@devrouter/cli 0.0.67 → 0.0.69

package/dist/devrouter-lifecycle-worker.js

@@ -23,8 +23,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/core/devpod-exec.ts
-var import_node_child_process28 = require("child_process");
-var import_node_crypto17 = require("crypto");
+var import_node_child_process29 = require("child_process");
+var import_node_crypto21 = require("crypto");
 
 // src/core/devpod-environment.ts
 var import_node_child_process3 = require("child_process");
@@ -141,35 +141,56 @@ function isProcessAlive(pid) {
     return error.code === "EPERM";
   }
 }
-function processBirthIdentity(pid) {
+function processBirthIdentityWithCause(pid) {
+  const causeParts = [];
   try {
     const stat = import_node_fs2.default.readFileSync(`/proc/${pid}/stat`, "utf-8");
     const commandEnd = stat.lastIndexOf(")");
     if (commandEnd >= 0) {
-      const fields = stat.slice(commandEnd + 1).trim().split(/\s+/);
-      const startTime = fields[19];
-      if (startTime) return `proc:${startTime}`;
+      const fields2 = stat.slice(commandEnd + 1).trim().split(/\s+/);
+      const startTime = fields2[19];
+      if (startTime) return { identity: `proc:${startTime}` };
+      causeParts.push(`procfs /proc/${pid}/stat had no start-time field`);
     }
-  } catch {
+  } catch (error) {
+    const code = error.code;
+    if (code !== "ENOENT")
+      causeParts.push(`procfs /proc/${pid}/stat read failed (${code ?? "unknown"})`);
   }
   const result = (0, import_node_child_process.spawnSync)("ps", ["-o", "lstart=", "-o", "command=", "-p", String(pid)], {
     encoding: "utf-8",
     env: { ...process.env, LC_ALL: "C" }
   });
-  const startedAt = result.status === 0 ? result.stdout.trim().replace(/\s+/g, " ") : "";
-  return startedAt ? `ps:${(0, import_node_crypto2.createHash)("sha256").update(startedAt).digest("hex")}` : void 0;
+  if (result.error) {
+    causeParts.push(
+      `ps spawn failed (${result.error.code ?? result.error.message})`
+    );
+  } else if (result.status !== 0) {
+    causeParts.push(
+      result.status === null && result.signal ? `ps was killed by signal ${result.signal}` : `ps exited with status ${result.status}` + (result.signal ? ` on ${result.signal}` : "")
+    );
+  } else {
+    const startedAt = result.stdout.trim().replace(/\s+/g, " ");
+    if (startedAt)
+      return { identity: `ps:${(0, import_node_crypto2.createHash)("sha256").update(startedAt).digest("hex")}` };
+    causeParts.push(`ps produced no start time for pid ${pid}`);
+  }
+  return { cause: causeParts.join("; ") };
+}
+function processBirthIdentity(pid) {
+  return processBirthIdentityWithCause(pid).identity;
 }
 function parseLockOwner(value) {
-  const fields = value.split(":");
-  const pid = Number(fields[0]);
+  const fields2 = value.split(":");
+  const pid = Number(fields2[0]);
   if (!Number.isInteger(pid) || pid <= 0) return void 0;
-  if (fields.length !== 3 || !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(fields[2])) {
+  if (fields2.length !== 3 || !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(fields2[2])) {
     return { pid };
   }
   try {
-    const processBirth = Buffer.from(fields[1], "base64url").toString("utf-8");
+    const processBirth = Buffer.from(fields2[1], "base64url").toString("utf-8");
     const canonical = Buffer.from(processBirth).toString("base64url");
-    return canonical === fields[1] && /^(proc|ps):/.test(processBirth) ? { pid, processBirth } : { pid };
+    return canonical === fields2[1] && /^(proc|ps):/.test(processBirth) ? { pid, processBirth } : { pid };
   } catch {
     return { pid };
   }
@@ -282,14 +303,15 @@ function tryReclaimStaleLock(lockPath, staleLinkPath, livenessCache) {
   }
 }
 function acquireFileLock(lockPath, options) {
-  const processBirth = processBirthIdentity(process.pid);
-  if (!processBirth) {
+  const processBirth = processBirthIdentityWithCause(process.pid);
+  const birthIdentity = processBirth.identity;
+  if (!birthIdentity) {
     throw new Error(
-      `could not determine process identity for ${options.activity} lock: process inspection may be unavailable or sandbox-denied; run the canonical command in a permitted host context`
+      `could not determine process identity for ${options.activity} lock at ${lockPath}: ${processBirth.cause ?? "process inspection returned no result"}. process inspection may be unavailable or denied by the execution sandbox; verify with LC_ALL=C ps -o lstart= -o command= -p <any-live-pid> and, if that fails with an operation-not-permitted error, run the canonical command in a permitted host context outside the sandbox. the lock stays fail-closed; no identity fallback was attempted.`
     );
   }
   const ownerId = (0, import_node_crypto2.randomUUID)();
-  const owner = `${process.pid}:${Buffer.from(processBirth).toString("base64url")}:${ownerId}`;
+  const owner = `${process.pid}:${Buffer.from(birthIdentity).toString("base64url")}:${ownerId}`;
   const candidatePath = `${lockPath}.${process.pid}.${ownerId}.candidate`;
   const staleLinkPath = `${candidatePath}.stale`;
   const enqueuedAtMs = Date.now();
@@ -811,7 +833,7 @@ function requireSameContainerPopulation(expected, actual) {
     throw new Error("Managed stop Docker inspection observed a changed population.");
   }
   const expectedSet = new Set(expected);
-  if (actual.some((id3) => !expectedSet.has(id3))) {
+  if (actual.some((id5) => !expectedSet.has(id5))) {
     throw new Error("Managed stop Docker inspection observed a changed population.");
   }
 }
@@ -849,7 +871,7 @@ function inspectWorkspaceContainers(options) {
         `docker ps failed: ${(listed.stderr || listed.stdout || listed.error?.message || "unknown error").trim()}`
       );
     }
-    ids2 = listed.stdout.split(/\r?\n/).map((id3) => id3.trim()).filter(Boolean);
+    ids2 = listed.stdout.split(/\r?\n/).map((id5) => id5.trim()).filter(Boolean);
   }
   if (ids2.length === 0) return [];
   const template = options?.withSize ? SIZE_INSPECT_TEMPLATE : SAFE_INSPECT_TEMPLATE;
@@ -1024,10 +1046,10 @@ function inspectManagedStopWorkspaceIds(endpoint, composeDirectory) {
   assertUniqueContainerIds(ids2);
   return ids2;
 }
-function hasExactManagedStopMissingObjectError(stderr, id3) {
+function hasExactManagedStopMissingObjectError(stderr, id5) {
   if (typeof stderr !== "string") return false;
   const line = stderr.endsWith("\r\n") ? stderr.slice(0, -2) : stderr.endsWith("\n") ? stderr.slice(0, -1) : stderr;
-  return line.toLowerCase() === `error: no such object: ${id3}`;
+  return line.toLowerCase() === `error: no such object: ${id5}`;
 }
 function assertManagedStopContainersAbsent(endpoint, ids2) {
   assertManagedStopEndpoint(endpoint);
@@ -1039,14 +1061,14 @@ function assertManagedStopContainersAbsent(endpoint, ids2) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  for (const id3 of ids2) {
-    const result = (0, import_node_child_process3.spawnSync)("docker", ["--host", endpoint, "inspect", "--format", "{{.Id}}", id3], {
+  for (const id5 of ids2) {
+    const result = (0, import_node_child_process3.spawnSync)("docker", ["--host", endpoint, "inspect", "--format", "{{.Id}}", id5], {
       env,
       encoding: "utf-8",
       timeout: MANAGED_STOP_DOCKER_TIMEOUT_MS,
       maxBuffer: MANAGED_STOP_DOCKER_MAX_BUFFER
     });
-    if (result.status !== 1 || result.error || result.signal || result.stdout !== "" && result.stdout !== "\n" && result.stdout !== "\r\n" || !hasExactManagedStopMissingObjectError(result.stderr, id3)) {
+    if (result.status !== 1 || result.error || result.signal || result.stdout !== "" && result.stdout !== "\n" && result.stdout !== "\r\n" || !hasExactManagedStopMissingObjectError(result.stderr, id5)) {
       throw new Error("Managed stop Docker inspection did not prove container absence.");
     }
   }
@@ -1747,7 +1769,7 @@ function selectDevpodWorkspace(workspaces, repoPath) {
 }
 
 // src/core/devsy-exec.ts
-var import_node_child_process27 = require("child_process");
+var import_node_child_process28 = require("child_process");
 
 // src/core/devsy-exec-proof.ts
 var import_node_fs6 = __toESM(require("fs"));
@@ -1836,7 +1858,7 @@ function revalidateDevsyExecProof(repoPath, proof) {
 
 // src/core/devsy-mutation.ts
 var import_node_child_process15 = require("child_process");
-var import_node_fs19 = __toESM(require("fs"));
+var import_node_fs20 = __toESM(require("fs"));
 var import_node_path24 = __toESM(require("path"));
 
 // src/core/devsy-agent.ts
@@ -1996,6 +2018,7 @@ function requireReadyDevsyAgent(options = {}) {
 }
 
 // src/core/managed-devsy-stop.ts
+var import_node_fs16 = __toESM(require("fs"));
 var import_node_os4 = __toESM(require("os"));
 var import_node_path20 = __toESM(require("path"));
 var import_node_util4 = require("util");
@@ -2473,7 +2496,7 @@ function stopExactManagedService(containerId, service, options) {
 var import_node_fs10 = __toESM(require("fs"));
 var import_node_path12 = __toESM(require("path"));
 function proveManagedComposePopulation(options) {
-  const { plan, repoPath, composeProject, featureDirectory, devsyRoot, containers } = options;
+  const { plan, repoPath, composeProject, providerRoot, featureDirectory, containers } = options;
   const services = /* @__PURE__ */ new Set();
   for (const container of containers) {
     const service = container.labels["com.docker.compose.service"] ?? "";
@@ -2491,7 +2514,7 @@ function proveManagedComposePopulation(options) {
     for (const file of files.slice(plan.composeFiles.length)) {
       if (import_node_path12.default.dirname(file) !== featureDirectory || !/^docker-compose\.devcontainer\.containerFeatures-[a-zA-Z0-9_-]+\.yml$/.test(
         import_node_path12.default.basename(file)
-      ) || import_node_fs10.default.realpathSync(file) !== import_node_path12.default.join(import_node_fs10.default.realpathSync(devsyRoot), import_node_path12.default.relative(devsyRoot, file))) {
+      ) || import_node_fs10.default.realpathSync(file) !== import_node_path12.default.join(import_node_fs10.default.realpathSync(providerRoot), import_node_path12.default.relative(providerRoot, file))) {
         throw new Error("Managed stop refuses a foreign or escaped provider Compose file.");
       }
     }
@@ -3220,8 +3243,8 @@ function managedRunnerId(uid, providerId) {
   if (uid === void 0) {
     return providerId;
   }
-  const bytes = Buffer.byteLength(uid);
-  return bytes === 16 || bytes === 40 ? uid : providerId;
+  const bytes2 = Buffer.byteLength(uid);
+  return bytes2 === 16 || bytes2 === 40 ? uid : providerId;
 }
 function identityOf(value) {
   return {
@@ -3309,7 +3332,7 @@ function captureManagedStopBaseline(state, plan, primaryId, expectedEndpoint) {
     repoPath: state.repoPath,
     composeProject: state.composeProject,
     featureDirectory,
-    devsyRoot,
+    providerRoot: devsyRoot,
     containers
   });
   if (primary.id !== primaryId)
@@ -3413,7 +3436,7 @@ function proveReplacementStopAbsence(state, baseline, replacement) {
   const newRunner = managedRunnerId(before.uid, baseline.providerId);
   const runners = oldRunner === newRunner ? [oldRunner] : [oldRunner, newRunner];
   const assertEmptyPopulation = () => {
-    if (inspectManagedStopContainers(baseline.project, baseline.endpoint).length !== 0 || inspectManagedStopWorkspaceIds(baseline.endpoint, baseline.composeDirectory).length !== 0 || runners.some((id3) => inspectProviderRunnerContainers(baseline.endpoint, id3).length !== 0))
+    if (inspectManagedStopContainers(baseline.project, baseline.endpoint).length !== 0 || inspectManagedStopWorkspaceIds(baseline.endpoint, baseline.composeDirectory).length !== 0 || runners.some((id5) => inspectProviderRunnerContainers(baseline.endpoint, id5).length !== 0))
       throw new Error("Replacement stop observed a remaining workspace population.");
   };
   assertEmptyPopulation();
@@ -3496,6 +3519,7 @@ function managedStopRouteReferences(state) {
 }
 
 // src/core/repo-config.ts
+var import_node_crypto7 = require("crypto");
 var import_node_fs14 = __toESM(require("fs"));
 var import_node_path18 = __toESM(require("path"));
 var import_yaml3 = __toESM(require("yaml"));
@@ -3858,10 +3882,10 @@ function replaceHostRoutesForRepo(repoPath, inputs) {
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const replacements = inputs.map((input) => {
-      const id3 = buildHostRouteId(input.repoPath, input.name);
+      const id5 = buildHostRouteId(input.repoPath, input.name);
       return hostRouteFromInput(
         input,
-        routes.find((route) => route.id === id3),
+        routes.find((route) => route.id === id5),
         now
       );
     });
@@ -3903,6 +3927,10 @@ var VALID_HOSTNAME_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-
 var DEVROUTER_VERSION_RE = /^\d+\.\d+\.\d+$/;
 var VALID_ENV_NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/i;
 var VALID_ENV_VAR_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var MAX_CAPACITY_PROFILES = 256;
+var MAX_CAPACITY_OPERATIONS = 64;
+var MAX_CAPACITY_TRANSITIONS = 1024;
+var MAX_CAPACITY_NAME_LENGTH = 64;
 var UPSTREAM_TEMPLATE_RE = /^(?:\$\{WORKSPACE\}|[a-zA-Z0-9._-])+:\d{1,5}$/;
 function assertUpstreamSpec(upstream, label) {
   if (upstream.includes(WORKSPACE_PLACEHOLDER)) {
@@ -4458,11 +4486,265 @@ function parseManagedRuntime(value, configPath) {
     processes
   };
 }
+function parseCapacitySafeInteger(value, pathLabel, minimum) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || Object.is(value, -0)) {
+    throw new Error(`${pathLabel} must be a safe integer.`);
+  }
+  if (value < minimum) {
+    throw new Error(`${pathLabel} must be at least ${minimum}.`);
+  }
+  return value;
+}
+function parseCapacityName(value, pathLabel) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`${pathLabel} must be a non-empty string.`);
+  }
+  if (value !== value.trim()) {
+    throw new Error(`${pathLabel} must not have leading or trailing whitespace.`);
+  }
+  if (value.length > MAX_CAPACITY_NAME_LENGTH) {
+    throw new Error(
+      `${pathLabel} exceeds the maximum length of ${MAX_CAPACITY_NAME_LENGTH} characters.`
+    );
+  }
+  if ([...value].some(
+    (character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127
+  )) {
+    throw new Error(`${pathLabel} must not contain control characters.`);
+  }
+  return value;
+}
+function parseCapacityProfileKey(value, pathLabel, declaredProfiles) {
+  const key = parseCapacityName(value, pathLabel);
+  if (key === "full") return key;
+  const names = key.split(",");
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, name] of names.entries()) {
+    if (!PROFILE_NAME_RE.test(name)) {
+      throw new Error(`${pathLabel}[${index}] is not a valid profile name.`);
+    }
+    if (seen.has(name)) {
+      throw new Error(`${pathLabel} contains duplicate profile '${name}'.`);
+    }
+    if (!declaredProfiles || !Object.hasOwn(declaredProfiles, name)) {
+      throw new Error(`${pathLabel} references undefined profile '${name}'.`);
+    }
+    seen.add(name);
+  }
+  return [...names].sort().join(",");
+}
+function parseCapacityDimension(value, pathLabel, runtime) {
+  const dimension = ensureObject(value, pathLabel);
+  ensureAllowedKeys(dimension, ["steadyBytes", "startupTotalBytes"], pathLabel);
+  const minimum = runtime ? 1 : 0;
+  const steadyBytes = parseCapacitySafeInteger(
+    dimension.steadyBytes,
+    `${pathLabel}.steadyBytes`,
+    minimum
+  );
+  const startupTotalBytes = parseCapacitySafeInteger(
+    dimension.startupTotalBytes,
+    `${pathLabel}.startupTotalBytes`,
+    minimum
+  );
+  if (startupTotalBytes < steadyBytes) {
+    throw new Error(`${pathLabel}.startupTotalBytes must be at least steadyBytes.`);
+  }
+  return { steadyBytes, startupTotalBytes };
+}
+function parseCapacityOperation(value, pathLabel) {
+  const operation = ensureObject(value, pathLabel);
+  ensureAllowedKeys(operation, ["hostIncrementBytes", "runtimeIncrementBytes"], pathLabel);
+  return {
+    hostIncrementBytes: parseCapacitySafeInteger(
+      operation.hostIncrementBytes,
+      `${pathLabel}.hostIncrementBytes`,
+      0
+    ),
+    runtimeIncrementBytes: parseCapacitySafeInteger(
+      operation.runtimeIncrementBytes,
+      `${pathLabel}.runtimeIncrementBytes`,
+      0
+    )
+  };
+}
+function parseCapacityOperations(value, pathLabel) {
+  const rawOperations = ensureObject(value, pathLabel);
+  const operationEntries = Object.entries(rawOperations);
+  if (operationEntries.length === 0) {
+    throw new Error(`${pathLabel} must define at least one named operation.`);
+  }
+  if (operationEntries.length > MAX_CAPACITY_OPERATIONS) {
+    throw new Error(`${pathLabel} exceeds the maximum of ${MAX_CAPACITY_OPERATIONS} operations.`);
+  }
+  const operations = {};
+  for (const [operationName, operationValue] of operationEntries) {
+    const name = parseCapacityName(operationName, `${pathLabel} key`);
+    if (!/^[a-z][a-z0-9._-]*$/.test(name)) {
+      throw new Error(`${pathLabel}.${operationName} is not a valid operation name.`);
+    }
+    operations[name] = parseCapacityOperation(operationValue, `${pathLabel}.${operationName}`);
+  }
+  return operations;
+}
+function parseCapacityTransition(value, pathLabel) {
+  const transition2 = ensureObject(value, pathLabel);
+  ensureAllowedKeys(transition2, ["hostTotalBytes", "runtimeTotalBytes"], pathLabel);
+  return {
+    hostTotalBytes: parseCapacitySafeInteger(
+      transition2.hostTotalBytes,
+      `${pathLabel}.hostTotalBytes`,
+      0
+    ),
+    runtimeTotalBytes: parseCapacitySafeInteger(
+      transition2.runtimeTotalBytes,
+      `${pathLabel}.runtimeTotalBytes`,
+      1
+    )
+  };
+}
+function parseCapacityEstimates(value, configPath, declaredProfiles) {
+  if (value === void 0) return void 0;
+  const pathLabel = `${configPath}.capacity`;
+  const capacity = ensureObject(value, pathLabel);
+  ensureAllowedKeys(capacity, ["version", "profiles", "transitions"], pathLabel);
+  const version = parseCapacitySafeInteger(capacity.version, `${pathLabel}.version`, 1);
+  if (version !== 1) {
+    throw new Error(`${pathLabel}.version must be 1.`);
+  }
+  const rawProfiles = ensureObject(capacity.profiles, `${pathLabel}.profiles`);
+  const profileEntries = Object.entries(rawProfiles);
+  if (profileEntries.length === 0) {
+    throw new Error(`${pathLabel}.profiles must define at least one exact profile combination.`);
+  }
+  if (profileEntries.length > MAX_CAPACITY_PROFILES) {
+    throw new Error(
+      `${pathLabel}.profiles exceeds the maximum of ${MAX_CAPACITY_PROFILES} combinations.`
+    );
+  }
+  const profiles = {};
+  for (const [rawKey, profileValue] of profileEntries) {
+    const profileKey = parseCapacityProfileKey(
+      rawKey,
+      `${pathLabel}.profiles key`,
+      declaredProfiles
+    );
+    if (Object.hasOwn(profiles, profileKey)) {
+      throw new Error(
+        `${pathLabel}.profiles contains aliases for the same exact combination '${profileKey}'.`
+      );
+    }
+    const profile = ensureObject(profileValue, `${pathLabel}.profiles.${rawKey}`);
+    ensureAllowedKeys(
+      profile,
+      ["host", "runtime", "operations"],
+      `${pathLabel}.profiles.${rawKey}`
+    );
+    profiles[profileKey] = {
+      host: parseCapacityDimension(profile.host, `${pathLabel}.profiles.${rawKey}.host`, false),
+      runtime: parseCapacityDimension(
+        profile.runtime,
+        `${pathLabel}.profiles.${rawKey}.runtime`,
+        true
+      ),
+      operations: parseCapacityOperations(
+        profile.operations,
+        `${pathLabel}.profiles.${rawKey}.operations`
+      )
+    };
+  }
+  let transitions;
+  if (capacity.transitions !== void 0) {
+    const rawTransitions = ensureObject(capacity.transitions, `${pathLabel}.transitions`);
+    const transitionEntries = Object.entries(rawTransitions);
+    if (transitionEntries.length === 0) {
+      throw new Error(`${pathLabel}.transitions must define at least one transition.`);
+    }
+    transitions = {};
+    let transitionCount = 0;
+    for (const [rawSource, targetValue] of transitionEntries) {
+      const source = parseCapacityProfileKey(
+        rawSource,
+        `${pathLabel}.transitions source key`,
+        declaredProfiles
+      );
+      if (!Object.hasOwn(profiles, source)) {
+        throw new Error(
+          `${pathLabel}.transitions source '${source}' must have a profile estimate.`
+        );
+      }
+      if (Object.hasOwn(transitions, source)) {
+        throw new Error(`${pathLabel}.transitions contains aliases for source '${source}'.`);
+      }
+      const rawTargets = ensureObject(targetValue, `${pathLabel}.transitions.${rawSource}`);
+      const targetEntries = Object.entries(rawTargets);
+      if (targetEntries.length === 0) {
+        throw new Error(`${pathLabel}.transitions.${rawSource} must define a target.`);
+      }
+      const targets = {};
+      for (const [rawTarget, transitionValue] of targetEntries) {
+        transitionCount += 1;
+        if (transitionCount > MAX_CAPACITY_TRANSITIONS) {
+          throw new Error(
+            `${pathLabel}.transitions exceeds the maximum of ${MAX_CAPACITY_TRANSITIONS} entries.`
+          );
+        }
+        const target = parseCapacityProfileKey(
+          rawTarget,
+          `${pathLabel}.transitions.${rawSource} target key`,
+          declaredProfiles
+        );
+        if (!Object.hasOwn(profiles, target)) {
+          throw new Error(
+            `${pathLabel}.transitions target '${target}' must have a profile estimate.`
+          );
+        }
+        if (Object.hasOwn(targets, target)) {
+          throw new Error(
+            `${pathLabel}.transitions.${rawSource} contains aliases for '${target}'.`
+          );
+        }
+        const transition2 = parseCapacityTransition(
+          transitionValue,
+          `${pathLabel}.transitions.${rawSource}.${rawTarget}`
+        );
+        const sourceProfile = profiles[source];
+        const targetProfile = profiles[target];
+        if (transition2.hostTotalBytes < Math.max(sourceProfile.host.steadyBytes, targetProfile.host.steadyBytes)) {
+          throw new Error(
+            `${pathLabel}.transitions.${rawSource}.${rawTarget}.hostTotalBytes must cover both steady host estimates.`
+          );
+        }
+        if (transition2.runtimeTotalBytes < Math.max(sourceProfile.runtime.steadyBytes, targetProfile.runtime.steadyBytes)) {
+          throw new Error(
+            `${pathLabel}.transitions.${rawSource}.${rawTarget}.runtimeTotalBytes must cover both steady runtime estimates.`
+          );
+        }
+        targets[target] = transition2;
+      }
+      transitions[source] = targets;
+    }
+  }
+  return {
+    version: 1,
+    profiles,
+    ...transitions ? { transitions } : {}
+  };
+}
 function parseConfig(raw, configPath) {
   const root = ensureObject(raw, configPath);
   ensureAllowedKeys(
     root,
-    ["version", "devrouter", "project", "secretManager", "managedRuntime", "profiles", "apps"],
+    [
+      "version",
+      "devrouter",
+      "project",
+      "secretManager",
+      "managedRuntime",
+      "profiles",
+      "capacity",
+      "apps"
+    ],
     configPath
   );
   const version = toIntegerOrThrow(root.version, `${configPath}.version`);
@@ -4534,6 +4816,7 @@ function parseConfig(raw, configPath) {
   }
   const managedRuntime = parseManagedRuntime(root.managedRuntime, configPath);
   const profiles = parseProfiles(root.profiles, configPath, apps, managedRuntime);
+  const capacity = parseCapacityEstimates(root.capacity, configPath, profiles);
   return {
     version: 1,
     ...devrouter ? { devrouter } : {},
@@ -4541,6 +4824,7 @@ function parseConfig(raw, configPath) {
     ...secretManager ? { secretManager } : {},
     ...managedRuntime ? { managedRuntime } : {},
     ...profiles ? { profiles } : {},
+    ...capacity ? { capacity } : {},
     apps
   };
 }
@@ -4875,7 +5159,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs14.default.rea
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.67" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.69" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -5054,7 +5338,7 @@ async function ensureNetwork(name) {
 
 // src/core/tls.ts
 var import_node_child_process13 = require("child_process");
-var import_node_crypto7 = require("crypto");
+var import_node_crypto8 = require("crypto");
 var import_node_fs15 = __toESM(require("fs"));
 var import_node_path19 = __toESM(require("path"));
 var DEFAULT_TLS_CERT_HOSTS = ["localhost", "*.localhost"];
@@ -5124,7 +5408,7 @@ function parseDnsHostsFromSubjectAltName(subjectAltName) {
   return normalizeUniqueHosts(names);
 }
 function parseCertificateDnsHosts(pem) {
-  const certificate = new import_node_crypto7.X509Certificate(pem);
+  const certificate = new import_node_crypto8.X509Certificate(pem);
   const subjectAltName = certificate.subjectAltName ?? "";
   if (subjectAltName.length === 0) {
     return [];
@@ -5399,12 +5683,108 @@ function containerIdentity(container) {
     mounts: container.mounts.map((mount) => JSON.stringify(mount)).sort()
   });
 }
+function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
+  if (!import_node_fs16.default.existsSync(import_node_path20.default.join(repoPath, ".devrouter.yml"))) return false;
+  const linked = isLinkedWorktree(repoPath);
+  const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
+  const registration2 = () => {
+    resetWorkspaceRuntimeCaches();
+    if (resolveWorkspaceRuntimeOrDefault(repoPath) !== "devsy")
+      throw new Error("Initial managed stop provider selection changed.");
+    const owner2 = inspectDevsyWorkspaceOwnership(listDevsyWorkspaces(), devsyId, repoPath);
+    if (owner2.status !== "owned")
+      throw new Error("Initial managed stop requires one exact Devsy registration.");
+    if (linked) {
+      const record5 = workspace ? readWorkspaceOwnership(repoPath, workspace) : void 0;
+      if (!record5 || record5.devpodId !== devsyId || !sameWorkspacePath(record5.worktreePath, repoPath) || resolveWorktreeWorkspace(repoPath) !== workspace)
+        throw new Error("Initial managed stop workspace ownership changed.");
+    }
+    return owner2.workspace;
+  };
+  const runtime = loadRuntimeConfig(repoPath, workspace ?? "");
+  if (!runtime.config.managedRuntime) return false;
+  const owner = registration2();
+  if (!owner.context || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(owner.context) || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(devsyId))
+    throw new Error("Initial managed stop requires exact provider context.");
+  const plan = inspectManagedDevcontainerConfig({
+    repoPath,
+    config: runtime.config,
+    profile: runtime.resolvedProfile,
+    linked
+  });
+  const providerRoot = import_node_path20.default.resolve(process.env.DEVSY_HOME || import_node_path20.default.join(import_node_os4.default.homedir(), ".devsy"));
+  const featureDirectory = import_node_path20.default.join(
+    providerRoot,
+    "contexts",
+    owner.context,
+    "workspaces",
+    devsyId,
+    "agent",
+    ".docker-compose"
+  );
+  const observe = () => {
+    if (!(0, import_node_util4.isDeepStrictEqual)(registration2(), owner) || readManagedRuntimeState(repoPath, workspace))
+      throw new Error("Initial managed stop ownership or runtime state changed.");
+    const matches = inspectWorkspaceContainers().filter(
+      (c) => sameWorkspacePath(
+        c.labels["com.docker.compose.project.working_dir"] ?? "",
+        plan.composeDirectory
+      )
+    );
+    if (!matches.length) return [];
+    const projects = new Set(matches.map((c) => c.labels["com.docker.compose.project"]));
+    if (projects.size !== 1 || !matches[0]?.labels["com.docker.compose.project"])
+      throw new Error("Initial managed stop requires one exact Compose project.");
+    const population = inspectManagedStopContainers(
+      matches[0].labels["com.docker.compose.project"]
+    );
+    if (!sameSet(
+      matches.map((c) => c.id),
+      population.map((c) => c.id)
+    ))
+      throw new Error("Initial managed stop population changed.");
+    proveManagedComposePopulation({
+      plan,
+      repoPath,
+      composeProject: matches[0].labels["com.docker.compose.project"],
+      providerRoot,
+      featureDirectory,
+      containers: population
+    });
+    return population;
+  };
+  const initial = observe();
+  const stable = () => {
+    const current = observe();
+    if (!sameSet(
+      initial.map((c) => c.id),
+      current.map((c) => c.id)
+    ) || current.some((c) => {
+      const prior = initial.find((p) => p.id === c.id);
+      return !prior || containerIdentity(prior) !== containerIdentity(c) || !prior.state.Running && c.state.Running;
+    }))
+      throw new Error("Initial managed stop population or identity changed.");
+    return current;
+  };
+  stable();
+  if (!initial.length) return false;
+  for (const container of initial) {
+    const current = stable().find((c) => c.id === container.id);
+    if (current?.state.Running)
+      stopExactManagedService(current.id, current.labels["com.docker.compose.service"] ?? "", {
+        timeoutMs: 3e4
+      });
+  }
+  if (stable().some((c) => c.state.Running))
+    throw new Error("Initial managed stop left a workload running.");
+  return true;
+}
 function stopRetainedManagedDevsyWorkspace(options) {
   const { repoPath, devsyId } = options;
   const linked = isLinkedWorktree(repoPath);
   const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
   const retainedState = readManagedRuntimeState(repoPath, workspace);
-  if (!retainedState) return false;
+  if (!retainedState) return stopInitialManagedDevsyWorkspace(repoPath, devsyId);
   const state = retainedState;
   if (state.devpodId !== devsyId || linked && !workspace) {
     throw new Error("Managed stop requires the exact retained workspace identity.");
@@ -5533,7 +5913,7 @@ function stopRetainedManagedDevsyWorkspace(options) {
       repoPath,
       composeProject: state.composeProject,
       featureDirectory,
-      devsyRoot,
+      providerRoot: devsyRoot,
       containers
     });
     if (previous && (!sameSet(
@@ -5633,13 +6013,13 @@ function networkProviderEnvironment(binding, source) {
 }
 
 // src/core/network-claim-lookup.ts
-var import_node_crypto9 = require("crypto");
-var import_node_fs18 = __toESM(require("fs"));
+var import_node_crypto10 = require("crypto");
+var import_node_fs19 = __toESM(require("fs"));
 var import_node_path23 = __toESM(require("path"));
 
 // src/core/network-claims.ts
-var import_node_crypto8 = require("crypto");
-var import_node_fs17 = __toESM(require("fs"));
+var import_node_crypto9 = require("crypto");
+var import_node_fs18 = __toESM(require("fs"));
 var import_node_path22 = __toESM(require("path"));
 
 // src/core/network-capacity.ts
@@ -5981,7 +6361,7 @@ function overlaps(left, right) {
 }
 
 // src/core/network-policy.ts
-var import_node_fs16 = __toESM(require("fs"));
+var import_node_fs17 = __toESM(require("fs"));
 var import_node_path21 = __toESM(require("path"));
 var NETWORK_POLICY_VERSION = 1;
 var NETWORK_POLICY_FILE = import_node_path21.default.join(DEVROUTER_HOME, "network-policy.json");
@@ -6177,7 +6557,7 @@ function hasControlCharacter(value) {
 function readPolicyFile(filePath) {
   let initialStats;
   try {
-    initialStats = import_node_fs16.default.lstatSync(filePath);
+    initialStats = import_node_fs17.default.lstatSync(filePath);
   } catch (error) {
     if (isErrno(error, "ENOENT")) return { status: "absent" };
     return { status: "invalid", error: "network policy could not be read" };
@@ -6190,16 +6570,16 @@ function readPolicyFile(filePath) {
   }
   let fileDescriptor;
   try {
-    fileDescriptor = import_node_fs16.default.openSync(
+    fileDescriptor = import_node_fs17.default.openSync(
       filePath,
-      import_node_fs16.default.constants.O_RDONLY | import_node_fs16.default.constants.O_NONBLOCK | (import_node_fs16.default.constants.O_NOFOLLOW ?? 0)
+      import_node_fs17.default.constants.O_RDONLY | import_node_fs17.default.constants.O_NONBLOCK | (import_node_fs17.default.constants.O_NOFOLLOW ?? 0)
     );
   } catch (error) {
     if (isErrno(error, "ENOENT")) return { status: "absent" };
     return { status: "invalid", error: "network policy could not be read" };
   }
   try {
-    const openedStats = import_node_fs16.default.fstatSync(fileDescriptor);
+    const openedStats = import_node_fs17.default.fstatSync(fileDescriptor);
     if (!openedStats.isFile()) {
       return { status: "invalid", error: "network policy must be a regular file" };
     }
@@ -6212,12 +6592,12 @@ function readPolicyFile(filePath) {
     const buffer = Buffer.alloc(openedStats.size);
     let offset = 0;
     while (offset < buffer.length) {
-      const bytesRead = import_node_fs16.default.readSync(fileDescriptor, buffer, offset, buffer.length - offset, null);
+      const bytesRead = import_node_fs17.default.readSync(fileDescriptor, buffer, offset, buffer.length - offset, null);
       if (bytesRead === 0)
         return { status: "invalid", error: "network policy changed during read" };
       offset += bytesRead;
     }
-    const finalStats = import_node_fs16.default.fstatSync(fileDescriptor);
+    const finalStats = import_node_fs17.default.fstatSync(fileDescriptor);
     if (!finalStats.isFile() || finalStats.size !== openedStats.size) {
       return { status: "invalid", error: "network policy changed during read" };
     }
@@ -6226,7 +6606,7 @@ function readPolicyFile(filePath) {
     return { status: "invalid", error: "network policy could not be read" };
   } finally {
     try {
-      import_node_fs16.default.closeSync(fileDescriptor);
+      import_node_fs17.default.closeSync(fileDescriptor);
     } catch {
     }
   }
@@ -6652,27 +7032,27 @@ function assertExactKeys(value, keys2) {
 function readDocument(store) {
   let descriptor;
   try {
-    descriptor = import_node_fs17.default.openSync(
+    descriptor = import_node_fs18.default.openSync(
       store.filePath,
-      import_node_fs17.default.constants.O_RDONLY | import_node_fs17.default.constants.O_NONBLOCK | (import_node_fs17.default.constants.O_NOFOLLOW ?? 0)
+      import_node_fs18.default.constants.O_RDONLY | import_node_fs18.default.constants.O_NONBLOCK | (import_node_fs18.default.constants.O_NOFOLLOW ?? 0)
     );
   } catch (error) {
     if (isErrno2(error, "ENOENT")) return void 0;
     throw claimError("invalid-state", "network claim state could not be read");
   }
   try {
-    const stat = import_node_fs17.default.fstatSync(descriptor);
+    const stat = import_node_fs18.default.fstatSync(descriptor);
     if (!stat.isFile() || stat.size > NETWORK_CLAIMS_MAX_FILE_BYTES || (stat.mode & 63) !== 0) {
       throw claimError("invalid-state", "network claim state is not a bounded private file");
     }
     const buffer = Buffer.alloc(NETWORK_CLAIMS_MAX_FILE_BYTES + 1);
     let count = 0;
     while (count < buffer.length) {
-      const bytesRead = import_node_fs17.default.readSync(descriptor, buffer, count, buffer.length - count, null);
+      const bytesRead = import_node_fs18.default.readSync(descriptor, buffer, count, buffer.length - count, null);
       if (bytesRead === 0) break;
       count += bytesRead;
     }
-    const finalStat = import_node_fs17.default.fstatSync(descriptor);
+    const finalStat = import_node_fs18.default.fstatSync(descriptor);
     if (count > NETWORK_CLAIMS_MAX_FILE_BYTES || finalStat.size !== stat.size) {
       throw claimError("invalid-state", "network claim state changed during read");
     }
@@ -6684,7 +7064,7 @@ function readDocument(store) {
     }
     return validateDocument(parsed, store.daemonId);
   } finally {
-    import_node_fs17.default.closeSync(descriptor);
+    import_node_fs18.default.closeSync(descriptor);
   }
 }
 function validateDocument(value, daemonId) {
@@ -6788,7 +7168,7 @@ function withStoreLock(daemonId, options, operation) {
   if (!Number.isSafeInteger(waitMs) || waitMs < 0 || waitMs > MAX_LOCK_WAIT_MS) {
     throw claimError("invalid-input", "network claim lock wait is invalid");
   }
-  import_node_fs17.default.mkdirSync(store.root, { recursive: true, mode: 448 });
+  import_node_fs18.default.mkdirSync(store.root, { recursive: true, mode: 448 });
   assertDirectory(store.root);
   return withFileLockSync(
     store.lockPath,
@@ -6819,7 +7199,7 @@ function validateRoot(root) {
 function assertDirectory(directory) {
   let stat;
   try {
-    stat = import_node_fs17.default.lstatSync(directory);
+    stat = import_node_fs18.default.lstatSync(directory);
   } catch {
     throw claimError("invalid-state", "network claim root could not be read");
   }
@@ -6828,7 +7208,7 @@ function assertDirectory(directory) {
   }
 }
 function hashKey(value) {
-  return (0, import_node_crypto8.createHash)("sha256").update(value).digest("hex");
+  return (0, import_node_crypto9.createHash)("sha256").update(value).digest("hex");
 }
 function cloneFence(fence) {
   return { ...fence };
@@ -6856,12 +7236,12 @@ function claimError(code, message) {
 function networkOwnerKey(repoPath) {
   if (!import_node_path23.default.isAbsolute(repoPath) || import_node_path23.default.resolve(repoPath) !== repoPath)
     throw new Error("Invalid network owner path.");
-  return (0, import_node_crypto9.createHash)("sha256").update(repoPath).digest("hex");
+  return (0, import_node_crypto10.createHash)("sha256").update(repoPath).digest("hex");
 }
 function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   let names;
   try {
-    names = import_node_fs18.default.readdirSync(root);
+    names = import_node_fs19.default.readdirSync(root);
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw new Error("Network claims cannot be inspected; repair is required.");
@@ -6871,32 +7251,32 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   let found;
   for (const file of files) {
     const full = import_node_path23.default.join(root, file);
-    const stat = import_node_fs18.default.lstatSync(full);
+    const stat = import_node_fs19.default.lstatSync(full);
     if (!stat.isFile() || stat.size > NETWORK_CLAIMS_MAX_FILE_BYTES)
       throw new Error("Invalid retained network claim file.");
     let value;
-    const descriptor = import_node_fs18.default.openSync(
+    const descriptor = import_node_fs19.default.openSync(
       full,
-      import_node_fs18.default.constants.O_RDONLY | import_node_fs18.default.constants.O_NONBLOCK | import_node_fs18.default.constants.O_NOFOLLOW
+      import_node_fs19.default.constants.O_RDONLY | import_node_fs19.default.constants.O_NONBLOCK | import_node_fs19.default.constants.O_NOFOLLOW
     );
     try {
-      if (!import_node_fs18.default.fstatSync(descriptor).isFile()) throw new Error();
-      const bytes = Buffer.alloc(NETWORK_CLAIMS_MAX_FILE_BYTES + 1);
+      if (!import_node_fs19.default.fstatSync(descriptor).isFile()) throw new Error();
+      const bytes2 = Buffer.alloc(NETWORK_CLAIMS_MAX_FILE_BYTES + 1);
       let size = 0;
-      while (size < bytes.length) {
-        const count = import_node_fs18.default.readSync(descriptor, bytes, size, bytes.length - size, null);
+      while (size < bytes2.length) {
+        const count = import_node_fs19.default.readSync(descriptor, bytes2, size, bytes2.length - size, null);
         if (!count) break;
         size += count;
       }
       if (size > NETWORK_CLAIMS_MAX_FILE_BYTES) throw new Error();
-      value = JSON.parse(bytes.subarray(0, size).toString("utf8"));
+      value = JSON.parse(bytes2.subarray(0, size).toString("utf8"));
       if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error();
     } catch {
       throw new Error("Retained network claim could not be read safely.");
     } finally {
-      import_node_fs18.default.closeSync(descriptor);
+      import_node_fs19.default.closeSync(descriptor);
     }
-    if (typeof value.daemonId !== "string" || `${(0, import_node_crypto9.createHash)("sha256").update(value.daemonId).digest("hex")}.json` !== file)
+    if (typeof value.daemonId !== "string" || `${(0, import_node_crypto10.createHash)("sha256").update(value.daemonId).digest("hex")}.json` !== file)
       throw new Error("Retained network daemon identity is invalid.");
     const claim2 = readNetworkClaim({
       daemonId: value.daemonId,
@@ -6913,7 +7293,7 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
 
 // src/core/network-provider-inspect.ts
 var import_node_child_process14 = require("child_process");
-var import_node_crypto10 = require("crypto");
+var import_node_crypto11 = require("crypto");
 function object(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("Invalid provider evidence.");
@@ -6933,7 +7313,7 @@ function qualifyNetworkProviderDefinition(value, provider) {
   if (definition.name !== "docker" || ![true, "true"].includes(agent.local) || agent.driver !== void 0 && agent.driver !== "docker" && agent.driver !== "" || docker.path !== "${DOCKER_PATH}" || docker.builder !== "${DOCKER_BUILDER}" || ![false, "false"].includes(docker.install) || (provider === "devsy" ? docker.elevation !== "${DOCKER_ELEVATION}" : docker.elevation !== void 0 && docker.elevation !== "") || env.DOCKER_HOST !== "${DOCKER_HOST}" || Object.keys(env).some((key) => key !== "DOCKER_HOST") || host.global !== true || dockerPath.default !== "docker" || actualCommand.length !== 1 || typeof actualCommand[0] !== "string" || actualCommand[0].trim() !== command || Object.keys(exec).some((key) => key !== "command") || agent.path !== void 0 && agent.path !== "" || agent.downloadURL !== void 0 && agent.downloadURL !== "") {
     throw new Error("Docker provider definition is not qualified for network allocation.");
   }
-  return (0, import_node_crypto10.createHash)("sha256").update(JSON.stringify({ name: definition.name, agent, options, exec })).digest("hex");
+  return (0, import_node_crypto11.createHash)("sha256").update(JSON.stringify({ name: definition.name, agent, options, exec })).digest("hex");
 }
 function read(provider, args) {
   const result = (0, import_node_child_process14.spawnSync)(provider, args, {
@@ -6995,9 +7375,9 @@ function inspectNetworkProviderBinding(input) {
     const option = (key, localOnly = false) => {
       const value = localOnly ? stored[key] : stored[key] ?? settings[key];
       if (value === void 0) return null;
-      const text3 = object(value).value;
-      if (typeof text3 !== "string") throw new Error();
-      return text3 || null;
+      const text4 = object(value).value;
+      if (typeof text4 !== "string") throw new Error();
+      return text4 || null;
     };
     if (workspaceProvider && workspaceProvider.name !== "docker") throw new Error();
     if (option("DOCKER_ELEVATION") && option("DOCKER_ELEVATION") !== "none") throw new Error();
@@ -7064,7 +7444,7 @@ function failedStartMayHaveAttached(devsyId, repoPath) {
   }
 }
 function withMutationLock(activity, target, operation) {
-  import_node_fs19.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVSY_MUTATION_LOCK_FILE,
     {
@@ -7078,7 +7458,7 @@ function withMutationLock(activity, target, operation) {
   );
 }
 function withMutationLockAsync(activity, target, operation) {
-  import_node_fs19.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     DEVSY_MUTATION_LOCK_FILE,
     {
@@ -7197,12 +7577,12 @@ function deleteOwnedDevsyWorkspace(devsyId, worktreePath) {
 function assertDevsyTarget(devsyId, repoPath) {
   const workspaces = listDevsyWorkspaces();
   const existing = selectDevsyWorkspace(workspaces, repoPath);
-  const id3 = devsyId ?? existing?.id;
-  if (id3) {
-    const before = inspectDevsyWorkspaceOwnership(workspaces, id3, repoPath);
+  const id5 = devsyId ?? existing?.id;
+  if (id5) {
+    const before = inspectDevsyWorkspaceOwnership(workspaces, id5, repoPath);
     if (before.status === "conflict") throw new Error(before.reason);
   }
-  return id3;
+  return id5;
 }
 async function startDevsyWorkspace(options) {
   const activity = options.recreate ? "Devsy recreate" : "Devsy start";
@@ -7314,7 +7694,572 @@ var ExecutionOutcomeError = class extends Error {
 };
 
 // src/core/reliability-lifecycle.ts
-var import_node_path33 = __toESM(require("path"));
+var import_node_crypto20 = require("crypto");
+var import_node_path39 = __toESM(require("path"));
+var import_node_util6 = require("util");
+
+// src/core/capacity-accounting.ts
+function bytes(value) {
+  return Number.isSafeInteger(value) && value >= 0;
+}
+function evaluateCapacity(budgets, samples, charges, requested, nowMs, maxSampleAgeMs, pools = []) {
+  if (!bytes(nowMs) || !bytes(maxSampleAgeMs)) throw new Error("Invalid capacity sample clock.");
+  for (const domain of Object.keys(requested.totals).sort()) {
+    const fail2 = (reason2) => ({ admitted: false, domain, reason: reason2 });
+    const budget = budgets[domain];
+    const sample = samples[domain];
+    if (!budget || !sample || !bytes(budget.capacityBytes) || !bytes(budget.protectedHeadroomBytes) || budget.protectedHeadroomBytes >= budget.capacityBytes || !Number.isSafeInteger(budget.startupSlots) || budget.startupSlots < 1 || !Number.isSafeInteger(budget.heavySlots) || budget.heavySlots < 1 || !bytes(sample.unmanagedBytes) || !bytes(sample.sharedBytes) || !bytes(sample.sampledAtMs) || Object.values(sample.ownedBytes).some((value) => !bytes(value)) || !bytes(requested.totals[domain]))
+      return fail2("unknown");
+    if (sample.sampledAtMs > nowMs || nowMs - sample.sampledAtMs > maxSampleAgeMs)
+      return fail2("stale");
+    if (sample.pressure !== "normal")
+      return fail2(sample.pressure === "pressured" ? "pressure" : "unknown");
+    const totals = /* @__PURE__ */ new Map();
+    let startups = 0;
+    let heavy = 0;
+    for (const charge of charges) {
+      if (!Object.hasOwn(charge.totals, domain)) continue;
+      if (!bytes(charge.totals[domain]) || totals.has(charge.environmentId)) return fail2("unknown");
+      totals.set(charge.environmentId, charge.totals[domain]);
+      if (charge.environmentId !== requested.environmentId) {
+        if (charge.startup) startups++;
+        if (charge.heavy) heavy++;
+      }
+    }
+    totals.set(
+      requested.environmentId,
+      Math.max(totals.get(requested.environmentId) ?? 0, requested.totals[domain])
+    );
+    for (const [environment, observed] of Object.entries(sample.ownedBytes))
+      totals.set(environment, Math.max(totals.get(environment) ?? 0, observed));
+    let used = BigInt(sample.unmanagedBytes) + BigInt(sample.sharedBytes);
+    for (const total of totals.values()) used += BigInt(total);
+    for (const pool of pools) {
+      if (pool.hostDomain !== domain) continue;
+      if (!bytes(pool.hostChargeCeilingBytes)) return fail2("unknown");
+      used += BigInt(pool.hostChargeCeilingBytes);
+    }
+    if (used > BigInt(budget.capacityBytes) - BigInt(budget.protectedHeadroomBytes))
+      return fail2("memory");
+    const existing = charges.find((charge) => charge.environmentId === requested.environmentId);
+    if ((requested.startup || existing?.startup) && startups >= budget.startupSlots)
+      return fail2("startup-slot");
+    if ((requested.heavy || existing?.heavy) && heavy >= budget.heavySlots)
+      return fail2("heavy-slot");
+  }
+  if (Object.keys(requested.totals).length === 0)
+    throw new Error("Capacity request has no domains.");
+  return { admitted: true };
+}
+
+// src/core/capacity-policy.ts
+var import_node_fs21 = __toESM(require("fs"));
+var import_node_path25 = __toESM(require("path"));
+
+// src/core/capacity-store.ts
+var import_node_fs22 = __toESM(require("fs"));
+var import_node_path26 = __toESM(require("path"));
+var MAX_BYTES = 1048576;
+var CapacitySnapshotChangedError = class extends Error {
+  constructor() {
+    super("Capacity snapshot changed.");
+    this.name = "CapacitySnapshotChangedError";
+  }
+};
+function assertPrivateDirectory(directoryPath) {
+  import_node_fs22.default.mkdirSync(directoryPath, { recursive: true, mode: 448 });
+  const directory = import_node_fs22.default.lstatSync(directoryPath);
+  if (!directory.isDirectory() || directory.isSymbolicLink() || directory.uid !== process.getuid?.() || (directory.mode & 63) !== 0)
+    throw new Error("Capacity reservation directory is not private.");
+}
+function object2(value, fields2) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).length !== fields2.length || Object.keys(value).some((key) => !fields2.includes(key)))
+    throw new Error("Invalid capacity reservation fields.");
+}
+function id2(value) {
+  return typeof value === "string" && /^[a-zA-Z0-9_-]{1,128}$/.test(value);
+}
+function validatePools(value) {
+  if (!Array.isArray(value) || value.length > 256) throw new Error("Invalid capacity pools.");
+  const daemons = /* @__PURE__ */ new Set();
+  const runtimes = /* @__PURE__ */ new Set();
+  for (const pool of value) {
+    object2(pool, ["daemonId", "runtimeDomain", "hostDomain", "hostChargeCeilingBytes"]);
+    if (typeof pool.daemonId !== "string" || pool.daemonId.length === 0 || pool.daemonId.length > 256 || pool.daemonId !== pool.daemonId.trim() || [...pool.daemonId].some(
+      (character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127
+    ) || !id2(pool.runtimeDomain) || !id2(pool.hostDomain) || pool.runtimeDomain === pool.hostDomain || !Number.isSafeInteger(pool.hostChargeCeilingBytes) || Number(pool.hostChargeCeilingBytes) <= 0 || daemons.has(pool.daemonId) || runtimes.has(pool.runtimeDomain))
+      throw new Error("Invalid capacity pool identity or ceiling.");
+    daemons.add(pool.daemonId);
+    runtimes.add(pool.runtimeDomain);
+  }
+}
+function validate(value) {
+  const hasPools = !!value && typeof value === "object" && Object.hasOwn(value, "pools");
+  object2(value, ["version", "revision", "reservations", ...hasPools ? ["pools"] : []]);
+  if (hasPools) validatePools(value.pools);
+  if (value.version !== 1 || !Number.isSafeInteger(value.revision) || Number(value.revision) < 0 || !Array.isArray(value.reservations) || value.reservations.length > 256)
+    throw new Error("Invalid capacity reservation snapshot.");
+  const environments = /* @__PURE__ */ new Set();
+  const operations = /* @__PURE__ */ new Set();
+  const reservations = /* @__PURE__ */ new Set();
+  for (const reservation of value.reservations) {
+    object2(reservation, [
+      "environmentId",
+      "operationId",
+      "reservationId",
+      "policyRevision",
+      "totals",
+      "startup",
+      "heavy"
+    ]);
+    if (!id2(reservation.environmentId) || !id2(reservation.operationId) || !id2(reservation.reservationId) || !Number.isSafeInteger(reservation.policyRevision) || Number(reservation.policyRevision) < 1 || typeof reservation.startup !== "boolean" || typeof reservation.heavy !== "boolean" || environments.has(reservation.environmentId) || operations.has(reservation.operationId) || reservations.has(reservation.reservationId))
+      throw new Error("Invalid capacity reservation identity.");
+    environments.add(reservation.environmentId);
+    operations.add(reservation.operationId);
+    reservations.add(reservation.reservationId);
+    const totals = reservation.totals;
+    if (!totals || typeof totals !== "object" || Array.isArray(totals) || Object.keys(totals).length < 1 || Object.keys(totals).length > 256 || Object.entries(totals).some(
+      ([key, bytes2]) => !id2(key) || !Number.isSafeInteger(bytes2) || Number(bytes2) < 0
+    ))
+      throw new Error("Invalid capacity reservation totals.");
+  }
+}
+function mergePools(pools, incoming) {
+  let changed = false;
+  for (const requested of incoming) {
+    const retained = pools.find((pool) => pool.daemonId === requested.daemonId);
+    if (retained) {
+      if (retained.hostDomain !== requested.hostDomain || retained.runtimeDomain !== requested.runtimeDomain)
+        throw new Error("Capacity pool binding changed.");
+      if (requested.hostChargeCeilingBytes > retained.hostChargeCeilingBytes) {
+        retained.hostChargeCeilingBytes = requested.hostChargeCeilingBytes;
+        changed = true;
+      }
+    } else {
+      pools.push(structuredClone(requested));
+      changed = true;
+    }
+  }
+  validatePools(pools);
+  return changed;
+}
+function serializeSnapshot(snapshot) {
+  const contents = `${JSON.stringify(snapshot)}
+`;
+  if (Buffer.byteLength(contents) > MAX_BYTES)
+    throw new Error("Capacity reservation snapshot exceeds byte limit.");
+  return contents;
+}
+var CapacityStore = class {
+  constructor(directory) {
+    this.directory = directory;
+    this.file = import_node_path26.default.join(directory, "capacity-reservations.json");
+  }
+  file;
+  read() {
+    let descriptor;
+    try {
+      descriptor = import_node_fs22.default.openSync(this.file, import_node_fs22.default.constants.O_RDONLY | import_node_fs22.default.constants.O_NOFOLLOW);
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return { version: 1, revision: 0, reservations: [] };
+      throw error;
+    }
+    try {
+      const stat = import_node_fs22.default.fstatSync(descriptor);
+      if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0 || stat.size > MAX_BYTES)
+        throw new Error("Unsafe capacity reservation snapshot.");
+      const buffer = Buffer.alloc(MAX_BYTES + 1);
+      const count = import_node_fs22.default.readSync(descriptor, buffer, 0, buffer.length, 0);
+      if (count > MAX_BYTES) throw new Error("Capacity reservation snapshot exceeds byte limit.");
+      const value = JSON.parse(buffer.subarray(0, count).toString("utf8"));
+      validate(value);
+      return value;
+    } finally {
+      import_node_fs22.default.closeSync(descriptor);
+    }
+  }
+  /**
+   * Caller must revoke journal authority and prove exact physical cessation first.
+   * An absent reservation still advances the revision to fence that proof.
+   */
+  settleEnvironmentAfterStop(environmentId, expectedRevision) {
+    if (!id2(environmentId)) throw new Error("Invalid capacity environment ID.");
+    if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 0)
+      throw new Error("Invalid capacity settlement revision.");
+    assertPrivateDirectory(this.directory);
+    return withFileLockSync(
+      `${this.file}.lock`,
+      { activity: "capacity settlement", waitMs: 100 },
+      () => {
+        const snapshot = this.read();
+        if (snapshot.revision !== expectedRevision) throw new CapacitySnapshotChangedError();
+        if (snapshot.revision === Number.MAX_SAFE_INTEGER)
+          throw new Error("Capacity reservation revision exhausted.");
+        const index = snapshot.reservations.findIndex(
+          (entry) => entry.environmentId === environmentId
+        );
+        if (index >= 0) snapshot.reservations.splice(index, 1);
+        snapshot.revision++;
+        validate(snapshot);
+        writeFileAtomically(this.file, serializeSnapshot(snapshot));
+        return { settled: index >= 0, revision: snapshot.revision };
+      }
+    );
+  }
+  /** Retain positively observed pools even when their charge already exceeds admission budgets. */
+  mergeObservedPools(pools, expectedRevision) {
+    validatePools(pools);
+    if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 0)
+      throw new Error("Invalid capacity expected revision.");
+    assertPrivateDirectory(this.directory);
+    return withFileLockSync(
+      `${this.file}.lock`,
+      { activity: "capacity pool observation", waitMs: 100 },
+      () => {
+        const snapshot = this.read();
+        if (snapshot.revision !== expectedRevision) throw new CapacitySnapshotChangedError();
+        const merged = structuredClone(snapshot.pools ?? []);
+        if (!mergePools(merged, pools)) return { changed: false, revision: snapshot.revision };
+        if (snapshot.revision === Number.MAX_SAFE_INTEGER)
+          throw new Error("Capacity reservation revision exhausted.");
+        snapshot.pools = merged;
+        snapshot.revision++;
+        validate(snapshot);
+        writeFileAtomically(this.file, serializeSnapshot(snapshot));
+        return { changed: true, revision: snapshot.revision };
+      }
+    );
+  }
+  /**
+   * Caller must revoke pool launch authority and prove exact VM cessation first.
+   * Container or environment cessation alone never permits releasing this ceiling.
+   */
+  settlePoolAfterCessation(identity2, expectedRevision) {
+    object2(identity2, ["daemonId", "runtimeDomain", "hostDomain"]);
+    validatePools([{ ...identity2, hostChargeCeilingBytes: 1 }]);
+    if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 0)
+      throw new Error("Invalid capacity settlement revision.");
+    assertPrivateDirectory(this.directory);
+    return withFileLockSync(
+      `${this.file}.lock`,
+      { activity: "capacity pool settlement", waitMs: 100 },
+      () => {
+        const snapshot = this.read();
+        if (snapshot.revision !== expectedRevision) throw new CapacitySnapshotChangedError();
+        const pools = snapshot.pools ?? [];
+        const index = pools.findIndex((pool2) => pool2.daemonId === identity2.daemonId);
+        const pool = pools[index];
+        if (pool && (pool.hostDomain !== identity2.hostDomain || pool.runtimeDomain !== identity2.runtimeDomain) || pools.some(
+          (entry) => entry.runtimeDomain === identity2.runtimeDomain && entry.daemonId !== identity2.daemonId
+        ) || snapshot.reservations.some((entry) => Object.hasOwn(entry.totals, identity2.runtimeDomain)))
+          throw new Error("Capacity pool cessation identity remains bound.");
+        if (snapshot.revision === Number.MAX_SAFE_INTEGER)
+          throw new Error("Capacity reservation revision exhausted.");
+        if (pool) pools.splice(index, 1);
+        snapshot.revision++;
+        validate(snapshot);
+        writeFileAtomically(this.file, serializeSnapshot(snapshot));
+        return { settled: !!pool, revision: snapshot.revision };
+      }
+    );
+  }
+  /** Caller persists phase proof and revokes authority before reducing this exact row. */
+  reduceAfterPhase(target, expectedRevision) {
+    validate({ version: 1, revision: 0, reservations: [target] });
+    if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 0)
+      throw new Error("Invalid capacity settlement revision.");
+    assertPrivateDirectory(this.directory);
+    withFileLockSync(
+      `${this.file}.lock`,
+      { activity: "capacity phase settlement", waitMs: 100 },
+      () => {
+        const snapshot = this.read();
+        if (snapshot.revision !== expectedRevision) throw new CapacitySnapshotChangedError();
+        const index = snapshot.reservations.findIndex(
+          (entry) => entry.environmentId === target.environmentId
+        );
+        const current = snapshot.reservations[index];
+        if (!current || current.reservationId !== target.reservationId || current.operationId !== target.operationId || current.policyRevision !== target.policyRevision)
+          throw new Error("Capacity phase settlement predecessor changed.");
+        if (Object.keys(current.totals).length !== Object.keys(target.totals).length || Object.entries(target.totals).some(
+          ([domain, bytes2]) => !Object.hasOwn(current.totals, domain) || bytes2 > current.totals[domain]
+        ) || target.startup && !current.startup || target.heavy && !current.heavy)
+          throw new Error("Capacity phase settlement cannot acquire resources.");
+        if (snapshot.revision === Number.MAX_SAFE_INTEGER)
+          throw new Error("Capacity reservation revision exhausted.");
+        snapshot.reservations[index] = structuredClone(target);
+        snapshot.revision++;
+        validate(snapshot);
+        writeFileAtomically(this.file, serializeSnapshot(snapshot));
+      }
+    );
+  }
+  reserve(request, budgets, samples, nowMs, maxSampleAgeMs, previous, expectedRevision, requestedPool) {
+    validate({ version: 1, revision: 0, reservations: [request] });
+    if (requestedPool !== void 0) {
+      validatePools([requestedPool]);
+      if (!Object.hasOwn(request.totals, requestedPool.hostDomain) || !Object.hasOwn(request.totals, requestedPool.runtimeDomain))
+        throw new Error("Capacity pool request lacks its bound domains.");
+    }
+    if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 0)
+      throw new Error("Invalid capacity expected revision.");
+    assertPrivateDirectory(this.directory);
+    return withFileLockSync(
+      `${this.file}.lock`,
+      { activity: "capacity reservation", waitMs: 100 },
+      () => {
+        const snapshot = this.read();
+        if (snapshot.revision !== expectedRevision) throw new CapacitySnapshotChangedError();
+        const pools = structuredClone(snapshot.pools ?? []);
+        const poolChanged = mergePools(pools, requestedPool === void 0 ? [] : [requestedPool]);
+        const existing = snapshot.reservations.find(
+          (entry) => entry.environmentId === request.environmentId
+        );
+        if (previous) {
+          if (snapshot.revision !== previous.revision || !existing || existing.reservationId !== previous.reservationId || existing.operationId !== previous.operationId || existing.policyRevision !== request.policyRevision)
+            throw new Error("Capacity expansion predecessor changed.");
+          const totals = { ...existing.totals };
+          for (const [domain, bytes2] of Object.entries(request.totals))
+            totals[domain] = Math.max(totals[domain] ?? 0, bytes2);
+          request = {
+            ...request,
+            totals,
+            startup: existing.startup || request.startup,
+            heavy: existing.heavy || request.heavy
+          };
+        } else if (existing) {
+          if (existing.reservationId !== request.reservationId || existing.operationId !== request.operationId || existing.policyRevision !== request.policyRevision || existing.startup !== request.startup || existing.heavy !== request.heavy || Object.keys(existing.totals).length !== Object.keys(request.totals).length || Object.entries(existing.totals).some(
+            ([domain, bytes2]) => request.totals[domain] !== bytes2
+          ))
+            throw new Error("Environment retains an earlier capacity reservation.");
+        }
+        const decision = evaluateCapacity(
+          budgets,
+          samples,
+          snapshot.reservations,
+          request,
+          nowMs,
+          maxSampleAgeMs,
+          pools
+        );
+        if (!decision.admitted) return decision;
+        if (!previous && existing && !poolChanged)
+          return { admitted: true, revision: snapshot.revision, joined: true };
+        if (snapshot.revision === Number.MAX_SAFE_INTEGER)
+          throw new Error("Capacity reservation revision exhausted.");
+        snapshot.revision++;
+        if (poolChanged) snapshot.pools = pools;
+        if (existing)
+          snapshot.reservations[snapshot.reservations.indexOf(existing)] = structuredClone(request);
+        else snapshot.reservations.push(structuredClone(request));
+        validate(snapshot);
+        writeFileAtomically(this.file, serializeSnapshot(snapshot));
+        return { admitted: true, revision: snapshot.revision, joined: false };
+      }
+    );
+  }
+};
+
+// src/core/controller-client.ts
+var import_node_crypto12 = require("crypto");
+var import_node_fs23 = __toESM(require("fs"));
+var import_node_net2 = __toESM(require("net"));
+var import_node_path28 = __toESM(require("path"));
+
+// src/core/controller-protocol.ts
+var import_node_path27 = __toESM(require("path"));
+var CONTROLLER_FRAME_BYTES = 64 * 1024;
+var CONTROLLER_MAX_OPERATION_REQUEST_BYTES = 32 * 1024;
+var CONTROLLER_PROFILE_TOKEN_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var CONTROLLER_PROFILE_RE = new RegExp(
+  `^(?:${CONTROLLER_PROFILE_TOKEN_RE.source.slice(1, -1)})(?:,(?:${CONTROLLER_PROFILE_TOKEN_RE.source.slice(1, -1)}))*$`
+);
+
+// src/core/controller-store.ts
+var import_node_crypto13 = require("crypto");
+var import_node_fs24 = __toESM(require("fs"));
+var import_node_path29 = __toESM(require("path"));
+var CONTROLLER_SNAPSHOT_BYTES = 1048576;
+function fail() {
+  throw new Error("Invalid controller snapshot.");
+}
+function fields(value, expected) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) fail();
+  const actual = Object.keys(value);
+  if (actual.length !== expected.length || actual.some((key) => !expected.includes(key))) fail();
+}
+function text2(value, max = 256) {
+  return typeof value === "string" && value.length > 0 && value.length <= max && ![...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);
+}
+function id3(value) {
+  return text2(value, 128) && /^[a-zA-Z0-9_-]+$/.test(value);
+}
+function counter(value) {
+  return Number.isSafeInteger(value) && Number(value) >= 0;
+}
+function validateControllerSnapshot(value) {
+  fields(value, [
+    "version",
+    "store",
+    "epoch",
+    "revision",
+    "nextSequence",
+    "environments",
+    "sessions",
+    "events"
+  ]);
+  if (value.version !== 1 || !id3(value.store) || !counter(value.epoch) || !counter(value.revision) || !counter(value.nextSequence) || value.nextSequence < 1 || !Array.isArray(value.environments) || value.environments.length > 32 || !Array.isArray(value.sessions) || value.sessions.length > 128 || !Array.isArray(value.events) || value.events.length > 256)
+    fail();
+  const environments = /* @__PURE__ */ new Set();
+  const checkouts = /* @__PURE__ */ new Set();
+  for (const env of value.environments) {
+    fields(env, [
+      "id",
+      "repoPath",
+      "workspace",
+      "provider",
+      "providerId",
+      "profile",
+      "fingerprint"
+    ]);
+    if (!id3(env.id) || environments.has(env.id) || !text2(env.repoPath, 4096) || !import_node_path29.default.isAbsolute(env.repoPath) || import_node_path29.default.resolve(env.repoPath) !== env.repoPath || checkouts.has(env.repoPath) || !id3(env.workspace) || !id3(env.providerId) || !text2(env.profile) || !/^[a-z0-9-]+(?:,[a-z0-9-]+)*$/.test(env.profile) || !text2(env.fingerprint, 128) || !/^[a-f0-9]{64}$/.test(env.fingerprint) || !["devpod", "devsy"].includes(String(env.provider)))
+      fail();
+    environments.add(env.id);
+    checkouts.add(env.repoPath);
+  }
+  const sessions = /* @__PURE__ */ new Set();
+  const usedEnvironments = /* @__PURE__ */ new Set();
+  for (const session of value.sessions) {
+    fields(session, [
+      "id",
+      "environmentId",
+      "generation",
+      "requirements",
+      "renewedAtMs",
+      ...Object.hasOwn(session, "observation") ? ["observation"] : []
+    ]);
+    if (!id3(session.id) || sessions.has(session.id) || !id3(session.environmentId) || !environments.has(session.environmentId) || !id3(session.generation) || !counter(session.renewedAtMs) || !Array.isArray(session.requirements) || session.requirements.length < 1 || session.requirements.length > 16 || new Set(session.requirements).size !== session.requirements.length || session.requirements.some(
+      (r) => !text2(r, 132) || !/^(runtime|app:[a-z0-9][a-z0-9-]*)$/.test(r)
+    ))
+      fail();
+    if (session.observation !== void 0) {
+      const observation = session.observation;
+      fields(observation, [
+        "status",
+        "sampledAtMs",
+        "validUntilMs",
+        "journalRevision",
+        "runtimeFingerprint"
+      ]);
+      if (![
+        "READY",
+        "APP_ERROR",
+        "BLOCKED",
+        "STOPPED",
+        "STARTING",
+        "RECOVERING",
+        "WAITING_CAPACITY",
+        "PARKED_CAPACITY",
+        "UNKNOWN"
+      ].includes(String(observation.status)) || !counter(observation.sampledAtMs) || !counter(observation.validUntilMs) || observation.validUntilMs < observation.sampledAtMs || !counter(observation.journalRevision) || !text2(observation.runtimeFingerprint, 128) || !/^[a-f0-9]{64}$/.test(observation.runtimeFingerprint))
+        fail();
+    }
+    sessions.add(session.id);
+    usedEnvironments.add(session.environmentId);
+  }
+  if (usedEnvironments.size !== environments.size) fail();
+  let previous = 0;
+  for (const event of value.events) {
+    fields(event, ["sequence", "session", "generation", "kind"]);
+    if (!counter(event.sequence) || event.sequence <= previous || event.sequence >= value.nextSequence || !id3(event.session) || !id3(event.generation) || !["acquired", "renewed", "released", "expired", "invalidated", "observed"].includes(
+      String(event.kind)
+    ))
+      fail();
+    previous = event.sequence;
+  }
+  if (Buffer.byteLength(JSON.stringify(value.events)) > 262144 || Buffer.byteLength(JSON.stringify(value)) + 1 > CONTROLLER_SNAPSHOT_BYTES)
+    fail();
+}
+var ControllerStore = class {
+  constructor(directory, write = writeFileAtomically) {
+    this.directory = directory;
+    this.write = write;
+    this.file = import_node_path29.default.join(directory, "snapshot.json");
+  }
+  file;
+  read() {
+    let fd;
+    try {
+      fd = import_node_fs24.default.openSync(
+        this.file,
+        import_node_fs24.default.constants.O_RDONLY | import_node_fs24.default.constants.O_NOFOLLOW | import_node_fs24.default.constants.O_NONBLOCK
+      );
+    } catch (error) {
+      if (error.code === "ENOENT") return void 0;
+      throw new Error("Controller snapshot cannot be opened.");
+    }
+    try {
+      const stat = import_node_fs24.default.fstatSync(fd);
+      if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0 || stat.size > CONTROLLER_SNAPSHOT_BYTES)
+        fail();
+      const bytes2 = Buffer.alloc(CONTROLLER_SNAPSHOT_BYTES + 1);
+      let length = 0;
+      while (length < bytes2.length) {
+        const count = import_node_fs24.default.readSync(fd, bytes2, length, bytes2.length - length, null);
+        if (!count) break;
+        length += count;
+      }
+      if (length > CONTROLLER_SNAPSHOT_BYTES) fail();
+      const value = JSON.parse(bytes2.subarray(0, length).toString("utf8"));
+      validateControllerSnapshot(value);
+      return value;
+    } catch {
+      throw new Error("Controller snapshot is unreadable or invalid.");
+    } finally {
+      import_node_fs24.default.closeSync(fd);
+    }
+  }
+  persist(snapshot) {
+    validateControllerSnapshot(snapshot);
+    this.read();
+    const contents = `${JSON.stringify(snapshot)}
+`;
+    try {
+      this.write(this.file, contents);
+    } catch {
+      const current = this.read();
+      if (!current || `${JSON.stringify(current)}
+` !== contents)
+        throw new Error("Controller snapshot commit failed.");
+      for (const file of [this.file, this.directory]) {
+        const fd = import_node_fs24.default.openSync(file, import_node_fs24.default.constants.O_RDONLY | import_node_fs24.default.constants.O_NOFOLLOW);
+        try {
+          import_node_fs24.default.fsyncSync(fd);
+        } finally {
+          import_node_fs24.default.closeSync(fd);
+        }
+      }
+    }
+  }
+  startIncarnation() {
+    const previous = this.read();
+    if (previous && (previous.epoch === Number.MAX_SAFE_INTEGER || previous.revision === Number.MAX_SAFE_INTEGER))
+      throw new Error("Controller snapshot counters exhausted.");
+    const snapshot = {
+      version: 1,
+      store: previous?.store ?? (0, import_node_crypto13.randomUUID)(),
+      epoch: (previous?.epoch ?? 0) + 1,
+      revision: (previous?.revision ?? 0) + 1,
+      nextSequence: 1,
+      environments: [],
+      sessions: [],
+      events: []
+    };
+    this.persist(snapshot);
+    return snapshot;
+  }
+};
 
 // src/core/reliability-contract.ts
 var RELIABILITY_CONTRACT_VERSION = 2;
@@ -7643,7 +8588,6 @@ function canExecAfterInterruptedEnsure(state) {
   return state.executionPolicy === "manual" && (state.desired === "running" || quiescent && state.desired === "stopped-by-user") && latestEnsure?.status === "INTERRUPTED" && latestEnsure.drained && state.operation?.drained === true && (state.operation.kind === "ensure" && (state.phase === "recovering" || quiescent) || state.operation.kind === "exec" && ["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status));
 }
 function handleOperationRequest(state, event) {
-  if (state.executionPolicy !== "manual") return unchanged(state, "blocked");
   const previous = state.operationHistory.find((entry) => entry.key === event.key);
   if (previous)
     return unchanged(
@@ -7652,6 +8596,8 @@ function handleOperationRequest(state, event) {
     );
   if (state.operationHistory.some((entry) => entry.id === event.operationId))
     return unchanged(state, "conflict");
+  if (state.executionPolicy !== "manual" && state.operationHistory.length >= RELIABILITY_MAX_ITEMS)
+    return unchanged(state, "blocked");
   if (event.kind === "exec" && canExecAfterInterruptedEnsure(state) && event.recoverInterruptedEnsure !== true)
     return blocked(
       state,
@@ -7674,7 +8620,7 @@ function handleOperationRequest(state, event) {
       state,
       `exec requires a running workspace (runtimeRunning=${event.runtimeRunning}, desired='${state.desired}').`
     );
-  const rollover = state.operationHistory.length >= RELIABILITY_MAX_ITEMS;
+  const rollover = state.executionPolicy === "manual" && state.operationHistory.length >= RELIABILITY_MAX_ITEMS;
   let retired = -1;
   if (rollover) {
     const latestEnsureId = [...state.operationHistory].reverse().find((entry) => entry.kind === "ensure")?.id;
@@ -7696,6 +8642,7 @@ function handleOperationRequest(state, event) {
   state.desired = "running";
   state.phase = "queued";
   state.profile = event.profile;
+  if (state.executionPolicy === "capacity-managed") state.admission = "waiting";
   state.stopProof = { workloadsStopped: false, routesRemoved: false };
   state.consumers = [cloneConsumer(event.consumer)];
   state.requests = [
@@ -7721,7 +8668,11 @@ function handleOperationRequest(state, event) {
     profile: event.profile,
     consumer: cloneConsumer(event.consumer)
   });
-  return transition(state, "accepted");
+  return transition(
+    state,
+    "accepted",
+    state.executionPolicy === "capacity-managed" ? [effect(state, "request-admission", event.operationId)] : []
+  );
 }
 function handleAdmission(state, event) {
   if (state.executionPolicy === "manual" || state.desired !== "running" && state.desired !== "parked-for-capacity" || state.requests.length === 0) {
@@ -7846,7 +8797,7 @@ function handleObservation(state, event, nowMs) {
   return transition(state, "accepted");
 }
 function handleStop(state) {
-  if (state.desired === "stopped-by-user" && state.intentRevision > 0)
+  if (state.desired === "stopped-by-user" && state.phase === "stopping")
     return unchanged(state, "joined");
   const intentRevision = advance(state.intentRevision);
   if (intentRevision === null) return unchanged(state, "blocked");
@@ -8068,7 +9019,7 @@ function stepReliability(state, event, nowMs) {
   if (!isReliabilityCounter(nowMs) || nowMs < state.observationsAfterMs)
     throw new Error("Invalid reliability clock.");
   const result = applyReliabilityEvent(state, event, nowMs);
-  if (result.outcome === "accepted" && result.state.executionPolicy === "manual" && result.state.operation) {
+  if (result.outcome === "accepted" && result.state.operation) {
     const operation = result.state.operation;
     result.state.operationHistory = result.state.operationHistory.map(
       (entry) => entry.id === operation.id ? { ...entry, ...operation } : entry
@@ -8081,11 +9032,12 @@ function stepReliability(state, event, nowMs) {
 }
 
 // src/core/reliability-operation-store.ts
-var import_node_crypto11 = require("crypto");
-var import_node_fs20 = __toESM(require("fs"));
-var import_node_path25 = __toESM(require("path"));
+var import_node_crypto14 = require("crypto");
+var import_node_fs25 = __toESM(require("fs"));
+var import_node_path30 = __toESM(require("path"));
+var import_node_util5 = require("util");
 function installedCliVersion() {
-  return true ? "0.0.67" : "0.0.0-dev";
+  return true ? "0.0.69" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -8098,21 +9050,112 @@ function compareCliVersions(left, right) {
   return 0;
 }
 var MAX_RECORD_BYTES = 1048576;
+var MAX_RELIABILITY_JOURNALS = 256;
+var MAX_RELIABILITY_DIRECTORY_ENTRIES = MAX_RELIABILITY_JOURNALS * 2;
 function identityKey(identity2) {
-  if (!import_node_path25.default.isAbsolute(identity2.repoPath) || import_node_path25.default.resolve(identity2.repoPath) !== identity2.repoPath || identity2.repoPath.includes("\0") || identity2.workspace !== null && !isReliabilityId(identity2.workspace) || !["devpod", "devsy"].includes(identity2.provider)) {
+  if (!import_node_path30.default.isAbsolute(identity2.repoPath) || import_node_path30.default.resolve(identity2.repoPath) !== identity2.repoPath || identity2.repoPath.includes("\0") || identity2.workspace !== null && !isReliabilityId(identity2.workspace) || !["devpod", "devsy"].includes(identity2.provider)) {
     throw new Error("Invalid reliability workspace identity.");
   }
-  return (0, import_node_crypto11.createHash)("sha256").update(identity2.repoPath).digest("hex");
+  return (0, import_node_crypto14.createHash)("sha256").update(identity2.repoPath).digest("hex");
 }
 function reliabilityOperationPath(identity2) {
-  return import_node_path25.default.join(DEVROUTER_HOME, "reliability", `${identityKey(identity2)}.json`);
+  return import_node_path30.default.join(DEVROUTER_HOME, "reliability", `${identityKey(identity2)}.json`);
 }
 function keys(value, expected) {
   if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !expected.includes(key))) {
     throw new Error("Reliability record contains unsupported fields.");
   }
 }
-function validate(record5, identity2) {
+function exactKeys(value, expected, message) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).length !== expected.length || Object.keys(value).some((key) => !expected.includes(key))) {
+    throw new Error(message);
+  }
+}
+function validateCapacityPhaseSettlement(record5, state, enrollment) {
+  const settlement = record5.phaseSettlement;
+  if (settlement === void 0 || settlement === null) return;
+  if (record5.version !== 2 || !enrollment || state.executionPolicy !== "capacity-managed")
+    throw new Error("Phase settlement requires durable capacity enrollment.");
+  exactKeys(
+    settlement,
+    ["id", "fence", "target", "estimatesDigest"],
+    "Invalid capacity phase settlement fields."
+  );
+  exactKeys(
+    settlement.fence,
+    ["environmentId", "intentRevision", "runtimeGeneration", "controllerEpoch"],
+    "Invalid capacity phase settlement fence."
+  );
+  exactKeys(
+    settlement.target,
+    [
+      "environmentId",
+      "operationId",
+      "reservationId",
+      "policyRevision",
+      "totals",
+      "startup",
+      "heavy"
+    ],
+    "Invalid capacity phase settlement target fields."
+  );
+  const target = settlement.target;
+  const totals = target.totals;
+  if (!isReliabilityId(settlement.id) || !isReliabilityId(settlement.fence.environmentId) || settlement.fence.environmentId !== state.environmentId || !isReliabilityCounter(settlement.fence.intentRevision) || !isReliabilityCounter(settlement.fence.runtimeGeneration) || !isReliabilityCounter(settlement.fence.controllerEpoch) || !isReliabilityId(target.environmentId) || target.environmentId !== state.environmentId || !isReliabilityId(target.operationId) || !isReliabilityId(target.reservationId) || !Number.isSafeInteger(target.policyRevision) || target.policyRevision < 1 || target.startup !== false || target.heavy !== false || typeof settlement.estimatesDigest !== "string" || !/^[0-9a-f]{64}$/.test(settlement.estimatesDigest))
+    throw new Error("Invalid capacity phase settlement.");
+  if (!totals || typeof totals !== "object" || Array.isArray(totals) || Object.keys(totals).length < 1 || Object.keys(totals).length > 256 || Object.entries(totals).some(
+    ([domain, bytes2]) => !isReliabilityId(domain) || !Number.isSafeInteger(bytes2) || bytes2 < 0
+  ))
+    throw new Error("Invalid capacity phase settlement totals.");
+  const capacity = record5.capacity;
+  if (capacity?.validUntilMs !== 0 || target.operationId !== capacity?.operationId || target.reservationId !== capacity?.reservationId || target.policyRevision !== capacity?.policyRevision || settlement.estimatesDigest !== enrollment.estimatesDigest)
+    throw new Error("Capacity phase settlement does not match durable capacity authority.");
+  const targetDomains = Object.keys(totals);
+  if (targetDomains.length !== 2 || !targetDomains.includes(enrollment.hostDomain) || !targetDomains.includes(enrollment.runtimeDomain))
+    throw new Error("Capacity phase settlement domains do not match enrollment.");
+}
+function validateStartupWitness(record5, state, enrollment) {
+  const witness = record5.startupWitness;
+  if (witness === void 0 || witness === null) return;
+  if (record5.version !== 2 || !enrollment || state.executionPolicy !== "capacity-managed")
+    throw new Error("Startup witness requires current durable managed intent.");
+  exactKeys(
+    witness,
+    [
+      "operationId",
+      "fence",
+      "provider",
+      "profile",
+      "sourceConfigSha256",
+      "effectiveConfigSha256",
+      "composeFiles",
+      "primaryService",
+      "startupServices",
+      "retainedContainerIds"
+    ],
+    "Invalid capacity startup witness fields."
+  );
+  exactKeys(
+    witness.fence,
+    ["environmentId", "intentRevision", "runtimeGeneration", "controllerEpoch"],
+    "Invalid capacity startup witness fence."
+  );
+  exactKeys(
+    witness.provider,
+    ["id", "context", "uid", "sourceContainer"],
+    "Invalid capacity startup witness provider fields."
+  );
+  const digest = (value) => typeof value === "string" && /^[0-9a-f]{64}$/.test(value);
+  const boundedText = (value) => typeof value === "string" && value.length <= 256 && ![...value].some(
+    (character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127
+  );
+  const absolutePath = (value) => typeof value === "string" && value.length <= 4096 && !value.includes("\0") && import_node_path30.default.isAbsolute(value) && import_node_path30.default.resolve(value) === value;
+  const unique = (values) => new Set(values).size === values.length;
+  const fence = witness.fence;
+  if (!isReliabilityId(witness.operationId) || !isReliabilityId(fence.environmentId) || !isReliabilityCounter(fence.intentRevision) || !isReliabilityCounter(fence.runtimeGeneration) || !isReliabilityCounter(fence.controllerEpoch) || !isReliabilityProfile(witness.profile) || !digest(witness.sourceConfigSha256) || !digest(witness.effectiveConfigSha256) || !boundedText(witness.provider.id) || witness.provider.id.trim() !== witness.provider.id || witness.provider.id === "" || witness.provider.id !== enrollment.providerId || !boundedText(witness.provider.context) || !boundedText(witness.provider.uid) || !boundedText(witness.provider.sourceContainer) || !Array.isArray(witness.composeFiles) || witness.composeFiles.length < 1 || witness.composeFiles.length > 16 || !witness.composeFiles.every(absolutePath) || !unique(witness.composeFiles) || !Array.isArray(witness.startupServices) || witness.startupServices.length < 1 || witness.startupServices.length > 64 || !witness.startupServices.every((service) => isReliabilityId(service) && service.length <= 64) || !unique(witness.startupServices) || !isReliabilityId(witness.primaryService) || witness.primaryService.length > 64 || !witness.startupServices.includes(witness.primaryService) || !Array.isArray(witness.retainedContainerIds) || witness.retainedContainerIds.length > 256 || !witness.retainedContainerIds.every(digest) || !unique(witness.retainedContainerIds))
+    throw new Error("Invalid capacity startup witness.");
+}
+function validate2(record5, identity2) {
   keys(record5, [
     "version",
     "identity",
@@ -8121,7 +9164,16 @@ function validate(record5, identity2) {
     "worker",
     "effectSequence",
     "outcome",
-    "writtenByVersion"
+    "result",
+    "writtenByVersion",
+    ...record5.version === 2 ? [
+      "capacity",
+      "enrollment",
+      "activeProfile",
+      "preparation",
+      "phaseSettlement",
+      "startupWitness"
+    ] : []
   ]);
   if (record5.writtenByVersion !== void 0 && compareCliVersions(record5.writtenByVersion, installedCliVersion()) > 0) {
     throw new Error(
@@ -8129,13 +9181,57 @@ function validate(record5, identity2) {
     );
   }
   keys(record5.identity, ["repoPath", "workspace", "provider"]);
-  if (record5.version !== 1 || record5.identity.repoPath !== identity2.repoPath || record5.identity.workspace !== identity2.workspace || record5.identity.provider !== identity2.provider || !isReliabilityCounter(record5.revision) || !isReliabilityCounter(record5.effectSequence)) {
+  if (record5.version !== 1 && record5.version !== 2 || record5.identity.repoPath !== identity2.repoPath || record5.identity.workspace !== identity2.workspace || record5.identity.provider !== identity2.provider || !isReliabilityCounter(record5.revision) || !isReliabilityCounter(record5.effectSequence)) {
     throw new Error("Reliability record has invalid version, ownership, or counters.");
   }
+  if (record5.version === 2) {
+    const capacity = record5.capacity;
+    if (capacity === void 0) throw new Error("Invalid capacity authority binding.");
+    if (capacity !== null) {
+      keys(capacity, [
+        "reservationId",
+        "operationId",
+        "workerId",
+        "policyRevision",
+        "validUntilMs",
+        "snapshotRevision",
+        "controller",
+        "execSteady"
+      ]);
+      if (capacity.controller !== void 0) {
+        keys(capacity.controller, ["store", "epoch"]);
+        if (!isReliabilityId(capacity.controller.store) || !isReliabilityCounter(capacity.controller.epoch) || capacity.controller.epoch < 1)
+          throw new Error("Invalid capacity controller identity.");
+      }
+    }
+    if (capacity !== null && (!isReliabilityId(capacity.reservationId) || !isReliabilityId(capacity.operationId) || !isReliabilityId(capacity.workerId) || !Number.isSafeInteger(capacity.policyRevision) || capacity.policyRevision < 1 || !isReliabilityCounter(capacity.validUntilMs) || capacity.snapshotRevision !== void 0 && (!isReliabilityCounter(capacity.snapshotRevision) || capacity.snapshotRevision < 1)))
+      throw new Error("Invalid capacity authority binding.");
+  }
   const state = record5.state;
   assertReliabilityState(state);
-  if (state.environmentId !== identityKey(identity2) || state.executionPolicy !== "manual") {
-    throw new Error("Reliability record does not grant manual authority for this workspace.");
+  if (state.environmentId !== identityKey(identity2)) {
+    throw new Error("Reliability record does not match this workspace.");
+  }
+  if (record5.enrollment !== void 0) {
+    const enrollment = record5.enrollment;
+    keys(enrollment, [
+      "policyRevision",
+      "gitCommonDir",
+      "providerId",
+      "hostDomain",
+      "runtimeDomain",
+      "endpoint",
+      "daemonId",
+      "estimatesDigest"
+    ]);
+    const absolute2 = (value) => typeof value === "string" && value.length <= 4096 && !value.includes("\0") && import_node_path30.default.isAbsolute(value) && import_node_path30.default.resolve(value) === value;
+    const providerIdentity = (value) => typeof value === "string" && value.length > 0 && value.length <= 256 && value.trim() === value && ![...value].some(
+      (character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127
+    );
+    if (record5.version !== 2 || state.executionPolicy !== "capacity-managed" || !Number.isSafeInteger(enrollment.policyRevision) || enrollment.policyRevision < 1 || !absolute2(enrollment.gitCommonDir) || !absolute2(enrollment.endpoint) || !providerIdentity(enrollment.providerId) || !providerIdentity(enrollment.daemonId) || !isReliabilityId(enrollment.hostDomain) || !isReliabilityId(enrollment.runtimeDomain) || enrollment.hostDomain === enrollment.runtimeDomain || typeof enrollment.estimatesDigest !== "string" || !/^[0-9a-f]{64}$/.test(enrollment.estimatesDigest) || record5.activeProfile !== null && (typeof record5.activeProfile !== "string" || record5.activeProfile.length > 256 || !/^[a-z0-9,-]+$/.test(record5.activeProfile)))
+      throw new Error("Invalid durable capacity enrollment.");
+  } else if (state.executionPolicy !== "manual" || record5.activeProfile !== void 0) {
+    throw new Error("Managed lifecycle requires durable capacity enrollment.");
   }
   keys(state, [
     "contractVersion",
@@ -8170,6 +9266,52 @@ function validate(record5, identity2) {
     keys(entry, ["key", "mode", "consumerId", "operationId", "profile", "intentRevision"]);
   for (const entry of state.observations)
     keys(entry, ["capability", "infrastructure", "application", "observedAtMs", "validForMs"]);
+  if (record5.preparation !== void 0 && record5.preparation !== null) {
+    if (record5.version !== 2 || record5.enrollment === void 0 || state.executionPolicy !== "capacity-managed")
+      throw new Error("Preparation receipt requires durable capacity enrollment.");
+    const preparation = record5.preparation;
+    keys(preparation, ["operationId", "profile", "fence"]);
+    keys(preparation.fence, [
+      "environmentId",
+      "intentRevision",
+      "runtimeGeneration",
+      "controllerEpoch"
+    ]);
+    if (!isReliabilityId(preparation.operationId) || !isReliabilityProfile(preparation.profile) || !isReliabilityId(preparation.fence.environmentId) || preparation.fence.environmentId !== state.environmentId || !isReliabilityCounter(preparation.fence.intentRevision) || !isReliabilityCounter(preparation.fence.runtimeGeneration) || !isReliabilityCounter(preparation.fence.controllerEpoch))
+      throw new Error("Invalid preparation receipt.");
+    const preparedOperation = state.operationHistory.find(
+      (entry) => entry.id === preparation.operationId
+    );
+    if (preparedOperation?.kind !== "ensure" || preparedOperation.profile !== preparation.profile || preparedOperation.status !== "COMPLETED")
+      throw new Error("Preparation receipt does not match a completed ensure operation.");
+  }
+  validateCapacityPhaseSettlement(record5, state, record5.enrollment);
+  validateStartupWitness(record5, state, record5.enrollment);
+  const execSteady = record5.capacity?.execSteady;
+  if (execSteady !== void 0) {
+    const enrollment = record5.enrollment;
+    if (record5.version !== 2 || !enrollment || state.executionPolicy !== "capacity-managed")
+      throw new Error("Exec steady receipt requires durable capacity enrollment.");
+    exactKeys(
+      execSteady,
+      ["profile", "estimatesDigest", "fence", "totals"],
+      "Invalid exec steady receipt fields."
+    );
+    exactKeys(
+      execSteady.fence,
+      ["environmentId", "intentRevision", "runtimeGeneration", "controllerEpoch"],
+      "Invalid exec steady receipt fence."
+    );
+    if (!isReliabilityProfile(execSteady.profile) || typeof execSteady.estimatesDigest !== "string" || !/^[0-9a-f]{64}$/.test(execSteady.estimatesDigest) || execSteady.estimatesDigest !== enrollment.estimatesDigest || execSteady.fence.environmentId !== state.environmentId || !isReliabilityCounter(execSteady.fence.intentRevision) || !isReliabilityCounter(execSteady.fence.runtimeGeneration) || !isReliabilityCounter(execSteady.fence.controllerEpoch))
+      throw new Error("Invalid exec steady receipt.");
+    exactKeys(
+      execSteady.totals,
+      [enrollment.hostDomain, enrollment.runtimeDomain],
+      "Exec steady receipt domains do not match enrollment."
+    );
+    if (!Object.values(execSteady.totals).every(isReliabilityCounter))
+      throw new Error("Invalid exec steady receipt totals.");
+  }
   if (state.operation) {
     const current = state.operationHistory.find((entry) => entry.id === state.operation?.id);
     if (!current || operationKeys.some(
@@ -8186,6 +9328,12 @@ function validate(record5, identity2) {
     if (outcome.operationId !== state.operation?.id || !["completed", "not-started", "completion-unknown"].includes(outcome.status) || (outcome.status === "completed" ? !validExit(outcome.exitCode) : outcome.exitCode !== null) || outcome.transport.exitCode !== null && !validExit(outcome.transport.exitCode) || outcome.transport.signal !== null && (typeof outcome.transport.signal !== "string" || !/^SIG[A-Z0-9]{1,16}$/.test(outcome.transport.signal))) {
       throw new Error("Reliability execution outcome is invalid.");
     }
+    if (record5.result !== void 0 && record5.result !== null) {
+      const serialized = JSON.stringify(record5.result);
+      if (typeof serialized !== "string" || serialized.length > 262144 || record5.result.ok !== true && record5.result.ok !== false || (record5.result.ok ? "message" in record5.result : !("message" in record5.result)) || !record5.result.ok && (typeof record5.result.message !== "string" || record5.result.message.length > 4096)) {
+        throw new Error("Reliability operation result is invalid.");
+      }
+    }
   }
   if (record5.worker !== null) {
     keys(record5.worker, ["id", "operationId", "pid", "birth"]);
@@ -8194,37 +9342,59 @@ function validate(record5, identity2) {
     }
   }
 }
+function assertCapacityEffect(record5, workerId, nowMs, directory = import_node_path30.default.join(DEVROUTER_HOME, "controller")) {
+  if (record5.version === 1) return;
+  const binding = record5.capacity;
+  if (!binding || binding.workerId !== workerId || binding.operationId !== record5.state.operation?.id || binding.validUntilMs <= nowMs)
+    throw new Error("Capacity effect authority is absent or stale.");
+  if (record5.state.executionPolicy === "capacity-managed") {
+    const controller = new ControllerStore(directory).read();
+    if (!binding.controller || !controller || controller.store !== binding.controller.store || controller.epoch !== binding.controller.epoch)
+      throw new Error("Capacity controller incarnation changed.");
+  }
+  const snapshot = new CapacityStore(directory).read();
+  if (binding.snapshotRevision === void 0 || snapshot.revision !== binding.snapshotRevision)
+    throw new Error("Capacity snapshot authority is absent or stale.");
+  const reservation = snapshot.reservations.find(
+    (entry) => entry.reservationId === binding.reservationId
+  );
+  if (!reservation || reservation.environmentId !== record5.state.environmentId || reservation.operationId !== binding.operationId || reservation.policyRevision !== binding.policyRevision)
+    throw new Error("Capacity effect reservation does not match lifecycle intent.");
+}
 function readReliabilityOperation(identity2) {
   const file = reliabilityOperationPath(identity2);
+  const parsed = readBoundedPrivateJson(file, "Reliability record");
+  if (parsed === void 0) return void 0;
+  const record5 = parsed;
+  validate2(record5, identity2);
+  return record5;
+}
+function readBoundedPrivateJson(file, label) {
   let descriptor;
   try {
-    descriptor = import_node_fs20.default.openSync(
+    descriptor = import_node_fs25.default.openSync(
       file,
-      import_node_fs20.default.constants.O_RDONLY | import_node_fs20.default.constants.O_NOFOLLOW | import_node_fs20.default.constants.O_NONBLOCK
+      import_node_fs25.default.constants.O_RDONLY | import_node_fs25.default.constants.O_NOFOLLOW | import_node_fs25.default.constants.O_NONBLOCK
     );
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
   }
   try {
-    const stat = import_node_fs20.default.fstatSync(descriptor);
-    if (!stat.isFile() || stat.size > MAX_RECORD_BYTES || (stat.mode & 63) !== 0) {
-      throw new Error("Reliability record is not a bounded private file.");
-    }
-    const bytes = Buffer.alloc(MAX_RECORD_BYTES + 1);
-    const count = import_node_fs20.default.readSync(descriptor, bytes, 0, bytes.length, 0);
-    if (count > MAX_RECORD_BYTES) throw new Error("Reliability record exceeds its byte limit.");
-    const record5 = JSON.parse(
-      bytes.subarray(0, count).toString("utf8")
-    );
-    validate(record5, identity2);
-    return record5;
+    const stat = import_node_fs25.default.fstatSync(descriptor);
+    if (!stat.isFile() || stat.uid !== process.getuid?.() || stat.size > MAX_RECORD_BYTES || (stat.mode & 63) !== 0) {
+      throw new Error(`${label} is not a bounded private file.`);
+    }
+    const bytes2 = Buffer.alloc(MAX_RECORD_BYTES + 1);
+    const count = import_node_fs25.default.readSync(descriptor, bytes2, 0, bytes2.length, 0);
+    if (count > MAX_RECORD_BYTES) throw new Error(`${label} exceeds its byte limit.`);
+    return JSON.parse(bytes2.subarray(0, count).toString("utf8"));
   } finally {
-    import_node_fs20.default.closeSync(descriptor);
+    import_node_fs25.default.closeSync(descriptor);
   }
 }
 function persist(record5) {
-  validate(record5, record5.identity);
+  validate2(record5, record5.identity);
   const contents = `${JSON.stringify(record5)}
 `;
   if (Buffer.byteLength(contents) > MAX_RECORD_BYTES)
@@ -8235,23 +9405,23 @@ function persist(record5) {
   } catch (error) {
     const reread = readReliabilityOperation(record5.identity);
     if (!reread || JSON.stringify(reread) !== JSON.stringify(record5)) throw error;
-    const descriptor = import_node_fs20.default.openSync(file, import_node_fs20.default.constants.O_RDONLY | import_node_fs20.default.constants.O_NOFOLLOW);
+    const descriptor = import_node_fs25.default.openSync(file, import_node_fs25.default.constants.O_RDONLY | import_node_fs25.default.constants.O_NOFOLLOW);
     try {
-      import_node_fs20.default.fsyncSync(descriptor);
+      import_node_fs25.default.fsyncSync(descriptor);
     } finally {
-      import_node_fs20.default.closeSync(descriptor);
+      import_node_fs25.default.closeSync(descriptor);
     }
-    const directory = import_node_fs20.default.openSync(import_node_path25.default.dirname(file), "r");
+    const directory = import_node_fs25.default.openSync(import_node_path30.default.dirname(file), "r");
     try {
-      import_node_fs20.default.fsyncSync(directory);
+      import_node_fs25.default.fsyncSync(directory);
     } finally {
-      import_node_fs20.default.closeSync(directory);
+      import_node_fs25.default.closeSync(directory);
     }
   }
 }
 function updateReliabilityOperation(identity2, operation) {
   const file = reliabilityOperationPath(identity2);
-  import_node_fs20.default.mkdirSync(import_node_path25.default.dirname(file), { recursive: true, mode: 448 });
+  import_node_fs25.default.mkdirSync(import_node_path30.default.dirname(file), { recursive: true, mode: 448 });
   return withFileLockSync(`${file}.lock`, { activity: "reliability intent", waitMs: 2e3 }, () => {
     const record5 = readReliabilityOperation(identity2) ?? {
       version: 1,
@@ -8264,23 +9434,37 @@ function updateReliabilityOperation(identity2, operation) {
     };
     if (record5.revision === Number.MAX_SAFE_INTEGER)
       throw new Error("Reliability record revision is exhausted.");
+    const previousVersion = record5.version;
+    const previousEnrollment = record5.enrollment && { ...record5.enrollment };
     const result = operation(record5);
     if (result && typeof result.then === "function") {
       throw new Error("Reliability record updates must be synchronous.");
     }
+    if (record5.version < previousVersion || previousEnrollment && !(0, import_node_util5.isDeepStrictEqual)(record5.enrollment, previousEnrollment))
+      throw new Error("Durable capacity enrollment cannot be downgraded or replaced.");
     record5.writtenByVersion = installedCliVersion();
-    validate(record5, identity2);
+    validate2(record5, identity2);
     record5.revision += 1;
     persist(record5);
     return result;
   });
 }
+function clearStartupWitness(identity2, fence) {
+  updateReliabilityOperation(identity2, (record5) => {
+    if (record5.startupWitness === void 0 || record5.startupWitness === null) return;
+    const live = reliabilityFence(record5.state);
+    if (Object.entries(fence).some(([key, value]) => value !== live[key]))
+      throw new Error("Startup witness clearing fence changed.");
+    record5.startupWitness = null;
+  });
+}
 
 // src/core/reliability-worker.ts
 var import_node_child_process16 = require("child_process");
-var import_node_crypto12 = require("crypto");
-var import_node_fs21 = __toESM(require("fs"));
-var import_node_path26 = __toESM(require("path"));
+var import_node_crypto15 = require("crypto");
+var import_node_fs26 = __toESM(require("fs"));
+var import_node_path31 = __toESM(require("path"));
+var DEFAULT_OUTPUT_PAGE_BYTES = 48 * 1024;
 function workerGroupAbsent(pid) {
   try {
     process.kill(-pid, 0);
@@ -8292,10 +9476,10 @@ function workerGroupAbsent(pid) {
 
 // src/core/traefik-route-health.ts
 var import_node_child_process17 = require("child_process");
-var import_node_fs22 = __toESM(require("fs"));
-var import_node_path27 = __toESM(require("path"));
+var import_node_fs27 = __toESM(require("fs"));
+var import_node_path32 = __toESM(require("path"));
 var ROUTER_API_BASE = "http://127.0.0.1:8080/api";
-var ROUTER_RELOAD_LOCK_FILE = import_node_path27.default.join(DEVROUTER_HOME, "router-reload.lock");
+var ROUTER_RELOAD_LOCK_FILE = import_node_path32.default.join(DEVROUTER_HOME, "router-reload.lock");
 var ROUTER_API_REQUEST_TIMEOUT_SECONDS = "2";
 var DEFAULT_INITIAL_TIMEOUT_MS = 3e3;
 var DEFAULT_RECOVERY_TIMEOUT_MS = 1e4;
@@ -8564,7 +9748,7 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
     throw new Error(
       "Traefik routes did not reload; shared router restart is disabled for this operation."
     );
-  import_node_fs22.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs27.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     ROUTER_RELOAD_LOCK_FILE,
     {
@@ -8615,20 +9799,20 @@ function assertTraefikRoutesRemoved(routes) {
 }
 
 // src/core/workspace-ensure.ts
-var import_node_child_process26 = require("child_process");
-var import_node_fs28 = __toESM(require("fs"));
-var import_node_path32 = __toESM(require("path"));
+var import_node_child_process27 = require("child_process");
+var import_node_fs33 = __toESM(require("fs"));
+var import_node_path38 = __toESM(require("path"));
 
 // src/core/devpod-mutation.ts
 var import_node_child_process18 = require("child_process");
-var import_node_fs23 = __toESM(require("fs"));
-var import_node_path28 = __toESM(require("path"));
-var DEVPOD_MUTATION_LOCK_FILE = import_node_path28.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+var import_node_fs28 = __toESM(require("fs"));
+var import_node_path33 = __toESM(require("path"));
+var DEVPOD_MUTATION_LOCK_FILE = import_node_path33.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
 var DEVPOD_MUTATION_WAIT_MS = 18e5;
 var DevpodStartPostconditionError = class extends Error {
 };
 function withMutationLock2(activity, target, operation) {
-  import_node_fs23.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs28.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
     {
@@ -8829,8 +10013,270 @@ async function startDevpodWorkspace(options) {
   });
 }
 
-// src/core/http-route-probe.ts
+// src/core/host-port-claims.ts
 var import_node_child_process19 = require("child_process");
+var import_node_path34 = __toESM(require("path"));
+var COMPOSE_RENDER_TIMEOUT_MS = 3e4;
+var COMPOSE_RENDER_MAX_BUFFER = 8 * 1024 * 1024;
+var DOCKER_TIMEOUT_MS = 1e4;
+var DOCKER_MAX_BUFFER = 1024 * 1024;
+var MAX_DESIRED_HOST_PORTS = 1024;
+var MAX_RUNNING_HOLDERS = 512;
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function optionalLabel(labels, key) {
+  const value = isRecord4(labels) ? labels[key] : void 0;
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function normalizeHostIp(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  if (trimmed.length === 0 || trimmed === "0.0.0.0" || trimmed === "::") return null;
+  return trimmed;
+}
+function parseSinglePortValue(value, service, label) {
+  if (typeof value === "number") {
+    if (!Number.isInteger(value) || value <= 0 || value > 65535) {
+      throw new Error(`Service '${service}' has an out-of-range ${label} port.`);
+    }
+    return value;
+  }
+  if (typeof value === "string") {
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 65535) {
+      throw new Error(`Service '${service}' has an out-of-range ${label} port '${value}'.`);
+    }
+    return parsed;
+  }
+  throw new Error(`Service '${service}' has an unsupported ${label} port value.`);
+}
+function parseFixedPublishedPort(value, service) {
+  if (value === void 0 || value === null || value === "" || value === 0 || value === "0") {
+    return null;
+  }
+  if (typeof value === "string" && value.includes("-")) {
+    return null;
+  }
+  return parseSinglePortValue(value, service, "published host");
+}
+function parsePublishedRange(value, service) {
+  const match = /^(\d+)-(\d+)$/.exec(value.trim());
+  if (!match) return void 0;
+  const lower = Number(match[1]);
+  const upper = Number(match[2]);
+  if (!Number.isInteger(lower) || !Number.isInteger(upper) || lower <= 0 || upper < lower || upper > 65535) {
+    throw new Error(`Service '${service}' publishes an invalid host port range '${value}'.`);
+  }
+  return [lower, upper];
+}
+function resolveFixedPublishedHostPorts(renderedConfig) {
+  const services = isRecord4(renderedConfig) ? renderedConfig.services : void 0;
+  const bindings = [];
+  const pushBinding = (binding) => {
+    bindings.push(binding);
+    if (bindings.length > MAX_DESIRED_HOST_PORTS) {
+      throw new Error(
+        `The managed Compose model declares more than ${MAX_DESIRED_HOST_PORTS} fixed host ports.`
+      );
+    }
+  };
+  for (const [service, serviceValue] of Object.entries(isRecord4(services) ? services : {})) {
+    const serviceRecord = isRecord4(serviceValue) ? serviceValue : {};
+    if (!Array.isArray(serviceRecord.ports)) continue;
+    for (const port of serviceRecord.ports) {
+      if (!isRecord4(port)) {
+        throw new Error(`Service '${service}' declares an unsupported port entry.`);
+      }
+      parseSinglePortValue(port.target, service, "container target");
+      const hostIp = normalizeHostIp(port.host_ip);
+      const protocol = typeof port.protocol === "string" && port.protocol ? port.protocol : "tcp";
+      if (typeof port.published !== "string" || !port.published.includes("-")) {
+        const hostPort = parseFixedPublishedPort(port.published, service);
+        if (hostPort === null) continue;
+        pushBinding({ service, hostIp, hostPort, protocol });
+        continue;
+      }
+      const range = parsePublishedRange(port.published, service);
+      if (!range) {
+        throw new Error(
+          `Service '${service}' publishes an unsupported host port value '${String(port.published)}'.`
+        );
+      }
+      for (let hostPort = range[0]; hostPort <= range[1]; hostPort += 1) {
+        pushBinding({ service, hostIp, hostPort, protocol });
+      }
+    }
+  }
+  return bindings;
+}
+function hostPortBindingsConflict(desired, holder) {
+  return desired.hostPort === holder.hostPort && desired.protocol === holder.protocol && // Wildcards collide with everything in their protocol family; specific
+  // addresses only collide with themselves. IPv6 nuance intentionally
+  // over-approximates: a loud refusal beats a missed kernel collision.
+  (desired.hostIp === null || holder.hostIp === null || desired.hostIp === holder.hostIp);
+}
+var HOST_PORT_INSPECT_TEMPLATE = '{"id":{{json .Id}},"name":{{json .Name}},"labels":{"com.docker.compose.project":{{json (index .Config.Labels "com.docker.compose.project")}},"com.docker.compose.project.working_dir":{{json (index .Config.Labels "com.docker.compose.project.working_dir")}}},"ports":{{json .NetworkSettings.Ports}}}';
+function runDocker(args) {
+  const result = (0, import_node_child_process19.spawnSync)("docker", args, {
+    ...networkDockerOptions(),
+    encoding: "utf-8",
+    timeout: DOCKER_TIMEOUT_MS,
+    maxBuffer: DOCKER_MAX_BUFFER
+  });
+  if (result.error || result.status !== 0) {
+    const reason2 = (result.stderr || result.stdout || result.error?.message || "unknown error").toString().trim();
+    throw new Error(`docker ${String(args[0])} failed: ${reason2}`);
+  }
+  if (typeof result.stdout !== "string") {
+    throw new Error(`docker ${String(args[0])} returned invalid output.`);
+  }
+  return result.stdout;
+}
+function parseHolderPortMap(value) {
+  const ports = [];
+  for (const [key, entries] of Object.entries(isRecord4(value) ? value : {})) {
+    const separator = key.lastIndexOf("/");
+    if (separator <= 0) continue;
+    const protocol = key.slice(separator + 1);
+    if (!Array.isArray(entries)) continue;
+    for (const entry of entries) {
+      if (!isRecord4(entry) || entry.HostPort === void 0 || entry.HostPort === null) continue;
+      const bound = Number(entry.HostPort);
+      if (!Number.isInteger(bound) || bound <= 0) continue;
+      ports.push({ hostIp: normalizeHostIp(entry.HostIp), hostPort: bound, protocol });
+    }
+  }
+  return ports;
+}
+function parseHolderSnapshots(stdout) {
+  return stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).map((line) => {
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      throw new Error("Host-port holder inspection returned malformed JSON.");
+    }
+    if (!isRecord4(parsed) || typeof parsed.id !== "string" || parsed.id.length === 0) {
+      throw new Error("Host-port holder inspection returned an invalid container record.");
+    }
+    const name = typeof parsed.name === "string" ? parsed.name.replace(/^\//, "") : parsed.id;
+    return {
+      id: parsed.id,
+      name,
+      composeProject: optionalLabel(parsed.labels, "com.docker.compose.project"),
+      workingDir: optionalLabel(parsed.labels, "com.docker.compose.project.working_dir"),
+      ports: parseHolderPortMap(parsed.ports)
+    };
+  });
+}
+function listHolderSnapshots() {
+  const listed = runDocker(["ps", "--filter", "status=running", "--format", "{{.ID}}"]);
+  const ids2 = listed.split(/\r?\n/).map((id5) => id5.trim()).filter(Boolean);
+  if (ids2.length === 0) return [];
+  if (ids2.length > MAX_RUNNING_HOLDERS) {
+    throw new Error(
+      `Host-port holder inspection found ${ids2.length} running containers, above its bound.`
+    );
+  }
+  const inspected = runDocker(["inspect", "--format", HOST_PORT_INSPECT_TEMPLATE, ...ids2]);
+  return parseHolderSnapshots(inspected);
+}
+function renderManagedComposeModel(plan, workspace) {
+  const fileArgs = plan.composeFiles.flatMap((file) => ["-f", file]);
+  const result = (0, import_node_child_process19.spawnSync)(
+    "docker",
+    [
+      "compose",
+      "--profile",
+      "*",
+      "--project-directory",
+      plan.composeDirectory,
+      ...fileArgs,
+      "config",
+      "--format",
+      "json"
+    ],
+    {
+      cwd: plan.composeDirectory,
+      encoding: "utf-8",
+      env: managedComposeEnvironment(workspace),
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: COMPOSE_RENDER_TIMEOUT_MS,
+      maxBuffer: COMPOSE_RENDER_MAX_BUFFER
+    }
+  );
+  if (result.status !== 0 || result.error || !result.stdout?.trim()) {
+    const reason2 = (result.stderr || result.error?.message || "unknown error").toString().trim().split(/\r?\n/).slice(-3).join("; ");
+    throw new Error(
+      `Host-port claims could not render the managed Compose model that the start would bind: ${reason2}`
+    );
+  }
+  try {
+    return JSON.parse(result.stdout);
+  } catch {
+    throw new Error("Host-port claims received a malformed rendered Compose model.");
+  }
+}
+function attributeHolderWorktree(workingDir) {
+  if (import_node_path34.default.basename(workingDir) !== ".devcontainer") return void 0;
+  return comparableWorkspacePath(import_node_path34.default.dirname(workingDir));
+}
+function holderAttribution(holder, repoPath) {
+  const attribution = {};
+  if (holder.composeProject) attribution.holderComposeProject = holder.composeProject;
+  const worktree = holder.workingDir ? attributeHolderWorktree(holder.workingDir) : void 0;
+  if (!worktree) return attribution;
+  attribution.holderWorktreePath = worktree;
+  try {
+    const owner = listWorkspaceOwnership(repoPath).find(
+      (record5) => comparableWorkspacePath(record5.worktreePath) === worktree
+    );
+    if (owner) {
+      attribution.holderWorkspace = owner.workspace;
+      if (owner.branch) attribution.holderBranch = owner.branch;
+    }
+  } catch {
+  }
+  return attribution;
+}
+function remediationFor(holder, attribution) {
+  if (attribution.holderWorktreePath) {
+    return `Stop the holding workspace with 'devrouter stop ${attribution.holderWorktreePath}', or override the consumer's published host binding through its own configuration, then run ensure again.`;
+  }
+  return `Stop or reconfigure the holding container '${holder.name}' and run ensure again; devrouter never rewrites consumer-declared host bindings.`;
+}
+function detectHostPortClaimConflicts(options) {
+  const desired = resolveFixedPublishedHostPorts(
+    renderManagedComposeModel(options.plan, options.workspace)
+  );
+  if (desired.length === 0) return [];
+  const holders = listHolderSnapshots();
+  const devcontainerDir = import_node_path34.default.join(options.repoPath, ".devcontainer");
+  const conflicts = [];
+  for (const binding of desired) {
+    for (const holder of holders) {
+      for (const holderPort of holder.ports) {
+        if (!hostPortBindingsConflict(binding, holderPort)) continue;
+        if (holder.workingDir && sameWorkspacePath(holder.workingDir, devcontainerDir)) continue;
+        const attribution = holderAttribution(holder, options.repoPath);
+        conflicts.push({
+          service: binding.service,
+          hostIp: binding.hostIp,
+          hostPort: binding.hostPort,
+          protocol: binding.protocol,
+          holderContainer: holder.name,
+          ...attribution,
+          remediation: remediationFor(holder, attribution)
+        });
+      }
+    }
+  }
+  return conflicts;
+}
+
+// src/core/http-route-probe.ts
+var import_node_child_process20 = require("child_process");
 var DEFAULT_MAX_TIME_SECONDS = 5;
 var PARENT_TIMEOUT_PADDING_MS = 250;
 var CONTRACT_MAX_BUFFER = 1024;
@@ -8863,7 +10309,7 @@ function probeHttpRoute(host, options = {}) {
     args.push("--cacert", CERT_FILE);
   }
   args.push(url);
-  const result = (0, import_node_child_process19.spawnSync)("curl", args, { encoding: "utf-8" });
+  const result = (0, import_node_child_process20.spawnSync)("curl", args, { encoding: "utf-8" });
   const stdout = result.stdout?.trim() ?? "";
   const status = /^\d{3}$/.test(stdout) ? Number(stdout) : void 0;
   const ok = result.status === 0 && status !== void 0 && status >= 100 && status < 500;
@@ -8882,7 +10328,7 @@ function probeHttpReadinessSync(host, readiness, maxTimeSeconds, repoPath) {
   }
   let result;
   try {
-    result = (0, import_node_child_process19.spawnSync)("curl", args, {
+    result = (0, import_node_child_process20.spawnSync)("curl", args, {
       encoding: "utf-8",
       maxBuffer: CONTRACT_MAX_BUFFER,
       timeout: Math.ceil(parentTimeoutMs)
@@ -8966,8 +10412,8 @@ function transportFailure() {
 }
 
 // src/core/managed-host-preparation.ts
-var import_node_child_process20 = require("child_process");
-var import_node_fs24 = __toESM(require("fs"));
+var import_node_child_process21 = require("child_process");
+var import_node_fs29 = __toESM(require("fs"));
 var PREPARATION_TIMEOUT_MS = 6e4;
 var CONFIG_READ_ERROR = "Managed host preparation could not read .devrouter.yml.";
 var CONFIG_CHANGED_ERROR = "Managed host preparation changed .devrouter.yml; refusing to continue.";
@@ -8978,7 +10424,7 @@ function runPreparationCommand(argv, cwd) {
   return new Promise((resolve) => {
     let child;
     try {
-      child = (0, import_node_child_process20.spawn)(argv[0], argv.slice(1), {
+      child = (0, import_node_child_process21.spawn)(argv[0], argv.slice(1), {
         cwd,
         detached: true,
         shell: false,
@@ -9010,7 +10456,7 @@ function runPreparationCommand(argv, cwd) {
 }
 function readConfigBytes(configPath) {
   try {
-    return import_node_fs24.default.readFileSync(configPath);
+    return import_node_fs29.default.readFileSync(configPath);
   } catch {
     return void 0;
   }
@@ -9044,10 +10490,10 @@ async function runManagedHostPreparation(repoPath, config) {
 }
 
 // src/core/managed-post-start.ts
-var import_node_child_process21 = require("child_process");
-var import_node_crypto13 = require("crypto");
-var import_node_fs25 = __toESM(require("fs"));
-var import_node_path29 = __toESM(require("path"));
+var import_node_child_process22 = require("child_process");
+var import_node_crypto16 = require("crypto");
+var import_node_fs30 = __toESM(require("fs"));
+var import_node_path35 = __toESM(require("path"));
 var MANAGED_MARKER = "devrouter:managed devcontainer";
 var MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
 var RUNTIME_HELPER_PATH = "/tmp/devrouter/bin/devrouter-process";
@@ -9060,7 +10506,7 @@ function renderDeliveryScript(targetPath) {
   if (!/^\/tmp\/devrouter\/bin\/[a-zA-Z0-9._-]+$/.test(targetPath)) {
     throw new Error(`Unsafe managed runtime delivery path: ${targetPath}`);
   }
-  const temporaryPrefix = import_node_path29.default.posix.basename(targetPath);
+  const temporaryPrefix = import_node_path35.default.posix.basename(targetPath);
   return `set -eu
 umask 077
 runtime_root=/tmp/devrouter
@@ -9084,7 +10530,7 @@ function commandFailure3(result) {
   return [result.error?.message, result.stderr, result.stdout].filter(Boolean).map((value) => String(value).trim()).filter(Boolean).join("\n");
 }
 function deliverRuntimeFile(containerId, targetPath, contents, label) {
-  const result = (0, import_node_child_process21.spawnSync)(
+  const result = (0, import_node_child_process22.spawnSync)(
     "docker",
     ["exec", "-i", containerId, "sh", "-c", renderDeliveryScript(targetPath)],
     { input: contents, encoding: "utf-8", ...networkDockerOptions() }
@@ -9095,32 +10541,32 @@ function deliverRuntimeFile(containerId, targetPath, contents, label) {
   }
 }
 function readRegularFileBytes(filePath) {
-  if (!import_node_fs25.default.existsSync(filePath) || !import_node_fs25.default.lstatSync(filePath).isFile()) return void 0;
-  return import_node_fs25.default.readFileSync(filePath);
+  if (!import_node_fs30.default.existsSync(filePath) || !import_node_fs30.default.lstatSync(filePath).isFile()) return void 0;
+  return import_node_fs30.default.readFileSync(filePath);
 }
 function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
 }
 function adapterFingerprint(adapter) {
-  return (0, import_node_crypto13.createHash)("sha256").update(adapter).digest("hex");
+  return (0, import_node_crypto16.createHash)("sha256").update(adapter).digest("hex");
 }
 function resolveProcessHelperPath() {
   const candidates = [
-    import_node_path29.default.resolve(__dirname, "..", "bin", "devrouter-process"),
-    import_node_path29.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
+    import_node_path35.default.resolve(__dirname, "..", "bin", "devrouter-process"),
+    import_node_path35.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
   ];
-  const helperPath = candidates.find((candidate) => import_node_fs25.default.existsSync(candidate));
+  const helperPath = candidates.find((candidate) => import_node_fs30.default.existsSync(candidate));
   if (!helperPath) {
     throw new Error("Could not locate the packaged devrouter-process helper.");
   }
   return helperPath;
 }
 function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path29.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterPath = import_node_path35.default.join(repoPath, MANAGED_ADAPTER_PATH);
   const adapterBytes = readRegularFileBytes(adapterPath);
   const adapterText = adapterBytes?.toString("utf-8");
-  const dockerfilePath = import_node_path29.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path29.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfilePath = import_node_path35.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path35.default.join(repoPath, ".devcontainer", "devcontainer.json");
   const dockerfile = readRegularFile(dockerfilePath) ?? "";
   const devcontainer = readRegularFile(devcontainerPath) ?? "";
   const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
@@ -9161,7 +10607,7 @@ function resolveManagedPostStartPlan(repoPath) {
 }
 function runManagedPostStart(options) {
   if (options.plan.kind !== "runtime") return;
-  const helper = import_node_fs25.default.readFileSync(resolveProcessHelperPath());
+  const helper = import_node_fs30.default.readFileSync(resolveProcessHelperPath());
   deliverRuntimeFile(
     options.container.id,
     RUNTIME_HELPER_PATH,
@@ -9175,7 +10621,7 @@ function runManagedPostStart(options) {
     options.plan.adapterContents,
     "the managed post-start adapter"
   );
-  const started2 = (0, import_node_child_process21.spawnSync)(
+  const started2 = (0, import_node_child_process22.spawnSync)(
     "docker",
     [
       "exec",
@@ -9216,7 +10662,7 @@ function assertSafeProcessName(name) {
 }
 function runManagedProcessAction(options) {
   assertSafeProcessName(options.name);
-  const result = (0, import_node_child_process21.spawnSync)(
+  const result = (0, import_node_child_process22.spawnSync)(
     "docker",
     [
       "exec",
@@ -9681,7 +11127,7 @@ function collectManagedRuntimeStatus(options) {
 }
 
 // src/core/network-inventory.ts
-var import_node_child_process22 = require("child_process");
+var import_node_child_process23 = require("child_process");
 var NetworkInventoryError = class extends Error {
 };
 var MAX_IDS = 4096;
@@ -9693,7 +11139,7 @@ function readDocker(endpoint, args, timeoutMs) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process22.spawnSync)("docker", ["--host", endpoint, ...args], {
+  const result = (0, import_node_child_process23.spawnSync)("docker", ["--host", endpoint, ...args], {
     env,
     encoding: "utf-8",
     timeout: timeoutMs,
@@ -9710,14 +11156,14 @@ function record4(value) {
   }
   return value;
 }
-function text2(value) {
+function text3(value) {
   if (typeof value !== "string" || !value || value.includes("\0")) {
     throw new NetworkInventoryError("Docker network inventory contains an invalid identity.");
   }
   return value;
 }
-function id2(value) {
-  const result = text2(value);
+function id4(value) {
+  const result = text3(value);
   if (!FULL_ID.test(result))
     throw new NetworkInventoryError("Docker inventory requires full object IDs.");
   return result;
@@ -9727,7 +11173,7 @@ function rows(output) {
   return trimmed ? trimmed.split(/\r?\n/).map((line) => JSON.parse(line)) : [];
 }
 function ids(output) {
-  const values = output.trim() ? output.trim().split(/\r?\n/).map(id2) : [];
+  const values = output.trim() ? output.trim().split(/\r?\n/).map(id4) : [];
   if (values.length > MAX_IDS || new Set(values).size !== values.length) {
     throw new NetworkInventoryError("Docker network inventory has duplicate or too many objects.");
   }
@@ -9773,7 +11219,7 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
         read2(["info", "--format", '{"id":{{json .ID}},"pools":{{json .DefaultAddressPools}}}'])
       )
     );
-    result.daemonId = text2(info.id);
+    result.daemonId = text3(info.id);
     if (options.expectedDaemonId && result.daemonId !== options.expectedDaemonId) {
       throw new NetworkInventoryError("Docker daemon identity changed before network inspection.");
     }
@@ -9781,7 +11227,7 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
       throw new NetworkInventoryError("Docker default pools are unavailable.");
     result.pools = info.pools.map((value) => {
       const pool = record4(value);
-      const base = text2(pool.Base);
+      const base = text3(pool.Base);
       if (!Number.isSafeInteger(pool.Size) || Number(pool.Size) < 0 || Number(pool.Size) > 128) {
         throw new NetworkInventoryError("Docker default pool allocation size is invalid.");
       }
@@ -9796,11 +11242,11 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
         throw new NetworkInventoryError("Docker network IPAM or endpoint evidence is unavailable.");
       }
       return {
-        id: id2(network.id),
-        name: text2(network.name),
-        driver: text2(network.driver),
+        id: id4(network.id),
+        name: text3(network.name),
+        driver: text3(network.driver),
         subnets: (network.ipam === null ? [] : network.ipam).map(
-          (entry) => text2(record4(entry).Subnet)
+          (entry) => text3(record4(entry).Subnet)
         ),
         activeEndpoints: Number(network.activeEndpoints),
         retainedContainerIds: [],
@@ -9816,11 +11262,11 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
     const inspected = [];
     for (const value of containers) {
       const container = record4(value);
-      const containerId = id2(container.id);
+      const containerId = id4(container.id);
       inspected.push(containerId);
       for (const membership of Object.values(record4(container.networks))) {
         const reference = record4(membership);
-        const networkId = id2(reference.NetworkID);
+        const networkId = id4(reference.NetworkID);
         const network = byId.get(networkId);
         if (!network)
           throw new NetworkInventoryError("A retained container references an unobserved network.");
@@ -9838,7 +11284,7 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
         "Docker object population changed during network inspection."
       );
     }
-    const finalId = text2(JSON.parse(read2(["info", "--format", "{{json .ID}}"])));
+    const finalId = text3(JSON.parse(read2(["info", "--format", "{{json .ID}}"])));
     if (finalId !== result.daemonId)
       throw new NetworkInventoryError("Docker daemon identity changed during inspection.");
     result.status = "complete";
@@ -9850,37 +11296,37 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
 }
 
 // src/core/network-routes.ts
-var import_node_child_process23 = require("child_process");
-var import_node_net2 = require("net");
+var import_node_child_process24 = require("child_process");
+var import_node_net3 = require("net");
 
 // src/core/network-local-daemon.ts
-var import_node_fs26 = __toESM(require("fs"));
-var import_node_path30 = __toESM(require("path"));
+var import_node_fs31 = __toESM(require("fs"));
+var import_node_path36 = __toESM(require("path"));
 function hasLocalDockerNetworkNamespace(endpoint, procRoot = "/proc") {
   const deadline = Date.now() + 2e3;
   try {
     if (!endpoint.startsWith("unix:///")) return false;
     const socket = endpoint.slice("unix://".length);
-    const table = import_node_fs26.default.readFileSync(import_node_path30.default.join(procRoot, "net/unix"), "utf8");
+    const table = import_node_fs31.default.readFileSync(import_node_path36.default.join(procRoot, "net/unix"), "utf8");
     if (Buffer.byteLength(table) > 1024 * 1024) return false;
     const rows2 = table.split("\n").map((line) => line.trim().split(/\s+/)).filter((row) => row[7] === socket && row[3] === "00010000");
     if (rows2.length !== 1 || !/^\d+$/.test(rows2[0][6])) return false;
     const inode = `socket:[${rows2[0][6]}]`;
-    const ownNamespace = import_node_fs26.default.readlinkSync(import_node_path30.default.join(procRoot, "self/ns/net"));
-    const pids = import_node_fs26.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
+    const ownNamespace = import_node_fs31.default.readlinkSync(import_node_path36.default.join(procRoot, "self/ns/net"));
+    const pids = import_node_fs31.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
     if (pids.length > 4096) return false;
     for (const pid of pids) {
       if (Date.now() > deadline) return false;
       try {
-        const root = import_node_path30.default.join(procRoot, pid);
-        if (import_node_path30.default.basename(import_node_fs26.default.readlinkSync(import_node_path30.default.join(root, "exe"))) !== "dockerd") continue;
-        if (import_node_fs26.default.readlinkSync(import_node_path30.default.join(root, "ns/net")) !== ownNamespace) continue;
-        const descriptors = import_node_fs26.default.readdirSync(import_node_path30.default.join(root, "fd"));
+        const root = import_node_path36.default.join(procRoot, pid);
+        if (import_node_path36.default.basename(import_node_fs31.default.readlinkSync(import_node_path36.default.join(root, "exe"))) !== "dockerd") continue;
+        if (import_node_fs31.default.readlinkSync(import_node_path36.default.join(root, "ns/net")) !== ownNamespace) continue;
+        const descriptors = import_node_fs31.default.readdirSync(import_node_path36.default.join(root, "fd"));
         if (descriptors.length > 4096) continue;
         if (descriptors.some((fd) => {
           if (Date.now() > deadline) return false;
           try {
-            return import_node_fs26.default.readlinkSync(import_node_path30.default.join(root, "fd", fd)) === inode;
+            return import_node_fs31.default.readlinkSync(import_node_path36.default.join(root, "fd", fd)) === inode;
           } catch {
             return false;
           }
@@ -9906,7 +11352,7 @@ function parseLinuxNetworkRoutes(output) {
       const value = row;
       if (typeof value.dst !== "string") throw new Error();
       if (value.dst === "default") continue;
-      if ((0, import_node_net2.isIP)(value.dst.split("/")[0]) === 6) continue;
+      if ((0, import_node_net3.isIP)(value.dst.split("/")[0]) === 6) continue;
       const cidr = parseIPv4Cidr(value.dst.includes("/") ? value.dst : `${value.dst}/32`);
       if (!cidr || typeof value.dev !== "string" || !value.dev) throw new Error();
       routes.push({ cidr, interface: value.dev, source: "host" });
@@ -9919,7 +11365,7 @@ function parseLinuxNetworkRoutes(output) {
 function collectNetworkRoutes(options) {
   if ((options.platform ?? process.platform) !== "linux" || !hasLocalDockerNetworkNamespace(options.endpoint))
     return { status: "unknown", routes: [] };
-  const result = (0, import_node_child_process23.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
+  const result = (0, import_node_child_process24.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
     encoding: "utf8",
     timeout: 5e3,
     maxBuffer: 1024 * 1024
@@ -9955,12 +11401,12 @@ function inspectLegacyNetworkCapacity(input) {
 }
 
 // src/core/network-managed.ts
-var import_node_crypto16 = require("crypto");
+var import_node_crypto19 = require("crypto");
 
 // src/core/network-compose.ts
-var import_node_crypto14 = require("crypto");
+var import_node_crypto17 = require("crypto");
 var SAFE_ENDPOINT_UPPER_BOUND_SEMANTICS = "full-lifecycle-demand";
-function isRecord4(value) {
+function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function hasOwn(record5, key) {
@@ -9978,13 +11424,13 @@ function sortedUnique2(values) {
   return [...new Set(values)].sort((left, right) => left.localeCompare(right));
 }
 function readMap(value) {
-  return isRecord4(value) ? value : void 0;
+  return isRecord5(value) ? value : void 0;
 }
 function readMode(input) {
   if (input.mode !== void 0) {
     return input.mode;
   }
-  if (!isRecord4(input.metadata)) {
+  if (!isRecord5(input.metadata)) {
     return void 0;
   }
   for (const key of ["mode", "runtimeMode", "checkoutMode"]) {
@@ -10001,7 +11447,7 @@ function readExternal(value) {
   if (typeof value === "boolean") {
     return { value, known: true };
   }
-  if (isRecord4(value)) {
+  if (isRecord5(value)) {
     return { value: true, known: true };
   }
   return { known: false };
@@ -10016,7 +11462,7 @@ function readDriver(value) {
   return { value: value.toLowerCase(), known: true };
 }
 function inspectNetworks(input, reasons) {
-  const compose = isRecord4(input.compose) ? input.compose : {};
+  const compose = isRecord5(input.compose) ? input.compose : {};
   const normalizedValue2 = compose.networks;
   const authoredValue2 = input.authoredNetworks;
   const normalized = normalizedValue2 === void 0 ? {} : readMap(normalizedValue2);
@@ -10045,7 +11491,7 @@ function inspectNetworks(input, reasons) {
     );
   } else {
     for (const [serviceName, rawService] of Object.entries(services)) {
-      if (!isRecord4(rawService)) {
+      if (!isRecord5(rawService)) {
         addReason(reasons, reason("malformed-service", `Service ${serviceName} is not an object.`));
         continue;
       }
@@ -10090,7 +11536,7 @@ function parseServiceNetworks(value, serviceName, reasons) {
     }
     return { names: sortedUnique2(names), known: true };
   }
-  if (!isRecord4(value)) {
+  if (!isRecord5(value)) {
     addReason(
       reasons,
       reason(
@@ -10110,7 +11556,7 @@ function parseServiceNetworks(value, serviceName, reasons) {
       );
       continue;
     }
-    if (attachment !== null && !isRecord4(attachment)) {
+    if (attachment !== null && !isRecord5(attachment)) {
       known = false;
       addReason(
         reasons,
@@ -10125,27 +11571,27 @@ function parseServiceNetworks(value, serviceName, reasons) {
 }
 function authoredHas(authored, name, key) {
   const declaration = authored[name];
-  return isRecord4(declaration) && hasOwn(declaration, key);
+  return isRecord5(declaration) && hasOwn(declaration, key);
 }
 function authoredValue(authored, name, key) {
   const declaration = authored[name];
-  return isRecord4(declaration) ? declaration[key] : void 0;
+  return isRecord5(declaration) ? declaration[key] : void 0;
 }
 function normalizedValue(normalized, name, key) {
   const declaration = normalized[name];
-  return isRecord4(declaration) ? declaration[key] : void 0;
+  return isRecord5(declaration) ? declaration[key] : void 0;
 }
 function classifyNetwork(name, inspection, reasons) {
   const authoredDeclaration = inspection.authored[name];
   const normalizedDeclaration = inspection.normalized[name];
-  if (authoredDeclaration !== void 0 && !isRecord4(authoredDeclaration)) {
+  if (authoredDeclaration !== void 0 && !isRecord5(authoredDeclaration)) {
     addReason(
       reasons,
       reason("malformed-authored-network", `Authored network ${name} is not an object.`)
     );
     return { external: false, private: false };
   }
-  if (normalizedDeclaration !== void 0 && !isRecord4(normalizedDeclaration)) {
+  if (normalizedDeclaration !== void 0 && !isRecord5(normalizedDeclaration)) {
     addReason(
       reasons,
       reason("malformed-normalized-network", `Normalized network ${name} is not an object.`)
@@ -10226,7 +11672,7 @@ function classifyNetwork(name, inspection, reasons) {
   } else {
     const normalizedIpam = normalizedValue(inspection.normalized, name, "ipam");
     if (normalizedIpam !== void 0) {
-      if (!isRecord4(normalizedIpam)) {
+      if (!isRecord5(normalizedIpam)) {
         addReason(
           reasons,
           reason("malformed-normalized-ipam", `Network ${name} has malformed normalized IPAM.`)
@@ -10328,7 +11774,7 @@ function parseCount(value, field, reasons) {
   if (value === void 0) {
     return { value: 0, known: true };
   }
-  const candidate = isRecord4(value) && hasOwn(value, "count") ? value.count : value;
+  const candidate = isRecord5(value) && hasOwn(value, "count") ? value.count : value;
   if (typeof candidate !== "number" || !Number.isSafeInteger(candidate) || candidate < 0) {
     addReason(reasons, reason("malformed-count", `${field} must be a non-negative integer.`));
     return { value: 0, known: false };
@@ -10344,7 +11790,7 @@ function parseReplicas(service, serviceName, reasons) {
     candidates.push({ field: "scale", value: service.scale });
   }
   if (hasOwn(service, "deploy")) {
-    if (!isRecord4(service.deploy)) {
+    if (!isRecord5(service.deploy)) {
       addReason(
         reasons,
         reason("malformed-replicas", `Service ${serviceName} deploy metadata is malformed.`)
@@ -10399,7 +11845,7 @@ function parseUpperBound(input, reasons) {
   const raw = input.endpointUpperBound;
   let value = raw;
   let semantics = input.endpointUpperBoundSemantics;
-  if (isRecord4(raw)) {
+  if (isRecord5(raw)) {
     value = raw.value ?? raw.endpoints ?? raw.count;
     semantics = raw.semantics ?? semantics;
   }
@@ -10464,7 +11910,7 @@ function deriveComposeNetworkDemand(input) {
       )
     );
   }
-  const compose = isRecord4(input.compose) ? input.compose : {};
+  const compose = isRecord5(input.compose) ? input.compose : {};
   const services = readMap(compose.services);
   const serviceEndpointsByService = {};
   const replicasByService = {};
@@ -10482,7 +11928,7 @@ function deriveComposeNetworkDemand(input) {
     serviceDemandKnown = false;
   } else {
     for (const [serviceName, rawService] of Object.entries(services)) {
-      if (!isRecord4(rawService)) {
+      if (!isRecord5(rawService)) {
         addReason(reasons, reason("malformed-service", `Service ${serviceName} is not an object.`));
         serviceDemandKnown = false;
         continue;
@@ -10584,7 +12030,7 @@ function deriveComposeNetworkOverlay(subnet) {
   };
 }
 function extendDockerComposeFile(nativeConfig, overlayPath) {
-  if (!isRecord4(nativeConfig)) {
+  if (!isRecord5(nativeConfig)) {
     return {
       status: "unknown",
       reasons: [
@@ -10635,7 +12081,7 @@ function replicaProjection(service) {
   return replicas.known ? replicas.value : "unknown";
 }
 function redactedNetworkProjection(value) {
-  if (!isRecord4(value)) {
+  if (!isRecord5(value)) {
     return value === void 0 ? void 0 : "unknown";
   }
   const projection = {};
@@ -10654,7 +12100,7 @@ function redactedNetworkProjection(value) {
         const config = Array.isArray(ipam?.config) ? ipam.config : void 0;
         projection.ipam = {
           config: config === void 0 ? "unknown" : config.map(
-            (entry) => isRecord4(entry) && typeof entry.subnet === "string" ? entry.subnet : "unknown"
+            (entry) => isRecord5(entry) && typeof entry.subnet === "string" ? entry.subnet : "unknown"
           )
         };
       } else if (key === "enable_ipv6") {
@@ -10670,7 +12116,7 @@ function redactedCountProjection(value) {
   if (value === void 0) {
     return 0;
   }
-  const candidate = isRecord4(value) && hasOwn(value, "count") ? value.count : value;
+  const candidate = isRecord5(value) && hasOwn(value, "count") ? value.count : value;
   return typeof candidate === "number" && Number.isSafeInteger(candidate) && candidate >= 0 ? candidate : "unknown";
 }
 function redactedUpperBoundProjection(value) {
@@ -10680,7 +12126,7 @@ function redactedUpperBoundProjection(value) {
   if (typeof value === "number") {
     return Number.isSafeInteger(value) && value >= 0 ? value : "unknown";
   }
-  if (!isRecord4(value)) {
+  if (!isRecord5(value)) {
     return "unknown";
   }
   const candidate = value.value ?? value.endpoints ?? value.count;
@@ -10690,12 +12136,12 @@ function redactedUpperBoundProjection(value) {
   };
 }
 function normalizedFingerprintProjection(input) {
-  const compose = isRecord4(input.compose) ? input.compose : {};
+  const compose = isRecord5(input.compose) ? input.compose : {};
   const services = readMap(compose.services);
   const serviceProjection = {};
   for (const serviceName of Object.keys(services ?? {}).sort()) {
     const service = services?.[serviceName];
-    serviceProjection[serviceName] = isRecord4(service) ? {
+    serviceProjection[serviceName] = isRecord5(service) ? {
       networks: projectionNetworkMembership(service.networks),
       replicas: replicaProjection(service)
     } : "unknown";
@@ -10727,14 +12173,14 @@ function normalizedFingerprintProjection(input) {
   };
 }
 function redactedOverlayProjection(value) {
-  if (!isRecord4(value)) {
+  if (!isRecord5(value)) {
     return value === void 0 ? void 0 : "unknown";
   }
   const networks = readMap(value.networks);
   const defaultNetwork = readMap(networks?.default);
   const ipam = readMap(defaultNetwork?.ipam);
   const config = Array.isArray(ipam?.config) ? ipam.config : void 0;
-  if (config === void 0 || config.some((entry) => !isRecord4(entry) || typeof entry.subnet !== "string")) {
+  if (config === void 0 || config.some((entry) => !isRecord5(entry) || typeof entry.subnet !== "string")) {
     return "unknown";
   }
   return {
@@ -10757,26 +12203,26 @@ function stableValue(value) {
   if (Array.isArray(value)) {
     return `[${value.map((item) => stableValue(item)).join(",")}]`;
   }
-  if (isRecord4(value)) {
+  if (isRecord5(value)) {
     return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableValue(value[key])}`).join(",")}}`;
   }
   return JSON.stringify(String(value));
 }
 function fingerprintComposeNetworkModel(input) {
   const projection = normalizedFingerprintProjection(input);
-  return (0, import_node_crypto14.createHash)("sha256").update(stableValue(projection), "utf8").digest("hex");
+  return (0, import_node_crypto17.createHash)("sha256").update(stableValue(projection), "utf8").digest("hex");
 }
 
 // src/core/network-compose-files.ts
-var import_node_child_process24 = require("child_process");
-var import_node_crypto15 = require("crypto");
-var import_node_fs27 = __toESM(require("fs"));
-var import_node_path31 = __toESM(require("path"));
+var import_node_child_process25 = require("child_process");
+var import_node_crypto18 = require("crypto");
+var import_node_fs32 = __toESM(require("fs"));
+var import_node_path37 = __toESM(require("path"));
 var import_yaml4 = __toESM(require("yaml"));
 var OVERLAY = "docker-compose.devrouter-network.yml";
 var MARKER = "# devrouter:managed workspace network";
-var MAX_BYTES = 2 * 1024 * 1024;
-function object2(value) {
+var MAX_BYTES2 = 2 * 1024 * 1024;
+function object3(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("Network Compose evidence is malformed.");
   return value;
@@ -10784,20 +12230,20 @@ function object2(value) {
 function inspectNetworkComposeFiles(input) {
   const authoredNetworks = {};
   for (const file of input.plan.composeFiles) {
-    const stat = import_node_fs27.default.lstatSync(file);
-    if (!stat.isFile() || stat.size > MAX_BYTES)
+    const stat = import_node_fs32.default.lstatSync(file);
+    if (!stat.isFile() || stat.size > MAX_BYTES2)
       throw new Error("Network Compose source is unavailable or too large.");
     let source;
     try {
-      source = object2(import_yaml4.default.parse(import_node_fs27.default.readFileSync(file, "utf8")));
+      source = object3(import_yaml4.default.parse(import_node_fs32.default.readFileSync(file, "utf8")));
     } catch {
       throw new Error("Network Compose source could not be parsed safely.");
     }
     if (source.networks !== void 0) {
-      for (const [name, declaration] of Object.entries(object2(source.networks))) {
+      for (const [name, declaration] of Object.entries(object3(source.networks))) {
         authoredNetworks[name] = {
           ...authoredNetworks[name],
-          ...declaration === null ? {} : object2(declaration)
+          ...declaration === null ? {} : object3(declaration)
         };
       }
     }
@@ -10805,7 +12251,7 @@ function inspectNetworkComposeFiles(input) {
   const env = managedComposeEnvironment(input.workspace);
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process24.spawnSync)(
+  const result = (0, import_node_child_process25.spawnSync)(
     "docker",
     [
       "--host",
@@ -10825,13 +12271,13 @@ function inspectNetworkComposeFiles(input) {
       env,
       encoding: "utf8",
       timeout: 1e4,
-      maxBuffer: MAX_BYTES
+      maxBuffer: MAX_BYTES2
     }
   );
   if (result.error || result.status !== 0)
     throw new Error("Complete network Compose evidence is unavailable.");
   try {
-    return { compose: object2(JSON.parse(result.stdout)), authoredNetworks };
+    return { compose: object3(JSON.parse(result.stdout)), authoredNetworks };
   } catch {
     throw new Error("Network Compose evidence is malformed.");
   }
@@ -10839,8 +12285,8 @@ function inspectNetworkComposeFiles(input) {
 function prepareNetworkComposeFiles(plan, subnet) {
   const overlay = deriveComposeNetworkOverlay(subnet);
   if (overlay.status !== "ready" || !overlay.overlay) throw new Error("Network subnet is invalid.");
-  const overlayPath = import_node_path31.default.join(plan.composeDirectory, OVERLAY);
-  const ignored = (0, import_node_child_process24.spawnSync)("git", [
+  const overlayPath = import_node_path37.default.join(plan.composeDirectory, OVERLAY);
+  const ignored = (0, import_node_child_process25.spawnSync)("git", [
     "-C",
     plan.composeDirectory,
     "check-ignore",
@@ -10851,12 +12297,12 @@ function prepareNetworkComposeFiles(plan, subnet) {
   ]);
   if (ignored.status !== 0)
     throw new Error("Generated network overlay must be ignored before allocation.");
-  const bytes = `${MARKER}
+  const bytes2 = `${MARKER}
 ${import_yaml4.default.stringify(overlay.overlay)}`;
   const assertOwnership = () => {
-    if (!import_node_fs27.default.existsSync(overlayPath)) return;
-    const stat = import_node_fs27.default.lstatSync(overlayPath);
-    if (!stat.isFile() || stat.size > MAX_BYTES || import_node_fs27.default.readFileSync(overlayPath, "utf8") !== bytes)
+    if (!import_node_fs32.default.existsSync(overlayPath)) return;
+    const stat = import_node_fs32.default.lstatSync(overlayPath);
+    if (!stat.isFile() || stat.size > MAX_BYTES2 || import_node_fs32.default.readFileSync(overlayPath, "utf8") !== bytes2)
       throw new Error("Retained network overlay changed; repair is required.");
   };
   assertOwnership();
@@ -10870,19 +12316,19 @@ ${JSON.stringify(extended.config, null, 2)}
     ...plan,
     contents,
     composeFiles: [...plan.composeFiles, overlayPath],
-    effectiveConfigSha256: (0, import_node_crypto15.createHash)("sha256").update(contents).digest("hex")
+    effectiveConfigSha256: (0, import_node_crypto18.createHash)("sha256").update(contents).digest("hex")
   };
   return {
     plan: result,
     write: () => {
       assertOwnership();
-      writeFileAtomically(overlayPath, bytes);
+      writeFileAtomically(overlayPath, bytes2);
     }
   };
 }
 
 // src/core/network-connected-route.ts
-var import_node_child_process25 = require("child_process");
+var import_node_child_process26 = require("child_process");
 function bounds(cidr) {
   const canonical = parseIPv4Cidr(cidr);
   if (!canonical) throw new Error("Invalid connected route.");
@@ -10907,7 +12353,7 @@ function inspectClaimedBridge(claim2, networkId) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process25.spawnSync)(
+  const result = (0, import_node_child_process26.spawnSync)(
     "docker",
     [
       "--host",
@@ -10934,7 +12380,7 @@ function inspectClaimedBridge(claim2, networkId) {
     const [first, last] = bounds(claim2.subnet);
     const [address] = bounds(gateway);
     if (address <= first || address >= last) throw new Error();
-    const interfaces = (0, import_node_child_process25.spawnSync)("ip", ["-j", "-d", "-4", "address", "show", "dev", bridge], {
+    const interfaces = (0, import_node_child_process26.spawnSync)("ip", ["-j", "-d", "-4", "address", "show", "dev", bridge], {
       encoding: "utf8",
       timeout: 5e3,
       maxBuffer: 65536
@@ -11188,7 +12634,7 @@ function createManagedNetworkSession(input) {
           "Insufficient endpoint headroom; request an allowed larger network before first allocation."
         );
       const authority = readNetworkOperationAuthority(identity2);
-      const fingerprint = (0, import_node_crypto16.createHash)("sha256").update(input.plan().sourceConfigSha256).update(fingerprintComposeNetworkModel(model)).digest("hex");
+      const fingerprint = (0, import_node_crypto19.createHash)("sha256").update(input.plan().sourceConfigSha256).update(fingerprintComposeNetworkModel(model)).digest("hex");
       if (!saved) {
         if (policy.status !== "valid")
           throw new Error("New network allocation requires valid machine policy.");
@@ -11372,11 +12818,11 @@ var DEFAULT_READINESS_TIMEOUT_MS = 12e4;
 var POLL_INTERVAL_MS = 1e3;
 function assertOverlay(container, repoPath) {
   const workingDir = container.labels["com.docker.compose.project.working_dir"];
-  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path32.default.join(repoPath, ".devcontainer"))) {
+  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path38.default.join(repoPath, ".devcontainer"))) {
     throw new Error(`Container '${container.id}' does not belong to the exact worktree.`);
   }
   const configFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").filter(Boolean);
-  const expectedOverlay = import_node_path32.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+  const expectedOverlay = import_node_path38.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
   if (!configFiles.some((configFile) => sameWorkspacePath(configFile, expectedOverlay))) {
     throw new Error(`Container '${container.id}' was not started with ${DEVCONTAINER_OVERLAY}.`);
   }
@@ -11571,7 +13017,7 @@ function hasExactManagedComposeProject(repoPath, state) {
     }).some((container) => {
       const workingDir = container.labels["com.docker.compose.project.working_dir"];
       return Boolean(
-        workingDir && sameWorkspacePath(workingDir, import_node_path32.default.join(repoPath, ".devcontainer"))
+        workingDir && sameWorkspacePath(workingDir, import_node_path38.default.join(repoPath, ".devcontainer"))
       );
     });
   } catch {
@@ -11679,7 +13125,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
         target
       });
       if (target.kind === "linked") {
-        const workspaceEnv = (0, import_node_child_process26.spawnSync)(
+        const workspaceEnv = (0, import_node_child_process27.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "WORKSPACE"],
           { encoding: "utf-8", ...networkDockerOptions() }
@@ -11689,7 +13135,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
             `Workspace app container must expose WORKSPACE='${target.workspace}' (got '${workspaceEnv.stdout.trim() || "(empty)"}').`
           );
         }
-        const devrouterWorkspaceEnv = (0, import_node_child_process26.spawnSync)(
+        const devrouterWorkspaceEnv = (0, import_node_child_process27.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "DEVROUTER_WORKSPACE"],
           { encoding: "utf-8", ...networkDockerOptions() }
@@ -11700,7 +13146,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
           );
         }
       }
-      const gitCheck = (0, import_node_child_process26.spawnSync)(
+      const gitCheck = (0, import_node_child_process27.spawnSync)(
         "docker",
         [
           "exec",
@@ -11955,14 +13401,14 @@ function resolvePrimaryTarget(repoPath) {
 }
 function isPrimaryCheckout(repoPath) {
   try {
-    return import_node_fs28.default.statSync(import_node_path32.default.join(repoPath, ".git")).isDirectory();
+    return import_node_fs33.default.statSync(import_node_path38.default.join(repoPath, ".git")).isDirectory();
   } catch {
     return false;
   }
 }
 function openUrls(urls) {
   for (const url of urls) {
-    const opened = (0, import_node_child_process26.spawnSync)("open", [url], { encoding: "utf-8" });
+    const opened = (0, import_node_child_process27.spawnSync)("open", [url], { encoding: "utf-8" });
     if (opened.status !== 0) {
       process.stderr.write(`Warning: could not open '${url}'.
 `);
@@ -12018,8 +13464,8 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       const target = options.repair ? resolveRepairTarget(repoPath, linked) : linked ? resolveLinkedTarget(repoPath) : resolvePrimaryTarget(repoPath);
       let devpodId = target.devpodId;
       if (target.kind === "linked") {
-        const overlayPath = import_node_path32.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
-        if (!import_node_fs28.default.existsSync(overlayPath)) {
+        const overlayPath = import_node_path38.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+        if (!import_node_fs33.default.existsSync(overlayPath)) {
           throw new Error(`Missing required DevPod compose overlay: ${overlayPath}`);
         }
       }
@@ -12087,9 +13533,38 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           });
         }
       }
+      if (managedPlan) {
+        let hostPortConflicts = [];
+        try {
+          hostPortConflicts = detectHostPortClaimConflicts({
+            repoPath,
+            plan: managedPlan,
+            workspace: managedWorkspaceEnv
+          });
+        } catch (error) {
+          throw new Error(
+            `Managed admission could not verify fixed host-port claims before start: ${error instanceof Error ? error.message : String(error)}`
+          );
+        }
+        if (hostPortConflicts.length > 0) {
+          return {
+            kind: target.kind,
+            repoPath,
+            ...target.kind === "linked" ? { workspace: target.workspace } : {},
+            profile: runtime.profile,
+            // A refusal precedes the provider start, so the exact id may not
+            // be known yet on a primary checkout.
+            devpodId: devpodId ?? "(absent)",
+            urls: [],
+            recreated: false,
+            tlsRefreshed: false,
+            hostPortConflicts
+          };
+        }
+      }
       const apps = proxyAppsFromConfig(runtime.config);
       const parsedUpstreams = apps.map((app) => parseUpstream(app.upstream));
-      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path32.default.basename(repoPath)) ?? "app";
+      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path38.default.basename(repoPath)) ?? "app";
       for (const [index, app] of apps.entries()) {
         if (!parsedUpstreams[index].host.startsWith(`${aliasPrefix}-`)) {
           const owner = target.kind === "linked" ? "workspace" : "checkout";
@@ -12204,7 +13679,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
               repairMutationStarted = true;
               transitionPhase = "service-start";
               claimLifecycleEffect();
-              const result = (0, import_node_child_process26.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
+              const result = (0, import_node_child_process27.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
                 ...networkDockerOptions(),
                 encoding: "utf-8",
                 timeout: DEFAULT_READINESS_TIMEOUT_MS,
@@ -12340,6 +13815,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
               claimLifecycleEffect();
               writeManagedRuntimeState(state);
               capturedStopState = state;
+              clearActiveLifecycleStartupWitness();
             };
             if (options.repair) capture();
             else
@@ -12908,9 +14384,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     }
     const repairLocked = () => {
       const runtime = resolveWorkspaceRuntimeOrDefault(repoPath);
-      import_node_fs28.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+      import_node_fs33.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
       return withFileLock(
-        import_node_path32.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
+        import_node_path38.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
         {
           activity: "Managed runtime repair",
           target: repoPath,
@@ -12982,6 +14458,7 @@ var lockHeld = false;
 var stopProjects = [];
 var stopBaselineState;
 var BUSY_LIFECYCLE_WAIT_MS = 30 * 60 * 1e3;
+var CAPACITY_CLIENT_WAIT_MS = 30 * 60 * 1e3;
 function matchesFence(record5, fence) {
   return Object.entries(reliabilityFence(record5.state)).every(
     ([key, value]) => value === fence[key]
@@ -12998,6 +14475,7 @@ function claimActiveLifecycleEffect() {
     if (!matchesFence(record5, worker.fence) || worker.kind !== "stop" && record5.worker?.id !== worker.workerId) {
       throw new Error("Lifecycle intent superseded this worker.");
     }
+    if (worker.kind !== "stop") assertCapacityEffect(record5, worker.workerId, Date.now());
     if (record5.effectSequence === Number.MAX_SAFE_INTEGER)
       throw new Error("Lifecycle effect sequence exhausted.");
     record5.effectSequence += 1;
@@ -13052,6 +14530,13 @@ function reconcileDrained(record5) {
     record5.worker = null;
   }
 }
+function clearActiveLifecycleStartupWitness() {
+  const request = activeWorker;
+  if (!request || request.kind === "stop") return;
+  const record5 = readReliabilityOperation(request.identity);
+  if (record5?.startupWitness?.operationId !== request.operationId) return;
+  clearStartupWitness(request.identity, reliabilityFence(record5.state));
+}
 async function acquireWorkerLock(repoPath, operation) {
   const deadline = Date.now() + 3e4;
   for (; ; ) {
@@ -13108,7 +14593,7 @@ async function executeLifecycleWorker(request, operation) {
           const owned = containers.filter(
             (container) => sameWorkspacePath(
               container.labels["com.docker.compose.project.working_dir"] ?? "",
-              import_node_path33.default.join(request.repoPath, ".devcontainer")
+              import_node_path39.default.join(request.repoPath, ".devcontainer")
             )
           );
           const projects = owned.map((container) => container.labels["com.docker.compose.project"]);
@@ -13134,7 +14619,7 @@ async function executeLifecycleWorker(request, operation) {
     }
   });
 }
-function recordLifecycleOutcome(outcome) {
+function recordLifecycleOutcome(outcome, result) {
   const request = activeWorker;
   if (request?.kind !== "exec") return;
   updateReliabilityOperation(request.identity, (record5) => {
@@ -13152,27 +14637,40 @@ function recordLifecycleOutcome(outcome) {
     };
     stepRecord(record5, event);
     record5.outcome = { ...outcome, operationId: request.operationId };
+    if (result !== void 0) record5.result = result;
   });
 }
-function recordLifecycleCompletion(exitCode) {
+function recordLifecycleCompletion(exitCode, preparedProfile, result) {
   const request = activeWorker;
   if (!request || request.kind === "stop") return;
   updateReliabilityOperation(request.identity, (record5) => {
     if (!matchesFence(record5, request.fence)) return;
+    if (preparedProfile !== void 0 && record5.enrollment) {
+      if (request.kind !== "ensure" || record5.worker?.id !== request.workerId || record5.state.operation?.id !== request.operationId || record5.state.profile !== preparedProfile)
+        throw new Error("Prepared profile does not match the active lifecycle worker.");
+      record5.activeProfile = preparedProfile;
+      record5.preparation = {
+        operationId: request.operationId,
+        profile: preparedProfile,
+        fence: { ...request.fence }
+      };
+    }
     stepRecord(record5, {
       ...request.fence,
       type: "completion",
       operationId: request.operationId,
       exitCode
     });
+    if (result !== void 0) record5.result = result;
   });
 }
-function recordLifecycleUnknown() {
+function recordLifecycleUnknown(result) {
   const request = activeWorker;
   if (!request || request.kind === "stop") return;
   updateReliabilityOperation(request.identity, (record5) => {
     if (!matchesFence(record5, request.fence)) return;
     stepRecord(record5, { ...request.fence, type: "interrupted", operationId: request.operationId });
+    if (result !== void 0) record5.result = result;
   });
 }
 function proveLifecycleStopped() {
@@ -13196,7 +14694,7 @@ function proveLifecycleStopped() {
       const remaining = inspectWorkspaceContainers().filter(
         (container) => sameWorkspacePath(
           container.labels["com.docker.compose.project.working_dir"] ?? "",
-          import_node_path33.default.join(request.repoPath, ".devcontainer")
+          import_node_path39.default.join(request.repoPath, ".devcontainer")
         )
       );
       if (remaining.some(
@@ -13209,16 +14707,48 @@ function proveLifecycleStopped() {
       (route) => sameWorkspacePath(route.repoPath, request.repoPath)
     );
     if (routes.length) throw new Error("Workspace routes remain published after stop.");
-    updateReliabilityOperation(request.identity, (record5) => {
+    const settlement = updateReliabilityOperation(request.identity, (record5) => {
       if (!matchesFence(record5, request.fence) || record5.worker)
         throw new Error("Stop proof was superseded or an earlier worker remains.");
+      if (record5.version === 2) {
+        if (record5.capacity) record5.capacity.validUntilMs = 0;
+        return record5.state.environmentId;
+      }
       stepRecord(record5, {
         ...request.fence,
         type: "stop-proof",
         workloadsStopped: true,
         routesRemoved: true
       });
+      return void 0;
     });
+    if (settlement) {
+      const capacity = new CapacityStore(import_node_path39.default.join(DEVROUTER_HOME, "controller"));
+      for (let attempt = 0; ; attempt++) {
+        try {
+          capacity.settleEnvironmentAfterStop(settlement, capacity.read().revision);
+          break;
+        } catch (error) {
+          if (!(error instanceof CapacitySnapshotChangedError) || attempt >= 2) throw error;
+        }
+      }
+      updateReliabilityOperation(request.identity, (record5) => {
+        if (!matchesFence(record5, request.fence) || record5.worker || record5.state.environmentId !== settlement || record5.capacity && record5.capacity.validUntilMs !== 0)
+          throw new Error("Capacity settlement was superseded before journal confirmation.");
+        record5.capacity = null;
+        if (record5.enrollment) {
+          record5.phaseSettlement = null;
+          record5.activeProfile = null;
+          record5.preparation = null;
+        }
+        stepRecord(record5, {
+          ...request.fence,
+          type: "stop-proof",
+          workloadsStopped: true,
+          routesRemoved: true
+        });
+      });
+    }
   };
   if (stopBaselineState)
     withMutationLock("Settle retained stop", stopBaselineState.repoPath, settle);
@@ -13259,7 +14789,7 @@ async function devsyExecOutcome(repoPath, command, retainedProof) {
         const launch = () => {
           if (retainedProof) revalidateDevsyExecProof(repoPath, retainedProof);
           claimLifecycleEffect();
-          return (0, import_node_child_process27.spawn)("devsy", args, { stdio: "inherit" });
+          return (0, import_node_child_process28.spawn)("devsy", args, { stdio: "inherit" });
         };
         child = retainedProof ? withMutationLock("Execute retained workspace", repoPath, launch) : launch();
       } catch (error) {
@@ -13307,7 +14837,7 @@ function ensureGuidance2(repoPath) {
   return `Run 'devrouter ensure ${repoPath}' first.`;
 }
 function assertRunningDevpod(devpodId, repoPath) {
-  const result = (0, import_node_child_process28.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
+  const result = (0, import_node_child_process29.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -13354,7 +14884,7 @@ async function devpodExecOutcome(repoPath, command) {
     }
     assertRunningDevpod(devpod.id, repoPath);
     const workspaceDirectory = resolveWorkspaceDirectory(repoPath);
-    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto17.randomUUID)()}__:`;
+    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto21.randomUUID)()}__:`;
     const statusMarkerBytes = Buffer.from(statusMarker, "ascii");
     const literalCommand = command.map(quotePosixArg).join(" ");
     const wrappedCommand = `${literalCommand}; __devrouter_status=$?; printf '${statusMarker}%s\\n' "$__devrouter_status" >&2; exit 0`;
@@ -13486,7 +15016,7 @@ async function devpodExecOutcome(repoPath, command) {
       let child;
       try {
         claimLifecycleEffect();
-        child = (0, import_node_child_process28.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
+        child = (0, import_node_child_process29.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
       } catch (error) {
         settled = true;
         reject(
@@ -13543,12 +15073,12 @@ async function devpodExecOutcome(repoPath, command) {
 }
 
 // src/core/workspace-lifecycle.ts
-var import_node_child_process29 = require("child_process");
-var import_node_fs30 = __toESM(require("fs"));
-var import_node_path34 = __toESM(require("path"));
+var import_node_child_process30 = require("child_process");
+var import_node_fs35 = __toESM(require("fs"));
+var import_node_path40 = __toESM(require("path"));
 
 // src/core/route-state.ts
-var import_node_fs29 = __toESM(require("fs"));
+var import_node_fs34 = __toESM(require("fs"));
 function listRoutesForWorktreePath(worktreePath, routes = listHostRouteState()) {
   return routes.filter((route) => sameWorkspacePath(route.repoPath, worktreePath));
 }
@@ -13753,20 +15283,26 @@ process.once("message", async (message) => {
           request.command ?? [],
           request.retainedExecProof
         ) : await devpodExecOutcome(request.repoPath, request.command ?? []);
-        recordLifecycleOutcome(outcome);
+        recordLifecycleOutcome(outcome, { ok: true, value: outcome });
         return outcome;
       }
       const ensured = await workspaceEnsure(request.repoPath, request.options);
       recordLifecycleCompletion(
-        ensured.applicationReadiness?.status === "application-error" ? 1 : 0
+        ensured.applicationReadiness?.status === "application-error" || (ensured.hostPortConflicts?.length ?? 0) > 0 ? 1 : 0,
+        ensured.managedRuntime?.status === "ready" ? ensured.profile : void 0,
+        { ok: true, value: ensured }
       );
       return ensured;
     });
     result = { ok: true, value };
   } catch (error) {
     try {
-      if (error instanceof ExecutionOutcomeError) recordLifecycleOutcome(error.outcome);
-      else recordLifecycleUnknown();
+      const failure = {
+        ok: false,
+        message: error instanceof Error ? error.message : String(error)
+      };
+      if (error instanceof ExecutionOutcomeError) recordLifecycleOutcome(error.outcome, failure);
+      else recordLifecycleUnknown(failure);
     } catch {
     }
     result = { ok: false, message: error instanceof Error ? error.message : String(error) };