@devrouter/cli 0.0.66 → 0.0.68

package/dist/devrouter-lifecycle-worker.js

@@ -24,7 +24,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 
 // src/core/devpod-exec.ts
 var import_node_child_process28 = require("child_process");
-var import_node_crypto17 = require("crypto");
+var import_node_crypto21 = require("crypto");
 
 // src/core/devpod-environment.ts
 var import_node_child_process3 = require("child_process");
@@ -141,35 +141,56 @@ function isProcessAlive(pid) {
     return error.code === "EPERM";
   }
 }
-function processBirthIdentity(pid) {
+function processBirthIdentityWithCause(pid) {
+  const causeParts = [];
   try {
     const stat = import_node_fs2.default.readFileSync(`/proc/${pid}/stat`, "utf-8");
     const commandEnd = stat.lastIndexOf(")");
     if (commandEnd >= 0) {
-      const fields = stat.slice(commandEnd + 1).trim().split(/\s+/);
-      const startTime = fields[19];
-      if (startTime) return `proc:${startTime}`;
+      const fields2 = stat.slice(commandEnd + 1).trim().split(/\s+/);
+      const startTime = fields2[19];
+      if (startTime) return { identity: `proc:${startTime}` };
+      causeParts.push(`procfs /proc/${pid}/stat had no start-time field`);
     }
-  } catch {
+  } catch (error) {
+    const code = error.code;
+    if (code !== "ENOENT")
+      causeParts.push(`procfs /proc/${pid}/stat read failed (${code ?? "unknown"})`);
   }
   const result = (0, import_node_child_process.spawnSync)("ps", ["-o", "lstart=", "-o", "command=", "-p", String(pid)], {
     encoding: "utf-8",
     env: { ...process.env, LC_ALL: "C" }
   });
-  const startedAt = result.status === 0 ? result.stdout.trim().replace(/\s+/g, " ") : "";
-  return startedAt ? `ps:${(0, import_node_crypto2.createHash)("sha256").update(startedAt).digest("hex")}` : void 0;
+  if (result.error) {
+    causeParts.push(
+      `ps spawn failed (${result.error.code ?? result.error.message})`
+    );
+  } else if (result.status !== 0) {
+    causeParts.push(
+      result.status === null && result.signal ? `ps was killed by signal ${result.signal}` : `ps exited with status ${result.status}` + (result.signal ? ` on ${result.signal}` : "")
+    );
+  } else {
+    const startedAt = result.stdout.trim().replace(/\s+/g, " ");
+    if (startedAt)
+      return { identity: `ps:${(0, import_node_crypto2.createHash)("sha256").update(startedAt).digest("hex")}` };
+    causeParts.push(`ps produced no start time for pid ${pid}`);
+  }
+  return { cause: causeParts.join("; ") };
+}
+function processBirthIdentity(pid) {
+  return processBirthIdentityWithCause(pid).identity;
 }
 function parseLockOwner(value) {
-  const fields = value.split(":");
-  const pid = Number(fields[0]);
+  const fields2 = value.split(":");
+  const pid = Number(fields2[0]);
   if (!Number.isInteger(pid) || pid <= 0) return void 0;
-  if (fields.length !== 3 || !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(fields[2])) {
+  if (fields2.length !== 3 || !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(fields2[2])) {
     return { pid };
   }
   try {
-    const processBirth = Buffer.from(fields[1], "base64url").toString("utf-8");
+    const processBirth = Buffer.from(fields2[1], "base64url").toString("utf-8");
     const canonical = Buffer.from(processBirth).toString("base64url");
-    return canonical === fields[1] && /^(proc|ps):/.test(processBirth) ? { pid, processBirth } : { pid };
+    return canonical === fields2[1] && /^(proc|ps):/.test(processBirth) ? { pid, processBirth } : { pid };
   } catch {
     return { pid };
   }
@@ -282,14 +303,15 @@ function tryReclaimStaleLock(lockPath, staleLinkPath, livenessCache) {
   }
 }
 function acquireFileLock(lockPath, options) {
-  const processBirth = processBirthIdentity(process.pid);
-  if (!processBirth) {
+  const processBirth = processBirthIdentityWithCause(process.pid);
+  const birthIdentity = processBirth.identity;
+  if (!birthIdentity) {
     throw new Error(
-      `could not determine process identity for ${options.activity} lock: process inspection may be unavailable or sandbox-denied; run the canonical command in a permitted host context`
+      `could not determine process identity for ${options.activity} lock at ${lockPath}: ${processBirth.cause ?? "process inspection returned no result"}. process inspection may be unavailable or denied by the execution sandbox; verify with LC_ALL=C ps -o lstart= -o command= -p <any-live-pid> and, if that fails with an operation-not-permitted error, run the canonical command in a permitted host context outside the sandbox. the lock stays fail-closed; no identity fallback was attempted.`
     );
   }
   const ownerId = (0, import_node_crypto2.randomUUID)();
-  const owner = `${process.pid}:${Buffer.from(processBirth).toString("base64url")}:${ownerId}`;
+  const owner = `${process.pid}:${Buffer.from(birthIdentity).toString("base64url")}:${ownerId}`;
   const candidatePath = `${lockPath}.${process.pid}.${ownerId}.candidate`;
   const staleLinkPath = `${candidatePath}.stale`;
   const enqueuedAtMs = Date.now();
@@ -811,7 +833,7 @@ function requireSameContainerPopulation(expected, actual) {
     throw new Error("Managed stop Docker inspection observed a changed population.");
   }
   const expectedSet = new Set(expected);
-  if (actual.some((id3) => !expectedSet.has(id3))) {
+  if (actual.some((id5) => !expectedSet.has(id5))) {
     throw new Error("Managed stop Docker inspection observed a changed population.");
   }
 }
@@ -849,7 +871,7 @@ function inspectWorkspaceContainers(options) {
         `docker ps failed: ${(listed.stderr || listed.stdout || listed.error?.message || "unknown error").trim()}`
       );
     }
-    ids2 = listed.stdout.split(/\r?\n/).map((id3) => id3.trim()).filter(Boolean);
+    ids2 = listed.stdout.split(/\r?\n/).map((id5) => id5.trim()).filter(Boolean);
   }
   if (ids2.length === 0) return [];
   const template = options?.withSize ? SIZE_INSPECT_TEMPLATE : SAFE_INSPECT_TEMPLATE;
@@ -1024,10 +1046,10 @@ function inspectManagedStopWorkspaceIds(endpoint, composeDirectory) {
   assertUniqueContainerIds(ids2);
   return ids2;
 }
-function hasExactManagedStopMissingObjectError(stderr, id3) {
+function hasExactManagedStopMissingObjectError(stderr, id5) {
   if (typeof stderr !== "string") return false;
   const line = stderr.endsWith("\r\n") ? stderr.slice(0, -2) : stderr.endsWith("\n") ? stderr.slice(0, -1) : stderr;
-  return line.toLowerCase() === `error: no such object: ${id3}`;
+  return line.toLowerCase() === `error: no such object: ${id5}`;
 }
 function assertManagedStopContainersAbsent(endpoint, ids2) {
   assertManagedStopEndpoint(endpoint);
@@ -1039,14 +1061,14 @@ function assertManagedStopContainersAbsent(endpoint, ids2) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  for (const id3 of ids2) {
-    const result = (0, import_node_child_process3.spawnSync)("docker", ["--host", endpoint, "inspect", "--format", "{{.Id}}", id3], {
+  for (const id5 of ids2) {
+    const result = (0, import_node_child_process3.spawnSync)("docker", ["--host", endpoint, "inspect", "--format", "{{.Id}}", id5], {
       env,
       encoding: "utf-8",
       timeout: MANAGED_STOP_DOCKER_TIMEOUT_MS,
       maxBuffer: MANAGED_STOP_DOCKER_MAX_BUFFER
     });
-    if (result.status !== 1 || result.error || result.signal || result.stdout !== "" && result.stdout !== "\n" && result.stdout !== "\r\n" || !hasExactManagedStopMissingObjectError(result.stderr, id3)) {
+    if (result.status !== 1 || result.error || result.signal || result.stdout !== "" && result.stdout !== "\n" && result.stdout !== "\r\n" || !hasExactManagedStopMissingObjectError(result.stderr, id5)) {
       throw new Error("Managed stop Docker inspection did not prove container absence.");
     }
   }
@@ -1188,6 +1210,17 @@ function inspectDevsyRuntimeStatus(devsyId) {
   if (result.status !== 0 || result.error) return "unknown";
   return parseDevsyRuntimeStatus(result.stdout, devsyId);
 }
+function inspectDevsyRuntimeAbsence(devsyId) {
+  const result = (0, import_node_child_process5.spawnSync)("devsy", ["workspace", "status", devsyId, "--result-format", "json"], {
+    encoding: "utf-8",
+    timeout: 1e4
+  });
+  if (!result.error && result.status === 0) {
+    return parseDevsyRuntimeStatus(result.stdout, devsyId) === "not-found";
+  }
+  const output = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n");
+  return /workspace not found/i.test(output);
+}
 function inspectDevsyWorkspaceOwnership(workspaces, devsyId, worktreePath) {
   const idOwners = workspaces.filter((workspace) => workspace.id === devsyId);
   const pathOwners = workspaces.filter(
@@ -1987,6 +2020,7 @@ function requireReadyDevsyAgent(options = {}) {
 // src/core/managed-devsy-stop.ts
 var import_node_os4 = __toESM(require("os"));
 var import_node_path20 = __toESM(require("path"));
+var import_node_util4 = require("util");
 
 // src/core/devcontainer-profile.ts
 var import_node_child_process10 = require("child_process");
@@ -2461,7 +2495,7 @@ function stopExactManagedService(containerId, service, options) {
 var import_node_fs10 = __toESM(require("fs"));
 var import_node_path12 = __toESM(require("path"));
 function proveManagedComposePopulation(options) {
-  const { plan, repoPath, composeProject, featureDirectory, devsyRoot, containers } = options;
+  const { plan, repoPath, composeProject, providerRoot, featureDirectory, containers } = options;
   const services = /* @__PURE__ */ new Set();
   for (const container of containers) {
     const service = container.labels["com.docker.compose.service"] ?? "";
@@ -2479,7 +2513,7 @@ function proveManagedComposePopulation(options) {
     for (const file of files.slice(plan.composeFiles.length)) {
       if (import_node_path12.default.dirname(file) !== featureDirectory || !/^docker-compose\.devcontainer\.containerFeatures-[a-zA-Z0-9_-]+\.yml$/.test(
         import_node_path12.default.basename(file)
-      ) || import_node_fs10.default.realpathSync(file) !== import_node_path12.default.join(import_node_fs10.default.realpathSync(devsyRoot), import_node_path12.default.relative(devsyRoot, file))) {
+      ) || import_node_fs10.default.realpathSync(file) !== import_node_path12.default.join(import_node_fs10.default.realpathSync(providerRoot), import_node_path12.default.relative(providerRoot, file))) {
         throw new Error("Managed stop refuses a foreign or escaped provider Compose file.");
       }
     }
@@ -3208,8 +3242,8 @@ function managedRunnerId(uid, providerId) {
   if (uid === void 0) {
     return providerId;
   }
-  const bytes = Buffer.byteLength(uid);
-  return bytes === 16 || bytes === 40 ? uid : providerId;
+  const bytes2 = Buffer.byteLength(uid);
+  return bytes2 === 16 || bytes2 === 40 ? uid : providerId;
 }
 function identityOf(value) {
   return {
@@ -3297,7 +3331,7 @@ function captureManagedStopBaseline(state, plan, primaryId, expectedEndpoint) {
     repoPath: state.repoPath,
     composeProject: state.composeProject,
     featureDirectory,
-    devsyRoot,
+    providerRoot: devsyRoot,
     containers
   });
   if (primary.id !== primaryId)
@@ -3401,7 +3435,7 @@ function proveReplacementStopAbsence(state, baseline, replacement) {
   const newRunner = managedRunnerId(before.uid, baseline.providerId);
   const runners = oldRunner === newRunner ? [oldRunner] : [oldRunner, newRunner];
   const assertEmptyPopulation = () => {
-    if (inspectManagedStopContainers(baseline.project, baseline.endpoint).length !== 0 || inspectManagedStopWorkspaceIds(baseline.endpoint, baseline.composeDirectory).length !== 0 || runners.some((id3) => inspectProviderRunnerContainers(baseline.endpoint, id3).length !== 0))
+    if (inspectManagedStopContainers(baseline.project, baseline.endpoint).length !== 0 || inspectManagedStopWorkspaceIds(baseline.endpoint, baseline.composeDirectory).length !== 0 || runners.some((id5) => inspectProviderRunnerContainers(baseline.endpoint, id5).length !== 0))
       throw new Error("Replacement stop observed a remaining workspace population.");
   };
   assertEmptyPopulation();
@@ -3484,6 +3518,7 @@ function managedStopRouteReferences(state) {
 }
 
 // src/core/repo-config.ts
+var import_node_crypto7 = require("crypto");
 var import_node_fs14 = __toESM(require("fs"));
 var import_node_path18 = __toESM(require("path"));
 var import_yaml3 = __toESM(require("yaml"));
@@ -3846,10 +3881,10 @@ function replaceHostRoutesForRepo(repoPath, inputs) {
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const replacements = inputs.map((input) => {
-      const id3 = buildHostRouteId(input.repoPath, input.name);
+      const id5 = buildHostRouteId(input.repoPath, input.name);
       return hostRouteFromInput(
         input,
-        routes.find((route) => route.id === id3),
+        routes.find((route) => route.id === id5),
         now
       );
     });
@@ -3891,6 +3926,10 @@ var VALID_HOSTNAME_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-
 var DEVROUTER_VERSION_RE = /^\d+\.\d+\.\d+$/;
 var VALID_ENV_NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/i;
 var VALID_ENV_VAR_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var MAX_CAPACITY_PROFILES = 256;
+var MAX_CAPACITY_OPERATIONS = 64;
+var MAX_CAPACITY_TRANSITIONS = 1024;
+var MAX_CAPACITY_NAME_LENGTH = 64;
 var UPSTREAM_TEMPLATE_RE = /^(?:\$\{WORKSPACE\}|[a-zA-Z0-9._-])+:\d{1,5}$/;
 function assertUpstreamSpec(upstream, label) {
   if (upstream.includes(WORKSPACE_PLACEHOLDER)) {
@@ -4446,11 +4485,265 @@ function parseManagedRuntime(value, configPath) {
     processes
   };
 }
+function parseCapacitySafeInteger(value, pathLabel, minimum) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || Object.is(value, -0)) {
+    throw new Error(`${pathLabel} must be a safe integer.`);
+  }
+  if (value < minimum) {
+    throw new Error(`${pathLabel} must be at least ${minimum}.`);
+  }
+  return value;
+}
+function parseCapacityName(value, pathLabel) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`${pathLabel} must be a non-empty string.`);
+  }
+  if (value !== value.trim()) {
+    throw new Error(`${pathLabel} must not have leading or trailing whitespace.`);
+  }
+  if (value.length > MAX_CAPACITY_NAME_LENGTH) {
+    throw new Error(
+      `${pathLabel} exceeds the maximum length of ${MAX_CAPACITY_NAME_LENGTH} characters.`
+    );
+  }
+  if ([...value].some(
+    (character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127
+  )) {
+    throw new Error(`${pathLabel} must not contain control characters.`);
+  }
+  return value;
+}
+function parseCapacityProfileKey(value, pathLabel, declaredProfiles) {
+  const key = parseCapacityName(value, pathLabel);
+  if (key === "full") return key;
+  const names = key.split(",");
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, name] of names.entries()) {
+    if (!PROFILE_NAME_RE.test(name)) {
+      throw new Error(`${pathLabel}[${index}] is not a valid profile name.`);
+    }
+    if (seen.has(name)) {
+      throw new Error(`${pathLabel} contains duplicate profile '${name}'.`);
+    }
+    if (!declaredProfiles || !Object.hasOwn(declaredProfiles, name)) {
+      throw new Error(`${pathLabel} references undefined profile '${name}'.`);
+    }
+    seen.add(name);
+  }
+  return [...names].sort().join(",");
+}
+function parseCapacityDimension(value, pathLabel, runtime) {
+  const dimension = ensureObject(value, pathLabel);
+  ensureAllowedKeys(dimension, ["steadyBytes", "startupTotalBytes"], pathLabel);
+  const minimum = runtime ? 1 : 0;
+  const steadyBytes = parseCapacitySafeInteger(
+    dimension.steadyBytes,
+    `${pathLabel}.steadyBytes`,
+    minimum
+  );
+  const startupTotalBytes = parseCapacitySafeInteger(
+    dimension.startupTotalBytes,
+    `${pathLabel}.startupTotalBytes`,
+    minimum
+  );
+  if (startupTotalBytes < steadyBytes) {
+    throw new Error(`${pathLabel}.startupTotalBytes must be at least steadyBytes.`);
+  }
+  return { steadyBytes, startupTotalBytes };
+}
+function parseCapacityOperation(value, pathLabel) {
+  const operation = ensureObject(value, pathLabel);
+  ensureAllowedKeys(operation, ["hostIncrementBytes", "runtimeIncrementBytes"], pathLabel);
+  return {
+    hostIncrementBytes: parseCapacitySafeInteger(
+      operation.hostIncrementBytes,
+      `${pathLabel}.hostIncrementBytes`,
+      0
+    ),
+    runtimeIncrementBytes: parseCapacitySafeInteger(
+      operation.runtimeIncrementBytes,
+      `${pathLabel}.runtimeIncrementBytes`,
+      0
+    )
+  };
+}
+function parseCapacityOperations(value, pathLabel) {
+  const rawOperations = ensureObject(value, pathLabel);
+  const operationEntries = Object.entries(rawOperations);
+  if (operationEntries.length === 0) {
+    throw new Error(`${pathLabel} must define at least one named operation.`);
+  }
+  if (operationEntries.length > MAX_CAPACITY_OPERATIONS) {
+    throw new Error(`${pathLabel} exceeds the maximum of ${MAX_CAPACITY_OPERATIONS} operations.`);
+  }
+  const operations = {};
+  for (const [operationName, operationValue] of operationEntries) {
+    const name = parseCapacityName(operationName, `${pathLabel} key`);
+    if (!/^[a-z][a-z0-9._-]*$/.test(name)) {
+      throw new Error(`${pathLabel}.${operationName} is not a valid operation name.`);
+    }
+    operations[name] = parseCapacityOperation(operationValue, `${pathLabel}.${operationName}`);
+  }
+  return operations;
+}
+function parseCapacityTransition(value, pathLabel) {
+  const transition2 = ensureObject(value, pathLabel);
+  ensureAllowedKeys(transition2, ["hostTotalBytes", "runtimeTotalBytes"], pathLabel);
+  return {
+    hostTotalBytes: parseCapacitySafeInteger(
+      transition2.hostTotalBytes,
+      `${pathLabel}.hostTotalBytes`,
+      0
+    ),
+    runtimeTotalBytes: parseCapacitySafeInteger(
+      transition2.runtimeTotalBytes,
+      `${pathLabel}.runtimeTotalBytes`,
+      1
+    )
+  };
+}
+function parseCapacityEstimates(value, configPath, declaredProfiles) {
+  if (value === void 0) return void 0;
+  const pathLabel = `${configPath}.capacity`;
+  const capacity = ensureObject(value, pathLabel);
+  ensureAllowedKeys(capacity, ["version", "profiles", "transitions"], pathLabel);
+  const version = parseCapacitySafeInteger(capacity.version, `${pathLabel}.version`, 1);
+  if (version !== 1) {
+    throw new Error(`${pathLabel}.version must be 1.`);
+  }
+  const rawProfiles = ensureObject(capacity.profiles, `${pathLabel}.profiles`);
+  const profileEntries = Object.entries(rawProfiles);
+  if (profileEntries.length === 0) {
+    throw new Error(`${pathLabel}.profiles must define at least one exact profile combination.`);
+  }
+  if (profileEntries.length > MAX_CAPACITY_PROFILES) {
+    throw new Error(
+      `${pathLabel}.profiles exceeds the maximum of ${MAX_CAPACITY_PROFILES} combinations.`
+    );
+  }
+  const profiles = {};
+  for (const [rawKey, profileValue] of profileEntries) {
+    const profileKey = parseCapacityProfileKey(
+      rawKey,
+      `${pathLabel}.profiles key`,
+      declaredProfiles
+    );
+    if (Object.hasOwn(profiles, profileKey)) {
+      throw new Error(
+        `${pathLabel}.profiles contains aliases for the same exact combination '${profileKey}'.`
+      );
+    }
+    const profile = ensureObject(profileValue, `${pathLabel}.profiles.${rawKey}`);
+    ensureAllowedKeys(
+      profile,
+      ["host", "runtime", "operations"],
+      `${pathLabel}.profiles.${rawKey}`
+    );
+    profiles[profileKey] = {
+      host: parseCapacityDimension(profile.host, `${pathLabel}.profiles.${rawKey}.host`, false),
+      runtime: parseCapacityDimension(
+        profile.runtime,
+        `${pathLabel}.profiles.${rawKey}.runtime`,
+        true
+      ),
+      operations: parseCapacityOperations(
+        profile.operations,
+        `${pathLabel}.profiles.${rawKey}.operations`
+      )
+    };
+  }
+  let transitions;
+  if (capacity.transitions !== void 0) {
+    const rawTransitions = ensureObject(capacity.transitions, `${pathLabel}.transitions`);
+    const transitionEntries = Object.entries(rawTransitions);
+    if (transitionEntries.length === 0) {
+      throw new Error(`${pathLabel}.transitions must define at least one transition.`);
+    }
+    transitions = {};
+    let transitionCount = 0;
+    for (const [rawSource, targetValue] of transitionEntries) {
+      const source = parseCapacityProfileKey(
+        rawSource,
+        `${pathLabel}.transitions source key`,
+        declaredProfiles
+      );
+      if (!Object.hasOwn(profiles, source)) {
+        throw new Error(
+          `${pathLabel}.transitions source '${source}' must have a profile estimate.`
+        );
+      }
+      if (Object.hasOwn(transitions, source)) {
+        throw new Error(`${pathLabel}.transitions contains aliases for source '${source}'.`);
+      }
+      const rawTargets = ensureObject(targetValue, `${pathLabel}.transitions.${rawSource}`);
+      const targetEntries = Object.entries(rawTargets);
+      if (targetEntries.length === 0) {
+        throw new Error(`${pathLabel}.transitions.${rawSource} must define a target.`);
+      }
+      const targets = {};
+      for (const [rawTarget, transitionValue] of targetEntries) {
+        transitionCount += 1;
+        if (transitionCount > MAX_CAPACITY_TRANSITIONS) {
+          throw new Error(
+            `${pathLabel}.transitions exceeds the maximum of ${MAX_CAPACITY_TRANSITIONS} entries.`
+          );
+        }
+        const target = parseCapacityProfileKey(
+          rawTarget,
+          `${pathLabel}.transitions.${rawSource} target key`,
+          declaredProfiles
+        );
+        if (!Object.hasOwn(profiles, target)) {
+          throw new Error(
+            `${pathLabel}.transitions target '${target}' must have a profile estimate.`
+          );
+        }
+        if (Object.hasOwn(targets, target)) {
+          throw new Error(
+            `${pathLabel}.transitions.${rawSource} contains aliases for '${target}'.`
+          );
+        }
+        const transition2 = parseCapacityTransition(
+          transitionValue,
+          `${pathLabel}.transitions.${rawSource}.${rawTarget}`
+        );
+        const sourceProfile = profiles[source];
+        const targetProfile = profiles[target];
+        if (transition2.hostTotalBytes < Math.max(sourceProfile.host.steadyBytes, targetProfile.host.steadyBytes)) {
+          throw new Error(
+            `${pathLabel}.transitions.${rawSource}.${rawTarget}.hostTotalBytes must cover both steady host estimates.`
+          );
+        }
+        if (transition2.runtimeTotalBytes < Math.max(sourceProfile.runtime.steadyBytes, targetProfile.runtime.steadyBytes)) {
+          throw new Error(
+            `${pathLabel}.transitions.${rawSource}.${rawTarget}.runtimeTotalBytes must cover both steady runtime estimates.`
+          );
+        }
+        targets[target] = transition2;
+      }
+      transitions[source] = targets;
+    }
+  }
+  return {
+    version: 1,
+    profiles,
+    ...transitions ? { transitions } : {}
+  };
+}
 function parseConfig(raw, configPath) {
   const root = ensureObject(raw, configPath);
   ensureAllowedKeys(
     root,
-    ["version", "devrouter", "project", "secretManager", "managedRuntime", "profiles", "apps"],
+    [
+      "version",
+      "devrouter",
+      "project",
+      "secretManager",
+      "managedRuntime",
+      "profiles",
+      "capacity",
+      "apps"
+    ],
     configPath
   );
   const version = toIntegerOrThrow(root.version, `${configPath}.version`);
@@ -4522,6 +4815,7 @@ function parseConfig(raw, configPath) {
   }
   const managedRuntime = parseManagedRuntime(root.managedRuntime, configPath);
   const profiles = parseProfiles(root.profiles, configPath, apps, managedRuntime);
+  const capacity = parseCapacityEstimates(root.capacity, configPath, profiles);
   return {
     version: 1,
     ...devrouter ? { devrouter } : {},
@@ -4529,6 +4823,7 @@ function parseConfig(raw, configPath) {
     ...secretManager ? { secretManager } : {},
     ...managedRuntime ? { managedRuntime } : {},
     ...profiles ? { profiles } : {},
+    ...capacity ? { capacity } : {},
     apps
   };
 }
@@ -4863,7 +5158,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs14.default.rea
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.66" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.68" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -5042,7 +5337,7 @@ async function ensureNetwork(name) {
 
 // src/core/tls.ts
 var import_node_child_process13 = require("child_process");
-var import_node_crypto7 = require("crypto");
+var import_node_crypto8 = require("crypto");
 var import_node_fs15 = __toESM(require("fs"));
 var import_node_path19 = __toESM(require("path"));
 var DEFAULT_TLS_CERT_HOSTS = ["localhost", "*.localhost"];
@@ -5112,7 +5407,7 @@ function parseDnsHostsFromSubjectAltName(subjectAltName) {
   return normalizeUniqueHosts(names);
 }
 function parseCertificateDnsHosts(pem) {
-  const certificate = new import_node_crypto7.X509Certificate(pem);
+  const certificate = new import_node_crypto8.X509Certificate(pem);
   const subjectAltName = certificate.subjectAltName ?? "";
   if (subjectAltName.length === 0) {
     return [];
@@ -5418,6 +5713,66 @@ function stopRetainedManagedDevsyWorkspace(options) {
     }
     return owner.workspace;
   }
+  function registrationStatus() {
+    resetWorkspaceRuntimeCaches();
+    if (resolveWorkspaceRuntimeOrDefault(repoPath) !== "devsy") {
+      throw new Error("Managed stop provider selection changed.");
+    }
+    return inspectDevsyWorkspaceOwnership(listDevsyWorkspaces(), devsyId, repoPath);
+  }
+  function proveAbsentRegistrationStop() {
+    const observe = () => {
+      const owner = registrationStatus();
+      if (owner.status === "conflict") throw new Error(owner.reason);
+      if (owner.status !== "absent") {
+        throw new Error("Managed stop absence proof requires the registration to remain absent.");
+      }
+      if (listDevpodWorkspacesRaw({ allowMissingExecutable: true }).some(
+        (entry) => entry.id === devsyId || sameWorkspacePath(entry.source.localFolder, repoPath)
+      )) {
+        throw new Error(
+          "Managed stop absence proof requires both provider registrations to remain absent."
+        );
+      }
+      if (!inspectDevsyRuntimeAbsence(devsyId)) {
+        throw new Error(
+          "Managed stop absence proof requires Devsy to report the runtime not-found."
+        );
+      }
+      if (inspectManagedStopContainers(state.composeProject).length !== 0) {
+        throw new Error("Managed stop absence proof observed a remaining compose population.");
+      }
+      if (inspectProviderRunnerContainers(resolveManagedStopEndpoint(), devsyId).length !== 0) {
+        throw new Error("Managed stop absence proof observed a remaining runner population.");
+      }
+      const owned = inspectWorkspaceContainers().filter(
+        (container) => sameWorkspacePath(
+          container.labels["com.docker.compose.project.working_dir"] ?? "",
+          import_node_path20.default.join(repoPath, ".devcontainer")
+        )
+      );
+      if (owned.length !== 0) {
+        throw new Error("Managed stop absence proof observed a remaining workspace container.");
+      }
+      if (workspace) {
+        const record5 = readWorkspaceOwnership(repoPath, workspace);
+        if (!record5 || record5.devpodId !== devsyId || !sameWorkspacePath(record5.worktreePath, repoPath) || resolveWorktreeWorkspace(repoPath) !== workspace || resolveGitCommonDir(repoPath) !== workspaceEnv?.gitCommonDir || inspectWorkspaceOwnership(record5, listGitWorktrees(repoPath), void 0).ownerStatus !== "present") {
+          throw new Error("Managed stop workspace ownership changed during absence proof.");
+        }
+      }
+      if (!(0, import_node_util4.isDeepStrictEqual)(readManagedRuntimeState(repoPath, workspace), state)) {
+        throw new Error("Managed stop retained state changed during absence proof.");
+      }
+    };
+    observe();
+    observe();
+  }
+  const initialOwner = registrationStatus();
+  if (initialOwner.status === "conflict") throw new Error(initialOwner.reason);
+  if (initialOwner.status === "absent") {
+    proveAbsentRegistrationStop();
+    return "proven-absent";
+  }
   const context = registration2().context;
   if (!context || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(context) || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(devsyId)) {
     throw new Error("Managed stop requires a valid exact Devsy context and workspace ID.");
@@ -5461,7 +5816,7 @@ function stopRetainedManagedDevsyWorkspace(options) {
       repoPath,
       composeProject: state.composeProject,
       featureDirectory,
-      devsyRoot,
+      providerRoot: devsyRoot,
       containers
     });
     if (previous && (!sameSet(
@@ -5561,12 +5916,12 @@ function networkProviderEnvironment(binding, source) {
 }
 
 // src/core/network-claim-lookup.ts
-var import_node_crypto9 = require("crypto");
+var import_node_crypto10 = require("crypto");
 var import_node_fs18 = __toESM(require("fs"));
 var import_node_path23 = __toESM(require("path"));
 
 // src/core/network-claims.ts
-var import_node_crypto8 = require("crypto");
+var import_node_crypto9 = require("crypto");
 var import_node_fs17 = __toESM(require("fs"));
 var import_node_path22 = __toESM(require("path"));
 
@@ -6756,7 +7111,7 @@ function assertDirectory(directory) {
   }
 }
 function hashKey(value) {
-  return (0, import_node_crypto8.createHash)("sha256").update(value).digest("hex");
+  return (0, import_node_crypto9.createHash)("sha256").update(value).digest("hex");
 }
 function cloneFence(fence) {
   return { ...fence };
@@ -6784,7 +7139,7 @@ function claimError(code, message) {
 function networkOwnerKey(repoPath) {
   if (!import_node_path23.default.isAbsolute(repoPath) || import_node_path23.default.resolve(repoPath) !== repoPath)
     throw new Error("Invalid network owner path.");
-  return (0, import_node_crypto9.createHash)("sha256").update(repoPath).digest("hex");
+  return (0, import_node_crypto10.createHash)("sha256").update(repoPath).digest("hex");
 }
 function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   let names;
@@ -6809,22 +7164,22 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
     );
     try {
       if (!import_node_fs18.default.fstatSync(descriptor).isFile()) throw new Error();
-      const bytes = Buffer.alloc(NETWORK_CLAIMS_MAX_FILE_BYTES + 1);
+      const bytes2 = Buffer.alloc(NETWORK_CLAIMS_MAX_FILE_BYTES + 1);
       let size = 0;
-      while (size < bytes.length) {
-        const count = import_node_fs18.default.readSync(descriptor, bytes, size, bytes.length - size, null);
+      while (size < bytes2.length) {
+        const count = import_node_fs18.default.readSync(descriptor, bytes2, size, bytes2.length - size, null);
         if (!count) break;
         size += count;
       }
       if (size > NETWORK_CLAIMS_MAX_FILE_BYTES) throw new Error();
-      value = JSON.parse(bytes.subarray(0, size).toString("utf8"));
+      value = JSON.parse(bytes2.subarray(0, size).toString("utf8"));
       if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error();
     } catch {
       throw new Error("Retained network claim could not be read safely.");
     } finally {
       import_node_fs18.default.closeSync(descriptor);
     }
-    if (typeof value.daemonId !== "string" || `${(0, import_node_crypto9.createHash)("sha256").update(value.daemonId).digest("hex")}.json` !== file)
+    if (typeof value.daemonId !== "string" || `${(0, import_node_crypto10.createHash)("sha256").update(value.daemonId).digest("hex")}.json` !== file)
       throw new Error("Retained network daemon identity is invalid.");
     const claim2 = readNetworkClaim({
       daemonId: value.daemonId,
@@ -6841,7 +7196,7 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
 
 // src/core/network-provider-inspect.ts
 var import_node_child_process14 = require("child_process");
-var import_node_crypto10 = require("crypto");
+var import_node_crypto11 = require("crypto");
 function object(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("Invalid provider evidence.");
@@ -6861,7 +7216,7 @@ function qualifyNetworkProviderDefinition(value, provider) {
   if (definition.name !== "docker" || ![true, "true"].includes(agent.local) || agent.driver !== void 0 && agent.driver !== "docker" && agent.driver !== "" || docker.path !== "${DOCKER_PATH}" || docker.builder !== "${DOCKER_BUILDER}" || ![false, "false"].includes(docker.install) || (provider === "devsy" ? docker.elevation !== "${DOCKER_ELEVATION}" : docker.elevation !== void 0 && docker.elevation !== "") || env.DOCKER_HOST !== "${DOCKER_HOST}" || Object.keys(env).some((key) => key !== "DOCKER_HOST") || host.global !== true || dockerPath.default !== "docker" || actualCommand.length !== 1 || typeof actualCommand[0] !== "string" || actualCommand[0].trim() !== command || Object.keys(exec).some((key) => key !== "command") || agent.path !== void 0 && agent.path !== "" || agent.downloadURL !== void 0 && agent.downloadURL !== "") {
     throw new Error("Docker provider definition is not qualified for network allocation.");
   }
-  return (0, import_node_crypto10.createHash)("sha256").update(JSON.stringify({ name: definition.name, agent, options, exec })).digest("hex");
+  return (0, import_node_crypto11.createHash)("sha256").update(JSON.stringify({ name: definition.name, agent, options, exec })).digest("hex");
 }
 function read(provider, args) {
   const result = (0, import_node_child_process14.spawnSync)(provider, args, {
@@ -6923,9 +7278,9 @@ function inspectNetworkProviderBinding(input) {
     const option = (key, localOnly = false) => {
       const value = localOnly ? stored[key] : stored[key] ?? settings[key];
       if (value === void 0) return null;
-      const text3 = object(value).value;
-      if (typeof text3 !== "string") throw new Error();
-      return text3 || null;
+      const text4 = object(value).value;
+      if (typeof text4 !== "string") throw new Error();
+      return text4 || null;
     };
     if (workspaceProvider && workspaceProvider.name !== "docker") throw new Error();
     if (option("DOCKER_ELEVATION") && option("DOCKER_ELEVATION") !== "none") throw new Error();
@@ -7125,12 +7480,12 @@ function deleteOwnedDevsyWorkspace(devsyId, worktreePath) {
 function assertDevsyTarget(devsyId, repoPath) {
   const workspaces = listDevsyWorkspaces();
   const existing = selectDevsyWorkspace(workspaces, repoPath);
-  const id3 = devsyId ?? existing?.id;
-  if (id3) {
-    const before = inspectDevsyWorkspaceOwnership(workspaces, id3, repoPath);
+  const id5 = devsyId ?? existing?.id;
+  if (id5) {
+    const before = inspectDevsyWorkspaceOwnership(workspaces, id5, repoPath);
     if (before.status === "conflict") throw new Error(before.reason);
   }
-  return id3;
+  return id5;
 }
 async function startDevsyWorkspace(options) {
   const activity = options.recreate ? "Devsy recreate" : "Devsy start";
@@ -7242,7 +7597,572 @@ var ExecutionOutcomeError = class extends Error {
 };
 
 // src/core/reliability-lifecycle.ts
-var import_node_path33 = __toESM(require("path"));
+var import_node_crypto20 = require("crypto");
+var import_node_path38 = __toESM(require("path"));
+var import_node_util6 = require("util");
+
+// src/core/capacity-accounting.ts
+function bytes(value) {
+  return Number.isSafeInteger(value) && value >= 0;
+}
+function evaluateCapacity(budgets, samples, charges, requested, nowMs, maxSampleAgeMs, pools = []) {
+  if (!bytes(nowMs) || !bytes(maxSampleAgeMs)) throw new Error("Invalid capacity sample clock.");
+  for (const domain of Object.keys(requested.totals).sort()) {
+    const fail2 = (reason2) => ({ admitted: false, domain, reason: reason2 });
+    const budget = budgets[domain];
+    const sample = samples[domain];
+    if (!budget || !sample || !bytes(budget.capacityBytes) || !bytes(budget.protectedHeadroomBytes) || budget.protectedHeadroomBytes >= budget.capacityBytes || !Number.isSafeInteger(budget.startupSlots) || budget.startupSlots < 1 || !Number.isSafeInteger(budget.heavySlots) || budget.heavySlots < 1 || !bytes(sample.unmanagedBytes) || !bytes(sample.sharedBytes) || !bytes(sample.sampledAtMs) || Object.values(sample.ownedBytes).some((value) => !bytes(value)) || !bytes(requested.totals[domain]))
+      return fail2("unknown");
+    if (sample.sampledAtMs > nowMs || nowMs - sample.sampledAtMs > maxSampleAgeMs)
+      return fail2("stale");
+    if (sample.pressure !== "normal")
+      return fail2(sample.pressure === "pressured" ? "pressure" : "unknown");
+    const totals = /* @__PURE__ */ new Map();
+    let startups = 0;
+    let heavy = 0;
+    for (const charge of charges) {
+      if (!Object.hasOwn(charge.totals, domain)) continue;
+      if (!bytes(charge.totals[domain]) || totals.has(charge.environmentId)) return fail2("unknown");
+      totals.set(charge.environmentId, charge.totals[domain]);
+      if (charge.environmentId !== requested.environmentId) {
+        if (charge.startup) startups++;
+        if (charge.heavy) heavy++;
+      }
+    }
+    totals.set(
+      requested.environmentId,
+      Math.max(totals.get(requested.environmentId) ?? 0, requested.totals[domain])
+    );
+    for (const [environment, observed] of Object.entries(sample.ownedBytes))
+      totals.set(environment, Math.max(totals.get(environment) ?? 0, observed));
+    let used = BigInt(sample.unmanagedBytes) + BigInt(sample.sharedBytes);
+    for (const total of totals.values()) used += BigInt(total);
+    for (const pool of pools) {
+      if (pool.hostDomain !== domain) continue;
+      if (!bytes(pool.hostChargeCeilingBytes)) return fail2("unknown");
+      used += BigInt(pool.hostChargeCeilingBytes);
+    }
+    if (used > BigInt(budget.capacityBytes) - BigInt(budget.protectedHeadroomBytes))
+      return fail2("memory");
+    const existing = charges.find((charge) => charge.environmentId === requested.environmentId);
+    if ((requested.startup || existing?.startup) && startups >= budget.startupSlots)
+      return fail2("startup-slot");
+    if ((requested.heavy || existing?.heavy) && heavy >= budget.heavySlots)
+      return fail2("heavy-slot");
+  }
+  if (Object.keys(requested.totals).length === 0)
+    throw new Error("Capacity request has no domains.");
+  return { admitted: true };
+}
+
+// src/core/capacity-policy.ts
+var import_node_fs20 = __toESM(require("fs"));
+var import_node_path25 = __toESM(require("path"));
+
+// src/core/capacity-store.ts
+var import_node_fs21 = __toESM(require("fs"));
+var import_node_path26 = __toESM(require("path"));
+var MAX_BYTES = 1048576;
+var CapacitySnapshotChangedError = class extends Error {
+  constructor() {
+    super("Capacity snapshot changed.");
+    this.name = "CapacitySnapshotChangedError";
+  }
+};
+function assertPrivateDirectory(directoryPath) {
+  import_node_fs21.default.mkdirSync(directoryPath, { recursive: true, mode: 448 });
+  const directory = import_node_fs21.default.lstatSync(directoryPath);
+  if (!directory.isDirectory() || directory.isSymbolicLink() || directory.uid !== process.getuid?.() || (directory.mode & 63) !== 0)
+    throw new Error("Capacity reservation directory is not private.");
+}
+function object2(value, fields2) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).length !== fields2.length || Object.keys(value).some((key) => !fields2.includes(key)))
+    throw new Error("Invalid capacity reservation fields.");
+}
+function id2(value) {
+  return typeof value === "string" && /^[a-zA-Z0-9_-]{1,128}$/.test(value);
+}
+function validatePools(value) {
+  if (!Array.isArray(value) || value.length > 256) throw new Error("Invalid capacity pools.");
+  const daemons = /* @__PURE__ */ new Set();
+  const runtimes = /* @__PURE__ */ new Set();
+  for (const pool of value) {
+    object2(pool, ["daemonId", "runtimeDomain", "hostDomain", "hostChargeCeilingBytes"]);
+    if (typeof pool.daemonId !== "string" || pool.daemonId.length === 0 || pool.daemonId.length > 256 || pool.daemonId !== pool.daemonId.trim() || [...pool.daemonId].some(
+      (character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127
+    ) || !id2(pool.runtimeDomain) || !id2(pool.hostDomain) || pool.runtimeDomain === pool.hostDomain || !Number.isSafeInteger(pool.hostChargeCeilingBytes) || Number(pool.hostChargeCeilingBytes) <= 0 || daemons.has(pool.daemonId) || runtimes.has(pool.runtimeDomain))
+      throw new Error("Invalid capacity pool identity or ceiling.");
+    daemons.add(pool.daemonId);
+    runtimes.add(pool.runtimeDomain);
+  }
+}
+function validate(value) {
+  const hasPools = !!value && typeof value === "object" && Object.hasOwn(value, "pools");
+  object2(value, ["version", "revision", "reservations", ...hasPools ? ["pools"] : []]);
+  if (hasPools) validatePools(value.pools);
+  if (value.version !== 1 || !Number.isSafeInteger(value.revision) || Number(value.revision) < 0 || !Array.isArray(value.reservations) || value.reservations.length > 256)
+    throw new Error("Invalid capacity reservation snapshot.");
+  const environments = /* @__PURE__ */ new Set();
+  const operations = /* @__PURE__ */ new Set();
+  const reservations = /* @__PURE__ */ new Set();
+  for (const reservation of value.reservations) {
+    object2(reservation, [
+      "environmentId",
+      "operationId",
+      "reservationId",
+      "policyRevision",
+      "totals",
+      "startup",
+      "heavy"
+    ]);
+    if (!id2(reservation.environmentId) || !id2(reservation.operationId) || !id2(reservation.reservationId) || !Number.isSafeInteger(reservation.policyRevision) || Number(reservation.policyRevision) < 1 || typeof reservation.startup !== "boolean" || typeof reservation.heavy !== "boolean" || environments.has(reservation.environmentId) || operations.has(reservation.operationId) || reservations.has(reservation.reservationId))
+      throw new Error("Invalid capacity reservation identity.");
+    environments.add(reservation.environmentId);
+    operations.add(reservation.operationId);
+    reservations.add(reservation.reservationId);
+    const totals = reservation.totals;
+    if (!totals || typeof totals !== "object" || Array.isArray(totals) || Object.keys(totals).length < 1 || Object.keys(totals).length > 256 || Object.entries(totals).some(
+      ([key, bytes2]) => !id2(key) || !Number.isSafeInteger(bytes2) || Number(bytes2) < 0
+    ))
+      throw new Error("Invalid capacity reservation totals.");
+  }
+}
+function mergePools(pools, incoming) {
+  let changed = false;
+  for (const requested of incoming) {
+    const retained = pools.find((pool) => pool.daemonId === requested.daemonId);
+    if (retained) {
+      if (retained.hostDomain !== requested.hostDomain || retained.runtimeDomain !== requested.runtimeDomain)
+        throw new Error("Capacity pool binding changed.");
+      if (requested.hostChargeCeilingBytes > retained.hostChargeCeilingBytes) {
+        retained.hostChargeCeilingBytes = requested.hostChargeCeilingBytes;
+        changed = true;
+      }
+    } else {
+      pools.push(structuredClone(requested));
+      changed = true;
+    }
+  }
+  validatePools(pools);
+  return changed;
+}
+function serializeSnapshot(snapshot) {
+  const contents = `${JSON.stringify(snapshot)}
+`;
+  if (Buffer.byteLength(contents) > MAX_BYTES)
+    throw new Error("Capacity reservation snapshot exceeds byte limit.");
+  return contents;
+}
+var CapacityStore = class {
+  constructor(directory) {
+    this.directory = directory;
+    this.file = import_node_path26.default.join(directory, "capacity-reservations.json");
+  }
+  file;
+  read() {
+    let descriptor;
+    try {
+      descriptor = import_node_fs21.default.openSync(this.file, import_node_fs21.default.constants.O_RDONLY | import_node_fs21.default.constants.O_NOFOLLOW);
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return { version: 1, revision: 0, reservations: [] };
+      throw error;
+    }
+    try {
+      const stat = import_node_fs21.default.fstatSync(descriptor);
+      if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0 || stat.size > MAX_BYTES)
+        throw new Error("Unsafe capacity reservation snapshot.");
+      const buffer = Buffer.alloc(MAX_BYTES + 1);
+      const count = import_node_fs21.default.readSync(descriptor, buffer, 0, buffer.length, 0);
+      if (count > MAX_BYTES) throw new Error("Capacity reservation snapshot exceeds byte limit.");
+      const value = JSON.parse(buffer.subarray(0, count).toString("utf8"));
+      validate(value);
+      return value;
+    } finally {
+      import_node_fs21.default.closeSync(descriptor);
+    }
+  }
+  /**
+   * Caller must revoke journal authority and prove exact physical cessation first.
+   * An absent reservation still advances the revision to fence that proof.
+   */
+  settleEnvironmentAfterStop(environmentId, expectedRevision) {
+    if (!id2(environmentId)) throw new Error("Invalid capacity environment ID.");
+    if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 0)
+      throw new Error("Invalid capacity settlement revision.");
+    assertPrivateDirectory(this.directory);
+    return withFileLockSync(
+      `${this.file}.lock`,
+      { activity: "capacity settlement", waitMs: 100 },
+      () => {
+        const snapshot = this.read();
+        if (snapshot.revision !== expectedRevision) throw new CapacitySnapshotChangedError();
+        if (snapshot.revision === Number.MAX_SAFE_INTEGER)
+          throw new Error("Capacity reservation revision exhausted.");
+        const index = snapshot.reservations.findIndex(
+          (entry) => entry.environmentId === environmentId
+        );
+        if (index >= 0) snapshot.reservations.splice(index, 1);
+        snapshot.revision++;
+        validate(snapshot);
+        writeFileAtomically(this.file, serializeSnapshot(snapshot));
+        return { settled: index >= 0, revision: snapshot.revision };
+      }
+    );
+  }
+  /** Retain positively observed pools even when their charge already exceeds admission budgets. */
+  mergeObservedPools(pools, expectedRevision) {
+    validatePools(pools);
+    if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 0)
+      throw new Error("Invalid capacity expected revision.");
+    assertPrivateDirectory(this.directory);
+    return withFileLockSync(
+      `${this.file}.lock`,
+      { activity: "capacity pool observation", waitMs: 100 },
+      () => {
+        const snapshot = this.read();
+        if (snapshot.revision !== expectedRevision) throw new CapacitySnapshotChangedError();
+        const merged = structuredClone(snapshot.pools ?? []);
+        if (!mergePools(merged, pools)) return { changed: false, revision: snapshot.revision };
+        if (snapshot.revision === Number.MAX_SAFE_INTEGER)
+          throw new Error("Capacity reservation revision exhausted.");
+        snapshot.pools = merged;
+        snapshot.revision++;
+        validate(snapshot);
+        writeFileAtomically(this.file, serializeSnapshot(snapshot));
+        return { changed: true, revision: snapshot.revision };
+      }
+    );
+  }
+  /**
+   * Caller must revoke pool launch authority and prove exact VM cessation first.
+   * Container or environment cessation alone never permits releasing this ceiling.
+   */
+  settlePoolAfterCessation(identity2, expectedRevision) {
+    object2(identity2, ["daemonId", "runtimeDomain", "hostDomain"]);
+    validatePools([{ ...identity2, hostChargeCeilingBytes: 1 }]);
+    if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 0)
+      throw new Error("Invalid capacity settlement revision.");
+    assertPrivateDirectory(this.directory);
+    return withFileLockSync(
+      `${this.file}.lock`,
+      { activity: "capacity pool settlement", waitMs: 100 },
+      () => {
+        const snapshot = this.read();
+        if (snapshot.revision !== expectedRevision) throw new CapacitySnapshotChangedError();
+        const pools = snapshot.pools ?? [];
+        const index = pools.findIndex((pool2) => pool2.daemonId === identity2.daemonId);
+        const pool = pools[index];
+        if (pool && (pool.hostDomain !== identity2.hostDomain || pool.runtimeDomain !== identity2.runtimeDomain) || pools.some(
+          (entry) => entry.runtimeDomain === identity2.runtimeDomain && entry.daemonId !== identity2.daemonId
+        ) || snapshot.reservations.some((entry) => Object.hasOwn(entry.totals, identity2.runtimeDomain)))
+          throw new Error("Capacity pool cessation identity remains bound.");
+        if (snapshot.revision === Number.MAX_SAFE_INTEGER)
+          throw new Error("Capacity reservation revision exhausted.");
+        if (pool) pools.splice(index, 1);
+        snapshot.revision++;
+        validate(snapshot);
+        writeFileAtomically(this.file, serializeSnapshot(snapshot));
+        return { settled: !!pool, revision: snapshot.revision };
+      }
+    );
+  }
+  /** Caller persists phase proof and revokes authority before reducing this exact row. */
+  reduceAfterPhase(target, expectedRevision) {
+    validate({ version: 1, revision: 0, reservations: [target] });
+    if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 0)
+      throw new Error("Invalid capacity settlement revision.");
+    assertPrivateDirectory(this.directory);
+    withFileLockSync(
+      `${this.file}.lock`,
+      { activity: "capacity phase settlement", waitMs: 100 },
+      () => {
+        const snapshot = this.read();
+        if (snapshot.revision !== expectedRevision) throw new CapacitySnapshotChangedError();
+        const index = snapshot.reservations.findIndex(
+          (entry) => entry.environmentId === target.environmentId
+        );
+        const current = snapshot.reservations[index];
+        if (!current || current.reservationId !== target.reservationId || current.operationId !== target.operationId || current.policyRevision !== target.policyRevision)
+          throw new Error("Capacity phase settlement predecessor changed.");
+        if (Object.keys(current.totals).length !== Object.keys(target.totals).length || Object.entries(target.totals).some(
+          ([domain, bytes2]) => !Object.hasOwn(current.totals, domain) || bytes2 > current.totals[domain]
+        ) || target.startup && !current.startup || target.heavy && !current.heavy)
+          throw new Error("Capacity phase settlement cannot acquire resources.");
+        if (snapshot.revision === Number.MAX_SAFE_INTEGER)
+          throw new Error("Capacity reservation revision exhausted.");
+        snapshot.reservations[index] = structuredClone(target);
+        snapshot.revision++;
+        validate(snapshot);
+        writeFileAtomically(this.file, serializeSnapshot(snapshot));
+      }
+    );
+  }
+  reserve(request, budgets, samples, nowMs, maxSampleAgeMs, previous, expectedRevision, requestedPool) {
+    validate({ version: 1, revision: 0, reservations: [request] });
+    if (requestedPool !== void 0) {
+      validatePools([requestedPool]);
+      if (!Object.hasOwn(request.totals, requestedPool.hostDomain) || !Object.hasOwn(request.totals, requestedPool.runtimeDomain))
+        throw new Error("Capacity pool request lacks its bound domains.");
+    }
+    if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 0)
+      throw new Error("Invalid capacity expected revision.");
+    assertPrivateDirectory(this.directory);
+    return withFileLockSync(
+      `${this.file}.lock`,
+      { activity: "capacity reservation", waitMs: 100 },
+      () => {
+        const snapshot = this.read();
+        if (snapshot.revision !== expectedRevision) throw new CapacitySnapshotChangedError();
+        const pools = structuredClone(snapshot.pools ?? []);
+        const poolChanged = mergePools(pools, requestedPool === void 0 ? [] : [requestedPool]);
+        const existing = snapshot.reservations.find(
+          (entry) => entry.environmentId === request.environmentId
+        );
+        if (previous) {
+          if (snapshot.revision !== previous.revision || !existing || existing.reservationId !== previous.reservationId || existing.operationId !== previous.operationId || existing.policyRevision !== request.policyRevision)
+            throw new Error("Capacity expansion predecessor changed.");
+          const totals = { ...existing.totals };
+          for (const [domain, bytes2] of Object.entries(request.totals))
+            totals[domain] = Math.max(totals[domain] ?? 0, bytes2);
+          request = {
+            ...request,
+            totals,
+            startup: existing.startup || request.startup,
+            heavy: existing.heavy || request.heavy
+          };
+        } else if (existing) {
+          if (existing.reservationId !== request.reservationId || existing.operationId !== request.operationId || existing.policyRevision !== request.policyRevision || existing.startup !== request.startup || existing.heavy !== request.heavy || Object.keys(existing.totals).length !== Object.keys(request.totals).length || Object.entries(existing.totals).some(
+            ([domain, bytes2]) => request.totals[domain] !== bytes2
+          ))
+            throw new Error("Environment retains an earlier capacity reservation.");
+        }
+        const decision = evaluateCapacity(
+          budgets,
+          samples,
+          snapshot.reservations,
+          request,
+          nowMs,
+          maxSampleAgeMs,
+          pools
+        );
+        if (!decision.admitted) return decision;
+        if (!previous && existing && !poolChanged)
+          return { admitted: true, revision: snapshot.revision, joined: true };
+        if (snapshot.revision === Number.MAX_SAFE_INTEGER)
+          throw new Error("Capacity reservation revision exhausted.");
+        snapshot.revision++;
+        if (poolChanged) snapshot.pools = pools;
+        if (existing)
+          snapshot.reservations[snapshot.reservations.indexOf(existing)] = structuredClone(request);
+        else snapshot.reservations.push(structuredClone(request));
+        validate(snapshot);
+        writeFileAtomically(this.file, serializeSnapshot(snapshot));
+        return { admitted: true, revision: snapshot.revision, joined: false };
+      }
+    );
+  }
+};
+
+// src/core/controller-client.ts
+var import_node_crypto12 = require("crypto");
+var import_node_fs22 = __toESM(require("fs"));
+var import_node_net2 = __toESM(require("net"));
+var import_node_path28 = __toESM(require("path"));
+
+// src/core/controller-protocol.ts
+var import_node_path27 = __toESM(require("path"));
+var CONTROLLER_FRAME_BYTES = 64 * 1024;
+var CONTROLLER_MAX_OPERATION_REQUEST_BYTES = 32 * 1024;
+var CONTROLLER_PROFILE_TOKEN_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var CONTROLLER_PROFILE_RE = new RegExp(
+  `^(?:${CONTROLLER_PROFILE_TOKEN_RE.source.slice(1, -1)})(?:,(?:${CONTROLLER_PROFILE_TOKEN_RE.source.slice(1, -1)}))*$`
+);
+
+// src/core/controller-store.ts
+var import_node_crypto13 = require("crypto");
+var import_node_fs23 = __toESM(require("fs"));
+var import_node_path29 = __toESM(require("path"));
+var CONTROLLER_SNAPSHOT_BYTES = 1048576;
+function fail() {
+  throw new Error("Invalid controller snapshot.");
+}
+function fields(value, expected) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) fail();
+  const actual = Object.keys(value);
+  if (actual.length !== expected.length || actual.some((key) => !expected.includes(key))) fail();
+}
+function text2(value, max = 256) {
+  return typeof value === "string" && value.length > 0 && value.length <= max && ![...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);
+}
+function id3(value) {
+  return text2(value, 128) && /^[a-zA-Z0-9_-]+$/.test(value);
+}
+function counter(value) {
+  return Number.isSafeInteger(value) && Number(value) >= 0;
+}
+function validateControllerSnapshot(value) {
+  fields(value, [
+    "version",
+    "store",
+    "epoch",
+    "revision",
+    "nextSequence",
+    "environments",
+    "sessions",
+    "events"
+  ]);
+  if (value.version !== 1 || !id3(value.store) || !counter(value.epoch) || !counter(value.revision) || !counter(value.nextSequence) || value.nextSequence < 1 || !Array.isArray(value.environments) || value.environments.length > 32 || !Array.isArray(value.sessions) || value.sessions.length > 128 || !Array.isArray(value.events) || value.events.length > 256)
+    fail();
+  const environments = /* @__PURE__ */ new Set();
+  const checkouts = /* @__PURE__ */ new Set();
+  for (const env of value.environments) {
+    fields(env, [
+      "id",
+      "repoPath",
+      "workspace",
+      "provider",
+      "providerId",
+      "profile",
+      "fingerprint"
+    ]);
+    if (!id3(env.id) || environments.has(env.id) || !text2(env.repoPath, 4096) || !import_node_path29.default.isAbsolute(env.repoPath) || import_node_path29.default.resolve(env.repoPath) !== env.repoPath || checkouts.has(env.repoPath) || !id3(env.workspace) || !id3(env.providerId) || !text2(env.profile) || !/^[a-z0-9-]+(?:,[a-z0-9-]+)*$/.test(env.profile) || !text2(env.fingerprint, 128) || !/^[a-f0-9]{64}$/.test(env.fingerprint) || !["devpod", "devsy"].includes(String(env.provider)))
+      fail();
+    environments.add(env.id);
+    checkouts.add(env.repoPath);
+  }
+  const sessions = /* @__PURE__ */ new Set();
+  const usedEnvironments = /* @__PURE__ */ new Set();
+  for (const session of value.sessions) {
+    fields(session, [
+      "id",
+      "environmentId",
+      "generation",
+      "requirements",
+      "renewedAtMs",
+      ...Object.hasOwn(session, "observation") ? ["observation"] : []
+    ]);
+    if (!id3(session.id) || sessions.has(session.id) || !id3(session.environmentId) || !environments.has(session.environmentId) || !id3(session.generation) || !counter(session.renewedAtMs) || !Array.isArray(session.requirements) || session.requirements.length < 1 || session.requirements.length > 16 || new Set(session.requirements).size !== session.requirements.length || session.requirements.some(
+      (r) => !text2(r, 132) || !/^(runtime|app:[a-z0-9][a-z0-9-]*)$/.test(r)
+    ))
+      fail();
+    if (session.observation !== void 0) {
+      const observation = session.observation;
+      fields(observation, [
+        "status",
+        "sampledAtMs",
+        "validUntilMs",
+        "journalRevision",
+        "runtimeFingerprint"
+      ]);
+      if (![
+        "READY",
+        "APP_ERROR",
+        "BLOCKED",
+        "STOPPED",
+        "STARTING",
+        "RECOVERING",
+        "WAITING_CAPACITY",
+        "PARKED_CAPACITY",
+        "UNKNOWN"
+      ].includes(String(observation.status)) || !counter(observation.sampledAtMs) || !counter(observation.validUntilMs) || observation.validUntilMs < observation.sampledAtMs || !counter(observation.journalRevision) || !text2(observation.runtimeFingerprint, 128) || !/^[a-f0-9]{64}$/.test(observation.runtimeFingerprint))
+        fail();
+    }
+    sessions.add(session.id);
+    usedEnvironments.add(session.environmentId);
+  }
+  if (usedEnvironments.size !== environments.size) fail();
+  let previous = 0;
+  for (const event of value.events) {
+    fields(event, ["sequence", "session", "generation", "kind"]);
+    if (!counter(event.sequence) || event.sequence <= previous || event.sequence >= value.nextSequence || !id3(event.session) || !id3(event.generation) || !["acquired", "renewed", "released", "expired", "invalidated", "observed"].includes(
+      String(event.kind)
+    ))
+      fail();
+    previous = event.sequence;
+  }
+  if (Buffer.byteLength(JSON.stringify(value.events)) > 262144 || Buffer.byteLength(JSON.stringify(value)) + 1 > CONTROLLER_SNAPSHOT_BYTES)
+    fail();
+}
+var ControllerStore = class {
+  constructor(directory, write = writeFileAtomically) {
+    this.directory = directory;
+    this.write = write;
+    this.file = import_node_path29.default.join(directory, "snapshot.json");
+  }
+  file;
+  read() {
+    let fd;
+    try {
+      fd = import_node_fs23.default.openSync(
+        this.file,
+        import_node_fs23.default.constants.O_RDONLY | import_node_fs23.default.constants.O_NOFOLLOW | import_node_fs23.default.constants.O_NONBLOCK
+      );
+    } catch (error) {
+      if (error.code === "ENOENT") return void 0;
+      throw new Error("Controller snapshot cannot be opened.");
+    }
+    try {
+      const stat = import_node_fs23.default.fstatSync(fd);
+      if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0 || stat.size > CONTROLLER_SNAPSHOT_BYTES)
+        fail();
+      const bytes2 = Buffer.alloc(CONTROLLER_SNAPSHOT_BYTES + 1);
+      let length = 0;
+      while (length < bytes2.length) {
+        const count = import_node_fs23.default.readSync(fd, bytes2, length, bytes2.length - length, null);
+        if (!count) break;
+        length += count;
+      }
+      if (length > CONTROLLER_SNAPSHOT_BYTES) fail();
+      const value = JSON.parse(bytes2.subarray(0, length).toString("utf8"));
+      validateControllerSnapshot(value);
+      return value;
+    } catch {
+      throw new Error("Controller snapshot is unreadable or invalid.");
+    } finally {
+      import_node_fs23.default.closeSync(fd);
+    }
+  }
+  persist(snapshot) {
+    validateControllerSnapshot(snapshot);
+    this.read();
+    const contents = `${JSON.stringify(snapshot)}
+`;
+    try {
+      this.write(this.file, contents);
+    } catch {
+      const current = this.read();
+      if (!current || `${JSON.stringify(current)}
+` !== contents)
+        throw new Error("Controller snapshot commit failed.");
+      for (const file of [this.file, this.directory]) {
+        const fd = import_node_fs23.default.openSync(file, import_node_fs23.default.constants.O_RDONLY | import_node_fs23.default.constants.O_NOFOLLOW);
+        try {
+          import_node_fs23.default.fsyncSync(fd);
+        } finally {
+          import_node_fs23.default.closeSync(fd);
+        }
+      }
+    }
+  }
+  startIncarnation() {
+    const previous = this.read();
+    if (previous && (previous.epoch === Number.MAX_SAFE_INTEGER || previous.revision === Number.MAX_SAFE_INTEGER))
+      throw new Error("Controller snapshot counters exhausted.");
+    const snapshot = {
+      version: 1,
+      store: previous?.store ?? (0, import_node_crypto13.randomUUID)(),
+      epoch: (previous?.epoch ?? 0) + 1,
+      revision: (previous?.revision ?? 0) + 1,
+      nextSequence: 1,
+      environments: [],
+      sessions: [],
+      events: []
+    };
+    this.persist(snapshot);
+    return snapshot;
+  }
+};
 
 // src/core/reliability-contract.ts
 var RELIABILITY_CONTRACT_VERSION = 2;
@@ -7396,6 +8316,7 @@ function assertReliabilityEvent(value) {
     case "launched":
     case "interrupted":
     case "not-started":
+    case "settle":
       valid = isReliabilityId(value.operationId);
       break;
     case "completion":
@@ -7465,8 +8386,13 @@ function transition(state, outcome, effects = []) {
   assertReliabilityState(state);
   return { state, effects, outcome };
 }
-function unchanged(state, outcome) {
-  return transition(cloneState(state), outcome);
+function unchanged(state, outcome, reason2) {
+  const result = transition(cloneState(state), outcome);
+  if (reason2) result.reason = reason2;
+  return result;
+}
+function blocked(state, reason2) {
+  return unchanged(state, "blocked", reason2);
 }
 function advance(value) {
   return value === Number.MAX_SAFE_INTEGER ? null : value + 1;
@@ -7491,7 +8417,10 @@ function updateRunningPhase(state) {
 }
 function handleRequest(state, event) {
   if (state.executionPolicy === "manual" && event.mode === "start")
-    return unchanged(state, "blocked");
+    return blocked(
+      state,
+      "start requests are not admitted under manual execution policy; use the ensure/stop commands."
+    );
   const existing = state.requests.find((request) => request.key === event.key);
   if (existing) {
     const consumer = state.consumers.find((candidate) => candidate.id === existing.consumerId);
@@ -7558,10 +8487,10 @@ function handleRequest(state, event) {
 }
 function canExecAfterInterruptedEnsure(state) {
   const latestEnsure = [...state.operationHistory].reverse().find((operation) => operation.kind === "ensure");
-  return state.executionPolicy === "manual" && state.desired === "running" && latestEnsure?.status === "INTERRUPTED" && latestEnsure.drained && state.operation?.drained === true && (state.operation.kind === "ensure" && state.phase === "recovering" || state.operation.kind === "exec" && ["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status));
+  const quiescent = state.stopProof.workloadsStopped && state.stopProof.routesRemoved;
+  return state.executionPolicy === "manual" && (state.desired === "running" || quiescent && state.desired === "stopped-by-user") && latestEnsure?.status === "INTERRUPTED" && latestEnsure.drained && state.operation?.drained === true && (state.operation.kind === "ensure" && (state.phase === "recovering" || quiescent) || state.operation.kind === "exec" && ["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status));
 }
 function handleOperationRequest(state, event) {
-  if (state.executionPolicy !== "manual") return unchanged(state, "blocked");
   const previous = state.operationHistory.find((entry) => entry.key === event.key);
   if (previous)
     return unchanged(
@@ -7570,26 +8499,42 @@ function handleOperationRequest(state, event) {
     );
   if (state.operationHistory.some((entry) => entry.id === event.operationId))
     return unchanged(state, "conflict");
-  if (event.kind === "exec" && canExecAfterInterruptedEnsure(state) && event.recoverInterruptedEnsure !== true)
+  if (state.executionPolicy !== "manual" && state.operationHistory.length >= RELIABILITY_MAX_ITEMS)
     return unchanged(state, "blocked");
+  if (event.kind === "exec" && canExecAfterInterruptedEnsure(state) && event.recoverInterruptedEnsure !== true)
+    return blocked(
+      state,
+      "the latest ensure is INTERRUPTED and drained; exec requires recovering it first (run ensure, or exec with recovery proof)."
+    );
   const fullyStopped = state.stopProof.workloadsStopped && state.stopProof.routesRemoved;
   const reconcileEnsure = event.kind === "ensure" && state.operation?.kind === "ensure" && ["NOT_STARTED", "INTERRUPTED"].includes(state.operation.status);
   if (state.operation && (!state.operation.drained || !["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status) && !fullyStopped && !reconcileEnsure && !(event.kind === "exec" && event.recoverInterruptedEnsure === true && canExecAfterInterruptedEnsure(state))))
-    return unchanged(state, "blocked");
+    return blocked(
+      state,
+      `operation ${state.operation.id} is ${state.operation.status} (drained=${state.operation.drained}) and no stop proof, ensure reconciliation, or exec recovery supersedes it.`
+    );
   if (state.phase === "stopping" || state.desired === "parked-for-capacity")
-    return unchanged(state, "blocked");
+    return blocked(
+      state,
+      `phase is '${state.phase}' with desired '${state.desired}'; wait for the running stop to finish.`
+    );
   if (event.kind === "exec" && (!event.runtimeRunning || state.desired !== "running" && state.intentRevision !== 0))
-    return unchanged(state, "blocked");
-  const rollover = state.operationHistory.length >= RELIABILITY_MAX_ITEMS;
+    return blocked(
+      state,
+      `exec requires a running workspace (runtimeRunning=${event.runtimeRunning}, desired='${state.desired}').`
+    );
+  const rollover = state.executionPolicy === "manual" && state.operationHistory.length >= RELIABILITY_MAX_ITEMS;
   let retired = -1;
   if (rollover) {
-    if (state.operation && (!state.operation.drained || !["COMPLETED", "NOT_LAUNCHED"].includes(state.operation.status)))
-      return unchanged(state, "blocked");
     const latestEnsureId = [...state.operationHistory].reverse().find((entry) => entry.kind === "ensure")?.id;
     retired = state.operationHistory.findIndex(
-      (entry) => entry.id !== state.operation?.id && entry.id !== latestEnsureId && entry.drained && ["COMPLETED", "NOT_LAUNCHED"].includes(entry.status)
+      (entry) => entry.id !== state.operation?.id && entry.id !== latestEnsureId && entry.drained && ["COMPLETED", "NOT_LAUNCHED", "INTERRUPTED"].includes(entry.status)
     );
-    if (retired === -1) return unchanged(state, "blocked");
+    if (retired === -1)
+      return blocked(
+        state,
+        `journal holds ${state.operationHistory.length} entries and every retirable entry is the current operation or the latest ensure.`
+      );
   }
   if (state.desired !== "running" || rollover) {
     const revision = advance(state.intentRevision);
@@ -7600,6 +8545,7 @@ function handleOperationRequest(state, event) {
   state.desired = "running";
   state.phase = "queued";
   state.profile = event.profile;
+  if (state.executionPolicy === "capacity-managed") state.admission = "waiting";
   state.stopProof = { workloadsStopped: false, routesRemoved: false };
   state.consumers = [cloneConsumer(event.consumer)];
   state.requests = [
@@ -7625,7 +8571,11 @@ function handleOperationRequest(state, event) {
     profile: event.profile,
     consumer: cloneConsumer(event.consumer)
   });
-  return transition(state, "accepted");
+  return transition(
+    state,
+    "accepted",
+    state.executionPolicy === "capacity-managed" ? [effect(state, "request-admission", event.operationId)] : []
+  );
 }
 function handleAdmission(state, event) {
   if (state.executionPolicy === "manual" || state.desired !== "running" && state.desired !== "parked-for-capacity" || state.requests.length === 0) {
@@ -7644,7 +8594,10 @@ function handleDispatch(state) {
   if (state.operation?.drained || state.operation?.status !== "NOT_STARTED")
     return unchanged(state, "stale");
   if (state.desired !== "running" || state.executionPolicy === "capacity-managed" && state.admission !== "admitted" || state.consumers.length === 0) {
-    return unchanged(state, "blocked");
+    return blocked(
+      state,
+      `dispatch requires desired 'running' with a registered consumer (desired='${state.desired}', consumers=${state.consumers.length}).`
+    );
   }
   const corrective = state.phase === "recovering" && state.incident !== null;
   state.operation = { ...state.operation, status: "DISPATCH_PENDING", exitCode: null };
@@ -7659,7 +8612,10 @@ function handleDispatchPersisted(state, event) {
   if (state.desired !== "running" || state.executionPolicy === "capacity-managed" && (state.admission !== "admitted" || !state.chargeHeld)) {
     state.operation = setUnknown(state.operation);
     state.chargeHeld = state.executionPolicy === "capacity-managed";
-    return transition(state, "blocked");
+    return blocked(
+      state,
+      `dispatch persistence requires desired 'running' (desired='${state.desired}'); the operation outcome is unknown.`
+    );
   }
   if (state.phase === "recovering" && state.incident !== null && state.incident.correctiveActionsTaken >= state.incident.actionLimit) {
     return unchanged(state, "blocked");
@@ -7707,6 +8663,22 @@ function handleInterrupted(state, event) {
   if (state.desired === "running") state.phase = "recovering";
   return transition(state, "accepted");
 }
+function handleSettle(state, event) {
+  if (state.executionPolicy !== "manual") return unchanged(state, "stale");
+  if (!state.operation || state.operation.id !== event.operationId)
+    return unchanged(state, "stale");
+  if (state.operation.drained && state.operation.status === "INTERRUPTED")
+    return unchanged(state, "joined");
+  if (state.operation.status === "COMPLETED") return unchanged(state, "joined");
+  state.operation = {
+    ...state.operation,
+    status: "INTERRUPTED",
+    drained: true,
+    exitCode: null
+  };
+  if (state.desired === "running") state.phase = "recovering";
+  return transition(state, "accepted");
+}
 function handleObservation(state, event, nowMs) {
   if (state.desired !== "running") return unchanged(state, "stale");
   const previous = state.observations.find(
@@ -7716,7 +8688,10 @@ function handleObservation(state, event, nowMs) {
     return unchanged(state, "stale");
   }
   if (!previous && state.observations.length >= RELIABILITY_MAX_ITEMS)
-    return unchanged(state, "blocked");
+    return blocked(
+      state,
+      `observation set holds ${state.observations.length} distinct capabilities; observations repeat per capability and never retire.`
+    );
   state.observations = state.observations.filter(
     (observation) => observation.capability !== event.observation.capability
   );
@@ -7725,7 +8700,7 @@ function handleObservation(state, event, nowMs) {
   return transition(state, "accepted");
 }
 function handleStop(state) {
-  if (state.desired === "stopped-by-user" && state.intentRevision > 0)
+  if (state.desired === "stopped-by-user" && state.phase === "stopping")
     return unchanged(state, "joined");
   const intentRevision = advance(state.intentRevision);
   if (intentRevision === null) return unchanged(state, "blocked");
@@ -7744,7 +8719,10 @@ function handleStop(state) {
 function handleStopProof(state, event) {
   if (state.desired === "running") return unchanged(state, "stale");
   if (state.executionPolicy === "manual" && state.operation && !state.operation.drained && event.workloadsStopped && event.routesRemoved)
-    return unchanged(state, "blocked");
+    return blocked(
+      state,
+      `stop proof cannot settle while operation ${state.operation.id} is not drained; wait for its worker or settle the journal.`
+    );
   const previous = { ...state.stopProof };
   if (previous.workloadsStopped === event.workloadsStopped && previous.routesRemoved === event.routesRemoved)
     return unchanged(state, "joined");
@@ -7923,6 +8901,8 @@ function applyReliabilityEvent(state, event, nowMs) {
       return handleCompletion(next, event);
     case "interrupted":
       return handleInterrupted(next, event);
+    case "settle":
+      return handleSettle(next, event);
     case "observation":
       return handleObservation(next, event, nowMs);
     case "stop-proof":
@@ -7942,7 +8922,7 @@ function stepReliability(state, event, nowMs) {
   if (!isReliabilityCounter(nowMs) || nowMs < state.observationsAfterMs)
     throw new Error("Invalid reliability clock.");
   const result = applyReliabilityEvent(state, event, nowMs);
-  if (result.outcome === "accepted" && result.state.executionPolicy === "manual" && result.state.operation) {
+  if (result.outcome === "accepted" && result.state.operation) {
     const operation = result.state.operation;
     result.state.operationHistory = result.state.operationHistory.map(
       (entry) => entry.id === operation.id ? { ...entry, ...operation } : entry
@@ -7955,34 +8935,206 @@ function stepReliability(state, event, nowMs) {
 }
 
 // src/core/reliability-operation-store.ts
-var import_node_crypto11 = require("crypto");
-var import_node_fs20 = __toESM(require("fs"));
-var import_node_path25 = __toESM(require("path"));
+var import_node_crypto14 = require("crypto");
+var import_node_fs24 = __toESM(require("fs"));
+var import_node_path30 = __toESM(require("path"));
+var import_node_util5 = require("util");
+function installedCliVersion() {
+  return true ? "0.0.68" : "0.0.0-dev";
+}
+function compareCliVersions(left, right) {
+  const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
+  const leftParts = parts(left);
+  const rightParts = parts(right);
+  for (let index = 0; index < 3; index += 1) {
+    const difference = (leftParts[index] ?? 0) - (rightParts[index] ?? 0);
+    if (difference !== 0) return difference;
+  }
+  return 0;
+}
 var MAX_RECORD_BYTES = 1048576;
+var MAX_RELIABILITY_JOURNALS = 256;
+var MAX_RELIABILITY_DIRECTORY_ENTRIES = MAX_RELIABILITY_JOURNALS * 2;
 function identityKey(identity2) {
-  if (!import_node_path25.default.isAbsolute(identity2.repoPath) || import_node_path25.default.resolve(identity2.repoPath) !== identity2.repoPath || identity2.repoPath.includes("\0") || identity2.workspace !== null && !isReliabilityId(identity2.workspace) || !["devpod", "devsy"].includes(identity2.provider)) {
+  if (!import_node_path30.default.isAbsolute(identity2.repoPath) || import_node_path30.default.resolve(identity2.repoPath) !== identity2.repoPath || identity2.repoPath.includes("\0") || identity2.workspace !== null && !isReliabilityId(identity2.workspace) || !["devpod", "devsy"].includes(identity2.provider)) {
     throw new Error("Invalid reliability workspace identity.");
   }
-  return (0, import_node_crypto11.createHash)("sha256").update(identity2.repoPath).digest("hex");
+  return (0, import_node_crypto14.createHash)("sha256").update(identity2.repoPath).digest("hex");
 }
 function reliabilityOperationPath(identity2) {
-  return import_node_path25.default.join(DEVROUTER_HOME, "reliability", `${identityKey(identity2)}.json`);
+  return import_node_path30.default.join(DEVROUTER_HOME, "reliability", `${identityKey(identity2)}.json`);
 }
 function keys(value, expected) {
   if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !expected.includes(key))) {
     throw new Error("Reliability record contains unsupported fields.");
   }
 }
-function validate(record5, identity2) {
-  keys(record5, ["version", "identity", "revision", "state", "worker", "effectSequence", "outcome"]);
+function exactKeys(value, expected, message) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).length !== expected.length || Object.keys(value).some((key) => !expected.includes(key))) {
+    throw new Error(message);
+  }
+}
+function validateCapacityPhaseSettlement(record5, state, enrollment) {
+  const settlement = record5.phaseSettlement;
+  if (settlement === void 0 || settlement === null) return;
+  if (record5.version !== 2 || !enrollment || state.executionPolicy !== "capacity-managed")
+    throw new Error("Phase settlement requires durable capacity enrollment.");
+  exactKeys(
+    settlement,
+    ["id", "fence", "target", "estimatesDigest"],
+    "Invalid capacity phase settlement fields."
+  );
+  exactKeys(
+    settlement.fence,
+    ["environmentId", "intentRevision", "runtimeGeneration", "controllerEpoch"],
+    "Invalid capacity phase settlement fence."
+  );
+  exactKeys(
+    settlement.target,
+    [
+      "environmentId",
+      "operationId",
+      "reservationId",
+      "policyRevision",
+      "totals",
+      "startup",
+      "heavy"
+    ],
+    "Invalid capacity phase settlement target fields."
+  );
+  const target = settlement.target;
+  const totals = target.totals;
+  if (!isReliabilityId(settlement.id) || !isReliabilityId(settlement.fence.environmentId) || settlement.fence.environmentId !== state.environmentId || !isReliabilityCounter(settlement.fence.intentRevision) || !isReliabilityCounter(settlement.fence.runtimeGeneration) || !isReliabilityCounter(settlement.fence.controllerEpoch) || !isReliabilityId(target.environmentId) || target.environmentId !== state.environmentId || !isReliabilityId(target.operationId) || !isReliabilityId(target.reservationId) || !Number.isSafeInteger(target.policyRevision) || target.policyRevision < 1 || target.startup !== false || target.heavy !== false || typeof settlement.estimatesDigest !== "string" || !/^[0-9a-f]{64}$/.test(settlement.estimatesDigest))
+    throw new Error("Invalid capacity phase settlement.");
+  if (!totals || typeof totals !== "object" || Array.isArray(totals) || Object.keys(totals).length < 1 || Object.keys(totals).length > 256 || Object.entries(totals).some(
+    ([domain, bytes2]) => !isReliabilityId(domain) || !Number.isSafeInteger(bytes2) || bytes2 < 0
+  ))
+    throw new Error("Invalid capacity phase settlement totals.");
+  const capacity = record5.capacity;
+  if (capacity?.validUntilMs !== 0 || target.operationId !== capacity?.operationId || target.reservationId !== capacity?.reservationId || target.policyRevision !== capacity?.policyRevision || settlement.estimatesDigest !== enrollment.estimatesDigest)
+    throw new Error("Capacity phase settlement does not match durable capacity authority.");
+  const targetDomains = Object.keys(totals);
+  if (targetDomains.length !== 2 || !targetDomains.includes(enrollment.hostDomain) || !targetDomains.includes(enrollment.runtimeDomain))
+    throw new Error("Capacity phase settlement domains do not match enrollment.");
+}
+function validateStartupWitness(record5, state, enrollment) {
+  const witness = record5.startupWitness;
+  if (witness === void 0 || witness === null) return;
+  if (record5.version !== 2 || !enrollment || state.executionPolicy !== "capacity-managed")
+    throw new Error("Startup witness requires current durable managed intent.");
+  exactKeys(
+    witness,
+    [
+      "operationId",
+      "fence",
+      "provider",
+      "profile",
+      "sourceConfigSha256",
+      "effectiveConfigSha256",
+      "composeFiles",
+      "primaryService",
+      "startupServices",
+      "retainedContainerIds"
+    ],
+    "Invalid capacity startup witness fields."
+  );
+  exactKeys(
+    witness.fence,
+    ["environmentId", "intentRevision", "runtimeGeneration", "controllerEpoch"],
+    "Invalid capacity startup witness fence."
+  );
+  exactKeys(
+    witness.provider,
+    ["id", "context", "uid", "sourceContainer"],
+    "Invalid capacity startup witness provider fields."
+  );
+  const digest = (value) => typeof value === "string" && /^[0-9a-f]{64}$/.test(value);
+  const boundedText = (value) => typeof value === "string" && value.length <= 256 && ![...value].some(
+    (character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127
+  );
+  const absolutePath = (value) => typeof value === "string" && value.length <= 4096 && !value.includes("\0") && import_node_path30.default.isAbsolute(value) && import_node_path30.default.resolve(value) === value;
+  const unique = (values) => new Set(values).size === values.length;
+  const fence = witness.fence;
+  if (!isReliabilityId(witness.operationId) || !isReliabilityId(fence.environmentId) || !isReliabilityCounter(fence.intentRevision) || !isReliabilityCounter(fence.runtimeGeneration) || !isReliabilityCounter(fence.controllerEpoch) || !isReliabilityProfile(witness.profile) || !digest(witness.sourceConfigSha256) || !digest(witness.effectiveConfigSha256) || !boundedText(witness.provider.id) || witness.provider.id.trim() !== witness.provider.id || witness.provider.id === "" || witness.provider.id !== enrollment.providerId || !boundedText(witness.provider.context) || !boundedText(witness.provider.uid) || !boundedText(witness.provider.sourceContainer) || !Array.isArray(witness.composeFiles) || witness.composeFiles.length < 1 || witness.composeFiles.length > 16 || !witness.composeFiles.every(absolutePath) || !unique(witness.composeFiles) || !Array.isArray(witness.startupServices) || witness.startupServices.length < 1 || witness.startupServices.length > 64 || !witness.startupServices.every((service) => isReliabilityId(service) && service.length <= 64) || !unique(witness.startupServices) || !isReliabilityId(witness.primaryService) || witness.primaryService.length > 64 || !witness.startupServices.includes(witness.primaryService) || !Array.isArray(witness.retainedContainerIds) || witness.retainedContainerIds.length > 256 || !witness.retainedContainerIds.every(digest) || !unique(witness.retainedContainerIds))
+    throw new Error("Invalid capacity startup witness.");
+}
+function validate2(record5, identity2) {
+  keys(record5, [
+    "version",
+    "identity",
+    "revision",
+    "state",
+    "worker",
+    "effectSequence",
+    "outcome",
+    "result",
+    "writtenByVersion",
+    ...record5.version === 2 ? [
+      "capacity",
+      "enrollment",
+      "activeProfile",
+      "preparation",
+      "phaseSettlement",
+      "startupWitness"
+    ] : []
+  ]);
+  if (record5.writtenByVersion !== void 0 && compareCliVersions(record5.writtenByVersion, installedCliVersion()) > 0) {
+    throw new Error(
+      `Reliability record was last written by devrouter ${record5.writtenByVersion}, which is newer than the installed ${installedCliVersion()}; upgrade devrouter (devrouter upgrade) before running lifecycle commands.`
+    );
+  }
   keys(record5.identity, ["repoPath", "workspace", "provider"]);
-  if (record5.version !== 1 || record5.identity.repoPath !== identity2.repoPath || record5.identity.workspace !== identity2.workspace || record5.identity.provider !== identity2.provider || !isReliabilityCounter(record5.revision) || !isReliabilityCounter(record5.effectSequence)) {
+  if (record5.version !== 1 && record5.version !== 2 || record5.identity.repoPath !== identity2.repoPath || record5.identity.workspace !== identity2.workspace || record5.identity.provider !== identity2.provider || !isReliabilityCounter(record5.revision) || !isReliabilityCounter(record5.effectSequence)) {
     throw new Error("Reliability record has invalid version, ownership, or counters.");
   }
+  if (record5.version === 2) {
+    const capacity = record5.capacity;
+    if (capacity === void 0) throw new Error("Invalid capacity authority binding.");
+    if (capacity !== null) {
+      keys(capacity, [
+        "reservationId",
+        "operationId",
+        "workerId",
+        "policyRevision",
+        "validUntilMs",
+        "snapshotRevision",
+        "controller",
+        "execSteady"
+      ]);
+      if (capacity.controller !== void 0) {
+        keys(capacity.controller, ["store", "epoch"]);
+        if (!isReliabilityId(capacity.controller.store) || !isReliabilityCounter(capacity.controller.epoch) || capacity.controller.epoch < 1)
+          throw new Error("Invalid capacity controller identity.");
+      }
+    }
+    if (capacity !== null && (!isReliabilityId(capacity.reservationId) || !isReliabilityId(capacity.operationId) || !isReliabilityId(capacity.workerId) || !Number.isSafeInteger(capacity.policyRevision) || capacity.policyRevision < 1 || !isReliabilityCounter(capacity.validUntilMs) || capacity.snapshotRevision !== void 0 && (!isReliabilityCounter(capacity.snapshotRevision) || capacity.snapshotRevision < 1)))
+      throw new Error("Invalid capacity authority binding.");
+  }
   const state = record5.state;
   assertReliabilityState(state);
-  if (state.environmentId !== identityKey(identity2) || state.executionPolicy !== "manual") {
-    throw new Error("Reliability record does not grant manual authority for this workspace.");
+  if (state.environmentId !== identityKey(identity2)) {
+    throw new Error("Reliability record does not match this workspace.");
+  }
+  if (record5.enrollment !== void 0) {
+    const enrollment = record5.enrollment;
+    keys(enrollment, [
+      "policyRevision",
+      "gitCommonDir",
+      "providerId",
+      "hostDomain",
+      "runtimeDomain",
+      "endpoint",
+      "daemonId",
+      "estimatesDigest"
+    ]);
+    const absolute2 = (value) => typeof value === "string" && value.length <= 4096 && !value.includes("\0") && import_node_path30.default.isAbsolute(value) && import_node_path30.default.resolve(value) === value;
+    const providerIdentity = (value) => typeof value === "string" && value.length > 0 && value.length <= 256 && value.trim() === value && ![...value].some(
+      (character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127
+    );
+    if (record5.version !== 2 || state.executionPolicy !== "capacity-managed" || !Number.isSafeInteger(enrollment.policyRevision) || enrollment.policyRevision < 1 || !absolute2(enrollment.gitCommonDir) || !absolute2(enrollment.endpoint) || !providerIdentity(enrollment.providerId) || !providerIdentity(enrollment.daemonId) || !isReliabilityId(enrollment.hostDomain) || !isReliabilityId(enrollment.runtimeDomain) || enrollment.hostDomain === enrollment.runtimeDomain || typeof enrollment.estimatesDigest !== "string" || !/^[0-9a-f]{64}$/.test(enrollment.estimatesDigest) || record5.activeProfile !== null && (typeof record5.activeProfile !== "string" || record5.activeProfile.length > 256 || !/^[a-z0-9,-]+$/.test(record5.activeProfile)))
+      throw new Error("Invalid durable capacity enrollment.");
+  } else if (state.executionPolicy !== "manual" || record5.activeProfile !== void 0) {
+    throw new Error("Managed lifecycle requires durable capacity enrollment.");
   }
   keys(state, [
     "contractVersion",
@@ -8017,6 +9169,52 @@ function validate(record5, identity2) {
     keys(entry, ["key", "mode", "consumerId", "operationId", "profile", "intentRevision"]);
   for (const entry of state.observations)
     keys(entry, ["capability", "infrastructure", "application", "observedAtMs", "validForMs"]);
+  if (record5.preparation !== void 0 && record5.preparation !== null) {
+    if (record5.version !== 2 || record5.enrollment === void 0 || state.executionPolicy !== "capacity-managed")
+      throw new Error("Preparation receipt requires durable capacity enrollment.");
+    const preparation = record5.preparation;
+    keys(preparation, ["operationId", "profile", "fence"]);
+    keys(preparation.fence, [
+      "environmentId",
+      "intentRevision",
+      "runtimeGeneration",
+      "controllerEpoch"
+    ]);
+    if (!isReliabilityId(preparation.operationId) || !isReliabilityProfile(preparation.profile) || !isReliabilityId(preparation.fence.environmentId) || preparation.fence.environmentId !== state.environmentId || !isReliabilityCounter(preparation.fence.intentRevision) || !isReliabilityCounter(preparation.fence.runtimeGeneration) || !isReliabilityCounter(preparation.fence.controllerEpoch))
+      throw new Error("Invalid preparation receipt.");
+    const preparedOperation = state.operationHistory.find(
+      (entry) => entry.id === preparation.operationId
+    );
+    if (preparedOperation?.kind !== "ensure" || preparedOperation.profile !== preparation.profile || preparedOperation.status !== "COMPLETED")
+      throw new Error("Preparation receipt does not match a completed ensure operation.");
+  }
+  validateCapacityPhaseSettlement(record5, state, record5.enrollment);
+  validateStartupWitness(record5, state, record5.enrollment);
+  const execSteady = record5.capacity?.execSteady;
+  if (execSteady !== void 0) {
+    const enrollment = record5.enrollment;
+    if (record5.version !== 2 || !enrollment || state.executionPolicy !== "capacity-managed")
+      throw new Error("Exec steady receipt requires durable capacity enrollment.");
+    exactKeys(
+      execSteady,
+      ["profile", "estimatesDigest", "fence", "totals"],
+      "Invalid exec steady receipt fields."
+    );
+    exactKeys(
+      execSteady.fence,
+      ["environmentId", "intentRevision", "runtimeGeneration", "controllerEpoch"],
+      "Invalid exec steady receipt fence."
+    );
+    if (!isReliabilityProfile(execSteady.profile) || typeof execSteady.estimatesDigest !== "string" || !/^[0-9a-f]{64}$/.test(execSteady.estimatesDigest) || execSteady.estimatesDigest !== enrollment.estimatesDigest || execSteady.fence.environmentId !== state.environmentId || !isReliabilityCounter(execSteady.fence.intentRevision) || !isReliabilityCounter(execSteady.fence.runtimeGeneration) || !isReliabilityCounter(execSteady.fence.controllerEpoch))
+      throw new Error("Invalid exec steady receipt.");
+    exactKeys(
+      execSteady.totals,
+      [enrollment.hostDomain, enrollment.runtimeDomain],
+      "Exec steady receipt domains do not match enrollment."
+    );
+    if (!Object.values(execSteady.totals).every(isReliabilityCounter))
+      throw new Error("Invalid exec steady receipt totals.");
+  }
   if (state.operation) {
     const current = state.operationHistory.find((entry) => entry.id === state.operation?.id);
     if (!current || operationKeys.some(
@@ -8033,6 +9231,12 @@ function validate(record5, identity2) {
     if (outcome.operationId !== state.operation?.id || !["completed", "not-started", "completion-unknown"].includes(outcome.status) || (outcome.status === "completed" ? !validExit(outcome.exitCode) : outcome.exitCode !== null) || outcome.transport.exitCode !== null && !validExit(outcome.transport.exitCode) || outcome.transport.signal !== null && (typeof outcome.transport.signal !== "string" || !/^SIG[A-Z0-9]{1,16}$/.test(outcome.transport.signal))) {
       throw new Error("Reliability execution outcome is invalid.");
     }
+    if (record5.result !== void 0 && record5.result !== null) {
+      const serialized = JSON.stringify(record5.result);
+      if (typeof serialized !== "string" || serialized.length > 262144 || record5.result.ok !== true && record5.result.ok !== false || (record5.result.ok ? "message" in record5.result : !("message" in record5.result)) || !record5.result.ok && (typeof record5.result.message !== "string" || record5.result.message.length > 4096)) {
+        throw new Error("Reliability operation result is invalid.");
+      }
+    }
   }
   if (record5.worker !== null) {
     keys(record5.worker, ["id", "operationId", "pid", "birth"]);
@@ -8041,37 +9245,59 @@ function validate(record5, identity2) {
     }
   }
 }
+function assertCapacityEffect(record5, workerId, nowMs, directory = import_node_path30.default.join(DEVROUTER_HOME, "controller")) {
+  if (record5.version === 1) return;
+  const binding = record5.capacity;
+  if (!binding || binding.workerId !== workerId || binding.operationId !== record5.state.operation?.id || binding.validUntilMs <= nowMs)
+    throw new Error("Capacity effect authority is absent or stale.");
+  if (record5.state.executionPolicy === "capacity-managed") {
+    const controller = new ControllerStore(directory).read();
+    if (!binding.controller || !controller || controller.store !== binding.controller.store || controller.epoch !== binding.controller.epoch)
+      throw new Error("Capacity controller incarnation changed.");
+  }
+  const snapshot = new CapacityStore(directory).read();
+  if (binding.snapshotRevision === void 0 || snapshot.revision !== binding.snapshotRevision)
+    throw new Error("Capacity snapshot authority is absent or stale.");
+  const reservation = snapshot.reservations.find(
+    (entry) => entry.reservationId === binding.reservationId
+  );
+  if (!reservation || reservation.environmentId !== record5.state.environmentId || reservation.operationId !== binding.operationId || reservation.policyRevision !== binding.policyRevision)
+    throw new Error("Capacity effect reservation does not match lifecycle intent.");
+}
 function readReliabilityOperation(identity2) {
   const file = reliabilityOperationPath(identity2);
+  const parsed = readBoundedPrivateJson(file, "Reliability record");
+  if (parsed === void 0) return void 0;
+  const record5 = parsed;
+  validate2(record5, identity2);
+  return record5;
+}
+function readBoundedPrivateJson(file, label) {
   let descriptor;
   try {
-    descriptor = import_node_fs20.default.openSync(
+    descriptor = import_node_fs24.default.openSync(
       file,
-      import_node_fs20.default.constants.O_RDONLY | import_node_fs20.default.constants.O_NOFOLLOW | import_node_fs20.default.constants.O_NONBLOCK
+      import_node_fs24.default.constants.O_RDONLY | import_node_fs24.default.constants.O_NOFOLLOW | import_node_fs24.default.constants.O_NONBLOCK
     );
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
   }
   try {
-    const stat = import_node_fs20.default.fstatSync(descriptor);
-    if (!stat.isFile() || stat.size > MAX_RECORD_BYTES || (stat.mode & 63) !== 0) {
-      throw new Error("Reliability record is not a bounded private file.");
-    }
-    const bytes = Buffer.alloc(MAX_RECORD_BYTES + 1);
-    const count = import_node_fs20.default.readSync(descriptor, bytes, 0, bytes.length, 0);
-    if (count > MAX_RECORD_BYTES) throw new Error("Reliability record exceeds its byte limit.");
-    const record5 = JSON.parse(
-      bytes.subarray(0, count).toString("utf8")
-    );
-    validate(record5, identity2);
-    return record5;
+    const stat = import_node_fs24.default.fstatSync(descriptor);
+    if (!stat.isFile() || stat.uid !== process.getuid?.() || stat.size > MAX_RECORD_BYTES || (stat.mode & 63) !== 0) {
+      throw new Error(`${label} is not a bounded private file.`);
+    }
+    const bytes2 = Buffer.alloc(MAX_RECORD_BYTES + 1);
+    const count = import_node_fs24.default.readSync(descriptor, bytes2, 0, bytes2.length, 0);
+    if (count > MAX_RECORD_BYTES) throw new Error(`${label} exceeds its byte limit.`);
+    return JSON.parse(bytes2.subarray(0, count).toString("utf8"));
   } finally {
-    import_node_fs20.default.closeSync(descriptor);
+    import_node_fs24.default.closeSync(descriptor);
   }
 }
 function persist(record5) {
-  validate(record5, record5.identity);
+  validate2(record5, record5.identity);
   const contents = `${JSON.stringify(record5)}
 `;
   if (Buffer.byteLength(contents) > MAX_RECORD_BYTES)
@@ -8082,23 +9308,23 @@ function persist(record5) {
   } catch (error) {
     const reread = readReliabilityOperation(record5.identity);
     if (!reread || JSON.stringify(reread) !== JSON.stringify(record5)) throw error;
-    const descriptor = import_node_fs20.default.openSync(file, import_node_fs20.default.constants.O_RDONLY | import_node_fs20.default.constants.O_NOFOLLOW);
+    const descriptor = import_node_fs24.default.openSync(file, import_node_fs24.default.constants.O_RDONLY | import_node_fs24.default.constants.O_NOFOLLOW);
     try {
-      import_node_fs20.default.fsyncSync(descriptor);
+      import_node_fs24.default.fsyncSync(descriptor);
     } finally {
-      import_node_fs20.default.closeSync(descriptor);
+      import_node_fs24.default.closeSync(descriptor);
     }
-    const directory = import_node_fs20.default.openSync(import_node_path25.default.dirname(file), "r");
+    const directory = import_node_fs24.default.openSync(import_node_path30.default.dirname(file), "r");
     try {
-      import_node_fs20.default.fsyncSync(directory);
+      import_node_fs24.default.fsyncSync(directory);
     } finally {
-      import_node_fs20.default.closeSync(directory);
+      import_node_fs24.default.closeSync(directory);
     }
   }
 }
 function updateReliabilityOperation(identity2, operation) {
   const file = reliabilityOperationPath(identity2);
-  import_node_fs20.default.mkdirSync(import_node_path25.default.dirname(file), { recursive: true, mode: 448 });
+  import_node_fs24.default.mkdirSync(import_node_path30.default.dirname(file), { recursive: true, mode: 448 });
   return withFileLockSync(`${file}.lock`, { activity: "reliability intent", waitMs: 2e3 }, () => {
     const record5 = readReliabilityOperation(identity2) ?? {
       version: 1,
@@ -8111,22 +9337,37 @@ function updateReliabilityOperation(identity2, operation) {
     };
     if (record5.revision === Number.MAX_SAFE_INTEGER)
       throw new Error("Reliability record revision is exhausted.");
+    const previousVersion = record5.version;
+    const previousEnrollment = record5.enrollment && { ...record5.enrollment };
     const result = operation(record5);
     if (result && typeof result.then === "function") {
       throw new Error("Reliability record updates must be synchronous.");
     }
-    validate(record5, identity2);
+    if (record5.version < previousVersion || previousEnrollment && !(0, import_node_util5.isDeepStrictEqual)(record5.enrollment, previousEnrollment))
+      throw new Error("Durable capacity enrollment cannot be downgraded or replaced.");
+    record5.writtenByVersion = installedCliVersion();
+    validate2(record5, identity2);
     record5.revision += 1;
     persist(record5);
     return result;
   });
 }
+function clearStartupWitness(identity2, fence) {
+  updateReliabilityOperation(identity2, (record5) => {
+    if (record5.startupWitness === void 0 || record5.startupWitness === null) return;
+    const live = reliabilityFence(record5.state);
+    if (Object.entries(fence).some(([key, value]) => value !== live[key]))
+      throw new Error("Startup witness clearing fence changed.");
+    record5.startupWitness = null;
+  });
+}
 
 // src/core/reliability-worker.ts
 var import_node_child_process16 = require("child_process");
-var import_node_crypto12 = require("crypto");
-var import_node_fs21 = __toESM(require("fs"));
-var import_node_path26 = __toESM(require("path"));
+var import_node_crypto15 = require("crypto");
+var import_node_fs25 = __toESM(require("fs"));
+var import_node_path31 = __toESM(require("path"));
+var DEFAULT_OUTPUT_PAGE_BYTES = 48 * 1024;
 function workerGroupAbsent(pid) {
   try {
     process.kill(-pid, 0);
@@ -8138,10 +9379,10 @@ function workerGroupAbsent(pid) {
 
 // src/core/traefik-route-health.ts
 var import_node_child_process17 = require("child_process");
-var import_node_fs22 = __toESM(require("fs"));
-var import_node_path27 = __toESM(require("path"));
+var import_node_fs26 = __toESM(require("fs"));
+var import_node_path32 = __toESM(require("path"));
 var ROUTER_API_BASE = "http://127.0.0.1:8080/api";
-var ROUTER_RELOAD_LOCK_FILE = import_node_path27.default.join(DEVROUTER_HOME, "router-reload.lock");
+var ROUTER_RELOAD_LOCK_FILE = import_node_path32.default.join(DEVROUTER_HOME, "router-reload.lock");
 var ROUTER_API_REQUEST_TIMEOUT_SECONDS = "2";
 var DEFAULT_INITIAL_TIMEOUT_MS = 3e3;
 var DEFAULT_RECOVERY_TIMEOUT_MS = 1e4;
@@ -8410,7 +9651,7 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
     throw new Error(
       "Traefik routes did not reload; shared router restart is disabled for this operation."
     );
-  import_node_fs22.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs26.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     ROUTER_RELOAD_LOCK_FILE,
     {
@@ -8462,19 +9703,19 @@ function assertTraefikRoutesRemoved(routes) {
 
 // src/core/workspace-ensure.ts
 var import_node_child_process26 = require("child_process");
-var import_node_fs28 = __toESM(require("fs"));
-var import_node_path32 = __toESM(require("path"));
+var import_node_fs32 = __toESM(require("fs"));
+var import_node_path37 = __toESM(require("path"));
 
 // src/core/devpod-mutation.ts
 var import_node_child_process18 = require("child_process");
-var import_node_fs23 = __toESM(require("fs"));
-var import_node_path28 = __toESM(require("path"));
-var DEVPOD_MUTATION_LOCK_FILE = import_node_path28.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+var import_node_fs27 = __toESM(require("fs"));
+var import_node_path33 = __toESM(require("path"));
+var DEVPOD_MUTATION_LOCK_FILE = import_node_path33.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
 var DEVPOD_MUTATION_WAIT_MS = 18e5;
 var DevpodStartPostconditionError = class extends Error {
 };
 function withMutationLock2(activity, target, operation) {
-  import_node_fs23.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs27.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
     {
@@ -8813,7 +10054,7 @@ function transportFailure() {
 
 // src/core/managed-host-preparation.ts
 var import_node_child_process20 = require("child_process");
-var import_node_fs24 = __toESM(require("fs"));
+var import_node_fs28 = __toESM(require("fs"));
 var PREPARATION_TIMEOUT_MS = 6e4;
 var CONFIG_READ_ERROR = "Managed host preparation could not read .devrouter.yml.";
 var CONFIG_CHANGED_ERROR = "Managed host preparation changed .devrouter.yml; refusing to continue.";
@@ -8856,7 +10097,7 @@ function runPreparationCommand(argv, cwd) {
 }
 function readConfigBytes(configPath) {
   try {
-    return import_node_fs24.default.readFileSync(configPath);
+    return import_node_fs28.default.readFileSync(configPath);
   } catch {
     return void 0;
   }
@@ -8891,9 +10132,9 @@ async function runManagedHostPreparation(repoPath, config) {
 
 // src/core/managed-post-start.ts
 var import_node_child_process21 = require("child_process");
-var import_node_crypto13 = require("crypto");
-var import_node_fs25 = __toESM(require("fs"));
-var import_node_path29 = __toESM(require("path"));
+var import_node_crypto16 = require("crypto");
+var import_node_fs29 = __toESM(require("fs"));
+var import_node_path34 = __toESM(require("path"));
 var MANAGED_MARKER = "devrouter:managed devcontainer";
 var MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
 var RUNTIME_HELPER_PATH = "/tmp/devrouter/bin/devrouter-process";
@@ -8906,7 +10147,7 @@ function renderDeliveryScript(targetPath) {
   if (!/^\/tmp\/devrouter\/bin\/[a-zA-Z0-9._-]+$/.test(targetPath)) {
     throw new Error(`Unsafe managed runtime delivery path: ${targetPath}`);
   }
-  const temporaryPrefix = import_node_path29.default.posix.basename(targetPath);
+  const temporaryPrefix = import_node_path34.default.posix.basename(targetPath);
   return `set -eu
 umask 077
 runtime_root=/tmp/devrouter
@@ -8941,32 +10182,32 @@ function deliverRuntimeFile(containerId, targetPath, contents, label) {
   }
 }
 function readRegularFileBytes(filePath) {
-  if (!import_node_fs25.default.existsSync(filePath) || !import_node_fs25.default.lstatSync(filePath).isFile()) return void 0;
-  return import_node_fs25.default.readFileSync(filePath);
+  if (!import_node_fs29.default.existsSync(filePath) || !import_node_fs29.default.lstatSync(filePath).isFile()) return void 0;
+  return import_node_fs29.default.readFileSync(filePath);
 }
 function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
 }
 function adapterFingerprint(adapter) {
-  return (0, import_node_crypto13.createHash)("sha256").update(adapter).digest("hex");
+  return (0, import_node_crypto16.createHash)("sha256").update(adapter).digest("hex");
 }
 function resolveProcessHelperPath() {
   const candidates = [
-    import_node_path29.default.resolve(__dirname, "..", "bin", "devrouter-process"),
-    import_node_path29.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
+    import_node_path34.default.resolve(__dirname, "..", "bin", "devrouter-process"),
+    import_node_path34.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
   ];
-  const helperPath = candidates.find((candidate) => import_node_fs25.default.existsSync(candidate));
+  const helperPath = candidates.find((candidate) => import_node_fs29.default.existsSync(candidate));
   if (!helperPath) {
     throw new Error("Could not locate the packaged devrouter-process helper.");
   }
   return helperPath;
 }
 function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path29.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterPath = import_node_path34.default.join(repoPath, MANAGED_ADAPTER_PATH);
   const adapterBytes = readRegularFileBytes(adapterPath);
   const adapterText = adapterBytes?.toString("utf-8");
-  const dockerfilePath = import_node_path29.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path29.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfilePath = import_node_path34.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path34.default.join(repoPath, ".devcontainer", "devcontainer.json");
   const dockerfile = readRegularFile(dockerfilePath) ?? "";
   const devcontainer = readRegularFile(devcontainerPath) ?? "";
   const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
@@ -9007,7 +10248,7 @@ function resolveManagedPostStartPlan(repoPath) {
 }
 function runManagedPostStart(options) {
   if (options.plan.kind !== "runtime") return;
-  const helper = import_node_fs25.default.readFileSync(resolveProcessHelperPath());
+  const helper = import_node_fs29.default.readFileSync(resolveProcessHelperPath());
   deliverRuntimeFile(
     options.container.id,
     RUNTIME_HELPER_PATH,
@@ -9556,14 +10797,14 @@ function record4(value) {
   }
   return value;
 }
-function text2(value) {
+function text3(value) {
   if (typeof value !== "string" || !value || value.includes("\0")) {
     throw new NetworkInventoryError("Docker network inventory contains an invalid identity.");
   }
   return value;
 }
-function id2(value) {
-  const result = text2(value);
+function id4(value) {
+  const result = text3(value);
   if (!FULL_ID.test(result))
     throw new NetworkInventoryError("Docker inventory requires full object IDs.");
   return result;
@@ -9573,7 +10814,7 @@ function rows(output) {
   return trimmed ? trimmed.split(/\r?\n/).map((line) => JSON.parse(line)) : [];
 }
 function ids(output) {
-  const values = output.trim() ? output.trim().split(/\r?\n/).map(id2) : [];
+  const values = output.trim() ? output.trim().split(/\r?\n/).map(id4) : [];
   if (values.length > MAX_IDS || new Set(values).size !== values.length) {
     throw new NetworkInventoryError("Docker network inventory has duplicate or too many objects.");
   }
@@ -9619,7 +10860,7 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
         read2(["info", "--format", '{"id":{{json .ID}},"pools":{{json .DefaultAddressPools}}}'])
       )
     );
-    result.daemonId = text2(info.id);
+    result.daemonId = text3(info.id);
     if (options.expectedDaemonId && result.daemonId !== options.expectedDaemonId) {
       throw new NetworkInventoryError("Docker daemon identity changed before network inspection.");
     }
@@ -9627,7 +10868,7 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
       throw new NetworkInventoryError("Docker default pools are unavailable.");
     result.pools = info.pools.map((value) => {
       const pool = record4(value);
-      const base = text2(pool.Base);
+      const base = text3(pool.Base);
       if (!Number.isSafeInteger(pool.Size) || Number(pool.Size) < 0 || Number(pool.Size) > 128) {
         throw new NetworkInventoryError("Docker default pool allocation size is invalid.");
       }
@@ -9642,11 +10883,11 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
         throw new NetworkInventoryError("Docker network IPAM or endpoint evidence is unavailable.");
       }
       return {
-        id: id2(network.id),
-        name: text2(network.name),
-        driver: text2(network.driver),
+        id: id4(network.id),
+        name: text3(network.name),
+        driver: text3(network.driver),
         subnets: (network.ipam === null ? [] : network.ipam).map(
-          (entry) => text2(record4(entry).Subnet)
+          (entry) => text3(record4(entry).Subnet)
         ),
         activeEndpoints: Number(network.activeEndpoints),
         retainedContainerIds: [],
@@ -9662,11 +10903,11 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
     const inspected = [];
     for (const value of containers) {
       const container = record4(value);
-      const containerId = id2(container.id);
+      const containerId = id4(container.id);
       inspected.push(containerId);
       for (const membership of Object.values(record4(container.networks))) {
         const reference = record4(membership);
-        const networkId = id2(reference.NetworkID);
+        const networkId = id4(reference.NetworkID);
         const network = byId.get(networkId);
         if (!network)
           throw new NetworkInventoryError("A retained container references an unobserved network.");
@@ -9684,7 +10925,7 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
         "Docker object population changed during network inspection."
       );
     }
-    const finalId = text2(JSON.parse(read2(["info", "--format", "{{json .ID}}"])));
+    const finalId = text3(JSON.parse(read2(["info", "--format", "{{json .ID}}"])));
     if (finalId !== result.daemonId)
       throw new NetworkInventoryError("Docker daemon identity changed during inspection.");
     result.status = "complete";
@@ -9697,36 +10938,36 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
 
 // src/core/network-routes.ts
 var import_node_child_process23 = require("child_process");
-var import_node_net2 = require("net");
+var import_node_net3 = require("net");
 
 // src/core/network-local-daemon.ts
-var import_node_fs26 = __toESM(require("fs"));
-var import_node_path30 = __toESM(require("path"));
+var import_node_fs30 = __toESM(require("fs"));
+var import_node_path35 = __toESM(require("path"));
 function hasLocalDockerNetworkNamespace(endpoint, procRoot = "/proc") {
   const deadline = Date.now() + 2e3;
   try {
     if (!endpoint.startsWith("unix:///")) return false;
     const socket = endpoint.slice("unix://".length);
-    const table = import_node_fs26.default.readFileSync(import_node_path30.default.join(procRoot, "net/unix"), "utf8");
+    const table = import_node_fs30.default.readFileSync(import_node_path35.default.join(procRoot, "net/unix"), "utf8");
     if (Buffer.byteLength(table) > 1024 * 1024) return false;
     const rows2 = table.split("\n").map((line) => line.trim().split(/\s+/)).filter((row) => row[7] === socket && row[3] === "00010000");
     if (rows2.length !== 1 || !/^\d+$/.test(rows2[0][6])) return false;
     const inode = `socket:[${rows2[0][6]}]`;
-    const ownNamespace = import_node_fs26.default.readlinkSync(import_node_path30.default.join(procRoot, "self/ns/net"));
-    const pids = import_node_fs26.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
+    const ownNamespace = import_node_fs30.default.readlinkSync(import_node_path35.default.join(procRoot, "self/ns/net"));
+    const pids = import_node_fs30.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
     if (pids.length > 4096) return false;
     for (const pid of pids) {
       if (Date.now() > deadline) return false;
       try {
-        const root = import_node_path30.default.join(procRoot, pid);
-        if (import_node_path30.default.basename(import_node_fs26.default.readlinkSync(import_node_path30.default.join(root, "exe"))) !== "dockerd") continue;
-        if (import_node_fs26.default.readlinkSync(import_node_path30.default.join(root, "ns/net")) !== ownNamespace) continue;
-        const descriptors = import_node_fs26.default.readdirSync(import_node_path30.default.join(root, "fd"));
+        const root = import_node_path35.default.join(procRoot, pid);
+        if (import_node_path35.default.basename(import_node_fs30.default.readlinkSync(import_node_path35.default.join(root, "exe"))) !== "dockerd") continue;
+        if (import_node_fs30.default.readlinkSync(import_node_path35.default.join(root, "ns/net")) !== ownNamespace) continue;
+        const descriptors = import_node_fs30.default.readdirSync(import_node_path35.default.join(root, "fd"));
         if (descriptors.length > 4096) continue;
         if (descriptors.some((fd) => {
           if (Date.now() > deadline) return false;
           try {
-            return import_node_fs26.default.readlinkSync(import_node_path30.default.join(root, "fd", fd)) === inode;
+            return import_node_fs30.default.readlinkSync(import_node_path35.default.join(root, "fd", fd)) === inode;
           } catch {
             return false;
           }
@@ -9752,7 +10993,7 @@ function parseLinuxNetworkRoutes(output) {
       const value = row;
       if (typeof value.dst !== "string") throw new Error();
       if (value.dst === "default") continue;
-      if ((0, import_node_net2.isIP)(value.dst.split("/")[0]) === 6) continue;
+      if ((0, import_node_net3.isIP)(value.dst.split("/")[0]) === 6) continue;
       const cidr = parseIPv4Cidr(value.dst.includes("/") ? value.dst : `${value.dst}/32`);
       if (!cidr || typeof value.dev !== "string" || !value.dev) throw new Error();
       routes.push({ cidr, interface: value.dev, source: "host" });
@@ -9801,10 +11042,10 @@ function inspectLegacyNetworkCapacity(input) {
 }
 
 // src/core/network-managed.ts
-var import_node_crypto16 = require("crypto");
+var import_node_crypto19 = require("crypto");
 
 // src/core/network-compose.ts
-var import_node_crypto14 = require("crypto");
+var import_node_crypto17 = require("crypto");
 var SAFE_ENDPOINT_UPPER_BOUND_SEMANTICS = "full-lifecycle-demand";
 function isRecord4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -10610,19 +11851,19 @@ function stableValue(value) {
 }
 function fingerprintComposeNetworkModel(input) {
   const projection = normalizedFingerprintProjection(input);
-  return (0, import_node_crypto14.createHash)("sha256").update(stableValue(projection), "utf8").digest("hex");
+  return (0, import_node_crypto17.createHash)("sha256").update(stableValue(projection), "utf8").digest("hex");
 }
 
 // src/core/network-compose-files.ts
 var import_node_child_process24 = require("child_process");
-var import_node_crypto15 = require("crypto");
-var import_node_fs27 = __toESM(require("fs"));
-var import_node_path31 = __toESM(require("path"));
+var import_node_crypto18 = require("crypto");
+var import_node_fs31 = __toESM(require("fs"));
+var import_node_path36 = __toESM(require("path"));
 var import_yaml4 = __toESM(require("yaml"));
 var OVERLAY = "docker-compose.devrouter-network.yml";
 var MARKER = "# devrouter:managed workspace network";
-var MAX_BYTES = 2 * 1024 * 1024;
-function object2(value) {
+var MAX_BYTES2 = 2 * 1024 * 1024;
+function object3(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("Network Compose evidence is malformed.");
   return value;
@@ -10630,20 +11871,20 @@ function object2(value) {
 function inspectNetworkComposeFiles(input) {
   const authoredNetworks = {};
   for (const file of input.plan.composeFiles) {
-    const stat = import_node_fs27.default.lstatSync(file);
-    if (!stat.isFile() || stat.size > MAX_BYTES)
+    const stat = import_node_fs31.default.lstatSync(file);
+    if (!stat.isFile() || stat.size > MAX_BYTES2)
       throw new Error("Network Compose source is unavailable or too large.");
     let source;
     try {
-      source = object2(import_yaml4.default.parse(import_node_fs27.default.readFileSync(file, "utf8")));
+      source = object3(import_yaml4.default.parse(import_node_fs31.default.readFileSync(file, "utf8")));
     } catch {
       throw new Error("Network Compose source could not be parsed safely.");
     }
     if (source.networks !== void 0) {
-      for (const [name, declaration] of Object.entries(object2(source.networks))) {
+      for (const [name, declaration] of Object.entries(object3(source.networks))) {
         authoredNetworks[name] = {
           ...authoredNetworks[name],
-          ...declaration === null ? {} : object2(declaration)
+          ...declaration === null ? {} : object3(declaration)
         };
       }
     }
@@ -10671,13 +11912,13 @@ function inspectNetworkComposeFiles(input) {
       env,
       encoding: "utf8",
       timeout: 1e4,
-      maxBuffer: MAX_BYTES
+      maxBuffer: MAX_BYTES2
     }
   );
   if (result.error || result.status !== 0)
     throw new Error("Complete network Compose evidence is unavailable.");
   try {
-    return { compose: object2(JSON.parse(result.stdout)), authoredNetworks };
+    return { compose: object3(JSON.parse(result.stdout)), authoredNetworks };
   } catch {
     throw new Error("Network Compose evidence is malformed.");
   }
@@ -10685,7 +11926,7 @@ function inspectNetworkComposeFiles(input) {
 function prepareNetworkComposeFiles(plan, subnet) {
   const overlay = deriveComposeNetworkOverlay(subnet);
   if (overlay.status !== "ready" || !overlay.overlay) throw new Error("Network subnet is invalid.");
-  const overlayPath = import_node_path31.default.join(plan.composeDirectory, OVERLAY);
+  const overlayPath = import_node_path36.default.join(plan.composeDirectory, OVERLAY);
   const ignored = (0, import_node_child_process24.spawnSync)("git", [
     "-C",
     plan.composeDirectory,
@@ -10697,12 +11938,12 @@ function prepareNetworkComposeFiles(plan, subnet) {
   ]);
   if (ignored.status !== 0)
     throw new Error("Generated network overlay must be ignored before allocation.");
-  const bytes = `${MARKER}
+  const bytes2 = `${MARKER}
 ${import_yaml4.default.stringify(overlay.overlay)}`;
   const assertOwnership = () => {
-    if (!import_node_fs27.default.existsSync(overlayPath)) return;
-    const stat = import_node_fs27.default.lstatSync(overlayPath);
-    if (!stat.isFile() || stat.size > MAX_BYTES || import_node_fs27.default.readFileSync(overlayPath, "utf8") !== bytes)
+    if (!import_node_fs31.default.existsSync(overlayPath)) return;
+    const stat = import_node_fs31.default.lstatSync(overlayPath);
+    if (!stat.isFile() || stat.size > MAX_BYTES2 || import_node_fs31.default.readFileSync(overlayPath, "utf8") !== bytes2)
       throw new Error("Retained network overlay changed; repair is required.");
   };
   assertOwnership();
@@ -10716,13 +11957,13 @@ ${JSON.stringify(extended.config, null, 2)}
     ...plan,
     contents,
     composeFiles: [...plan.composeFiles, overlayPath],
-    effectiveConfigSha256: (0, import_node_crypto15.createHash)("sha256").update(contents).digest("hex")
+    effectiveConfigSha256: (0, import_node_crypto18.createHash)("sha256").update(contents).digest("hex")
   };
   return {
     plan: result,
     write: () => {
       assertOwnership();
-      writeFileAtomically(overlayPath, bytes);
+      writeFileAtomically(overlayPath, bytes2);
     }
   };
 }
@@ -11034,7 +12275,7 @@ function createManagedNetworkSession(input) {
           "Insufficient endpoint headroom; request an allowed larger network before first allocation."
         );
       const authority = readNetworkOperationAuthority(identity2);
-      const fingerprint = (0, import_node_crypto16.createHash)("sha256").update(input.plan().sourceConfigSha256).update(fingerprintComposeNetworkModel(model)).digest("hex");
+      const fingerprint = (0, import_node_crypto19.createHash)("sha256").update(input.plan().sourceConfigSha256).update(fingerprintComposeNetworkModel(model)).digest("hex");
       if (!saved) {
         if (policy.status !== "valid")
           throw new Error("New network allocation requires valid machine policy.");
@@ -11218,11 +12459,11 @@ var DEFAULT_READINESS_TIMEOUT_MS = 12e4;
 var POLL_INTERVAL_MS = 1e3;
 function assertOverlay(container, repoPath) {
   const workingDir = container.labels["com.docker.compose.project.working_dir"];
-  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path32.default.join(repoPath, ".devcontainer"))) {
+  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path37.default.join(repoPath, ".devcontainer"))) {
     throw new Error(`Container '${container.id}' does not belong to the exact worktree.`);
   }
   const configFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").filter(Boolean);
-  const expectedOverlay = import_node_path32.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+  const expectedOverlay = import_node_path37.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
   if (!configFiles.some((configFile) => sameWorkspacePath(configFile, expectedOverlay))) {
     throw new Error(`Container '${container.id}' was not started with ${DEVCONTAINER_OVERLAY}.`);
   }
@@ -11417,7 +12658,7 @@ function hasExactManagedComposeProject(repoPath, state) {
     }).some((container) => {
       const workingDir = container.labels["com.docker.compose.project.working_dir"];
       return Boolean(
-        workingDir && sameWorkspacePath(workingDir, import_node_path32.default.join(repoPath, ".devcontainer"))
+        workingDir && sameWorkspacePath(workingDir, import_node_path37.default.join(repoPath, ".devcontainer"))
       );
     });
   } catch {
@@ -11801,7 +13042,7 @@ function resolvePrimaryTarget(repoPath) {
 }
 function isPrimaryCheckout(repoPath) {
   try {
-    return import_node_fs28.default.statSync(import_node_path32.default.join(repoPath, ".git")).isDirectory();
+    return import_node_fs32.default.statSync(import_node_path37.default.join(repoPath, ".git")).isDirectory();
   } catch {
     return false;
   }
@@ -11864,8 +13105,8 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       const target = options.repair ? resolveRepairTarget(repoPath, linked) : linked ? resolveLinkedTarget(repoPath) : resolvePrimaryTarget(repoPath);
       let devpodId = target.devpodId;
       if (target.kind === "linked") {
-        const overlayPath = import_node_path32.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
-        if (!import_node_fs28.default.existsSync(overlayPath)) {
+        const overlayPath = import_node_path37.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+        if (!import_node_fs32.default.existsSync(overlayPath)) {
           throw new Error(`Missing required DevPod compose overlay: ${overlayPath}`);
         }
       }
@@ -11935,7 +13176,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       }
       const apps = proxyAppsFromConfig(runtime.config);
       const parsedUpstreams = apps.map((app) => parseUpstream(app.upstream));
-      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path32.default.basename(repoPath)) ?? "app";
+      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path37.default.basename(repoPath)) ?? "app";
       for (const [index, app] of apps.entries()) {
         if (!parsedUpstreams[index].host.startsWith(`${aliasPrefix}-`)) {
           const owner = target.kind === "linked" ? "workspace" : "checkout";
@@ -12186,6 +13427,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
               claimLifecycleEffect();
               writeManagedRuntimeState(state);
               capturedStopState = state;
+              clearActiveLifecycleStartupWitness();
             };
             if (options.repair) capture();
             else
@@ -12754,9 +13996,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     }
     const repairLocked = () => {
       const runtime = resolveWorkspaceRuntimeOrDefault(repoPath);
-      import_node_fs28.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+      import_node_fs32.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
       return withFileLock(
-        import_node_path32.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
+        import_node_path37.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
         {
           activity: "Managed runtime repair",
           target: repoPath,
@@ -12828,6 +14070,7 @@ var lockHeld = false;
 var stopProjects = [];
 var stopBaselineState;
 var BUSY_LIFECYCLE_WAIT_MS = 30 * 60 * 1e3;
+var CAPACITY_CLIENT_WAIT_MS = 30 * 60 * 1e3;
 function matchesFence(record5, fence) {
   return Object.entries(reliabilityFence(record5.state)).every(
     ([key, value]) => value === fence[key]
@@ -12844,6 +14087,7 @@ function claimActiveLifecycleEffect() {
     if (!matchesFence(record5, worker.fence) || worker.kind !== "stop" && record5.worker?.id !== worker.workerId) {
       throw new Error("Lifecycle intent superseded this worker.");
     }
+    if (worker.kind !== "stop") assertCapacityEffect(record5, worker.workerId, Date.now());
     if (record5.effectSequence === Number.MAX_SAFE_INTEGER)
       throw new Error("Lifecycle effect sequence exhausted.");
     record5.effectSequence += 1;
@@ -12861,7 +14105,9 @@ async function withLifecycleOperationLock(repoPath, operation) {
 function stepRecord(record5, event) {
   const transition2 = stepReliability(record5.state, event, Date.now());
   if (!["accepted", "joined"].includes(transition2.outcome))
-    throw new Error(`Lifecycle transition is ${transition2.outcome}.`);
+    throw new Error(
+      `Lifecycle transition is ${transition2.outcome}.${transition2.reason ? ` ${transition2.reason}` : ""}`
+    );
   record5.state = transition2.state;
 }
 function reconcileDrained(record5) {
@@ -12896,6 +14142,13 @@ function reconcileDrained(record5) {
     record5.worker = null;
   }
 }
+function clearActiveLifecycleStartupWitness() {
+  const request = activeWorker;
+  if (!request || request.kind === "stop") return;
+  const record5 = readReliabilityOperation(request.identity);
+  if (record5?.startupWitness?.operationId !== request.operationId) return;
+  clearStartupWitness(request.identity, reliabilityFence(record5.state));
+}
 async function acquireWorkerLock(repoPath, operation) {
   const deadline = Date.now() + 3e4;
   for (; ; ) {
@@ -12952,7 +14205,7 @@ async function executeLifecycleWorker(request, operation) {
           const owned = containers.filter(
             (container) => sameWorkspacePath(
               container.labels["com.docker.compose.project.working_dir"] ?? "",
-              import_node_path33.default.join(request.repoPath, ".devcontainer")
+              import_node_path38.default.join(request.repoPath, ".devcontainer")
             )
           );
           const projects = owned.map((container) => container.labels["com.docker.compose.project"]);
@@ -12978,7 +14231,7 @@ async function executeLifecycleWorker(request, operation) {
     }
   });
 }
-function recordLifecycleOutcome(outcome) {
+function recordLifecycleOutcome(outcome, result) {
   const request = activeWorker;
   if (request?.kind !== "exec") return;
   updateReliabilityOperation(request.identity, (record5) => {
@@ -12996,27 +14249,40 @@ function recordLifecycleOutcome(outcome) {
     };
     stepRecord(record5, event);
     record5.outcome = { ...outcome, operationId: request.operationId };
+    if (result !== void 0) record5.result = result;
   });
 }
-function recordLifecycleCompletion(exitCode) {
+function recordLifecycleCompletion(exitCode, preparedProfile, result) {
   const request = activeWorker;
   if (!request || request.kind === "stop") return;
   updateReliabilityOperation(request.identity, (record5) => {
     if (!matchesFence(record5, request.fence)) return;
+    if (preparedProfile !== void 0 && record5.enrollment) {
+      if (request.kind !== "ensure" || record5.worker?.id !== request.workerId || record5.state.operation?.id !== request.operationId || record5.state.profile !== preparedProfile)
+        throw new Error("Prepared profile does not match the active lifecycle worker.");
+      record5.activeProfile = preparedProfile;
+      record5.preparation = {
+        operationId: request.operationId,
+        profile: preparedProfile,
+        fence: { ...request.fence }
+      };
+    }
     stepRecord(record5, {
       ...request.fence,
       type: "completion",
       operationId: request.operationId,
       exitCode
     });
+    if (result !== void 0) record5.result = result;
   });
 }
-function recordLifecycleUnknown() {
+function recordLifecycleUnknown(result) {
   const request = activeWorker;
   if (!request || request.kind === "stop") return;
   updateReliabilityOperation(request.identity, (record5) => {
     if (!matchesFence(record5, request.fence)) return;
     stepRecord(record5, { ...request.fence, type: "interrupted", operationId: request.operationId });
+    if (result !== void 0) record5.result = result;
   });
 }
 function proveLifecycleStopped() {
@@ -13040,7 +14306,7 @@ function proveLifecycleStopped() {
       const remaining = inspectWorkspaceContainers().filter(
         (container) => sameWorkspacePath(
           container.labels["com.docker.compose.project.working_dir"] ?? "",
-          import_node_path33.default.join(request.repoPath, ".devcontainer")
+          import_node_path38.default.join(request.repoPath, ".devcontainer")
         )
       );
       if (remaining.some(
@@ -13053,16 +14319,48 @@ function proveLifecycleStopped() {
       (route) => sameWorkspacePath(route.repoPath, request.repoPath)
     );
     if (routes.length) throw new Error("Workspace routes remain published after stop.");
-    updateReliabilityOperation(request.identity, (record5) => {
+    const settlement = updateReliabilityOperation(request.identity, (record5) => {
       if (!matchesFence(record5, request.fence) || record5.worker)
         throw new Error("Stop proof was superseded or an earlier worker remains.");
+      if (record5.version === 2) {
+        if (record5.capacity) record5.capacity.validUntilMs = 0;
+        return record5.state.environmentId;
+      }
       stepRecord(record5, {
         ...request.fence,
         type: "stop-proof",
         workloadsStopped: true,
         routesRemoved: true
       });
+      return void 0;
     });
+    if (settlement) {
+      const capacity = new CapacityStore(import_node_path38.default.join(DEVROUTER_HOME, "controller"));
+      for (let attempt = 0; ; attempt++) {
+        try {
+          capacity.settleEnvironmentAfterStop(settlement, capacity.read().revision);
+          break;
+        } catch (error) {
+          if (!(error instanceof CapacitySnapshotChangedError) || attempt >= 2) throw error;
+        }
+      }
+      updateReliabilityOperation(request.identity, (record5) => {
+        if (!matchesFence(record5, request.fence) || record5.worker || record5.state.environmentId !== settlement || record5.capacity && record5.capacity.validUntilMs !== 0)
+          throw new Error("Capacity settlement was superseded before journal confirmation.");
+        record5.capacity = null;
+        if (record5.enrollment) {
+          record5.phaseSettlement = null;
+          record5.activeProfile = null;
+          record5.preparation = null;
+        }
+        stepRecord(record5, {
+          ...request.fence,
+          type: "stop-proof",
+          workloadsStopped: true,
+          routesRemoved: true
+        });
+      });
+    }
   };
   if (stopBaselineState)
     withMutationLock("Settle retained stop", stopBaselineState.repoPath, settle);
@@ -13198,7 +14496,7 @@ async function devpodExecOutcome(repoPath, command) {
     }
     assertRunningDevpod(devpod.id, repoPath);
     const workspaceDirectory = resolveWorkspaceDirectory(repoPath);
-    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto17.randomUUID)()}__:`;
+    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto21.randomUUID)()}__:`;
     const statusMarkerBytes = Buffer.from(statusMarker, "ascii");
     const literalCommand = command.map(quotePosixArg).join(" ");
     const wrappedCommand = `${literalCommand}; __devrouter_status=$?; printf '${statusMarker}%s\\n' "$__devrouter_status" >&2; exit 0`;
@@ -13388,11 +14686,11 @@ async function devpodExecOutcome(repoPath, command) {
 
 // src/core/workspace-lifecycle.ts
 var import_node_child_process29 = require("child_process");
-var import_node_fs30 = __toESM(require("fs"));
-var import_node_path34 = __toESM(require("path"));
+var import_node_fs34 = __toESM(require("fs"));
+var import_node_path39 = __toESM(require("path"));
 
 // src/core/route-state.ts
-var import_node_fs29 = __toESM(require("fs"));
+var import_node_fs33 = __toESM(require("fs"));
 function listRoutesForWorktreePath(worktreePath, routes = listHostRouteState()) {
   return routes.filter((route) => sameWorkspacePath(route.repoPath, worktreePath));
 }
@@ -13597,20 +14895,26 @@ process.once("message", async (message) => {
           request.command ?? [],
           request.retainedExecProof
         ) : await devpodExecOutcome(request.repoPath, request.command ?? []);
-        recordLifecycleOutcome(outcome);
+        recordLifecycleOutcome(outcome, { ok: true, value: outcome });
         return outcome;
       }
       const ensured = await workspaceEnsure(request.repoPath, request.options);
       recordLifecycleCompletion(
-        ensured.applicationReadiness?.status === "application-error" ? 1 : 0
+        ensured.applicationReadiness?.status === "application-error" ? 1 : 0,
+        ensured.managedRuntime?.status === "ready" ? ensured.profile : void 0,
+        { ok: true, value: ensured }
       );
       return ensured;
     });
     result = { ok: true, value };
   } catch (error) {
     try {
-      if (error instanceof ExecutionOutcomeError) recordLifecycleOutcome(error.outcome);
-      else recordLifecycleUnknown();
+      const failure = {
+        ok: false,
+        message: error instanceof Error ? error.message : String(error)
+      };
+      if (error instanceof ExecutionOutcomeError) recordLifecycleOutcome(error.outcome, failure);
+      else recordLifecycleUnknown(failure);
     } catch {
     }
     result = { ok: false, message: error instanceof Error ? error.message : String(error) };