@devrouter/cli 0.0.72 → 0.0.73

package/dist/devrouter-lifecycle-worker.js

@@ -5159,7 +5159,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs14.default.rea
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.72" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.73" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -8901,14 +8901,16 @@ function handleRecover(state, event) {
   if (state.executionPolicy === "manual" || state.desired !== "running")
     return unchanged(state, "blocked");
   if (possibleDispatch(state.operation)) return unchanged(state, "blocked");
+  const stranded = state.operation?.drained === true && ["NOT_STARTED", "NOT_LAUNCHED"].includes(state.operation.status);
+  const operation = stranded ? null : state.operation;
   if (state.incident !== null && state.incident.id !== event.incidentId) {
     return unchanged(state, "conflict");
   }
   if (state.incident !== null) {
-    if (state.operation && pendingCommand(state.operation)) {
-      return state.operation.id === event.operationId && state.phase === "recovering" ? unchanged(state, "joined") : unchanged(state, "conflict");
+    if (operation && pendingCommand(operation)) {
+      return operation.id === event.operationId && state.phase === "recovering" ? unchanged(state, "joined") : unchanged(state, "conflict");
     }
-    if (state.operation?.id === event.operationId && state.operation.status === "COMPLETED") {
+    if (operation?.id === event.operationId && operation.status === "COMPLETED") {
       return unchanged(state, "joined");
     }
     if (state.incident.correctiveActionsTaken >= state.incident.actionLimit) {
@@ -8916,17 +8918,20 @@ function handleRecover(state, event) {
     }
   }
   if (state.incident === null) {
-    if (state.operation?.status === "NOT_STARTED") return unchanged(state, "blocked");
-    if (state.operation?.id === event.operationId) return unchanged(state, "conflict");
+    if (operation?.status === "NOT_STARTED") return unchanged(state, "blocked");
+    if (operation?.id === event.operationId) return unchanged(state, "conflict");
     state.incident = {
       id: event.incidentId,
       correctiveActionsTaken: 0,
       actionLimit: event.actionLimit
     };
   }
-  if (!state.operation || state.operation.status === "COMPLETED" || state.operation.status === "INTERRUPTED") {
+  if (!operation || operation.status === "COMPLETED" || operation.status === "INTERRUPTED") {
     const runtimeGeneration = advance(state.runtimeGeneration);
     if (runtimeGeneration === null) return unchanged(state, "blocked");
+    const consumer = state.consumers[0];
+    if (state.profile === null || consumer === void 0) return unchanged(state, "blocked");
+    if (state.operationHistory.length >= RELIABILITY_MAX_ITEMS) return unchanged(state, "blocked");
     state.runtimeGeneration = runtimeGeneration;
     state.observations = [];
     state.operation = {
@@ -8936,6 +8941,12 @@ function handleRecover(state, event) {
       status: "NOT_STARTED",
       exitCode: null
     };
+    state.operationHistory.push({
+      ...state.operation,
+      key: event.operationId,
+      profile: state.profile,
+      consumer: cloneConsumer(consumer)
+    });
   }
   state.phase = "recovering";
   return transition(state, "accepted");
@@ -9035,7 +9046,7 @@ var import_node_fs25 = __toESM(require("fs"));
 var import_node_path30 = __toESM(require("path"));
 var import_node_util5 = require("util");
 function installedCliVersion() {
-  return true ? "0.0.72" : "0.0.0-dev";
+  return true ? "0.0.73" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);

package/dist/devrouter.js

@@ -31,7 +31,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/core/controller-probe.ts
-function runControllerProbe(command, args, signal, options = {}) {
+function probe(command, args, signal, options) {
   return new Promise((resolve, reject) => {
     if (signal.aborted) {
       reject(new Error("Observation cancelled."));
@@ -85,12 +85,19 @@ function runControllerProbe(command, args, signal, options = {}) {
       if (finished) return;
       finished = true;
       cleanup();
-      if (failed || code !== 0)
-        reject(new Error("Observation process failed or exceeded its bound."));
-      else resolve(Buffer.concat(chunks).toString("utf8"));
+      if (failed) reject(new Error("Observation process failed or exceeded its bound."));
+      else resolve({ output: Buffer.concat(chunks).toString("utf8"), code });
     });
   });
 }
+async function runControllerProbe(command, args, signal, options = {}) {
+  const result = await probe(command, args, signal, options);
+  if (result.code !== 0) throw new Error("Observation process failed or exceeded its bound.");
+  return result.output;
+}
+function runControllerProbeStatus(command, args, signal, options = {}) {
+  return probe(command, args, signal, options);
+}
 var import_node_child_process, ControllerProbeUnavailable;
 var init_controller_probe = __esm({
   "src/core/controller-probe.ts"() {
@@ -132,12 +139,12 @@ async function readCapacityHostSnapshot(signal, dependencies = {}) {
   try {
     if ((dependencies.platform ?? process.platform) !== "darwin" || signal.aborted)
       throw new Error("Host probe unavailable.");
-    const probe = dependencies.probe ?? runControllerProbe;
+    const probe2 = dependencies.probe ?? runControllerProbe;
     const cancellation = new AbortController();
     const probeSignal = AbortSignal.any([signal, cancellation.signal]);
     const results = await Promise.allSettled(
       ["hw.memsize", "kern.memorystatus_vm_pressure_level"].map(
-        (name) => Promise.resolve().then(() => probe("/usr/sbin/sysctl", ["-n", name], probeSignal)).catch((error) => {
+        (name) => Promise.resolve().then(() => probe2("/usr/sbin/sysctl", ["-n", name], probeSignal)).catch((error) => {
           cancellation.abort();
           throw error;
         })
@@ -1803,6 +1810,62 @@ function parseScheduling(value) {
   }
   return result;
 }
+function parseRecovery(value) {
+  if (value === void 0) return { ...DEFAULT_CAPACITY_RECOVERY };
+  const label2 = "recovery";
+  const recovery = ensureObject(value, label2);
+  ensureAllowedKeys(
+    recovery,
+    [
+      "enabled",
+      "maxProcessRestarts",
+      "maxServiceRestarts",
+      "maxCorrectiveActions",
+      "windowSeconds",
+      "observationSeconds",
+      "resumeDwellSeconds"
+    ],
+    label2
+  );
+  if (typeof recovery.enabled !== "boolean") {
+    throw new Error(`${label2}.enabled must be a boolean.`);
+  }
+  const result = {
+    enabled: recovery.enabled,
+    maxProcessRestarts: parseSafeInteger(
+      recovery.maxProcessRestarts,
+      `${label2}.maxProcessRestarts`,
+      0
+    ),
+    maxServiceRestarts: parseSafeInteger(
+      recovery.maxServiceRestarts,
+      `${label2}.maxServiceRestarts`,
+      0
+    ),
+    maxCorrectiveActions: parsePositiveInteger(
+      recovery.maxCorrectiveActions,
+      `${label2}.maxCorrectiveActions`
+    ),
+    windowSeconds: parsePositiveInteger(recovery.windowSeconds, `${label2}.windowSeconds`),
+    observationSeconds: parsePositiveInteger(
+      recovery.observationSeconds,
+      `${label2}.observationSeconds`
+    ),
+    resumeDwellSeconds: parsePositiveInteger(
+      recovery.resumeDwellSeconds,
+      `${label2}.resumeDwellSeconds`
+    )
+  };
+  if (result.maxCorrectiveActions < result.maxProcessRestarts + result.maxServiceRestarts) {
+    throw new Error(
+      `${label2}.maxCorrectiveActions must cover maxProcessRestarts and maxServiceRestarts.`
+    );
+  }
+  if (result.maxProcessRestarts > 4 || result.maxServiceRestarts > 2 || result.maxCorrectiveActions > 8 || result.windowSeconds > 3600 || result.observationSeconds > 300 || result.resumeDwellSeconds > 3600) {
+    throw new Error(`${label2} exceeds supported controller bounds.`);
+  }
+  return result;
+}
 function validateDomainReferences(domains) {
   const daemonIds = /* @__PURE__ */ new Map();
   const endpoints = /* @__PURE__ */ new Map();
@@ -1926,7 +1989,7 @@ function parseCapacityPolicy(value) {
   const root = ensureObject(value, "capacity policy");
   ensureAllowedKeys(
     root,
-    ["version", "revision", "admissions", "scheduling", "domains", "enrollments"],
+    ["version", "revision", "admissions", "scheduling", "recovery", "domains", "enrollments"],
     "capacity policy"
   );
   const version = parsePositiveInteger(root.version, "capacity policy.version");
@@ -1939,6 +2002,7 @@ function parseCapacityPolicy(value) {
     throw new Error("capacity policy.admissions must be 'enabled' or 'paused'.");
   }
   const scheduling = parseScheduling(root.scheduling);
+  const recovery = parseRecovery(root.recovery);
   const domainsValue = ensureObject(root.domains, "capacity policy.domains");
   const domainEntries = Object.entries(domainsValue);
   if (domainEntries.length > MAX_DOMAINS) {
@@ -1985,11 +2049,12 @@ function parseCapacityPolicy(value) {
     revision,
     admissions,
     scheduling,
+    recovery,
     domains,
     enrollments
   };
 }
-var import_node_fs4, import_node_path6, MAX_DOMAINS, MAX_ENROLLMENTS, MAX_PROFILES_PER_ENROLLMENT, MAX_STRING_LENGTH, MAX_PATH_LENGTH, DOMAIN_ID_RE, PROFILE_NAME_RE, WORKSPACE_TOKEN_RE, SHA256_RE;
+var import_node_fs4, import_node_path6, MAX_DOMAINS, MAX_ENROLLMENTS, MAX_PROFILES_PER_ENROLLMENT, MAX_STRING_LENGTH, MAX_PATH_LENGTH, DOMAIN_ID_RE, PROFILE_NAME_RE, WORKSPACE_TOKEN_RE, SHA256_RE, DEFAULT_CAPACITY_RECOVERY;
 var init_capacity_policy = __esm({
   "src/core/capacity-policy.ts"() {
     "use strict";
@@ -2004,6 +2069,15 @@ var init_capacity_policy = __esm({
     PROFILE_NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
     WORKSPACE_TOKEN_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
     SHA256_RE = /^[0-9a-f]{64}$/;
+    DEFAULT_CAPACITY_RECOVERY = {
+      enabled: false,
+      maxProcessRestarts: 2,
+      maxServiceRestarts: 1,
+      maxCorrectiveActions: 3,
+      windowSeconds: 600,
+      observationSeconds: 30,
+      resumeDwellSeconds: 300
+    };
   }
 });
 
@@ -4133,7 +4207,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs7.default.read
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.72" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.73" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -5386,7 +5460,7 @@ var init_reliability_contract = __esm({
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.0.72" : "0.0.0-dev";
+  return true ? "0.0.73" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -6423,6 +6497,16 @@ async function readProviderGeneration(repoPath, providerId, signal) {
     throw new Error("Capacity provider generation is malformed.");
   return generation;
 }
+function ownershipPopulationEvidence(record5, state) {
+  return {
+    environmentId: record5.state.environmentId,
+    executionPolicy: record5.state.executionPolicy,
+    enrollment: record5.enrollment ?? null,
+    composeProject: state?.composeProject ?? null,
+    devpodId: state?.devpodId ?? null,
+    stopBaseline: state?.stopBaseline ?? null
+  };
+}
 async function resolveCapacityOwnership(policy, runtimeDomain, signal, dependencies = {
   resolve: resolveCapacityEnrollment,
   providerGeneration: readProviderGeneration,
@@ -6473,18 +6557,21 @@ async function resolveCapacityOwnership(policy, runtimeDomain, signal, dependenc
         check();
         if (!(0, import_node_util5.isDeepStrictEqual)(current, entry.binding) || !(0, import_node_util5.isDeepStrictEqual)(generation, entry.generation))
           throw new Error("Capacity provider ownership changed during collection.");
-        if (!entry.evidence || !(0, import_node_util5.isDeepStrictEqual)(entry.evidence, {
-          record: dependencies.journal({
-            repoPath: entry.enrollment.repoPath,
-            workspace: entry.enrollment.workspace || null,
-            provider: entry.enrollment.provider
-          }),
-          state: dependencies.managed(
-            entry.enrollment.repoPath,
-            entry.enrollment.workspace || void 0,
-            (file) => readControllerEvidence(file, 1048576)
+        if (!entry.evidence || !(0, import_node_util5.isDeepStrictEqual)(
+          entry.evidence,
+          ownershipPopulationEvidence(
+            dependencies.journal({
+              repoPath: entry.enrollment.repoPath,
+              workspace: entry.enrollment.workspace || null,
+              provider: entry.enrollment.provider
+            }),
+            dependencies.managed(
+              entry.enrollment.repoPath,
+              entry.enrollment.workspace || void 0,
+              (file) => readControllerEvidence(file, 1048576)
+            )
           )
-        }))
+        ))
           throw new Error("Capacity ownership records changed before publication.");
       }
     },
@@ -6533,7 +6620,7 @@ async function resolveCapacityOwnership(policy, runtimeDomain, signal, dependenc
             throw new Error("Capacity witnessed startup generation changed.");
         } else if (!baseline || baseline.provider !== enrollment.provider || baseline.context !== entry.generation.context || baseline.uid !== entry.generation.uid || baseline.sourceContainer !== entry.generation.sourceContainer || baseline.endpoint !== `unix://${domain.endpoint}` || baseline.daemonId !== domain.daemonId)
           throw new Error("Capacity population lacks an exact retained runtime baseline.");
-        const evidence = { record: record5, state };
+        const evidence = ownershipPopulationEvidence(record5, state);
         if (entry.evidence && !(0, import_node_util5.isDeepStrictEqual)(entry.evidence, evidence))
           throw new Error("Capacity ownership generation changed during collection.");
         entry.evidence = structuredClone(evidence);
@@ -6569,7 +6656,13 @@ async function resolveCapacityOwnership(policy, runtimeDomain, signal, dependenc
             endpoint: `unix://${domain.endpoint}`
           });
         }
-        if (!(0, import_node_util5.isDeepStrictEqual)(state, readState()) || !(0, import_node_util5.isDeepStrictEqual)(record5, dependencies.journal(identity2)))
+        if (!(0, import_node_util5.isDeepStrictEqual)(state, readState()) || !(0, import_node_util5.isDeepStrictEqual)(
+          ownershipPopulationEvidence(record5, state),
+          ownershipPopulationEvidence(
+            dependencies.journal(identity2),
+            state
+          )
+        ))
           throw new Error("Capacity ownership records changed during collection.");
         result.push({ environmentId: binding.environment.id, containers: containers2 });
       }
@@ -6623,8 +6716,8 @@ async function collectDeclaredRuntimeCapacity(domain, proveOwned, signal, depend
   const sampledAtMs = Date.now();
   const cancellation = new AbortController();
   const combined = AbortSignal.any([signal, cancellation.signal]);
-  const timer = setTimeout(() => cancellation.abort(), 3e3);
-  const deadline = performance.now() + 3e3;
+  const timer = setTimeout(() => cancellation.abort(), RUNTIME_PROBE_BUDGET_MS);
+  const deadline = performance.now() + RUNTIME_PROBE_BUDGET_MS;
   const check = () => {
     if (combined.aborted || performance.now() >= deadline)
       throw new Error("Runtime capacity collection expired.");
@@ -6717,13 +6810,14 @@ async function collectDeclaredRuntimeCapacity(domain, proveOwned, signal, depend
     clearTimeout(timer);
   }
 }
-var import_node_util6;
+var import_node_util6, RUNTIME_PROBE_BUDGET_MS;
 var init_capacity_runtime_probe = __esm({
   "src/core/capacity-runtime-probe.ts"() {
     "use strict";
     import_node_util6 = require("util");
     init_capacity_docker_probe();
     init_capacity_host_probe();
+    RUNTIME_PROBE_BUDGET_MS = 8e3;
   }
 });
 
@@ -8538,8 +8632,8 @@ function parseWorkspaceRuntime(value) {
 }
 function isRuntimeInstalled(runtime) {
   const probeArgs = runtime === "devsy" ? ["--version"] : ["version"];
-  const probe = (0, import_node_child_process10.spawnSync)(runtime, probeArgs, { encoding: "utf-8" });
-  return probe.status === 0 && !probe.error;
+  const probe2 = (0, import_node_child_process10.spawnSync)(runtime, probeArgs, { encoding: "utf-8" });
+  return probe2.status === 0 && !probe2.error;
 }
 function readWorkspaceRuntimeConfig() {
   let raw;
@@ -12138,14 +12232,16 @@ function handleRecover(state, event) {
   if (state.executionPolicy === "manual" || state.desired !== "running")
     return unchanged(state, "blocked");
   if (possibleDispatch(state.operation)) return unchanged(state, "blocked");
+  const stranded = state.operation?.drained === true && ["NOT_STARTED", "NOT_LAUNCHED"].includes(state.operation.status);
+  const operation = stranded ? null : state.operation;
   if (state.incident !== null && state.incident.id !== event.incidentId) {
     return unchanged(state, "conflict");
   }
   if (state.incident !== null) {
-    if (state.operation && pendingCommand(state.operation)) {
-      return state.operation.id === event.operationId && state.phase === "recovering" ? unchanged(state, "joined") : unchanged(state, "conflict");
+    if (operation && pendingCommand(operation)) {
+      return operation.id === event.operationId && state.phase === "recovering" ? unchanged(state, "joined") : unchanged(state, "conflict");
     }
-    if (state.operation?.id === event.operationId && state.operation.status === "COMPLETED") {
+    if (operation?.id === event.operationId && operation.status === "COMPLETED") {
       return unchanged(state, "joined");
     }
     if (state.incident.correctiveActionsTaken >= state.incident.actionLimit) {
@@ -12153,17 +12249,20 @@ function handleRecover(state, event) {
     }
   }
   if (state.incident === null) {
-    if (state.operation?.status === "NOT_STARTED") return unchanged(state, "blocked");
-    if (state.operation?.id === event.operationId) return unchanged(state, "conflict");
+    if (operation?.status === "NOT_STARTED") return unchanged(state, "blocked");
+    if (operation?.id === event.operationId) return unchanged(state, "conflict");
     state.incident = {
       id: event.incidentId,
       correctiveActionsTaken: 0,
       actionLimit: event.actionLimit
     };
   }
-  if (!state.operation || state.operation.status === "COMPLETED" || state.operation.status === "INTERRUPTED") {
+  if (!operation || operation.status === "COMPLETED" || operation.status === "INTERRUPTED") {
     const runtimeGeneration = advance(state.runtimeGeneration);
     if (runtimeGeneration === null) return unchanged(state, "blocked");
+    const consumer = state.consumers[0];
+    if (state.profile === null || consumer === void 0) return unchanged(state, "blocked");
+    if (state.operationHistory.length >= RELIABILITY_MAX_ITEMS) return unchanged(state, "blocked");
     state.runtimeGeneration = runtimeGeneration;
     state.observations = [];
     state.operation = {
@@ -12173,6 +12272,12 @@ function handleRecover(state, event) {
       status: "NOT_STARTED",
       exitCode: null
     };
+    state.operationHistory.push({
+      ...state.operation,
+      key: event.operationId,
+      profile: state.profile,
+      consumer: cloneConsumer(consumer)
+    });
   }
   state.phase = "recovering";
   return transition(state, "accepted");
@@ -12265,6 +12370,49 @@ function stepReliability(state, event, nowMs) {
   }
   return result;
 }
+function requiredCapabilities(state) {
+  const required = /* @__PURE__ */ new Set();
+  for (const consumer of state.consumers) {
+    for (const capability of consumer.requiredCapabilities) required.add(capability);
+  }
+  return [...required];
+}
+function failedCapability(state, required, nowMs) {
+  return required.some((capability) => {
+    const observation = state.observations.find((entry) => entry.capability === capability);
+    return observation !== void 0 && observation.infrastructure === "failed" && observation.observedAtMs >= state.observationsAfterMs && observation.observedAtMs <= nowMs && nowMs - observation.observedAtMs < observation.validForMs;
+  });
+}
+function decideRecovery(input2) {
+  const { state, nowMs, actionLimit, pressureDwellSatisfied } = input2;
+  assertReliabilityState(state);
+  if (!isReliabilityCounter(nowMs) || nowMs < state.observationsAfterMs)
+    throw new Error("Invalid reliability clock.");
+  if (input2.failedCapabilities !== void 0 && (input2.failedCapabilities.length > RELIABILITY_MAX_ITEMS || input2.failedCapabilities.some((capability) => !isReliabilityId(capability))))
+    throw new Error("Invalid recovery evidence.");
+  if (state.executionPolicy === "manual") return { action: "none", reason: "unmanaged" };
+  if (state.desired === "stopped-by-user") return { action: "none", reason: "user-stopped" };
+  if (state.desired === "parked-for-capacity") {
+    const resumeReady = pressureDwellSatisfied && state.stopProof.workloadsStopped && state.stopProof.routesRemoved && state.consumers.length > 0 && state.admission === "admitted" && state.profile !== null && (state.incident === null || state.incident.correctiveActionsTaken < state.incident.actionLimit) && state.operation !== null && ["NOT_STARTED", "COMPLETED", "INTERRUPTED"].includes(state.operation.status);
+    return { action: resumeReady ? "resume" : "none", reason: "parked" };
+  }
+  if (!isReliabilityCounter(actionLimit) || actionLimit < 1)
+    throw new Error("Invalid recovery action budget.");
+  const failed = input2.failedCapabilities !== void 0 ? input2.failedCapabilities.length > 0 : failedCapability(state, requiredCapabilities(state), nowMs);
+  if (!failed) return { action: "none", reason: "healthy" };
+  if (possibleDispatch(state.operation)) return { action: "none", reason: "active-operation" };
+  if (state.incident !== null) {
+    if (state.incident.correctiveActionsTaken >= state.incident.actionLimit)
+      return { action: "blocked", reason: "budget-exhausted" };
+    return {
+      action: "continue",
+      reason: "recovery-eligible",
+      incidentId: state.incident.id,
+      actionLimit: state.incident.actionLimit
+    };
+  }
+  return { action: "start", reason: "recovery-eligible", actionLimit };
+}
 var INFRASTRUCTURE_VALUES, APPLICATION_VALUES, ADMISSION_VALUES;
 var init_reliability_model = __esm({
   "src/core/reliability-model.ts"() {
@@ -14841,6 +14989,52 @@ function assertCurrentCapacityController(expected, directory = import_node_path4
   if (!expected || current?.store !== expected.store || current.epoch !== expected.epoch)
     throw new Error("Capacity controller incarnation changed.");
 }
+function prepareRecoveryLifecycleOperation(input2) {
+  const ids2 = newLifecycleIds();
+  return updateReliabilityOperation(input2.identity, (record5) => {
+    assertCurrentCapacityController(input2.controller);
+    if (record5.version !== 2 || record5.state.executionPolicy !== "capacity-managed" || record5.enrollment?.policyRevision !== input2.policyRevision)
+      throw new Error("Managed recovery requires current durable enrollment.");
+    if (record5.phaseSettlement) return void 0;
+    reconcileDrained(record5);
+    if (record5.worker) return void 0;
+    const decision = decideRecovery({
+      state: record5.state,
+      nowMs: Date.now(),
+      actionLimit: input2.actionLimit,
+      pressureDwellSatisfied: false,
+      failedCapabilities: input2.failedCapabilities
+    });
+    if (decision.action !== "start" && decision.action !== "continue") return void 0;
+    const transition2 = stepReliability(
+      record5.state,
+      {
+        ...reliabilityFence(record5.state),
+        type: "recover",
+        incidentId: decision.action === "continue" ? decision.incidentId : input2.incidentId,
+        actionLimit: input2.actionLimit,
+        operationId: ids2.operationId
+      },
+      Date.now()
+    );
+    if (transition2.outcome !== "accepted") return void 0;
+    record5.state = transition2.state;
+    record5.outcome = null;
+    record5.result = null;
+    record5.startupWitness = null;
+    return {
+      operationId: ids2.operationId,
+      request: {
+        ...ids2,
+        kind: "ensure",
+        repoPath: input2.identity.repoPath,
+        identity: { ...input2.identity },
+        fence: reliabilityFence(record5.state),
+        options: { profile: input2.profile, quiet: true }
+      }
+    };
+  });
+}
 function settlePreparedLifecycleCapacity(input2) {
   const directory = input2.directory ?? import_node_path44.default.join(DEVROUTER_HOME, "controller");
   const store = new CapacityStore(directory);
@@ -15175,6 +15369,17 @@ async function superviseThroughController(input2) {
       );
   };
   const deadline = Date.now() + CAPACITY_CLIENT_WAIT_MS;
+  let outputGapReported = false;
+  const onOutput = (page) => {
+    if (page.gap && !outputGapReported) {
+      process.stderr.write("devrouter: controller output buffer dropped earlier command output.\n");
+      outputGapReported = true;
+    }
+    for (const chunk of page.chunks) {
+      const stream = chunk.stream === "stderr" ? process.stderr : process.stdout;
+      stream.write(Buffer.from(chunk.data, page.encoding));
+    }
+  };
   try {
     const bind = () => observeControllerBinding(directory, {
       path: input2.repoPath,
@@ -15189,7 +15394,7 @@ async function superviseThroughController(input2) {
     let pending = await submitControllerOperation(
       directory,
       input2.kind === "exec" ? { ...binding, requestId: input2.requestId, kind: "exec", command: input2.command ?? [] } : { ...binding, requestId: input2.requestId, kind: "ensure" },
-      { waitSeconds: controllerWaitSeconds(deadline) }
+      { waitSeconds: controllerWaitSeconds(deadline), onOutput }
     );
     while (pending.status !== "terminal") {
       cancelled();
@@ -15205,7 +15410,7 @@ async function superviseThroughController(input2) {
         pending = await followControllerOperation(
           directory,
           { ...binding, operationId: pending.operationId },
-          { waitSeconds: controllerWaitSeconds(deadline) }
+          { waitSeconds: controllerWaitSeconds(deadline), onOutput }
         );
       } catch {
         await new Promise((resolve) => setTimeout(resolve, Math.min(1e3, deadline - Date.now())));
@@ -15231,23 +15436,28 @@ function renewLifecycleCapacity(request2, policy, samples, controller, directory
     const binding = record5.capacity;
     if (!matchesFence(record5, request2.fence) || !binding || binding.operationId !== request2.operationId || binding.workerId !== request2.workerId || binding.controller?.store !== controller.store || binding.controller?.epoch !== controller.epoch)
       throw new Error("Capacity renewal no longer owns this operation.");
-    binding.validUntilMs = 0;
     try {
-      if (record5.state.executionPolicy !== "capacity-managed" || record5.state.operation?.id !== request2.operationId || record5.state.operation.drained || record5.state.desired !== "running" || policy.admissions !== "enabled" || policy.revision !== binding.policyRevision || JSON.stringify(readCapacityPolicy(directory)) !== JSON.stringify(policy))
+      if (record5.state.executionPolicy !== "capacity-managed" || record5.state.operation?.id !== request2.operationId || record5.state.operation.drained || record5.state.desired !== "running" || policy.admissions !== "enabled" || policy.revision !== binding.policyRevision || JSON.stringify(readCapacityPolicy(directory)) !== JSON.stringify(policy)) {
+        binding.validUntilMs = 0;
         return false;
+      }
       const enrolled = record5.enrollment;
       const runtime = enrolled && policy.domains[enrolled.runtimeDomain];
       const enrollment = policy.enrollments.find(
         (entry) => entry.repoPath === record5.identity.repoPath && entry.workspace === record5.identity.workspace && entry.provider === record5.identity.provider && entry.providerId === enrolled?.providerId && entry.gitCommonDir === enrolled.gitCommonDir && entry.estimatesDigest === enrolled.estimatesDigest && entry.hostDomain === enrolled.hostDomain && entry.runtimeDomain === enrolled.runtimeDomain && entry.profiles.includes(record5.state.profile ?? "")
       );
-      if (!enrolled || enrolled.policyRevision !== policy.revision || !enrollment || runtime?.kind !== "runtime" || runtime.endpoint !== enrolled.endpoint || runtime.daemonId !== enrolled.daemonId)
+      if (!enrolled || enrolled.policyRevision !== policy.revision || !enrollment || runtime?.kind !== "runtime" || runtime.endpoint !== enrolled.endpoint || runtime.daemonId !== enrolled.daemonId) {
+        binding.validUntilMs = 0;
         return false;
+      }
       const snapshot = new CapacityStore(directory).read();
       const reservation = snapshot.reservations.find(
         (entry) => entry.reservationId === binding.reservationId
       );
-      if (!reservation || reservation.environmentId !== record5.state.environmentId || reservation.operationId !== request2.operationId || reservation.policyRevision !== policy.revision)
+      if (!reservation || reservation.environmentId !== record5.state.environmentId || reservation.operationId !== request2.operationId || reservation.policyRevision !== policy.revision) {
+        binding.validUntilMs = 0;
         return false;
+      }
       const maxAge = policy.scheduling.maxSampleAgeSeconds * 1e3;
       const decision = evaluateCapacity(
         policy.domains,
@@ -15274,16 +15484,21 @@ function renewLifecycleCapacity(request2, policy, samples, controller, directory
             snapshot.pools
           ).admitted;
         })();
-        if (!tolerated) return false;
+        if (!tolerated) {
+          if (decision.reason !== "unknown" && decision.reason !== "stale")
+            binding.validUntilMs = 0;
+          return false;
+        }
       }
+      const observed = Object.keys(reservation.totals).map(
+        (domain) => samples[domain]?.sampledAtMs
+      );
+      if (observed.some((sampledAtMs) => typeof sampledAtMs !== "number")) return false;
       binding.snapshotRevision = snapshot.revision;
-      binding.validUntilMs = Math.min(
-        ...Object.keys(reservation.totals).map((domain) => samples[domain]?.sampledAtMs ?? 0)
-      ) + maxAge;
+      binding.validUntilMs = Math.min(...observed) + maxAge;
       assertCapacityEffect(record5, request2.workerId, nowMs, directory);
       return true;
     } catch {
-      binding.validUntilMs = 0;
       return false;
     }
   });
@@ -15427,6 +15642,11 @@ var init_capacity_queue = __esm({
         });
         return request2.operationId;
       }
+      /** True while the queue still owns the operation, awaiting admission or running. */
+      hasOperation(operationId) {
+        const entry = this.entries.get(operationId);
+        return entry !== void 0 && entry.phase !== "terminal";
+      }
       observe(operationId) {
         const entry = this.entries.get(operationId);
         return entry ? { operationId, phase: entry.phase, reason: entry.reason, output: entry.output.read() } : void 0;
@@ -15964,6 +16184,87 @@ function createCapacityController(options) {
       settlePreparations();
       return queue.tick();
     },
+    /**
+     * Open or advance one bounded automatic recovery for an environment whose
+     * required capability has positively failed. It is inert unless the
+     * operator policy enables recovery, and every decision, budget, and
+     * admission rule is the one an operator-requested ensure obeys.
+     */
+    async recover(environment, failedCapabilities, signal) {
+      signal = AbortSignal.any([signal, lifetime.signal]);
+      if (signal.aborted || !policy.recovery.enabled) return;
+      if (failedCapabilities.length === 0 || failedCapabilities.length > 64) return;
+      const current = readCapacityPolicy(options.directory);
+      if (current?.admissions !== "enabled" || !(0, import_node_util12.isDeepStrictEqual)(current, policy)) return;
+      let resolved;
+      try {
+        resolved = await enrollCapacityLifecycle(
+          current,
+          { path: environment.repoPath, profile: environment.profile, require: [] },
+          signal,
+          options.directory
+        );
+      } catch {
+        return;
+      }
+      if (signal.aborted || !(0, import_node_util12.isDeepStrictEqual)(resolved.environment, environment)) return;
+      if (!(0, import_node_util12.isDeepStrictEqual)(readCapacityPolicy(options.directory), current)) return;
+      const runtime = current.domains[resolved.enrollment.runtimeDomain];
+      if (runtime?.kind !== "runtime" || runtime.hostDomain !== resolved.enrollment.hostDomain || current.domains[runtime.hostDomain]?.kind !== "host" || !current.enrollments.some((entry) => (0, import_node_util12.isDeepStrictEqual)(entry, resolved.enrollment)))
+        return;
+      const pool = {
+        daemonId: runtime.daemonId,
+        runtimeDomain: resolved.enrollment.runtimeDomain,
+        hostDomain: runtime.hostDomain,
+        hostChargeCeilingBytes: runtime.hostChargeCeilingBytes
+      };
+      const identity2 = {
+        repoPath: environment.repoPath,
+        workspace: environment.workspace || null,
+        provider: environment.provider
+      };
+      const record5 = readReliabilityOperation(identity2);
+      if (!record5) return;
+      if (record5.state.operation && queue.hasOperation(record5.state.operation.id)) return;
+      let prepared;
+      try {
+        prepared = prepareRecoveryLifecycleOperation({
+          identity: identity2,
+          controller,
+          policyRevision: current.revision,
+          actionLimit: policy.recovery.maxCorrectiveActions,
+          failedCapabilities,
+          profile: environment.profile,
+          incidentId: `incident-${(0, import_node_crypto22.randomUUID)()}`
+        });
+      } catch {
+        return;
+      }
+      if (!prepared) return;
+      const charge = capacityRequest(resolved.estimates, resolved.enrollment, {
+        environmentId: record5.state.environmentId,
+        profile: environment.profile,
+        ...record5.activeProfile ? { activeProfile: record5.activeProfile } : {},
+        kind: "ensure"
+      });
+      try {
+        queue.enqueue(
+          prepared.request,
+          {
+            ...charge,
+            operationId: prepared.operationId,
+            reservationId: (0, import_node_crypto22.randomUUID)(),
+            policyRevision: current.revision
+          },
+          { estimates: resolved.estimates, enrollment: resolved.enrollment, pool }
+        );
+      } catch {
+        try {
+          retireQueuedLifecycle(prepared.request);
+        } catch {
+        }
+      }
+    },
     close() {
       lifetime.abort();
       queue.close();
@@ -16094,12 +16395,13 @@ var init_controller_monitor = __esm({
     ControllerObservationBindingChanged = class extends Error {
     };
     ControllerMonitor = class {
-      constructor(sessions, collect, serialize, clock = () => Math.floor(performance.now()), fence = withReliabilityObservationFence) {
+      constructor(sessions, collect, serialize, clock = () => Math.floor(performance.now()), fence = withReliabilityObservationFence, recover) {
         this.sessions = sessions;
         this.collect = collect;
         this.serialize = serialize;
         this.clock = clock;
         this.fence = fence;
+        this.recover = recover;
       }
       active = /* @__PURE__ */ new Map();
       lastStarted = /* @__PURE__ */ new Map();
@@ -16194,6 +16496,18 @@ var init_controller_monitor = __esm({
                 this.sessions.publish(bindings, projections, commitTime, Date.now());
               });
             });
+            if (this.recover === void 0 || this.stopped) return;
+            const required = new Set(requirements.map(controllerCapability));
+            const failed = batch.capabilities.filter(
+              (capability) => capability.infrastructure === "failed" && required.has(capability.capability)
+            ).map((capability) => capability.capability);
+            if (failed.length > 0)
+              void this.recover(
+                batch.environment,
+                failed,
+                this.active.get(environment.id)?.signal ?? abort.signal
+              ).catch(() => {
+              });
           }).catch(async (error) => {
             if (!this.stopped)
               await this.serialize(() => {
@@ -16217,7 +16531,7 @@ var init_controller_monitor = __esm({
 async function observeControllerProcess(containerId, name, signal) {
   if (!/^[a-f0-9]{12,64}$/.test(containerId) || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/.test(name))
     throw new Error("Process observation identity is invalid.");
-  const output2 = await runControllerProbe(
+  const result = await runControllerProbeStatus(
     "docker",
     [
       "exec",
@@ -16233,12 +16547,14 @@ async function observeControllerProcess(containerId, name, signal) {
     ],
     signal
   );
-  const identity2 = output2.trim();
+  if (result.code === PROCESS_ABSENT_EXIT) return { kind: "absent" };
+  if (result.code !== 0) throw new Error("Process observation is unavailable.");
+  const identity2 = result.output.trim();
   if (!/^[1-9][0-9]* [0-9]+ [a-zA-Z0-9][a-zA-Z0-9._:-]{0,4095}$/.test(identity2))
     throw new Error("Process observation is unavailable.");
-  return identity2;
+  return { kind: "present", identity: identity2 };
 }
-var PROCESS_OBSERVATION;
+var PROCESS_OBSERVATION, PROCESS_ABSENT_EXIT;
 var init_controller_process_observation = __esm({
   "src/core/controller-process-observation.ts"() {
     "use strict";
@@ -16248,7 +16564,9 @@ set -euo pipefail
 name="$1"
 [[ "$name" =~ ^[a-zA-Z0-9][a-zA-Z0-9._-]*$ ]] || exit 1
 file="${"$"}{DEVROUTER_PROCESS_STATE_DIR:-/tmp}/devrouter-process-$name.state"
-[ -f "$file" ] && [ ! -L "$file" ] || exit 1
+[ ! -L "$file" ] || exit 1
+# A missing marker is positive absence: the expected process was never recorded.
+[ -f "$file" ] || exit 3
 [ "$(stat -c %s "$file")" -le 4096 ] || exit 1
 before="$(head -c 4097 "$file")"
 read -r pid pgid fingerprint extra <<<"$before"
@@ -16268,11 +16586,13 @@ identity() {
   tr '\0' '\n' <"/proc/$pid/environ" | grep -Fx "DEVROUTER_PROCESS_FINGERPRINT=$fingerprint" >/dev/null || return 1
   printf '%s' "${"$"}{fields[19]}"
 }
-birth="$(identity)"
+birth="$(identity)" || exit 3
 [ "$birth" = "$(identity)" ] || exit 1
-[ ! -L "$file" ] && [ "$before" = "$(head -c 4097 "$file")" ] || exit 1
+[ ! -L "$file" ] || exit 1
+[ "$before" = "$(head -c 4097 "$file")" ] || exit 3
 printf '%s %s %s\n' "$pid" "$birth" "$fingerprint"
 `;
+    PROCESS_ABSENT_EXIT = 3;
   }
 });
 
@@ -16488,10 +16808,14 @@ var init_controller_observation = __esm({
       ];
       const processes = [];
       let processesVerified = healthy;
+      let processesAbsent = false;
       if (healthy && requirements.some((value) => value.startsWith("app:"))) {
         try {
-          for (const name of profile.managedRuntime.processes)
-            processes.push(await observeControllerProcess(primary[0].id, name, signal));
+          for (const name of profile.managedRuntime.processes) {
+            const observation = await observeControllerProcess(primary[0].id, name, signal);
+            if (observation.kind === "absent") processesAbsent = true;
+            else processes.push(observation.identity);
+          }
         } catch (error) {
           if (signal.aborted) throw error;
           processesVerified = false;
@@ -16505,7 +16829,7 @@ var init_controller_observation = __esm({
         const routeMatches = routes.some(
           (route) => route.workspace === environment.workspace && route.name === app.name && route.host === app.host && route.mode === "proxy" && route.upstreamHost === upstream.upstreamHost && route.port === upstream.port
         );
-        const http2 = healthy && routeMatches && processesVerified ? await probeHttpReadiness(
+        const http2 = healthy && routeMatches && processesVerified && !processesAbsent ? await probeHttpReadiness(
           app.host,
           app.readiness,
           signal,
@@ -16514,7 +16838,7 @@ var init_controller_observation = __esm({
         ) : void 0;
         capabilities.push({
           capability: controllerCapability(requirement),
-          infrastructure: healthy && routeMatches ? "healthy" : "unknown",
+          infrastructure: healthy && routeMatches ? processesAbsent ? "failed" : "healthy" : "unknown",
           application: http2?.ok ? "verified" : http2?.classification === "application-contract" ? "unready" : "unverified",
           observedAtMs: 0,
           validForMs: 15e3
@@ -16522,13 +16846,15 @@ var init_controller_observation = __esm({
       }
       if (processesVerified && requirements.some((value) => value.startsWith("app:"))) {
         try {
-          for (let index = 0; index < profile.managedRuntime.processes.length; index++)
-            if (processes[index] !== await observeControllerProcess(
+          for (let index = 0; index < profile.managedRuntime.processes.length; index++) {
+            const recheck = await observeControllerProcess(
               primary[0].id,
               profile.managedRuntime.processes[index],
               signal
-            ))
+            );
+            if (recheck.kind !== "present" || processes[index] !== recheck.identity)
               throw new Error("Observation process changed.");
+          }
         } catch (error) {
           if (signal.aborted) throw error;
           for (const capability of capabilities)
@@ -16839,12 +17165,19 @@ async function runController(options) {
     let serial = Promise.resolve();
     const monotonic = () => Math.floor(performance.now());
     let fatal;
-    const monitor = options.collect ? new ControllerMonitor(sessions, options.collect, (operation) => {
-      const pending = serial.then(operation);
-      serial = pending.catch(() => {
-      });
-      return pending;
-    }) : void 0;
+    const monitor = options.collect ? new ControllerMonitor(
+      sessions,
+      options.collect,
+      (operation) => {
+        const pending = serial.then(operation);
+        serial = pending.catch(() => {
+        });
+        return pending;
+      },
+      void 0,
+      void 0,
+      operations?.recover
+    ) : void 0;
     const server = import_node_net4.default.createServer((socket) => {
       if (sockets.size >= 32) {
         socket.destroy();
@@ -17918,8 +18251,8 @@ function buildOnboardingPrompt(options = {}) {
     "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes an exact captured snapshot of the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause, `devrouter stop . --delete` only for explicit exact-owner cleanup without removing the checkout, and `devrouter exec . -- <command...>` for container commands. Never substitute raw DevPod/Devsy mutations; they bypass the machine-global ownership lock, which serializes provider mutations in a fair arrival-order queue and lets contenders wait up to thirty minutes with throttled stderr progress before failing with the queue position or holder PID and true durations. `workspace up` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped.",
     "- After a drained interrupted ensure, manual exec can use an exactly proven retained Devsy runtime with the plain local Docker command. Revalidate identity for each tooling command until later preparation reconciles startup; preserve configuration, data and interrupted history. This does not repair absent stop baselines or provide OOM protection.",
     "- Busy ensure and exec wait up to thirty minutes for a positively identified active lifecycle worker on the same checkout, with stderr progress. Do not stop healthy work to make room. Commands stay serial; timeout or cancellation before admission leaves prior work untouched. A lifecycle fence change cancels admission, and uncertain execution is never replayed.",
-    "- Ensure reconciles interrupted or never-dispatched ensure after positive worker drainage. Unknown arbitrary exec never replays; use explicit stop to reconcile that uncertainty. Preserve journals and generated configuration if evidence is unavailable. This does not prevent OOM or activate capacity-managed recovery.",
-    "- Capacity admission is opt-in: only an operator-enabled capacity policy with an enrolled checkout routes ensure and exec through controller admission. The CLI follows the decision with bounded reconnecting waits that survive controller restarts, worker results are journalled atomically, and stop bypasses admission. Without an enabled policy lifecycle behavior is unchanged.",
+    "- Ensure reconciles interrupted or never-dispatched ensure after positive worker drainage. Unknown arbitrary exec never replays; use explicit stop to reconcile that uncertainty. Preserve journals and generated configuration if evidence is unavailable. This does not detect or prevent OOM; bounded automatic recovery runs only when the operator enables the capacity recovery policy.",
+    "- Capacity admission is opt-in: only an operator-enabled capacity policy with an enrolled checkout routes ensure and exec through controller admission. The CLI follows the decision with bounded reconnecting waits that survive controller restarts, worker results are journalled atomically, and stop bypasses admission. Without an enabled policy lifecycle behavior is unchanged. An optional recovery block adds bounded automatic recovery: one journal-admitted corrective ensure per positively failed required capability, bounded by per-scope restart counts, an aggregate corrective-action cap and a rolling observation window. It is inert unless enabled.",
     "- A lock that cannot prove its owner fails closed with the failing inspection stage, the exact lock path, and a portable reproduction command; run the canonical command in a permitted host context. No identity fallback is attempted, and `devrouter controller` prints the underlying cause on stderr while keeping the stable `controller-unavailable` JSON on stdout.",
     "- Devsy agent readiness: run `devrouter setup --yes --workspace-runtime devsy` once so Devrouter acquires and verifies the pinned agent in its own machine cache. `doctor` reports `ready`, `missing`, `stale`, or `invalid` without network access, and `ensure` fails before the provider queue when readiness is not `ready`. An explicit `DEVSY_AGENT_BINARY` remains authoritative and must match a pinned official asset.",
     "- A managed adapter plus `postCreateCommand` requires `waitFor` exactly `postCreateCommand` or `postStartCommand`; managed selective config preserves lifecycle fields and changes only `runServices`.",
@@ -20398,7 +20731,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.72" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.73" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -25828,7 +26161,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.72" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.73" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.0.72",
+  "version": "0.0.73",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",

package/upgrade-prompts/0.0.73.md

@@ -0,0 +1,54 @@
+# Upgrade to devrouter 0.0.73
+
+This patch release adds opt-in bounded automatic recovery and fixes three
+capacity-managed defects found while dogfooding the eLearning canary.
+
+- Capacity-enrolled `exec` now returns the wrapped command's output. The
+  controller captured a supervised worker's stdout and stderr into its bounded
+  buffer and the client exposed it through `onOutput`, but the CLI never
+  forwarded it, so `devrouter exec <path> -- <command>` returned only the exit
+  status. The controller-supervised path now streams each bounded page to the
+  caller and prints one notice if the buffer dropped earlier bytes.
+- A capacity-enrolled operation keeps its effect authority while the controller
+  cannot observe capacity. Renewal previously wrote a zero deadline before each
+  attempt and again on failure, so one missing, stale, or unknown sample revoked
+  authority mid-start and later commands failed with `Capacity effect authority
+  is absent or stale.` Renewal now extends only when every reserved domain has a
+  usable sample. Ownership evidence also compares environment identity instead
+  of whole journal records, so the controller rewriting its own bookkeeping no
+  longer reports `unknown` for a healthy runtime.
+- The observation collector reports a required managed process that has
+  positively exited as a failed capability instead of `unknown`, so bounded
+  recovery can act on it. Ambiguous or unreadable process state stays `unknown`.
+- Optional bounded automatic recovery. A new `recovery` block in the capacity
+  policy enables a supervisor that reacts to a positively failed required
+  capability with one journal-admitted corrective `ensure`, bounded by
+  per-scope restart counts, an aggregate corrective-action cap and a rolling
+  observation window. The block is absent by default. Parking and controlled
+  resume remain model-only, and there is no OOM detection: a container-local OOM
+  still surfaces only as a failed capability.
+
+No `.devrouter.yml` schema, CLI flag, or default behavior changes.
+
+## Task
+
+Install the published release and update `.devrouter.yml` devrouter.version to
+0.0.73. No configuration change is required. Enabling bounded recovery is
+optional: add a `recovery` block to the operator capacity policy only when you
+want automatic corrective ensures.
+
+## Validation
+
+On a capacity-enrolled checkout, run
+`devrouter exec <path> -- bash -lc 'echo checked'` and confirm the command's
+output appears. Confirm a failing command still returns its non-zero exit
+status, and that `devrouter ensure <path>` reports the environment ready with
+its routes published. If you enabled recovery, confirm an environment whose
+required process is positively absent is corrected by one admitted `ensure`
+within the configured bound.
+
+## Report
+
+Report the installed CLI version, the enrolled repository, the observed `exec`
+output and exit code, the final `ensure` readiness with its route count, and
+whether the recovery policy was enabled.