@devrouter/cli 0.0.62 → 0.0.64

package/dist/devrouter.js

@@ -671,7 +671,9 @@ function tryReclaimStaleLock(lockPath, staleLinkPath, livenessCache) {
 function acquireFileLock(lockPath, options) {
   const processBirth = processBirthIdentity(process.pid);
   if (!processBirth) {
-    throw new Error(`could not determine process identity for ${options.activity} lock`);
+    throw new Error(
+      `could not determine process identity for ${options.activity} lock: process inspection may be unavailable or sandbox-denied; run the canonical command in a permitted host context`
+    );
   }
   const ownerId = (0, import_node_crypto2.randomUUID)();
   const owner = `${process.pid}:${Buffer.from(processBirth).toString("base64url")}:${ownerId}`;
@@ -2450,7 +2452,7 @@ function loadRepoConfig(repoPath, read = (file) => import_node_fs6.default.readF
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.62" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.64" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -4634,6 +4636,33 @@ function inspectManagedStopWorkspaceIds(endpoint, composeDirectory) {
   assertUniqueContainerIds(ids);
   return ids;
 }
+function hasExactManagedStopMissingObjectError(stderr, id3) {
+  if (typeof stderr !== "string") return false;
+  const line = stderr.endsWith("\r\n") ? stderr.slice(0, -2) : stderr.endsWith("\n") ? stderr.slice(0, -1) : stderr;
+  return line.toLowerCase() === `error: no such object: ${id3}`;
+}
+function assertManagedStopContainersAbsent(endpoint, ids) {
+  assertManagedStopEndpoint(endpoint);
+  if (!Array.isArray(ids) || ids.length === 0 || ids.length > 256) {
+    throw new Error("Managed stop absence proof requires between 1 and 256 container ids.");
+  }
+  ids.forEach(assertFullContainerId);
+  assertUniqueContainerIds(ids);
+  const env = { ...process.env };
+  delete env.DOCKER_CONTEXT;
+  delete env.DOCKER_HOST;
+  for (const id3 of ids) {
+    const result = (0, import_node_child_process6.spawnSync)("docker", ["--host", endpoint, "inspect", "--format", "{{.Id}}", id3], {
+      env,
+      encoding: "utf-8",
+      timeout: MANAGED_STOP_DOCKER_TIMEOUT_MS,
+      maxBuffer: MANAGED_STOP_DOCKER_MAX_BUFFER
+    });
+    if (result.status !== 1 || result.error || result.signal || result.stdout !== "" && result.stdout !== "\n" && result.stdout !== "\r\n" || !hasExactManagedStopMissingObjectError(result.stderr, id3)) {
+      throw new Error("Managed stop Docker inspection did not prove container absence.");
+    }
+  }
+}
 function stopPinnedManagedContainer(endpoint, containerId) {
   assertFullContainerId(containerId);
   runManagedStopDocker(["stop", containerId], endpoint, 3e4);
@@ -7142,6 +7171,7 @@ function buildOnboardingPrompt(options = {}) {
     "- TLS: namespaced hosts (`web.<ws>.localhost`) are not covered by the `*.localhost` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.",
     "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes an exact captured snapshot of the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause, `devrouter stop . --delete` only for explicit exact-owner cleanup without removing the checkout, and `devrouter exec . -- <command...>` for container commands. Never substitute raw DevPod/Devsy mutations; they bypass the machine-global ownership lock, which serializes provider mutations in a fair arrival-order queue and lets contenders wait up to thirty minutes with throttled stderr progress before failing with the queue position or holder PID and true durations. `workspace up` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped.",
     "- After a drained interrupted ensure, manual exec can use an exactly proven retained Devsy runtime with the plain local Docker command. Revalidate identity for each tooling command until later preparation reconciles startup; preserve configuration, data and interrupted history. This does not repair absent stop baselines or provide OOM protection.",
+    "- Busy ensure and exec wait up to thirty minutes for a positively identified active lifecycle worker on the same checkout, with stderr progress. Do not stop healthy work to make room. Commands stay serial; timeout or cancellation before admission leaves prior work untouched. A lifecycle fence change cancels admission, and uncertain execution is never replayed.",
     "- Ensure reconciles interrupted or never-dispatched ensure after positive worker drainage. Unknown arbitrary exec never replays; use explicit stop to reconcile that uncertainty. Preserve journals and generated configuration if evidence is unavailable. This does not prevent OOM or activate capacity-managed recovery.",
     "- Devsy agent readiness: run `devrouter setup --yes --workspace-runtime devsy` once so Devrouter acquires and verifies the pinned agent in its own machine cache. `doctor` reports `ready`, `missing`, `stale`, or `invalid` without network access, and `ensure` fails before the provider queue when readiness is not `ready`. An explicit `DEVSY_AGENT_BINARY` remains authoritative and must match a pinned official asset.",
     "- A managed adapter plus `postCreateCommand` requires `waitFor` exactly `postCreateCommand` or `postStartCommand`; managed selective config preserves lifecycle fields and changes only `runServices`.",
@@ -8725,6 +8755,9 @@ var init_devcontainer_diagnostics = __esm({
 });
 
 // src/core/route-state.ts
+function listRoutesForWorktreePath(worktreePath, routes = listHostRouteState()) {
+  return routes.filter((route) => sameWorkspacePath(route.repoPath, worktreePath));
+}
 function listRoutesForWorktreePaths(worktreePaths) {
   const routes = listHostRouteState();
   const byWorktreePath = /* @__PURE__ */ new Map();
@@ -9584,11 +9617,13 @@ var init_status = __esm({
 });
 
 // src/core/devpod-registry.ts
-function listDevpodWorkspacesRaw() {
+function listDevpodWorkspacesRaw(options = {}) {
   const result = (0, import_node_child_process12.spawnSync)("devpod", ["list", "--output", "json", "--skip-pro"], {
     encoding: "utf-8"
   });
-  if (result.status !== 0) {
+  if (options.allowMissingExecutable && result.error?.code === "ENOENT")
+    return [];
+  if (result.error || result.status !== 0) {
     const details = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     throw new Error(`devpod list failed: ${details || "devpod is not installed or unavailable"}`);
   }
@@ -10954,7 +10989,56 @@ function proveRetainedManagedStop(state) {
   }
   return result;
 }
+function absentRegistrationIdentity(state) {
+  resetWorkspaceRuntimeCaches();
+  if (resolveWorkspaceRuntimeOrDefault(state.repoPath) !== "devsy")
+    throw new Error("Stop provider changed.");
+  if (!state.workspace || !isLinkedWorktree(state.repoPath))
+    throw new Error("Absent stop requires a linked workspace.");
+  const record4 = readWorkspaceOwnership(state.repoPath, state.workspace);
+  if (!record4 || record4.workspace !== state.workspace || record4.devpodId !== state.devpodId || !sameWorkspacePath(record4.worktreePath, state.repoPath) || resolveWorktreeWorkspace(state.repoPath) !== state.workspace || inspectWorkspaceOwnership(record4, listGitWorktrees(state.repoPath), void 0).ownerStatus !== "present")
+    throw new Error("Absent stop workspace ownership changed.");
+  for (const entries of [
+    listDevsyWorkspaces(),
+    listDevpodWorkspacesRaw({ allowMissingExecutable: true })
+  ]) {
+    if (entries.some(
+      (entry) => entry.id === state.devpodId || sameWorkspacePath(entry.source.localFolder, state.repoPath)
+    ))
+      throw new Error("Absent stop requires both provider registrations to remain absent.");
+  }
+  return { record: record4, gitCommonDir: resolveGitCommonDir(state.repoPath) };
+}
+function proveManagedStop(state) {
+  const baseline = validateManagedStopBaseline(state.stopBaseline, state);
+  const owner = inspectDevsyWorkspaceOwnership(
+    listDevsyWorkspaces(),
+    state.devpodId,
+    state.repoPath
+  );
+  if (owner.status !== "absent")
+    return { status: "retained", containers: proveRetainedManagedStop(state) };
+  if (baseline.sourceContainer) throw new Error("Absent stop cannot prove a source container.");
+  const before = absentRegistrationIdentity(state);
+  if (!(0, import_node_util2.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state))
+    throw new Error("Retained stop generation changed.");
+  if (inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId)
+    throw new Error("Stop daemon changed.");
+  assertManagedStopContainersAbsent(
+    baseline.endpoint,
+    baseline.containers.map((container) => container.id)
+  );
+  const uidBytes = Buffer.byteLength(baseline.uid);
+  const runnerId = uidBytes === 16 || uidBytes === 40 ? baseline.uid : baseline.providerId;
+  if (inspectManagedStopContainers(baseline.project, baseline.endpoint).length !== 0 || inspectManagedStopWorkspaceIds(baseline.endpoint, baseline.composeDirectory).length !== 0 || inspectProviderRunnerContainers(baseline.endpoint, runnerId).length !== 0)
+    throw new Error("Absent stop observed a remaining workspace population.");
+  if (inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId || !(0, import_node_util2.isDeepStrictEqual)(absentRegistrationIdentity(state), before) || !(0, import_node_util2.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state))
+    throw new Error("Absent stop authority changed during inspection.");
+  return { status: "proven-absent", containers: [] };
+}
 function stopFromManagedBaseline(state) {
+  const proof = proveManagedStop(state);
+  if (proof.status === "proven-absent") return proof.status;
   const baseline = validateManagedStopBaseline(state.stopBaseline, state);
   const stopped = /* @__PURE__ */ new Set();
   for (const initial of proveRetainedManagedStop(state))
@@ -10977,6 +11061,12 @@ function stopFromManagedBaseline(state) {
   }
   if (inspect().some((container) => container.state.Running))
     throw new Error("Retained workloads remain running.");
+  return "retained";
+}
+function managedStopRouteReferences(state) {
+  return state.desired.apps.flatMap(
+    (name) => ["http", "tcp"].map((protocol) => ({ repoPath: state.repoPath, name, protocol }))
+  );
 }
 var import_node_os2, import_node_path31, import_node_util2;
 var init_managed_stop_recovery = __esm({
@@ -10986,6 +11076,7 @@ var init_managed_stop_recovery = __esm({
     import_node_path31 = __toESM(require("path"));
     import_node_util2 = require("util");
     init_devpod_environment();
+    init_devpod_registry();
     init_devsy_workspaces();
     init_managed_compose_population();
     init_managed_runtime_state();
@@ -11095,8 +11186,7 @@ function stopRetainedManagedDevsyWorkspace(options) {
     throw new Error("Managed stop requires the exact retained workspace identity.");
   }
   if (state.stopBaseline) {
-    stopFromManagedBaseline(state);
-    return true;
+    return stopFromManagedBaseline(state) === "proven-absent" ? "proven-absent" : true;
   }
   const workspaceEnv = workspace ? { token: workspace, gitCommonDir: resolveGitCommonDir(repoPath) } : void 0;
   function registration2() {
@@ -11280,12 +11370,14 @@ function inspectExactOwnership(devsyId, worktreePath) {
 }
 function mutateOwnedDevsyWorkspace(action2, devsyId, worktreePath) {
   return withMutationLock(`Devsy ${action2}`, worktreePath, () => {
-    if (action2 === "stop" && stopRetainedManagedDevsyWorkspace({
-      repoPath: worktreePath,
-      devsyId,
-      stopProvider: () => runDevsyAction("stop", devsyId)
-    }))
-      return { status: "changed" };
+    if (action2 === "stop") {
+      const stopped = stopRetainedManagedDevsyWorkspace({
+        repoPath: worktreePath,
+        devsyId,
+        stopProvider: () => runDevsyAction("stop", devsyId)
+      });
+      if (stopped) return { status: stopped === "proven-absent" ? "proven-absent" : "changed" };
+    }
     const before = inspectExactOwnership(devsyId, worktreePath);
     if (before.status === "absent") return { status: "absent" };
     runDevsyAction(action2, devsyId);
@@ -12068,7 +12160,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.62" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.64" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -13362,7 +13454,7 @@ function applyReliabilityEvent(state, event, nowMs) {
     case "not-started":
       if (next.executionPolicy !== "manual" || next.operation?.kind !== "exec")
         return unchanged(next, "blocked");
-      if (next.operation.id !== event.operationId || next.operation.status !== "RUNNING")
+      if (next.operation.id !== event.operationId || !["RUNNING", "DISPATCH_RECORDED"].includes(next.operation.status))
         return unchanged(next, "stale");
       next.operation = { ...next.operation, status: "NOT_LAUNCHED", exitCode: null };
       return transition(next, "accepted");
@@ -13417,6 +13509,11 @@ function sameFence2(record4, fence) {
     ([key, value]) => value === fence[key]
   );
 }
+function hasDuplicateOperation(record4, requestId, operationId) {
+  return record4.state.operationHistory.some(
+    (operation) => operation.key === requestId || operation.id === operationId
+  );
+}
 function workerGroupAbsent(pid) {
   try {
     process.kill(-pid, 0);
@@ -13433,7 +13530,7 @@ function signalOwnedGroup(child, signal) {
     if (error.code !== "ESRCH") throw error;
   }
 }
-async function runLifecycleWorker(request) {
+async function runLifecycleWorker(request, beforeAdmission) {
   if (process.platform === "win32")
     throw new Error("Lifecycle workers require POSIX process-group ownership.");
   const workerPath = import_node_path38.default.join(__dirname, "devrouter-lifecycle-worker.js");
@@ -13445,13 +13542,18 @@ async function runLifecycleWorker(request) {
     execArgv: []
   });
   let ready = false;
+  let closed = false;
+  let registered = false;
+  let dispatchAcknowledged = false;
+  let sendAttempted = false;
+  let readinessTimer;
   let result;
   let cancelled = false;
   let forceTimer;
   let monitor;
   let failure;
   const cancel = () => {
-    if (cancelled) return;
+    if (cancelled || closed) return;
     cancelled = true;
     try {
       signalOwnedGroup(child, "SIGTERM");
@@ -13474,20 +13576,56 @@ async function runLifecycleWorker(request) {
       child.once("error", (error) => {
         failure = error;
       });
-      child.on("message", (message) => {
+      readinessTimer = setTimeout(() => {
+        failure = new Error("Lifecycle worker readiness timed out before dispatch.");
+        cancel();
+      }, 3e4);
+      child.on("message", async (message) => {
         if (!message || typeof message !== "object") return;
         if ("ready" in message && message.ready === true && !ready) {
           ready = true;
+          if (readinessTimer) clearTimeout(readinessTimer);
           try {
+            await new Promise((resolve2) => setImmediate(resolve2));
+            if (closed) return;
             if (cancelled || !child.pid)
               throw new Error("Lifecycle invocation was cancelled before dispatch.");
             if (request.kind !== "stop") {
               const birth = processBirthIdentity(child.pid);
               if (!birth) throw new Error("Could not prove lifecycle worker incarnation.");
               updateReliabilityOperation(request.identity, (record4) => {
-                if (!sameFence2(record4, request.fence) || record4.worker || record4.state.operation?.id !== request.operationId) {
+                beforeAdmission?.();
+                if (!request.admission)
+                  throw new Error("Lifecycle operation admission is required.");
+                if (hasDuplicateOperation(record4, request.requestId, request.operationId))
+                  throw new Error(
+                    "Lifecycle operation request conflicts with an existing operation."
+                  );
+                if (!sameFence2(record4, request.fence))
                   throw new Error("Lifecycle intent changed before dispatch.");
+                if (record4.worker || record4.revision !== request.admission.expectedRevision) {
+                  throw new LifecycleWorkerAdmissionBusyError();
                 }
+                const admitted = stepReliability(
+                  record4.state,
+                  {
+                    ...request.fence,
+                    type: "operation-request",
+                    kind: request.kind === "exec" ? "exec" : "ensure",
+                    key: request.requestId,
+                    operationId: request.operationId,
+                    profile: request.admission.profile,
+                    consumer: request.admission.consumer,
+                    runtimeRunning: request.admission.runtimeRunning,
+                    ...request.admission.recoverInterruptedEnsure ? { recoverInterruptedEnsure: true } : {}
+                  },
+                  Date.now()
+                );
+                if (admitted.outcome !== "accepted")
+                  throw new Error(`Lifecycle admission is ${admitted.outcome}.`);
+                record4.state = admitted.state;
+                record4.outcome = null;
+                request.fence = reliabilityFence(record4.state);
                 record4.worker = {
                   id: request.workerId,
                   operationId: request.operationId,
@@ -13503,6 +13641,7 @@ async function runLifecycleWorker(request) {
                   throw new Error("Lifecycle dispatch is blocked.");
                 record4.state = transition2.state;
               });
+              registered = true;
               updateReliabilityOperation(request.identity, (record4) => {
                 const transition2 = stepReliability(
                   record4.state,
@@ -13513,12 +13652,18 @@ async function runLifecycleWorker(request) {
                   },
                   Date.now()
                 );
-                record4.state = transition2.state;
                 if (!transition2.effects.some((effect2) => effect2.kind === "launch")) {
                   throw new Error("Lifecycle dispatch persistence was not acknowledged.");
                 }
+                record4.state = transition2.state;
               });
+              dispatchAcknowledged = true;
             }
+            await new Promise((resolve2) => setImmediate(resolve2));
+            if (closed) return;
+            beforeAdmission?.();
+            if (cancelled) throw new Error("Lifecycle invocation was cancelled before dispatch.");
+            sendAttempted = true;
             child.send({ request }, (error) => {
               if (error) {
                 failure = error;
@@ -13543,8 +13688,9 @@ async function runLifecycleWorker(request) {
         }
       });
       child.once("close", () => {
+        closed = true;
         try {
-          if (request.kind !== "stop") {
+          if (request.kind !== "stop" && registered) {
             updateReliabilityOperation(request.identity, (record4) => {
               if (record4.worker?.id !== request.workerId || record4.worker.pid !== child.pid) return;
               if (!result) {
@@ -13552,7 +13698,7 @@ async function runLifecycleWorker(request) {
                   record4.state,
                   {
                     ...reliabilityFence(record4.state),
-                    type: "interrupted",
+                    type: request.kind === "exec" && dispatchAcknowledged && !sendAttempted ? "not-started" : "interrupted",
                     operationId: request.operationId
                   },
                   Date.now()
@@ -13586,6 +13732,7 @@ async function runLifecycleWorker(request) {
       });
     });
   } finally {
+    if (readinessTimer) clearTimeout(readinessTimer);
     if (monitor) clearInterval(monitor);
     if (forceTimer) clearTimeout(forceTimer);
     process.removeListener("SIGINT", onSignal);
@@ -13595,7 +13742,7 @@ async function runLifecycleWorker(request) {
 function newLifecycleIds() {
   return { requestId: (0, import_node_crypto16.randomUUID)(), operationId: (0, import_node_crypto16.randomUUID)(), workerId: (0, import_node_crypto16.randomUUID)() };
 }
-var import_node_child_process21, import_node_crypto16, import_node_fs31, import_node_path38;
+var import_node_child_process21, import_node_crypto16, import_node_fs31, import_node_path38, LifecycleWorkerAdmissionBusyError;
 var init_reliability_worker = __esm({
   "src/core/reliability-worker.ts"() {
     "use strict";
@@ -13607,17 +13754,12 @@ var init_reliability_worker = __esm({
     init_reliability_contract();
     init_reliability_model();
     init_reliability_operation_store();
-  }
-});
-
-// src/core/managed-host-preparation.ts
-var import_node_child_process22, import_node_fs32;
-var init_managed_host_preparation = __esm({
-  "src/core/managed-host-preparation.ts"() {
-    "use strict";
-    import_node_child_process22 = require("child_process");
-    import_node_fs32 = __toESM(require("fs"));
-    init_repo_config();
+    LifecycleWorkerAdmissionBusyError = class extends Error {
+      constructor() {
+        super("Lifecycle admission lost to another operation.");
+        this.name = "LifecycleWorkerAdmissionBusyError";
+      }
+    };
   }
 });
 
@@ -13626,7 +13768,7 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function inspectRouterApi(protocol) {
-  const result = (0, import_node_child_process23.spawnSync)(
+  const result = (0, import_node_child_process22.spawnSync)(
     "curl",
     [
       "--silent",
@@ -13653,6 +13795,11 @@ function inspectRouterApi(protocol) {
   if (!Array.isArray(value)) {
     return { ok: false, details: `${protocol.toUpperCase()} router API returned a non-array` };
   }
+  if (value.some((item) => !isRecord4(item) || typeof item.name !== "string" || !item.name))
+    return {
+      ok: false,
+      details: `${protocol.toUpperCase()} router API returned malformed entries`
+    };
   return {
     ok: true,
     reachedPageLimit: value.length >= ROUTER_API_PAGE_SIZE,
@@ -13665,6 +13812,9 @@ function inspectRouterApi(protocol) {
     )
   };
 }
+function isRecord4(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
 function inspectExpectedRoutes(routes, expectation) {
   const mismatched = [];
   const failures = [];
@@ -13725,7 +13875,7 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
     throw new Error(
       "Traefik routes did not reload; shared router restart is disabled for this operation."
     );
-  import_node_fs33.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs32.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     ROUTER_RELOAD_LOCK_FILE,
     {
@@ -13756,12 +13906,12 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
 async function ensureTraefikRoutesRemoved(routes, options = {}) {
   return ensureTraefikRouteExpectation(routes, "removed", options);
 }
-var import_node_child_process23, import_node_fs33, import_node_path39, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, ROUTER_API_REQUEST_TIMEOUT_SECONDS, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, ROUTER_API_PAGE_SIZE;
+var import_node_child_process22, import_node_fs32, import_node_path39, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, ROUTER_API_REQUEST_TIMEOUT_SECONDS, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, ROUTER_API_PAGE_SIZE;
 var init_traefik_route_health = __esm({
   "src/core/traefik-route-health.ts"() {
     "use strict";
-    import_node_child_process23 = require("child_process");
-    import_node_fs33 = __toESM(require("fs"));
+    import_node_child_process22 = require("child_process");
+    import_node_fs32 = __toESM(require("fs"));
     import_node_path39 = __toESM(require("path"));
     init_file_lock();
     init_host_routes();
@@ -13777,6 +13927,17 @@ var init_traefik_route_health = __esm({
   }
 });
 
+// src/core/managed-host-preparation.ts
+var import_node_child_process23, import_node_fs33;
+var init_managed_host_preparation = __esm({
+  "src/core/managed-host-preparation.ts"() {
+    "use strict";
+    import_node_child_process23 = require("child_process");
+    import_node_fs33 = __toESM(require("fs"));
+    init_repo_config();
+  }
+});
+
 // src/core/workspace-ensure.ts
 function resolveLinkedTarget(repoPath) {
   const snapshots = getWorkspaceRegistrySnapshots();
@@ -13839,6 +14000,11 @@ var init_workspace_ensure = __esm({
 });
 
 // src/core/reliability-lifecycle.ts
+function matchesFence(record4, fence) {
+  return Object.entries(reliabilityFence(record4.state)).every(
+    ([key, value]) => value === fence[key]
+  );
+}
 async function withLifecycleOperationLock(repoPath, operation) {
   if (activeWorker && lockHeld) {
     if (!sameWorkspacePath(repoPath, activeWorker.repoPath))
@@ -13886,6 +14052,23 @@ function reconcileDrained(record4) {
     record4.worker = null;
   }
 }
+function reportBusyLifecycleWait(kind, operationId, waitedMs) {
+  process.stderr.write(
+    `Lifecycle ${kind} ${operationId} is waiting for the existing worker (${Math.ceil(waitedMs / 1e3)}s).
+`
+  );
+}
+function installLifecycleWaitSignals(cancellation) {
+  const onSignal = () => {
+    cancellation.requested = true;
+  };
+  process.once("SIGINT", onSignal);
+  process.once("SIGTERM", onSignal);
+  return () => {
+    process.removeListener("SIGINT", onSignal);
+    process.removeListener("SIGTERM", onSignal);
+  };
+}
 async function superviseLifecycle(kind, repoPath, options = {}, command) {
   repoPath = comparableWorkspacePath(repoPath);
   if (isLinkedWorktree(repoPath) && !readPersistedWorkspace(repoPath)) {
@@ -13898,58 +14081,115 @@ async function superviseLifecycle(kind, repoPath, options = {}, command) {
     provider: resolveWorkspaceRuntimeOrDefault(repoPath)
   };
   const ids = newLifecycleIds();
-  let fence;
-  const runtimeRunning = kind === "exec" ? Boolean(resolveRunningWorkspaceContainer(repoPath)) : false;
-  const previous = kind === "exec" && identity2.provider === "devsy" ? updateReliabilityOperation(identity2, (record4) => {
-    reconcileDrained(record4);
-    return record4;
-  }) : void 0;
-  let retainedExecProof;
-  if (previous && !previous.worker && canExecAfterInterruptedEnsure(previous.state)) {
-    retainedExecProof = withMutationLock(
-      "Prove retained exec",
-      repoPath,
-      () => captureDevsyExecProof(repoPath)
-    );
-  }
-  updateReliabilityOperation(identity2, (record4) => {
-    reconcileDrained(record4);
-    if (retainedExecProof && record4.state.operation?.id !== previous?.state.operation?.id)
-      throw new Error("Lifecycle operation changed during retained exec proof.");
-    if (kind === "stop") {
+  const copiedOptions = { ...options };
+  const copiedCommand = command ? [...command] : void 0;
+  if (kind === "stop") {
+    const fence = updateReliabilityOperation(identity2, (record4) => {
+      reconcileDrained(record4);
       stepRecord(record4, { ...reliabilityFence(record4.state), type: "stop" });
-    } else {
-      if (record4.worker)
+      return reliabilityFence(record4.state);
+    });
+    return runLifecycleWorker({ kind, repoPath, identity: identity2, ...ids, fence, options: copiedOptions });
+  }
+  const initial = readReliabilityOperation(identity2) ?? updateReliabilityOperation(identity2, (record4) => record4);
+  const expectedFence = reliabilityFence(initial.state);
+  const deadline = Date.now() + BUSY_LIFECYCLE_WAIT_MS;
+  const cancellation = { requested: false };
+  const removeSignals = installLifecycleWaitSignals(cancellation);
+  let lastProgress = -Infinity;
+  const assertWaiting = () => {
+    if (cancellation.requested)
+      throw new Error(`Lifecycle ${kind} ${ids.operationId} cancelled before dispatch.`);
+    if (Date.now() >= deadline)
+      throw new Error(
+        `Lifecycle ${kind} ${ids.operationId} admission timed out; command was not launched.`
+      );
+  };
+  try {
+    for (; ; ) {
+      assertWaiting();
+      let previous = readReliabilityOperation(identity2);
+      if (!previous || !matchesFence(previous, expectedFence))
         throw new Error(
-          "An earlier lifecycle worker may still be active; use explicit stop to reconcile it."
+          "Lifecycle intent changed while awaiting admission; command was not launched."
         );
-      record4.outcome = null;
-      stepRecord(record4, {
-        ...reliabilityFence(record4.state),
-        type: "operation-request",
-        kind,
-        key: ids.requestId,
-        operationId: ids.operationId,
-        profile: options.profile ?? record4.state.profile ?? "full",
-        consumer: { id: "manual-cli", requiredCapabilities: [], pinned: false },
-        runtimeRunning,
-        ...retainedExecProof ? { recoverInterruptedEnsure: true } : {}
-      });
+      if (hasDuplicateOperation(previous, ids.requestId, ids.operationId))
+        throw new Error("Lifecycle request identity already exists; command was not replayed.");
+      if (previous.worker) {
+        const worker = previous.worker;
+        const birth = processBirthIdentity(worker.pid);
+        if (birth !== worker.birth && workerGroupAbsent(worker.pid)) {
+          previous = updateReliabilityOperation(identity2, (record4) => {
+            reconcileDrained(record4);
+            return record4;
+          });
+        } else {
+          if (!birth || birth !== worker.birth || previous.state.operation?.status === "COMPLETION_UNKNOWN")
+            throw new Error(
+              "Existing lifecycle worker identity or completion is uncertain; preserve its evidence."
+            );
+          const now = Date.now();
+          if (now - lastProgress >= BUSY_LIFECYCLE_PROGRESS_MS) {
+            reportBusyLifecycleWait(
+              kind,
+              ids.operationId,
+              now - (deadline - BUSY_LIFECYCLE_WAIT_MS)
+            );
+            lastProgress = now;
+          }
+          await new Promise(
+            (resolve) => setTimeout(resolve, Math.min(BUSY_LIFECYCLE_POLL_MS, deadline - now))
+          );
+          continue;
+        }
+      }
+      if (!previous.worker && previous.state.operation?.status === "NOT_STARTED" && !previous.state.operation.drained)
+        previous = updateReliabilityOperation(identity2, (record4) => {
+          reconcileDrained(record4);
+          return record4;
+        });
+      assertWaiting();
+      const runtimeRunning = kind === "exec" && Boolean(resolveRunningWorkspaceContainer(repoPath));
+      let retainedExecProof;
+      if (kind === "exec" && identity2.provider === "devsy" && canExecAfterInterruptedEnsure(previous.state))
+        retainedExecProof = withMutationLock(
+          "Prove retained exec",
+          repoPath,
+          () => captureDevsyExecProof(repoPath)
+        );
+      assertWaiting();
+      try {
+        return await runLifecycleWorker(
+          {
+            kind,
+            repoPath,
+            identity: identity2,
+            ...ids,
+            fence: { ...expectedFence },
+            options: copiedOptions,
+            ...copiedCommand ? { command: copiedCommand } : {},
+            ...retainedExecProof ? { retainedExecProof } : {},
+            admission: {
+              expectedRevision: previous.revision,
+              profile: copiedOptions.profile ?? previous.state.profile ?? "full",
+              consumer: { id: "manual-cli", requiredCapabilities: [], pinned: false },
+              runtimeRunning,
+              ...retainedExecProof ? { recoverInterruptedEnsure: true } : {}
+            }
+          },
+          assertWaiting
+        );
+      } catch (error) {
+        if (!(error instanceof LifecycleWorkerAdmissionBusyError)) throw error;
+        assertWaiting();
+        await new Promise((resolve) => setTimeout(resolve, BUSY_LIFECYCLE_POLL_MS));
+      }
     }
-    fence = reliabilityFence(record4.state);
-  });
-  return runLifecycleWorker({
-    kind,
-    repoPath,
-    identity: identity2,
-    ...ids,
-    fence,
-    options,
-    ...command ? { command } : {},
-    ...retainedExecProof ? { retainedExecProof } : {}
-  });
+  } finally {
+    removeSignals();
+  }
 }
-var import_node_path41, activeWorker, lockHeld;
+var import_node_path41, activeWorker, lockHeld, BUSY_LIFECYCLE_WAIT_MS, BUSY_LIFECYCLE_POLL_MS, BUSY_LIFECYCLE_PROGRESS_MS;
 var init_reliability_lifecycle = __esm({
   "src/core/reliability-lifecycle.ts"() {
     "use strict";
@@ -13966,11 +14206,15 @@ var init_reliability_lifecycle = __esm({
     init_reliability_model();
     init_reliability_operation_store();
     init_reliability_worker();
+    init_traefik_route_health();
     init_workspace();
     init_workspace_ensure();
     init_workspace_runtime();
     init_reliability_context();
     lockHeld = false;
+    BUSY_LIFECYCLE_WAIT_MS = 30 * 60 * 1e3;
+    BUSY_LIFECYCLE_POLL_MS = 250;
+    BUSY_LIFECYCLE_PROGRESS_MS = 1e4;
   }
 });
 
@@ -15632,11 +15876,11 @@ var init_repo_devcontainer = __esm({
 function fail3(message) {
   throw new Error(message);
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function requireRecord(value, label) {
-  if (!isRecord4(value)) fail3(`${label} must be a mapping.`);
+  if (!isRecord5(value)) fail3(`${label} must be a mapping.`);
   return value;
 }
 function requireExactKeys(value, allowed, label) {
@@ -17416,7 +17660,7 @@ var init_workspace_consumption = __esm({
 });
 
 // src/core/workspace-cleanup.ts
-function isRecord5(value) {
+function isRecord6(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function isSha(value) {
@@ -17560,14 +17804,14 @@ function parseGitHubChanges(value, project, branch) {
   if (!Array.isArray(value)) return void 0;
   const changes = [];
   for (const item of value) {
-    if (!isRecord5(item)) return void 0;
-    const repository = isRecord5(item.repository) ? item.repository.nameWithOwner : void 0;
-    const headRepository = isRecord5(item.headRepository) ? item.headRepository.nameWithOwner : void 0;
+    if (!isRecord6(item)) return void 0;
+    const repository = isRecord6(item.repository) ? item.repository.nameWithOwner : void 0;
+    const headRepository = isRecord6(item.headRepository) ? item.headRepository.nameWithOwner : void 0;
     if (repository !== project || headRepository !== project || item.headRefName !== branch || !isSha(item.headRefOid) || typeof item.baseRefName !== "string") {
       continue;
     }
     const merged = item.state === "MERGED" && validTimestamp(item.mergedAt);
-    const mergeCommit = isRecord5(item.mergeCommit) && isSha(item.mergeCommit.oid) ? item.mergeCommit.oid : void 0;
+    const mergeCommit = isRecord6(item.mergeCommit) && isSha(item.mergeCommit.oid) ? item.mergeCommit.oid : void 0;
     const baseSha = isSha(item.baseRefOid) ? item.baseRefOid : void 0;
     changes.push({
       sourceBranch: branch,
@@ -17584,14 +17828,14 @@ function parseGitLabChanges(value, _project, branch) {
   if (!Array.isArray(value)) return void 0;
   const changes = [];
   for (const item of value) {
-    if (!isRecord5(item)) return void 0;
+    if (!isRecord6(item)) return void 0;
     const sourceProjectId = item.source_project_id;
     const targetProjectId = item.target_project_id;
     const sameProject = typeof sourceProjectId === "number" && typeof targetProjectId === "number" && sourceProjectId === targetProjectId;
     if (!sameProject || item.source_branch !== branch || !isSha(item.sha) || typeof item.target_branch !== "string") {
       continue;
     }
-    const diffRefs = isRecord5(item.diff_refs) ? item.diff_refs : void 0;
+    const diffRefs = isRecord6(item.diff_refs) ? item.diff_refs : void 0;
     const mergeCommitSha = isSha(item.merge_commit_sha) ? item.merge_commit_sha : void 0;
     const baseSha = diffRefs && isSha(diffRefs.base_sha) ? diffRefs.base_sha : void 0;
     changes.push({
@@ -18413,8 +18657,24 @@ async function mutateWorkspaceRuntime(action2, resolved, worktrees, quiet = fals
       "Retained managed runtime has no exact provider registration; routes were preserved."
     );
   }
-  const routes = removeWorkspaceRoutesForWorktree(resolved.workspace, resolved.worktreePath);
-  await ensureTraefikRoutesRemoved(routes);
+  const retained = action2 === "stop" ? readManagedRuntimeState(resolved.worktreePath, resolved.workspace) : void 0;
+  let absent = false;
+  const remove = () => {
+    if (retained?.stopBaseline) {
+      absent = proveManagedStop(retained).status === "proven-absent";
+      if (absent && listRoutesForWorktreePath(resolved.worktreePath).some(
+        (route) => route.workspace !== resolved.workspace || !retained.desired.apps.includes(route.name)
+      ))
+        throw new Error("Absent stop contains routes outside the retained desired set.");
+    }
+    claimLifecycleEffect();
+    return removeWorkspaceRoutesForWorktree(resolved.workspace, resolved.worktreePath);
+  };
+  const routes = retained?.stopBaseline ? withMutationLock("Revalidate stop routes", resolved.worktreePath, remove) : remove();
+  await ensureTraefikRoutesRemoved([
+    ...routes,
+    ...absent && retained ? managedStopRouteReferences(retained) : []
+  ]);
   if (!quiet) {
     process.stdout.write(
       `Freed ${routes.length} route(s) for workspace '${resolved.workspace}'.
@@ -18425,6 +18685,7 @@ async function mutateWorkspaceRuntime(action2, resolved, worktrees, quiet = fals
     ...mutation.status === "changed" ? { devpodId } : {},
     freedRoutes: routes.length,
     providerChanged: mutation.status === "changed",
+    ...absent ? { runtimeAbsent: true } : {},
     workspace: resolved.workspace
   };
 }
@@ -18487,7 +18748,9 @@ var init_workspace_lifecycle = __esm({
     import_node_path49 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
+    init_devsy_mutation();
     init_managed_runtime_state();
+    init_managed_stop_recovery();
     init_reliability_lifecycle();
     init_repo_config();
     init_route_state();
@@ -18643,7 +18906,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.62" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.64" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {