@devrouter/cli 0.0.65 → 0.0.67

package/dist/devrouter.js

@@ -2520,7 +2520,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs6.default.read
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.65" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.67" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -3494,6 +3494,19 @@ var init_reliability_contract = __esm({
 });
 
 // src/core/reliability-operation-store.ts
+function installedCliVersion() {
+  return true ? "0.0.67" : "0.0.0-dev";
+}
+function compareCliVersions(left, right) {
+  const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
+  const leftParts = parts(left);
+  const rightParts = parts(right);
+  for (let index = 0; index < 3; index += 1) {
+    const difference = (leftParts[index] ?? 0) - (rightParts[index] ?? 0);
+    if (difference !== 0) return difference;
+  }
+  return 0;
+}
 function identityKey(identity2) {
   if (!import_node_path10.default.isAbsolute(identity2.repoPath) || import_node_path10.default.resolve(identity2.repoPath) !== identity2.repoPath || identity2.repoPath.includes("\0") || identity2.workspace !== null && !isReliabilityId(identity2.workspace) || !["devpod", "devsy"].includes(identity2.provider)) {
     throw new Error("Invalid reliability workspace identity.");
@@ -3509,7 +3522,21 @@ function keys(value, expected) {
   }
 }
 function validate(record5, identity2) {
-  keys(record5, ["version", "identity", "revision", "state", "worker", "effectSequence", "outcome"]);
+  keys(record5, [
+    "version",
+    "identity",
+    "revision",
+    "state",
+    "worker",
+    "effectSequence",
+    "outcome",
+    "writtenByVersion"
+  ]);
+  if (record5.writtenByVersion !== void 0 && compareCliVersions(record5.writtenByVersion, installedCliVersion()) > 0) {
+    throw new Error(
+      `Reliability record was last written by devrouter ${record5.writtenByVersion}, which is newer than the installed ${installedCliVersion()}; upgrade devrouter (devrouter upgrade) before running lifecycle commands.`
+    );
+  }
   keys(record5.identity, ["repoPath", "workspace", "provider"]);
   if (record5.version !== 1 || record5.identity.repoPath !== identity2.repoPath || record5.identity.workspace !== identity2.workspace || record5.identity.provider !== identity2.provider || !isReliabilityCounter(record5.revision) || !isReliabilityCounter(record5.effectSequence)) {
     throw new Error("Reliability record has invalid version, ownership, or counters.");
@@ -3650,6 +3677,7 @@ function updateReliabilityOperation(identity2, operation) {
     if (result && typeof result.then === "function") {
       throw new Error("Reliability record updates must be synchronous.");
     }
+    record5.writtenByVersion = installedCliVersion();
     validate(record5, identity2);
     record5.revision += 1;
     persist(record5);
@@ -7462,6 +7490,10 @@ var init_ai_prompt = __esm({
       {
         command: "devrouter workspace gc [--json] [--yes]",
         purpose: "Report missing owners without mutation by default; --yes deletes only exact eligible ledger-owned resources and records, never Git worktrees."
+      },
+      {
+        command: "devrouter workspace journal settle [path] [--json]",
+        purpose: "Settle a lifecycle operation whose worker is provably gone as unobservable so ensure/stop can proceed; never hand-edit the devrouter state directory."
       }
     ];
   }
@@ -11467,6 +11499,17 @@ function inspectDevsyRuntimeStatus(devsyId) {
   if (result.status !== 0 || result.error) return "unknown";
   return parseDevsyRuntimeStatus(result.stdout, devsyId);
 }
+function inspectDevsyRuntimeAbsence(devsyId) {
+  const result = (0, import_node_child_process16.spawnSync)("devsy", ["workspace", "status", devsyId, "--result-format", "json"], {
+    encoding: "utf-8",
+    timeout: 1e4
+  });
+  if (!result.error && result.status === 0) {
+    return parseDevsyRuntimeStatus(result.stdout, devsyId) === "not-found";
+  }
+  const output2 = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n");
+  return /workspace not found/i.test(output2);
+}
 function inspectDevsyWorkspaceOwnership(workspaces, devsyId, worktreePath) {
   const idOwners = workspaces.filter((workspace) => workspace.id === devsyId);
   const pathOwners = workspaces.filter(
@@ -12140,6 +12183,96 @@ var init_managed_compose_population = __esm({
   }
 });
 
+// src/core/devsy-exec-proof.ts
+function proveLocalDockerSelection(workspace) {
+  const name = workspace.providerName;
+  const context = workspace.context;
+  if (!name || !context || !/^[a-z0-9][a-z0-9-]{0,31}$/.test(name) || !/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(context))
+    throw new Error("Retained exec provider configuration identity is unavailable.");
+  const file = import_node_path33.default.join(
+    process.env.DEVSY_HOME || import_node_path33.default.join(import_node_os2.default.homedir(), ".devsy"),
+    "contexts",
+    context,
+    "providers",
+    name,
+    "provider.json"
+  );
+  try {
+    if (import_node_fs29.default.statSync(file).size > 1024 * 1024) throw new Error();
+    const config = JSON.parse(import_node_fs29.default.readFileSync(file, "utf8"));
+    const driver = config.agent?.driver ?? "docker";
+    const configuredPath = config.agent?.docker?.path ?? "";
+    if (typeof configuredPath !== "string") throw new Error();
+    const command = configuredPath === "${DOCKER_PATH}" || configuredPath === "$DOCKER_PATH" ? workspace.dockerPathOption || process.env.DOCKER_PATH || "docker" : configuredPath || "docker";
+    if (config.name !== name || driver !== "docker" || command !== "docker") throw new Error();
+  } catch {
+    throw new Error("Retained exec requires a provider configured for the local Docker command.");
+  }
+  return name;
+}
+function captureDevsyExecProof(repoPath) {
+  repoPath = comparableWorkspacePath(repoPath);
+  const registry = listDevsyWorkspaces();
+  const workspace = selectDevsyWorkspace(registry, repoPath);
+  if (!workspace?.uid || !workspace.context || workspace.source.container || inspectDevsyWorkspaceOwnership(registry, workspace.id, repoPath).status !== "owned" || inspectDevsyRuntimeStatus(workspace.id) !== "running")
+    throw new Error("Retained exec requires one exact running Devsy registration.");
+  const providerName = proveLocalDockerSelection(workspace);
+  const endpoint = resolveManagedStopEndpoint();
+  if (!supportsManagedStopBaseline(endpoint))
+    throw new Error("Retained exec requires an exact local Docker endpoint.");
+  const daemon = inspectManagedStopDaemon(endpoint);
+  const candidates = workspaceAppContainers(inspectWorkspaceContainers(), repoPath).filter(
+    (container) => container.state.Running
+  );
+  if (candidates.length !== 1)
+    throw new Error("Retained exec requires one exact running primary container.");
+  const candidate = candidates[0];
+  const project = candidate.labels["com.docker.compose.project"];
+  if (!project) throw new Error("Retained exec primary has no Compose identity.");
+  const pinned = workspaceAppContainers(
+    inspectManagedStopContainers(project, endpoint),
+    repoPath
+  ).filter((container) => container.state.Running);
+  if (pinned.length !== 1 || pinned[0].id !== candidate.id)
+    throw new Error("Retained exec primary changed during inspection.");
+  const mounts = pinned[0].mounts.filter(
+    (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
+  );
+  if (mounts.length !== 1 || !mounts[0].Destination.startsWith("/"))
+    throw new Error("Retained exec requires one exact source mount.");
+  const uidBytes = Buffer.byteLength(workspace.uid);
+  const runner = uidBytes === 16 || uidBytes === 40 ? workspace.uid : workspace.id;
+  const runnerContainers = inspectProviderRunnerContainers(endpoint, runner);
+  if (runnerContainers.length !== 1 || runnerContainers[0] !== candidate.id)
+    throw new Error("Retained exec runner does not select the exact primary container.");
+  if (inspectManagedStopRunnerId(endpoint, candidate.id) !== runner || inspectManagedStopDaemon(endpoint) !== daemon)
+    throw new Error("Retained exec provider or Docker identity changed.");
+  return {
+    repoPath,
+    id: workspace.id,
+    uid: workspace.uid,
+    context: workspace.context,
+    providerName,
+    endpoint,
+    daemon,
+    containerId: candidate.id,
+    workspacePath: mounts[0].Destination
+  };
+}
+var import_node_fs29, import_node_os2, import_node_path33, import_node_util2;
+var init_devsy_exec_proof = __esm({
+  "src/core/devsy-exec-proof.ts"() {
+    "use strict";
+    import_node_fs29 = __toESM(require("fs"));
+    import_node_os2 = __toESM(require("os"));
+    import_node_path33 = __toESM(require("path"));
+    import_node_util2 = require("util");
+    init_devpod_environment();
+    init_devsy_workspaces();
+    init_workspace();
+  }
+});
+
 // src/core/reliability-context.ts
 function claimLifecycleEffect() {
   claim?.();
@@ -12168,7 +12301,7 @@ function resolveGitCommonDir(repoPath) {
   if (result.status !== 0 || !output2) {
     throw commandError("Could not resolve the Git common directory", repoPath, result.stderr);
   }
-  return comparableWorkspacePath(import_node_path33.default.isAbsolute(output2) ? output2 : import_node_path33.default.resolve(repoPath, output2));
+  return comparableWorkspacePath(import_node_path34.default.isAbsolute(output2) ? output2 : import_node_path34.default.resolve(repoPath, output2));
 }
 function resolveGitTopLevel(repoPath) {
   const result = (0, import_node_child_process20.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
@@ -12219,7 +12352,7 @@ function listGitWorktrees(repoPath) {
   return worktrees;
 }
 function ownershipDirectory(repoPath) {
-  return import_node_path33.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
+  return import_node_path34.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
 }
 function validateWorkspace(value, label) {
   if (typeof value !== "string" || wsFromBranch(value) !== value) {
@@ -12247,7 +12380,7 @@ function validateRecord(value, expectedWorkspace) {
       `workspace ownership file '${expectedWorkspace}' contains identity '${workspace}'`
     );
   }
-  if (typeof candidate.worktreePath !== "string" || !import_node_path33.default.isAbsolute(candidate.worktreePath)) {
+  if (typeof candidate.worktreePath !== "string" || !import_node_path34.default.isAbsolute(candidate.worktreePath)) {
     throw new Error("invalid workspace ownership worktreePath");
   }
   if (candidate.branch !== null && typeof candidate.branch !== "string") {
@@ -12265,7 +12398,7 @@ function validateRecord(value, expectedWorkspace) {
   };
 }
 function recordPath(repoPath, workspace) {
-  return import_node_path33.default.join(
+  return import_node_path34.default.join(
     ownershipDirectory(repoPath),
     `${validateWorkspace(workspace, "workspace")}.json`
   );
@@ -12273,7 +12406,7 @@ function recordPath(repoPath, workspace) {
 function readRecordFile(filePath, expectedWorkspace) {
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs29.default.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(import_node_fs30.default.readFileSync(filePath, "utf-8"));
   } catch (error) {
     if (error instanceof SyntaxError) {
       throw new Error(`invalid workspace ownership JSON at '${filePath}'`);
@@ -12298,7 +12431,7 @@ function listWorkspaceOwnership(repoPath) {
 function listWorkspaceOwnershipInDirectory(directory) {
   let entries;
   try {
-    entries = import_node_fs29.default.readdirSync(directory, { withFileTypes: true });
+    entries = import_node_fs30.default.readdirSync(directory, { withFileTypes: true });
   } catch (error) {
     if (error.code === "ENOENT") return [];
     throw error;
@@ -12306,14 +12439,14 @@ function listWorkspaceOwnershipInDirectory(directory) {
   return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
     const workspace = entry.name.slice(0, -".json".length);
     validateWorkspace(workspace, "filename");
-    return readRecordFile(import_node_path33.default.join(directory, entry.name), workspace);
+    return readRecordFile(import_node_path34.default.join(directory, entry.name), workspace);
   });
 }
 function writeWorkspaceOwnershipInDirectory(directory, input2) {
   const workspace = validateWorkspace(input2.workspace, "workspace");
   const devpodId = validateWorkspace(input2.devpodId, "devpodId");
   const worktreePath = comparableWorkspacePath(input2.worktreePath);
-  const filePath = import_node_path33.default.join(directory, `${workspace}.json`);
+  const filePath = import_node_path34.default.join(directory, `${workspace}.json`);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const records = listWorkspaceOwnershipInDirectory(directory);
   const existing = records.find((record6) => record6.workspace === workspace);
@@ -12349,9 +12482,9 @@ function writeWorkspaceOwnershipInDirectory(directory, input2) {
   return record5;
 }
 function removeWorkspaceOwnershipInDirectory(directory, workspace) {
-  const filePath = import_node_path33.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
+  const filePath = import_node_path34.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
   try {
-    import_node_fs29.default.rmSync(filePath);
+    import_node_fs30.default.rmSync(filePath);
     return true;
   } catch (error) {
     if (error.code === "ENOENT") return false;
@@ -12362,7 +12495,7 @@ function sameOwnershipRecord(left, right) {
   return left.version === right.version && left.workspace === right.workspace && sameWorkspacePath(left.worktreePath, right.worktreePath) && left.branch === right.branch && left.devpodId === right.devpodId && left.createdAt === right.createdAt && left.updatedAt === right.updatedAt;
 }
 function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
-  const filePath = import_node_path33.default.join(
+  const filePath = import_node_path34.default.join(
     directory,
     `${validateWorkspace(expected.workspace, "workspace")}.json`
   );
@@ -12374,14 +12507,14 @@ function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
     throw error;
   }
   if (!sameOwnershipRecord(current, expected)) return "changed";
-  import_node_fs29.default.rmSync(filePath);
+  import_node_fs30.default.rmSync(filePath);
   return "removed";
 }
 function withWorkspaceOwnershipTransaction(repoPath, operation, options = {}) {
   const directory = ownershipDirectory(repoPath);
-  import_node_fs29.default.mkdirSync(directory, { recursive: true });
+  import_node_fs30.default.mkdirSync(directory, { recursive: true });
   return withFileLockSync(
-    import_node_path33.default.join(directory, ".lock"),
+    import_node_path34.default.join(directory, ".lock"),
     {
       activity: "workspace ownership transaction",
       target: `'${repoPath}'`,
@@ -12414,7 +12547,7 @@ function persistedWorkspaceOwners(repoPath, worktreePath) {
     try {
       workspace = readPersistedWorkspace(worktree.path);
     } catch (error) {
-      if (!import_node_fs29.default.existsSync(worktree.path)) continue;
+      if (!import_node_fs30.default.existsSync(worktree.path)) continue;
       throw error;
     }
     if (!workspace) continue;
@@ -12577,7 +12710,7 @@ function inspectWorkspaceOwnership(record5, worktrees, devpods) {
   if (worktree?.locked) {
     return { ownerStatus: "locked", devpodStatus, worktree };
   }
-  if ((!worktree || worktree.prunable) && import_node_fs29.default.existsSync(record5.worktreePath)) {
+  if ((!worktree || worktree.prunable) && import_node_fs30.default.existsSync(record5.worktreePath)) {
     return { ownerStatus: "conflict", devpodStatus, worktree };
   }
   if (!worktree || worktree.prunable) {
@@ -12601,20 +12734,20 @@ function listMissingWorkspaceOwnership(repoPath) {
     (record5) => inspectWorkspaceOwnership(record5, worktrees, void 0).ownerStatus === "missing"
   );
 }
-var import_node_child_process20, import_node_fs29, import_node_path33, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
+var import_node_child_process20, import_node_fs30, import_node_path34, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
 var init_workspace_ownership = __esm({
   "src/core/workspace-ownership.ts"() {
     "use strict";
     import_node_child_process20 = require("child_process");
-    import_node_fs29 = __toESM(require("fs"));
-    import_node_path33 = __toESM(require("path"));
+    import_node_fs30 = __toESM(require("fs"));
+    import_node_path34 = __toESM(require("path"));
     init_atomic_file();
     init_devpod_workspaces();
     init_file_lock();
     init_workspace();
     READ_ONLY_GIT_ENV = { ...process.env, GIT_OPTIONAL_LOCKS: "0" };
     OWNERSHIP_VERSION = 1;
-    OWNERSHIP_DIR = import_node_path33.default.join("devrouter", "workspaces");
+    OWNERSHIP_DIR = import_node_path34.default.join("devrouter", "workspaces");
   }
 });
 
@@ -12636,7 +12769,16 @@ function registration(state) {
       throw new Error("Stop workspace identity changed.");
     resolveGitCommonDir(state.repoPath);
   } else if (state.workspace !== void 0) throw new Error("Stop checkout identity changed.");
-  const value = owner.workspace;
+  return identityOf(owner.workspace);
+}
+function managedRunnerId(uid, providerId) {
+  if (uid === void 0) {
+    return providerId;
+  }
+  const bytes = Buffer.byteLength(uid);
+  return bytes === 16 || bytes === 40 ? uid : providerId;
+}
+function identityOf(value) {
   return {
     context: value.context ?? "",
     providerId: value.id,
@@ -12671,7 +12813,7 @@ function prove(state, baseline) {
   const containers2 = inspectManagedStopContainers(baseline.project, baseline.endpoint);
   const expected = baseline.containers.map((container) => ({ ...container, mounts: orderedMounts(container.mounts) })).sort((a, b) => compareText(a.id, b.id));
   const observed = containers2.map(identity).sort((a, b) => compareText(a.id, b.id));
-  if (!(0, import_node_util2.isDeepStrictEqual)(expected, observed) || containers2.some(
+  if (!(0, import_node_util3.isDeepStrictEqual)(expected, observed) || containers2.some(
     (container) => container.labels["com.docker.compose.project.working_dir"] !== baseline.composeDirectory
   )) {
     throw new Error("Retained container population or immutable identity changed.");
@@ -12680,7 +12822,7 @@ function prove(state, baseline) {
     baseline.endpoint,
     baseline.composeDirectory
   ).sort();
-  if (!(0, import_node_util2.isDeepStrictEqual)(workspaceIds, expected.map((container) => container.id).sort())) {
+  if (!(0, import_node_util3.isDeepStrictEqual)(workspaceIds, expected.map((container) => container.id).sort())) {
     throw new Error("Workspace contains an unrecorded container population.");
   }
   const primary = baseline.containers.find(
@@ -12692,18 +12834,18 @@ function prove(state, baseline) {
   if (!baseline.sourceContainer && inspectManagedStopRunnerId(baseline.endpoint, primary.id) !== runnerId) {
     throw new Error("Provider-to-container binding changed.");
   }
-  if (!(0, import_node_util2.isDeepStrictEqual)(registration(state), owner) || inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId) {
+  if (!(0, import_node_util3.isDeepStrictEqual)(registration(state), owner) || inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId) {
     throw new Error("Stop authority changed during inspection.");
   }
   return containers2;
 }
 function proveRetainedManagedStop(state) {
   const baseline = validateManagedStopBaseline(state.stopBaseline, state);
-  if (!(0, import_node_util2.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state)) {
+  if (!(0, import_node_util3.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state)) {
     throw new Error("Retained stop generation changed.");
   }
   const result = prove(state, baseline);
-  if (!(0, import_node_util2.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state)) {
+  if (!(0, import_node_util3.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state)) {
     throw new Error("Retained stop generation changed during inspection.");
   }
   return result;
@@ -12728,6 +12870,64 @@ function absentRegistrationIdentity(state) {
   }
   return { record: record5, gitCommonDir: resolveGitCommonDir(state.repoPath) };
 }
+function replacementObservation(state) {
+  resetWorkspaceRuntimeCaches();
+  if (resolveWorkspaceRuntimeOrDefault(state.repoPath) !== "devsy")
+    throw new Error("Stop provider changed.");
+  if (!state.workspace || !isLinkedWorktree(state.repoPath))
+    throw new Error("Replacement stop requires a linked workspace.");
+  const record5 = readWorkspaceOwnership(state.repoPath, state.workspace);
+  if (!record5 || record5.workspace !== state.workspace || record5.devpodId !== state.devpodId || !sameWorkspacePath(record5.worktreePath, state.repoPath) || resolveWorktreeWorkspace(state.repoPath) !== state.workspace || inspectWorkspaceOwnership(record5, listGitWorktrees(state.repoPath), void 0).ownerStatus !== "present")
+    throw new Error("Replacement stop workspace ownership changed.");
+  const owner = inspectDevsyWorkspaceOwnership(
+    listDevsyWorkspaces(),
+    state.devpodId,
+    state.repoPath
+  );
+  if (owner.status !== "owned")
+    throw new Error("Replacement stop requires one exact provider registration.");
+  if (listDevpodWorkspacesRaw({ allowMissingExecutable: true }).some(
+    (entry) => entry.id === state.devpodId || sameWorkspacePath(entry.source.localFolder, state.repoPath)
+  ))
+    throw new Error("Replacement stop requires no competing provider registration.");
+  proveLocalDockerSelection(owner.workspace);
+  return owner.workspace;
+}
+function proveReplacementStopAbsence(state, baseline, replacement) {
+  const observation = () => {
+    const workspace = replacementObservation(state);
+    if (workspace.uid !== replacement.uid)
+      throw new Error("Replacement stop registration changed during inspection.");
+    if (resolveManagedStopEndpoint() !== baseline.endpoint)
+      throw new Error("Stop endpoint changed.");
+    if (inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId)
+      throw new Error("Stop daemon changed.");
+    return workspace;
+  };
+  const before = observation();
+  if (!(0, import_node_util3.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state))
+    throw new Error("Retained stop generation changed.");
+  assertManagedStopContainersAbsent(
+    baseline.endpoint,
+    baseline.containers.map((container) => container.id)
+  );
+  const oldRunner = managedRunnerId(baseline.uid, baseline.providerId);
+  const newRunner = managedRunnerId(before.uid, baseline.providerId);
+  const runners = oldRunner === newRunner ? [oldRunner] : [oldRunner, newRunner];
+  const assertEmptyPopulation = () => {
+    if (inspectManagedStopContainers(baseline.project, baseline.endpoint).length !== 0 || inspectManagedStopWorkspaceIds(baseline.endpoint, baseline.composeDirectory).length !== 0 || runners.some((id4) => inspectProviderRunnerContainers(baseline.endpoint, id4).length !== 0))
+      throw new Error("Replacement stop observed a remaining workspace population.");
+  };
+  assertEmptyPopulation();
+  const after = observation();
+  if (after.uid !== before.uid || !(0, import_node_util3.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state))
+    throw new Error("Replacement stop authority changed during inspection.");
+  assertManagedStopContainersAbsent(
+    baseline.endpoint,
+    baseline.containers.map((container) => container.id)
+  );
+  assertEmptyPopulation();
+}
 function proveManagedStop(state) {
   const baseline = validateManagedStopBaseline(state.stopBaseline, state);
   const owner = inspectDevsyWorkspaceOwnership(
@@ -12735,11 +12935,20 @@ function proveManagedStop(state) {
     state.devpodId,
     state.repoPath
   );
+  if (owner.status === "owned") {
+    const identityKeys = ["context", "providerId", "uid", "sourcePath", "sourceContainer"];
+    const current = identityOf(owner.workspace);
+    const changed = identityKeys.filter((key) => baseline[key] !== current[key]);
+    if (changed.length === 1 && changed[0] === "uid" && !baseline.sourceContainer && !current.sourceContainer && state.workspace !== void 0 && isLinkedWorktree(state.repoPath)) {
+      proveReplacementStopAbsence(state, baseline, { uid: current.uid || void 0 });
+      return { status: "proven-absent", containers: [] };
+    }
+  }
   if (owner.status !== "absent")
     return { status: "retained", containers: proveRetainedManagedStop(state) };
   if (baseline.sourceContainer) throw new Error("Absent stop cannot prove a source container.");
   const before = absentRegistrationIdentity(state);
-  if (!(0, import_node_util2.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state))
+  if (!(0, import_node_util3.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state))
     throw new Error("Retained stop generation changed.");
   if (inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId)
     throw new Error("Stop daemon changed.");
@@ -12751,7 +12960,7 @@ function proveManagedStop(state) {
   const runnerId = uidBytes === 16 || uidBytes === 40 ? baseline.uid : baseline.providerId;
   if (inspectManagedStopContainers(baseline.project, baseline.endpoint).length !== 0 || inspectManagedStopWorkspaceIds(baseline.endpoint, baseline.composeDirectory).length !== 0 || inspectProviderRunnerContainers(baseline.endpoint, runnerId).length !== 0)
     throw new Error("Absent stop observed a remaining workspace population.");
-  if (inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId || !(0, import_node_util2.isDeepStrictEqual)(absentRegistrationIdentity(state), before) || !(0, import_node_util2.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state))
+  if (inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId || !(0, import_node_util3.isDeepStrictEqual)(absentRegistrationIdentity(state), before) || !(0, import_node_util3.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state))
     throw new Error("Absent stop authority changed during inspection.");
   return { status: "proven-absent", containers: [] };
 }
@@ -12787,15 +12996,16 @@ function managedStopRouteReferences(state) {
     (name) => ["http", "tcp"].map((protocol) => ({ repoPath: state.repoPath, name, protocol }))
   );
 }
-var import_node_os2, import_node_path34, import_node_util2;
+var import_node_os3, import_node_path35, import_node_util3;
 var init_managed_stop_recovery = __esm({
   "src/core/managed-stop-recovery.ts"() {
     "use strict";
-    import_node_os2 = __toESM(require("os"));
-    import_node_path34 = __toESM(require("path"));
-    import_node_util2 = require("util");
+    import_node_os3 = __toESM(require("os"));
+    import_node_path35 = __toESM(require("path"));
+    import_node_util3 = require("util");
     init_devpod_environment();
     init_devpod_registry();
+    init_devsy_exec_proof();
     init_devsy_workspaces();
     init_managed_compose_population();
     init_managed_runtime_state();
@@ -12925,12 +13135,72 @@ function stopRetainedManagedDevsyWorkspace(options) {
     }
     return owner.workspace;
   }
+  function registrationStatus() {
+    resetWorkspaceRuntimeCaches();
+    if (resolveWorkspaceRuntimeOrDefault(repoPath) !== "devsy") {
+      throw new Error("Managed stop provider selection changed.");
+    }
+    return inspectDevsyWorkspaceOwnership(listDevsyWorkspaces(), devsyId, repoPath);
+  }
+  function proveAbsentRegistrationStop() {
+    const observe = () => {
+      const owner = registrationStatus();
+      if (owner.status === "conflict") throw new Error(owner.reason);
+      if (owner.status !== "absent") {
+        throw new Error("Managed stop absence proof requires the registration to remain absent.");
+      }
+      if (listDevpodWorkspacesRaw({ allowMissingExecutable: true }).some(
+        (entry) => entry.id === devsyId || sameWorkspacePath(entry.source.localFolder, repoPath)
+      )) {
+        throw new Error(
+          "Managed stop absence proof requires both provider registrations to remain absent."
+        );
+      }
+      if (!inspectDevsyRuntimeAbsence(devsyId)) {
+        throw new Error(
+          "Managed stop absence proof requires Devsy to report the runtime not-found."
+        );
+      }
+      if (inspectManagedStopContainers(state.composeProject).length !== 0) {
+        throw new Error("Managed stop absence proof observed a remaining compose population.");
+      }
+      if (inspectProviderRunnerContainers(resolveManagedStopEndpoint(), devsyId).length !== 0) {
+        throw new Error("Managed stop absence proof observed a remaining runner population.");
+      }
+      const owned = inspectWorkspaceContainers().filter(
+        (container) => sameWorkspacePath(
+          container.labels["com.docker.compose.project.working_dir"] ?? "",
+          import_node_path36.default.join(repoPath, ".devcontainer")
+        )
+      );
+      if (owned.length !== 0) {
+        throw new Error("Managed stop absence proof observed a remaining workspace container.");
+      }
+      if (workspace) {
+        const record5 = readWorkspaceOwnership(repoPath, workspace);
+        if (!record5 || record5.devpodId !== devsyId || !sameWorkspacePath(record5.worktreePath, repoPath) || resolveWorktreeWorkspace(repoPath) !== workspace || resolveGitCommonDir(repoPath) !== workspaceEnv?.gitCommonDir || inspectWorkspaceOwnership(record5, listGitWorktrees(repoPath), void 0).ownerStatus !== "present") {
+          throw new Error("Managed stop workspace ownership changed during absence proof.");
+        }
+      }
+      if (!(0, import_node_util4.isDeepStrictEqual)(readManagedRuntimeState(repoPath, workspace), state)) {
+        throw new Error("Managed stop retained state changed during absence proof.");
+      }
+    };
+    observe();
+    observe();
+  }
+  const initialOwner = registrationStatus();
+  if (initialOwner.status === "conflict") throw new Error(initialOwner.reason);
+  if (initialOwner.status === "absent") {
+    proveAbsentRegistrationStop();
+    return "proven-absent";
+  }
   const context = registration2().context;
   if (!context || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(context) || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(devsyId)) {
     throw new Error("Managed stop requires a valid exact Devsy context and workspace ID.");
   }
-  const devsyRoot = import_node_path35.default.resolve(process.env.DEVSY_HOME || import_node_path35.default.join(import_node_os3.default.homedir(), ".devsy"));
-  const featureDirectory = import_node_path35.default.join(
+  const devsyRoot = import_node_path36.default.resolve(process.env.DEVSY_HOME || import_node_path36.default.join(import_node_os4.default.homedir(), ".devsy"));
+  const featureDirectory = import_node_path36.default.join(
     devsyRoot,
     "contexts",
     context,
@@ -13034,14 +13304,16 @@ function stopRetainedManagedDevsyWorkspace(options) {
   if (providerFailed) throw providerError;
   return true;
 }
-var import_node_os3, import_node_path35;
+var import_node_os4, import_node_path36, import_node_util4;
 var init_managed_devsy_stop = __esm({
   "src/core/managed-devsy-stop.ts"() {
     "use strict";
-    import_node_os3 = __toESM(require("os"));
-    import_node_path35 = __toESM(require("path"));
+    import_node_os4 = __toESM(require("os"));
+    import_node_path36 = __toESM(require("path"));
+    import_node_util4 = require("util");
     init_devcontainer_profile();
     init_devpod_environment();
+    init_devpod_registry();
     init_devsy_workspaces();
     init_managed_compose_population();
     init_managed_runtime_state();
@@ -13082,14 +13354,14 @@ var init_network_provider_binding = __esm({
 
 // src/core/network-claim-lookup.ts
 function networkOwnerKey(repoPath) {
-  if (!import_node_path36.default.isAbsolute(repoPath) || import_node_path36.default.resolve(repoPath) !== repoPath)
+  if (!import_node_path37.default.isAbsolute(repoPath) || import_node_path37.default.resolve(repoPath) !== repoPath)
     throw new Error("Invalid network owner path.");
   return (0, import_node_crypto18.createHash)("sha256").update(repoPath).digest("hex");
 }
 function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   let names;
   try {
-    names = import_node_fs30.default.readdirSync(root);
+    names = import_node_fs31.default.readdirSync(root);
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw new Error("Network claims cannot be inspected; repair is required.");
@@ -13098,21 +13370,21 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   if (files.length > 128) throw new Error("Network daemon inventory exceeds its bound.");
   let found;
   for (const file of files) {
-    const full = import_node_path36.default.join(root, file);
-    const stat = import_node_fs30.default.lstatSync(full);
+    const full = import_node_path37.default.join(root, file);
+    const stat = import_node_fs31.default.lstatSync(full);
     if (!stat.isFile() || stat.size > NETWORK_CLAIMS_MAX_FILE_BYTES)
       throw new Error("Invalid retained network claim file.");
     let value;
-    const descriptor = import_node_fs30.default.openSync(
+    const descriptor = import_node_fs31.default.openSync(
       full,
-      import_node_fs30.default.constants.O_RDONLY | import_node_fs30.default.constants.O_NONBLOCK | import_node_fs30.default.constants.O_NOFOLLOW
+      import_node_fs31.default.constants.O_RDONLY | import_node_fs31.default.constants.O_NONBLOCK | import_node_fs31.default.constants.O_NOFOLLOW
     );
     try {
-      if (!import_node_fs30.default.fstatSync(descriptor).isFile()) throw new Error();
+      if (!import_node_fs31.default.fstatSync(descriptor).isFile()) throw new Error();
       const bytes = Buffer.alloc(NETWORK_CLAIMS_MAX_FILE_BYTES + 1);
       let size = 0;
       while (size < bytes.length) {
-        const count = import_node_fs30.default.readSync(descriptor, bytes, size, bytes.length - size, null);
+        const count = import_node_fs31.default.readSync(descriptor, bytes, size, bytes.length - size, null);
         if (!count) break;
         size += count;
       }
@@ -13122,7 +13394,7 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
     } catch {
       throw new Error("Retained network claim could not be read safely.");
     } finally {
-      import_node_fs30.default.closeSync(descriptor);
+      import_node_fs31.default.closeSync(descriptor);
     }
     if (typeof value.daemonId !== "string" || `${(0, import_node_crypto18.createHash)("sha256").update(value.daemonId).digest("hex")}.json` !== file)
       throw new Error("Retained network daemon identity is invalid.");
@@ -13138,13 +13410,13 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   }
   return found;
 }
-var import_node_crypto18, import_node_fs30, import_node_path36;
+var import_node_crypto18, import_node_fs31, import_node_path37;
 var init_network_claim_lookup = __esm({
   "src/core/network-claim-lookup.ts"() {
     "use strict";
     import_node_crypto18 = require("crypto");
-    import_node_fs30 = __toESM(require("fs"));
-    import_node_path36 = __toESM(require("path"));
+    import_node_fs31 = __toESM(require("fs"));
+    import_node_path37 = __toESM(require("path"));
     init_network_claims();
   }
 });
@@ -13182,7 +13454,7 @@ var init_network_provider_effect = __esm({
 
 // src/core/devsy-mutation.ts
 function withMutationLock(activity, target, operation) {
-  import_node_fs31.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs32.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVSY_MUTATION_LOCK_FILE,
     {
@@ -13263,13 +13535,13 @@ function stopOwnedDevsyWorkspace(devsyId, worktreePath) {
 function deleteOwnedDevsyWorkspace(devsyId, worktreePath) {
   return mutateOwnedDevsyWorkspace("delete", devsyId, worktreePath);
 }
-var import_node_child_process21, import_node_fs31, import_node_path37, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS;
+var import_node_child_process21, import_node_fs32, import_node_path38, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS;
 var init_devsy_mutation = __esm({
   "src/core/devsy-mutation.ts"() {
     "use strict";
     import_node_child_process21 = require("child_process");
-    import_node_fs31 = __toESM(require("fs"));
-    import_node_path37 = __toESM(require("path"));
+    import_node_fs32 = __toESM(require("fs"));
+    import_node_path38 = __toESM(require("path"));
     init_devsy_agent();
     init_devsy_workspaces();
     init_file_lock();
@@ -13278,14 +13550,14 @@ var init_devsy_mutation = __esm({
     init_network_provider_effect();
     init_reliability_context();
     init_router();
-    DEVSY_MUTATION_LOCK_FILE = import_node_path37.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
+    DEVSY_MUTATION_LOCK_FILE = import_node_path38.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
     DEVSY_MUTATION_WAIT_MS = 18e5;
   }
 });
 
 // src/core/devpod-mutation.ts
 function withMutationLock2(activity, target, operation) {
-  import_node_fs32.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs33.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
     {
@@ -13375,13 +13647,13 @@ function deleteOwnedDevpodWorkspace(devpodId, worktreePath) {
   resetWorkspaceRuntimeCaches();
   return result;
 }
-var import_node_child_process22, import_node_fs32, import_node_path38, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS;
+var import_node_child_process22, import_node_fs33, import_node_path39, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS;
 var init_devpod_mutation = __esm({
   "src/core/devpod-mutation.ts"() {
     "use strict";
     import_node_child_process22 = require("child_process");
-    import_node_fs32 = __toESM(require("fs"));
-    import_node_path38 = __toESM(require("path"));
+    import_node_fs33 = __toESM(require("fs"));
+    import_node_path39 = __toESM(require("path"));
     init_devpod_workspaces();
     init_devsy_mutation();
     init_file_lock();
@@ -13390,7 +13662,7 @@ var init_devpod_mutation = __esm({
     init_reliability_context();
     init_router();
     init_workspace_runtime();
-    DEVPOD_MUTATION_LOCK_FILE = import_node_path38.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+    DEVPOD_MUTATION_LOCK_FILE = import_node_path39.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
     DEVPOD_MUTATION_WAIT_MS = 18e5;
   }
 });
@@ -13405,10 +13677,10 @@ function inRepositoryWorkspaceScope(repoPath, worktreePath, livePaths) {
   if (livePaths.some((candidate) => sameWorkspacePath(candidate, worktreePath))) return true;
   const comparableRepo = comparableWorkspacePath(repoPath);
   const comparableWorktree = comparableWorkspacePath(worktreePath);
-  const localRoot = import_node_path39.default.join(comparableRepo, "trees") + import_node_path39.default.sep;
+  const localRoot = import_node_path40.default.join(comparableRepo, "trees") + import_node_path40.default.sep;
   if (comparableWorktree.startsWith(localRoot)) return true;
-  const legacyPrefix = `${import_node_path39.default.basename(comparableRepo)}-`;
-  return import_node_path39.default.dirname(comparableWorktree) === import_node_path39.default.dirname(comparableRepo) && import_node_path39.default.basename(comparableWorktree).startsWith(legacyPrefix);
+  const legacyPrefix = `${import_node_path40.default.basename(comparableRepo)}-`;
+  return import_node_path40.default.dirname(comparableWorktree) === import_node_path40.default.dirname(comparableRepo) && import_node_path40.default.basename(comparableWorktree).startsWith(legacyPrefix);
 }
 function previewActions(devpodStatus, routeCount, includeRecord) {
   const actions = [
@@ -13660,11 +13932,11 @@ function applyWorkspaceGc(plan) {
     candidates
   };
 }
-var import_node_path39;
+var import_node_path40;
 var init_workspace_gc = __esm({
   "src/core/workspace-gc.ts"() {
     "use strict";
-    import_node_path39 = __toESM(require("path"));
+    import_node_path40 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_host_routes();
@@ -13734,11 +14006,11 @@ function inspectPostgresCredentials(repoPath, config) {
         parseErrors.push(`${app.name}: ${composeFile} (${message})`);
         continue;
       }
-      if (!import_node_fs33.default.existsSync(absolutePath)) {
+      if (!import_node_fs34.default.existsSync(absolutePath)) {
         continue;
       }
       try {
-        const raw = import_node_fs33.default.readFileSync(absolutePath, "utf-8");
+        const raw = import_node_fs34.default.readFileSync(absolutePath, "utf-8");
         const parsed = import_yaml5.default.parse(raw);
         const root = asRecord2(parsed);
         const services = asRecord2(root?.services);
@@ -14018,7 +14290,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.65" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.67" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -14048,9 +14320,9 @@ async function buildDoctorReport(options = {}) {
         (app) => app.docker.composeFiles.map((filePath) => ({
           app: app.name,
           filePath,
-          absolutePath: import_node_path40.default.resolve(repo.path, filePath)
+          absolutePath: import_node_path41.default.resolve(repo.path, filePath)
         }))
-      ).filter((entry) => !import_node_fs33.default.existsSync(entry.absolutePath));
+      ).filter((entry) => !import_node_fs34.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.compose-files",
         level: missingComposeFiles.length === 0 ? "ok" : "error",
@@ -14093,8 +14365,8 @@ async function buildDoctorReport(options = {}) {
       const missingHostCwds = config.apps.filter((app) => app.runtime === "host").map((app) => ({
         app: app.name,
         cwd: app.hostRun.cwd,
-        absolutePath: import_node_path40.default.resolve(repo.path, app.hostRun.cwd)
-      })).filter((entry) => !import_node_fs33.default.existsSync(entry.absolutePath));
+        absolutePath: import_node_path41.default.resolve(repo.path, app.hostRun.cwd)
+      })).filter((entry) => !import_node_fs34.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.host-cwd",
         level: missingHostCwds.length === 0 ? "ok" : "error",
@@ -14238,12 +14510,12 @@ async function buildDoctorReport(options = {}) {
     nextSteps
   };
 }
-var import_node_fs33, import_node_path40, import_yaml5, POSTGRES_DEFAULTS;
+var import_node_fs34, import_node_path41, import_yaml5, POSTGRES_DEFAULTS;
 var init_doctor = __esm({
   "src/core/doctor.ts"() {
     "use strict";
-    import_node_fs33 = __toESM(require("fs"));
-    import_node_path40 = __toESM(require("path"));
+    import_node_fs34 = __toESM(require("fs"));
+    import_node_path41 = __toESM(require("path"));
     import_yaml5 = __toESM(require("yaml"));
     init_docker();
     init_host_routes();
@@ -14652,96 +14924,6 @@ var init_up = __esm({
   }
 });
 
-// src/core/devsy-exec-proof.ts
-function proveLocalDockerSelection(workspace) {
-  const name = workspace.providerName;
-  const context = workspace.context;
-  if (!name || !context || !/^[a-z0-9][a-z0-9-]{0,31}$/.test(name) || !/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(context))
-    throw new Error("Retained exec provider configuration identity is unavailable.");
-  const file = import_node_path41.default.join(
-    process.env.DEVSY_HOME || import_node_path41.default.join(import_node_os4.default.homedir(), ".devsy"),
-    "contexts",
-    context,
-    "providers",
-    name,
-    "provider.json"
-  );
-  try {
-    if (import_node_fs34.default.statSync(file).size > 1024 * 1024) throw new Error();
-    const config = JSON.parse(import_node_fs34.default.readFileSync(file, "utf8"));
-    const driver = config.agent?.driver ?? "docker";
-    const configuredPath = config.agent?.docker?.path ?? "";
-    if (typeof configuredPath !== "string") throw new Error();
-    const command = configuredPath === "${DOCKER_PATH}" || configuredPath === "$DOCKER_PATH" ? workspace.dockerPathOption || process.env.DOCKER_PATH || "docker" : configuredPath || "docker";
-    if (config.name !== name || driver !== "docker" || command !== "docker") throw new Error();
-  } catch {
-    throw new Error("Retained exec requires a provider configured for the local Docker command.");
-  }
-  return name;
-}
-function captureDevsyExecProof(repoPath) {
-  repoPath = comparableWorkspacePath(repoPath);
-  const registry = listDevsyWorkspaces();
-  const workspace = selectDevsyWorkspace(registry, repoPath);
-  if (!workspace?.uid || !workspace.context || workspace.source.container || inspectDevsyWorkspaceOwnership(registry, workspace.id, repoPath).status !== "owned" || inspectDevsyRuntimeStatus(workspace.id) !== "running")
-    throw new Error("Retained exec requires one exact running Devsy registration.");
-  const providerName = proveLocalDockerSelection(workspace);
-  const endpoint = resolveManagedStopEndpoint();
-  if (!supportsManagedStopBaseline(endpoint))
-    throw new Error("Retained exec requires an exact local Docker endpoint.");
-  const daemon = inspectManagedStopDaemon(endpoint);
-  const candidates = workspaceAppContainers(inspectWorkspaceContainers(), repoPath).filter(
-    (container) => container.state.Running
-  );
-  if (candidates.length !== 1)
-    throw new Error("Retained exec requires one exact running primary container.");
-  const candidate = candidates[0];
-  const project = candidate.labels["com.docker.compose.project"];
-  if (!project) throw new Error("Retained exec primary has no Compose identity.");
-  const pinned = workspaceAppContainers(
-    inspectManagedStopContainers(project, endpoint),
-    repoPath
-  ).filter((container) => container.state.Running);
-  if (pinned.length !== 1 || pinned[0].id !== candidate.id)
-    throw new Error("Retained exec primary changed during inspection.");
-  const mounts = pinned[0].mounts.filter(
-    (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
-  );
-  if (mounts.length !== 1 || !mounts[0].Destination.startsWith("/"))
-    throw new Error("Retained exec requires one exact source mount.");
-  const uidBytes = Buffer.byteLength(workspace.uid);
-  const runner = uidBytes === 16 || uidBytes === 40 ? workspace.uid : workspace.id;
-  const runnerContainers = inspectProviderRunnerContainers(endpoint, runner);
-  if (runnerContainers.length !== 1 || runnerContainers[0] !== candidate.id)
-    throw new Error("Retained exec runner does not select the exact primary container.");
-  if (inspectManagedStopRunnerId(endpoint, candidate.id) !== runner || inspectManagedStopDaemon(endpoint) !== daemon)
-    throw new Error("Retained exec provider or Docker identity changed.");
-  return {
-    repoPath,
-    id: workspace.id,
-    uid: workspace.uid,
-    context: workspace.context,
-    providerName,
-    endpoint,
-    daemon,
-    containerId: candidate.id,
-    workspacePath: mounts[0].Destination
-  };
-}
-var import_node_fs34, import_node_os4, import_node_path41, import_node_util3;
-var init_devsy_exec_proof = __esm({
-  "src/core/devsy-exec-proof.ts"() {
-    "use strict";
-    import_node_fs34 = __toESM(require("fs"));
-    import_node_os4 = __toESM(require("os"));
-    import_node_path41 = __toESM(require("path"));
-    import_node_util3 = require("util");
-    init_devpod_environment();
-    init_devsy_workspaces();
-    init_workspace();
-  }
-});
-
 // src/core/reliability-model.ts
 function record4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -14794,6 +14976,7 @@ function assertReliabilityEvent(value) {
     case "launched":
     case "interrupted":
     case "not-started":
+    case "settle":
       valid = isReliabilityId(value.operationId);
       break;
     case "completion":
@@ -14863,8 +15046,13 @@ function transition(state, outcome, effects = []) {
   assertReliabilityState(state);
   return { state, effects, outcome };
 }
-function unchanged(state, outcome) {
-  return transition(cloneState(state), outcome);
+function unchanged(state, outcome, reason) {
+  const result = transition(cloneState(state), outcome);
+  if (reason) result.reason = reason;
+  return result;
+}
+function blocked2(state, reason) {
+  return unchanged(state, "blocked", reason);
 }
 function advance(value) {
   return value === Number.MAX_SAFE_INTEGER ? null : value + 1;
@@ -14889,7 +15077,10 @@ function updateRunningPhase(state) {
 }
 function handleRequest(state, event) {
   if (state.executionPolicy === "manual" && event.mode === "start")
-    return unchanged(state, "blocked");
+    return blocked2(
+      state,
+      "start requests are not admitted under manual execution policy; use the ensure/stop commands."
+    );
   const existing = state.requests.find((request) => request.key === event.key);
   if (existing) {
     const consumer = state.consumers.find((candidate) => candidate.id === existing.consumerId);
@@ -14956,7 +15147,8 @@ function handleRequest(state, event) {
 }
 function canExecAfterInterruptedEnsure(state) {
   const latestEnsure = [...state.operationHistory].reverse().find((operation) => operation.kind === "ensure");
-  return state.executionPolicy === "manual" && state.desired === "running" && latestEnsure?.status === "INTERRUPTED" && latestEnsure.drained && state.operation?.drained === true && (state.operation.kind === "ensure" && state.phase === "recovering" || state.operation.kind === "exec" && ["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status));
+  const quiescent = state.stopProof.workloadsStopped && state.stopProof.routesRemoved;
+  return state.executionPolicy === "manual" && (state.desired === "running" || quiescent && state.desired === "stopped-by-user") && latestEnsure?.status === "INTERRUPTED" && latestEnsure.drained && state.operation?.drained === true && (state.operation.kind === "ensure" && (state.phase === "recovering" || quiescent) || state.operation.kind === "exec" && ["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status));
 }
 function handleOperationRequest(state, event) {
   if (state.executionPolicy !== "manual") return unchanged(state, "blocked");
@@ -14969,25 +15161,39 @@ function handleOperationRequest(state, event) {
   if (state.operationHistory.some((entry) => entry.id === event.operationId))
     return unchanged(state, "conflict");
   if (event.kind === "exec" && canExecAfterInterruptedEnsure(state) && event.recoverInterruptedEnsure !== true)
-    return unchanged(state, "blocked");
+    return blocked2(
+      state,
+      "the latest ensure is INTERRUPTED and drained; exec requires recovering it first (run ensure, or exec with recovery proof)."
+    );
   const fullyStopped = state.stopProof.workloadsStopped && state.stopProof.routesRemoved;
   const reconcileEnsure = event.kind === "ensure" && state.operation?.kind === "ensure" && ["NOT_STARTED", "INTERRUPTED"].includes(state.operation.status);
   if (state.operation && (!state.operation.drained || !["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status) && !fullyStopped && !reconcileEnsure && !(event.kind === "exec" && event.recoverInterruptedEnsure === true && canExecAfterInterruptedEnsure(state))))
-    return unchanged(state, "blocked");
+    return blocked2(
+      state,
+      `operation ${state.operation.id} is ${state.operation.status} (drained=${state.operation.drained}) and no stop proof, ensure reconciliation, or exec recovery supersedes it.`
+    );
   if (state.phase === "stopping" || state.desired === "parked-for-capacity")
-    return unchanged(state, "blocked");
+    return blocked2(
+      state,
+      `phase is '${state.phase}' with desired '${state.desired}'; wait for the running stop to finish.`
+    );
   if (event.kind === "exec" && (!event.runtimeRunning || state.desired !== "running" && state.intentRevision !== 0))
-    return unchanged(state, "blocked");
+    return blocked2(
+      state,
+      `exec requires a running workspace (runtimeRunning=${event.runtimeRunning}, desired='${state.desired}').`
+    );
   const rollover = state.operationHistory.length >= RELIABILITY_MAX_ITEMS;
   let retired = -1;
   if (rollover) {
-    if (state.operation && (!state.operation.drained || !["COMPLETED", "NOT_LAUNCHED"].includes(state.operation.status)))
-      return unchanged(state, "blocked");
     const latestEnsureId = [...state.operationHistory].reverse().find((entry) => entry.kind === "ensure")?.id;
     retired = state.operationHistory.findIndex(
-      (entry) => entry.id !== state.operation?.id && entry.id !== latestEnsureId && entry.drained && ["COMPLETED", "NOT_LAUNCHED"].includes(entry.status)
+      (entry) => entry.id !== state.operation?.id && entry.id !== latestEnsureId && entry.drained && ["COMPLETED", "NOT_LAUNCHED", "INTERRUPTED"].includes(entry.status)
     );
-    if (retired === -1) return unchanged(state, "blocked");
+    if (retired === -1)
+      return blocked2(
+        state,
+        `journal holds ${state.operationHistory.length} entries and every retirable entry is the current operation or the latest ensure.`
+      );
   }
   if (state.desired !== "running" || rollover) {
     const revision = advance(state.intentRevision);
@@ -15042,7 +15248,10 @@ function handleDispatch(state) {
   if (state.operation?.drained || state.operation?.status !== "NOT_STARTED")
     return unchanged(state, "stale");
   if (state.desired !== "running" || state.executionPolicy === "capacity-managed" && state.admission !== "admitted" || state.consumers.length === 0) {
-    return unchanged(state, "blocked");
+    return blocked2(
+      state,
+      `dispatch requires desired 'running' with a registered consumer (desired='${state.desired}', consumers=${state.consumers.length}).`
+    );
   }
   const corrective = state.phase === "recovering" && state.incident !== null;
   state.operation = { ...state.operation, status: "DISPATCH_PENDING", exitCode: null };
@@ -15057,7 +15266,10 @@ function handleDispatchPersisted(state, event) {
   if (state.desired !== "running" || state.executionPolicy === "capacity-managed" && (state.admission !== "admitted" || !state.chargeHeld)) {
     state.operation = setUnknown(state.operation);
     state.chargeHeld = state.executionPolicy === "capacity-managed";
-    return transition(state, "blocked");
+    return blocked2(
+      state,
+      `dispatch persistence requires desired 'running' (desired='${state.desired}'); the operation outcome is unknown.`
+    );
   }
   if (state.phase === "recovering" && state.incident !== null && state.incident.correctiveActionsTaken >= state.incident.actionLimit) {
     return unchanged(state, "blocked");
@@ -15105,6 +15317,22 @@ function handleInterrupted(state, event) {
   if (state.desired === "running") state.phase = "recovering";
   return transition(state, "accepted");
 }
+function handleSettle(state, event) {
+  if (state.executionPolicy !== "manual") return unchanged(state, "stale");
+  if (!state.operation || state.operation.id !== event.operationId)
+    return unchanged(state, "stale");
+  if (state.operation.drained && state.operation.status === "INTERRUPTED")
+    return unchanged(state, "joined");
+  if (state.operation.status === "COMPLETED") return unchanged(state, "joined");
+  state.operation = {
+    ...state.operation,
+    status: "INTERRUPTED",
+    drained: true,
+    exitCode: null
+  };
+  if (state.desired === "running") state.phase = "recovering";
+  return transition(state, "accepted");
+}
 function handleObservation(state, event, nowMs) {
   if (state.desired !== "running") return unchanged(state, "stale");
   const previous = state.observations.find(
@@ -15114,7 +15342,10 @@ function handleObservation(state, event, nowMs) {
     return unchanged(state, "stale");
   }
   if (!previous && state.observations.length >= RELIABILITY_MAX_ITEMS)
-    return unchanged(state, "blocked");
+    return blocked2(
+      state,
+      `observation set holds ${state.observations.length} distinct capabilities; observations repeat per capability and never retire.`
+    );
   state.observations = state.observations.filter(
     (observation) => observation.capability !== event.observation.capability
   );
@@ -15142,7 +15373,10 @@ function handleStop(state) {
 function handleStopProof(state, event) {
   if (state.desired === "running") return unchanged(state, "stale");
   if (state.executionPolicy === "manual" && state.operation && !state.operation.drained && event.workloadsStopped && event.routesRemoved)
-    return unchanged(state, "blocked");
+    return blocked2(
+      state,
+      `stop proof cannot settle while operation ${state.operation.id} is not drained; wait for its worker or settle the journal.`
+    );
   const previous = { ...state.stopProof };
   if (previous.workloadsStopped === event.workloadsStopped && previous.routesRemoved === event.routesRemoved)
     return unchanged(state, "joined");
@@ -15321,6 +15555,8 @@ function applyReliabilityEvent(state, event, nowMs) {
       return handleCompletion(next, event);
     case "interrupted":
       return handleInterrupted(next, event);
+    case "settle":
+      return handleSettle(next, event);
     case "observation":
       return handleObservation(next, event, nowMs);
     case "stop-proof":
@@ -15481,7 +15717,9 @@ async function runLifecycleWorker(request, beforeAdmission) {
                   Date.now()
                 );
                 if (admitted.outcome !== "accepted")
-                  throw new Error(`Lifecycle admission is ${admitted.outcome}.`);
+                  throw new Error(
+                    `Lifecycle admission is ${admitted.outcome}.${admitted.reason ? ` ${admitted.reason}` : ""}`
+                  );
                 record5.state = admitted.state;
                 record5.outcome = null;
                 request.fence = reliabilityFence(record5.state);
@@ -15971,7 +16209,9 @@ async function withLifecycleOperationLock(repoPath, operation) {
 function stepRecord(record5, event) {
   const transition2 = stepReliability(record5.state, event, Date.now());
   if (!["accepted", "joined"].includes(transition2.outcome))
-    throw new Error(`Lifecycle transition is ${transition2.outcome}.`);
+    throw new Error(
+      `Lifecycle transition is ${transition2.outcome}.${transition2.reason ? ` ${transition2.reason}` : ""}`
+    );
   record5.state = transition2.state;
 }
 function reconcileDrained(record5) {
@@ -20320,6 +20560,70 @@ var init_workspace_cleanup = __esm({
   }
 });
 
+// src/core/workspace-journal-settle.ts
+async function settleWorkspaceJournal(repoPath) {
+  repoPath = comparableWorkspacePath(repoPath);
+  if (isLinkedWorktree(repoPath) && !readPersistedWorkspace(repoPath)) {
+    throw new Error("Settle requires the existing linked workspace identity.");
+  }
+  const identity2 = {
+    repoPath,
+    workspace: resolveWorktreeWorkspace(repoPath) ?? null,
+    provider: resolveWorkspaceRuntimeOrDefault(repoPath)
+  };
+  if (!readReliabilityOperation(identity2)) {
+    throw new Error(`No reliability journal exists for '${repoPath}'; nothing to settle.`);
+  }
+  const settled = await withWorkspaceLifecycleLock(
+    repoPath,
+    async () => updateReliabilityOperation(identity2, (record5) => settleRecord(record5))
+  );
+  return { repoPath, workspace: identity2.workspace, ...settled };
+}
+function settleRecord(record5) {
+  if (record5.worker) {
+    const birth = processBirthIdentity(record5.worker.pid);
+    if (birth === record5.worker.birth || !workerGroupAbsent(record5.worker.pid)) {
+      throw new Error(
+        `Lifecycle worker '${record5.worker.id}' is still running; settle is refused while its outcome is observable.`
+      );
+    }
+    reconcileDrained(record5);
+    if (record5.worker) throw new Error("Dead lifecycle worker could not be drained.");
+  }
+  const operation = record5.state.operation;
+  if (!operation) throw new Error("No lifecycle operation is recorded; nothing to settle.");
+  const priorStatus = operation.status;
+  const transition2 = stepReliability(
+    record5.state,
+    { ...reliabilityFence(record5.state), type: "settle", operationId: operation.id },
+    Date.now()
+  );
+  if (!["accepted", "joined"].includes(transition2.outcome))
+    throw new Error(
+      `Lifecycle settlement is ${transition2.outcome}.${transition2.reason ? ` ${transition2.reason}` : ""}`
+    );
+  record5.state = transition2.state;
+  return {
+    operationId: operation.id,
+    status: transition2.outcome === "joined" ? "already-settled" : "settled",
+    priorStatus
+  };
+}
+var init_workspace_journal_settle = __esm({
+  "src/core/workspace-journal-settle.ts"() {
+    "use strict";
+    init_file_lock();
+    init_reliability_contract();
+    init_reliability_lifecycle();
+    init_reliability_model();
+    init_reliability_operation_store();
+    init_reliability_worker();
+    init_workspace();
+    init_workspace_runtime();
+  }
+});
+
 // src/core/workspace-lifecycle.ts
 function withWorkspaceAllocationTransaction(repoPath, operation) {
   return withWorkspaceOwnershipTransaction(repoPath, operation, {
@@ -20723,6 +21027,7 @@ __export(workspace_exports, {
   runWorkspaceCleanupCommand: () => runWorkspaceCleanupCommand,
   runWorkspaceDownCommand: () => runWorkspaceDownCommand,
   runWorkspaceGcCommand: () => runWorkspaceGcCommand,
+  runWorkspaceJournalSettleCommand: () => runWorkspaceJournalSettleCommand,
   runWorkspaceLsCommand: () => runWorkspaceLsCommand,
   runWorkspaceStopCommand: () => runWorkspaceStopCommand,
   runWorkspaceUpCommand: () => runWorkspaceUpCommand
@@ -20812,6 +21117,26 @@ function runWorkspaceGcCommand(options) {
   }
   if (report.summary.errors > 0) process.exitCode = 1;
 }
+async function runWorkspaceJournalSettleCommand(options) {
+  const repoPath = resolveGitCheckoutPath(options.path);
+  const result = await settleWorkspaceJournal(repoPath);
+  if (options.json) {
+    printJSON(result);
+    return;
+  }
+  const workspaceLabel = result.workspace ? ` (workspace '${result.workspace}')` : "";
+  if (result.status === "already-settled") {
+    process.stdout.write(
+      `Journal operation ${result.operationId} is already settled${workspaceLabel}.
+`
+    );
+    return;
+  }
+  process.stdout.write(
+    `Settled journal operation ${result.operationId} (was ${result.priorStatus})${workspaceLabel}; ensure and stop may proceed.
+`
+  );
+}
 var init_workspace2 = __esm({
   "src/commands/workspace.ts"() {
     "use strict";
@@ -20819,8 +21144,10 @@ var init_workspace2 = __esm({
     init_repo_config();
     init_workspace_cleanup();
     init_workspace_gc();
+    init_workspace_journal_settle();
     init_workspace_lifecycle();
     init_workspace_ownership();
+    init_environment_path();
   }
 });
 
@@ -20862,7 +21189,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.65" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.67" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {
@@ -21232,6 +21559,15 @@ workspaceCommand2.command("down").description("Delete a workspace's runtime and
     await runWorkspaceDownCommand2(target, options);
   })
 );
+workspaceCommand2.command("journal settle").description(
+  "Settle an interrupted lifecycle operation as unobservable so ensure and stop can proceed"
+).argument("[path]", "Checkout path (defaults to current directory)").option("--json", "Output JSON").action(
+  withErrorHandling(async (path54, _options, command) => {
+    const options = command.opts();
+    const { runWorkspaceJournalSettleCommand: runWorkspaceJournalSettleCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));
+    await runWorkspaceJournalSettleCommand2({ ...path54 ? { path: path54 } : {}, ...options });
+  })
+);
 function parseVersionRequest(argv) {
   let requested = false;
   let repo;