@devrouter/cli 0.0.61 → 0.0.63

package/dist/devrouter-lifecycle-worker.js

@@ -936,6 +936,28 @@ function inspectManagedStopRunnerId(endpoint, containerId) {
     throw new Error("Provider container binding is unavailable.");
   return value;
 }
+function inspectProviderRunnerContainers(endpoint, runnerId) {
+  if (!runnerId || runnerId.length > 4096 || /[\r\n\0]/.test(runnerId))
+    throw new Error("Provider runner identity is malformed.");
+  const ids = parseDockerLines(
+    runManagedStopDocker(
+      [
+        "ps",
+        "-a",
+        "--no-trunc",
+        "--filter",
+        `label=dev.containers.id=${runnerId}`,
+        "--format",
+        "{{.ID}}"
+      ],
+      endpoint
+    )
+  );
+  if (ids.length > 256) throw new Error("Provider runner population exceeds its bound.");
+  ids.forEach(assertFullContainerId);
+  assertUniqueContainerIds(ids);
+  return ids;
+}
 function inspectManagedStopWorkspaceIds(endpoint, composeDirectory) {
   const ids = parseDockerLines(
     runManagedStopDocker(
@@ -956,6 +978,33 @@ function inspectManagedStopWorkspaceIds(endpoint, composeDirectory) {
   assertUniqueContainerIds(ids);
   return ids;
 }
+function hasExactManagedStopMissingObjectError(stderr, id2) {
+  if (typeof stderr !== "string") return false;
+  const line = stderr.endsWith("\r\n") ? stderr.slice(0, -2) : stderr.endsWith("\n") ? stderr.slice(0, -1) : stderr;
+  return line.toLowerCase() === `error: no such object: ${id2}`;
+}
+function assertManagedStopContainersAbsent(endpoint, ids) {
+  assertManagedStopEndpoint(endpoint);
+  if (!Array.isArray(ids) || ids.length === 0 || ids.length > 256) {
+    throw new Error("Managed stop absence proof requires between 1 and 256 container ids.");
+  }
+  ids.forEach(assertFullContainerId);
+  assertUniqueContainerIds(ids);
+  const env = { ...process.env };
+  delete env.DOCKER_CONTEXT;
+  delete env.DOCKER_HOST;
+  for (const id2 of ids) {
+    const result = (0, import_node_child_process3.spawnSync)("docker", ["--host", endpoint, "inspect", "--format", "{{.Id}}", id2], {
+      env,
+      encoding: "utf-8",
+      timeout: MANAGED_STOP_DOCKER_TIMEOUT_MS,
+      maxBuffer: MANAGED_STOP_DOCKER_MAX_BUFFER
+    });
+    if (result.status !== 1 || result.error || result.signal || result.stdout !== "" && result.stdout !== "\n" && result.stdout !== "\r\n" || !hasExactManagedStopMissingObjectError(result.stderr, id2)) {
+      throw new Error("Managed stop Docker inspection did not prove container absence.");
+    }
+  }
+}
 function stopPinnedManagedContainer(endpoint, containerId) {
   assertFullContainerId(containerId);
   runManagedStopDocker(["stop", containerId], endpoint, 3e4);
@@ -966,11 +1015,13 @@ var import_node_child_process8 = require("child_process");
 
 // src/core/devpod-registry.ts
 var import_node_child_process4 = require("child_process");
-function listDevpodWorkspacesRaw() {
+function listDevpodWorkspacesRaw(options = {}) {
   const result = (0, import_node_child_process4.spawnSync)("devpod", ["list", "--output", "json", "--skip-pro"], {
     encoding: "utf-8"
   });
-  if (result.status !== 0) {
+  if (options.allowMissingExecutable && result.error?.code === "ENOENT")
+    return [];
+  if (result.error || result.status !== 0) {
     const details = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     throw new Error(`devpod list failed: ${details || "devpod is not installed or unavailable"}`);
   }
@@ -1046,6 +1097,10 @@ function listDevsyWorkspaces() {
       ...typeof candidate.uid === "string" ? { uid: candidate.uid } : {},
       ...typeof candidate.context === "string" ? { context: candidate.context } : {}
     };
+    const provider = candidate.provider;
+    if (provider && typeof provider.name === "string") workspace.providerName = provider.name;
+    if (typeof provider?.options?.DOCKER_PATH?.value === "string")
+      workspace.dockerPathOption = provider.options.DOCKER_PATH.value;
     if ("lastUsed" in candidate) {
       if (typeof candidate.lastUsed === "string") {
         workspace.lastUsed = candidate.lastUsed;
@@ -1627,29 +1682,101 @@ function selectDevpodWorkspace(workspaces, repoPath) {
 // src/core/devsy-exec.ts
 var import_node_child_process22 = require("child_process");
 
-// src/core/execution-outcome.ts
-var ExecutionOutcomeError = class extends Error {
-  outcome;
-  constructor(message, outcome) {
-    super(message);
-    this.name = "ExecutionOutcomeError";
-    this.outcome = outcome;
+// src/core/devsy-exec-proof.ts
+var import_node_fs6 = __toESM(require("fs"));
+var import_node_os2 = __toESM(require("os"));
+var import_node_path7 = __toESM(require("path"));
+var import_node_util = require("util");
+function proveLocalDockerSelection(workspace) {
+  const name = workspace.providerName;
+  const context = workspace.context;
+  if (!name || !context || !/^[a-z0-9][a-z0-9-]{0,31}$/.test(name) || !/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(context))
+    throw new Error("Retained exec provider configuration identity is unavailable.");
+  const file = import_node_path7.default.join(
+    process.env.DEVSY_HOME || import_node_path7.default.join(import_node_os2.default.homedir(), ".devsy"),
+    "contexts",
+    context,
+    "providers",
+    name,
+    "provider.json"
+  );
+  try {
+    if (import_node_fs6.default.statSync(file).size > 1024 * 1024) throw new Error();
+    const config = JSON.parse(import_node_fs6.default.readFileSync(file, "utf8"));
+    const driver = config.agent?.driver ?? "docker";
+    const configuredPath = config.agent?.docker?.path ?? "";
+    if (typeof configuredPath !== "string") throw new Error();
+    const command = configuredPath === "${DOCKER_PATH}" || configuredPath === "$DOCKER_PATH" ? workspace.dockerPathOption || process.env.DOCKER_PATH || "docker" : configuredPath || "docker";
+    if (config.name !== name || driver !== "docker" || command !== "docker") throw new Error();
+  } catch {
+    throw new Error("Retained exec requires a provider configured for the local Docker command.");
   }
-};
-
-// src/core/reliability-lifecycle.ts
-var import_node_path27 = __toESM(require("path"));
+  return name;
+}
+function captureDevsyExecProof(repoPath) {
+  repoPath = comparableWorkspacePath(repoPath);
+  const registry = listDevsyWorkspaces();
+  const workspace = selectDevsyWorkspace(registry, repoPath);
+  if (!workspace?.uid || !workspace.context || workspace.source.container || inspectDevsyWorkspaceOwnership(registry, workspace.id, repoPath).status !== "owned" || inspectDevsyRuntimeStatus(workspace.id) !== "running")
+    throw new Error("Retained exec requires one exact running Devsy registration.");
+  const providerName = proveLocalDockerSelection(workspace);
+  const endpoint = resolveManagedStopEndpoint();
+  if (!supportsManagedStopBaseline(endpoint))
+    throw new Error("Retained exec requires an exact local Docker endpoint.");
+  const daemon = inspectManagedStopDaemon(endpoint);
+  const candidates = workspaceAppContainers(inspectWorkspaceContainers(), repoPath).filter(
+    (container) => container.state.Running
+  );
+  if (candidates.length !== 1)
+    throw new Error("Retained exec requires one exact running primary container.");
+  const candidate = candidates[0];
+  const project = candidate.labels["com.docker.compose.project"];
+  if (!project) throw new Error("Retained exec primary has no Compose identity.");
+  const pinned = workspaceAppContainers(
+    inspectManagedStopContainers(project, endpoint),
+    repoPath
+  ).filter((container) => container.state.Running);
+  if (pinned.length !== 1 || pinned[0].id !== candidate.id)
+    throw new Error("Retained exec primary changed during inspection.");
+  const mounts = pinned[0].mounts.filter(
+    (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
+  );
+  if (mounts.length !== 1 || !mounts[0].Destination.startsWith("/"))
+    throw new Error("Retained exec requires one exact source mount.");
+  const uidBytes = Buffer.byteLength(workspace.uid);
+  const runner = uidBytes === 16 || uidBytes === 40 ? workspace.uid : workspace.id;
+  const runnerContainers = inspectProviderRunnerContainers(endpoint, runner);
+  if (runnerContainers.length !== 1 || runnerContainers[0] !== candidate.id)
+    throw new Error("Retained exec runner does not select the exact primary container.");
+  if (inspectManagedStopRunnerId(endpoint, candidate.id) !== runner || inspectManagedStopDaemon(endpoint) !== daemon)
+    throw new Error("Retained exec provider or Docker identity changed.");
+  return {
+    repoPath,
+    id: workspace.id,
+    uid: workspace.uid,
+    context: workspace.context,
+    providerName,
+    endpoint,
+    daemon,
+    containerId: candidate.id,
+    workspacePath: mounts[0].Destination
+  };
+}
+function revalidateDevsyExecProof(repoPath, proof) {
+  if (!(0, import_node_util.isDeepStrictEqual)(captureDevsyExecProof(repoPath), proof))
+    throw new Error("Retained exec identity changed before command launch.");
+}
 
 // src/core/devsy-mutation.ts
 var import_node_child_process14 = require("child_process");
-var import_node_fs15 = __toESM(require("fs"));
-var import_node_path20 = __toESM(require("path"));
+var import_node_fs16 = __toESM(require("fs"));
+var import_node_path21 = __toESM(require("path"));
 
 // src/core/devsy-agent.ts
 var import_node_child_process9 = require("child_process");
 var import_node_crypto4 = require("crypto");
-var import_node_fs6 = __toESM(require("fs"));
-var import_node_path7 = __toESM(require("path"));
+var import_node_fs7 = __toESM(require("fs"));
+var import_node_path8 = __toESM(require("path"));
 var SUPPORTED_DEVSY_VERSION = "1.16.2";
 var DEVSY_AGENT_SETUP_COMMAND = "devrouter setup --yes --workspace-runtime devsy";
 var DEVSY_AGENT_ASSETS = [
@@ -1675,7 +1802,7 @@ var DevsyAgentReadinessError = class extends Error {
     this.name = "DevsyAgentReadinessError";
   }
 };
-var DEVSY_AGENT_CACHE_LOCK = import_node_path7.default.join(DEVROUTER_HOME, "devsy-agent-cache.lock");
+var DEVSY_AGENT_CACHE_LOCK = import_node_path8.default.join(DEVROUTER_HOME, "devsy-agent-cache.lock");
 function parseVersion(output) {
   return output?.match(
     /\bv?(\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)\b/
@@ -1699,14 +1826,14 @@ function nativeAssetName(platform, arch) {
   return void 0;
 }
 function managedBinaryPath(cacheRoot, asset) {
-  return import_node_path7.default.join(cacheRoot, `v${SUPPORTED_DEVSY_VERSION}`, asset.name);
+  return import_node_path8.default.join(cacheRoot, `v${SUPPORTED_DEVSY_VERSION}`, asset.name);
 }
 function hashOpenFile(file) {
   const digest = (0, import_node_crypto4.createHash)("sha256");
   const buffer = Buffer.allocUnsafe(1024 * 1024);
   let position = 0;
   for (; ; ) {
-    const bytesRead = import_node_fs6.default.readSync(file, buffer, 0, buffer.length, position);
+    const bytesRead = import_node_fs7.default.readSync(file, buffer, 0, buffer.length, position);
     if (bytesRead === 0) break;
     digest.update(buffer.subarray(0, bytesRead));
     position += bytesRead;
@@ -1716,8 +1843,8 @@ function hashOpenFile(file) {
 function inspectBinary(binaryPath, assets, missingState) {
   let file;
   try {
-    file = import_node_fs6.default.openSync(binaryPath, import_node_fs6.default.constants.O_RDONLY | import_node_fs6.default.constants.O_NOFOLLOW);
-    const stat = import_node_fs6.default.fstatSync(file);
+    file = import_node_fs7.default.openSync(binaryPath, import_node_fs7.default.constants.O_RDONLY | import_node_fs7.default.constants.O_NOFOLLOW);
+    const stat = import_node_fs7.default.fstatSync(file);
     if (!stat.isFile()) {
       return { state: "invalid", reason: "the selected source is not a regular file" };
     }
@@ -1732,7 +1859,7 @@ function inspectBinary(binaryPath, assets, missingState) {
     const code = error.code;
     return code === "ENOENT" ? { state: missingState, reason: "the selected source is missing" } : { state: "invalid", reason: "the selected source is not a readable regular file" };
   } finally {
-    if (file !== void 0) import_node_fs6.default.closeSync(file);
+    if (file !== void 0) import_node_fs7.default.closeSync(file);
   }
 }
 function resolvedOptions(options) {
@@ -1741,7 +1868,7 @@ function resolvedOptions(options) {
     platform: options.platform ?? process.platform,
     arch: options.arch ?? process.arch,
     versionOutput: options.versionOutput ?? installedVersionOutput(),
-    cacheRoot: options.cacheRoot ?? import_node_path7.default.join(CACHE_DIR, "devsy", "agents"),
+    cacheRoot: options.cacheRoot ?? import_node_path8.default.join(CACHE_DIR, "devsy", "agents"),
     lockPath: options.lockPath ?? DEVSY_AGENT_CACHE_LOCK,
     assets: options.assets ?? DEVSY_AGENT_ASSETS,
     nativeAssetName: options.nativeAssetName
@@ -1802,19 +1929,19 @@ function requireReadyDevsyAgent(options = {}) {
 }
 
 // src/core/managed-devsy-stop.ts
-var import_node_os3 = __toESM(require("os"));
-var import_node_path19 = __toESM(require("path"));
+var import_node_os4 = __toESM(require("os"));
+var import_node_path20 = __toESM(require("path"));
 
 // src/core/devcontainer-profile.ts
 var import_node_child_process10 = require("child_process");
 var import_node_crypto5 = require("crypto");
-var import_node_fs8 = __toESM(require("fs"));
-var import_node_path10 = __toESM(require("path"));
+var import_node_fs9 = __toESM(require("fs"));
+var import_node_path11 = __toESM(require("path"));
 var import_yaml = __toESM(require("yaml"));
 
 // src/core/devcontainer-config.ts
-var import_node_fs7 = __toESM(require("fs"));
-var import_node_path8 = __toESM(require("path"));
+var import_node_fs8 = __toESM(require("fs"));
+var import_node_path9 = __toESM(require("path"));
 var import_jsonc_parser = require("jsonc-parser");
 function isObject(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -1837,11 +1964,11 @@ function parseDevcontainerConfig(contents, sourcePath) {
   return parsed;
 }
 function readDevcontainerConfig(repoPath) {
-  const sourcePath = import_node_path8.default.join(repoPath, ".devcontainer", "devcontainer.json");
-  if (!import_node_fs7.default.existsSync(sourcePath) || !import_node_fs7.default.lstatSync(sourcePath).isFile()) {
+  const sourcePath = import_node_path9.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  if (!import_node_fs8.default.existsSync(sourcePath) || !import_node_fs8.default.lstatSync(sourcePath).isFile()) {
     throw new Error(`Managed Dev Container source config does not exist: ${sourcePath}`);
   }
-  const sourceContents = import_node_fs7.default.readFileSync(sourcePath, "utf-8");
+  const sourceContents = import_node_fs8.default.readFileSync(sourcePath, "utf-8");
   return {
     sourcePath,
     sourceContents,
@@ -1859,11 +1986,11 @@ function assertManagedDevcontainerLifecycle(repoPath) {
 }
 
 // src/core/paths.ts
-var import_node_path9 = __toESM(require("path"));
+var import_node_path10 = __toESM(require("path"));
 function assertPathWithinRepo(filePath, repoRoot, label) {
-  const resolvedRoot = import_node_path9.default.resolve(repoRoot);
-  const resolved = import_node_path9.default.resolve(repoRoot, filePath);
-  if (resolved !== resolvedRoot && !resolved.startsWith(resolvedRoot + import_node_path9.default.sep)) {
+  const resolvedRoot = import_node_path10.default.resolve(repoRoot);
+  const resolved = import_node_path10.default.resolve(repoRoot, filePath);
+  if (resolved !== resolvedRoot && !resolved.startsWith(resolvedRoot + import_node_path10.default.sep)) {
     throw new Error(`${label} path '${filePath}' escapes the repository root.`);
   }
   return resolved;
@@ -1917,14 +2044,14 @@ function resolveComposeFiles(source, repoPath, linked) {
       "managedRuntime requires .devcontainer/devcontainer.json to define dockerComposeFile."
     );
   }
-  const directory = import_node_path10.default.join(repoPath, ".devcontainer");
+  const directory = import_node_path11.default.join(repoPath, ".devcontainer");
   const files = references.map((reference) => {
     const resolved2 = assertPathWithinRepo(
       resolveComposeReference(reference, linked),
       directory,
       "dockerComposeFile"
     );
-    if (!import_node_fs8.default.existsSync(resolved2) || !import_node_fs8.default.lstatSync(resolved2).isFile()) {
+    if (!import_node_fs9.default.existsSync(resolved2) || !import_node_fs9.default.lstatSync(resolved2).isFile()) {
       throw new Error(`Managed Dev Container compose file does not exist: ${resolved2}`);
     }
     return resolved2;
@@ -1932,7 +2059,7 @@ function resolveComposeFiles(source, repoPath, linked) {
   for (const file of files) {
     let parsed;
     try {
-      parsed = import_yaml.default.parse(import_node_fs8.default.readFileSync(file, "utf-8"));
+      parsed = import_yaml.default.parse(import_node_fs9.default.readFileSync(file, "utf-8"));
     } catch (error) {
       throw new Error(
         `Could not parse managed Dev Container compose file '${file}': ${String(error)}`
@@ -1981,12 +2108,12 @@ function assertIgnoredGeneratedPath(repoPath, generatedPath) {
   }
 }
 function assertGeneratedPathOwnership(generatedPath) {
-  if (!import_node_fs8.default.existsSync(generatedPath)) return;
-  const stat = import_node_fs8.default.lstatSync(generatedPath);
+  if (!import_node_fs9.default.existsSync(generatedPath)) return;
+  const stat = import_node_fs9.default.lstatSync(generatedPath);
   if (!stat.isFile() || stat.isSymbolicLink()) {
     throw new Error(`Managed Dev Container path '${generatedPath}' is not a regular file.`);
   }
-  const firstLine = import_node_fs8.default.readFileSync(generatedPath, "utf-8").split(/\r?\n/, 1)[0];
+  const firstLine = import_node_fs9.default.readFileSync(generatedPath, "utf-8").split(/\r?\n/, 1)[0];
   if (firstLine !== MANAGED_DEVCONTAINER_MARKER) {
     throw new Error(
       `Managed Dev Container path '${generatedPath}' exists without the devrouter ownership marker.`
@@ -2062,7 +2189,7 @@ function inspectManagedDevcontainerConfig(options) {
   const contents = `${MANAGED_DEVCONTAINER_MARKER}
 ${JSON.stringify(effective, null, 2)}
 `;
-  const generatedPath = import_node_path10.default.join(options.repoPath, MANAGED_DEVCONTAINER_PATH);
+  const generatedPath = import_node_path11.default.join(options.repoPath, MANAGED_DEVCONTAINER_PATH);
   assertIgnoredGeneratedPath(options.repoPath, generatedPath);
   assertGeneratedPathOwnership(generatedPath);
   return {
@@ -2089,13 +2216,13 @@ function writeManagedDevcontainerConfig(plan) {
 function inspectManagedDevcontainerGeneratedConfig(plan) {
   let stat;
   try {
-    stat = import_node_fs8.default.lstatSync(plan.generatedPath);
+    stat = import_node_fs9.default.lstatSync(plan.generatedPath);
   } catch (error) {
     if (error.code === "ENOENT") return { status: "missing" };
     throw error;
   }
   if (!stat.isFile() || stat.isSymbolicLink()) return { status: "foreign" };
-  const contents = import_node_fs8.default.readFileSync(plan.generatedPath, "utf-8");
+  const contents = import_node_fs9.default.readFileSync(plan.generatedPath, "utf-8");
   if (!contents.startsWith(`${MANAGED_DEVCONTAINER_MARKER}
 `)) {
     return { status: "foreign" };
@@ -2107,17 +2234,17 @@ function inspectManagedDevcontainerGeneratedConfig(plan) {
   };
 }
 function removeManagedDevcontainerConfig(plan) {
-  if (!import_node_fs8.default.existsSync(plan.generatedPath)) return;
-  const stat = import_node_fs8.default.lstatSync(plan.generatedPath);
+  if (!import_node_fs9.default.existsSync(plan.generatedPath)) return;
+  const stat = import_node_fs9.default.lstatSync(plan.generatedPath);
   if (!stat.isFile()) {
     throw new Error(`Managed Dev Container path '${plan.generatedPath}' is not a regular file.`);
   }
-  const contents = import_node_fs8.default.readFileSync(plan.generatedPath, "utf-8");
+  const contents = import_node_fs9.default.readFileSync(plan.generatedPath, "utf-8");
   if (!contents.startsWith(`${MANAGED_DEVCONTAINER_MARKER}
 `)) {
     throw new Error(`Managed Dev Container path '${plan.generatedPath}' is not devrouter-owned.`);
   }
-  import_node_fs8.default.unlinkSync(plan.generatedPath);
+  import_node_fs9.default.unlinkSync(plan.generatedPath);
 }
 function assertSafeContainerId(containerId) {
   if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(containerId)) {
@@ -2141,8 +2268,8 @@ function managedComposeEnvironment(workspace) {
 }
 function assertReadableComposeFile(file) {
   try {
-    if (!import_node_fs8.default.statSync(file).isFile()) throw new Error("not a regular file");
-    import_node_fs8.default.accessSync(file, import_node_fs8.default.constants.R_OK);
+    if (!import_node_fs9.default.statSync(file).isFile()) throw new Error("not a regular file");
+    import_node_fs9.default.accessSync(file, import_node_fs9.default.constants.R_OK);
   } catch {
     throw new Error("Managed container Compose configuration contains an unreadable file.");
   }
@@ -2274,8 +2401,8 @@ function stopExactManagedService(containerId, service, options) {
 }
 
 // src/core/managed-compose-population.ts
-var import_node_fs9 = __toESM(require("fs"));
-var import_node_path11 = __toESM(require("path"));
+var import_node_fs10 = __toESM(require("fs"));
+var import_node_path12 = __toESM(require("path"));
 function proveManagedComposePopulation(options) {
   const { plan, repoPath, composeProject, featureDirectory, devsyRoot, containers } = options;
   const services = /* @__PURE__ */ new Set();
@@ -2289,13 +2416,13 @@ function proveManagedComposePopulation(options) {
     }
     services.add(service);
     const files = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").map((file) => file.trim());
-    if (files.some((file) => !file || !import_node_path11.default.isAbsolute(file)) || new Set(files.map((file) => import_node_path11.default.resolve(file))).size !== files.length || files.length < plan.composeFiles.length || plan.composeFiles.some((file, index) => !sameWorkspacePath(file, files[index]))) {
+    if (files.some((file) => !file || !import_node_path12.default.isAbsolute(file)) || new Set(files.map((file) => import_node_path12.default.resolve(file))).size !== files.length || files.length < plan.composeFiles.length || plan.composeFiles.some((file, index) => !sameWorkspacePath(file, files[index]))) {
       throw new Error("Managed stop Compose file identity changed.");
     }
     for (const file of files.slice(plan.composeFiles.length)) {
-      if (import_node_path11.default.dirname(file) !== featureDirectory || !/^docker-compose\.devcontainer\.containerFeatures-[a-zA-Z0-9_-]+\.yml$/.test(
-        import_node_path11.default.basename(file)
-      ) || import_node_fs9.default.realpathSync(file) !== import_node_path11.default.join(import_node_fs9.default.realpathSync(devsyRoot), import_node_path11.default.relative(devsyRoot, file))) {
+      if (import_node_path12.default.dirname(file) !== featureDirectory || !/^docker-compose\.devcontainer\.containerFeatures-[a-zA-Z0-9_-]+\.yml$/.test(
+        import_node_path12.default.basename(file)
+      ) || import_node_fs10.default.realpathSync(file) !== import_node_path12.default.join(import_node_fs10.default.realpathSync(devsyRoot), import_node_path12.default.relative(devsyRoot, file))) {
         throw new Error("Managed stop refuses a foreign or escaped provider Compose file.");
       }
     }
@@ -2316,11 +2443,11 @@ function proveManagedComposePopulation(options) {
 
 // src/core/managed-runtime-state.ts
 var import_node_crypto6 = require("crypto");
-var import_node_fs10 = __toESM(require("fs"));
-var import_node_path13 = __toESM(require("path"));
+var import_node_fs11 = __toESM(require("fs"));
+var import_node_path14 = __toESM(require("path"));
 
 // src/core/managed-stop-baseline.ts
-var import_node_path12 = __toESM(require("path"));
+var import_node_path13 = __toESM(require("path"));
 function record(value, keys2) {
   if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).length !== keys2.length || Object.keys(value).some((key) => !keys2.includes(key))) {
     throw new Error("Invalid managed stop baseline fields.");
@@ -2335,7 +2462,7 @@ function text(value, empty = false) {
 }
 function absolute(value) {
   const result = text(value);
-  if (!import_node_path12.default.isAbsolute(result) || import_node_path12.default.normalize(result) !== result) {
+  if (!import_node_path13.default.isAbsolute(result) || import_node_path13.default.normalize(result) !== result) {
     throw new Error("Invalid managed stop baseline path.");
   }
   return result;
@@ -2413,8 +2540,8 @@ function validateManagedStopBaseline(value, state) {
     const c = record(entry, ["id", "service", "configFiles", "mounts"]);
     const configFiles = list(c.configFiles, absolute);
     if (configFiles.length < result.composeFiles.length || result.composeFiles.some((file, index) => configFiles[index] !== file) || configFiles.slice(result.composeFiles.length).some(
-      (file) => import_node_path12.default.dirname(file) !== result.featureDirectory || !/^docker-compose\.devcontainer\.containerFeatures-[a-zA-Z0-9_-]+\.yml$/.test(
-        import_node_path12.default.basename(file)
+      (file) => import_node_path13.default.dirname(file) !== result.featureDirectory || !/^docker-compose\.devcontainer\.containerFeatures-[a-zA-Z0-9_-]+\.yml$/.test(
+        import_node_path13.default.basename(file)
       )
     )) {
       throw new Error("Invalid stop baseline Compose provenance.");
@@ -2453,7 +2580,7 @@ function stateKey(repoPath, workspace) {
   return (0, import_node_crypto6.createHash)("sha256").update(`${repoPath}\0${workspace ?? ""}`, "utf-8").digest("hex");
 }
 function managedRuntimeStatePath(repoPath, workspace) {
-  return import_node_path13.default.join(DEVROUTER_HOME, "managed-runtime", `${stateKey(repoPath, workspace)}.json`);
+  return import_node_path14.default.join(DEVROUTER_HOME, "managed-runtime", `${stateKey(repoPath, workspace)}.json`);
 }
 function isStringArray(value) {
   return Array.isArray(value) && value.every((item) => typeof item === "string") && new Set(value).size === value.length;
@@ -2518,9 +2645,9 @@ function validateState(value, repoPath, workspace) {
   }
   return result;
 }
-function readManagedRuntimeState(repoPath, workspace, read = (file) => import_node_fs10.default.readFileSync(file, "utf-8")) {
+function readManagedRuntimeState(repoPath, workspace, read = (file) => import_node_fs11.default.readFileSync(file, "utf-8")) {
   const statePath = managedRuntimeStatePath(repoPath, workspace);
-  if (!import_node_fs10.default.existsSync(statePath)) return void 0;
+  if (!import_node_fs11.default.existsSync(statePath)) return void 0;
   let parsed;
   try {
     parsed = JSON.parse(read(statePath));
@@ -2547,9 +2674,9 @@ function markManagedRuntimeDegraded(state, transitionPhase) {
 }
 
 // src/core/managed-stop-recovery.ts
-var import_node_os2 = __toESM(require("os"));
-var import_node_path15 = __toESM(require("path"));
-var import_node_util = require("util");
+var import_node_os3 = __toESM(require("os"));
+var import_node_path16 = __toESM(require("path"));
+var import_node_util2 = require("util");
 
 // src/core/reliability-context.ts
 var claim;
@@ -2563,11 +2690,11 @@ function claimLifecycleEffect() {
 
 // src/core/workspace-ownership.ts
 var import_node_child_process11 = require("child_process");
-var import_node_fs11 = __toESM(require("fs"));
-var import_node_path14 = __toESM(require("path"));
+var import_node_fs12 = __toESM(require("fs"));
+var import_node_path15 = __toESM(require("path"));
 var READ_ONLY_GIT_ENV = { ...process.env, GIT_OPTIONAL_LOCKS: "0" };
 var OWNERSHIP_VERSION = 1;
-var OWNERSHIP_DIR = import_node_path14.default.join("devrouter", "workspaces");
+var OWNERSHIP_DIR = import_node_path15.default.join("devrouter", "workspaces");
 function commandError(command, repoPath, stderr) {
   return new Error(
     `${command} failed for '${repoPath}': ${stderr?.trim() || "not a Git repository"}`
@@ -2582,7 +2709,7 @@ function resolveGitCommonDir(repoPath) {
   if (result.status !== 0 || !output) {
     throw commandError("Could not resolve the Git common directory", repoPath, result.stderr);
   }
-  return comparableWorkspacePath(import_node_path14.default.isAbsolute(output) ? output : import_node_path14.default.resolve(repoPath, output));
+  return comparableWorkspacePath(import_node_path15.default.isAbsolute(output) ? output : import_node_path15.default.resolve(repoPath, output));
 }
 function listGitWorktrees(repoPath) {
   const result = (0, import_node_child_process11.spawnSync)("git", ["-C", repoPath, "worktree", "list", "--porcelain"], {
@@ -2622,7 +2749,7 @@ function listGitWorktrees(repoPath) {
   return worktrees;
 }
 function ownershipDirectory(repoPath) {
-  return import_node_path14.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
+  return import_node_path15.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
 }
 function validateWorkspace(value, label) {
   if (typeof value !== "string" || wsFromBranch(value) !== value) {
@@ -2650,7 +2777,7 @@ function validateRecord(value, expectedWorkspace) {
       `workspace ownership file '${expectedWorkspace}' contains identity '${workspace}'`
     );
   }
-  if (typeof candidate.worktreePath !== "string" || !import_node_path14.default.isAbsolute(candidate.worktreePath)) {
+  if (typeof candidate.worktreePath !== "string" || !import_node_path15.default.isAbsolute(candidate.worktreePath)) {
     throw new Error("invalid workspace ownership worktreePath");
   }
   if (candidate.branch !== null && typeof candidate.branch !== "string") {
@@ -2668,7 +2795,7 @@ function validateRecord(value, expectedWorkspace) {
   };
 }
 function recordPath(repoPath, workspace) {
-  return import_node_path14.default.join(
+  return import_node_path15.default.join(
     ownershipDirectory(repoPath),
     `${validateWorkspace(workspace, "workspace")}.json`
   );
@@ -2676,7 +2803,7 @@ function recordPath(repoPath, workspace) {
 function readRecordFile(filePath, expectedWorkspace) {
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs11.default.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(import_node_fs12.default.readFileSync(filePath, "utf-8"));
   } catch (error) {
     if (error instanceof SyntaxError) {
       throw new Error(`invalid workspace ownership JSON at '${filePath}'`);
@@ -2701,7 +2828,7 @@ function listWorkspaceOwnership(repoPath) {
 function listWorkspaceOwnershipInDirectory(directory) {
   let entries;
   try {
-    entries = import_node_fs11.default.readdirSync(directory, { withFileTypes: true });
+    entries = import_node_fs12.default.readdirSync(directory, { withFileTypes: true });
   } catch (error) {
     if (error.code === "ENOENT") return [];
     throw error;
@@ -2709,14 +2836,14 @@ function listWorkspaceOwnershipInDirectory(directory) {
   return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
     const workspace = entry.name.slice(0, -".json".length);
     validateWorkspace(workspace, "filename");
-    return readRecordFile(import_node_path14.default.join(directory, entry.name), workspace);
+    return readRecordFile(import_node_path15.default.join(directory, entry.name), workspace);
   });
 }
 function writeWorkspaceOwnershipInDirectory(directory, input) {
   const workspace = validateWorkspace(input.workspace, "workspace");
   const devpodId = validateWorkspace(input.devpodId, "devpodId");
   const worktreePath = comparableWorkspacePath(input.worktreePath);
-  const filePath = import_node_path14.default.join(directory, `${workspace}.json`);
+  const filePath = import_node_path15.default.join(directory, `${workspace}.json`);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const records = listWorkspaceOwnershipInDirectory(directory);
   const existing = records.find((record5) => record5.workspace === workspace);
@@ -2752,9 +2879,9 @@ function writeWorkspaceOwnershipInDirectory(directory, input) {
   return record4;
 }
 function removeWorkspaceOwnershipInDirectory(directory, workspace) {
-  const filePath = import_node_path14.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
+  const filePath = import_node_path15.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
   try {
-    import_node_fs11.default.rmSync(filePath);
+    import_node_fs12.default.rmSync(filePath);
     return true;
   } catch (error) {
     if (error.code === "ENOENT") return false;
@@ -2765,7 +2892,7 @@ function sameOwnershipRecord(left, right) {
   return left.version === right.version && left.workspace === right.workspace && sameWorkspacePath(left.worktreePath, right.worktreePath) && left.branch === right.branch && left.devpodId === right.devpodId && left.createdAt === right.createdAt && left.updatedAt === right.updatedAt;
 }
 function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
-  const filePath = import_node_path14.default.join(
+  const filePath = import_node_path15.default.join(
     directory,
     `${validateWorkspace(expected.workspace, "workspace")}.json`
   );
@@ -2777,14 +2904,14 @@ function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
     throw error;
   }
   if (!sameOwnershipRecord(current, expected)) return "changed";
-  import_node_fs11.default.rmSync(filePath);
+  import_node_fs12.default.rmSync(filePath);
   return "removed";
 }
 function withWorkspaceOwnershipTransaction(repoPath, operation, options = {}) {
   const directory = ownershipDirectory(repoPath);
-  import_node_fs11.default.mkdirSync(directory, { recursive: true });
+  import_node_fs12.default.mkdirSync(directory, { recursive: true });
   return withFileLockSync(
-    import_node_path14.default.join(directory, ".lock"),
+    import_node_path15.default.join(directory, ".lock"),
     {
       activity: "workspace ownership transaction",
       target: `'${repoPath}'`,
@@ -2817,7 +2944,7 @@ function persistedWorkspaceOwners(repoPath, worktreePath) {
     try {
       workspace = readPersistedWorkspace(worktree.path);
     } catch (error) {
-      if (!import_node_fs11.default.existsSync(worktree.path)) continue;
+      if (!import_node_fs12.default.existsSync(worktree.path)) continue;
       throw error;
     }
     if (!workspace) continue;
@@ -2974,7 +3101,7 @@ function inspectWorkspaceOwnership(record4, worktrees, devpods) {
   if (worktree?.locked) {
     return { ownerStatus: "locked", devpodStatus, worktree };
   }
-  if ((!worktree || worktree.prunable) && import_node_fs11.default.existsSync(record4.worktreePath)) {
+  if ((!worktree || worktree.prunable) && import_node_fs12.default.existsSync(record4.worktreePath)) {
     return { ownerStatus: "conflict", devpodStatus, worktree };
   }
   if (!worktree || worktree.prunable) {
@@ -3052,7 +3179,7 @@ function prove(state, baseline) {
   const containers = inspectManagedStopContainers(baseline.project, baseline.endpoint);
   const expected = baseline.containers.map((container) => ({ ...container, mounts: orderedMounts(container.mounts) })).sort((a, b) => compareText(a.id, b.id));
   const observed = containers.map(identity).sort((a, b) => compareText(a.id, b.id));
-  if (!(0, import_node_util.isDeepStrictEqual)(expected, observed) || containers.some(
+  if (!(0, import_node_util2.isDeepStrictEqual)(expected, observed) || containers.some(
     (container) => container.labels["com.docker.compose.project.working_dir"] !== baseline.composeDirectory
   )) {
     throw new Error("Retained container population or immutable identity changed.");
@@ -3061,7 +3188,7 @@ function prove(state, baseline) {
     baseline.endpoint,
     baseline.composeDirectory
   ).sort();
-  if (!(0, import_node_util.isDeepStrictEqual)(workspaceIds, expected.map((container) => container.id).sort())) {
+  if (!(0, import_node_util2.isDeepStrictEqual)(workspaceIds, expected.map((container) => container.id).sort())) {
     throw new Error("Workspace contains an unrecorded container population.");
   }
   const primary = baseline.containers.find(
@@ -3073,7 +3200,7 @@ function prove(state, baseline) {
   if (!baseline.sourceContainer && inspectManagedStopRunnerId(baseline.endpoint, primary.id) !== runnerId) {
     throw new Error("Provider-to-container binding changed.");
   }
-  if (!(0, import_node_util.isDeepStrictEqual)(registration(state), owner) || inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId) {
+  if (!(0, import_node_util2.isDeepStrictEqual)(registration(state), owner) || inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId) {
     throw new Error("Stop authority changed during inspection.");
   }
   return containers;
@@ -3082,8 +3209,8 @@ function captureManagedStopBaseline(state, plan, primaryId, expectedEndpoint) {
   const owner = registration(state);
   if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(owner.context) || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(owner.providerId))
     throw new Error("Invalid capture provider identity.");
-  const devsyRoot = import_node_path15.default.resolve(process.env.DEVSY_HOME || import_node_path15.default.join(import_node_os2.default.homedir(), ".devsy"));
-  const featureDirectory = import_node_path15.default.join(
+  const devsyRoot = import_node_path16.default.resolve(process.env.DEVSY_HOME || import_node_path16.default.join(import_node_os3.default.homedir(), ".devsy"));
+  const featureDirectory = import_node_path16.default.join(
     devsyRoot,
     "contexts",
     owner.context,
@@ -3133,16 +3260,65 @@ function captureManagedStopBaseline(state, plan, primaryId, expectedEndpoint) {
 }
 function proveRetainedManagedStop(state) {
   const baseline = validateManagedStopBaseline(state.stopBaseline, state);
-  if (!(0, import_node_util.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state)) {
+  if (!(0, import_node_util2.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state)) {
     throw new Error("Retained stop generation changed.");
   }
   const result = prove(state, baseline);
-  if (!(0, import_node_util.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state)) {
+  if (!(0, import_node_util2.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state)) {
     throw new Error("Retained stop generation changed during inspection.");
   }
   return result;
 }
+function absentRegistrationIdentity(state) {
+  resetWorkspaceRuntimeCaches();
+  if (resolveWorkspaceRuntimeOrDefault(state.repoPath) !== "devsy")
+    throw new Error("Stop provider changed.");
+  if (!state.workspace || !isLinkedWorktree(state.repoPath))
+    throw new Error("Absent stop requires a linked workspace.");
+  const record4 = readWorkspaceOwnership(state.repoPath, state.workspace);
+  if (!record4 || record4.workspace !== state.workspace || record4.devpodId !== state.devpodId || !sameWorkspacePath(record4.worktreePath, state.repoPath) || resolveWorktreeWorkspace(state.repoPath) !== state.workspace || inspectWorkspaceOwnership(record4, listGitWorktrees(state.repoPath), void 0).ownerStatus !== "present")
+    throw new Error("Absent stop workspace ownership changed.");
+  for (const entries of [
+    listDevsyWorkspaces(),
+    listDevpodWorkspacesRaw({ allowMissingExecutable: true })
+  ]) {
+    if (entries.some(
+      (entry) => entry.id === state.devpodId || sameWorkspacePath(entry.source.localFolder, state.repoPath)
+    ))
+      throw new Error("Absent stop requires both provider registrations to remain absent.");
+  }
+  return { record: record4, gitCommonDir: resolveGitCommonDir(state.repoPath) };
+}
+function proveManagedStop(state) {
+  const baseline = validateManagedStopBaseline(state.stopBaseline, state);
+  const owner = inspectDevsyWorkspaceOwnership(
+    listDevsyWorkspaces(),
+    state.devpodId,
+    state.repoPath
+  );
+  if (owner.status !== "absent")
+    return { status: "retained", containers: proveRetainedManagedStop(state) };
+  if (baseline.sourceContainer) throw new Error("Absent stop cannot prove a source container.");
+  const before = absentRegistrationIdentity(state);
+  if (!(0, import_node_util2.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state))
+    throw new Error("Retained stop generation changed.");
+  if (inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId)
+    throw new Error("Stop daemon changed.");
+  assertManagedStopContainersAbsent(
+    baseline.endpoint,
+    baseline.containers.map((container) => container.id)
+  );
+  const uidBytes = Buffer.byteLength(baseline.uid);
+  const runnerId = uidBytes === 16 || uidBytes === 40 ? baseline.uid : baseline.providerId;
+  if (inspectManagedStopContainers(baseline.project, baseline.endpoint).length !== 0 || inspectManagedStopWorkspaceIds(baseline.endpoint, baseline.composeDirectory).length !== 0 || inspectProviderRunnerContainers(baseline.endpoint, runnerId).length !== 0)
+    throw new Error("Absent stop observed a remaining workspace population.");
+  if (inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId || !(0, import_node_util2.isDeepStrictEqual)(absentRegistrationIdentity(state), before) || !(0, import_node_util2.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state))
+    throw new Error("Absent stop authority changed during inspection.");
+  return { status: "proven-absent", containers: [] };
+}
 function stopFromManagedBaseline(state) {
+  const proof = proveManagedStop(state);
+  if (proof.status === "proven-absent") return proof.status;
   const baseline = validateManagedStopBaseline(state.stopBaseline, state);
   const stopped = /* @__PURE__ */ new Set();
   for (const initial of proveRetainedManagedStop(state))
@@ -3165,11 +3341,17 @@ function stopFromManagedBaseline(state) {
   }
   if (inspect().some((container) => container.state.Running))
     throw new Error("Retained workloads remain running.");
+  return "retained";
+}
+function managedStopRouteReferences(state) {
+  return state.desired.apps.flatMap(
+    (name) => ["http", "tcp"].map((protocol) => ({ repoPath: state.repoPath, name, protocol }))
+  );
 }
 
 // src/core/repo-config.ts
-var import_node_fs13 = __toESM(require("fs"));
-var import_node_path17 = __toESM(require("path"));
+var import_node_fs14 = __toESM(require("fs"));
+var import_node_path18 = __toESM(require("path"));
 var import_yaml3 = __toESM(require("yaml"));
 
 // src/core/capabilities.ts
@@ -3195,9 +3377,9 @@ function formatSupportedTcpProtocols() {
 }
 
 // src/core/host-routes.ts
-var import_node_fs12 = __toESM(require("fs"));
-var import_node_path16 = __toESM(require("path"));
-var import_node_util2 = require("util");
+var import_node_fs13 = __toESM(require("fs"));
+var import_node_path17 = __toESM(require("path"));
+var import_node_util3 = require("util");
 var import_yaml2 = __toESM(require("yaml"));
 var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "0.0.0.0"]);
 var UPSTREAM_RE = /^([a-zA-Z0-9._-]+):(\d{1,5})$/;
@@ -3380,7 +3562,7 @@ function writeRouteGeneration(routes, tlsEnabled) {
   writeFileAtomically(HOST_ROUTES_STATE_FILE, renderCompatibilityState(routes));
   writeFileAtomically(TRAEFIK_HOST_ROUTES_FILE, renderCanonicalState(routes, tlsEnabled));
 }
-function readCompatibilityState(read = (file) => import_node_fs12.default.readFileSync(file, "utf-8")) {
+function readCompatibilityState(read = (file) => import_node_fs13.default.readFileSync(file, "utf-8")) {
   let raw;
   try {
     raw = read(HOST_ROUTES_STATE_FILE);
@@ -3437,14 +3619,14 @@ function parseCanonicalState(raw) {
     throw new Error(`Canonical host-route document is invalid: ${error.message}`);
   }
   const expectedDocument = buildHostRoutesDocument(routes, metadata.tlsEnabled);
-  if (!(0, import_node_util2.isDeepStrictEqual)(document, expectedDocument)) {
+  if (!(0, import_node_util3.isDeepStrictEqual)(document, expectedDocument)) {
     throw new Error("Canonical host-route document does not match its metadata.");
   }
   return { kind: "canonical", metadata };
 }
 function ensureHostRouteStorage() {
-  import_node_fs12.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
-  import_node_fs12.default.mkdirSync(TRAEFIK_DYNAMIC_DIR, { recursive: true });
+  import_node_fs13.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs13.default.mkdirSync(TRAEFIK_DYNAMIC_DIR, { recursive: true });
 }
 function writeState(routes) {
   ensureHostRouteStorage();
@@ -3463,8 +3645,8 @@ function refreshHostRoutesDynamicFile() {
 }
 function readHostRouteStateLocked() {
   ensureHostRouteStorage();
-  if (!import_node_fs12.default.existsSync(TRAEFIK_HOST_ROUTES_FILE)) {
-    if (import_node_fs12.default.existsSync(HOST_ROUTES_STATE_FILE)) {
+  if (!import_node_fs13.default.existsSync(TRAEFIK_HOST_ROUTES_FILE)) {
+    if (import_node_fs13.default.existsSync(HOST_ROUTES_STATE_FILE)) {
       const routes = readCompatibilityState();
       writeRouteGeneration(routes, isTLSEnabled());
       return routes;
@@ -3472,10 +3654,10 @@ function readHostRouteStateLocked() {
     writeRouteGeneration([], isTLSEnabled());
     return [];
   }
-  const raw = import_node_fs12.default.readFileSync(TRAEFIK_HOST_ROUTES_FILE, "utf-8");
+  const raw = import_node_fs13.default.readFileSync(TRAEFIK_HOST_ROUTES_FILE, "utf-8");
   const canonical = parseCanonicalState(raw);
   if (canonical.kind === "legacy") {
-    if (!import_node_fs12.default.existsSync(HOST_ROUTES_STATE_FILE)) {
+    if (!import_node_fs13.default.existsSync(HOST_ROUTES_STATE_FILE)) {
       throw new Error(
         "Headerless host-route document requires a valid compatibility state file for migration."
       );
@@ -3485,9 +3667,9 @@ function readHostRouteStateLocked() {
     return routes;
   }
   let mirrorMatches = false;
-  if (import_node_fs12.default.existsSync(HOST_ROUTES_STATE_FILE)) {
+  if (import_node_fs13.default.existsSync(HOST_ROUTES_STATE_FILE)) {
     try {
-      mirrorMatches = (0, import_node_util2.isDeepStrictEqual)(readCompatibilityState(), canonical.metadata.routes);
+      mirrorMatches = (0, import_node_util3.isDeepStrictEqual)(readCompatibilityState(), canonical.metadata.routes);
     } catch {
       mirrorMatches = false;
     }
@@ -4505,15 +4687,15 @@ function applyProfile(config, profile) {
   return next;
 }
 function resolveRepoPath(repoPath) {
-  return import_node_path17.default.resolve(repoPath ?? process.cwd());
+  return import_node_path18.default.resolve(repoPath ?? process.cwd());
 }
 function getRepoConfigPath(repoPath) {
-  return import_node_path17.default.join(resolveRepoPath(repoPath), CONFIG_FILE_NAME);
+  return import_node_path18.default.join(resolveRepoPath(repoPath), CONFIG_FILE_NAME);
 }
-function loadRepoConfig(repoPath, read = (file) => import_node_fs13.default.readFileSync(file, "utf-8")) {
+function loadRepoConfig(repoPath, read = (file) => import_node_fs14.default.readFileSync(file, "utf-8")) {
   const resolvedRepoPath = resolveRepoPath(repoPath);
   const configPath = getRepoConfigPath(resolvedRepoPath);
-  if (!import_node_fs13.default.existsSync(configPath)) {
+  if (!import_node_fs14.default.existsSync(configPath)) {
     throw new Error(
       `Missing ${CONFIG_FILE_NAME} in ${resolvedRepoPath}. Run 'dev repo init --repo ${resolvedRepoPath}' first.`
     );
@@ -4523,7 +4705,7 @@ function loadRepoConfig(repoPath, read = (file) => import_node_fs13.default.read
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.61" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.63" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -4543,7 +4725,7 @@ function namespaceHost(host, workspace) {
   return `${base}.${workspace}${suffix}`;
 }
 function applyWorkspace(config, workspace, repoPath) {
-  const defaultToken = wsFromBranch(config.project?.name ?? import_node_path17.default.basename(import_node_path17.default.resolve(repoPath))) ?? "app";
+  const defaultToken = wsFromBranch(config.project?.name ?? import_node_path18.default.basename(import_node_path18.default.resolve(repoPath))) ?? "app";
   const substitutionToken = workspace ?? defaultToken;
   const next = structuredClone(config);
   for (const app of next.apps) {
@@ -4704,10 +4886,10 @@ async function ensureNetwork(name) {
 // src/core/tls.ts
 var import_node_child_process13 = require("child_process");
 var import_node_crypto7 = require("crypto");
-var import_node_fs14 = __toESM(require("fs"));
-var import_node_path18 = __toESM(require("path"));
+var import_node_fs15 = __toESM(require("fs"));
+var import_node_path19 = __toESM(require("path"));
 var DEFAULT_TLS_CERT_HOSTS = ["localhost", "*.localhost"];
-var TLS_CERTIFICATE_LOCK_FILE = import_node_path18.default.join(DEVROUTER_HOME, "tls-certificate.lock");
+var TLS_CERTIFICATE_LOCK_FILE = import_node_path19.default.join(DEVROUTER_HOME, "tls-certificate.lock");
 var TLS_CERTIFICATE_LOCK_WAIT_MS = 6e4;
 var TLS_CERTIFICATE_WRITE_ATTEMPTS = 2;
 function runOrThrow(command, args) {
@@ -4739,8 +4921,8 @@ function tlsSetupCommand(repoPath) {
 }
 function getMkcertRootCAPath(options = {}) {
   ensureMkcert();
-  const rootCAPath = import_node_path18.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
-  if (!import_node_fs14.default.existsSync(rootCAPath)) {
+  const rootCAPath = import_node_path19.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
+  if (!import_node_fs15.default.existsSync(rootCAPath)) {
     throw new Error(
       `mkcert root CA was not found at '${rootCAPath}'. Run: ${tlsSetupCommand(options.repoPath)}`
     );
@@ -4841,11 +5023,11 @@ function compactTLSCertificateHosts(hosts) {
   );
 }
 function readCurrentCertificateHosts(options = {}) {
-  if (!import_node_fs14.default.existsSync(CERT_FILE)) {
+  if (!import_node_fs15.default.existsSync(CERT_FILE)) {
     return [];
   }
   try {
-    const pem = import_node_fs14.default.readFileSync(CERT_FILE, "utf-8");
+    const pem = import_node_fs15.default.readFileSync(CERT_FILE, "utf-8");
     return parseCertificateDnsHosts(pem);
   } catch (error) {
     if (options.replaceMalformed) {
@@ -5059,8 +5241,7 @@ function stopRetainedManagedDevsyWorkspace(options) {
     throw new Error("Managed stop requires the exact retained workspace identity.");
   }
   if (state.stopBaseline) {
-    stopFromManagedBaseline(state);
-    return true;
+    return stopFromManagedBaseline(state) === "proven-absent" ? "proven-absent" : true;
   }
   const workspaceEnv = workspace ? { token: workspace, gitCommonDir: resolveGitCommonDir(repoPath) } : void 0;
   function registration2() {
@@ -5084,8 +5265,8 @@ function stopRetainedManagedDevsyWorkspace(options) {
   if (!context || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(context) || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(devsyId)) {
     throw new Error("Managed stop requires a valid exact Devsy context and workspace ID.");
   }
-  const devsyRoot = import_node_path19.default.resolve(process.env.DEVSY_HOME || import_node_path19.default.join(import_node_os3.default.homedir(), ".devsy"));
-  const featureDirectory = import_node_path19.default.join(
+  const devsyRoot = import_node_path20.default.resolve(process.env.DEVSY_HOME || import_node_path20.default.join(import_node_os4.default.homedir(), ".devsy"));
+  const featureDirectory = import_node_path20.default.join(
     devsyRoot,
     "contexts",
     context,
@@ -5191,7 +5372,7 @@ function stopRetainedManagedDevsyWorkspace(options) {
 }
 
 // src/core/devsy-mutation.ts
-var DEVSY_MUTATION_LOCK_FILE = import_node_path20.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
+var DEVSY_MUTATION_LOCK_FILE = import_node_path21.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
 var DEVSY_MUTATION_WAIT_MS = 18e5;
 var DevsyStartPostconditionError = class extends Error {
 };
@@ -5206,7 +5387,7 @@ function failedStartMayHaveAttached(devsyId, repoPath) {
   }
 }
 function withMutationLock(activity, target, operation) {
-  import_node_fs15.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs16.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVSY_MUTATION_LOCK_FILE,
     {
@@ -5220,7 +5401,7 @@ function withMutationLock(activity, target, operation) {
   );
 }
 function withMutationLockAsync(activity, target, operation) {
-  import_node_fs15.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs16.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     DEVSY_MUTATION_LOCK_FILE,
     {
@@ -5288,12 +5469,14 @@ function inspectExactOwnership(devsyId, worktreePath) {
 }
 function mutateOwnedDevsyWorkspace(action, devsyId, worktreePath) {
   return withMutationLock(`Devsy ${action}`, worktreePath, () => {
-    if (action === "stop" && stopRetainedManagedDevsyWorkspace({
-      repoPath: worktreePath,
-      devsyId,
-      stopProvider: () => runDevsyAction("stop", devsyId)
-    }))
-      return { status: "changed" };
+    if (action === "stop") {
+      const stopped = stopRetainedManagedDevsyWorkspace({
+        repoPath: worktreePath,
+        devsyId,
+        stopProvider: () => runDevsyAction("stop", devsyId)
+      });
+      if (stopped) return { status: stopped === "proven-absent" ? "proven-absent" : "changed" };
+    }
     const before = inspectExactOwnership(devsyId, worktreePath);
     if (before.status === "absent") return { status: "absent" };
     runDevsyAction(action, devsyId);
@@ -5424,6 +5607,19 @@ async function startDevsyWorkspace(options) {
   });
 }
 
+// src/core/execution-outcome.ts
+var ExecutionOutcomeError = class extends Error {
+  outcome;
+  constructor(message, outcome) {
+    super(message);
+    this.name = "ExecutionOutcomeError";
+    this.outcome = outcome;
+  }
+};
+
+// src/core/reliability-lifecycle.ts
+var import_node_path28 = __toESM(require("path"));
+
 // src/core/reliability-contract.ts
 var RELIABILITY_CONTRACT_VERSION = 2;
 var RELIABILITY_MAX_ITEMS = 128;
@@ -5553,7 +5749,7 @@ function assertReliabilityEvent(value) {
       valid = oneOf2(value.mode, ["start", "attach"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer);
       break;
     case "operation-request":
-      valid = oneOf2(value.kind, ["ensure", "exec"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer) && typeof value.runtimeRunning === "boolean";
+      valid = oneOf2(value.kind, ["ensure", "exec"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer) && typeof value.runtimeRunning === "boolean" && (value.recoverInterruptedEnsure === void 0 || typeof value.recoverInterruptedEnsure === "boolean");
       break;
     case "drained":
       valid = isReliabilityId(value.operationId);
@@ -5736,6 +5932,10 @@ function handleRequest(state, event) {
   });
   return transition(state, "accepted");
 }
+function canExecAfterInterruptedEnsure(state) {
+  const latestEnsure = [...state.operationHistory].reverse().find((operation) => operation.kind === "ensure");
+  return state.executionPolicy === "manual" && state.desired === "running" && latestEnsure?.status === "INTERRUPTED" && latestEnsure.drained && state.operation?.drained === true && (state.operation.kind === "ensure" && state.phase === "recovering" || state.operation.kind === "exec" && ["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status));
+}
 function handleOperationRequest(state, event) {
   if (state.executionPolicy !== "manual") return unchanged(state, "blocked");
   const previous = state.operationHistory.find((entry) => entry.key === event.key);
@@ -5746,9 +5946,11 @@ function handleOperationRequest(state, event) {
     );
   if (state.operationHistory.some((entry) => entry.id === event.operationId))
     return unchanged(state, "conflict");
+  if (event.kind === "exec" && canExecAfterInterruptedEnsure(state) && event.recoverInterruptedEnsure !== true)
+    return unchanged(state, "blocked");
   const fullyStopped = state.stopProof.workloadsStopped && state.stopProof.routesRemoved;
   const reconcileEnsure = event.kind === "ensure" && state.operation?.kind === "ensure" && ["NOT_STARTED", "INTERRUPTED"].includes(state.operation.status);
-  if (state.operation && (!state.operation.drained || !["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status) && !fullyStopped && !reconcileEnsure))
+  if (state.operation && (!state.operation.drained || !["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status) && !fullyStopped && !reconcileEnsure && !(event.kind === "exec" && event.recoverInterruptedEnsure === true && canExecAfterInterruptedEnsure(state))))
     return unchanged(state, "blocked");
   if (state.phase === "stopping" || state.desired === "parked-for-capacity")
     return unchanged(state, "blocked");
@@ -5759,8 +5961,9 @@ function handleOperationRequest(state, event) {
   if (rollover) {
     if (state.operation && (!state.operation.drained || !["COMPLETED", "NOT_LAUNCHED"].includes(state.operation.status)))
       return unchanged(state, "blocked");
+    const latestEnsureId = [...state.operationHistory].reverse().find((entry) => entry.kind === "ensure")?.id;
     retired = state.operationHistory.findIndex(
-      (entry) => entry.id !== state.operation?.id && entry.drained && ["COMPLETED", "NOT_LAUNCHED"].includes(entry.status)
+      (entry) => entry.id !== state.operation?.id && entry.id !== latestEnsureId && entry.drained && ["COMPLETED", "NOT_LAUNCHED"].includes(entry.status)
     );
     if (retired === -1) return unchanged(state, "blocked");
   }
@@ -6088,7 +6291,7 @@ function applyReliabilityEvent(state, event, nowMs) {
     case "not-started":
       if (next.executionPolicy !== "manual" || next.operation?.kind !== "exec")
         return unchanged(next, "blocked");
-      if (next.operation.id !== event.operationId || next.operation.status !== "RUNNING")
+      if (next.operation.id !== event.operationId || !["RUNNING", "DISPATCH_RECORDED"].includes(next.operation.status))
         return unchanged(next, "stale");
       next.operation = { ...next.operation, status: "NOT_LAUNCHED", exitCode: null };
       return transition(next, "accepted");
@@ -6129,17 +6332,17 @@ function stepReliability(state, event, nowMs) {
 
 // src/core/reliability-operation-store.ts
 var import_node_crypto8 = require("crypto");
-var import_node_fs16 = __toESM(require("fs"));
-var import_node_path21 = __toESM(require("path"));
+var import_node_fs17 = __toESM(require("fs"));
+var import_node_path22 = __toESM(require("path"));
 var MAX_RECORD_BYTES = 1048576;
 function identityKey(identity2) {
-  if (!import_node_path21.default.isAbsolute(identity2.repoPath) || import_node_path21.default.resolve(identity2.repoPath) !== identity2.repoPath || identity2.repoPath.includes("\0") || identity2.workspace !== null && !isReliabilityId(identity2.workspace) || !["devpod", "devsy"].includes(identity2.provider)) {
+  if (!import_node_path22.default.isAbsolute(identity2.repoPath) || import_node_path22.default.resolve(identity2.repoPath) !== identity2.repoPath || identity2.repoPath.includes("\0") || identity2.workspace !== null && !isReliabilityId(identity2.workspace) || !["devpod", "devsy"].includes(identity2.provider)) {
     throw new Error("Invalid reliability workspace identity.");
   }
   return (0, import_node_crypto8.createHash)("sha256").update(identity2.repoPath).digest("hex");
 }
 function reliabilityOperationPath(identity2) {
-  return import_node_path21.default.join(DEVROUTER_HOME, "reliability", `${identityKey(identity2)}.json`);
+  return import_node_path22.default.join(DEVROUTER_HOME, "reliability", `${identityKey(identity2)}.json`);
 }
 function keys(value, expected) {
   if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !expected.includes(key))) {
@@ -6218,21 +6421,21 @@ function readReliabilityOperation(identity2) {
   const file = reliabilityOperationPath(identity2);
   let descriptor;
   try {
-    descriptor = import_node_fs16.default.openSync(
+    descriptor = import_node_fs17.default.openSync(
       file,
-      import_node_fs16.default.constants.O_RDONLY | import_node_fs16.default.constants.O_NOFOLLOW | import_node_fs16.default.constants.O_NONBLOCK
+      import_node_fs17.default.constants.O_RDONLY | import_node_fs17.default.constants.O_NOFOLLOW | import_node_fs17.default.constants.O_NONBLOCK
     );
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
   }
   try {
-    const stat = import_node_fs16.default.fstatSync(descriptor);
+    const stat = import_node_fs17.default.fstatSync(descriptor);
     if (!stat.isFile() || stat.size > MAX_RECORD_BYTES || (stat.mode & 63) !== 0) {
       throw new Error("Reliability record is not a bounded private file.");
     }
     const bytes = Buffer.alloc(MAX_RECORD_BYTES + 1);
-    const count = import_node_fs16.default.readSync(descriptor, bytes, 0, bytes.length, 0);
+    const count = import_node_fs17.default.readSync(descriptor, bytes, 0, bytes.length, 0);
     if (count > MAX_RECORD_BYTES) throw new Error("Reliability record exceeds its byte limit.");
     const record4 = JSON.parse(
       bytes.subarray(0, count).toString("utf8")
@@ -6240,7 +6443,7 @@ function readReliabilityOperation(identity2) {
     validate(record4, identity2);
     return record4;
   } finally {
-    import_node_fs16.default.closeSync(descriptor);
+    import_node_fs17.default.closeSync(descriptor);
   }
 }
 function persist(record4) {
@@ -6255,23 +6458,23 @@ function persist(record4) {
   } catch (error) {
     const reread = readReliabilityOperation(record4.identity);
     if (!reread || JSON.stringify(reread) !== JSON.stringify(record4)) throw error;
-    const descriptor = import_node_fs16.default.openSync(file, import_node_fs16.default.constants.O_RDONLY | import_node_fs16.default.constants.O_NOFOLLOW);
+    const descriptor = import_node_fs17.default.openSync(file, import_node_fs17.default.constants.O_RDONLY | import_node_fs17.default.constants.O_NOFOLLOW);
     try {
-      import_node_fs16.default.fsyncSync(descriptor);
+      import_node_fs17.default.fsyncSync(descriptor);
     } finally {
-      import_node_fs16.default.closeSync(descriptor);
+      import_node_fs17.default.closeSync(descriptor);
     }
-    const directory = import_node_fs16.default.openSync(import_node_path21.default.dirname(file), "r");
+    const directory = import_node_fs17.default.openSync(import_node_path22.default.dirname(file), "r");
     try {
-      import_node_fs16.default.fsyncSync(directory);
+      import_node_fs17.default.fsyncSync(directory);
     } finally {
-      import_node_fs16.default.closeSync(directory);
+      import_node_fs17.default.closeSync(directory);
     }
   }
 }
 function updateReliabilityOperation(identity2, operation) {
   const file = reliabilityOperationPath(identity2);
-  import_node_fs16.default.mkdirSync(import_node_path21.default.dirname(file), { recursive: true, mode: 448 });
+  import_node_fs17.default.mkdirSync(import_node_path22.default.dirname(file), { recursive: true, mode: 448 });
   return withFileLockSync(`${file}.lock`, { activity: "reliability intent", waitMs: 2e3 }, () => {
     const record4 = readReliabilityOperation(identity2) ?? {
       version: 1,
@@ -6298,8 +6501,8 @@ function updateReliabilityOperation(identity2, operation) {
 // src/core/reliability-worker.ts
 var import_node_child_process15 = require("child_process");
 var import_node_crypto9 = require("crypto");
-var import_node_fs17 = __toESM(require("fs"));
-var import_node_path22 = __toESM(require("path"));
+var import_node_fs18 = __toESM(require("fs"));
+var import_node_path23 = __toESM(require("path"));
 function workerGroupAbsent(pid) {
   try {
     process.kill(-pid, 0);
@@ -6309,53 +6512,377 @@ function workerGroupAbsent(pid) {
   }
 }
 
-// src/core/workspace-ensure.ts
-var import_node_child_process21 = require("child_process");
-var import_node_fs22 = __toESM(require("fs"));
-var import_node_path26 = __toESM(require("path"));
-
-// src/core/devpod-mutation.ts
+// src/core/traefik-route-health.ts
 var import_node_child_process16 = require("child_process");
-var import_node_fs18 = __toESM(require("fs"));
-var import_node_path23 = __toESM(require("path"));
-var DEVPOD_MUTATION_LOCK_FILE = import_node_path23.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
-var DEVPOD_MUTATION_WAIT_MS = 18e5;
-var DevpodStartPostconditionError = class extends Error {
-};
-function withMutationLock2(activity, target, operation) {
-  import_node_fs18.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
-  return withFileLockSync(
-    DEVPOD_MUTATION_LOCK_FILE,
-    {
-      activity,
-      target: `'${target}'`,
-      waitMs: DEVPOD_MUTATION_WAIT_MS,
-      fair: true,
-      onWait: createStderrWaitReporter(activity, `'${target}'`)
-    },
-    operation
-  );
-}
-function commandFailure2(result) {
-  return [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+var import_node_fs19 = __toESM(require("fs"));
+var import_node_path24 = __toESM(require("path"));
+var ROUTER_API_BASE = "http://127.0.0.1:8080/api";
+var ROUTER_RELOAD_LOCK_FILE = import_node_path24.default.join(DEVROUTER_HOME, "router-reload.lock");
+var ROUTER_API_REQUEST_TIMEOUT_SECONDS = "2";
+var DEFAULT_INITIAL_TIMEOUT_MS = 3e3;
+var DEFAULT_RECOVERY_TIMEOUT_MS = 1e4;
+var DEFAULT_POLL_INTERVAL_MS = 250;
+var ROUTER_API_PAGE_SIZE = 1e3;
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function runDevpodAction(action, devpodId, force = false) {
-  const args = action === "delete" ? [action, devpodId, ...force ? ["--force"] : [], "--ignore-not-found"] : [action, devpodId];
-  claimLifecycleEffect();
-  const result = (0, import_node_child_process16.spawnSync)("devpod", args, { encoding: "utf-8" });
+function inspectRouterApi(protocol) {
+  const result = (0, import_node_child_process16.spawnSync)(
+    "curl",
+    [
+      "--silent",
+      "--show-error",
+      "--fail",
+      "--max-time",
+      ROUTER_API_REQUEST_TIMEOUT_SECONDS,
+      `${ROUTER_API_BASE}/${protocol}/routers?per_page=${ROUTER_API_PAGE_SIZE}`
+    ],
+    { encoding: "utf-8" }
+  );
   if (result.status !== 0) {
-    throw new Error(
-      `devpod ${action}${force ? " --force" : ""} failed for '${devpodId}': ${commandFailure2(result) || "unknown error"}`
-    );
+    return {
+      ok: false,
+      details: result.stderr?.trim() || `curl exited with status ${result.status ?? "unknown"}`
+    };
+  }
+  let value;
+  try {
+    value = JSON.parse(result.stdout);
+  } catch {
+    return { ok: false, details: `${protocol.toUpperCase()} router API returned invalid JSON` };
   }
+  if (!Array.isArray(value)) {
+    return { ok: false, details: `${protocol.toUpperCase()} router API returned a non-array` };
+  }
+  if (value.some((item) => !isRecord3(item) || typeof item.name !== "string" || !item.name))
+    return {
+      ok: false,
+      details: `${protocol.toUpperCase()} router API returned malformed entries`
+    };
+  return {
+    ok: true,
+    reachedPageLimit: value.length >= ROUTER_API_PAGE_SIZE,
+    names: new Set(
+      value.flatMap((item) => {
+        if (!item || typeof item !== "object") return [];
+        const name = item.name;
+        return typeof name === "string" ? [name] : [];
+      })
+    )
+  };
 }
-function inspectExactOwnership2(devpodId, worktreePath) {
-  const ownership = inspectDevpodWorkspaceOwnership(
-    listDevpodWorkspaces(worktreePath),
-    devpodId,
-    worktreePath
-  );
-  if (ownership.status === "conflict") throw new Error(ownership.reason);
+function isRecord3(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function inspectNamedRouterApi(protocol, resource, name) {
+  const result = (0, import_node_child_process16.spawnSync)(
+    "curl",
+    [
+      "--silent",
+      "--show-error",
+      "--fail",
+      "--max-time",
+      ROUTER_API_REQUEST_TIMEOUT_SECONDS,
+      `${ROUTER_API_BASE}/${protocol}/${resource}/${encodeURIComponent(name)}`
+    ],
+    { encoding: "utf-8" }
+  );
+  if (result.status !== 0) {
+    return {
+      ok: false,
+      details: result.stderr?.trim() || `curl exited with status ${result.status ?? "unknown"}`
+    };
+  }
+  let value;
+  try {
+    value = JSON.parse(result.stdout);
+  } catch {
+    return {
+      ok: false,
+      details: `${protocol.toUpperCase()} ${resource.slice(0, -1)} API returned invalid JSON`
+    };
+  }
+  if (!isRecord3(value)) {
+    return {
+      ok: false,
+      details: `${protocol.toUpperCase()} ${resource.slice(0, -1)} API returned a non-object`
+    };
+  }
+  return { ok: true, value };
+}
+function renderExpectedRoute(route) {
+  const protocol = route.protocol ?? "http";
+  const routerName = buildHostRouteRouterName(route.repoPath, route.name);
+  const routeState = {
+    id: buildHostRouteId(route.repoPath, route.name),
+    name: route.name,
+    host: route.host,
+    protocol,
+    tcpProtocol: route.tcpProtocol,
+    repoPath: route.repoPath,
+    port: route.port,
+    mode: route.mode,
+    upstreamHost: route.upstreamHost,
+    pid: route.pid,
+    command: route.command,
+    workspace: route.workspace,
+    createdAt: "",
+    updatedAt: ""
+  };
+  const document = buildHostRoutesDocument([routeState], false);
+  const protocolDocument = document[protocol];
+  if (!isRecord3(protocolDocument)) return void 0;
+  const routers = protocolDocument.routers;
+  const services = protocolDocument.services;
+  if (!isRecord3(routers) || !isRecord3(services)) return void 0;
+  const routerKey = routerName.slice(0, routerName.lastIndexOf("@"));
+  const router = routers[routerKey];
+  const service = services[routerKey];
+  if (!isRecord3(router) || !isRecord3(service)) return void 0;
+  const rule = router.rule;
+  const serviceReference = router.service;
+  const loadBalancer = service.loadBalancer;
+  const servers = isRecord3(loadBalancer) ? loadBalancer.servers : void 0;
+  if (typeof rule !== "string" || serviceReference !== routerKey || !isRecord3(loadBalancer) || !Array.isArray(servers) || servers.length !== 1 || !isRecord3(servers[0])) {
+    return void 0;
+  }
+  const serverField = protocol === "http" ? "url" : "address";
+  const server = servers[0][serverField];
+  if (typeof server !== "string") return void 0;
+  const provider = routerName.slice(routerName.lastIndexOf("@")).trim();
+  if (!provider.startsWith("@")) return void 0;
+  return {
+    protocol,
+    routerName,
+    serviceKey: routerKey,
+    serviceName: `${routerKey}${provider}`,
+    rule,
+    serverField,
+    server
+  };
+}
+function inspectExpectedRouteMatch(route) {
+  const expected = renderExpectedRoute(route);
+  const routeName = buildHostRouteRouterName(route.repoPath, route.name);
+  if (!expected) {
+    return {
+      ok: false,
+      routes: [routeName],
+      details: "host-route renderer returned an incomplete route configuration"
+    };
+  }
+  const routerResult = inspectNamedRouterApi(expected.protocol, "routers", expected.routerName);
+  if (!routerResult.ok) {
+    return { ok: false, routes: [routeName], details: routerResult.details };
+  }
+  if (routerResult.value.status !== "enabled" || routerResult.value.name !== expected.routerName || routerResult.value.rule !== expected.rule || routerResult.value.service !== expected.serviceKey && routerResult.value.service !== expected.serviceName) {
+    return {
+      ok: false,
+      routes: [routeName],
+      details: "active Traefik router does not match the rendered route"
+    };
+  }
+  const serviceResult = inspectNamedRouterApi(expected.protocol, "services", expected.serviceName);
+  if (!serviceResult.ok) {
+    return { ok: false, routes: [routeName], details: serviceResult.details };
+  }
+  const loadBalancer = serviceResult.value.loadBalancer;
+  const servers = isRecord3(loadBalancer) ? loadBalancer.servers : void 0;
+  const server = Array.isArray(servers) && servers.length === 1 ? servers[0] : void 0;
+  if (serviceResult.value.status !== "enabled" || serviceResult.value.name !== expected.serviceName || !isRecord3(loadBalancer) || !Array.isArray(servers) || servers.length !== 1 || !isRecord3(server) || server[expected.serverField] !== expected.server) {
+    return {
+      ok: false,
+      routes: [routeName],
+      details: "active Traefik service does not match the rendered route"
+    };
+  }
+  return { ok: true };
+}
+function inspectExpectedRouteMatches(routes) {
+  const mismatched = [];
+  const failures = [];
+  for (const route of routes) {
+    const result = inspectExpectedRouteMatch(route);
+    if (!result.ok) {
+      mismatched.push(...result.routes);
+      failures.push(result.details);
+    }
+  }
+  return mismatched.length === 0 ? { ok: true } : {
+    ok: false,
+    routes: mismatched,
+    details: failures.join("; ")
+  };
+}
+async function waitForExpectedRouteMatches(routes, timeoutMs, pollIntervalMs) {
+  const deadline = Date.now() + timeoutMs;
+  let result;
+  do {
+    result = inspectExpectedRouteMatches(routes);
+    if (result.ok) return result;
+    if (Date.now() < deadline) {
+      await sleep(Math.min(pollIntervalMs, Math.max(1, deadline - Date.now())));
+    }
+  } while (Date.now() < deadline);
+  return result;
+}
+function inspectExpectedRoutes(routes, expectation) {
+  const mismatched = [];
+  const failures = [];
+  for (const protocol of ["http", "tcp"]) {
+    const expected = routes.filter((route) => (route.protocol ?? "http") === protocol).map((route) => buildHostRouteRouterName(route.repoPath, route.name));
+    if (expected.length === 0) continue;
+    const result = inspectRouterApi(protocol);
+    if (!result.ok) {
+      failures.push(result.details);
+      mismatched.push(...expected);
+      continue;
+    }
+    const unexpected = expected.filter(
+      (name) => expectation === "loaded" ? !result.names.has(name) : result.names.has(name)
+    );
+    const boundedAbsenceIsUncertain = result.reachedPageLimit && (expectation === "loaded" ? unexpected.length > 0 : unexpected.length === 0);
+    if (boundedAbsenceIsUncertain) {
+      failures.push(
+        `${protocol.toUpperCase()} router API reached the ${ROUTER_API_PAGE_SIZE}-entry safety limit`
+      );
+    }
+    mismatched.push(...unexpected);
+    if (expectation === "removed" && unexpected.length === 0 && result.reachedPageLimit) {
+      mismatched.push(...expected);
+    }
+  }
+  return mismatched.length === 0 ? { ok: true } : {
+    ok: false,
+    routes: mismatched,
+    details: failures.length > 0 ? failures.join("; ") : expectation === "loaded" ? "router names are absent" : "router names are still present"
+  };
+}
+async function waitForExpectedRoutes(routes, expectation, timeoutMs, pollIntervalMs) {
+  const deadline = Date.now() + timeoutMs;
+  let result;
+  do {
+    result = inspectExpectedRoutes(routes, expectation);
+    if (result.ok) return result;
+    if (Date.now() < deadline) {
+      await sleep(Math.min(pollIntervalMs, Math.max(1, deadline - Date.now())));
+    }
+  } while (Date.now() < deadline);
+  return result;
+}
+async function ensureTraefikRouteExpectation(routes, expectation, options) {
+  if (routes.length === 0) return { restarted: false };
+  const initialTimeoutMs = options.initialTimeoutMs ?? DEFAULT_INITIAL_TIMEOUT_MS;
+  const recoveryTimeoutMs = options.recoveryTimeoutMs ?? DEFAULT_RECOVERY_TIMEOUT_MS;
+  const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const initial = await waitForExpectedRoutes(
+    routes,
+    expectation,
+    initialTimeoutMs,
+    pollIntervalMs
+  );
+  if (initial.ok) return { restarted: false };
+  if (options.allowRestart === false)
+    throw new Error(
+      "Traefik routes did not reload; shared router restart is disabled for this operation."
+    );
+  import_node_fs19.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  return withFileLock(
+    ROUTER_RELOAD_LOCK_FILE,
+    {
+      activity: "Traefik route reload recovery",
+      waitMs: initialTimeoutMs + recoveryTimeoutMs + 1e4,
+      fair: true,
+      onWait: createStderrWaitReporter("Traefik route reload recovery", "shared router")
+    },
+    async () => {
+      const recheck = await waitForExpectedRoutes(routes, expectation, 0, pollIntervalMs);
+      if (recheck.ok) return { restarted: false };
+      claimLifecycleEffect();
+      restartRouterStack();
+      const recovered = await waitForExpectedRoutes(
+        routes,
+        expectation,
+        recoveryTimeoutMs,
+        pollIntervalMs
+      );
+      if (recovered.ok) return { restarted: true };
+      const action = expectation === "loaded" ? "load" : "remove";
+      throw new Error(
+        `Traefik did not ${action} file-provider routes after one restart: ${recovered.routes.join(", ")} (${recovered.details}). Inspect: devrouter logs --tail 100`
+      );
+    }
+  );
+}
+async function ensureTraefikRoutesLoaded(routes, options = {}) {
+  return ensureTraefikRouteExpectation(routes, "loaded", options);
+}
+async function ensureTraefikRoutesMatch(routes, options = {}) {
+  if (routes.length === 0) return;
+  const timeoutMs = options.initialTimeoutMs ?? options.recoveryTimeoutMs ?? DEFAULT_INITIAL_TIMEOUT_MS;
+  const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const result = await waitForExpectedRouteMatches(routes, timeoutMs, pollIntervalMs);
+  if (!result.ok) {
+    throw new Error(
+      `Traefik route configuration did not match rendered routes: ${result.routes.join(", ")} (${result.details})`
+    );
+  }
+}
+async function ensureTraefikRoutesRemoved(routes, options = {}) {
+  return ensureTraefikRouteExpectation(routes, "removed", options);
+}
+function assertTraefikRoutesRemoved(routes) {
+  const result = inspectExpectedRoutes(routes, "removed");
+  if (!result.ok) throw new Error(`Workspace route cessation is not proven: ${result.details}`);
+}
+
+// src/core/workspace-ensure.ts
+var import_node_child_process21 = require("child_process");
+var import_node_fs23 = __toESM(require("fs"));
+var import_node_path27 = __toESM(require("path"));
+
+// src/core/devpod-mutation.ts
+var import_node_child_process17 = require("child_process");
+var import_node_fs20 = __toESM(require("fs"));
+var import_node_path25 = __toESM(require("path"));
+var DEVPOD_MUTATION_LOCK_FILE = import_node_path25.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+var DEVPOD_MUTATION_WAIT_MS = 18e5;
+var DevpodStartPostconditionError = class extends Error {
+};
+function withMutationLock2(activity, target, operation) {
+  import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  return withFileLockSync(
+    DEVPOD_MUTATION_LOCK_FILE,
+    {
+      activity,
+      target: `'${target}'`,
+      waitMs: DEVPOD_MUTATION_WAIT_MS,
+      fair: true,
+      onWait: createStderrWaitReporter(activity, `'${target}'`)
+    },
+    operation
+  );
+}
+function commandFailure2(result) {
+  return [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+}
+function runDevpodAction(action, devpodId, force = false) {
+  const args = action === "delete" ? [action, devpodId, ...force ? ["--force"] : [], "--ignore-not-found"] : [action, devpodId];
+  claimLifecycleEffect();
+  const result = (0, import_node_child_process17.spawnSync)("devpod", args, { encoding: "utf-8" });
+  if (result.status !== 0) {
+    throw new Error(
+      `devpod ${action}${force ? " --force" : ""} failed for '${devpodId}': ${commandFailure2(result) || "unknown error"}`
+    );
+  }
+}
+function inspectExactOwnership2(devpodId, worktreePath) {
+  const ownership = inspectDevpodWorkspaceOwnership(
+    listDevpodWorkspaces(worktreePath),
+    devpodId,
+    worktreePath
+  );
+  if (ownership.status === "conflict") throw new Error(ownership.reason);
   return ownership;
 }
 function mutateOwnedDevpodWorkspace(action, devpodId, worktreePath) {
@@ -6472,7 +6999,7 @@ async function startDevpodWorkspace(options) {
       delete env.DEVCONTAINER_COMPOSE_OVERLAY;
     }
     claimLifecycleEffect();
-    const result = (0, import_node_child_process16.spawnSync)("devpod", args, {
+    const result = (0, import_node_child_process17.spawnSync)("devpod", args, {
       stdio: options.quiet ? ["inherit", 2, "inherit"] : "inherit",
       env
     });
@@ -6505,7 +7032,7 @@ async function startDevpodWorkspace(options) {
 }
 
 // src/core/http-route-probe.ts
-var import_node_child_process17 = require("child_process");
+var import_node_child_process18 = require("child_process");
 var DEFAULT_MAX_TIME_SECONDS = 5;
 var PARENT_TIMEOUT_PADDING_MS = 250;
 var CONTRACT_MAX_BUFFER = 1024;
@@ -6538,7 +7065,7 @@ function probeHttpRoute(host, options = {}) {
     args.push("--cacert", CERT_FILE);
   }
   args.push(url);
-  const result = (0, import_node_child_process17.spawnSync)("curl", args, { encoding: "utf-8" });
+  const result = (0, import_node_child_process18.spawnSync)("curl", args, { encoding: "utf-8" });
   const stdout = result.stdout?.trim() ?? "";
   const status = /^\d{3}$/.test(stdout) ? Number(stdout) : void 0;
   const ok = result.status === 0 && status !== void 0 && status >= 100 && status < 500;
@@ -6557,7 +7084,7 @@ function probeHttpReadinessSync(host, readiness, maxTimeSeconds, repoPath) {
   }
   let result;
   try {
-    result = (0, import_node_child_process17.spawnSync)("curl", args, {
+    result = (0, import_node_child_process18.spawnSync)("curl", args, {
       encoding: "utf-8",
       maxBuffer: CONTRACT_MAX_BUFFER,
       timeout: Math.ceil(parentTimeoutMs)
@@ -6641,8 +7168,8 @@ function transportFailure() {
 }
 
 // src/core/managed-host-preparation.ts
-var import_node_child_process18 = require("child_process");
-var import_node_fs19 = __toESM(require("fs"));
+var import_node_child_process19 = require("child_process");
+var import_node_fs21 = __toESM(require("fs"));
 var PREPARATION_TIMEOUT_MS = 6e4;
 var CONFIG_READ_ERROR = "Managed host preparation could not read .devrouter.yml.";
 var CONFIG_CHANGED_ERROR = "Managed host preparation changed .devrouter.yml; refusing to continue.";
@@ -6653,7 +7180,7 @@ function runPreparationCommand(argv, cwd) {
   return new Promise((resolve) => {
     let child;
     try {
-      child = (0, import_node_child_process18.spawn)(argv[0], argv.slice(1), {
+      child = (0, import_node_child_process19.spawn)(argv[0], argv.slice(1), {
         cwd,
         detached: true,
         shell: false,
@@ -6685,7 +7212,7 @@ function runPreparationCommand(argv, cwd) {
 }
 function readConfigBytes(configPath) {
   try {
-    return import_node_fs19.default.readFileSync(configPath);
+    return import_node_fs21.default.readFileSync(configPath);
   } catch {
     return void 0;
   }
@@ -6719,10 +7246,10 @@ async function runManagedHostPreparation(repoPath, config) {
 }
 
 // src/core/managed-post-start.ts
-var import_node_child_process19 = require("child_process");
+var import_node_child_process20 = require("child_process");
 var import_node_crypto10 = require("crypto");
-var import_node_fs20 = __toESM(require("fs"));
-var import_node_path24 = __toESM(require("path"));
+var import_node_fs22 = __toESM(require("fs"));
+var import_node_path26 = __toESM(require("path"));
 var MANAGED_MARKER = "devrouter:managed devcontainer";
 var MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
 var RUNTIME_HELPER_PATH = "/tmp/devrouter/bin/devrouter-process";
@@ -6735,7 +7262,7 @@ function renderDeliveryScript(targetPath) {
   if (!/^\/tmp\/devrouter\/bin\/[a-zA-Z0-9._-]+$/.test(targetPath)) {
     throw new Error(`Unsafe managed runtime delivery path: ${targetPath}`);
   }
-  const temporaryPrefix = import_node_path24.default.posix.basename(targetPath);
+  const temporaryPrefix = import_node_path26.default.posix.basename(targetPath);
   return `set -eu
 umask 077
 runtime_root=/tmp/devrouter
@@ -6759,7 +7286,7 @@ function commandFailure3(result) {
   return [result.error?.message, result.stderr, result.stdout].filter(Boolean).map((value) => String(value).trim()).filter(Boolean).join("\n");
 }
 function deliverRuntimeFile(containerId, targetPath, contents, label) {
-  const result = (0, import_node_child_process19.spawnSync)(
+  const result = (0, import_node_child_process20.spawnSync)(
     "docker",
     ["exec", "-i", containerId, "sh", "-c", renderDeliveryScript(targetPath)],
     { input: contents, encoding: "utf-8" }
@@ -6770,8 +7297,8 @@ function deliverRuntimeFile(containerId, targetPath, contents, label) {
   }
 }
 function readRegularFileBytes(filePath) {
-  if (!import_node_fs20.default.existsSync(filePath) || !import_node_fs20.default.lstatSync(filePath).isFile()) return void 0;
-  return import_node_fs20.default.readFileSync(filePath);
+  if (!import_node_fs22.default.existsSync(filePath) || !import_node_fs22.default.lstatSync(filePath).isFile()) return void 0;
+  return import_node_fs22.default.readFileSync(filePath);
 }
 function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
@@ -6781,21 +7308,21 @@ function adapterFingerprint(adapter) {
 }
 function resolveProcessHelperPath() {
   const candidates = [
-    import_node_path24.default.resolve(__dirname, "..", "bin", "devrouter-process"),
-    import_node_path24.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
+    import_node_path26.default.resolve(__dirname, "..", "bin", "devrouter-process"),
+    import_node_path26.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
   ];
-  const helperPath = candidates.find((candidate) => import_node_fs20.default.existsSync(candidate));
+  const helperPath = candidates.find((candidate) => import_node_fs22.default.existsSync(candidate));
   if (!helperPath) {
     throw new Error("Could not locate the packaged devrouter-process helper.");
   }
   return helperPath;
 }
 function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path24.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterPath = import_node_path26.default.join(repoPath, MANAGED_ADAPTER_PATH);
   const adapterBytes = readRegularFileBytes(adapterPath);
   const adapterText = adapterBytes?.toString("utf-8");
-  const dockerfilePath = import_node_path24.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path24.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfilePath = import_node_path26.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path26.default.join(repoPath, ".devcontainer", "devcontainer.json");
   const dockerfile = readRegularFile(dockerfilePath) ?? "";
   const devcontainer = readRegularFile(devcontainerPath) ?? "";
   const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
@@ -6836,7 +7363,7 @@ function resolveManagedPostStartPlan(repoPath) {
 }
 function runManagedPostStart(options) {
   if (options.plan.kind !== "runtime") return;
-  const helper = import_node_fs20.default.readFileSync(resolveProcessHelperPath());
+  const helper = import_node_fs22.default.readFileSync(resolveProcessHelperPath());
   deliverRuntimeFile(
     options.container.id,
     RUNTIME_HELPER_PATH,
@@ -6850,7 +7377,7 @@ function runManagedPostStart(options) {
     options.plan.adapterContents,
     "the managed post-start adapter"
   );
-  const started = (0, import_node_child_process19.spawnSync)(
+  const started2 = (0, import_node_child_process20.spawnSync)(
     "docker",
     [
       "exec",
@@ -6876,8 +7403,8 @@ function runManagedPostStart(options) {
     ],
     { stdio: options.quiet ? ["ignore", 2, "inherit"] : "inherit" }
   );
-  if (started.status !== 0) {
-    const details = commandFailure3(started);
+  if (started2.status !== 0) {
+    const details = commandFailure3(started2);
     throw new Error(`Managed post-start failed${details ? `: ${details}.` : "."}`);
   }
 }
@@ -6888,7 +7415,7 @@ function assertSafeProcessName(name) {
 }
 function runManagedProcessAction(options) {
   assertSafeProcessName(options.name);
-  const result = (0, import_node_child_process19.spawnSync)(
+  const result = (0, import_node_child_process20.spawnSync)(
     "docker",
     [
       "exec",
@@ -7250,420 +7777,105 @@ function collectManagedRuntimeStatus(options) {
   if (state) {
     const desiredState = {
       apps: sortedUnique(state.desired.apps),
-      services: sortedUnique(state.desired.services),
-      processes: sortedUnique(state.desired.processes)
-    };
-    const desired = {
-      apps: desiredApps,
-      services: desiredServices,
-      processes: desiredProcesses
-    };
-    for (const [label, expected, actual] of [
-      ["apps", desired.apps, desiredState.apps],
-      ["services", desired.services, desiredState.services],
-      ["processes", desired.processes, desiredState.processes]
-    ]) {
-      const mismatch = compareResourceSet(label, expected, actual);
-      if (mismatch) drift.push(mismatch);
-    }
-    if (state.profile !== options.profile)
-      drift.push("active profile differs from the selected profile");
-  }
-  const inspection = inspectManagedRuntime({
-    repoPath: options.repoPath,
-    config: options.config,
-    registeredServices,
-    registeredProcesses,
-    desiredServices,
-    desiredProcesses,
-    workspace: options.workspace,
-    state
-  });
-  drift.push(...inspection.drift);
-  if (state && inspection.plan && state.sourceConfigSha256 !== inspection.plan.sourceConfigSha256) {
-    drift.push("managed Dev Container source configuration changed");
-  }
-  if (state && inspection.plan && state.effectiveConfigSha256 !== inspection.plan.effectiveConfigSha256) {
-    drift.push("managed Dev Container effective configuration changed");
-  }
-  if (state && inspection.generatedConfigSha256 && state.effectiveConfigSha256 !== inspection.generatedConfigSha256) {
-    drift.push("managed generated Dev Container configuration differs from last successful state");
-  }
-  const routes = exactRoutes(options.repoPath, options.workspace);
-  drift.push(...routes.drift);
-  const activeApps = routes.apps;
-  const anyActive = inspection.primaryActive || inspection.activeServices.length > 0 || Object.values(inspection.baseStatuses).some(isActiveResourceStatus) || inspection.activeProcesses.length > 0 || activeApps.length > 0;
-  if (activeApps.length > 0 && !inspection.primaryActive) {
-    drift.push("active app routes exist without a running primary container");
-  }
-  if (desiredApps.some((app) => !activeApps.includes(app)) && anyActive) {
-    drift.push("one or more selected app routes are missing");
-  }
-  if (activeApps.some((app) => !desiredApps.includes(app))) {
-    drift.push("one or more active app routes are outside the selected profile");
-  }
-  if (inspection.activeServices.some((service) => !desiredServices.includes(service))) {
-    drift.push("one or more active services are outside the selected profile");
-  }
-  if (inspection.activeProcesses.some((process2) => !desiredProcesses.includes(process2))) {
-    drift.push("one or more active processes are outside the selected profile");
-  }
-  const positivelyStopped = !inspection.primaryActive && Object.values(inspection.baseStatuses).every(isStoppedOrMissingResourceStatus) && Object.values(inspection.serviceStatuses).every(isStoppedOrMissingResourceStatus) && activeApps.length === 0;
-  const onlyDegradedIncident = state?.status === "degraded" && drift.length === 1;
-  const requiredServicesReady = desiredServices.every(
-    (service) => isReadyResourceStatus(inspection.serviceStatuses[service] ?? "missing")
-  );
-  const baseServicesReady = Object.values(inspection.baseStatuses).every(isReadyResourceStatus);
-  const processesReady = desiredProcesses.every(
-    (process2) => isReadyResourceStatus(inspection.processStatuses[process2] ?? "missing")
-  );
-  const routesReady = desiredApps.every((app) => activeApps.includes(app));
-  const ready = inspection.primaryReady && requiredServicesReady && baseServicesReady && processesReady && routesReady && !stateReadFailed && !drift.length;
-  const status = positivelyStopped && onlyDegradedIncident ? "stopped" : state?.status === "degraded" ? "failed-transition" : drift.length > 0 ? "drifted" : ready ? "ready" : anyActive ? "starting" : "stopped";
-  const active = {
-    apps: activeApps,
-    services: inspection.activeServices,
-    processes: inspection.activeProcesses
-  };
-  return {
-    mode: "managed",
-    status,
-    profile: options.profile,
-    ...state?.profile ? { activeProfile: state.profile } : {},
-    ...options.workspace !== void 0 ? { workspace: options.workspace } : {},
-    ...state?.devpodId ? { devpodId: state.devpodId } : {},
-    ...inspection.composeProject ? { composeProject: inspection.composeProject } : {},
-    desired: {
-      apps: desiredApps,
-      services: desiredServices,
-      processes: desiredProcesses
-    },
-    active,
-    serviceStatuses: inspection.serviceStatuses,
-    baseServiceStatuses: inspection.baseStatuses,
-    processStatuses: inspection.processStatuses,
-    drift: sortedUnique(drift),
-    ...inspection.plan?.sourceConfigSha256 || state?.sourceConfigSha256 ? { sourceConfigSha256: inspection.plan?.sourceConfigSha256 ?? state?.sourceConfigSha256 } : {},
-    ...inspection.plan?.effectiveConfigSha256 || state?.effectiveConfigSha256 ? {
-      effectiveConfigSha256: inspection.plan?.effectiveConfigSha256 ?? state?.effectiveConfigSha256
-    } : {},
-    ...state?.transitionPhase ? { transitionPhase: state.transitionPhase } : {}
-  };
-}
-
-// src/core/traefik-route-health.ts
-var import_node_child_process20 = require("child_process");
-var import_node_fs21 = __toESM(require("fs"));
-var import_node_path25 = __toESM(require("path"));
-var ROUTER_API_BASE = "http://127.0.0.1:8080/api";
-var ROUTER_RELOAD_LOCK_FILE = import_node_path25.default.join(DEVROUTER_HOME, "router-reload.lock");
-var ROUTER_API_REQUEST_TIMEOUT_SECONDS = "2";
-var DEFAULT_INITIAL_TIMEOUT_MS = 3e3;
-var DEFAULT_RECOVERY_TIMEOUT_MS = 1e4;
-var DEFAULT_POLL_INTERVAL_MS = 250;
-var ROUTER_API_PAGE_SIZE = 1e3;
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function inspectRouterApi(protocol) {
-  const result = (0, import_node_child_process20.spawnSync)(
-    "curl",
-    [
-      "--silent",
-      "--show-error",
-      "--fail",
-      "--max-time",
-      ROUTER_API_REQUEST_TIMEOUT_SECONDS,
-      `${ROUTER_API_BASE}/${protocol}/routers?per_page=${ROUTER_API_PAGE_SIZE}`
-    ],
-    { encoding: "utf-8" }
-  );
-  if (result.status !== 0) {
-    return {
-      ok: false,
-      details: result.stderr?.trim() || `curl exited with status ${result.status ?? "unknown"}`
-    };
-  }
-  let value;
-  try {
-    value = JSON.parse(result.stdout);
-  } catch {
-    return { ok: false, details: `${protocol.toUpperCase()} router API returned invalid JSON` };
-  }
-  if (!Array.isArray(value)) {
-    return { ok: false, details: `${protocol.toUpperCase()} router API returned a non-array` };
-  }
-  return {
-    ok: true,
-    reachedPageLimit: value.length >= ROUTER_API_PAGE_SIZE,
-    names: new Set(
-      value.flatMap((item) => {
-        if (!item || typeof item !== "object") return [];
-        const name = item.name;
-        return typeof name === "string" ? [name] : [];
-      })
-    )
-  };
-}
-function isRecord3(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function inspectNamedRouterApi(protocol, resource, name) {
-  const result = (0, import_node_child_process20.spawnSync)(
-    "curl",
-    [
-      "--silent",
-      "--show-error",
-      "--fail",
-      "--max-time",
-      ROUTER_API_REQUEST_TIMEOUT_SECONDS,
-      `${ROUTER_API_BASE}/${protocol}/${resource}/${encodeURIComponent(name)}`
-    ],
-    { encoding: "utf-8" }
-  );
-  if (result.status !== 0) {
-    return {
-      ok: false,
-      details: result.stderr?.trim() || `curl exited with status ${result.status ?? "unknown"}`
-    };
-  }
-  let value;
-  try {
-    value = JSON.parse(result.stdout);
-  } catch {
-    return {
-      ok: false,
-      details: `${protocol.toUpperCase()} ${resource.slice(0, -1)} API returned invalid JSON`
-    };
-  }
-  if (!isRecord3(value)) {
-    return {
-      ok: false,
-      details: `${protocol.toUpperCase()} ${resource.slice(0, -1)} API returned a non-object`
-    };
-  }
-  return { ok: true, value };
-}
-function renderExpectedRoute(route) {
-  const protocol = route.protocol ?? "http";
-  const routerName = buildHostRouteRouterName(route.repoPath, route.name);
-  const routeState = {
-    id: buildHostRouteId(route.repoPath, route.name),
-    name: route.name,
-    host: route.host,
-    protocol,
-    tcpProtocol: route.tcpProtocol,
-    repoPath: route.repoPath,
-    port: route.port,
-    mode: route.mode,
-    upstreamHost: route.upstreamHost,
-    pid: route.pid,
-    command: route.command,
-    workspace: route.workspace,
-    createdAt: "",
-    updatedAt: ""
-  };
-  const document = buildHostRoutesDocument([routeState], false);
-  const protocolDocument = document[protocol];
-  if (!isRecord3(protocolDocument)) return void 0;
-  const routers = protocolDocument.routers;
-  const services = protocolDocument.services;
-  if (!isRecord3(routers) || !isRecord3(services)) return void 0;
-  const routerKey = routerName.slice(0, routerName.lastIndexOf("@"));
-  const router = routers[routerKey];
-  const service = services[routerKey];
-  if (!isRecord3(router) || !isRecord3(service)) return void 0;
-  const rule = router.rule;
-  const serviceReference = router.service;
-  const loadBalancer = service.loadBalancer;
-  const servers = isRecord3(loadBalancer) ? loadBalancer.servers : void 0;
-  if (typeof rule !== "string" || serviceReference !== routerKey || !isRecord3(loadBalancer) || !Array.isArray(servers) || servers.length !== 1 || !isRecord3(servers[0])) {
-    return void 0;
-  }
-  const serverField = protocol === "http" ? "url" : "address";
-  const server = servers[0][serverField];
-  if (typeof server !== "string") return void 0;
-  const provider = routerName.slice(routerName.lastIndexOf("@")).trim();
-  if (!provider.startsWith("@")) return void 0;
-  return {
-    protocol,
-    routerName,
-    serviceKey: routerKey,
-    serviceName: `${routerKey}${provider}`,
-    rule,
-    serverField,
-    server
-  };
-}
-function inspectExpectedRouteMatch(route) {
-  const expected = renderExpectedRoute(route);
-  const routeName = buildHostRouteRouterName(route.repoPath, route.name);
-  if (!expected) {
-    return {
-      ok: false,
-      routes: [routeName],
-      details: "host-route renderer returned an incomplete route configuration"
+      services: sortedUnique(state.desired.services),
+      processes: sortedUnique(state.desired.processes)
+    };
+    const desired = {
+      apps: desiredApps,
+      services: desiredServices,
+      processes: desiredProcesses
     };
+    for (const [label, expected, actual] of [
+      ["apps", desired.apps, desiredState.apps],
+      ["services", desired.services, desiredState.services],
+      ["processes", desired.processes, desiredState.processes]
+    ]) {
+      const mismatch = compareResourceSet(label, expected, actual);
+      if (mismatch) drift.push(mismatch);
+    }
+    if (state.profile !== options.profile)
+      drift.push("active profile differs from the selected profile");
   }
-  const routerResult = inspectNamedRouterApi(expected.protocol, "routers", expected.routerName);
-  if (!routerResult.ok) {
-    return { ok: false, routes: [routeName], details: routerResult.details };
+  const inspection = inspectManagedRuntime({
+    repoPath: options.repoPath,
+    config: options.config,
+    registeredServices,
+    registeredProcesses,
+    desiredServices,
+    desiredProcesses,
+    workspace: options.workspace,
+    state
+  });
+  drift.push(...inspection.drift);
+  if (state && inspection.plan && state.sourceConfigSha256 !== inspection.plan.sourceConfigSha256) {
+    drift.push("managed Dev Container source configuration changed");
   }
-  if (routerResult.value.status !== "enabled" || routerResult.value.name !== expected.routerName || routerResult.value.rule !== expected.rule || routerResult.value.service !== expected.serviceKey && routerResult.value.service !== expected.serviceName) {
-    return {
-      ok: false,
-      routes: [routeName],
-      details: "active Traefik router does not match the rendered route"
-    };
+  if (state && inspection.plan && state.effectiveConfigSha256 !== inspection.plan.effectiveConfigSha256) {
+    drift.push("managed Dev Container effective configuration changed");
   }
-  const serviceResult = inspectNamedRouterApi(expected.protocol, "services", expected.serviceName);
-  if (!serviceResult.ok) {
-    return { ok: false, routes: [routeName], details: serviceResult.details };
+  if (state && inspection.generatedConfigSha256 && state.effectiveConfigSha256 !== inspection.generatedConfigSha256) {
+    drift.push("managed generated Dev Container configuration differs from last successful state");
   }
-  const loadBalancer = serviceResult.value.loadBalancer;
-  const servers = isRecord3(loadBalancer) ? loadBalancer.servers : void 0;
-  const server = Array.isArray(servers) && servers.length === 1 ? servers[0] : void 0;
-  if (serviceResult.value.status !== "enabled" || serviceResult.value.name !== expected.serviceName || !isRecord3(loadBalancer) || !Array.isArray(servers) || servers.length !== 1 || !isRecord3(server) || server[expected.serverField] !== expected.server) {
-    return {
-      ok: false,
-      routes: [routeName],
-      details: "active Traefik service does not match the rendered route"
-    };
+  const routes = exactRoutes(options.repoPath, options.workspace);
+  drift.push(...routes.drift);
+  const activeApps = routes.apps;
+  const anyActive = inspection.primaryActive || inspection.activeServices.length > 0 || Object.values(inspection.baseStatuses).some(isActiveResourceStatus) || inspection.activeProcesses.length > 0 || activeApps.length > 0;
+  if (activeApps.length > 0 && !inspection.primaryActive) {
+    drift.push("active app routes exist without a running primary container");
   }
-  return { ok: true };
-}
-function inspectExpectedRouteMatches(routes) {
-  const mismatched = [];
-  const failures = [];
-  for (const route of routes) {
-    const result = inspectExpectedRouteMatch(route);
-    if (!result.ok) {
-      mismatched.push(...result.routes);
-      failures.push(result.details);
-    }
+  if (desiredApps.some((app) => !activeApps.includes(app)) && anyActive) {
+    drift.push("one or more selected app routes are missing");
   }
-  return mismatched.length === 0 ? { ok: true } : {
-    ok: false,
-    routes: mismatched,
-    details: failures.join("; ")
-  };
-}
-async function waitForExpectedRouteMatches(routes, timeoutMs, pollIntervalMs) {
-  const deadline = Date.now() + timeoutMs;
-  let result;
-  do {
-    result = inspectExpectedRouteMatches(routes);
-    if (result.ok) return result;
-    if (Date.now() < deadline) {
-      await sleep(Math.min(pollIntervalMs, Math.max(1, deadline - Date.now())));
-    }
-  } while (Date.now() < deadline);
-  return result;
-}
-function inspectExpectedRoutes(routes, expectation) {
-  const mismatched = [];
-  const failures = [];
-  for (const protocol of ["http", "tcp"]) {
-    const expected = routes.filter((route) => (route.protocol ?? "http") === protocol).map((route) => buildHostRouteRouterName(route.repoPath, route.name));
-    if (expected.length === 0) continue;
-    const result = inspectRouterApi(protocol);
-    if (!result.ok) {
-      failures.push(result.details);
-      mismatched.push(...expected);
-      continue;
-    }
-    const unexpected = expected.filter(
-      (name) => expectation === "loaded" ? !result.names.has(name) : result.names.has(name)
-    );
-    const boundedAbsenceIsUncertain = result.reachedPageLimit && (expectation === "loaded" ? unexpected.length > 0 : unexpected.length === 0);
-    if (boundedAbsenceIsUncertain) {
-      failures.push(
-        `${protocol.toUpperCase()} router API reached the ${ROUTER_API_PAGE_SIZE}-entry safety limit`
-      );
-    }
-    mismatched.push(...unexpected);
-    if (expectation === "removed" && unexpected.length === 0 && result.reachedPageLimit) {
-      mismatched.push(...expected);
-    }
+  if (activeApps.some((app) => !desiredApps.includes(app))) {
+    drift.push("one or more active app routes are outside the selected profile");
   }
-  return mismatched.length === 0 ? { ok: true } : {
-    ok: false,
-    routes: mismatched,
-    details: failures.length > 0 ? failures.join("; ") : expectation === "loaded" ? "router names are absent" : "router names are still present"
-  };
-}
-async function waitForExpectedRoutes(routes, expectation, timeoutMs, pollIntervalMs) {
-  const deadline = Date.now() + timeoutMs;
-  let result;
-  do {
-    result = inspectExpectedRoutes(routes, expectation);
-    if (result.ok) return result;
-    if (Date.now() < deadline) {
-      await sleep(Math.min(pollIntervalMs, Math.max(1, deadline - Date.now())));
-    }
-  } while (Date.now() < deadline);
-  return result;
-}
-async function ensureTraefikRouteExpectation(routes, expectation, options) {
-  if (routes.length === 0) return { restarted: false };
-  const initialTimeoutMs = options.initialTimeoutMs ?? DEFAULT_INITIAL_TIMEOUT_MS;
-  const recoveryTimeoutMs = options.recoveryTimeoutMs ?? DEFAULT_RECOVERY_TIMEOUT_MS;
-  const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-  const initial = await waitForExpectedRoutes(
-    routes,
-    expectation,
-    initialTimeoutMs,
-    pollIntervalMs
+  if (inspection.activeServices.some((service) => !desiredServices.includes(service))) {
+    drift.push("one or more active services are outside the selected profile");
+  }
+  if (inspection.activeProcesses.some((process2) => !desiredProcesses.includes(process2))) {
+    drift.push("one or more active processes are outside the selected profile");
+  }
+  const positivelyStopped = !inspection.primaryActive && Object.values(inspection.baseStatuses).every(isStoppedOrMissingResourceStatus) && Object.values(inspection.serviceStatuses).every(isStoppedOrMissingResourceStatus) && activeApps.length === 0;
+  const onlyDegradedIncident = state?.status === "degraded" && drift.length === 1;
+  const requiredServicesReady = desiredServices.every(
+    (service) => isReadyResourceStatus(inspection.serviceStatuses[service] ?? "missing")
   );
-  if (initial.ok) return { restarted: false };
-  if (options.allowRestart === false)
-    throw new Error(
-      "Traefik routes did not reload; shared router restart is disabled for this operation."
-    );
-  import_node_fs21.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
-  return withFileLock(
-    ROUTER_RELOAD_LOCK_FILE,
-    {
-      activity: "Traefik route reload recovery",
-      waitMs: initialTimeoutMs + recoveryTimeoutMs + 1e4,
-      fair: true,
-      onWait: createStderrWaitReporter("Traefik route reload recovery", "shared router")
-    },
-    async () => {
-      const recheck = await waitForExpectedRoutes(routes, expectation, 0, pollIntervalMs);
-      if (recheck.ok) return { restarted: false };
-      claimLifecycleEffect();
-      restartRouterStack();
-      const recovered = await waitForExpectedRoutes(
-        routes,
-        expectation,
-        recoveryTimeoutMs,
-        pollIntervalMs
-      );
-      if (recovered.ok) return { restarted: true };
-      const action = expectation === "loaded" ? "load" : "remove";
-      throw new Error(
-        `Traefik did not ${action} file-provider routes after one restart: ${recovered.routes.join(", ")} (${recovered.details}). Inspect: devrouter logs --tail 100`
-      );
-    }
+  const baseServicesReady = Object.values(inspection.baseStatuses).every(isReadyResourceStatus);
+  const processesReady = desiredProcesses.every(
+    (process2) => isReadyResourceStatus(inspection.processStatuses[process2] ?? "missing")
   );
-}
-async function ensureTraefikRoutesLoaded(routes, options = {}) {
-  return ensureTraefikRouteExpectation(routes, "loaded", options);
-}
-async function ensureTraefikRoutesMatch(routes, options = {}) {
-  if (routes.length === 0) return;
-  const timeoutMs = options.initialTimeoutMs ?? options.recoveryTimeoutMs ?? DEFAULT_INITIAL_TIMEOUT_MS;
-  const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-  const result = await waitForExpectedRouteMatches(routes, timeoutMs, pollIntervalMs);
-  if (!result.ok) {
-    throw new Error(
-      `Traefik route configuration did not match rendered routes: ${result.routes.join(", ")} (${result.details})`
-    );
-  }
-}
-async function ensureTraefikRoutesRemoved(routes, options = {}) {
-  return ensureTraefikRouteExpectation(routes, "removed", options);
+  const routesReady = desiredApps.every((app) => activeApps.includes(app));
+  const ready = inspection.primaryReady && requiredServicesReady && baseServicesReady && processesReady && routesReady && !stateReadFailed && !drift.length;
+  const status = positivelyStopped && onlyDegradedIncident ? "stopped" : state?.status === "degraded" ? "failed-transition" : drift.length > 0 ? "drifted" : ready ? "ready" : anyActive ? "starting" : "stopped";
+  const active = {
+    apps: activeApps,
+    services: inspection.activeServices,
+    processes: inspection.activeProcesses
+  };
+  return {
+    mode: "managed",
+    status,
+    profile: options.profile,
+    ...state?.profile ? { activeProfile: state.profile } : {},
+    ...options.workspace !== void 0 ? { workspace: options.workspace } : {},
+    ...state?.devpodId ? { devpodId: state.devpodId } : {},
+    ...inspection.composeProject ? { composeProject: inspection.composeProject } : {},
+    desired: {
+      apps: desiredApps,
+      services: desiredServices,
+      processes: desiredProcesses
+    },
+    active,
+    serviceStatuses: inspection.serviceStatuses,
+    baseServiceStatuses: inspection.baseStatuses,
+    processStatuses: inspection.processStatuses,
+    drift: sortedUnique(drift),
+    ...inspection.plan?.sourceConfigSha256 || state?.sourceConfigSha256 ? { sourceConfigSha256: inspection.plan?.sourceConfigSha256 ?? state?.sourceConfigSha256 } : {},
+    ...inspection.plan?.effectiveConfigSha256 || state?.effectiveConfigSha256 ? {
+      effectiveConfigSha256: inspection.plan?.effectiveConfigSha256 ?? state?.effectiveConfigSha256
+    } : {},
+    ...state?.transitionPhase ? { transitionPhase: state.transitionPhase } : {}
+  };
 }
 
 // src/core/workspace-ensure.ts
@@ -7672,11 +7884,11 @@ var DEFAULT_READINESS_TIMEOUT_MS = 12e4;
 var POLL_INTERVAL_MS = 1e3;
 function assertOverlay(container, repoPath) {
   const workingDir = container.labels["com.docker.compose.project.working_dir"];
-  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path26.default.join(repoPath, ".devcontainer"))) {
+  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path27.default.join(repoPath, ".devcontainer"))) {
     throw new Error(`Container '${container.id}' does not belong to the exact worktree.`);
   }
   const configFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").filter(Boolean);
-  const expectedOverlay = import_node_path26.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+  const expectedOverlay = import_node_path27.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
   if (!configFiles.some((configFile) => sameWorkspacePath(configFile, expectedOverlay))) {
     throw new Error(`Container '${container.id}' was not started with ${DEVCONTAINER_OVERLAY}.`);
   }
@@ -7871,7 +8083,7 @@ function hasExactManagedComposeProject(repoPath, state) {
     }).some((container) => {
       const workingDir = container.labels["com.docker.compose.project.working_dir"];
       return Boolean(
-        workingDir && sameWorkspacePath(workingDir, import_node_path26.default.join(repoPath, ".devcontainer"))
+        workingDir && sameWorkspacePath(workingDir, import_node_path27.default.join(repoPath, ".devcontainer"))
       );
     });
   } catch {
@@ -8255,7 +8467,7 @@ function resolvePrimaryTarget(repoPath) {
 }
 function isPrimaryCheckout(repoPath) {
   try {
-    return import_node_fs22.default.statSync(import_node_path26.default.join(repoPath, ".git")).isDirectory();
+    return import_node_fs23.default.statSync(import_node_path27.default.join(repoPath, ".git")).isDirectory();
   } catch {
     return false;
   }
@@ -8316,8 +8528,8 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       const target = options.repair ? resolveRepairTarget(repoPath, linked) : linked ? resolveLinkedTarget(repoPath) : resolvePrimaryTarget(repoPath);
       let devpodId = target.devpodId;
       if (target.kind === "linked") {
-        const overlayPath = import_node_path26.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
-        if (!import_node_fs22.default.existsSync(overlayPath)) {
+        const overlayPath = import_node_path27.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+        if (!import_node_fs23.default.existsSync(overlayPath)) {
           throw new Error(`Missing required DevPod compose overlay: ${overlayPath}`);
         }
       }
@@ -8387,7 +8599,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       }
       const apps = proxyAppsFromConfig(runtime.config);
       const parsedUpstreams = apps.map((app) => parseUpstream(app.upstream));
-      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path26.default.basename(repoPath)) ?? "app";
+      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path27.default.basename(repoPath)) ?? "app";
       for (const [index, app] of apps.entries()) {
         if (!parsedUpstreams[index].host.startsWith(`${aliasPrefix}-`)) {
           const owner = target.kind === "linked" ? "workspace" : "checkout";
@@ -9157,9 +9369,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     }
     const repairLocked = () => {
       const runtime = resolveWorkspaceRuntimeOrDefault(repoPath);
-      import_node_fs22.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+      import_node_fs23.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
       return withFileLock(
-        import_node_path26.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
+        import_node_path27.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
         {
           activity: "Managed runtime repair",
           target: repoPath,
@@ -9230,6 +9442,7 @@ var cancelled = false;
 var lockHeld = false;
 var stopProjects = [];
 var stopBaselineState;
+var BUSY_EXEC_WAIT_MS = 30 * 60 * 1e3;
 function matchesFence(record4, fence) {
   return Object.entries(reliabilityFence(record4.state)).every(
     ([key, value]) => value === fence[key]
@@ -9347,14 +9560,14 @@ async function executeLifecycleWorker(request, operation) {
           withMutationLock(
             "Verify retained stop",
             request.repoPath,
-            () => proveRetainedManagedStop(retained)
+            () => proveManagedStop(retained)
           );
         } else {
           const containers = inspectWorkspaceContainers();
           const owned = containers.filter(
             (container) => sameWorkspacePath(
               container.labels["com.docker.compose.project.working_dir"] ?? "",
-              import_node_path27.default.join(request.repoPath, ".devcontainer")
+              import_node_path28.default.join(request.repoPath, ".devcontainer")
             )
           );
           const projects = owned.map((container) => container.labels["com.docker.compose.project"]);
@@ -9428,9 +9641,11 @@ function proveLifecycleStopped() {
   const settle = () => {
     claimLifecycleEffect();
     if (stopBaselineState) {
-      if (proveRetainedManagedStop(stopBaselineState).some((container) => container.state.Running)) {
+      const proof = proveManagedStop(stopBaselineState);
+      if (proof.containers.some((container) => container.state.Running))
         throw new Error("Retained workspace workloads remain running.");
-      }
+      if (proof.status === "proven-absent")
+        assertTraefikRoutesRemoved(managedStopRouteReferences(stopBaselineState));
     } else {
       for (const project of stopProjects) {
         const containers = inspectManagedStopContainers(project);
@@ -9440,7 +9655,7 @@ function proveLifecycleStopped() {
       const remaining = inspectWorkspaceContainers().filter(
         (container) => sameWorkspacePath(
           container.labels["com.docker.compose.project.working_dir"] ?? "",
-          import_node_path27.default.join(request.repoPath, ".devcontainer")
+          import_node_path28.default.join(request.repoPath, ".devcontainer")
         )
       );
       if (remaining.some(
@@ -9476,7 +9691,7 @@ function ensureGuidance(repoPath) {
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
-async function devsyExecOutcome(repoPath, command) {
+async function devsyExecOutcome(repoPath, command, retainedProof) {
   if (command.length === 0) {
     throw new Error("No command provided. Use `devrouter exec [path] -- <command...>`.");
   }
@@ -9487,12 +9702,25 @@ async function devsyExecOutcome(repoPath, command) {
         `No exact Devsy workspace exists for '${repoPath}'. ${ensureGuidance(repoPath)}`
       );
     }
-    const args = ["workspace", "exec", "--result-format", "plain", workspace.id, "--", ...command];
+    const args = [
+      "workspace",
+      "exec",
+      "--result-format",
+      "plain",
+      ...retainedProof ? ["--context", retainedProof.context] : [],
+      retainedProof?.id ?? workspace.id,
+      "--",
+      ...command
+    ];
     return new Promise((resolve, reject) => {
       let child;
       try {
-        claimLifecycleEffect();
-        child = (0, import_node_child_process22.spawn)("devsy", args, { stdio: "inherit" });
+        const launch = () => {
+          if (retainedProof) revalidateDevsyExecProof(repoPath, retainedProof);
+          claimLifecycleEffect();
+          return (0, import_node_child_process22.spawn)("devsy", args, { stdio: "inherit" });
+        };
+        child = retainedProof ? withMutationLock("Execute retained workspace", repoPath, launch) : launch();
       } catch (error) {
         reject(
           new ExecutionOutcomeError(`devsy exec failed: ${errorMessage(error)}`, {
@@ -9775,11 +10003,14 @@ async function devpodExecOutcome(repoPath, command) {
 
 // src/core/workspace-lifecycle.ts
 var import_node_child_process24 = require("child_process");
-var import_node_fs24 = __toESM(require("fs"));
-var import_node_path28 = __toESM(require("path"));
+var import_node_fs25 = __toESM(require("fs"));
+var import_node_path29 = __toESM(require("path"));
 
 // src/core/route-state.ts
-var import_node_fs23 = __toESM(require("fs"));
+var import_node_fs24 = __toESM(require("fs"));
+function listRoutesForWorktreePath(worktreePath, routes = listHostRouteState()) {
+  return routes.filter((route) => sameWorkspacePath(route.repoPath, worktreePath));
+}
 function removeWorkspaceRoutesForWorktree(workspace, worktreePath) {
   return removeHostRoutesWhere(
     (route) => route.workspace === workspace && sameWorkspacePath(route.repoPath, worktreePath)
@@ -9831,8 +10062,24 @@ async function mutateWorkspaceRuntime(action, resolved, worktrees, quiet = false
       "Retained managed runtime has no exact provider registration; routes were preserved."
     );
   }
-  const routes = removeWorkspaceRoutesForWorktree(resolved.workspace, resolved.worktreePath);
-  await ensureTraefikRoutesRemoved(routes);
+  const retained = action === "stop" ? readManagedRuntimeState(resolved.worktreePath, resolved.workspace) : void 0;
+  let absent = false;
+  const remove = () => {
+    if (retained?.stopBaseline) {
+      absent = proveManagedStop(retained).status === "proven-absent";
+      if (absent && listRoutesForWorktreePath(resolved.worktreePath).some(
+        (route) => route.workspace !== resolved.workspace || !retained.desired.apps.includes(route.name)
+      ))
+        throw new Error("Absent stop contains routes outside the retained desired set.");
+    }
+    claimLifecycleEffect();
+    return removeWorkspaceRoutesForWorktree(resolved.workspace, resolved.worktreePath);
+  };
+  const routes = retained?.stopBaseline ? withMutationLock("Revalidate stop routes", resolved.worktreePath, remove) : remove();
+  await ensureTraefikRoutesRemoved([
+    ...routes,
+    ...absent && retained ? managedStopRouteReferences(retained) : []
+  ]);
   if (!quiet) {
     process.stdout.write(
       `Freed ${routes.length} route(s) for workspace '${resolved.workspace}'.
@@ -9843,6 +10090,7 @@ async function mutateWorkspaceRuntime(action, resolved, worktrees, quiet = false
     ...mutation.status === "changed" ? { devpodId } : {},
     freedRoutes: routes.length,
     providerChanged: mutation.status === "changed",
+    ...absent ? { runtimeAbsent: true } : {},
     workspace: resolved.workspace
   };
 }
@@ -9906,7 +10154,7 @@ async function environmentStop(repoPath, options = {}) {
         repoPath,
         workspace: result.workspace,
         ...result.devpodId ? { devpodId: result.devpodId } : {},
-        stopped: !options.delete && result.providerChanged,
+        stopped: !options.delete && (result.providerChanged || result.runtimeAbsent === true),
         ...options.delete ? { deleted: result.providerChanged } : {},
         freedRoutes: result.freedRoutes
       };
@@ -9939,10 +10187,16 @@ async function environmentStop(repoPath, options = {}) {
 }
 
 // src/lifecycle-worker.ts
-process.on("SIGTERM", cancelLifecycleWorker);
-process.on("SIGINT", cancelLifecycleWorker);
-process.on("disconnect", cancelLifecycleWorker);
+var started = false;
+function cancel() {
+  cancelLifecycleWorker();
+  if (!started && process.connected) process.disconnect();
+}
+process.on("SIGTERM", cancel);
+process.on("SIGINT", cancel);
+process.on("disconnect", cancel);
 process.once("message", async (message) => {
+  started = true;
   let result;
   try {
     const request = message.request;
@@ -9953,7 +10207,11 @@ process.once("message", async (message) => {
         return stopped;
       }
       if (request.kind === "exec") {
-        const outcome = await devpodExecOutcome(request.repoPath, request.command ?? []);
+        const outcome = request.retainedExecProof ? await devsyExecOutcome(
+          request.repoPath,
+          request.command ?? [],
+          request.retainedExecProof
+        ) : await devpodExecOutcome(request.repoPath, request.command ?? []);
         recordLifecycleOutcome(outcome);
         return outcome;
       }