .Endpoints.docker.Host}}"
+    ])
+  );
+  if (typeof endpoint !== "string") throw new Error("Docker endpoint is unavailable.");
+  supportsManagedStopBaseline(endpoint);
+  return endpoint;
+}
+function inspectManagedStopDaemon(endpoint) {
+  const value = parseManagedStopJson(
+    runManagedStopDocker(["info", "--format", "{{json .ID}}"], endpoint)
+  );
+  if (typeof value !== "string" || !value.length || value.length > 256 || /\s/.test(value) || [...value].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127)) {
+    throw new Error("Docker daemon identity is unavailable.");
+  }
+  return value;
+}
+function inspectManagedStopRunnerId(endpoint, containerId) {
+  assertFullContainerId(containerId);
+  const value = parseManagedStopJson(
+    runManagedStopDocker(
+      ["inspect", "--format", '{{json (index .Config.Labels "dev.containers.id")}}', containerId],
+      endpoint
+    )
+  );
+  if (typeof value !== "string" || value.length > 4096)
+    throw new Error("Provider container binding is unavailable.");
+  return value;
+}
+function inspectProviderRunnerContainers(endpoint, runnerId) {
+  if (!runnerId || runnerId.length > 4096 || /[\r\n\0]/.test(runnerId))
+    throw new Error("Provider runner identity is malformed.");
+  const ids = parseDockerLines(
+    runManagedStopDocker(
+      [
+        "ps",
+        "-a",
+        "--no-trunc",
+        "--filter",
+        `label=dev.containers.id=${runnerId}`,
+        "--format",
+        "{{.ID}}"
+      ],
+      endpoint
+    )
+  );
+  if (ids.length > 256) throw new Error("Provider runner population exceeds its bound.");
+  ids.forEach(assertFullContainerId);
+  assertUniqueContainerIds(ids);
+  return ids;
+}
+function inspectManagedStopWorkspaceIds(endpoint, composeDirectory) {
+  const ids = parseDockerLines(
+    runManagedStopDocker(
+      [
+        "ps",
+        "-a",
+        "--no-trunc",
+        "--filter",
+        `label=com.docker.compose.project.working_dir=${composeDirectory}`,
+        "--format",
+        "{{.ID}}"
+      ],
+      endpoint
+    )
+  );
+  if (ids.length > 256) throw new Error("Managed stop population exceeds its bound.");
+  ids.forEach(assertFullContainerId);
+  assertUniqueContainerIds(ids);
+  return ids;
+}
+function stopPinnedManagedContainer(endpoint, containerId) {
+  assertFullContainerId(containerId);
+  runManagedStopDocker(["stop", containerId], endpoint, 3e4);
+}
 var import_node_child_process6, import_node_path14, SAFE_INSPECT_TEMPLATE, SIZE_INSPECT_TEMPLATE, MANAGED_STOP_INSPECT_TEMPLATE, MANAGED_STOP_PROJECT_PATTERN, FULL_CONTAINER_ID_PATTERN, MANAGED_STOP_DOCKER_TIMEOUT_MS, MANAGED_STOP_DOCKER_MAX_BUFFER, MANAGED_STOP_COMPOSE_LABEL, MANAGED_STOP_IDENTITY_LABELS;
 var init_devpod_environment = __esm({
   "src/core/devpod-environment.ts"() {
@@ -5084,12 +5208,147 @@ var init_http_route_probe = __esm({
   }
 });
 
+// src/core/managed-stop-baseline.ts
+function record2(value, keys2) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).length !== keys2.length || Object.keys(value).some((key) => !keys2.includes(key))) {
+    throw new Error("Invalid managed stop baseline fields.");
+  }
+  return value;
+}
+function text(value, empty = false) {
+  if (typeof value !== "string" || value.length > 4096 || !empty && !value.length || value.trim() !== value || [...value].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127)) {
+    throw new Error("Invalid managed stop baseline identity.");
+  }
+  return value;
+}
+function absolute(value) {
+  const result = text(value);
+  if (!import_node_path16.default.isAbsolute(result) || import_node_path16.default.normalize(result) !== result) {
+    throw new Error("Invalid managed stop baseline path.");
+  }
+  return result;
+}
+function list(value, parse2 = text) {
+  if (!Array.isArray(value) || !value.length || value.length > 256) {
+    throw new Error("Invalid managed stop baseline population.");
+  }
+  const result = value.map((item) => parse2(item));
+  if (new Set(result).size !== result.length) throw new Error("Duplicate stop baseline identity.");
+  return result;
+}
+function id(value) {
+  const result = text(value);
+  if (!/^[a-f0-9]{64}$/.test(result)) throw new Error("Invalid stop baseline container ID.");
+  return result;
+}
+function validateManagedStopBaseline(value, state) {
+  const v = record2(value, [
+    "version",
+    "provider",
+    "context",
+    "providerId",
+    "uid",
+    "sourcePath",
+    "sourceContainer",
+    "endpoint",
+    "daemonId",
+    "sourceConfigSha256",
+    "effectiveConfigSha256",
+    "project",
+    "primaryService",
+    "requiredServices",
+    "allowedServices",
+    "composeDirectory",
+    "composeFiles",
+    "featureDirectory",
+    "containers"
+  ]);
+  if (v.version !== 1 || v.provider !== "devsy" || Buffer.byteLength(JSON.stringify(value)) > 1024 * 1024) {
+    throw new Error("Unsupported or oversized managed stop baseline.");
+  }
+  const endpoint = text(v.endpoint);
+  if (!endpoint.startsWith("unix://"))
+    throw new Error("Stop baseline requires a pinned local Docker endpoint.");
+  absolute(endpoint.slice(7));
+  const result = {
+    version: 1,
+    provider: "devsy",
+    context: text(v.context),
+    providerId: text(v.providerId),
+    uid: text(v.uid, true),
+    sourcePath: absolute(v.sourcePath),
+    sourceContainer: text(v.sourceContainer, true),
+    endpoint,
+    daemonId: text(v.daemonId),
+    sourceConfigSha256: id(v.sourceConfigSha256),
+    effectiveConfigSha256: id(v.effectiveConfigSha256),
+    project: text(v.project),
+    primaryService: text(v.primaryService),
+    requiredServices: list(v.requiredServices),
+    allowedServices: list(v.allowedServices),
+    composeDirectory: absolute(v.composeDirectory),
+    composeFiles: list(v.composeFiles, absolute),
+    featureDirectory: absolute(v.featureDirectory),
+    containers: []
+  };
+  if (result.providerId !== state.devpodId || result.sourcePath !== state.repoPath || result.project !== state.composeProject || result.sourceConfigSha256 !== state.sourceConfigSha256 || result.effectiveConfigSha256 !== state.effectiveConfigSha256 || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(result.context) || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(result.providerId) || !/^[a-z0-9][a-z0-9_-]*$/.test(result.project) || !result.requiredServices.includes(result.primaryService) || result.requiredServices.some((service) => !result.allowedServices.includes(service))) {
+    throw new Error("Managed stop baseline does not bind the retained generation.");
+  }
+  if (!Array.isArray(v.containers) || !v.containers.length || v.containers.length > 256) {
+    throw new Error("Invalid managed stop baseline population.");
+  }
+  result.containers = v.containers.map((entry) => {
+    const c = record2(entry, ["id", "service", "configFiles", "mounts"]);
+    const configFiles = list(c.configFiles, absolute);
+    if (configFiles.length < result.composeFiles.length || result.composeFiles.some((file, index) => configFiles[index] !== file) || configFiles.slice(result.composeFiles.length).some(
+      (file) => import_node_path16.default.dirname(file) !== result.featureDirectory || !/^docker-compose\.devcontainer\.containerFeatures-[a-zA-Z0-9_-]+\.yml$/.test(
+        import_node_path16.default.basename(file)
+      )
+    )) {
+      throw new Error("Invalid stop baseline Compose provenance.");
+    }
+    if (!Array.isArray(c.mounts) || c.mounts.length > 256)
+      throw new Error("Invalid baseline mounts.");
+    return {
+      id: id(c.id),
+      service: text(c.service),
+      configFiles,
+      mounts: c.mounts.map((item) => {
+        const mount = record2(item, ["Type", "Source", "Destination"]);
+        return {
+          Type: text(mount.Type),
+          Source: mount.Type === "tmpfs" && mount.Source === "" ? "" : absolute(mount.Source),
+          Destination: absolute(mount.Destination)
+        };
+      })
+    };
+  });
+  const services = result.containers.map((container) => container.service);
+  if (new Set(services).size !== services.length || new Set(result.containers.map((container) => container.id)).size !== result.containers.length || services.some((service) => !result.allowedServices.includes(service)) || result.requiredServices.some((service) => !services.includes(service))) {
+    throw new Error("Incomplete or duplicate stop baseline population.");
+  }
+  const primary = result.containers.find(
+    (container) => container.service === result.primaryService
+  );
+  if (primary?.mounts.filter((mount) => mount.Type === "bind" && mount.Source === state.repoPath).length !== 1 || result.sourceContainer && result.sourceContainer !== primary.id) {
+    throw new Error("Stop baseline has no exact primary source binding.");
+  }
+  return result;
+}
+var import_node_path16;
+var init_managed_stop_baseline = __esm({
+  "src/core/managed-stop-baseline.ts"() {
+    "use strict";
+    import_node_path16 = __toESM(require("path"));
+  }
+});
+
 // src/core/managed-runtime-state.ts
 function stateKey(repoPath, workspace) {
   return (0, import_node_crypto10.createHash)("sha256").update(`${repoPath}\0${workspace ?? ""}`, "utf-8").digest("hex");
 }
 function managedRuntimeStatePath(repoPath, workspace) {
-  return import_node_path16.default.join(DEVROUTER_HOME, "managed-runtime", `${stateKey(repoPath, workspace)}.json`);
+  return import_node_path17.default.join(DEVROUTER_HOME, "managed-runtime", `${stateKey(repoPath, workspace)}.json`);
 }
 function isStringArray(value) {
   return Array.isArray(value) && value.every((item) => typeof item === "string") && new Set(value).size === value.length;
@@ -5131,7 +5390,7 @@ function validateState(value, repoPath, workspace) {
   if (typeof candidate.updatedAt !== "string" || !Number.isFinite(Date.parse(candidate.updatedAt))) {
     throw new Error("Managed runtime state has an invalid timestamp.");
   }
-  return {
+  const result = {
     version: 1,
     repoPath,
     ...workspace !== void 0 ? { workspace } : {},
@@ -5149,6 +5408,10 @@ function validateState(value, repoPath, workspace) {
     ...candidate.transitionPhase ? { transitionPhase: candidate.transitionPhase } : {},
     updatedAt: candidate.updatedAt
   };
+  if (Object.hasOwn(candidate, "stopBaseline")) {
+    result.stopBaseline = validateManagedStopBaseline(candidate.stopBaseline, result);
+  }
+  return result;
 }
 function readManagedRuntimeState(repoPath, workspace, read = (file) => import_node_fs13.default.readFileSync(file, "utf-8")) {
   const statePath = managedRuntimeStatePath(repoPath, workspace);
@@ -5161,14 +5424,15 @@ function readManagedRuntimeState(repoPath, workspace, read = (file) => import_no
   }
   return validateState(parsed, repoPath, workspace);
 }
-var import_node_crypto10, import_node_fs13, import_node_path16;
+var import_node_crypto10, import_node_fs13, import_node_path17;
 var init_managed_runtime_state = __esm({
   "src/core/managed-runtime-state.ts"() {
     "use strict";
     import_node_crypto10 = require("crypto");
     import_node_fs13 = __toESM(require("fs"));
-    import_node_path16 = __toESM(require("path"));
+    import_node_path17 = __toESM(require("path"));
     init_atomic_file();
+    init_managed_stop_baseline();
     init_router();
   }
 });
@@ -5197,7 +5461,7 @@ async function containers(project, signal) {
     signal
   );
   const ids = listed.trim() ? listed.trim().split(/\r?\n/).sort() : [];
-  if (ids.length > 128 || new Set(ids).size !== ids.length || ids.some((id2) => !/^[a-f0-9]{64}$/.test(id2)))
+  if (ids.length > 128 || new Set(ids).size !== ids.length || ids.some((id3) => !/^[a-f0-9]{64}$/.test(id3)))
     throw new Error("Observation container population is invalid.");
   if (!ids.length) return [];
   const output2 = await runControllerProbe(
@@ -5214,12 +5478,12 @@ async function containers(project, signal) {
   }
   return values.sort((a, b) => a.id.localeCompare(b.id));
 }
-var import_node_crypto11, import_node_path17, OBSERVATION_INSPECT_TEMPLATE, collectControllerObservation;
+var import_node_crypto11, import_node_path18, OBSERVATION_INSPECT_TEMPLATE, collectControllerObservation;
 var init_controller_observation = __esm({
   "src/core/controller-observation.ts"() {
     "use strict";
     import_node_crypto11 = require("crypto");
-    import_node_path17 = __toESM(require("path"));
+    import_node_path18 = __toESM(require("path"));
     init_controller_binding();
     init_controller_monitor();
     init_controller_probe();
@@ -5262,14 +5526,14 @@ var init_controller_observation = __esm({
       )).trim().split("\n");
       if (metadata.length !== 2) throw new Error("Observation ownership paths unavailable.");
       const [gitDir, commonDir] = metadata;
-      const sourcePath = import_node_path17.default.join(environment.repoPath, ".devcontainer/devcontainer.json");
+      const sourcePath = import_node_path18.default.join(environment.repoPath, ".devcontainer/devcontainer.json");
       const files = [
-        import_node_path17.default.join(commonDir, "devrouter/workspaces", `${environment.workspace}.json`),
-        import_node_path17.default.join(environment.repoPath, ".devrouter.yml"),
-        import_node_path17.default.join(gitDir, "devrouter-workspace"),
+        import_node_path18.default.join(commonDir, "devrouter/workspaces", `${environment.workspace}.json`),
+        import_node_path18.default.join(environment.repoPath, ".devrouter.yml"),
+        import_node_path18.default.join(gitDir, "devrouter-workspace"),
         managedRuntimeStatePath(environment.repoPath, environment.workspace),
         sourcePath,
-        import_node_path17.default.join(environment.repoPath, MANAGED_DEVCONTAINER_PATH)
+        import_node_path18.default.join(environment.repoPath, MANAGED_DEVCONTAINER_PATH)
       ];
       const persisted = captureControllerEvidence(files);
       if (controllerBindingFingerprint(persisted.contents[0], persisted.contents[1]) !== environment.fingerprint)
@@ -5285,16 +5549,16 @@ var init_controller_observation = __esm({
       const source = parseDevcontainerConfig(persisted.contents[4], sourcePath);
       if (!state || state.devpodId !== environment.providerId || state.profile !== environment.profile || typeof source.service !== "string" || !source.service || (0, import_node_crypto11.createHash)("sha256").update(persisted.contents[4]).digest("hex") !== state.sourceConfigSha256 || (0, import_node_crypto11.createHash)("sha256").update(persisted.contents[5]).digest("hex") !== state.effectiveConfigSha256)
         throw new ControllerObservationBindingChanged("Observation retained configuration changed.");
-      const identity = {
+      const identity2 = {
         repoPath: environment.repoPath,
         workspace: environment.workspace,
         provider: environment.provider
       };
-      const journal = readReliabilityOperation(identity);
+      const journal = readReliabilityOperation(identity2);
       if (!journal) throw new Error("Observation journal is unavailable.");
       const routes = readRoutes().filter((route) => route.repoPath === environment.repoPath);
       const before = await containers(state.composeProject, signal);
-      const composeDirectory = import_node_path17.default.join(environment.repoPath, ".devcontainer");
+      const composeDirectory = import_node_path18.default.join(environment.repoPath, ".devcontainer");
       const references = typeof source.dockerComposeFile === "string" ? [source.dockerComposeFile] : source.dockerComposeFile;
       if (!Array.isArray(references) || !references.length || references.some((value) => typeof value !== "string"))
         throw new Error("Observation Compose source is unavailable.");
@@ -5311,7 +5575,7 @@ var init_controller_observation = __esm({
         if (!recorded || container.labels["com.docker.compose.project.working_dir"] !== composeDirectory)
           throw new Error("Observation Compose ownership is unavailable.");
         const files2 = recorded.split(",").map((file) => file.trim());
-        if (files2.some((file) => !import_node_path17.default.isAbsolute(file)) || !hasExactComposeIdentity(container, {
+        if (files2.some((file) => !import_node_path18.default.isAbsolute(file)) || !hasExactComposeIdentity(container, {
           repoPath: environment.repoPath,
           service: container.labels["com.docker.compose.service"] ?? "",
           composeProject: state.composeProject,
@@ -5440,7 +5704,7 @@ var init_controller_observation = __esm({
       const routeFingerprint = digest2(routes);
       return {
         environment,
-        identity,
+        identity: identity2,
         journal,
         sampledAtMs: Math.floor(performance.now()),
         runtimeFingerprint: digest2({ before, processes }),
@@ -5538,11 +5802,11 @@ var init_controller_sessions = __esm({
         this.previousTime = { monotonic, wall };
         return discontinuity;
       }
-      acquire(id2, environment, requirements, monotonic, wall) {
+      acquire(id3, environment, requirements, monotonic, wall) {
         this.tick(monotonic, wall);
         const next = this.read();
         const required = [...requirements].sort();
-        const existing = next.sessions.find((s) => s.id === id2);
+        const existing = next.sessions.find((s) => s.id === id3);
         const shared = next.environments.find((env) => env.repoPath === environment.repoPath);
         if (shared && JSON.stringify(shared) !== JSON.stringify(environment))
           throw new Error("Controller environment binding conflicts.");
@@ -5554,7 +5818,7 @@ var init_controller_sessions = __esm({
         if (next.sessions.length >= 128 || !shared && next.environments.length >= 32)
           throw new Error("Controller coordination capacity exhausted.");
         const session = {
-          id: id2,
+          id: id3,
           environmentId: environment.id,
           generation: (0, import_node_crypto12.randomUUID)(),
           requirements: required,
@@ -5564,7 +5828,7 @@ var init_controller_sessions = __esm({
         next.sessions.push(session);
         this.event(next, session, "acquired");
         this.commit(next);
-        this.leases.set(id2, monotonic + 3e4);
+        this.leases.set(id3, monotonic + 3e4);
         return this.binding(session);
       }
       publish(bindings, projections, monotonic, wall) {
@@ -5610,8 +5874,8 @@ var init_controller_sessions = __esm({
         if (changed) {
           this.commit(next);
           if (bindingChanged) {
-            for (const id2 of this.leases.keys())
-              if (!next.sessions.some((s) => s.id === id2)) this.leases.delete(id2);
+            for (const id3 of this.leases.keys())
+              if (!next.sessions.some((s) => s.id === id3)) this.leases.delete(id3);
           }
         }
       }
@@ -5677,11 +5941,11 @@ function fields(value, expected) {
   const actual = Object.keys(value);
   if (actual.length !== expected.length || actual.some((key) => !expected.includes(key))) fail2();
 }
-function text(value, max = 256) {
+function text2(value, max = 256) {
   return typeof value === "string" && value.length > 0 && value.length <= max && ![...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);
 }
-function id(value) {
-  return text(value, 128) && /^[a-zA-Z0-9_-]+$/.test(value);
+function id2(value) {
+  return text2(value, 128) && /^[a-zA-Z0-9_-]+$/.test(value);
 }
 function counter(value) {
   return Number.isSafeInteger(value) && Number(value) >= 0;
@@ -5697,7 +5961,7 @@ function validateControllerSnapshot(value) {
     "sessions",
     "events"
   ]);
-  if (value.version !== 1 || !id(value.store) || !counter(value.epoch) || !counter(value.revision) || !counter(value.nextSequence) || value.nextSequence < 1 || !Array.isArray(value.environments) || value.environments.length > 32 || !Array.isArray(value.sessions) || value.sessions.length > 128 || !Array.isArray(value.events) || value.events.length > 256)
+  if (value.version !== 1 || !id2(value.store) || !counter(value.epoch) || !counter(value.revision) || !counter(value.nextSequence) || value.nextSequence < 1 || !Array.isArray(value.environments) || value.environments.length > 32 || !Array.isArray(value.sessions) || value.sessions.length > 128 || !Array.isArray(value.events) || value.events.length > 256)
     fail2();
   const environments = /* @__PURE__ */ new Set();
   const checkouts = /* @__PURE__ */ new Set();
@@ -5711,7 +5975,7 @@ function validateControllerSnapshot(value) {
       "profile",
       "fingerprint"
     ]);
-    if (!id(env.id) || environments.has(env.id) || !text(env.repoPath, 4096) || !import_node_path18.default.isAbsolute(env.repoPath) || import_node_path18.default.resolve(env.repoPath) !== env.repoPath || checkouts.has(env.repoPath) || !id(env.workspace) || !id(env.providerId) || !text(env.profile) || !/^[a-z0-9-]+(?:,[a-z0-9-]+)*$/.test(env.profile) || !text(env.fingerprint, 128) || !/^[a-f0-9]{64}$/.test(env.fingerprint) || !["devpod", "devsy"].includes(String(env.provider)))
+    if (!id2(env.id) || environments.has(env.id) || !text2(env.repoPath, 4096) || !import_node_path19.default.isAbsolute(env.repoPath) || import_node_path19.default.resolve(env.repoPath) !== env.repoPath || checkouts.has(env.repoPath) || !id2(env.workspace) || !id2(env.providerId) || !text2(env.profile) || !/^[a-z0-9-]+(?:,[a-z0-9-]+)*$/.test(env.profile) || !text2(env.fingerprint, 128) || !/^[a-f0-9]{64}$/.test(env.fingerprint) || !["devpod", "devsy"].includes(String(env.provider)))
       fail2();
     environments.add(env.id);
     checkouts.add(env.repoPath);
@@ -5727,8 +5991,8 @@ function validateControllerSnapshot(value) {
       "renewedAtMs",
       ...Object.hasOwn(session, "observation") ? ["observation"] : []
     ]);
-    if (!id(session.id) || sessions.has(session.id) || !id(session.environmentId) || !environments.has(session.environmentId) || !id(session.generation) || !counter(session.renewedAtMs) || !Array.isArray(session.requirements) || session.requirements.length < 1 || session.requirements.length > 16 || new Set(session.requirements).size !== session.requirements.length || session.requirements.some(
-      (r) => !text(r, 132) || !/^(runtime|app:[a-z0-9][a-z0-9-]*)$/.test(r)
+    if (!id2(session.id) || sessions.has(session.id) || !id2(session.environmentId) || !environments.has(session.environmentId) || !id2(session.generation) || !counter(session.renewedAtMs) || !Array.isArray(session.requirements) || session.requirements.length < 1 || session.requirements.length > 16 || new Set(session.requirements).size !== session.requirements.length || session.requirements.some(
+      (r) => !text2(r, 132) || !/^(runtime|app:[a-z0-9][a-z0-9-]*)$/.test(r)
     ))
       fail2();
     if (session.observation !== void 0) {
@@ -5750,7 +6014,7 @@ function validateControllerSnapshot(value) {
         "WAITING_CAPACITY",
         "PARKED_CAPACITY",
         "UNKNOWN"
-      ].includes(String(observation.status)) || !counter(observation.sampledAtMs) || !counter(observation.validUntilMs) || observation.validUntilMs < observation.sampledAtMs || !counter(observation.journalRevision) || !text(observation.runtimeFingerprint, 128) || !/^[a-f0-9]{64}$/.test(observation.runtimeFingerprint))
+      ].includes(String(observation.status)) || !counter(observation.sampledAtMs) || !counter(observation.validUntilMs) || observation.validUntilMs < observation.sampledAtMs || !counter(observation.journalRevision) || !text2(observation.runtimeFingerprint, 128) || !/^[a-f0-9]{64}$/.test(observation.runtimeFingerprint))
         fail2();
     }
     sessions.add(session.id);
@@ -5760,7 +6024,7 @@ function validateControllerSnapshot(value) {
   let previous = 0;
   for (const event of value.events) {
     fields(event, ["sequence", "session", "generation", "kind"]);
-    if (!counter(event.sequence) || event.sequence <= previous || event.sequence >= value.nextSequence || !id(event.session) || !id(event.generation) || !["acquired", "renewed", "released", "expired", "invalidated", "observed"].includes(
+    if (!counter(event.sequence) || event.sequence <= previous || event.sequence >= value.nextSequence || !id2(event.session) || !id2(event.generation) || !["acquired", "renewed", "released", "expired", "invalidated", "observed"].includes(
       String(event.kind)
     ))
       fail2();
@@ -5769,20 +6033,20 @@ function validateControllerSnapshot(value) {
   if (Buffer.byteLength(JSON.stringify(value.events)) > 262144 || Buffer.byteLength(JSON.stringify(value)) + 1 > CONTROLLER_SNAPSHOT_BYTES)
     fail2();
 }
-var import_node_crypto13, import_node_fs14, import_node_path18, CONTROLLER_SNAPSHOT_BYTES, ControllerStore;
+var import_node_crypto13, import_node_fs14, import_node_path19, CONTROLLER_SNAPSHOT_BYTES, ControllerStore;
 var init_controller_store = __esm({
   "src/core/controller-store.ts"() {
     "use strict";
     import_node_crypto13 = require("crypto");
     import_node_fs14 = __toESM(require("fs"));
-    import_node_path18 = __toESM(require("path"));
+    import_node_path19 = __toESM(require("path"));
     init_atomic_file();
     CONTROLLER_SNAPSHOT_BYTES = 1048576;
     ControllerStore = class {
       constructor(directory, write = writeFileAtomically) {
         this.directory = directory;
         this.write = write;
-        this.file = import_node_path18.default.join(directory, "snapshot.json");
+        this.file = import_node_path19.default.join(directory, "snapshot.json");
       }
       file;
       read() {
@@ -5862,10 +6126,10 @@ var init_controller_store = __esm({
 
 // src/core/controller-server.ts
 function privateDirectory(directory) {
-  const absolute = import_node_path19.default.resolve(directory);
-  let current = import_node_path19.default.parse(absolute).root;
-  for (const part of absolute.slice(current.length).split(import_node_path19.default.sep)) {
-    current = import_node_path19.default.join(current, part);
+  const absolute2 = import_node_path20.default.resolve(directory);
+  let current = import_node_path20.default.parse(absolute2).root;
+  for (const part of absolute2.slice(current.length).split(import_node_path20.default.sep)) {
+    current = import_node_path20.default.join(current, part);
     try {
       const stat2 = import_node_fs15.default.lstatSync(current);
       if (!stat2.isDirectory() || stat2.isSymbolicLink())
@@ -5875,7 +6139,7 @@ function privateDirectory(directory) {
       import_node_fs15.default.mkdirSync(current, { mode: 448 });
     }
   }
-  const stat = import_node_fs15.default.lstatSync(absolute);
+  const stat = import_node_fs15.default.lstatSync(absolute2);
   if (stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0)
     throw new Error("Controller directory is not private.");
 }
@@ -5891,10 +6155,10 @@ function validateOwnedFile(file, socket) {
   }
 }
 async function runController(options) {
-  const socketPath = import_node_path19.default.join(options.directory, "control.sock");
+  const socketPath = import_node_path20.default.join(options.directory, "control.sock");
   if (Buffer.byteLength(socketPath) > 103) throw new Error("Controller socket path is too long.");
   privateDirectory(options.directory);
-  const lockPath = import_node_path19.default.join(options.directory, "owner.lock");
+  const lockPath = import_node_path20.default.join(options.directory, "owner.lock");
   try {
     const stat = import_node_fs15.default.lstatSync(lockPath);
     if (!stat.isFile() || stat.uid !== process.getuid?.())
@@ -6197,13 +6461,13 @@ async function runController(options) {
     }
   });
 }
-var import_node_fs15, import_node_net2, import_node_path19, FRAME_BYTES;
+var import_node_fs15, import_node_net2, import_node_path20, FRAME_BYTES;
 var init_controller_server = __esm({
   "src/core/controller-server.ts"() {
     "use strict";
     import_node_fs15 = __toESM(require("fs"));
     import_node_net2 = __toESM(require("net"));
-    import_node_path19 = __toESM(require("path"));
+    import_node_path20 = __toESM(require("path"));
     init_controller_monitor();
     init_controller_protocol();
     init_controller_sessions();
@@ -6219,7 +6483,7 @@ __export(controller_exports, {
   runControllerCommand: () => runControllerCommand
 });
 async function runControllerCommand(method, options, repo) {
-  const directory = import_node_path20.default.join(DEVROUTER_HOME, "controller");
+  const directory = import_node_path21.default.join(DEVROUTER_HOME, "controller");
   try {
     if (method === "run") {
       const controller = new AbortController();
@@ -6244,7 +6508,7 @@ async function runControllerCommand(method, options, repo) {
     if (fields2.timeout !== void 0) fields2.timeout = Number(fields2.timeout);
     await controllerRequest(
       directory,
-      { method, ...fields2, ...repo ? { path: import_node_path20.default.resolve(repo) } : {} },
+      { method, ...fields2, ...repo ? { path: import_node_path21.default.resolve(repo) } : {} },
       (value) => process.stdout.write(`${JSON.stringify(value)}
 `)
     );
@@ -6256,11 +6520,11 @@ async function runControllerCommand(method, options, repo) {
     process.exitCode = 1;
   }
 }
-var import_node_path20;
+var import_node_path21;
 var init_controller = __esm({
   "src/commands/controller.ts"() {
     "use strict";
-    import_node_path20 = __toESM(require("path"));
+    import_node_path21 = __toESM(require("path"));
     init_controller_binding();
     init_controller_client();
     init_controller_observation();
@@ -6308,13 +6572,13 @@ function replaceDevrouterSection(content) {
   return `${content.slice(0, start)}${buildDevrouterSection()}${content.slice(end)}`;
 }
 function writeRepoFile(repoPath, relPath, content) {
-  const absolutePath = (0, import_node_path21.join)(repoPath, relPath);
-  (0, import_node_fs16.mkdirSync)((0, import_node_path21.dirname)(absolutePath), { recursive: true });
+  const absolutePath = (0, import_node_path22.join)(repoPath, relPath);
+  (0, import_node_fs16.mkdirSync)((0, import_node_path22.dirname)(absolutePath), { recursive: true });
   (0, import_node_fs16.writeFileSync)(absolutePath, content, "utf-8");
   return absolutePath;
 }
 function ensureAgentsMdSection(repoPath) {
-  const filePath = (0, import_node_path21.join)(repoPath, AGENTS_MD);
+  const filePath = (0, import_node_path22.join)(repoPath, AGENTS_MD);
   if ((0, import_node_fs16.existsSync)(filePath)) {
     const content = (0, import_node_fs16.readFileSync)(filePath, "utf-8");
     if (content.includes(DEVROUTER_SENTINEL)) {
@@ -6339,12 +6603,12 @@ function ensureSkillFile(repoPath) {
   const filePath = writeRepoFile(repoPath, DEVROUTER_SKILL_REL_PATH, DEVROUTER_SKILL_CONTENT);
   return { path: filePath, written: true };
 }
-var import_node_fs16, import_node_path21, DEVROUTER_SENTINEL, DEVROUTER_END_SENTINEL, LEGACY_DEVROUTER_SECTION_END, AGENTS_MD, DEVROUTER_SKILL_REL_PATH, DEVROUTER_SKILL_CONTENT;
+var import_node_fs16, import_node_path22, DEVROUTER_SENTINEL, DEVROUTER_END_SENTINEL, LEGACY_DEVROUTER_SECTION_END, AGENTS_MD, DEVROUTER_SKILL_REL_PATH, DEVROUTER_SKILL_CONTENT;
 var init_agents_md = __esm({
   "src/core/agents-md.ts"() {
     "use strict";
     import_node_fs16 = require("fs");
-    import_node_path21 = require("path");
+    import_node_path22 = require("path");
     DEVROUTER_SENTINEL = "<!-- devrouter -->";
     DEVROUTER_END_SENTINEL = "<!-- /devrouter -->";
     LEGACY_DEVROUTER_SECTION_END = "- `devrouter ls`";
@@ -6877,13 +7141,14 @@ function buildOnboardingPrompt(options = {}) {
     `- When a workspace is active: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`${WORKSPACE_PLACEHOLDER}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed ensure rejects every HTTP/TCP upstream outside that exact alias namespace before mutation. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.`,
     "- TLS: namespaced hosts (`web.<ws>.localhost`) are not covered by the `*.localhost` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.",
     "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes an exact captured snapshot of the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause, `devrouter stop . --delete` only for explicit exact-owner cleanup without removing the checkout, and `devrouter exec . -- <command...>` for container commands. Never substitute raw DevPod/Devsy mutations; they bypass the machine-global ownership lock, which serializes provider mutations in a fair arrival-order queue and lets contenders wait up to thirty minutes with throttled stderr progress before failing with the queue position or holder PID and true durations. `workspace up` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped.",
+    "- After a drained interrupted ensure, manual exec can use an exactly proven retained Devsy runtime with the plain local Docker command. Revalidate identity for each tooling command until later preparation reconciles startup; preserve configuration, data and interrupted history. This does not repair absent stop baselines or provide OOM protection.",
     "- Ensure reconciles interrupted or never-dispatched ensure after positive worker drainage. Unknown arbitrary exec never replays; use explicit stop to reconcile that uncertainty. Preserve journals and generated configuration if evidence is unavailable. This does not prevent OOM or activate capacity-managed recovery.",
     "- Devsy agent readiness: run `devrouter setup --yes --workspace-runtime devsy` once so Devrouter acquires and verifies the pinned agent in its own machine cache. `doctor` reports `ready`, `missing`, `stale`, or `invalid` without network access, and `ensure` fails before the provider queue when readiness is not `ready`. An explicit `DEVSY_AGENT_BINARY` remains authoritative and must match a pinned official asset.",
     "- A managed adapter plus `postCreateCommand` requires `waitFor` exactly `postCreateCommand` or `postStartCommand`; managed selective config preserves lifecycle fields and changes only `runServices`.",
     "- Managed process reuse fingerprints command argv, workspace identity, and the exact adapter snapshot. If a non-secret runtime value also affects reuse, set `DEVROUTER_PROCESS_FINGERPRINT_ENV` to its comma-separated environment names; secret-like names are rejected and raw values are never persisted.",
     "- Managed adapters may use devrouter-process ensure --prepare-command <command> for synchronous dependency preparation under the process lock before app launch. Unchanged owned processes skip preparation; it participates in default fingerprints and must not daemonize or detach.",
     "- Host-generated Compose inputs may use managedRuntime.devcontainer.prepareCommand as literal argv. Ensure runs it once from the checkout root before Compose inspection, with a 60-second bound and no implicit shell. Keep .devrouter.yml unchanged. Diagnostics never run it; changed warm mounts require separate verification.",
-    "- Exact managed Devsy stop validates complete retained container membership, ownership and configuration before stopping residual services after a stopped primary. Unknown evidence blocks cleanup; original provider failures remain errors even after successful residual cleanup.",
+    "- Managed Devsy startup on supported local Unix Docker endpoints captures exact stop ownership before application readiness. With that baseline, canonical stop tolerates changed or missing repository configuration and preserves containers and volumes. Older records without a baseline retain configuration-dependent stop; installing a new CLI does not establish historical ownership. Invalid or changed ownership never falls back. Do not replay destructive bootstrap hooks to obtain a baseline.",
     "- Owner status is `present`, `missing`, `locked`, or `conflict`. Dirty or locked full down fails before side effects. `workspace gc` is a dry run; only `--yes` deletes exact eligible missing resources and records, never Git worktrees, branches, or prune state.",
     "- `devrouter workspace cleanup --repo . --inactive-for 30d --check-merged --json` is report-only and never mutates the workspace runtime, routes, ownership, Git, Docker, applications, worktrees, or branches. It reports ownership, workspace runtime registration, runtime state (`running|stopped|busy|not-found|absent|unknown`), checkout, advisory activity, route, and integration evidence. Local DevPod/Devsy list/status checks always run; `--check-merged` alone enables read-only origin and matching GitHub/GitLab checks. Treat `not-found` as stale runtime after Docker pruning; busy, unavailable, or conflicting evidence suppresses destructive suggestions. Explicit `gc`/`down` can remove exact stale registration only after expected-ID `NotFound` proof and ownership revalidation. Runtime `lastUsed` remains advisory.",
     '- `--measure-size` adds per-workspace storage consumption and stays read-only, but walks each worktree and runs `docker ps` / `docker inspect --size`, so leave it off for a quick report. Each row reports `worktree` and `containerWritable` bytes, which are reclaimable; `imageShared` bytes, which are not, because those image layers are shared with other containers and overlap across rows; and `reclaimable`, the sum of the reclaimable fields. Never add `imageShared` across rows. Any figure that cannot be trusted reports `{"status": "unknown", "reason": ...}` rather than zero, and a workspace with no container reports a measured `0`.',
@@ -7618,7 +7883,7 @@ function readPromptDirectory(promptDirPath) {
       continue;
     }
     const version = normalizeVersion(basename);
-    const promptPath = import_node_path22.default.join(promptDirPath, file.name);
+    const promptPath = import_node_path23.default.join(promptDirPath, file.name);
     const prompt = import_node_fs17.default.readFileSync(promptPath, "utf-8").trim();
     releases.push({ version, prompt, promptPath });
   }
@@ -7640,17 +7905,17 @@ function listAvailableUpgradeTargets(currentVersion, releases) {
 }
 function resolvePromptDirectory(explicitPath) {
   if (explicitPath) {
-    return import_node_path22.default.resolve(explicitPath);
+    return import_node_path23.default.resolve(explicitPath);
   }
-  const entryFile = process.argv[1] ? import_node_path22.default.resolve(process.argv[1]) : __filename;
-  const entryDir = import_node_path22.default.dirname(entryFile);
-  const resolvedEntryDir = import_node_fs17.default.existsSync(entryFile) ? import_node_path22.default.dirname(import_node_fs17.default.realpathSync(entryFile)) : entryDir;
+  const entryFile = process.argv[1] ? import_node_path23.default.resolve(process.argv[1]) : __filename;
+  const entryDir = import_node_path23.default.dirname(entryFile);
+  const resolvedEntryDir = import_node_fs17.default.existsSync(entryFile) ? import_node_path23.default.dirname(import_node_fs17.default.realpathSync(entryFile)) : entryDir;
   const candidates = [
-    import_node_path22.default.resolve(resolvedEntryDir, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path22.default.resolve(entryDir, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path22.default.resolve(__dirname, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path22.default.resolve(__dirname, "..", "..", UPGRADE_PROMPTS_DIR),
-    import_node_path22.default.resolve(process.cwd(), UPGRADE_PROMPTS_DIR)
+    import_node_path23.default.resolve(resolvedEntryDir, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path23.default.resolve(entryDir, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path23.default.resolve(__dirname, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path23.default.resolve(__dirname, "..", "..", UPGRADE_PROMPTS_DIR),
+    import_node_path23.default.resolve(process.cwd(), UPGRADE_PROMPTS_DIR)
   ];
   const existing = candidates.find((candidate) => import_node_fs17.default.existsSync(candidate));
   return existing ?? candidates[0];
@@ -7668,12 +7933,12 @@ function loadUpgradeCatalog(options = {}) {
     releases
   };
 }
-var import_node_fs17, import_node_path22, SEMVER_RE, UPGRADE_PROMPTS_DIR;
+var import_node_fs17, import_node_path23, SEMVER_RE, UPGRADE_PROMPTS_DIR;
 var init_upgrade = __esm({
   "src/core/upgrade.ts"() {
     "use strict";
     import_node_fs17 = __toESM(require("fs"));
-    import_node_path22 = __toESM(require("path"));
+    import_node_path23 = __toESM(require("path"));
     init_repo_config();
     SEMVER_RE = /^v?(\d+)\.(\d+)\.(\d+)$/;
     UPGRADE_PROMPTS_DIR = "upgrade-prompts";
@@ -7786,7 +8051,7 @@ function nativeAssetName(platform, arch) {
   return void 0;
 }
 function managedBinaryPath(cacheRoot, asset) {
-  return import_node_path23.default.join(cacheRoot, `v${SUPPORTED_DEVSY_VERSION}`, asset.name);
+  return import_node_path24.default.join(cacheRoot, `v${SUPPORTED_DEVSY_VERSION}`, asset.name);
 }
 function hashOpenFile(file) {
   const digest3 = (0, import_node_crypto14.createHash)("sha256");
@@ -7828,7 +8093,7 @@ function resolvedOptions(options) {
     platform: options.platform ?? process.platform,
     arch: options.arch ?? process.arch,
     versionOutput: options.versionOutput ?? installedVersionOutput(),
-    cacheRoot: options.cacheRoot ?? import_node_path23.default.join(CACHE_DIR, "devsy", "agents"),
+    cacheRoot: options.cacheRoot ?? import_node_path24.default.join(CACHE_DIR, "devsy", "agents"),
     lockPath: options.lockPath ?? DEVSY_AGENT_CACHE_LOCK,
     assets: options.assets ?? DEVSY_AGENT_ASSETS,
     nativeAssetName: options.nativeAssetName
@@ -7953,11 +8218,11 @@ function fsyncDirectory2(directory) {
   }
 }
 async function downloadAndPublish(asset, binaryPath, fetcher, githubCliDownloader) {
-  const directory = import_node_path23.default.dirname(binaryPath);
+  const directory = import_node_path24.default.dirname(binaryPath);
   import_node_fs18.default.mkdirSync(directory, { recursive: true, mode: 448 });
-  const temporaryPath = import_node_path23.default.join(
+  const temporaryPath = import_node_path24.default.join(
     directory,
-    `.${import_node_path23.default.basename(binaryPath)}.${process.pid}.${(0, import_node_crypto14.randomUUID)()}.tmp`
+    `.${import_node_path24.default.basename(binaryPath)}.${process.pid}.${(0, import_node_crypto14.randomUUID)()}.tmp`
   );
   let handle;
   try {
@@ -8041,7 +8306,7 @@ async function prepareDevsyAgent(options = {}) {
     throw new DevsyAgentReadinessError(before);
   }
   const lock = options.withLock ?? ((operation) => {
-    import_node_fs18.default.mkdirSync(import_node_path23.default.dirname(resolved.lockPath), { recursive: true });
+    import_node_fs18.default.mkdirSync(import_node_path24.default.dirname(resolved.lockPath), { recursive: true });
     return withFileLock(
       resolved.lockPath,
       {
@@ -8086,14 +8351,14 @@ async function prepareDevsyAgent(options = {}) {
     };
   });
 }
-var import_node_child_process10, import_node_crypto14, import_node_fs18, import_node_path23, SUPPORTED_DEVSY_VERSION, DEVSY_AGENT_SETUP_COMMAND, DEVSY_AGENT_ASSETS, DevsyAgentReadinessError, DEVSY_AGENT_CACHE_LOCK, DEVSY_AGENT_LOCK_WAIT_MS, GITHUB_CLI_STDERR_TAIL_BYTES;
+var import_node_child_process10, import_node_crypto14, import_node_fs18, import_node_path24, SUPPORTED_DEVSY_VERSION, DEVSY_AGENT_SETUP_COMMAND, DEVSY_AGENT_ASSETS, DevsyAgentReadinessError, DEVSY_AGENT_CACHE_LOCK, DEVSY_AGENT_LOCK_WAIT_MS, GITHUB_CLI_STDERR_TAIL_BYTES;
 var init_devsy_agent = __esm({
   "src/core/devsy-agent.ts"() {
     "use strict";
     import_node_child_process10 = require("child_process");
     import_node_crypto14 = require("crypto");
     import_node_fs18 = __toESM(require("fs"));
-    import_node_path23 = __toESM(require("path"));
+    import_node_path24 = __toESM(require("path"));
     init_file_lock();
     init_router();
     SUPPORTED_DEVSY_VERSION = "1.16.2";
@@ -8121,7 +8386,7 @@ var init_devsy_agent = __esm({
         this.name = "DevsyAgentReadinessError";
       }
     };
-    DEVSY_AGENT_CACHE_LOCK = import_node_path23.default.join(DEVROUTER_HOME, "devsy-agent-cache.lock");
+    DEVSY_AGENT_CACHE_LOCK = import_node_path24.default.join(DEVROUTER_HOME, "devsy-agent-cache.lock");
     DEVSY_AGENT_LOCK_WAIT_MS = 18e5;
     GITHUB_CLI_STDERR_TAIL_BYTES = 4096;
   }
@@ -8139,11 +8404,11 @@ function adapterFingerprint(adapter) {
   return (0, import_node_crypto15.createHash)("sha256").update(adapter).digest("hex");
 }
 function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path24.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterPath = import_node_path25.default.join(repoPath, MANAGED_ADAPTER_PATH);
   const adapterBytes = readRegularFileBytes(adapterPath);
   const adapterText = adapterBytes?.toString("utf-8");
-  const dockerfilePath = import_node_path24.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path24.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfilePath = import_node_path25.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path25.default.join(repoPath, ".devcontainer", "devcontainer.json");
   const dockerfile = readRegularFile(dockerfilePath) ?? "";
   const devcontainer = readRegularFile(devcontainerPath) ?? "";
   const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
@@ -8225,14 +8490,14 @@ function runManagedProcessAction(options) {
   }
   return "drifted";
 }
-var import_node_child_process11, import_node_crypto15, import_node_fs19, import_node_path24, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH;
+var import_node_child_process11, import_node_crypto15, import_node_fs19, import_node_path25, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH;
 var init_managed_post_start = __esm({
   "src/core/managed-post-start.ts"() {
     "use strict";
     import_node_child_process11 = require("child_process");
     import_node_crypto15 = require("crypto");
     import_node_fs19 = __toESM(require("fs"));
-    import_node_path24 = __toESM(require("path"));
+    import_node_path25 = __toESM(require("path"));
     init_devcontainer_config();
     MANAGED_MARKER = "devrouter:managed devcontainer";
     MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
@@ -8272,19 +8537,19 @@ function formatPublishedPort(serviceName, value) {
   if (typeof value === "string") {
     return `${serviceName}: ${value}`;
   }
-  const record3 = asRecord(value);
-  if (!record3) {
+  const record4 = asRecord(value);
+  if (!record4) {
     return void 0;
   }
-  const target = record3.target;
-  const published = record3.published;
+  const target = record4.target;
+  const published = record4.published;
   if (published !== void 0 && target !== void 0) {
     return `${serviceName}: ${String(published)}:${String(target)}`;
   }
   if (target !== void 0) {
     return `${serviceName}: target ${String(target)}`;
   }
-  return `${serviceName}: ${JSON.stringify(record3)}`;
+  return `${serviceName}: ${JSON.stringify(record4)}`;
 }
 function upstreamHost(upstream) {
   const separator = upstream.lastIndexOf(":");
@@ -8360,11 +8625,11 @@ function routedProxyApps(config) {
   );
 }
 function buildDevcontainerChecks(repoPath, config, workspace) {
-  const devcontainerDir = import_node_path25.default.join(repoPath, ".devcontainer");
+  const devcontainerDir = import_node_path26.default.join(repoPath, ".devcontainer");
   if (!import_node_fs20.default.existsSync(devcontainerDir)) {
     return [];
   }
-  const compose = inspectCompose(import_node_path25.default.join(devcontainerDir, "docker-compose.yml"), workspace);
+  const compose = inspectCompose(import_node_path26.default.join(devcontainerDir, "docker-compose.yml"), workspace);
   const checks = [];
   if (compose.parseError) {
     checks.push({
@@ -8391,7 +8656,7 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
     details: compose.publishedPorts.length > 0 ? compose.publishedPorts.join(", ") : void 0,
     suggestion: compose.parseError || compose.publishedPorts.length > 0 ? "Remove published ports and route services through devnet aliases with devrouter proxy apps." : void 0
   });
-  const dockerfilePath = import_node_path25.default.join(devcontainerDir, "Dockerfile");
+  const dockerfilePath = import_node_path26.default.join(devcontainerDir, "Dockerfile");
   const dockerfileExists = import_node_fs20.default.existsSync(dockerfilePath);
   const dockerfile = dockerfileExists ? import_node_fs20.default.readFileSync(dockerfilePath, "utf-8") : "";
   const devrouterArtifacts = ["@devrouter/cli", "devrouter-process"].filter(
@@ -8448,12 +8713,12 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
   });
   return checks;
 }
-var import_node_fs20, import_node_path25, import_yaml4;
+var import_node_fs20, import_node_path26, import_yaml4;
 var init_devcontainer_diagnostics = __esm({
   "src/core/devcontainer-diagnostics.ts"() {
     "use strict";
     import_node_fs20 = __toESM(require("fs"));
-    import_node_path25 = __toESM(require("path"));
+    import_node_path26 = __toESM(require("path"));
     import_yaml4 = __toESM(require("yaml"));
     init_managed_post_start();
   }
@@ -9393,11 +9658,22 @@ function listDevsyWorkspaces() {
     if (typeof candidate.id !== "string" || !source || typeof source.localFolder !== "string") {
       throw new Error("devsy workspace list returned a workspace without id/source.localFolder.");
     }
+    if (candidate.uid !== void 0 && typeof candidate.uid !== "string" || source.container !== void 0 && typeof source.container !== "string") {
+      throw new Error("Devsy workspace list returned invalid provider identity.");
+    }
     const workspace = {
       id: candidate.id,
-      source: { localFolder: source.localFolder },
+      source: {
+        localFolder: source.localFolder,
+        ...typeof source.container === "string" ? { container: source.container } : {}
+      },
+      ...typeof candidate.uid === "string" ? { uid: candidate.uid } : {},
       ...typeof candidate.context === "string" ? { context: candidate.context } : {}
     };
+    const provider = candidate.provider;
+    if (provider && typeof provider.name === "string") workspace.providerName = provider.name;
+    if (typeof provider?.options?.DOCKER_PATH?.value === "string")
+      workspace.dockerPathOption = provider.options.DOCKER_PATH.value;
     if ("lastUsed" in candidate) {
       if (typeof candidate.lastUsed === "string") {
         workspace.lastUsed = candidate.lastUsed;
@@ -9455,6 +9731,16 @@ function inspectDevsyWorkspaceOwnership(workspaces, devsyId, worktreePath) {
   }
   return exact[0] ? { status: "owned", workspace: exact[0] } : { status: "absent" };
 }
+function selectDevsyWorkspace(workspaces, repoPath) {
+  const matches = workspaces.filter(
+    (workspace) => sameWorkspacePath(workspace.source.localFolder, repoPath)
+  );
+  if (matches.length > 1) {
+    const ids = matches.map((match) => match.id).join(", ");
+    throw new Error(`Multiple Devsy workspaces reference '${repoPath}': ${ids}`);
+  }
+  return matches[0];
+}
 var import_node_child_process13;
 var init_devsy_workspaces = __esm({
   "src/core/devsy-workspaces.ts"() {
@@ -9662,20 +9948,20 @@ function resetWorkspaceRuntimeCaches() {
   cachedRuntime = void 0;
   cachedSnapshots = void 0;
 }
-var import_node_child_process14, import_node_fs23, import_node_path26, SUPPORTED_RUNTIMES2, RUNTIME_CONFIG_FILE, INACTIVITY_TIMEOUT_PATTERN, cachedRuntime, cachedSnapshots, UnsupportedWorkspaceRuntimeError, WorkspaceRuntimeOwnershipError;
+var import_node_child_process14, import_node_fs23, import_node_path27, SUPPORTED_RUNTIMES2, RUNTIME_CONFIG_FILE, INACTIVITY_TIMEOUT_PATTERN, cachedRuntime, cachedSnapshots, UnsupportedWorkspaceRuntimeError, WorkspaceRuntimeOwnershipError;
 var init_workspace_runtime = __esm({
   "src/core/workspace-runtime.ts"() {
     "use strict";
     import_node_child_process14 = require("child_process");
     import_node_fs23 = __toESM(require("fs"));
-    import_node_path26 = __toESM(require("path"));
+    import_node_path27 = __toESM(require("path"));
     init_atomic_file();
     init_devpod_registry();
     init_devsy_workspaces();
     init_router();
     init_workspace();
     SUPPORTED_RUNTIMES2 = ["devpod", "devsy"];
-    RUNTIME_CONFIG_FILE = import_node_path26.default.join(DEVROUTER_HOME, "workspace-runtime.json");
+    RUNTIME_CONFIG_FILE = import_node_path27.default.join(DEVROUTER_HOME, "workspace-runtime.json");
     INACTIVITY_TIMEOUT_PATTERN = /^(?:\d+(?:ms|s|m|h))+$/;
     UnsupportedWorkspaceRuntimeError = class extends Error {
     };
@@ -9753,7 +10039,7 @@ function parseMinimumNodeMajor(value) {
   return Number(match[1]);
 }
 function readPackageJson(repoPath) {
-  const packagePath = import_node_path27.default.join(repoPath, "package.json");
+  const packagePath = import_node_path28.default.join(repoPath, "package.json");
   if (!import_node_fs24.default.existsSync(packagePath)) {
     return void 0;
   }
@@ -9942,13 +10228,13 @@ function buildGlobalToolChecksWithoutTelemetry(repoPath) {
   checks.push(nodeToolchainCheck(repoPath));
   return checks;
 }
-var import_node_child_process15, import_node_fs24, import_node_path27, DEVSY_DISABLE_TELEMETRY;
+var import_node_child_process15, import_node_fs24, import_node_path28, DEVSY_DISABLE_TELEMETRY;
 var init_tool_diagnostics = __esm({
   "src/core/tool-diagnostics.ts"() {
     "use strict";
     import_node_child_process15 = require("child_process");
     import_node_fs24 = __toESM(require("fs"));
-    import_node_path27 = __toESM(require("path"));
+    import_node_path28 = __toESM(require("path"));
     init_devsy_agent();
     init_workspace_runtime();
     DEVSY_DISABLE_TELEMETRY = "DEVSY_DISABLE_TELEMETRY";
@@ -10054,6 +10340,54 @@ var init_devpod_workspaces = __esm({
   }
 });
 
+// src/core/managed-compose-population.ts
+function proveManagedComposePopulation(options) {
+  const { plan, repoPath, composeProject, featureDirectory, devsyRoot, containers: containers2 } = options;
+  const services = /* @__PURE__ */ new Set();
+  for (const container of containers2) {
+    const service = container.labels["com.docker.compose.service"] ?? "";
+    if (!plan.nativeRunServices.includes(service) || services.has(service) || container.labels["com.docker.compose.project"] !== composeProject || !sameWorkspacePath(
+      container.labels["com.docker.compose.project.working_dir"] ?? "",
+      plan.composeDirectory
+    )) {
+      throw new Error("Managed stop found unexpected or duplicate project membership.");
+    }
+    services.add(service);
+    const files = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").map((file) => file.trim());
+    if (files.some((file) => !file || !import_node_path29.default.isAbsolute(file)) || new Set(files.map((file) => import_node_path29.default.resolve(file))).size !== files.length || files.length < plan.composeFiles.length || plan.composeFiles.some((file, index) => !sameWorkspacePath(file, files[index]))) {
+      throw new Error("Managed stop Compose file identity changed.");
+    }
+    for (const file of files.slice(plan.composeFiles.length)) {
+      if (import_node_path29.default.dirname(file) !== featureDirectory || !/^docker-compose\.devcontainer\.containerFeatures-[a-zA-Z0-9_-]+\.yml$/.test(
+        import_node_path29.default.basename(file)
+      ) || import_node_fs25.default.realpathSync(file) !== import_node_path29.default.join(import_node_fs25.default.realpathSync(devsyRoot), import_node_path29.default.relative(devsyRoot, file))) {
+        throw new Error("Managed stop refuses a foreign or escaped provider Compose file.");
+      }
+    }
+  }
+  if (plan.desiredServices.some((service) => !services.has(service))) {
+    throw new Error("Managed stop cannot prove the complete retained service population.");
+  }
+  const primary = containers2.find(
+    (c) => c.labels["com.docker.compose.service"] === plan.primaryService
+  );
+  if (primary?.mounts.filter(
+    (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
+  ).length !== 1) {
+    throw new Error("Managed stop cannot prove the exact primary workspace mount.");
+  }
+  return primary;
+}
+var import_node_fs25, import_node_path29;
+var init_managed_compose_population = __esm({
+  "src/core/managed-compose-population.ts"() {
+    "use strict";
+    import_node_fs25 = __toESM(require("fs"));
+    import_node_path29 = __toESM(require("path"));
+    init_workspace();
+  }
+});
+
 // src/core/reliability-context.ts
 function claimLifecycleEffect() {
   claim?.();
@@ -10065,81 +10399,6 @@ var init_reliability_context = __esm({
   }
 });
 
-// src/core/route-publication.ts
-function routedAppsFromConfig(config) {
-  return config.apps.filter((app) => app.kind !== "dependency");
-}
-function configuredProxyAppsFromConfig(config) {
-  return routedAppsFromConfig(config).filter(
-    (app) => app.runtime === "proxy"
-  );
-}
-function proxyAppsFromConfig(config) {
-  const routedApps = routedAppsFromConfig(config);
-  const proxyApps = configuredProxyAppsFromConfig(config);
-  const unsupported = routedApps.filter((app) => app.runtime !== "proxy");
-  if (unsupported.length > 0) {
-    throw new Error(
-      `Environment reconciliation supports proxy runtime apps only; unsupported: ${unsupported.map((app) => `${app.name} (${app.runtime})`).join(", ")}`
-    );
-  }
-  return proxyApps;
-}
-async function ensureRouteInfrastructure(apps, options = {}) {
-  claimLifecycleEffect();
-  ensureRouterFiles();
-  await ensureNetwork(DEVNET_NAME);
-  claimLifecycleEffect();
-  const tlsCoverage = await ensureTLSHostsCovered(
-    apps.map((app) => app.host),
-    options
-  );
-  for (const app of apps) {
-    if (app.protocol === "tcp") {
-      if (!isTLSEnabled()) {
-        throw new Error(
-          `TCP route '${app.name}' requires TLS. Run: ${tlsSetupCommand(options.repoPath)}`
-        );
-      }
-      activateTcpProtocol(app.tcpProtocol);
-    }
-  }
-  claimLifecycleEffect();
-  startRouterStack();
-  return tlsCoverage;
-}
-async function replacePublishedProxyRoutes(repoPath, config, workspace, options = {}) {
-  const apps = proxyAppsFromConfig(config);
-  const tlsCoverage = options.prepareInfrastructure === false ? { refreshed: false } : await ensureRouteInfrastructure(apps, { repoPath });
-  const routes = apps.map((app) => {
-    const upstream = parseUpstream(app.upstream);
-    return {
-      name: app.name,
-      host: app.host,
-      protocol: app.protocol,
-      tcpProtocol: app.protocol === "tcp" ? app.tcpProtocol : void 0,
-      repoPath,
-      port: upstream.port,
-      mode: "proxy",
-      upstreamHost: upstream.upstreamHost,
-      workspace
-    };
-  });
-  claimLifecycleEffect();
-  replaceHostRoutesForRepo(repoPath, routes);
-  return { routes, tlsRefreshed: tlsCoverage.refreshed };
-}
-var init_route_publication = __esm({
-  "src/core/route-publication.ts"() {
-    "use strict";
-    init_docker();
-    init_host_routes();
-    init_reliability_context();
-    init_router();
-    init_tls();
-  }
-});
-
 // src/core/workspace-ownership.ts
 function commandError(command, repoPath, stderr) {
   return new Error(
@@ -10155,7 +10414,7 @@ function resolveGitCommonDir(repoPath) {
   if (result.status !== 0 || !output2) {
     throw commandError("Could not resolve the Git common directory", repoPath, result.stderr);
   }
-  return comparableWorkspacePath(import_node_path28.default.isAbsolute(output2) ? output2 : import_node_path28.default.resolve(repoPath, output2));
+  return comparableWorkspacePath(import_node_path30.default.isAbsolute(output2) ? output2 : import_node_path30.default.resolve(repoPath, output2));
 }
 function resolveGitTopLevel(repoPath) {
   const result = (0, import_node_child_process17.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
@@ -10206,7 +10465,7 @@ function listGitWorktrees(repoPath) {
   return worktrees;
 }
 function ownershipDirectory(repoPath) {
-  return import_node_path28.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
+  return import_node_path30.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
 }
 function validateWorkspace(value, label) {
   if (typeof value !== "string" || wsFromBranch(value) !== value) {
@@ -10234,7 +10493,7 @@ function validateRecord(value, expectedWorkspace) {
       `workspace ownership file '${expectedWorkspace}' contains identity '${workspace}'`
     );
   }
-  if (typeof candidate.worktreePath !== "string" || !import_node_path28.default.isAbsolute(candidate.worktreePath)) {
+  if (typeof candidate.worktreePath !== "string" || !import_node_path30.default.isAbsolute(candidate.worktreePath)) {
     throw new Error("invalid workspace ownership worktreePath");
   }
   if (candidate.branch !== null && typeof candidate.branch !== "string") {
@@ -10252,7 +10511,7 @@ function validateRecord(value, expectedWorkspace) {
   };
 }
 function recordPath(repoPath, workspace) {
-  return import_node_path28.default.join(
+  return import_node_path30.default.join(
     ownershipDirectory(repoPath),
     `${validateWorkspace(workspace, "workspace")}.json`
   );
@@ -10260,7 +10519,7 @@ function recordPath(repoPath, workspace) {
 function readRecordFile(filePath, expectedWorkspace) {
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs25.default.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(import_node_fs26.default.readFileSync(filePath, "utf-8"));
   } catch (error) {
     if (error instanceof SyntaxError) {
       throw new Error(`invalid workspace ownership JSON at '${filePath}'`);
@@ -10285,7 +10544,7 @@ function listWorkspaceOwnership(repoPath) {
 function listWorkspaceOwnershipInDirectory(directory) {
   let entries;
   try {
-    entries = import_node_fs25.default.readdirSync(directory, { withFileTypes: true });
+    entries = import_node_fs26.default.readdirSync(directory, { withFileTypes: true });
   } catch (error) {
     if (error.code === "ENOENT") return [];
     throw error;
@@ -10293,24 +10552,24 @@ function listWorkspaceOwnershipInDirectory(directory) {
   return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
     const workspace = entry.name.slice(0, -".json".length);
     validateWorkspace(workspace, "filename");
-    return readRecordFile(import_node_path28.default.join(directory, entry.name), workspace);
+    return readRecordFile(import_node_path30.default.join(directory, entry.name), workspace);
   });
 }
 function writeWorkspaceOwnershipInDirectory(directory, input2) {
   const workspace = validateWorkspace(input2.workspace, "workspace");
   const devpodId = validateWorkspace(input2.devpodId, "devpodId");
   const worktreePath = comparableWorkspacePath(input2.worktreePath);
-  const filePath = import_node_path28.default.join(directory, `${workspace}.json`);
+  const filePath = import_node_path30.default.join(directory, `${workspace}.json`);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const records = listWorkspaceOwnershipInDirectory(directory);
-  const existing = records.find((record4) => record4.workspace === workspace);
+  const existing = records.find((record5) => record5.workspace === workspace);
   if (existing && !sameWorkspacePath(existing.worktreePath, worktreePath)) {
     throw new Error(
       `Workspace '${workspace}' already belongs to '${existing.worktreePath}', refusing '${worktreePath}'.`
     );
   }
   const pathOwner = records.find(
-    (record4) => record4.workspace !== workspace && sameWorkspacePath(record4.worktreePath, worktreePath)
+    (record5) => record5.workspace !== workspace && sameWorkspacePath(record5.worktreePath, worktreePath)
   );
   if (pathOwner) {
     throw new Error(
@@ -10322,7 +10581,7 @@ function writeWorkspaceOwnershipInDirectory(directory, input2) {
       `Workspace '${workspace}' already owns DevPod '${existing.devpodId}', refusing '${devpodId}'.`
     );
   }
-  const record3 = {
+  const record4 = {
     version: OWNERSHIP_VERSION,
     workspace,
     worktreePath,
@@ -10331,14 +10590,14 @@ function writeWorkspaceOwnershipInDirectory(directory, input2) {
     createdAt: existing?.createdAt ?? validateTimestamp(now, "createdAt"),
     updatedAt: validateTimestamp(now, "updatedAt")
   };
-  writeFileAtomically(filePath, `${JSON.stringify(record3, null, 2)}
+  writeFileAtomically(filePath, `${JSON.stringify(record4, null, 2)}
 `);
-  return record3;
+  return record4;
 }
 function removeWorkspaceOwnershipInDirectory(directory, workspace) {
-  const filePath = import_node_path28.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
+  const filePath = import_node_path30.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
   try {
-    import_node_fs25.default.rmSync(filePath);
+    import_node_fs26.default.rmSync(filePath);
     return true;
   } catch (error) {
     if (error.code === "ENOENT") return false;
@@ -10349,7 +10608,7 @@ function sameOwnershipRecord(left, right) {
   return left.version === right.version && left.workspace === right.workspace && sameWorkspacePath(left.worktreePath, right.worktreePath) && left.branch === right.branch && left.devpodId === right.devpodId && left.createdAt === right.createdAt && left.updatedAt === right.updatedAt;
 }
 function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
-  const filePath = import_node_path28.default.join(
+  const filePath = import_node_path30.default.join(
     directory,
     `${validateWorkspace(expected.workspace, "workspace")}.json`
   );
@@ -10361,14 +10620,14 @@ function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
     throw error;
   }
   if (!sameOwnershipRecord(current, expected)) return "changed";
-  import_node_fs25.default.rmSync(filePath);
+  import_node_fs26.default.rmSync(filePath);
   return "removed";
 }
 function withWorkspaceOwnershipTransaction(repoPath, operation, options = {}) {
   const directory = ownershipDirectory(repoPath);
-  import_node_fs25.default.mkdirSync(directory, { recursive: true });
+  import_node_fs26.default.mkdirSync(directory, { recursive: true });
   return withFileLockSync(
-    import_node_path28.default.join(directory, ".lock"),
+    import_node_path30.default.join(directory, ".lock"),
     {
       activity: "workspace ownership transaction",
       target: `'${repoPath}'`,
@@ -10401,7 +10660,7 @@ function persistedWorkspaceOwners(repoPath, worktreePath) {
     try {
       workspace = readPersistedWorkspace(worktree.path);
     } catch (error) {
-      if (!import_node_fs25.default.existsSync(worktree.path)) continue;
+      if (!import_node_fs26.default.existsSync(worktree.path)) continue;
       throw error;
     }
     if (!workspace) continue;
@@ -10415,7 +10674,7 @@ function persistedWorkspaceOwners(repoPath, worktreePath) {
 }
 function claimConflict(workspace, devpodId, worktreePath, records, providerWorkspaces, persistedOwners, exactRecord) {
   const recordOwner = records.find(
-    (record3) => record3 !== exactRecord && (record3.workspace === workspace || record3.devpodId === devpodId)
+    (record4) => record4 !== exactRecord && (record4.workspace === workspace || record4.devpodId === devpodId)
   );
   if (recordOwner) {
     return `workspace owner record '${recordOwner.workspace}' for '${recordOwner.worktreePath}'`;
@@ -10438,7 +10697,7 @@ function claimWorkspaceIdentity(repoPath, input2) {
   return withWorkspaceOwnershipTransaction(repoPath, (transaction) => {
     const records = transaction.list();
     const exactRecords = records.filter(
-      (record3) => sameWorkspacePath(record3.worktreePath, worktreePath)
+      (record4) => sameWorkspacePath(record4.worktreePath, worktreePath)
     );
     if (exactRecords.length > 1) {
       throw new Error(
@@ -10552,11 +10811,11 @@ function removeWorkspaceOwnership(repoPath, workspace) {
     (transaction) => transaction.remove(workspace)
   );
 }
-function inspectWorkspaceOwnership(record3, worktrees, devpods) {
+function inspectWorkspaceOwnership(record4, worktrees, devpods) {
   const worktree = worktrees.find(
-    (candidate) => sameWorkspacePath(candidate.path, record3.worktreePath)
+    (candidate) => sameWorkspacePath(candidate.path, record4.worktreePath)
   );
-  const devpodOwnership = devpods ? inspectDevpodWorkspaceOwnership(devpods, record3.devpodId, record3.worktreePath) : void 0;
+  const devpodOwnership = devpods ? inspectDevpodWorkspaceOwnership(devpods, record4.devpodId, record4.worktreePath) : void 0;
   const devpodStatus = devpodOwnership?.status ?? "unknown";
   if (devpodStatus === "conflict") {
     return { ownerStatus: "conflict", devpodStatus, worktree };
@@ -10564,7 +10823,7 @@ function inspectWorkspaceOwnership(record3, worktrees, devpods) {
   if (worktree?.locked) {
     return { ownerStatus: "locked", devpodStatus, worktree };
   }
-  if ((!worktree || worktree.prunable) && import_node_fs25.default.existsSync(record3.worktreePath)) {
+  if ((!worktree || worktree.prunable) && import_node_fs26.default.existsSync(record4.worktreePath)) {
     return { ownerStatus: "conflict", devpodStatus, worktree };
   }
   if (!worktree || worktree.prunable) {
@@ -10577,7 +10836,7 @@ function inspectWorkspaceOwnership(record3, worktrees, devpods) {
     return { ownerStatus: "conflict", devpodStatus, worktree };
   }
   return {
-    ownerStatus: persisted === record3.workspace ? "present" : "conflict",
+    ownerStatus: persisted === record4.workspace ? "present" : "conflict",
     devpodStatus,
     worktree
   };
@@ -10585,23 +10844,231 @@ function inspectWorkspaceOwnership(record3, worktrees, devpods) {
 function listMissingWorkspaceOwnership(repoPath) {
   const worktrees = listGitWorktrees(repoPath);
   return listWorkspaceOwnership(repoPath).filter(
-    (record3) => inspectWorkspaceOwnership(record3, worktrees, void 0).ownerStatus === "missing"
+    (record4) => inspectWorkspaceOwnership(record4, worktrees, void 0).ownerStatus === "missing"
   );
 }
-var import_node_child_process17, import_node_fs25, import_node_path28, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
+var import_node_child_process17, import_node_fs26, import_node_path30, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
 var init_workspace_ownership = __esm({
   "src/core/workspace-ownership.ts"() {
     "use strict";
     import_node_child_process17 = require("child_process");
-    import_node_fs25 = __toESM(require("fs"));
-    import_node_path28 = __toESM(require("path"));
+    import_node_fs26 = __toESM(require("fs"));
+    import_node_path30 = __toESM(require("path"));
     init_atomic_file();
     init_devpod_workspaces();
     init_file_lock();
     init_workspace();
     READ_ONLY_GIT_ENV = { ...process.env, GIT_OPTIONAL_LOCKS: "0" };
     OWNERSHIP_VERSION = 1;
-    OWNERSHIP_DIR = import_node_path28.default.join("devrouter", "workspaces");
+    OWNERSHIP_DIR = import_node_path30.default.join("devrouter", "workspaces");
+  }
+});
+
+// src/core/managed-stop-recovery.ts
+function registration(state) {
+  resetWorkspaceRuntimeCaches();
+  if (resolveWorkspaceRuntimeOrDefault(state.repoPath) !== "devsy")
+    throw new Error("Stop provider changed.");
+  const owner = inspectDevsyWorkspaceOwnership(
+    listDevsyWorkspaces(),
+    state.devpodId,
+    state.repoPath
+  );
+  if (owner.status !== "owned") throw new Error("Stop requires one exact provider registration.");
+  if (isLinkedWorktree(state.repoPath)) {
+    const workspace = resolveWorktreeWorkspace(state.repoPath);
+    const record4 = workspace ? readWorkspaceOwnership(state.repoPath, workspace) : void 0;
+    if (!workspace || workspace !== state.workspace || !record4 || record4.devpodId !== state.devpodId || !sameWorkspacePath(record4.worktreePath, state.repoPath))
+      throw new Error("Stop workspace identity changed.");
+    resolveGitCommonDir(state.repoPath);
+  } else if (state.workspace !== void 0) throw new Error("Stop checkout identity changed.");
+  const value = owner.workspace;
+  return {
+    context: value.context ?? "",
+    providerId: value.id,
+    uid: value.uid ?? "",
+    sourcePath: value.source.localFolder,
+    sourceContainer: value.source.container ?? ""
+  };
+}
+function compareText(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+function orderedMounts(mounts) {
+  return mounts.map((mount) => ({ ...mount })).sort((a, b) => compareText(JSON.stringify(a), JSON.stringify(b)));
+}
+function identity(container) {
+  return {
+    id: container.id,
+    service: container.labels["com.docker.compose.service"] ?? "",
+    configFiles: (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").map((file) => file.trim()),
+    mounts: orderedMounts(container.mounts)
+  };
+}
+function prove(state, baseline) {
+  const owner = registration(state);
+  if (Object.entries(owner).some(
+    ([key, value]) => baseline[key] !== value
+  )) {
+    throw new Error("Retained provider identity changed.");
+  }
+  if (inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId)
+    throw new Error("Stop daemon changed.");
+  const containers2 = inspectManagedStopContainers(baseline.project, baseline.endpoint);
+  const expected = baseline.containers.map((container) => ({ ...container, mounts: orderedMounts(container.mounts) })).sort((a, b) => compareText(a.id, b.id));
+  const observed = containers2.map(identity).sort((a, b) => compareText(a.id, b.id));
+  if (!(0, import_node_util2.isDeepStrictEqual)(expected, observed) || containers2.some(
+    (container) => container.labels["com.docker.compose.project.working_dir"] !== baseline.composeDirectory
+  )) {
+    throw new Error("Retained container population or immutable identity changed.");
+  }
+  const workspaceIds = inspectManagedStopWorkspaceIds(
+    baseline.endpoint,
+    baseline.composeDirectory
+  ).sort();
+  if (!(0, import_node_util2.isDeepStrictEqual)(workspaceIds, expected.map((container) => container.id).sort())) {
+    throw new Error("Workspace contains an unrecorded container population.");
+  }
+  const primary = baseline.containers.find(
+    (container) => container.service === baseline.primaryService
+  );
+  if (!primary) throw new Error("Retained primary is missing.");
+  const uidBytes = Buffer.byteLength(baseline.uid);
+  const runnerId = uidBytes === 16 || uidBytes === 40 ? baseline.uid : baseline.providerId;
+  if (!baseline.sourceContainer && inspectManagedStopRunnerId(baseline.endpoint, primary.id) !== runnerId) {
+    throw new Error("Provider-to-container binding changed.");
+  }
+  if (!(0, import_node_util2.isDeepStrictEqual)(registration(state), owner) || inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId) {
+    throw new Error("Stop authority changed during inspection.");
+  }
+  return containers2;
+}
+function proveRetainedManagedStop(state) {
+  const baseline = validateManagedStopBaseline(state.stopBaseline, state);
+  if (!(0, import_node_util2.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state)) {
+    throw new Error("Retained stop generation changed.");
+  }
+  const result = prove(state, baseline);
+  if (!(0, import_node_util2.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state)) {
+    throw new Error("Retained stop generation changed during inspection.");
+  }
+  return result;
+}
+function stopFromManagedBaseline(state) {
+  const baseline = validateManagedStopBaseline(state.stopBaseline, state);
+  const stopped = /* @__PURE__ */ new Set();
+  for (const initial of proveRetainedManagedStop(state))
+    if (!initial.state.Running) stopped.add(initial.id);
+  const inspect = () => {
+    const current = proveRetainedManagedStop(state);
+    if (current.some((container) => stopped.has(container.id) && container.state.Running)) {
+      throw new Error("Retained container restarted during stop.");
+    }
+    for (const container of current) if (!container.state.Running) stopped.add(container.id);
+    return current;
+  };
+  for (const retained of baseline.containers) {
+    if (inspect().find((container) => container.id === retained.id)?.state.Running) {
+      claimLifecycleEffect();
+      stopPinnedManagedContainer(baseline.endpoint, retained.id);
+      if (inspect().find((container) => container.id === retained.id)?.state.Running)
+        throw new Error("Container cessation is not proven.");
+    }
+  }
+  if (inspect().some((container) => container.state.Running))
+    throw new Error("Retained workloads remain running.");
+}
+var import_node_os2, import_node_path31, import_node_util2;
+var init_managed_stop_recovery = __esm({
+  "src/core/managed-stop-recovery.ts"() {
+    "use strict";
+    import_node_os2 = __toESM(require("os"));
+    import_node_path31 = __toESM(require("path"));
+    import_node_util2 = require("util");
+    init_devpod_environment();
+    init_devsy_workspaces();
+    init_managed_compose_population();
+    init_managed_runtime_state();
+    init_managed_stop_baseline();
+    init_reliability_context();
+    init_workspace();
+    init_workspace_ownership();
+    init_workspace_runtime();
+  }
+});
+
+// src/core/route-publication.ts
+function routedAppsFromConfig(config) {
+  return config.apps.filter((app) => app.kind !== "dependency");
+}
+function configuredProxyAppsFromConfig(config) {
+  return routedAppsFromConfig(config).filter(
+    (app) => app.runtime === "proxy"
+  );
+}
+function proxyAppsFromConfig(config) {
+  const routedApps = routedAppsFromConfig(config);
+  const proxyApps = configuredProxyAppsFromConfig(config);
+  const unsupported = routedApps.filter((app) => app.runtime !== "proxy");
+  if (unsupported.length > 0) {
+    throw new Error(
+      `Environment reconciliation supports proxy runtime apps only; unsupported: ${unsupported.map((app) => `${app.name} (${app.runtime})`).join(", ")}`
+    );
+  }
+  return proxyApps;
+}
+async function ensureRouteInfrastructure(apps, options = {}) {
+  claimLifecycleEffect();
+  ensureRouterFiles();
+  await ensureNetwork(DEVNET_NAME);
+  claimLifecycleEffect();
+  const tlsCoverage = await ensureTLSHostsCovered(
+    apps.map((app) => app.host),
+    options
+  );
+  for (const app of apps) {
+    if (app.protocol === "tcp") {
+      if (!isTLSEnabled()) {
+        throw new Error(
+          `TCP route '${app.name}' requires TLS. Run: ${tlsSetupCommand(options.repoPath)}`
+        );
+      }
+      activateTcpProtocol(app.tcpProtocol);
+    }
+  }
+  claimLifecycleEffect();
+  startRouterStack();
+  return tlsCoverage;
+}
+async function replacePublishedProxyRoutes(repoPath, config, workspace, options = {}) {
+  const apps = proxyAppsFromConfig(config);
+  const tlsCoverage = options.prepareInfrastructure === false ? { refreshed: false } : await ensureRouteInfrastructure(apps, { repoPath });
+  const routes = apps.map((app) => {
+    const upstream = parseUpstream(app.upstream);
+    return {
+      name: app.name,
+      host: app.host,
+      protocol: app.protocol,
+      tcpProtocol: app.protocol === "tcp" ? app.tcpProtocol : void 0,
+      repoPath,
+      port: upstream.port,
+      mode: "proxy",
+      upstreamHost: upstream.upstreamHost,
+      workspace
+    };
+  });
+  claimLifecycleEffect();
+  replaceHostRoutesForRepo(repoPath, routes);
+  return { routes, tlsRefreshed: tlsCoverage.refreshed };
+}
+var init_route_publication = __esm({
+  "src/core/route-publication.ts"() {
+    "use strict";
+    init_docker();
+    init_host_routes();
+    init_reliability_context();
+    init_router();
+    init_tls();
   }
 });
 
@@ -10627,8 +11094,12 @@ function stopRetainedManagedDevsyWorkspace(options) {
   if (state.devpodId !== devsyId || linked && !workspace) {
     throw new Error("Managed stop requires the exact retained workspace identity.");
   }
+  if (state.stopBaseline) {
+    stopFromManagedBaseline(state);
+    return true;
+  }
   const workspaceEnv = workspace ? { token: workspace, gitCommonDir: resolveGitCommonDir(repoPath) } : void 0;
-  function registration() {
+  function registration2() {
     resetWorkspaceRuntimeCaches();
     if (resolveWorkspaceRuntimeOrDefault(repoPath) !== "devsy") {
       throw new Error("Managed stop provider selection changed.");
@@ -10638,19 +11109,19 @@ function stopRetainedManagedDevsyWorkspace(options) {
       throw new Error("Managed stop requires one exact retained Devsy registration.");
     }
     if (workspace) {
-      const record3 = readWorkspaceOwnership(repoPath, workspace);
-      if (!record3 || record3.devpodId !== devsyId || !sameWorkspacePath(record3.worktreePath, repoPath) || resolveWorktreeWorkspace(repoPath) !== workspace || resolveGitCommonDir(repoPath) !== workspaceEnv?.gitCommonDir) {
+      const record4 = readWorkspaceOwnership(repoPath, workspace);
+      if (!record4 || record4.devpodId !== devsyId || !sameWorkspacePath(record4.worktreePath, repoPath) || resolveWorktreeWorkspace(repoPath) !== workspace || resolveGitCommonDir(repoPath) !== workspaceEnv?.gitCommonDir) {
         throw new Error("Managed stop workspace ownership changed.");
       }
     }
     return owner.workspace;
   }
-  const context = registration().context;
+  const context = registration2().context;
   if (!context || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(context) || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(devsyId)) {
     throw new Error("Managed stop requires a valid exact Devsy context and workspace ID.");
   }
-  const devsyRoot = import_node_path29.default.resolve(process.env.DEVSY_HOME || import_node_path29.default.join(import_node_os2.default.homedir(), ".devsy"));
-  const featureDirectory = import_node_path29.default.join(
+  const devsyRoot = import_node_path32.default.resolve(process.env.DEVSY_HOME || import_node_path32.default.join(import_node_os3.default.homedir(), ".devsy"));
+  const featureDirectory = import_node_path32.default.join(
     devsyRoot,
     "contexts",
     context,
@@ -10659,8 +11130,8 @@ function stopRetainedManagedDevsyWorkspace(options) {
     "agent",
     ".docker-compose"
   );
-  function prove(previous) {
-    if (registration().context !== context || JSON.stringify(readManagedRuntimeState(repoPath, workspace)) !== JSON.stringify(state)) {
+  function prove2(previous) {
+    if (registration2().context !== context || JSON.stringify(readManagedRuntimeState(repoPath, workspace)) !== JSON.stringify(state)) {
       throw new Error("Managed stop retained context or runtime record changed.");
     }
     const runtime = loadRuntimeConfig(repoPath, workspace ?? "", state.profile);
@@ -10683,49 +11154,24 @@ function stopRetainedManagedDevsyWorkspace(options) {
       throw new Error("Managed stop requires unchanged recorded resources and configuration.");
     }
     const containers2 = inspectManagedStopContainers(state.composeProject);
-    const services = /* @__PURE__ */ new Set();
-    for (const container of containers2) {
-      const service = container.labels["com.docker.compose.service"] ?? "";
-      if (!plan.nativeRunServices.includes(service) || services.has(service) || container.labels["com.docker.compose.project"] !== state.composeProject || !sameWorkspacePath(
-        container.labels["com.docker.compose.project.working_dir"] ?? "",
-        plan.composeDirectory
-      )) {
-        throw new Error("Managed stop found unexpected or duplicate project membership.");
-      }
-      services.add(service);
-      const files = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").map((file) => file.trim());
-      if (files.some((file) => !file || !import_node_path29.default.isAbsolute(file)) || new Set(files.map((file) => import_node_path29.default.resolve(file))).size !== files.length || files.length < plan.composeFiles.length || plan.composeFiles.some((file, index) => !sameWorkspacePath(file, files[index]))) {
-        throw new Error("Managed stop Compose file identity changed.");
-      }
-      for (const file of files.slice(plan.composeFiles.length)) {
-        if (import_node_path29.default.dirname(file) !== featureDirectory || !/^docker-compose\.devcontainer\.containerFeatures-[a-zA-Z0-9_-]+\.yml$/.test(
-          import_node_path29.default.basename(file)
-        ) || import_node_fs26.default.realpathSync(file) !== import_node_path29.default.join(import_node_fs26.default.realpathSync(devsyRoot), import_node_path29.default.relative(devsyRoot, file))) {
-          throw new Error("Managed stop refuses a foreign or escaped provider Compose file.");
-        }
-      }
-      if (previous) {
-        const retained = previous.find((entry) => entry.id === container.id);
-        if (!retained || containerIdentity(retained) !== containerIdentity(container) || !retained.state.Running && container.state.Running) {
-          throw new Error("Managed stop container identity or quiescent state changed.");
-        }
-      }
-    }
-    if (plan.desiredServices.some((service) => !services.has(service)) || previous && !sameSet(
+    const primary = proveManagedComposePopulation({
+      plan,
+      repoPath,
+      composeProject: state.composeProject,
+      featureDirectory,
+      devsyRoot,
+      containers: containers2
+    });
+    if (previous && (!sameSet(
       previous.map((c) => c.id),
       containers2.map((c) => c.id)
-    )) {
-      throw new Error("Managed stop cannot prove the complete retained service population.");
-    }
-    const primary = containers2.find(
-      (c) => c.labels["com.docker.compose.service"] === plan.primaryService
-    );
-    if (primary?.mounts.filter(
-      (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
-    ).length !== 1) {
-      throw new Error("Managed stop cannot prove the exact primary workspace mount.");
+    ) || containers2.some((container) => {
+      const retained = previous.find((entry) => entry.id === container.id);
+      return !retained || containerIdentity(retained) !== containerIdentity(container) || !retained.state.Running && container.state.Running;
+    }))) {
+      throw new Error("Managed stop container identity or quiescent state changed.");
     }
-    if (registration().context !== context) {
+    if (registration2().context !== context) {
       throw new Error("Managed stop provider context changed during inspection.");
     }
     const status = inspectDevsyRuntimeStatus(devsyId);
@@ -10734,7 +11180,7 @@ function stopRetainedManagedDevsyWorkspace(options) {
     }
     return { containers: containers2, primary, status };
   }
-  const initial = prove();
+  const initial = prove2();
   let providerError;
   let providerFailed = false;
   if (initial.status === "running") {
@@ -10747,7 +11193,7 @@ function stopRetainedManagedDevsyWorkspace(options) {
   }
   try {
     const stopped = () => {
-      const current = prove(initial.containers);
+      const current = prove2(initial.containers);
       if (current.status !== "stopped" || current.primary.state.Running) {
         throw new Error("Managed stop has not stopped the exact primary container.");
       }
@@ -10779,17 +11225,18 @@ function stopRetainedManagedDevsyWorkspace(options) {
   if (providerFailed) throw providerError;
   return true;
 }
-var import_node_fs26, import_node_os2, import_node_path29;
+var import_node_os3, import_node_path32;
 var init_managed_devsy_stop = __esm({
   "src/core/managed-devsy-stop.ts"() {
     "use strict";
-    import_node_fs26 = __toESM(require("fs"));
-    import_node_os2 = __toESM(require("os"));
-    import_node_path29 = __toESM(require("path"));
+    import_node_os3 = __toESM(require("os"));
+    import_node_path32 = __toESM(require("path"));
     init_devcontainer_profile();
     init_devpod_environment();
     init_devsy_workspaces();
+    init_managed_compose_population();
     init_managed_runtime_state();
+    init_managed_stop_recovery();
     init_repo_config();
     init_route_publication();
     init_workspace();
@@ -10875,20 +11322,20 @@ function stopOwnedDevsyWorkspace(devsyId, worktreePath) {
 function deleteOwnedDevsyWorkspace(devsyId, worktreePath) {
   return mutateOwnedDevsyWorkspace("delete", devsyId, worktreePath);
 }
-var import_node_child_process18, import_node_fs27, import_node_path30, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS;
+var import_node_child_process18, import_node_fs27, import_node_path33, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS;
 var init_devsy_mutation = __esm({
   "src/core/devsy-mutation.ts"() {
     "use strict";
     import_node_child_process18 = require("child_process");
     import_node_fs27 = __toESM(require("fs"));
-    import_node_path30 = __toESM(require("path"));
+    import_node_path33 = __toESM(require("path"));
     init_devsy_agent();
     init_devsy_workspaces();
     init_file_lock();
     init_managed_devsy_stop();
     init_reliability_context();
     init_router();
-    DEVSY_MUTATION_LOCK_FILE = import_node_path30.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
+    DEVSY_MUTATION_LOCK_FILE = import_node_path33.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
     DEVSY_MUTATION_WAIT_MS = 18e5;
   }
 });
@@ -10981,20 +11428,20 @@ function deleteOwnedDevpodWorkspace(devpodId, worktreePath) {
   resetWorkspaceRuntimeCaches();
   return result;
 }
-var import_node_child_process19, import_node_fs28, import_node_path31, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS;
+var import_node_child_process19, import_node_fs28, import_node_path34, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS;
 var init_devpod_mutation = __esm({
   "src/core/devpod-mutation.ts"() {
     "use strict";
     import_node_child_process19 = require("child_process");
     import_node_fs28 = __toESM(require("fs"));
-    import_node_path31 = __toESM(require("path"));
+    import_node_path34 = __toESM(require("path"));
     init_devpod_workspaces();
     init_devsy_mutation();
     init_file_lock();
     init_reliability_context();
     init_router();
     init_workspace_runtime();
-    DEVPOD_MUTATION_LOCK_FILE = import_node_path31.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+    DEVPOD_MUTATION_LOCK_FILE = import_node_path34.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
     DEVPOD_MUTATION_WAIT_MS = 18e5;
   }
 });
@@ -11009,10 +11456,10 @@ function inRepositoryWorkspaceScope(repoPath, worktreePath, livePaths) {
   if (livePaths.some((candidate) => sameWorkspacePath(candidate, worktreePath))) return true;
   const comparableRepo = comparableWorkspacePath(repoPath);
   const comparableWorktree = comparableWorkspacePath(worktreePath);
-  const localRoot = import_node_path32.default.join(comparableRepo, "trees") + import_node_path32.default.sep;
+  const localRoot = import_node_path35.default.join(comparableRepo, "trees") + import_node_path35.default.sep;
   if (comparableWorktree.startsWith(localRoot)) return true;
-  const legacyPrefix = `${import_node_path32.default.basename(comparableRepo)}-`;
-  return import_node_path32.default.dirname(comparableWorktree) === import_node_path32.default.dirname(comparableRepo) && import_node_path32.default.basename(comparableWorktree).startsWith(legacyPrefix);
+  const legacyPrefix = `${import_node_path35.default.basename(comparableRepo)}-`;
+  return import_node_path35.default.dirname(comparableWorktree) === import_node_path35.default.dirname(comparableRepo) && import_node_path35.default.basename(comparableWorktree).startsWith(legacyPrefix);
 }
 function previewActions(devpodStatus, routeCount, includeRecord) {
   const actions = [
@@ -11041,15 +11488,15 @@ function ownedReason(ownerStatus) {
       return "Ownership conflicts with live Git, persisted token, or DevPod source evidence.";
   }
 }
-function ownedCandidate(record3, worktrees, devpods, routes) {
-  const status = inspectWorkspaceOwnership(record3, worktrees, devpods);
-  const routeCount = routesForOwner(routes, record3.workspace, record3.worktreePath).length;
+function ownedCandidate(record4, worktrees, devpods, routes) {
+  const status = inspectWorkspaceOwnership(record4, worktrees, devpods);
+  const routeCount = routesForOwner(routes, record4.workspace, record4.worktreePath).length;
   const eligible = status.ownerStatus === "missing" && status.devpodStatus !== "conflict";
   return {
     kind: "owned",
-    workspace: record3.workspace,
-    devpodId: record3.devpodId,
-    worktreePath: record3.worktreePath,
+    workspace: record4.workspace,
+    devpodId: record4.devpodId,
+    worktreePath: record4.worktreePath,
     ownerStatus: status.ownerStatus,
     devpodStatus: status.devpodStatus,
     routeCount,
@@ -11067,10 +11514,10 @@ function legacyCandidates(repoPath, records, worktrees, devpods, routes) {
   const primaryPath = worktrees[0]?.path;
   const evidence = /* @__PURE__ */ new Map();
   const isRecordedRoute = (workspace, worktreePath) => records.some(
-    (record3) => record3.workspace === workspace && sameWorkspacePath(record3.worktreePath, worktreePath)
+    (record4) => record4.workspace === workspace && sameWorkspacePath(record4.worktreePath, worktreePath)
   );
   const isRecordedDevpod = (devpodId, worktreePath) => records.some(
-    (record3) => record3.devpodId === devpodId && sameWorkspacePath(record3.worktreePath, worktreePath)
+    (record4) => record4.devpodId === devpodId && sameWorkspacePath(record4.worktreePath, worktreePath)
   );
   const key = (workspace, worktreePath) => `${workspace}\0${comparableWorkspacePath(worktreePath)}`;
   for (const devpod of devpods) {
@@ -11109,8 +11556,8 @@ function legacyCandidates(repoPath, records, worktrees, devpods, routes) {
   }));
 }
 function revalidateCandidate(candidate, repoPath, transaction) {
-  const record3 = transaction.list().find((entry) => entry.workspace === candidate.workspace);
-  if (!record3 || !sameWorkspacePath(record3.worktreePath, candidate.worktreePath) || record3.devpodId !== candidate.devpodId) {
+  const record4 = transaction.list().find((entry) => entry.workspace === candidate.workspace);
+  if (!record4 || !sameWorkspacePath(record4.worktreePath, candidate.worktreePath) || record4.devpodId !== candidate.devpodId) {
     return {
       status: "blocked",
       candidate: {
@@ -11126,12 +11573,12 @@ function revalidateCandidate(candidate, repoPath, transaction) {
     };
   }
   const fresh2 = ownedCandidate(
-    record3,
+    record4,
     listGitWorktrees(repoPath),
-    listDevpodWorkspaces(record3.worktreePath),
+    listDevpodWorkspaces(record4.worktreePath),
     listHostRouteState()
   );
-  if (fresh2.eligible) return { status: "ready", candidate: fresh2, record: record3 };
+  if (fresh2.eligible) return { status: "ready", candidate: fresh2, record: record4 };
   return {
     status: "blocked",
     candidate: {
@@ -11165,11 +11612,11 @@ function applyCandidate(candidate, repoPath) {
         };
       }
       if (revalidated.status === "blocked") return revalidated.candidate;
-      const { candidate: fresh2, record: record3 } = revalidated;
+      const { candidate: fresh2, record: record4 } = revalidated;
       const actions = [];
       let devpodStatus;
       try {
-        const mutation = deleteOwnedDevpodWorkspace(record3.devpodId, record3.worktreePath);
+        const mutation = deleteOwnedDevpodWorkspace(record4.devpodId, record4.worktreePath);
         devpodStatus = mutation.status === "changed" ? "owned" : "absent";
       } catch (error) {
         return { ...fresh2, actions: [failedAction("devpod", error)] };
@@ -11189,7 +11636,7 @@ function applyCandidate(candidate, repoPath) {
         return { ...fresh2, actions: [...actions, failedAction("routes", error)] };
       }
       try {
-        const removal = transaction.removeIfMatches(record3);
+        const removal = transaction.removeIfMatches(record4);
         if (removal === "changed") {
           throw new Error("Ownership record changed during cleanup; record was retained.");
         }
@@ -11235,10 +11682,10 @@ function inspectWorkspaceGc(repo) {
     // that owns each record (snapshot reads: the apply path revalidates
     // live); legacy detection scans both registries.
     ...records.map(
-      (record3) => ownedCandidate(
-        record3,
+      (record4) => ownedCandidate(
+        record4,
         worktrees,
-        listDevpodWorkspacesFromSnapshots(record3.worktreePath),
+        listDevpodWorkspacesFromSnapshots(record4.worktreePath),
         routes
       )
     ),
@@ -11264,11 +11711,11 @@ function applyWorkspaceGc(plan) {
     candidates
   };
 }
-var import_node_path32;
+var import_node_path35;
 var init_workspace_gc = __esm({
   "src/core/workspace-gc.ts"() {
     "use strict";
-    import_node_path32 = __toESM(require("path"));
+    import_node_path35 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_host_routes();
@@ -11621,7 +12068,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.60" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.62" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -11651,7 +12098,7 @@ async function buildDoctorReport(options = {}) {
         (app) => app.docker.composeFiles.map((filePath) => ({
           app: app.name,
           filePath,
-          absolutePath: import_node_path33.default.resolve(repo.path, filePath)
+          absolutePath: import_node_path36.default.resolve(repo.path, filePath)
         }))
       ).filter((entry) => !import_node_fs29.default.existsSync(entry.absolutePath));
       addCheck(checks, {
@@ -11696,7 +12143,7 @@ async function buildDoctorReport(options = {}) {
       const missingHostCwds = config.apps.filter((app) => app.runtime === "host").map((app) => ({
         app: app.name,
         cwd: app.hostRun.cwd,
-        absolutePath: import_node_path33.default.resolve(repo.path, app.hostRun.cwd)
+        absolutePath: import_node_path36.default.resolve(repo.path, app.hostRun.cwd)
       })).filter((entry) => !import_node_fs29.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.host-cwd",
@@ -11841,12 +12288,12 @@ async function buildDoctorReport(options = {}) {
     nextSteps
   };
 }
-var import_node_fs29, import_node_path33, import_yaml5, POSTGRES_DEFAULTS;
+var import_node_fs29, import_node_path36, import_yaml5, POSTGRES_DEFAULTS;
 var init_doctor = __esm({
   "src/core/doctor.ts"() {
     "use strict";
     import_node_fs29 = __toESM(require("fs"));
-    import_node_path33 = __toESM(require("path"));
+    import_node_path36 = __toESM(require("path"));
     import_yaml5 = __toESM(require("yaml"));
     init_docker();
     init_host_routes();
@@ -12254,8 +12701,98 @@ var init_up = __esm({
   }
 });
 
+// src/core/devsy-exec-proof.ts
+function proveLocalDockerSelection(workspace) {
+  const name = workspace.providerName;
+  const context = workspace.context;
+  if (!name || !context || !/^[a-z0-9][a-z0-9-]{0,31}$/.test(name) || !/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(context))
+    throw new Error("Retained exec provider configuration identity is unavailable.");
+  const file = import_node_path37.default.join(
+    process.env.DEVSY_HOME || import_node_path37.default.join(import_node_os4.default.homedir(), ".devsy"),
+    "contexts",
+    context,
+    "providers",
+    name,
+    "provider.json"
+  );
+  try {
+    if (import_node_fs30.default.statSync(file).size > 1024 * 1024) throw new Error();
+    const config = JSON.parse(import_node_fs30.default.readFileSync(file, "utf8"));
+    const driver = config.agent?.driver ?? "docker";
+    const configuredPath = config.agent?.docker?.path ?? "";
+    if (typeof configuredPath !== "string") throw new Error();
+    const command = configuredPath === "${DOCKER_PATH}" || configuredPath === "$DOCKER_PATH" ? workspace.dockerPathOption || process.env.DOCKER_PATH || "docker" : configuredPath || "docker";
+    if (config.name !== name || driver !== "docker" || command !== "docker") throw new Error();
+  } catch {
+    throw new Error("Retained exec requires a provider configured for the local Docker command.");
+  }
+  return name;
+}
+function captureDevsyExecProof(repoPath) {
+  repoPath = comparableWorkspacePath(repoPath);
+  const registry = listDevsyWorkspaces();
+  const workspace = selectDevsyWorkspace(registry, repoPath);
+  if (!workspace?.uid || !workspace.context || workspace.source.container || inspectDevsyWorkspaceOwnership(registry, workspace.id, repoPath).status !== "owned" || inspectDevsyRuntimeStatus(workspace.id) !== "running")
+    throw new Error("Retained exec requires one exact running Devsy registration.");
+  const providerName = proveLocalDockerSelection(workspace);
+  const endpoint = resolveManagedStopEndpoint();
+  if (!supportsManagedStopBaseline(endpoint))
+    throw new Error("Retained exec requires an exact local Docker endpoint.");
+  const daemon = inspectManagedStopDaemon(endpoint);
+  const candidates = workspaceAppContainers(inspectWorkspaceContainers(), repoPath).filter(
+    (container) => container.state.Running
+  );
+  if (candidates.length !== 1)
+    throw new Error("Retained exec requires one exact running primary container.");
+  const candidate = candidates[0];
+  const project = candidate.labels["com.docker.compose.project"];
+  if (!project) throw new Error("Retained exec primary has no Compose identity.");
+  const pinned = workspaceAppContainers(
+    inspectManagedStopContainers(project, endpoint),
+    repoPath
+  ).filter((container) => container.state.Running);
+  if (pinned.length !== 1 || pinned[0].id !== candidate.id)
+    throw new Error("Retained exec primary changed during inspection.");
+  const mounts = pinned[0].mounts.filter(
+    (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
+  );
+  if (mounts.length !== 1 || !mounts[0].Destination.startsWith("/"))
+    throw new Error("Retained exec requires one exact source mount.");
+  const uidBytes = Buffer.byteLength(workspace.uid);
+  const runner = uidBytes === 16 || uidBytes === 40 ? workspace.uid : workspace.id;
+  const runnerContainers = inspectProviderRunnerContainers(endpoint, runner);
+  if (runnerContainers.length !== 1 || runnerContainers[0] !== candidate.id)
+    throw new Error("Retained exec runner does not select the exact primary container.");
+  if (inspectManagedStopRunnerId(endpoint, candidate.id) !== runner || inspectManagedStopDaemon(endpoint) !== daemon)
+    throw new Error("Retained exec provider or Docker identity changed.");
+  return {
+    repoPath,
+    id: workspace.id,
+    uid: workspace.uid,
+    context: workspace.context,
+    providerName,
+    endpoint,
+    daemon,
+    containerId: candidate.id,
+    workspacePath: mounts[0].Destination
+  };
+}
+var import_node_fs30, import_node_os4, import_node_path37, import_node_util3;
+var init_devsy_exec_proof = __esm({
+  "src/core/devsy-exec-proof.ts"() {
+    "use strict";
+    import_node_fs30 = __toESM(require("fs"));
+    import_node_os4 = __toESM(require("os"));
+    import_node_path37 = __toESM(require("path"));
+    import_node_util3 = require("util");
+    init_devpod_environment();
+    init_devsy_workspaces();
+    init_workspace();
+  }
+});
+
 // src/core/reliability-model.ts
-function record2(value) {
+function record3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function oneOf2(value, values) {
@@ -12265,16 +12802,16 @@ function uniqueIds2(values) {
   return new Set(values).size === values.length && values.every(isReliabilityId);
 }
 function isFence(value) {
-  return record2(value) && isReliabilityId(value.environmentId) && isReliabilityCounter(value.intentRevision) && isReliabilityCounter(value.runtimeGeneration) && isReliabilityCounter(value.controllerEpoch);
+  return record3(value) && isReliabilityId(value.environmentId) && isReliabilityCounter(value.intentRevision) && isReliabilityCounter(value.runtimeGeneration) && isReliabilityCounter(value.controllerEpoch);
 }
 function isConsumer(value) {
-  return record2(value) && isReliabilityId(value.id) && typeof value.pinned === "boolean" && Array.isArray(value.requiredCapabilities) && value.requiredCapabilities.length <= 128 && uniqueIds2(value.requiredCapabilities);
+  return record3(value) && isReliabilityId(value.id) && typeof value.pinned === "boolean" && Array.isArray(value.requiredCapabilities) && value.requiredCapabilities.length <= 128 && uniqueIds2(value.requiredCapabilities);
 }
 function isObservation(value) {
-  return record2(value) && isReliabilityId(value.capability) && oneOf2(value.infrastructure, INFRASTRUCTURE_VALUES) && oneOf2(value.application, APPLICATION_VALUES) && isReliabilityCounter(value.observedAtMs) && isReliabilityCounter(value.validForMs);
+  return record3(value) && isReliabilityId(value.capability) && oneOf2(value.infrastructure, INFRASTRUCTURE_VALUES) && oneOf2(value.application, APPLICATION_VALUES) && isReliabilityCounter(value.observedAtMs) && isReliabilityCounter(value.validForMs);
 }
 function assertReliabilityEvent(value) {
-  if (!record2(value) || !isFence(value) || typeof value.type !== "string") {
+  if (!record3(value) || !isFence(value) || typeof value.type !== "string") {
     throw new Error("Invalid reliability event.");
   }
   let valid = false;
@@ -12283,7 +12820,7 @@ function assertReliabilityEvent(value) {
       valid = oneOf2(value.mode, ["start", "attach"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer);
       break;
     case "operation-request":
-      valid = oneOf2(value.kind, ["ensure", "exec"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer) && typeof value.runtimeRunning === "boolean";
+      valid = oneOf2(value.kind, ["ensure", "exec"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer) && typeof value.runtimeRunning === "boolean" && (value.recoverInterruptedEnsure === void 0 || typeof value.recoverInterruptedEnsure === "boolean");
       break;
     case "drained":
       valid = isReliabilityId(value.operationId);
@@ -12466,6 +13003,10 @@ function handleRequest(state, event) {
   });
   return transition(state, "accepted");
 }
+function canExecAfterInterruptedEnsure(state) {
+  const latestEnsure = [...state.operationHistory].reverse().find((operation) => operation.kind === "ensure");
+  return state.executionPolicy === "manual" && state.desired === "running" && latestEnsure?.status === "INTERRUPTED" && latestEnsure.drained && state.operation?.drained === true && (state.operation.kind === "ensure" && state.phase === "recovering" || state.operation.kind === "exec" && ["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status));
+}
 function handleOperationRequest(state, event) {
   if (state.executionPolicy !== "manual") return unchanged(state, "blocked");
   const previous = state.operationHistory.find((entry) => entry.key === event.key);
@@ -12476,20 +13017,33 @@ function handleOperationRequest(state, event) {
     );
   if (state.operationHistory.some((entry) => entry.id === event.operationId))
     return unchanged(state, "conflict");
-  if (state.operationHistory.length >= RELIABILITY_MAX_ITEMS) return unchanged(state, "blocked");
+  if (event.kind === "exec" && canExecAfterInterruptedEnsure(state) && event.recoverInterruptedEnsure !== true)
+    return unchanged(state, "blocked");
   const fullyStopped = state.stopProof.workloadsStopped && state.stopProof.routesRemoved;
   const reconcileEnsure = event.kind === "ensure" && state.operation?.kind === "ensure" && ["NOT_STARTED", "INTERRUPTED"].includes(state.operation.status);
-  if (state.operation && (!state.operation.drained || !["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status) && !fullyStopped && !reconcileEnsure))
+  if (state.operation && (!state.operation.drained || !["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status) && !fullyStopped && !reconcileEnsure && !(event.kind === "exec" && event.recoverInterruptedEnsure === true && canExecAfterInterruptedEnsure(state))))
     return unchanged(state, "blocked");
   if (state.phase === "stopping" || state.desired === "parked-for-capacity")
     return unchanged(state, "blocked");
   if (event.kind === "exec" && (!event.runtimeRunning || state.desired !== "running" && state.intentRevision !== 0))
     return unchanged(state, "blocked");
-  if (state.desired !== "running") {
+  const rollover = state.operationHistory.length >= RELIABILITY_MAX_ITEMS;
+  let retired = -1;
+  if (rollover) {
+    if (state.operation && (!state.operation.drained || !["COMPLETED", "NOT_LAUNCHED"].includes(state.operation.status)))
+      return unchanged(state, "blocked");
+    const latestEnsureId = [...state.operationHistory].reverse().find((entry) => entry.kind === "ensure")?.id;
+    retired = state.operationHistory.findIndex(
+      (entry) => entry.id !== state.operation?.id && entry.id !== latestEnsureId && entry.drained && ["COMPLETED", "NOT_LAUNCHED"].includes(entry.status)
+    );
+    if (retired === -1) return unchanged(state, "blocked");
+  }
+  if (state.desired !== "running" || rollover) {
     const revision = advance(state.intentRevision);
     if (revision === null) return unchanged(state, "blocked");
     state.intentRevision = revision;
   }
+  if (rollover) state.operationHistory.splice(retired, 1);
   state.desired = "running";
   state.phase = "queued";
   state.profile = event.profile;
@@ -12858,8 +13412,8 @@ var init_reliability_model = __esm({
 });
 
 // src/core/reliability-worker.ts
-function sameFence2(record3, fence) {
-  return Object.entries(reliabilityFence(record3.state)).every(
+function sameFence2(record4, fence) {
+  return Object.entries(reliabilityFence(record4.state)).every(
     ([key, value]) => value === fence[key]
   );
 }
@@ -12882,8 +13436,8 @@ function signalOwnedGroup(child, signal) {
 async function runLifecycleWorker(request) {
   if (process.platform === "win32")
     throw new Error("Lifecycle workers require POSIX process-group ownership.");
-  const workerPath = import_node_path34.default.join(__dirname, "devrouter-lifecycle-worker.js");
-  if (!import_node_fs30.default.existsSync(workerPath))
+  const workerPath = import_node_path38.default.join(__dirname, "devrouter-lifecycle-worker.js");
+  if (!import_node_fs31.default.existsSync(workerPath))
     throw new Error("The packaged lifecycle worker is missing; rebuild the CLI.");
   const child = (0, import_node_child_process21.fork)(workerPath, [], {
     detached: true,
@@ -12930,28 +13484,28 @@ async function runLifecycleWorker(request) {
             if (request.kind !== "stop") {
               const birth = processBirthIdentity(child.pid);
               if (!birth) throw new Error("Could not prove lifecycle worker incarnation.");
-              updateReliabilityOperation(request.identity, (record3) => {
-                if (!sameFence2(record3, request.fence) || record3.worker || record3.state.operation?.id !== request.operationId) {
+              updateReliabilityOperation(request.identity, (record4) => {
+                if (!sameFence2(record4, request.fence) || record4.worker || record4.state.operation?.id !== request.operationId) {
                   throw new Error("Lifecycle intent changed before dispatch.");
                 }
-                record3.worker = {
+                record4.worker = {
                   id: request.workerId,
                   operationId: request.operationId,
                   pid: child.pid,
                   birth
                 };
                 const transition2 = stepReliability(
-                  record3.state,
+                  record4.state,
                   { ...request.fence, type: "dispatch" },
                   Date.now()
                 );
                 if (transition2.outcome !== "accepted")
                   throw new Error("Lifecycle dispatch is blocked.");
-                record3.state = transition2.state;
+                record4.state = transition2.state;
               });
-              updateReliabilityOperation(request.identity, (record3) => {
+              updateReliabilityOperation(request.identity, (record4) => {
                 const transition2 = stepReliability(
-                  record3.state,
+                  record4.state,
                   {
                     ...request.fence,
                     type: "dispatch-persisted",
@@ -12959,7 +13513,7 @@ async function runLifecycleWorker(request) {
                   },
                   Date.now()
                 );
-                record3.state = transition2.state;
+                record4.state = transition2.state;
                 if (!transition2.effects.some((effect2) => effect2.kind === "launch")) {
                   throw new Error("Lifecycle dispatch persistence was not acknowledged.");
                 }
@@ -12973,8 +13527,8 @@ async function runLifecycleWorker(request) {
             });
             monitor = setInterval(() => {
               try {
-                const record3 = readReliabilityOperation(request.identity);
-                if (!record3 || !sameFence2(record3, request.fence)) cancel();
+                const record4 = readReliabilityOperation(request.identity);
+                if (!record4 || !sameFence2(record4, request.fence)) cancel();
               } catch (error) {
                 failure = error instanceof Error ? error : new Error(String(error));
                 cancel();
@@ -12991,13 +13545,13 @@ async function runLifecycleWorker(request) {
       child.once("close", () => {
         try {
           if (request.kind !== "stop") {
-            updateReliabilityOperation(request.identity, (record3) => {
-              if (record3.worker?.id !== request.workerId || record3.worker.pid !== child.pid) return;
+            updateReliabilityOperation(request.identity, (record4) => {
+              if (record4.worker?.id !== request.workerId || record4.worker.pid !== child.pid) return;
               if (!result) {
-                record3.state = stepReliability(
-                  record3.state,
+                record4.state = stepReliability(
+                  record4.state,
                   {
-                    ...reliabilityFence(record3.state),
+                    ...reliabilityFence(record4.state),
                     type: "interrupted",
                     operationId: request.operationId
                   },
@@ -13005,16 +13559,16 @@ async function runLifecycleWorker(request) {
                 ).state;
               }
               if (child.pid && workerGroupAbsent(child.pid)) {
-                record3.state = stepReliability(
-                  record3.state,
+                record4.state = stepReliability(
+                  record4.state,
                   {
-                    ...reliabilityFence(record3.state),
+                    ...reliabilityFence(record4.state),
                     type: "drained",
                     operationId: request.operationId
                   },
                   Date.now()
                 ).state;
-                record3.worker = null;
+                record4.worker = null;
               }
             });
           }
@@ -13041,14 +13595,14 @@ async function runLifecycleWorker(request) {
 function newLifecycleIds() {
   return { requestId: (0, import_node_crypto16.randomUUID)(), operationId: (0, import_node_crypto16.randomUUID)(), workerId: (0, import_node_crypto16.randomUUID)() };
 }
-var import_node_child_process21, import_node_crypto16, import_node_fs30, import_node_path34;
+var import_node_child_process21, import_node_crypto16, import_node_fs31, import_node_path38;
 var init_reliability_worker = __esm({
   "src/core/reliability-worker.ts"() {
     "use strict";
     import_node_child_process21 = require("child_process");
     import_node_crypto16 = require("crypto");
-    import_node_fs30 = __toESM(require("fs"));
-    import_node_path34 = __toESM(require("path"));
+    import_node_fs31 = __toESM(require("fs"));
+    import_node_path38 = __toESM(require("path"));
     init_file_lock();
     init_reliability_contract();
     init_reliability_model();
@@ -13057,12 +13611,12 @@ var init_reliability_worker = __esm({
 });
 
 // src/core/managed-host-preparation.ts
-var import_node_child_process22, import_node_fs31;
+var import_node_child_process22, import_node_fs32;
 var init_managed_host_preparation = __esm({
   "src/core/managed-host-preparation.ts"() {
     "use strict";
     import_node_child_process22 = require("child_process");
-    import_node_fs31 = __toESM(require("fs"));
+    import_node_fs32 = __toESM(require("fs"));
     init_repo_config();
   }
 });
@@ -13171,7 +13725,7 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
     throw new Error(
       "Traefik routes did not reload; shared router restart is disabled for this operation."
     );
-  import_node_fs32.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs33.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     ROUTER_RELOAD_LOCK_FILE,
     {
@@ -13202,19 +13756,19 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
 async function ensureTraefikRoutesRemoved(routes, options = {}) {
   return ensureTraefikRouteExpectation(routes, "removed", options);
 }
-var import_node_child_process23, import_node_fs32, import_node_path35, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, ROUTER_API_REQUEST_TIMEOUT_SECONDS, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, ROUTER_API_PAGE_SIZE;
+var import_node_child_process23, import_node_fs33, import_node_path39, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, ROUTER_API_REQUEST_TIMEOUT_SECONDS, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, ROUTER_API_PAGE_SIZE;
 var init_traefik_route_health = __esm({
   "src/core/traefik-route-health.ts"() {
     "use strict";
     import_node_child_process23 = require("child_process");
-    import_node_fs32 = __toESM(require("fs"));
-    import_node_path35 = __toESM(require("path"));
+    import_node_fs33 = __toESM(require("fs"));
+    import_node_path39 = __toESM(require("path"));
     init_file_lock();
     init_host_routes();
     init_reliability_context();
     init_router();
     ROUTER_API_BASE = "http://127.0.0.1:8080/api";
-    ROUTER_RELOAD_LOCK_FILE = import_node_path35.default.join(DEVROUTER_HOME, "router-reload.lock");
+    ROUTER_RELOAD_LOCK_FILE = import_node_path39.default.join(DEVROUTER_HOME, "router-reload.lock");
     ROUTER_API_REQUEST_TIMEOUT_SECONDS = "2";
     DEFAULT_INITIAL_TIMEOUT_MS = 3e3;
     DEFAULT_RECOVERY_TIMEOUT_MS = 1e4;
@@ -13253,17 +13807,18 @@ function resolveLinkedTarget(repoPath) {
     gitCommonDir: resolveGitCommonDir(repoPath)
   };
 }
-var import_node_child_process24, import_node_fs33, import_node_path36;
+var import_node_child_process24, import_node_fs34, import_node_path40;
 var init_workspace_ensure = __esm({
   "src/core/workspace-ensure.ts"() {
     "use strict";
     import_node_child_process24 = require("child_process");
-    import_node_fs33 = __toESM(require("fs"));
-    import_node_path36 = __toESM(require("path"));
+    import_node_fs34 = __toESM(require("fs"));
+    import_node_path40 = __toESM(require("path"));
     init_devcontainer_profile();
     init_devpod_environment();
     init_devpod_mutation();
     init_devpod_workspaces();
+    init_devsy_mutation();
     init_file_lock();
     init_host_routes();
     init_http_route_probe();
@@ -13271,6 +13826,7 @@ var init_workspace_ensure = __esm({
     init_managed_post_start();
     init_managed_runtime_state();
     init_managed_runtime_status();
+    init_managed_stop_recovery();
     init_reliability_lifecycle();
     init_repo_config();
     init_route_publication();
@@ -13292,50 +13848,51 @@ async function withLifecycleOperationLock(repoPath, operation) {
   }
   return withWorkspaceLifecycleLock(repoPath, operation);
 }
-function stepRecord(record3, event) {
-  const transition2 = stepReliability(record3.state, event, Date.now());
+function stepRecord(record4, event) {
+  const transition2 = stepReliability(record4.state, event, Date.now());
   if (!["accepted", "joined"].includes(transition2.outcome))
     throw new Error(`Lifecycle transition is ${transition2.outcome}.`);
-  record3.state = transition2.state;
+  record4.state = transition2.state;
 }
-function reconcileDrained(record3) {
-  const worker = record3.worker;
+function reconcileDrained(record4) {
+  const worker = record4.worker;
   if (!worker) {
-    if (record3.state.operation?.status === "NOT_STARTED" && !record3.state.operation.drained) {
-      stepRecord(record3, {
-        ...reliabilityFence(record3.state),
+    if (record4.state.operation?.status === "NOT_STARTED" && !record4.state.operation.drained) {
+      stepRecord(record4, {
+        ...reliabilityFence(record4.state),
         type: "drained",
-        operationId: record3.state.operation.id
+        operationId: record4.state.operation.id
       });
     }
     return;
   }
   if (processBirthIdentity(worker.pid) === worker.birth || !workerGroupAbsent(worker.pid)) return;
-  if (record3.state.operation) {
+  if (record4.state.operation) {
     const interrupted = stepReliability(
-      record3.state,
+      record4.state,
       {
-        ...reliabilityFence(record3.state),
+        ...reliabilityFence(record4.state),
         type: "interrupted",
         operationId: worker.operationId
       },
       Date.now()
     );
-    record3.state = interrupted.state;
-    stepRecord(record3, {
-      ...reliabilityFence(record3.state),
+    record4.state = interrupted.state;
+    stepRecord(record4, {
+      ...reliabilityFence(record4.state),
       type: "drained",
       operationId: worker.operationId
     });
-    record3.worker = null;
+    record4.worker = null;
   }
 }
 async function superviseLifecycle(kind, repoPath, options = {}, command) {
   repoPath = comparableWorkspacePath(repoPath);
   if (isLinkedWorktree(repoPath) && !readPersistedWorkspace(repoPath)) {
+    if (kind === "stop") throw new Error("Stop requires the existing linked workspace identity.");
     resolveLinkedTarget(repoPath);
   }
-  const identity = {
+  const identity2 = {
     repoPath,
     workspace: resolveWorktreeWorkspace(repoPath) ?? null,
     provider: resolveWorkspaceRuntimeOrDefault(repoPath)
@@ -13343,48 +13900,67 @@ async function superviseLifecycle(kind, repoPath, options = {}, command) {
   const ids = newLifecycleIds();
   let fence;
   const runtimeRunning = kind === "exec" ? Boolean(resolveRunningWorkspaceContainer(repoPath)) : false;
-  updateReliabilityOperation(identity, (record3) => {
-    reconcileDrained(record3);
+  const previous = kind === "exec" && identity2.provider === "devsy" ? updateReliabilityOperation(identity2, (record4) => {
+    reconcileDrained(record4);
+    return record4;
+  }) : void 0;
+  let retainedExecProof;
+  if (previous && !previous.worker && canExecAfterInterruptedEnsure(previous.state)) {
+    retainedExecProof = withMutationLock(
+      "Prove retained exec",
+      repoPath,
+      () => captureDevsyExecProof(repoPath)
+    );
+  }
+  updateReliabilityOperation(identity2, (record4) => {
+    reconcileDrained(record4);
+    if (retainedExecProof && record4.state.operation?.id !== previous?.state.operation?.id)
+      throw new Error("Lifecycle operation changed during retained exec proof.");
     if (kind === "stop") {
-      stepRecord(record3, { ...reliabilityFence(record3.state), type: "stop" });
+      stepRecord(record4, { ...reliabilityFence(record4.state), type: "stop" });
     } else {
-      if (record3.worker)
+      if (record4.worker)
         throw new Error(
           "An earlier lifecycle worker may still be active; use explicit stop to reconcile it."
         );
-      record3.outcome = null;
-      stepRecord(record3, {
-        ...reliabilityFence(record3.state),
+      record4.outcome = null;
+      stepRecord(record4, {
+        ...reliabilityFence(record4.state),
         type: "operation-request",
         kind,
         key: ids.requestId,
         operationId: ids.operationId,
-        profile: options.profile ?? record3.state.profile ?? "full",
+        profile: options.profile ?? record4.state.profile ?? "full",
         consumer: { id: "manual-cli", requiredCapabilities: [], pinned: false },
-        runtimeRunning
+        runtimeRunning,
+        ...retainedExecProof ? { recoverInterruptedEnsure: true } : {}
       });
     }
-    fence = reliabilityFence(record3.state);
+    fence = reliabilityFence(record4.state);
   });
   return runLifecycleWorker({
     kind,
     repoPath,
-    identity,
+    identity: identity2,
     ...ids,
     fence,
     options,
-    ...command ? { command } : {}
+    ...command ? { command } : {},
+    ...retainedExecProof ? { retainedExecProof } : {}
   });
 }
-var import_node_path37, activeWorker, lockHeld;
+var import_node_path41, activeWorker, lockHeld;
 var init_reliability_lifecycle = __esm({
   "src/core/reliability-lifecycle.ts"() {
     "use strict";
-    import_node_path37 = __toESM(require("path"));
+    import_node_path41 = __toESM(require("path"));
     init_devpod_environment();
+    init_devsy_exec_proof();
+    init_devsy_mutation();
     init_file_lock();
     init_host_routes();
     init_managed_runtime_state();
+    init_managed_stop_recovery();
     init_reliability_context();
     init_reliability_contract();
     init_reliability_model();
@@ -13788,17 +14364,17 @@ function asRecord3(value) {
   return value;
 }
 function readJson(filePath) {
-  if (!import_node_fs34.default.existsSync(filePath)) {
+  if (!import_node_fs35.default.existsSync(filePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs34.default.readFileSync(filePath, "utf-8"));
+    return JSON.parse(import_node_fs35.default.readFileSync(filePath, "utf-8"));
   } catch {
     return void 0;
   }
 }
 function relative(repoPath, filePath) {
-  return import_node_path38.default.relative(repoPath, filePath) || ".";
+  return import_node_path42.default.relative(repoPath, filePath) || ".";
 }
 function redactEnvAssignments(value) {
   return value.replace(
@@ -13839,7 +14415,7 @@ function inspectPackageManager(repoPath, pkg) {
     ["bun.lock", "bun"]
   ];
   for (const [fileName, name] of lockfiles) {
-    if (import_node_fs34.default.existsSync(import_node_path38.default.join(repoPath, fileName))) {
+    if (import_node_fs35.default.existsSync(import_node_path42.default.join(repoPath, fileName))) {
       return { name, source: fileName };
     }
   }
@@ -13854,9 +14430,9 @@ function inspectNode(repoPath, pkg) {
   if (typeof engines?.node === "string") {
     return { version: engines.node, source: "package.json:engines.node" };
   }
-  const nvmrc = import_node_path38.default.join(repoPath, ".nvmrc");
-  if (import_node_fs34.default.existsSync(nvmrc)) {
-    const version = import_node_fs34.default.readFileSync(nvmrc, "utf-8").trim();
+  const nvmrc = import_node_path42.default.join(repoPath, ".nvmrc");
+  if (import_node_fs35.default.existsSync(nvmrc)) {
+    const version = import_node_fs35.default.readFileSync(nvmrc, "utf-8").trim();
     return { version, source: ".nvmrc" };
   }
   return void 0;
@@ -13917,7 +14493,7 @@ function configuredComposeFiles(repoPath) {
     const files = config.apps.filter(
       (app) => app.runtime === "docker"
     ).flatMap((app) => app.docker.composeFiles).filter(
-      (fileName) => !import_node_path38.default.isAbsolute(fileName) && !import_node_path38.default.normalize(fileName).startsWith("..")
+      (fileName) => !import_node_path42.default.isAbsolute(fileName) && !import_node_path42.default.normalize(fileName).startsWith("..")
     );
     return Array.from(new Set(files));
   } catch {
@@ -13935,7 +14511,7 @@ function composeFiles(repoPath) {
     ...configuredComposeFiles(repoPath)
   ];
   return Array.from(new Set(candidates)).filter(
-    (fileName) => import_node_fs34.default.existsSync(import_node_path38.default.join(repoPath, fileName))
+    (fileName) => import_node_fs35.default.existsSync(import_node_path42.default.join(repoPath, fileName))
   );
 }
 function stringArray2(value) {
@@ -13948,8 +14524,8 @@ function envNames(value) {
   if (Array.isArray(value)) {
     return value.filter((entry) => typeof entry === "string").map((entry) => entry.split("=")[0]?.trim()).filter((entry) => Boolean(entry));
   }
-  const record3 = asRecord3(value);
-  return record3 ? Object.keys(record3).sort() : [];
+  const record4 = asRecord3(value);
+  return record4 ? Object.keys(record4).sort() : [];
 }
 function inferServiceKind(name, image) {
   const source = `${name} ${image ?? ""}`.toLowerCase();
@@ -13973,7 +14549,7 @@ function inspectServices(repoPath) {
   const services = [];
   for (const fileName of composeFiles(repoPath)) {
     try {
-      const parsed = import_yaml6.default.parse(import_node_fs34.default.readFileSync(import_node_path38.default.join(repoPath, fileName), "utf-8"));
+      const parsed = import_yaml6.default.parse(import_node_fs35.default.readFileSync(import_node_path42.default.join(repoPath, fileName), "utf-8"));
       const serviceMap = asRecord3(asRecord3(parsed)?.services);
       for (const [name, value] of Object.entries(serviceMap ?? {})) {
         const service = asRecord3(value);
@@ -14008,8 +14584,8 @@ function inspectServices(repoPath) {
   return services;
 }
 function inspectEnvFiles(repoPath) {
-  const files = import_node_fs34.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
-    const content = import_node_fs34.default.readFileSync(import_node_path38.default.join(repoPath, fileName), "utf-8");
+  const files = import_node_fs35.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
+    const content = import_node_fs35.default.readFileSync(import_node_path42.default.join(repoPath, fileName), "utf-8");
     const names = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=")[0]?.trim()).filter((name) => Boolean(name)).sort();
     return { path: fileName, names };
   });
@@ -14023,18 +14599,18 @@ function inspectEnvFiles(repoPath) {
   };
 }
 function inspectDevcontainer(repoPath) {
-  const dir = import_node_path38.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs34.default.existsSync(dir)) {
+  const dir = import_node_path42.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs35.default.existsSync(dir)) {
     return { exists: false, files: [] };
   }
   return {
     exists: true,
-    files: import_node_fs34.default.readdirSync(dir).filter((fileName) => import_node_fs34.default.statSync(import_node_path38.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
+    files: import_node_fs35.default.readdirSync(dir).filter((fileName) => import_node_fs35.default.statSync(import_node_path42.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
   };
 }
 function inspectDevrouter(repoPath) {
   const configPath = getRepoConfigPath(repoPath);
-  if (!import_node_fs34.default.existsSync(configPath)) {
+  if (!import_node_fs35.default.existsSync(configPath)) {
     return {
       exists: false,
       configPath,
@@ -14078,15 +14654,15 @@ function inspectAgentGuidance(repoPath) {
     ["AGENTS.md", "agents"],
     ["CLAUDE.md", "claude"]
   ]) {
-    if (import_node_fs34.default.existsSync(import_node_path38.default.join(repoPath, fileName))) {
+    if (import_node_fs35.default.existsSync(import_node_path42.default.join(repoPath, fileName))) {
       results.push({ path: fileName, kind });
     }
   }
-  const skillsDir = import_node_path38.default.join(repoPath, ".agents", "skills");
-  if (import_node_fs34.default.existsSync(skillsDir)) {
-    for (const name of import_node_fs34.default.readdirSync(skillsDir).sort()) {
-      const skillPath = import_node_path38.default.join(skillsDir, name, "SKILL.md");
-      if (import_node_fs34.default.existsSync(skillPath)) {
+  const skillsDir = import_node_path42.default.join(repoPath, ".agents", "skills");
+  if (import_node_fs35.default.existsSync(skillsDir)) {
+    for (const name of import_node_fs35.default.readdirSync(skillsDir).sort()) {
+      const skillPath = import_node_path42.default.join(skillsDir, name, "SKILL.md");
+      if (import_node_fs35.default.existsSync(skillPath)) {
         results.push({ path: relative(repoPath, skillPath), kind: "skill" });
       }
     }
@@ -14129,7 +14705,7 @@ function buildIssues(report) {
 }
 function inspectRepo(options = {}) {
   const repoPath = resolveRepoPath(options.repo);
-  const pkg = readJson(import_node_path38.default.join(repoPath, "package.json"));
+  const pkg = readJson(import_node_path42.default.join(repoPath, "package.json"));
   const scripts = inspectScripts(pkg);
   const reportWithoutIssues = {
     repoPath,
@@ -14148,12 +14724,12 @@ function inspectRepo(options = {}) {
     issues: buildIssues(reportWithoutIssues)
   };
 }
-var import_node_fs34, import_node_path38, import_yaml6;
+var import_node_fs35, import_node_path42, import_yaml6;
 var init_repo_inspect = __esm({
   "src/core/repo-inspect.ts"() {
     "use strict";
-    import_node_fs34 = __toESM(require("fs"));
-    import_node_path38 = __toESM(require("path"));
+    import_node_fs35 = __toESM(require("fs"));
+    import_node_path42 = __toESM(require("path"));
     import_yaml6 = __toESM(require("yaml"));
     init_repo_config();
   }
@@ -14258,7 +14834,7 @@ function requiredFileChecks(repoPath) {
     ".devcontainer/docker-compose.yml",
     ".devrouter.yml"
   ];
-  const missing = required.filter((fileName) => !import_node_fs35.default.existsSync(import_node_path39.default.join(repoPath, fileName)));
+  const missing = required.filter((fileName) => !import_node_fs36.default.existsSync(import_node_path43.default.join(repoPath, fileName)));
   return {
     id: "repo.devcontainer.verify-files",
     level: missing.length === 0 ? "ok" : "error",
@@ -14483,12 +15059,12 @@ async function verifyDevcontainer(options = {}) {
     nextSteps: collectNextSteps3(checks)
   };
 }
-var import_node_fs35, import_node_path39;
+var import_node_fs36, import_node_path43;
 var init_devcontainer_verify = __esm({
   "src/core/devcontainer-verify.ts"() {
     "use strict";
-    import_node_fs35 = __toESM(require("fs"));
-    import_node_path39 = __toESM(require("path"));
+    import_node_fs36 = __toESM(require("fs"));
+    import_node_path43 = __toESM(require("path"));
     init_capabilities();
     init_doctor();
     init_host_routes();
@@ -14785,7 +15361,7 @@ function packageManagerIssues(repo) {
 }
 function plannedFiles(repoPath, version) {
   const repo = inspectRepo({ repo: repoPath });
-  const projectName = sanitizeProjectName(import_node_path40.default.basename(repo.repoPath));
+  const projectName = sanitizeProjectName(import_node_path44.default.basename(repo.repoPath));
   const nodeMajor = majorVersion(repo.node?.version, "24");
   const pnpmVersion = repo.packageManager?.name === "pnpm" && repo.packageManager.version ? repo.packageManager.version : DEFAULT_PNPM_VERSION;
   const port = inferPort2(repo);
@@ -14830,8 +15406,8 @@ function plannedFiles(repoPath, version) {
   };
 }
 function classifyFile(repoPath, file) {
-  const absolutePath = import_node_path40.default.join(repoPath, file.relativePath);
-  if (!import_node_fs36.default.existsSync(absolutePath)) {
+  const absolutePath = import_node_path44.default.join(repoPath, file.relativePath);
+  if (!import_node_fs37.default.existsSync(absolutePath)) {
     return {
       path: file.relativePath,
       action: "create",
@@ -14839,7 +15415,7 @@ function classifyFile(repoPath, file) {
       bytes: Buffer.byteLength(file.content)
     };
   }
-  const current = import_node_fs36.default.readFileSync(absolutePath, "utf-8");
+  const current = import_node_fs37.default.readFileSync(absolutePath, "utf-8");
   if (!current.includes(MANAGED_MARKER2)) {
     return {
       path: file.relativePath,
@@ -14896,11 +15472,11 @@ function buildPlan(repoPath, dryRun, version) {
   };
 }
 function writeFile(repoPath, file) {
-  const absolutePath = import_node_path40.default.join(repoPath, file.relativePath);
-  import_node_fs36.default.mkdirSync(import_node_path40.default.dirname(absolutePath), { recursive: true });
-  import_node_fs36.default.writeFileSync(absolutePath, file.content, "utf-8");
+  const absolutePath = import_node_path44.default.join(repoPath, file.relativePath);
+  import_node_fs37.default.mkdirSync(import_node_path44.default.dirname(absolutePath), { recursive: true });
+  import_node_fs37.default.writeFileSync(absolutePath, file.content, "utf-8");
   if (file.executable) {
-    import_node_fs36.default.chmodSync(absolutePath, 493);
+    import_node_fs37.default.chmodSync(absolutePath, 493);
   }
 }
 function writeDevcontainer(options = {}) {
@@ -14938,12 +15514,12 @@ function writeDevcontainer(options = {}) {
     nextSteps: postWriteNextSteps(repoPath)
   };
 }
-var import_node_fs36, import_node_path40, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
+var import_node_fs37, import_node_path44, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
 var init_devcontainer_write = __esm({
   "src/core/devcontainer-write.ts"() {
     "use strict";
-    import_node_fs36 = __toESM(require("fs"));
-    import_node_path40 = __toESM(require("path"));
+    import_node_fs37 = __toESM(require("fs"));
+    import_node_path44 = __toESM(require("path"));
     init_repo_config();
     init_repo_inspect();
     MANAGED_MARKER2 = "devrouter:managed devcontainer";
@@ -15277,13 +15853,13 @@ function buildProfilePlanReport(options) {
   return { ...report, contractPath, bindings };
 }
 function loadContract(repoPath, contractPath) {
-  if (import_node_path41.default.isAbsolute(contractPath)) {
+  if (import_node_path45.default.isAbsolute(contractPath)) {
     fail3("profile plan contract path must be relative to the repository.");
   }
   const absolutePath = assertPathWithinRepo(contractPath, repoPath, "Profile plan contract");
   let metadata;
   try {
-    metadata = import_node_fs37.default.lstatSync(absolutePath);
+    metadata = import_node_fs38.default.lstatSync(absolutePath);
   } catch (error) {
     fail3(`could not inspect profile plan contract '${contractPath}': ${error.message}`);
   }
@@ -15293,16 +15869,16 @@ function loadContract(repoPath, contractPath) {
   if (metadata.size > MAX_CONTRACT_BYTES) {
     fail3(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
-  const realRepo = import_node_fs37.default.realpathSync(repoPath);
-  const realContract = import_node_fs37.default.realpathSync(absolutePath);
+  const realRepo = import_node_fs38.default.realpathSync(repoPath);
+  const realContract = import_node_fs38.default.realpathSync(absolutePath);
   assertPathWithinRepo(realContract, realRepo, "Profile plan contract");
-  const source = import_node_fs37.default.readFileSync(absolutePath, "utf-8");
+  const source = import_node_fs38.default.readFileSync(absolutePath, "utf-8");
   if (Buffer.byteLength(source, "utf-8") > MAX_CONTRACT_BYTES) {
     fail3(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
   return {
     contract: parseProfilePlanContract(source),
-    contractPath: import_node_path41.default.relative(repoPath, absolutePath).split(import_node_path41.default.sep).join("/")
+    contractPath: import_node_path45.default.relative(repoPath, absolutePath).split(import_node_path45.default.sep).join("/")
   };
 }
 function resolveProfilePlan(options) {
@@ -15316,12 +15892,12 @@ function resolveProfilePlan(options) {
     contractPath: loaded.contractPath
   });
 }
-var import_node_fs37, import_node_path41, import_yaml7, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
+var import_node_fs38, import_node_path45, import_yaml7, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
 var init_profile_plan = __esm({
   "src/core/profile-plan.ts"() {
     "use strict";
-    import_node_fs37 = __toESM(require("fs"));
-    import_node_path41 = __toESM(require("path"));
+    import_node_fs38 = __toESM(require("fs"));
+    import_node_path45 = __toESM(require("path"));
     import_yaml7 = require("yaml");
     init_paths();
     init_profile_resolution();
@@ -15353,7 +15929,7 @@ async function runProfileResolveCommand(options) {
 async function runProfilePlanCommand(options) {
   const report = resolveProfilePlan(options);
   if (options.output) {
-    writeFileAtomically(import_node_path42.default.resolve(options.output), `${JSON.stringify(report, null, 2)}
+    writeFileAtomically(import_node_path46.default.resolve(options.output), `${JSON.stringify(report, null, 2)}
 `);
   }
   if (options.json) {
@@ -15389,14 +15965,14 @@ function printProfilePlanSummary(report, output2) {
     process.stdout.write(`Binding ${key}: ${renderValues(report.bindings[key] ?? [])}
 `);
   }
-  if (output2) process.stdout.write(`Output: ${import_node_path42.default.resolve(output2)}
+  if (output2) process.stdout.write(`Output: ${import_node_path46.default.resolve(output2)}
 `);
 }
-var import_node_path42;
+var import_node_path46;
 var init_profile = __esm({
   "src/commands/profile.ts"() {
     "use strict";
-    import_node_path42 = __toESM(require("path"));
+    import_node_path46 = __toESM(require("path"));
     init_atomic_file();
     init_output();
     init_profile_plan();
@@ -15686,7 +16262,7 @@ function sanitizeRouterId(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function repoHash(repoPath) {
-  return (0, import_node_crypto17.createHash)("sha1").update(import_node_path43.default.resolve(repoPath)).digest("hex").slice(0, 12);
+  return (0, import_node_crypto17.createHash)("sha1").update(import_node_path47.default.resolve(repoPath)).digest("hex").slice(0, 12);
 }
 function asDockerApp(app) {
   return app.runtime === "docker";
@@ -15765,11 +16341,11 @@ function prepareDockerOverlay(repoPath, appName, apps, publishTcpPorts = false)
   if (dockerApps.length === 0) {
     throw new Error("No docker apps selected to prepare compose overlay.");
   }
-  const cachePath = import_node_path43.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
-  import_node_fs38.default.mkdirSync(cachePath, { recursive: true });
-  const overlayPath = import_node_path43.default.join(cachePath, "compose.devrouter.yml");
+  const cachePath = import_node_path47.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
+  import_node_fs39.default.mkdirSync(cachePath, { recursive: true });
+  const overlayPath = import_node_path47.default.join(cachePath, "compose.devrouter.yml");
   const overlayDocument = buildOverlayDocument(dockerApps, publishTcpPorts);
-  import_node_fs38.default.writeFileSync(overlayPath, import_yaml8.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
+  import_node_fs39.default.writeFileSync(overlayPath, import_yaml8.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
   return {
     overlayPath,
     composeFiles: ensureComposeFiles(dockerApps),
@@ -15889,14 +16465,14 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process27, import_node_crypto17, import_node_fs38, import_node_path43, import_yaml8;
+var import_node_child_process27, import_node_crypto17, import_node_fs39, import_node_path47, import_yaml8;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
     import_node_child_process27 = require("child_process");
     import_node_crypto17 = require("crypto");
-    import_node_fs38 = __toESM(require("fs"));
-    import_node_path43 = __toESM(require("path"));
+    import_node_fs39 = __toESM(require("fs"));
+    import_node_path47 = __toESM(require("path"));
     import_yaml8 = __toESM(require("yaml"));
     init_docker_error_guidance();
     init_paths();
@@ -16718,13 +17294,13 @@ function measureWorktreeConsumption(worktreePath, options) {
   const startedAt = Date.now();
   let rootStat;
   try {
-    rootStat = import_node_fs39.default.lstatSync(worktreePath);
+    rootStat = import_node_fs40.default.lstatSync(worktreePath);
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
   let rootEntries;
   try {
-    rootEntries = import_node_fs39.default.readdirSync(worktreePath, { withFileTypes: true });
+    rootEntries = import_node_fs40.default.readdirSync(worktreePath, { withFileTypes: true });
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
@@ -16750,10 +17326,10 @@ function measureWorktreeConsumption(worktreePath, options) {
         timedOut = true;
         break;
       }
-      const entryPath = import_node_path44.default.join(dirPath, entry.name);
+      const entryPath = import_node_path48.default.join(dirPath, entry.name);
       let entryStat;
       try {
-        entryStat = import_node_fs39.default.lstatSync(entryPath);
+        entryStat = import_node_fs40.default.lstatSync(entryPath);
       } catch (error) {
         if (error?.code === "ENOENT") continue;
         unreadableReason = describeIncompleteWalk(error);
@@ -16763,7 +17339,7 @@ function measureWorktreeConsumption(worktreePath, options) {
       if (!entryStat.isDirectory()) continue;
       let childEntries;
       try {
-        childEntries = import_node_fs39.default.readdirSync(entryPath, { withFileTypes: true });
+        childEntries = import_node_fs40.default.readdirSync(entryPath, { withFileTypes: true });
       } catch (error) {
         unreadableReason = describeIncompleteWalk(error);
         break;
@@ -16827,12 +17403,12 @@ function describeError(error, worktreePath) {
   }
   return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
 }
-var import_node_fs39, import_node_path44, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var import_node_fs40, import_node_path48, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
 var init_workspace_consumption = __esm({
   "src/core/workspace-consumption.ts"() {
     "use strict";
-    import_node_fs39 = __toESM(require("fs"));
-    import_node_path44 = __toESM(require("path"));
+    import_node_fs40 = __toESM(require("fs"));
+    import_node_path48 = __toESM(require("path"));
     init_devpod_environment();
     DEFAULT_DEADLINE_MS = 1e4;
     BLOCK_SIZE_BYTES = 512;
@@ -16933,7 +17509,7 @@ function evaluateWorkspaceActivity(evidence, cutoff) {
 }
 function readGitSnapshot(worktree, commandRunner) {
   const comparablePath = comparableWorkspacePath(worktree.path);
-  if (worktree.prunable || !import_node_fs40.default.existsSync(comparablePath)) {
+  if (worktree.prunable || !import_node_fs41.default.existsSync(comparablePath)) {
     return { worktree, checkout: "missing", head: null, committerDate: null };
   }
   const head = gitOutput(comparablePath, ["rev-parse", "--verify", "HEAD"], commandRunner);
@@ -17082,8 +17658,8 @@ function inspectWorkspaceIntegration(repoPath, snapshot, branch, checkMerged, co
     return { status: "unknown", reason: "Current HEAD or branch evidence is unavailable." };
   }
   const originUrl = gitOutput(repoPath, ["config", "--get", "remote.origin.url"], commandRunner);
-  const identity = originUrl ? parseRemoteIdentity(originUrl) : void 0;
-  if (!identity) {
+  const identity2 = originUrl ? parseRemoteIdentity(originUrl) : void 0;
+  if (!identity2) {
     return { status: "unknown", reason: "The origin is missing or uses an unsupported forge." };
   }
   const localTargetBranch = parseTargetBranch(
@@ -17128,11 +17704,11 @@ function inspectWorkspaceIntegration(repoPath, snapshot, branch, checkMerged, co
     };
   }
   const forgeChanges = [];
-  const forgeCommand = identity.provider === "github" ? [
+  const forgeCommand = identity2.provider === "github" ? [
     "pr",
     "list",
     "--repo",
-    identity.project,
+    identity2.project,
     "--state",
     "all",
     "--head",
@@ -17143,20 +17719,20 @@ function inspectWorkspaceIntegration(repoPath, snapshot, branch, checkMerged, co
     "mr",
     "list",
     "--repo",
-    identity.project,
+    identity2.project,
     "--all",
     "--source-branch",
     branch,
     "--output",
     "json"
   ];
-  const forge = commandRunner(identity.provider === "github" ? "gh" : "glab", forgeCommand);
+  const forge = commandRunner(identity2.provider === "github" ? "gh" : "glab", forgeCommand);
   if (forge.status !== 0 || forge.error) {
     return { status: "unknown", reason: "The forge query was unavailable or unauthenticated." };
   }
   try {
     const parsed = JSON.parse(forge.stdout);
-    const changes = identity.provider === "github" ? parseGitHubChanges(parsed, identity.project, branch) : parseGitLabChanges(parsed, identity.project, branch);
+    const changes = identity2.provider === "github" ? parseGitHubChanges(parsed, identity2.project, branch) : parseGitLabChanges(parsed, identity2.project, branch);
     if (!changes) {
       return { status: "unknown", reason: "The forge response was malformed." };
     }
@@ -17222,31 +17798,31 @@ function inspectWorkspaceIntegration(repoPath, snapshot, branch, checkMerged, co
     reason: "Fresh target and forge evidence did not prove integration."
   };
 }
-function routeStatus(record3, routes) {
+function routeStatus(record4, routes) {
   if (!routes) return "unknown";
   const matchingPath = routes.filter(
-    (route) => sameWorkspacePath(route.repoPath, record3.worktreePath)
+    (route) => sameWorkspacePath(route.repoPath, record4.worktreePath)
   );
   if (matchingPath.length === 0) return "absent";
-  return matchingPath.every((route) => route.workspace === record3.workspace) ? "owned" : "conflict";
+  return matchingPath.every((route) => route.workspace === record4.workspace) ? "owned" : "conflict";
 }
-function buildActivityEvidence(record3, providerStatus, provider, routeEntries, git) {
+function buildActivityEvidence(record4, providerStatus, provider, routeEntries, git) {
   const providerEvidence = providerStatus === "unknown" || providerStatus === "conflict" ? { source: "devpod.lastUsed", status: "unavailable" } : providerStatus === "absent" ? { source: "devpod.lastUsed", status: "not-applicable" } : provider?.lastUsedMalformed ? { source: "devpod.lastUsed", status: "malformed" } : provider?.lastUsed ? validTimestamp(provider.lastUsed) ? { source: "devpod.lastUsed", status: "valid", timestamp: provider.lastUsed } : { source: "devpod.lastUsed", status: "malformed" } : { source: "devpod.lastUsed", status: "missing" };
   const routeTimestamps = routeEntries?.map((route) => route.updatedAt) ?? [];
   const malformedRoute = routeTimestamps.some((timestamp) => !validTimestamp(timestamp));
   const newestRoute = routeTimestamps.filter(validTimestamp).sort((left, right) => (parseTimestamp(right) ?? 0) - (parseTimestamp(left) ?? 0))[0];
   const routeEvidence = !routeEntries ? { source: "route.updatedAt", status: "unavailable" } : routeEntries.length === 0 ? { source: "route.updatedAt", status: "not-applicable" } : malformedRoute ? { source: "route.updatedAt", status: "malformed" } : newestRoute ? { source: "route.updatedAt", status: "valid", timestamp: newestRoute } : { source: "route.updatedAt", status: "malformed" };
-  const ownerEvidence = validTimestamp(record3.updatedAt) ? { source: "ownership.updatedAt", status: "valid", timestamp: record3.updatedAt } : { source: "ownership.updatedAt", status: "malformed" };
+  const ownerEvidence = validTimestamp(record4.updatedAt) ? { source: "ownership.updatedAt", status: "valid", timestamp: record4.updatedAt } : { source: "ownership.updatedAt", status: "malformed" };
   const gitEvidence = git.checkout === "missing" ? { source: "git.headCommitterDate", status: "not-applicable" } : git.committerDate && validTimestamp(git.committerDate) ? { source: "git.headCommitterDate", status: "valid", timestamp: git.committerDate } : git.checkout === "unknown" ? { source: "git.headCommitterDate", status: "unavailable" } : { source: "git.headCommitterDate", status: "malformed" };
   return [providerEvidence, routeEvidence, ownerEvidence, gitEvidence];
 }
-function buildSuggestions(repoPath, record3, ownership, provider, runtime, checkout, route, activity, integration, worktree, checkMerged) {
+function buildSuggestions(repoPath, record4, ownership, provider, runtime, checkout, route, activity, integration, worktree, checkMerged) {
   const reasons = [];
   const eligibleActions = [];
   const suggestions = [];
   const gcCommand = workspaceCommand(repoPath, ["gc"], [], ["--yes"]);
-  const keepCommand = workspaceCommand(repoPath, ["down", record3.workspace], ["--keep-worktree"]);
-  const downCommand = workspaceCommand(repoPath, ["down", record3.workspace]);
+  const keepCommand = workspaceCommand(repoPath, ["down", record4.workspace], ["--keep-worktree"]);
+  const downCommand = workspaceCommand(repoPath, ["down", record4.workspace]);
   const routeSafe = route === "owned" || route === "absent";
   const checkoutSafe = checkout === "clean" && !worktree?.locked;
   const providerSafe = provider === "owned";
@@ -17324,17 +17900,17 @@ function buildSuggestions(repoPath, record3, ownership, provider, runtime, check
   }
   return { eligibleActions, suggestions, reasons };
 }
-function buildRow(repoPath, record3, worktrees, devpods, routes, snapshot, cutoff, checkMerged, commandRunner, inspectOwnershipFn, inspectIntegrationFn, inspectRuntimeFn) {
-  const ownershipEvidence = inspectOwnershipFn(record3, worktrees, devpods);
+function buildRow(repoPath, record4, worktrees, devpods, routes, snapshot, cutoff, checkMerged, commandRunner, inspectOwnershipFn, inspectIntegrationFn, inspectRuntimeFn) {
+  const ownershipEvidence = inspectOwnershipFn(record4, worktrees, devpods);
   const providerOwnership = devpods?.find(
-    (devpod) => devpod.id === record3.devpodId && sameWorkspacePath(devpod.source.localFolder, record3.worktreePath)
+    (devpod) => devpod.id === record4.devpodId && sameWorkspacePath(devpod.source.localFolder, record4.worktreePath)
   );
   const matchingRoutes = routes?.filter(
-    (route) => sameWorkspacePath(route.repoPath, record3.worktreePath)
+    (route) => sameWorkspacePath(route.repoPath, record4.worktreePath)
   );
   const activity = evaluateWorkspaceActivity(
     buildActivityEvidence(
-      record3,
+      record4,
       ownershipEvidence.devpodStatus,
       providerOwnership,
       matchingRoutes,
@@ -17342,23 +17918,23 @@ function buildRow(repoPath, record3, worktrees, devpods, routes, snapshot, cutof
     ),
     cutoff
   );
-  const branch = snapshot.checkout === "detached" ? null : snapshot.worktree.branch ?? record3.branch;
+  const branch = snapshot.checkout === "detached" ? null : snapshot.worktree.branch ?? record4.branch;
   const integration = inspectIntegrationFn?.(repoPath, snapshot, branch, checkMerged) ?? inspectWorkspaceIntegration(repoPath, snapshot, branch, checkMerged, commandRunner);
   const runtime = ownershipEvidence.devpodStatus === "absent" ? "absent" : ownershipEvidence.devpodStatus === "owned" ? (() => {
     try {
-      return inspectRuntimeFn(record3.devpodId);
+      return inspectRuntimeFn(record4.devpodId);
     } catch {
       return "unknown";
     }
   })() : "unknown";
   const suggestions = buildSuggestions(
     repoPath,
-    record3,
+    record4,
     ownershipEvidence.ownerStatus,
     ownershipEvidence.devpodStatus,
     runtime,
     snapshot.checkout,
-    routeStatus(record3, routes),
+    routeStatus(record4, routes),
     activity.status,
     integration,
     snapshot.worktree,
@@ -17369,7 +17945,7 @@ function buildRow(repoPath, record3, worktrees, devpods, routes, snapshot, cutof
     `provider=${ownershipEvidence.devpodStatus}`,
     `runtime=${runtime}`,
     `checkout=${snapshot.checkout}`,
-    `route=${routeStatus(record3, routes)}`,
+    `route=${routeStatus(record4, routes)}`,
     `activity=${activity.status}`,
     `integration=${integration.status}`,
     ...integration.reason ? [integration.reason] : [],
@@ -17377,16 +17953,16 @@ function buildRow(repoPath, record3, worktrees, devpods, routes, snapshot, cutof
   ];
   return {
     schemaVersion: 2,
-    workspace: record3.workspace,
+    workspace: record4.workspace,
     branch,
     repo: repoPath,
-    worktreePath: record3.worktreePath,
-    devpodId: record3.devpodId,
+    worktreePath: record4.worktreePath,
+    devpodId: record4.devpodId,
     ownership: ownershipEvidence.ownerStatus,
     provider: ownershipEvidence.devpodStatus,
     runtime,
     checkout: snapshot.checkout,
-    route: routeStatus(record3, routes),
+    route: routeStatus(record4, routes),
     activity: activity.status,
     cutoff,
     latestTimestamp: activity.latestTimestamp,
@@ -17453,30 +18029,30 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
   const measureContainersFn = dependencies.measureContainers ?? measureContainerConsumption;
   let containers2 = /* @__PURE__ */ new Map();
   if (measureSize) {
-    const worktreePaths = records.map((record3) => record3.worktreePath);
+    const worktreePaths = records.map((record4) => record4.worktreePath);
     try {
       containers2 = measureContainersFn(worktreePaths);
     } catch (error) {
       const reason = `container measurement failed: ${describeCause(error)}`;
-      containers2 = new Map(worktreePaths.map((path45) => [path45, unknownContainers(reason)]));
+      containers2 = new Map(worktreePaths.map((path49) => [path49, unknownContainers(reason)]));
     }
   }
-  const rows = records.map((record3) => {
+  const rows = records.map((record4) => {
     const worktree = worktrees.find(
-      (candidate) => sameWorkspacePath(candidate.path, record3.worktreePath)
+      (candidate) => sameWorkspacePath(candidate.path, record4.worktreePath)
     );
     const snapshot = (dependencies.readGitSnapshot ?? ((candidate) => readGitSnapshot(candidate, commandRunner)))(
       worktree ?? {
-        path: record3.worktreePath,
-        branch: record3.branch ?? void 0,
+        path: record4.worktreePath,
+        branch: record4.branch ?? void 0,
         locked: false,
         prunable: true
       }
     );
-    const devpods = dependencies.listDevpods ? dependencies.listDevpods() : listDevpodWorkspacesFromSnapshots(record3.worktreePath);
+    const devpods = dependencies.listDevpods ? dependencies.listDevpods() : listDevpodWorkspacesFromSnapshots(record4.worktreePath);
     const row = buildRow(
       repoPath,
-      record3,
+      record4,
       worktrees,
       devpods,
       routes,
@@ -17489,11 +18065,11 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
         return { ownerStatus: status.ownerStatus, devpodStatus: status.devpodStatus };
       }),
       dependencies.inspectIntegration,
-      dependencies.inspectDevpodRuntime ?? ((devpodId) => inspectDevpodRuntimeStatus(devpodId, record3.worktreePath))
+      dependencies.inspectDevpodRuntime ?? ((devpodId) => inspectDevpodRuntimeStatus(devpodId, record4.worktreePath))
     );
     return measureSize ? {
       ...row,
-      consumption: collectConsumption(record3.worktreePath, measureWorktreeFn, containers2)
+      consumption: collectConsumption(record4.worktreePath, measureWorktreeFn, containers2)
     } : row;
   }).sort((left, right) => left.workspace.localeCompare(right.workspace));
   return {
@@ -17507,12 +18083,12 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
     workspaces: rows
   };
 }
-var import_node_child_process29, import_node_fs40, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var import_node_child_process29, import_node_fs41, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
 var init_workspace_cleanup = __esm({
   "src/core/workspace-cleanup.ts"() {
     "use strict";
     import_node_child_process29 = require("child_process");
-    import_node_fs40 = __toESM(require("fs"));
+    import_node_fs41 = __toESM(require("fs"));
     init_devpod_workspaces();
     init_host_routes();
     init_repo_config();
@@ -17559,7 +18135,7 @@ function warnMissingWorkspaceOwnership(repoPath) {
   );
 }
 function defaultWorktreePath(mainRepo, ws) {
-  return import_node_path45.default.join(mainRepo, "trees", ws);
+  return import_node_path49.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
   const ignored = (0, import_node_child_process30.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
@@ -17567,12 +18143,12 @@ function assertDefaultWorktreeRootIgnored(mainRepo) {
   });
   if (ignored.status !== 0) {
     throw new Error(
-      `Default worktree root '${import_node_path45.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path45.default.join(mainRepo, ".gitignore")}' or use --path.`
+      `Default worktree root '${import_node_path49.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path49.default.join(mainRepo, ".gitignore")}' or use --path.`
     );
   }
 }
 function legacyDefaultWorktreePath(mainRepo, ws) {
-  return import_node_path45.default.join(import_node_path45.default.dirname(mainRepo), `${import_node_path45.default.basename(mainRepo)}-${ws}`);
+  return import_node_path49.default.join(import_node_path49.default.dirname(mainRepo), `${import_node_path49.default.basename(mainRepo)}-${ws}`);
 }
 function teardownFallbackPath(mainRepo, workspace) {
   const candidates = [
@@ -17625,7 +18201,7 @@ function resolveWorkspaceTarget(mainRepo, target, worktrees, records) {
     }
     const liveRecord = oneRecordMatch(
       target,
-      records.filter((record4) => sameWorkspacePath(record4.worktreePath, liveBranchWorktree.path))
+      records.filter((record5) => sameWorkspacePath(record5.worktreePath, liveBranchWorktree.path))
     );
     return {
       workspace: liveRecord?.workspace ?? liveWorkspace,
@@ -17634,13 +18210,13 @@ function resolveWorkspaceTarget(mainRepo, target, worktrees, records) {
       record: liveRecord
     };
   }
-  const record3 = records.find((candidate) => candidate.workspace === requestedWorkspace);
-  if (record3) {
+  const record4 = records.find((candidate) => candidate.workspace === requestedWorkspace);
+  if (record4) {
     return {
-      workspace: record3.workspace,
-      worktreePath: record3.worktreePath,
-      worktree: worktreeForRecord(worktrees, record3),
-      record: record3
+      workspace: record4.workspace,
+      worktreePath: record4.worktreePath,
+      worktree: worktreeForRecord(worktrees, record4),
+      record: record4
     };
   }
   const linked = worktrees.filter((worktree2) => worktree2.workspace !== void 0);
@@ -17661,8 +18237,8 @@ function resolveWorkspaceTarget(mainRepo, target, worktrees, records) {
     record: void 0
   };
 }
-function worktreeForRecord(worktrees, record3) {
-  return worktrees.find((candidate) => sameWorkspacePath(candidate.path, record3.worktreePath));
+function worktreeForRecord(worktrees, record4) {
+  return worktrees.find((candidate) => sameWorkspacePath(candidate.path, record4.worktreePath));
 }
 function assertDevpodTargetSafe(target, worktrees, devpods) {
   if (target.record) {
@@ -17684,7 +18260,7 @@ function assertFullDownPreflight(mainRepo, target) {
   if (sameWorkspacePath(target.worktreePath, mainRepo)) {
     throw new Error("Refusing to remove the primary Git checkout.");
   }
-  if (!target.worktree || target.worktree.prunable || !import_node_fs41.default.existsSync(target.worktreePath)) return;
+  if (!target.worktree || target.worktree.prunable || !import_node_fs42.default.existsSync(target.worktreePath)) return;
   if (target.worktree.locked) {
     throw new Error(
       `Worktree '${target.worktreePath}' is locked; unlock it before workspace down.`
@@ -17724,9 +18300,9 @@ async function workspaceUp(branch, opts = {}) {
       (candidate) => defaultWorktreePath(mainRepo, candidate)
     );
     const generatedPath = candidatePaths.find(
-      (candidate) => !import_node_fs41.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
+      (candidate) => !import_node_fs42.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
     );
-    const selectedPath = opts.path ? import_node_path45.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
+    const selectedPath = opts.path ? import_node_path49.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
     if (!selectedPath) {
       throw new Error(`Could not allocate a collision-safe worktree path for branch '${branch}'.`);
     }
@@ -17735,7 +18311,7 @@ async function workspaceUp(branch, opts = {}) {
         `Branch '${branch}' already uses worktree '${existingBranch.path}', not '${selectedPath}'.`
       );
     }
-    if (import_node_fs41.default.existsSync(selectedPath)) {
+    if (import_node_fs42.default.existsSync(selectedPath)) {
       const registered = worktrees.find(
         (worktree) => sameWorkspacePath(worktree.path, selectedPath)
       );
@@ -17799,26 +18375,26 @@ function workspaceLs(repoPath) {
   const paths = Array.from(
     /* @__PURE__ */ new Set([
       ...worktrees.map((worktree) => worktree.path),
-      ...records.map((record3) => record3.worktreePath)
+      ...records.map((record4) => record4.worktreePath)
     ])
   );
   const routesByWorktreePath = listRoutesForWorktreePaths(paths);
   const worktreesByPath = new Map(worktrees.map((worktree) => [worktree.path, worktree]));
-  const recordsByPath = new Map(records.map((record3) => [record3.worktreePath, record3]));
+  const recordsByPath = new Map(records.map((record4) => [record4.worktreePath, record4]));
   return paths.map((worktreePath) => {
     const worktree = worktreesByPath.get(worktreePath);
-    const record3 = recordsByPath.get(worktreePath);
+    const record4 = recordsByPath.get(worktreePath);
     const devpods = devpodsForPath(worktreePath);
-    const status = record3 ? inspectWorkspaceOwnership(record3, worktrees, devpods) : void 0;
+    const status = record4 ? inspectWorkspaceOwnership(record4, worktrees, devpods) : void 0;
     const matchingDevpods = devpods?.filter(
       (devpod) => sameWorkspacePath(devpod.source.localFolder, worktreePath)
     );
     const wsRoutes = routesByWorktreePath.get(worktreePath) ?? [];
     return {
-      workspace: record3?.workspace ?? worktree?.workspace,
-      branch: worktree?.branch ?? record3?.branch ?? void 0,
+      workspace: record4?.workspace ?? worktree?.workspace,
+      branch: worktree?.branch ?? record4?.branch ?? void 0,
       worktreePath,
-      legacy: !record3 && worktree?.workspace !== void 0,
+      legacy: !record4 && worktree?.workspace !== void 0,
       ownerStatus: status?.ownerStatus,
       devpodStatus: status?.devpodStatus ?? (devpods === void 0 ? "unknown" : matchingDevpods?.length === 0 ? "absent" : matchingDevpods?.length === 1 ? "owned" : "conflict"),
       routeCount: wsRoutes.length,
@@ -17875,7 +18451,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     const result = await mutateWorkspaceRuntime("delete", resolved, worktrees, opts.quiet);
     if (removeWorktree) {
-      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs41.default.existsSync(resolved.worktreePath)) {
+      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs42.default.existsSync(resolved.worktreePath)) {
         const rm = (0, import_node_child_process30.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
           encoding: "utf-8"
         });
@@ -17894,7 +18470,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     return result;
   };
-  return resolved.worktree && !resolved.worktree.prunable && import_node_fs41.default.existsSync(resolved.worktreePath) ? withLifecycleOperationLock(resolved.worktreePath, operation) : operation();
+  return resolved.worktree && !resolved.worktree.prunable && import_node_fs42.default.existsSync(resolved.worktreePath) ? withLifecycleOperationLock(resolved.worktreePath, operation) : operation();
 }
 async function workspaceStop(target, opts = {}) {
   return runWorkspaceLifecycle("stop", target, opts);
@@ -17902,13 +18478,13 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process30, import_node_fs41, import_node_path45, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
+var import_node_child_process30, import_node_fs42, import_node_path49, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
     import_node_child_process30 = require("child_process");
-    import_node_fs41 = __toESM(require("fs"));
-    import_node_path45 = __toESM(require("path"));
+    import_node_fs42 = __toESM(require("fs"));
+    import_node_path49 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_managed_runtime_state();
@@ -18067,7 +18643,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.60" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.62" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {