@devrouter/cli 0.0.73 → 0.0.75

package/dist/devrouter.js

@@ -1177,6 +1177,55 @@ function inspectManagedStopWorkspaceIds(endpoint, composeDirectory) {
   assertUniqueContainerIds(ids2);
   return ids2;
 }
+function assertManagedStopCheckoutAbsent(endpoint, repoPath) {
+  const list2 = () => {
+    const ids3 = parseDockerLines(
+      runManagedStopDocker(["ps", "-a", "--no-trunc", "--format", "{{.ID}}"], endpoint)
+    );
+    if (ids3.length > 256) throw new Error("Managed stop population exceeds its bound.");
+    ids3.forEach(assertFullContainerId);
+    assertUniqueContainerIds(ids3);
+    return ids3;
+  };
+  const ids2 = list2();
+  const seen = [];
+  const labels = [
+    "com.docker.compose.project.working_dir",
+    "devcontainer.local_folder",
+    "vsch.local.folder"
+  ];
+  const template = '{"id":{{json .Id}},"labels":{"com.docker.compose.project.working_dir":{{json (index .Config.Labels "com.docker.compose.project.working_dir")}},"devcontainer.local_folder":{{json (index .Config.Labels "devcontainer.local_folder")}},"vsch.local.folder":{{json (index .Config.Labels "vsch.local.folder")}}},"mounts":[{{range $i, $m := .Mounts}}{{if $i}},{{end}}{"Type":{{json $m.Type}},"Source":{{json $m.Source}}}{{end}}]}';
+  if (ids2.length) {
+    for (const line of parseDockerLines(
+      runManagedStopDocker(["inspect", "--format", template, ...ids2], endpoint)
+    )) {
+      const value = parseManagedStopJson(line);
+      if (!isRecord(value) || !isRecord(value.labels) || !Array.isArray(value.mounts))
+        throw new Error("Managed stop checkout inspection is malformed.");
+      assertFullContainerId(value.id);
+      seen.push(value.id);
+      for (const label2 of labels) {
+        const field = value.labels[label2];
+        if (field !== null && typeof field !== "string")
+          throw new Error("Managed stop checkout labels are incomplete.");
+        if (typeof field === "string" && sameWorkspacePath(
+          field,
+          label2 === labels[0] ? import_node_path4.default.join(repoPath, ".devcontainer") : repoPath
+        ))
+          throw new Error("Managed stop observed a remaining checkout container.");
+      }
+      for (const mount of value.mounts) {
+        if (!isRecord(mount) || typeof mount.Type !== "string" || typeof mount.Source !== "string")
+          throw new Error("Managed stop checkout mounts are incomplete.");
+        if (mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath))
+          throw new Error("Managed stop observed a remaining checkout mount.");
+      }
+    }
+  }
+  assertUniqueContainerIds(seen);
+  requireSameContainerPopulation(ids2, seen);
+  requireSameContainerPopulation(ids2, list2());
+}
 function hasExactManagedStopMissingObjectError(stderr, id5) {
   if (typeof stderr !== "string") return false;
   const line = stderr.endsWith("\r\n") ? stderr.slice(0, -2) : stderr.endsWith("\n") ? stderr.slice(0, -1) : stderr;
@@ -4207,7 +4256,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs7.default.read
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.73" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.75" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -5460,7 +5509,7 @@ var init_reliability_contract = __esm({
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.0.73" : "0.0.0-dev";
+  return true ? "0.0.75" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -7671,10 +7720,11 @@ function inspectDevsyRuntimeAbsence(devsyId) {
     encoding: "utf-8",
     timeout: 1e4
   });
-  if (!result.error && result.status === 0) {
+  if (result.error || result.status === null) return false;
+  if (result.status === 0) {
     return parseDevsyRuntimeStatus(result.stdout, devsyId) === "not-found";
   }
-  const output2 = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n");
+  const output2 = [result.stdout, result.stderr].filter(Boolean).join("\n");
   return /workspace not found/i.test(output2);
 }
 function inspectDevsyWorkspaceOwnership(workspaces, devsyId, worktreePath) {
@@ -8363,6 +8413,12 @@ function isWildcard(values) {
 function sha256(contents) {
   return (0, import_node_crypto11.createHash)("sha256").update(contents, "utf-8").digest("hex");
 }
+function safeComposeProject(value) {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(value)) {
+    throw new Error(`Docker Compose project '${value}' is not a safe exact identifier.`);
+  }
+  return value;
+}
 function inspectManagedDevcontainerConfig(options) {
   const managedRuntime = options.config.managedRuntime;
   if (!managedRuntime) {
@@ -8481,6 +8537,91 @@ function managedComposeEnvironment(workspace) {
   }
   return env;
 }
+function assertReadableComposeFile(file) {
+  try {
+    if (!import_node_fs18.default.statSync(file).isFile()) throw new Error("not a regular file");
+    import_node_fs18.default.accessSync(file, import_node_fs18.default.constants.R_OK);
+  } catch {
+    throw new Error("Managed container Compose configuration contains an unreadable file.");
+  }
+}
+function assertManagedContainerConfigUnchanged(options) {
+  if (options.containers.length === 0) {
+    throw new Error("Managed container configuration cannot be verified without containers.");
+  }
+  for (const container of options.containers) {
+    const project = container.labels["com.docker.compose.project"];
+    const service = container.labels["com.docker.compose.service"];
+    const workingDirectory = container.labels["com.docker.compose.project.working_dir"];
+    const recordedConfigFiles = container.labels["com.docker.compose.project.config_files"];
+    const expectedHash = container.labels["com.docker.compose.config-hash"];
+    if (!project || !service || !workingDirectory || !recordedConfigFiles || !expectedHash || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(service) || !/^[a-f0-9]{64}$/.test(expectedHash)) {
+      throw new Error("Managed container is missing valid Compose identity and hash labels.");
+    }
+    const composeProject = safeComposeProject(project);
+    const configFiles2 = recordedConfigFiles.split(",").map((file) => file.trim());
+    if (configFiles2.some((file) => file.length === 0)) {
+      throw new Error("Managed container has an invalid recorded Compose file list.");
+    }
+    if (options.plan.composeFiles.some(
+      (expected) => !configFiles2.some((actual) => sameWorkspacePath(actual, expected))
+    )) {
+      throw new Error("Managed container Compose files do not include the managed plan files.");
+    }
+    for (const file of configFiles2) assertReadableComposeFile(file);
+    const fileArgs = configFiles2.flatMap((file) => ["-f", file]);
+    const result = (() => {
+      try {
+        const composeArgs = [
+          "compose",
+          "--project-name",
+          composeProject,
+          "--project-directory",
+          workingDirectory
+        ];
+        const env = managedComposeEnvironment(options.workspace);
+        const rendered = (0, import_node_child_process8.spawnSync)(
+          "docker",
+          [...composeArgs, ...fileArgs, "config", "--format", "json"],
+          {
+            cwd: workingDirectory,
+            encoding: "utf-8",
+            env,
+            stdio: ["ignore", "pipe", "ignore"],
+            timeout: COMPOSE_HASH_TIMEOUT_MS,
+            maxBuffer: 1024 * 1024
+          }
+        );
+        if (rendered.status !== 0 || rendered.error || !rendered.stdout?.trim()) {
+          throw new Error("Compose configuration rendering failed.");
+        }
+        return (0, import_node_child_process8.spawnSync)(
+          "docker",
+          [...composeArgs, "-f", "-", "config", "--no-interpolate", "--hash", service],
+          {
+            cwd: workingDirectory,
+            encoding: "utf-8",
+            env,
+            input: rendered.stdout,
+            stdio: ["pipe", "pipe", "ignore"],
+            timeout: COMPOSE_HASH_TIMEOUT_MS,
+            maxBuffer: 1024 * 1024
+          }
+        );
+      } catch {
+        throw new Error(`Could not verify managed Compose configuration for service '${service}'.`);
+      }
+    })();
+    if (result.status !== 0 || result.error) {
+      throw new Error(`Could not verify managed Compose configuration for service '${service}'.`);
+    }
+    const output2 = typeof result.stdout === "string" ? result.stdout.trim() : "";
+    const match = /^(\S+)\s+([a-f0-9]{64})$/.exec(output2);
+    if (!match || match[1] !== service || match[2] !== expectedHash) {
+      throw new Error(`Managed Compose configuration changed for service '${service}'.`);
+    }
+  }
+}
 function stopExactManagedService(containerId, service, options) {
   assertSafeContainerId(containerId);
   const result = (0, import_node_child_process8.spawnSync)("docker", ["stop", containerId], {
@@ -8493,7 +8634,7 @@ function stopExactManagedService(containerId, service, options) {
     throw new Error(`Could not stop exact managed service '${service}' (${containerId}).`);
   }
 }
-var import_node_child_process8, import_node_crypto11, import_node_fs18, import_node_path25, import_yaml3, MANAGED_DEVCONTAINER_PATH, MANAGED_DEVCONTAINER_MARKER;
+var import_node_child_process8, import_node_crypto11, import_node_fs18, import_node_path25, import_yaml3, MANAGED_DEVCONTAINER_PATH, MANAGED_DEVCONTAINER_MARKER, COMPOSE_HASH_TIMEOUT_MS;
 var init_devcontainer_profile = __esm({
   "src/core/devcontainer-profile.ts"() {
     "use strict";
@@ -8509,6 +8650,7 @@ var init_devcontainer_profile = __esm({
     init_workspace();
     MANAGED_DEVCONTAINER_PATH = ".devcontainer/devcontainer.devrouter.json";
     MANAGED_DEVCONTAINER_MARKER = "// devrouter:managed devcontainer profile";
+    COMPOSE_HASH_TIMEOUT_MS = 1e4;
   }
 });
 
@@ -8517,8 +8659,10 @@ function listDevpodWorkspacesRaw(options = {}) {
   const result = (0, import_node_child_process9.spawnSync)("devpod", ["list", "--output", "json", "--skip-pro"], {
     encoding: "utf-8"
   });
-  if (options.allowMissingExecutable && result.error?.code === "ENOENT")
-    return [];
+  if (result.error?.code === "ENOENT") {
+    if (options.readLocalWhenMissing) return readLocalDevpodRegistry();
+    if (options.allowMissingExecutable) return [];
+  }
   if (result.error || result.status !== 0) {
     const details = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     throw new Error(`devpod list failed: ${details || "devpod is not installed or unavailable"}`);
@@ -8551,11 +8695,110 @@ function listDevpodWorkspacesRaw(options = {}) {
     return workspace;
   });
 }
-var import_node_child_process9;
+function devpodRegistryRoot() {
+  return import_node_path26.default.resolve(process.env.DEVPOD_HOME || import_node_path26.default.join(import_node_os3.default.homedir(), ".devpod"));
+}
+function readLocalDevpodRegistry() {
+  const fail4 = () => new Error("Local DevPod registry evidence is incomplete, unreadable, or changed.");
+  const stamps = /* @__PURE__ */ new Map();
+  const stamp = (stat, identityOnly = false) => JSON.stringify([
+    stat.dev,
+    stat.ino,
+    stat.mode,
+    stat.uid,
+    ...identityOnly ? [] : [stat.size, stat.mtimeMs, stat.ctimeMs]
+  ]);
+  const inspect = (file) => {
+    try {
+      return import_node_fs19.default.lstatSync(file);
+    } catch (error) {
+      if (error.code === "ENOENT") return void 0;
+      throw fail4();
+    }
+  };
+  const directory = (dir, optional = false, identityOnly = false) => {
+    const stat = inspect(dir);
+    if (!stat && !optional || stat && !stat.isDirectory()) throw fail4();
+    stamps.set(dir, { value: stat && stamp(stat, identityOnly), identityOnly });
+    return !!stat;
+  };
+  const entries = (dir) => {
+    const names = import_node_fs19.default.readdirSync(dir).sort();
+    if (names.length > 256) throw fail4();
+    return names;
+  };
+  const result = [];
+  try {
+    const root = devpodRegistryRoot();
+    let ancestor = import_node_path26.default.parse(root).root;
+    let present = directory(ancestor, false, ancestor !== root);
+    for (const part of root.slice(ancestor.length).split(import_node_path26.default.sep).filter(Boolean)) {
+      if (!present) break;
+      ancestor = import_node_path26.default.join(ancestor, part);
+      present = directory(ancestor, true, ancestor !== root);
+    }
+    const contexts = import_node_path26.default.join(root, "contexts");
+    if (present && directory(contexts, true)) {
+      for (const context of entries(contexts)) {
+        const contextDir = import_node_path26.default.join(contexts, context);
+        directory(contextDir);
+        const workspaces = import_node_path26.default.join(contextDir, "workspaces");
+        if (!directory(workspaces, true)) continue;
+        for (const id5 of entries(workspaces)) {
+          if (result.length >= 256) throw fail4();
+          const workspace = import_node_path26.default.join(workspaces, id5);
+          directory(workspace);
+          const file = import_node_path26.default.join(workspace, "workspace.json");
+          const stat = inspect(file);
+          if (!stat?.isFile() || stat.size > 1024 * 1024) throw fail4();
+          stamps.set(file, { value: stamp(stat), identityOnly: false });
+          const fd = import_node_fs19.default.openSync(file, import_node_fs19.default.constants.O_RDONLY | import_node_fs19.default.constants.O_NOFOLLOW);
+          let raw;
+          try {
+            if (stamp(import_node_fs19.default.fstatSync(fd)) !== stamp(stat)) throw fail4();
+            const buffer = Buffer.alloc(stat.size + 1);
+            const bytes2 = import_node_fs19.default.readSync(fd, buffer, 0, buffer.length, 0);
+            if (bytes2 !== stat.size || stamp(import_node_fs19.default.fstatSync(fd)) !== stamp(stat)) throw fail4();
+            raw = JSON.parse(buffer.subarray(0, bytes2).toString("utf8"));
+          } finally {
+            import_node_fs19.default.closeSync(fd);
+          }
+          if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw fail4();
+          const value = raw;
+          if (value.id !== id5 || !value.source || typeof value.source !== "object" || Array.isArray(value.source))
+            throw fail4();
+          const source = value.source;
+          if (source.localFolder !== void 0 && (typeof source.localFolder !== "string" || source.localFolder !== "" && !import_node_path26.default.isAbsolute(source.localFolder)))
+            throw fail4();
+          const remote = ["gitRepository", "image", "container"];
+          if (remote.some((key) => source[key] !== void 0 && typeof source[key] !== "string"))
+            throw fail4();
+          if (!source.localFolder && !remote.some((key) => typeof source[key] === "string" && source[key]))
+            throw fail4();
+          result.push({
+            id: id5,
+            source: { localFolder: source.localFolder ?? "" }
+          });
+        }
+      }
+    }
+    for (const [file, expected] of stamps) {
+      const actual = inspect(file);
+      if ((actual && stamp(actual, expected.identityOnly)) !== expected.value) throw fail4();
+    }
+    return result;
+  } catch {
+    throw fail4();
+  }
+}
+var import_node_child_process9, import_node_fs19, import_node_os3, import_node_path26;
 var init_devpod_registry = __esm({
   "src/core/devpod-registry.ts"() {
     "use strict";
     import_node_child_process9 = require("child_process");
+    import_node_fs19 = __toESM(require("fs"));
+    import_node_os3 = __toESM(require("os"));
+    import_node_path26 = __toESM(require("path"));
   }
 });
 
@@ -8573,13 +8816,13 @@ function proveManagedComposePopulation(options) {
     }
     services.add(service);
     const files = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").map((file) => file.trim());
-    if (files.some((file) => !file || !import_node_path26.default.isAbsolute(file)) || new Set(files.map((file) => import_node_path26.default.resolve(file))).size !== files.length || files.length < plan.composeFiles.length || plan.composeFiles.some((file, index) => !sameWorkspacePath(file, files[index]))) {
+    if (files.some((file) => !file || !import_node_path27.default.isAbsolute(file)) || new Set(files.map((file) => import_node_path27.default.resolve(file))).size !== files.length || files.length < plan.composeFiles.length || plan.composeFiles.some((file, index) => !sameWorkspacePath(file, files[index]))) {
       throw new Error("Managed stop Compose file identity changed.");
     }
     for (const file of files.slice(plan.composeFiles.length)) {
-      if (import_node_path26.default.dirname(file) !== featureDirectory || !/^docker-compose\.devcontainer\.containerFeatures-[a-zA-Z0-9_-]+\.yml$/.test(
-        import_node_path26.default.basename(file)
-      ) || import_node_fs19.default.realpathSync(file) !== import_node_path26.default.join(import_node_fs19.default.realpathSync(providerRoot), import_node_path26.default.relative(providerRoot, file))) {
+      if (import_node_path27.default.dirname(file) !== featureDirectory || !/^docker-compose\.devcontainer\.containerFeatures-[a-zA-Z0-9_-]+\.yml$/.test(
+        import_node_path27.default.basename(file)
+      ) || import_node_fs20.default.realpathSync(file) !== import_node_path27.default.join(import_node_fs20.default.realpathSync(providerRoot), import_node_path27.default.relative(providerRoot, file))) {
         throw new Error("Managed stop refuses a foreign or escaped provider Compose file.");
       }
     }
@@ -8597,12 +8840,12 @@ function proveManagedComposePopulation(options) {
   }
   return primary;
 }
-var import_node_fs19, import_node_path26;
+var import_node_fs20, import_node_path27;
 var init_managed_compose_population = __esm({
   "src/core/managed-compose-population.ts"() {
     "use strict";
-    import_node_fs19 = __toESM(require("fs"));
-    import_node_path26 = __toESM(require("path"));
+    import_node_fs20 = __toESM(require("fs"));
+    import_node_path27 = __toESM(require("path"));
     init_workspace();
   }
 });
@@ -8638,7 +8881,7 @@ function isRuntimeInstalled(runtime) {
 function readWorkspaceRuntimeConfig() {
   let raw;
   try {
-    raw = JSON.parse(import_node_fs20.default.readFileSync(RUNTIME_CONFIG_FILE, "utf-8"));
+    raw = JSON.parse(import_node_fs21.default.readFileSync(RUNTIME_CONFIG_FILE, "utf-8"));
   } catch {
     return {};
   }
@@ -8659,7 +8902,7 @@ function readWorkspaceRuntimeConfig() {
 function inspectWorkspaceRuntimeConfig() {
   let rawText;
   try {
-    rawText = import_node_fs20.default.readFileSync(RUNTIME_CONFIG_FILE, "utf-8");
+    rawText = import_node_fs21.default.readFileSync(RUNTIME_CONFIG_FILE, "utf-8");
   } catch {
     return { exists: false, config: {}, problems: [] };
   }
@@ -8710,7 +8953,7 @@ function writeWorkspaceRuntimeConfig(config) {
     }
     next.devsyInactivityTimeout = timeout;
   }
-  import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs21.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   writeFileAtomically(RUNTIME_CONFIG_FILE, `${JSON.stringify(next, null, 2)}
 `);
 }
@@ -8818,20 +9061,20 @@ function resetWorkspaceRuntimeCaches() {
   cachedRuntime = void 0;
   cachedSnapshots = void 0;
 }
-var import_node_child_process10, import_node_fs20, import_node_path27, SUPPORTED_RUNTIMES2, RUNTIME_CONFIG_FILE, INACTIVITY_TIMEOUT_PATTERN, cachedRuntime, cachedSnapshots, UnsupportedWorkspaceRuntimeError, WorkspaceRuntimeOwnershipError;
+var import_node_child_process10, import_node_fs21, import_node_path28, SUPPORTED_RUNTIMES2, RUNTIME_CONFIG_FILE, INACTIVITY_TIMEOUT_PATTERN, cachedRuntime, cachedSnapshots, UnsupportedWorkspaceRuntimeError, WorkspaceRuntimeOwnershipError;
 var init_workspace_runtime = __esm({
   "src/core/workspace-runtime.ts"() {
     "use strict";
     import_node_child_process10 = require("child_process");
-    import_node_fs20 = __toESM(require("fs"));
-    import_node_path27 = __toESM(require("path"));
+    import_node_fs21 = __toESM(require("fs"));
+    import_node_path28 = __toESM(require("path"));
     init_atomic_file();
     init_devpod_registry();
     init_devsy_workspaces();
     init_router();
     init_workspace();
     SUPPORTED_RUNTIMES2 = ["devpod", "devsy"];
-    RUNTIME_CONFIG_FILE = import_node_path27.default.join(DEVROUTER_HOME, "workspace-runtime.json");
+    RUNTIME_CONFIG_FILE = import_node_path28.default.join(DEVROUTER_HOME, "workspace-runtime.json");
     INACTIVITY_TIMEOUT_PATTERN = /^(?:\d+(?:ms|s|m|h))+$/;
     UnsupportedWorkspaceRuntimeError = class extends Error {
     };
@@ -8958,7 +9201,7 @@ function resolveGitCommonDir(repoPath) {
   if (result.status !== 0 || !output2) {
     throw commandError("Could not resolve the Git common directory", repoPath, result.stderr);
   }
-  return comparableWorkspacePath(import_node_path28.default.isAbsolute(output2) ? output2 : import_node_path28.default.resolve(repoPath, output2));
+  return comparableWorkspacePath(import_node_path29.default.isAbsolute(output2) ? output2 : import_node_path29.default.resolve(repoPath, output2));
 }
 function resolveGitTopLevel(repoPath) {
   const result = (0, import_node_child_process12.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
@@ -9009,7 +9252,7 @@ function listGitWorktrees(repoPath) {
   return worktrees;
 }
 function ownershipDirectory(repoPath) {
-  return import_node_path28.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
+  return import_node_path29.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
 }
 function validateWorkspace(value, label2) {
   if (typeof value !== "string" || wsFromBranch(value) !== value) {
@@ -9037,7 +9280,7 @@ function validateRecord(value, expectedWorkspace) {
       `workspace ownership file '${expectedWorkspace}' contains identity '${workspace}'`
     );
   }
-  if (typeof candidate.worktreePath !== "string" || !import_node_path28.default.isAbsolute(candidate.worktreePath)) {
+  if (typeof candidate.worktreePath !== "string" || !import_node_path29.default.isAbsolute(candidate.worktreePath)) {
     throw new Error("invalid workspace ownership worktreePath");
   }
   if (candidate.branch !== null && typeof candidate.branch !== "string") {
@@ -9055,7 +9298,7 @@ function validateRecord(value, expectedWorkspace) {
   };
 }
 function recordPath(repoPath, workspace) {
-  return import_node_path28.default.join(
+  return import_node_path29.default.join(
     ownershipDirectory(repoPath),
     `${validateWorkspace(workspace, "workspace")}.json`
   );
@@ -9063,7 +9306,7 @@ function recordPath(repoPath, workspace) {
 function readRecordFile(filePath, expectedWorkspace) {
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs21.default.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(import_node_fs22.default.readFileSync(filePath, "utf-8"));
   } catch (error) {
     if (error instanceof SyntaxError) {
       throw new Error(`invalid workspace ownership JSON at '${filePath}'`);
@@ -9088,7 +9331,7 @@ function listWorkspaceOwnership(repoPath) {
 function listWorkspaceOwnershipInDirectory(directory) {
   let entries;
   try {
-    entries = import_node_fs21.default.readdirSync(directory, { withFileTypes: true });
+    entries = import_node_fs22.default.readdirSync(directory, { withFileTypes: true });
   } catch (error) {
     if (error.code === "ENOENT") return [];
     throw error;
@@ -9096,14 +9339,14 @@ function listWorkspaceOwnershipInDirectory(directory) {
   return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
     const workspace = entry.name.slice(0, -".json".length);
     validateWorkspace(workspace, "filename");
-    return readRecordFile(import_node_path28.default.join(directory, entry.name), workspace);
+    return readRecordFile(import_node_path29.default.join(directory, entry.name), workspace);
   });
 }
 function writeWorkspaceOwnershipInDirectory(directory, input2) {
   const workspace = validateWorkspace(input2.workspace, "workspace");
   const devpodId = validateWorkspace(input2.devpodId, "devpodId");
   const worktreePath = comparableWorkspacePath(input2.worktreePath);
-  const filePath = import_node_path28.default.join(directory, `${workspace}.json`);
+  const filePath = import_node_path29.default.join(directory, `${workspace}.json`);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const records = listWorkspaceOwnershipInDirectory(directory);
   const existing = records.find((record6) => record6.workspace === workspace);
@@ -9139,9 +9382,9 @@ function writeWorkspaceOwnershipInDirectory(directory, input2) {
   return record5;
 }
 function removeWorkspaceOwnershipInDirectory(directory, workspace) {
-  const filePath = import_node_path28.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
+  const filePath = import_node_path29.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
   try {
-    import_node_fs21.default.rmSync(filePath);
+    import_node_fs22.default.rmSync(filePath);
     return true;
   } catch (error) {
     if (error.code === "ENOENT") return false;
@@ -9152,7 +9395,7 @@ function sameOwnershipRecord(left, right) {
   return left.version === right.version && left.workspace === right.workspace && sameWorkspacePath(left.worktreePath, right.worktreePath) && left.branch === right.branch && left.devpodId === right.devpodId && left.createdAt === right.createdAt && left.updatedAt === right.updatedAt;
 }
 function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
-  const filePath = import_node_path28.default.join(
+  const filePath = import_node_path29.default.join(
     directory,
     `${validateWorkspace(expected.workspace, "workspace")}.json`
   );
@@ -9164,14 +9407,14 @@ function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
     throw error;
   }
   if (!sameOwnershipRecord(current, expected)) return "changed";
-  import_node_fs21.default.rmSync(filePath);
+  import_node_fs22.default.rmSync(filePath);
   return "removed";
 }
 function withWorkspaceOwnershipTransaction(repoPath, operation, options = {}) {
   const directory = ownershipDirectory(repoPath);
-  import_node_fs21.default.mkdirSync(directory, { recursive: true });
+  import_node_fs22.default.mkdirSync(directory, { recursive: true });
   return withFileLockSync(
-    import_node_path28.default.join(directory, ".lock"),
+    import_node_path29.default.join(directory, ".lock"),
     {
       activity: "workspace ownership transaction",
       target: `'${repoPath}'`,
@@ -9204,7 +9447,7 @@ function persistedWorkspaceOwners(repoPath, worktreePath) {
     try {
       workspace = readPersistedWorkspace(worktree.path);
     } catch (error) {
-      if (!import_node_fs21.default.existsSync(worktree.path)) continue;
+      if (!import_node_fs22.default.existsSync(worktree.path)) continue;
       throw error;
     }
     if (!workspace) continue;
@@ -9367,7 +9610,7 @@ function inspectWorkspaceOwnership(record5, worktrees, devpods) {
   if (worktree?.locked) {
     return { ownerStatus: "locked", devpodStatus, worktree };
   }
-  if ((!worktree || worktree.prunable) && import_node_fs21.default.existsSync(record5.worktreePath)) {
+  if ((!worktree || worktree.prunable) && import_node_fs22.default.existsSync(record5.worktreePath)) {
     return { ownerStatus: "conflict", devpodStatus, worktree };
   }
   if (!worktree || worktree.prunable) {
@@ -9391,20 +9634,20 @@ function listMissingWorkspaceOwnership(repoPath) {
     (record5) => inspectWorkspaceOwnership(record5, worktrees, void 0).ownerStatus === "missing"
   );
 }
-var import_node_child_process12, import_node_fs21, import_node_path28, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
+var import_node_child_process12, import_node_fs22, import_node_path29, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
 var init_workspace_ownership = __esm({
   "src/core/workspace-ownership.ts"() {
     "use strict";
     import_node_child_process12 = require("child_process");
-    import_node_fs21 = __toESM(require("fs"));
-    import_node_path28 = __toESM(require("path"));
+    import_node_fs22 = __toESM(require("fs"));
+    import_node_path29 = __toESM(require("path"));
     init_atomic_file();
     init_devpod_workspaces();
     init_file_lock();
     init_workspace();
     READ_ONLY_GIT_ENV = { ...process.env, GIT_OPTIONAL_LOCKS: "0" };
     OWNERSHIP_VERSION = 1;
-    OWNERSHIP_DIR = import_node_path28.default.join("devrouter", "workspaces");
+    OWNERSHIP_DIR = import_node_path29.default.join("devrouter", "workspaces");
   }
 });
 
@@ -9653,12 +9896,12 @@ function managedStopRouteReferences(state) {
     (name) => ["http", "tcp"].map((protocol) => ({ repoPath: state.repoPath, name, protocol }))
   );
 }
-var import_node_os3, import_node_path29, import_node_util8;
+var import_node_os4, import_node_path30, import_node_util8;
 var init_managed_stop_recovery = __esm({
   "src/core/managed-stop-recovery.ts"() {
     "use strict";
-    import_node_os3 = __toESM(require("os"));
-    import_node_path29 = __toESM(require("path"));
+    import_node_os4 = __toESM(require("os"));
+    import_node_path30 = __toESM(require("path"));
     import_node_util8 = require("util");
     init_devpod_environment();
     init_devpod_registry();
@@ -9805,8 +10048,8 @@ function tlsSetupCommand(repoPath) {
 }
 function getMkcertRootCAPath(options = {}) {
   ensureMkcert();
-  const rootCAPath = import_node_path30.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
-  if (!import_node_fs22.default.existsSync(rootCAPath)) {
+  const rootCAPath = import_node_path31.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
+  if (!import_node_fs23.default.existsSync(rootCAPath)) {
     throw new Error(
       `mkcert root CA was not found at '${rootCAPath}'. Run: ${tlsSetupCommand(options.repoPath)}`
     );
@@ -9907,11 +10150,11 @@ function compactTLSCertificateHosts(hosts) {
   );
 }
 function readCurrentCertificateHosts(options = {}) {
-  if (!import_node_fs22.default.existsSync(CERT_FILE)) {
+  if (!import_node_fs23.default.existsSync(CERT_FILE)) {
     return [];
   }
   try {
-    const pem = import_node_fs22.default.readFileSync(CERT_FILE, "utf-8");
+    const pem = import_node_fs23.default.readFileSync(CERT_FILE, "utf-8");
     return parseCertificateDnsHosts(pem);
   } catch (error) {
     if (options.replaceMalformed) {
@@ -10039,20 +10282,20 @@ Run: ${tlsSetupCommand(options.repoPath)}`
     );
   }
 }
-var import_node_child_process14, import_node_crypto12, import_node_fs22, import_node_path30, DEFAULT_TLS_CERT_HOSTS, TLS_CERTIFICATE_LOCK_FILE, TLS_CERTIFICATE_LOCK_WAIT_MS, TLS_CERTIFICATE_WRITE_ATTEMPTS;
+var import_node_child_process14, import_node_crypto12, import_node_fs23, import_node_path31, DEFAULT_TLS_CERT_HOSTS, TLS_CERTIFICATE_LOCK_FILE, TLS_CERTIFICATE_LOCK_WAIT_MS, TLS_CERTIFICATE_WRITE_ATTEMPTS;
 var init_tls = __esm({
   "src/core/tls.ts"() {
     "use strict";
     import_node_child_process14 = require("child_process");
     import_node_crypto12 = require("crypto");
-    import_node_fs22 = __toESM(require("fs"));
-    import_node_path30 = __toESM(require("path"));
+    import_node_fs23 = __toESM(require("fs"));
+    import_node_path31 = __toESM(require("path"));
     init_docker();
     init_file_lock();
     init_host_routes();
     init_router();
     DEFAULT_TLS_CERT_HOSTS = ["localhost", "*.localhost"];
-    TLS_CERTIFICATE_LOCK_FILE = import_node_path30.default.join(DEVROUTER_HOME, "tls-certificate.lock");
+    TLS_CERTIFICATE_LOCK_FILE = import_node_path31.default.join(DEVROUTER_HOME, "tls-certificate.lock");
     TLS_CERTIFICATE_LOCK_WAIT_MS = 6e4;
     TLS_CERTIFICATE_WRITE_ATTEMPTS = 2;
   }
@@ -10133,6 +10376,174 @@ var init_route_publication = __esm({
   }
 });
 
+// src/core/traefik-route-health.ts
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function inspectRouterApi(protocol) {
+  const result = (0, import_node_child_process15.spawnSync)(
+    "curl",
+    [
+      "--silent",
+      "--show-error",
+      "--fail",
+      "--max-time",
+      ROUTER_API_REQUEST_TIMEOUT_SECONDS,
+      `${ROUTER_API_BASE}/${protocol}/routers?per_page=${ROUTER_API_PAGE_SIZE}`
+    ],
+    { encoding: "utf-8" }
+  );
+  if (result.status !== 0) {
+    return {
+      ok: false,
+      details: result.stderr?.trim() || `curl exited with status ${result.status ?? "unknown"}`
+    };
+  }
+  let value;
+  try {
+    value = JSON.parse(result.stdout);
+  } catch {
+    return { ok: false, details: `${protocol.toUpperCase()} router API returned invalid JSON` };
+  }
+  if (!Array.isArray(value)) {
+    return { ok: false, details: `${protocol.toUpperCase()} router API returned a non-array` };
+  }
+  if (value.some((item) => !isRecord5(item) || typeof item.name !== "string" || !item.name))
+    return {
+      ok: false,
+      details: `${protocol.toUpperCase()} router API returned malformed entries`
+    };
+  return {
+    ok: true,
+    reachedPageLimit: value.length >= ROUTER_API_PAGE_SIZE,
+    names: new Set(
+      value.flatMap((item) => {
+        if (!item || typeof item !== "object") return [];
+        const name = item.name;
+        return typeof name === "string" ? [name] : [];
+      })
+    )
+  };
+}
+function isRecord5(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function inspectExpectedRoutes(routes, expectation) {
+  const mismatched = [];
+  const failures = [];
+  for (const protocol of ["http", "tcp"]) {
+    const expected = routes.filter((route) => (route.protocol ?? "http") === protocol).map((route) => buildHostRouteRouterName(route.repoPath, route.name));
+    if (expected.length === 0) continue;
+    const result = inspectRouterApi(protocol);
+    if (!result.ok) {
+      failures.push(result.details);
+      mismatched.push(...expected);
+      continue;
+    }
+    const unexpected = expected.filter(
+      (name) => expectation === "loaded" ? !result.names.has(name) : result.names.has(name)
+    );
+    const boundedAbsenceIsUncertain = result.reachedPageLimit && (expectation === "loaded" ? unexpected.length > 0 : unexpected.length === 0);
+    if (boundedAbsenceIsUncertain) {
+      failures.push(
+        `${protocol.toUpperCase()} router API reached the ${ROUTER_API_PAGE_SIZE}-entry safety limit`
+      );
+    }
+    mismatched.push(...unexpected);
+    if (expectation === "removed" && unexpected.length === 0 && result.reachedPageLimit) {
+      mismatched.push(...expected);
+    }
+  }
+  return mismatched.length === 0 ? { ok: true } : {
+    ok: false,
+    routes: mismatched,
+    details: failures.length > 0 ? failures.join("; ") : expectation === "loaded" ? "router names are absent" : "router names are still present"
+  };
+}
+async function waitForExpectedRoutes(routes, expectation, timeoutMs, pollIntervalMs) {
+  const deadline = Date.now() + timeoutMs;
+  let result;
+  do {
+    result = inspectExpectedRoutes(routes, expectation);
+    if (result.ok) return result;
+    if (Date.now() < deadline) {
+      await sleep(Math.min(pollIntervalMs, Math.max(1, deadline - Date.now())));
+    }
+  } while (Date.now() < deadline);
+  return result;
+}
+async function ensureTraefikRouteExpectation(routes, expectation, options) {
+  if (routes.length === 0) return { restarted: false };
+  const initialTimeoutMs = options.initialTimeoutMs ?? DEFAULT_INITIAL_TIMEOUT_MS;
+  const recoveryTimeoutMs = options.recoveryTimeoutMs ?? DEFAULT_RECOVERY_TIMEOUT_MS;
+  const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const initial = await waitForExpectedRoutes(
+    routes,
+    expectation,
+    initialTimeoutMs,
+    pollIntervalMs
+  );
+  if (initial.ok) return { restarted: false };
+  if (options.allowRestart === false)
+    throw new Error(
+      "Traefik routes did not reload; shared router restart is disabled for this operation."
+    );
+  import_node_fs24.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  return withFileLock(
+    ROUTER_RELOAD_LOCK_FILE,
+    {
+      activity: "Traefik route reload recovery",
+      waitMs: initialTimeoutMs + recoveryTimeoutMs + 1e4,
+      fair: true,
+      onWait: createStderrWaitReporter("Traefik route reload recovery", "shared router")
+    },
+    async () => {
+      const recheck = await waitForExpectedRoutes(routes, expectation, 0, pollIntervalMs);
+      if (recheck.ok) return { restarted: false };
+      claimLifecycleEffect();
+      restartRouterStack();
+      const recovered = await waitForExpectedRoutes(
+        routes,
+        expectation,
+        recoveryTimeoutMs,
+        pollIntervalMs
+      );
+      if (recovered.ok) return { restarted: true };
+      const action2 = expectation === "loaded" ? "load" : "remove";
+      throw new Error(
+        `Traefik did not ${action2} file-provider routes after one restart: ${recovered.routes.join(", ")} (${recovered.details}). Inspect: devrouter logs --tail 100`
+      );
+    }
+  );
+}
+async function ensureTraefikRoutesRemoved(routes, options = {}) {
+  return ensureTraefikRouteExpectation(routes, "removed", options);
+}
+function assertTraefikRoutesRemoved(routes) {
+  const result = inspectExpectedRoutes(routes, "removed");
+  if (!result.ok) throw new Error(`Workspace route cessation is not proven: ${result.details}`);
+}
+var import_node_child_process15, import_node_fs24, import_node_path32, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, ROUTER_API_REQUEST_TIMEOUT_SECONDS, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, ROUTER_API_PAGE_SIZE;
+var init_traefik_route_health = __esm({
+  "src/core/traefik-route-health.ts"() {
+    "use strict";
+    import_node_child_process15 = require("child_process");
+    import_node_fs24 = __toESM(require("fs"));
+    import_node_path32 = __toESM(require("path"));
+    init_file_lock();
+    init_host_routes();
+    init_reliability_context();
+    init_router();
+    ROUTER_API_BASE = "http://127.0.0.1:8080/api";
+    ROUTER_RELOAD_LOCK_FILE = import_node_path32.default.join(DEVROUTER_HOME, "router-reload.lock");
+    ROUTER_API_REQUEST_TIMEOUT_SECONDS = "2";
+    DEFAULT_INITIAL_TIMEOUT_MS = 3e3;
+    DEFAULT_RECOVERY_TIMEOUT_MS = 1e4;
+    DEFAULT_POLL_INTERVAL_MS = 250;
+    ROUTER_API_PAGE_SIZE = 1e3;
+  }
+});
+
 // src/core/managed-devsy-stop.ts
 function sameSet(left, right) {
   return JSON.stringify([...left].sort()) === JSON.stringify([...right].sort());
@@ -10145,10 +10556,92 @@ function containerIdentity(container) {
     mounts: container.mounts.map((mount) => JSON.stringify(mount)).sort()
   });
 }
+function proveInitialManagedDevsyAbsence(repoPath, expectedId) {
+  if (!isLinkedWorktree(repoPath)) return void 0;
+  const workspace = resolveWorktreeWorkspace(repoPath);
+  if (!workspace || readManagedRuntimeState(repoPath, workspace)) return void 0;
+  if (!import_node_fs25.default.existsSync(import_node_path33.default.join(repoPath, ".devrouter.yml"))) return void 0;
+  const runtime = loadRuntimeConfig(repoPath, workspace);
+  if (!runtime.config.managedRuntime) return void 0;
+  const routes = proxyAppsFromConfig(runtime.config).flatMap(
+    (app) => ["http", "tcp"].map((protocol) => ({ repoPath, name: app.name, protocol }))
+  );
+  const record5 = readWorkspaceOwnership(repoPath, workspace);
+  if (!record5 || expectedId !== void 0 && record5.devpodId !== expectedId || record5.workspace !== workspace || !sameWorkspacePath(record5.worktreePath, repoPath))
+    throw new Error("Initial managed stop requires exact linked ownership.");
+  const devsyId = record5.devpodId;
+  const ownership = inspectDevsyWorkspaceOwnership(listDevsyWorkspaces(), devsyId, repoPath);
+  if (ownership.status === "conflict") throw new Error(ownership.reason);
+  if (ownership.status !== "absent") return void 0;
+  const gitCommonDir = resolveGitCommonDir(repoPath);
+  const endpoint = resolveManagedStopEndpoint();
+  if (!supportsManagedStopBaseline(endpoint))
+    throw new Error("Initial managed stop requires a local Docker endpoint.");
+  const daemon = inspectManagedStopDaemon(endpoint);
+  const legacyHome = devpodRegistryRoot();
+  const readLegacy = () => listDevpodWorkspacesRaw({ readLocalWhenMissing: true }).map(({ id: id5, source }) => ({ id: id5, source: { localFolder: source.localFolder } })).sort(
+    (a, b) => a.id.localeCompare(b.id) || a.source.localFolder.localeCompare(b.source.localFolder)
+  );
+  const legacyWorkspaces = readLegacy();
+  const observe = () => {
+    resetWorkspaceRuntimeCaches();
+    if (resolveWorkspaceRuntimeOrDefault(repoPath) !== "devsy" || !isLinkedWorktree(repoPath) || resolveWorktreeWorkspace(repoPath) !== workspace || resolveGitCommonDir(repoPath) !== gitCommonDir || !(0, import_node_util9.isDeepStrictEqual)(readWorkspaceOwnership(repoPath, workspace), record5) || inspectWorkspaceOwnership(record5, listGitWorktrees(repoPath), void 0).ownerStatus !== "present" || readManagedRuntimeState(repoPath, workspace))
+      throw new Error("Initial managed stop ownership or retained state changed.");
+    if (devpodRegistryRoot() !== legacyHome || !(0, import_node_util9.isDeepStrictEqual)(readLegacy(), legacyWorkspaces))
+      throw new Error("Initial managed stop legacy registry evidence changed.");
+    if (inspectDevsyWorkspaceOwnership(listDevsyWorkspaces(), devsyId, repoPath).status !== "absent" || legacyWorkspaces.some(
+      (entry) => entry.id === devsyId || entry.source.localFolder !== "" && sameWorkspacePath(entry.source.localFolder, repoPath)
+    ))
+      throw new Error("Initial managed stop requires both provider registrations absent.");
+    if (!inspectDevsyRuntimeAbsence(devsyId))
+      throw new Error("Initial managed stop requires positive runtime not-found.");
+    if (resolveManagedStopEndpoint() !== endpoint || inspectManagedStopDaemon(endpoint) !== daemon)
+      throw new Error("Initial managed stop Docker identity changed.");
+    if (inspectProviderRunnerContainers(endpoint, devsyId).length)
+      throw new Error("Initial managed stop observed a remaining provider runner.");
+    assertManagedStopCheckoutAbsent(endpoint, repoPath);
+    if (listHostRouteState().some((route) => sameWorkspacePath(route.repoPath, repoPath)))
+      throw new Error("Initial managed stop observed remaining workspace routes.");
+    assertTraefikRoutesRemoved(routes);
+    if (resolveManagedStopEndpoint() !== endpoint || inspectManagedStopDaemon(endpoint) !== daemon)
+      throw new Error("Initial managed stop Docker identity changed.");
+  };
+  observe();
+  observe();
+  return {
+    workspace,
+    record: record5,
+    gitCommonDir,
+    endpoint,
+    daemon,
+    routes,
+    legacyHome,
+    legacyWorkspaces
+  };
+}
 function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
-  if (!import_node_fs23.default.existsSync(import_node_path31.default.join(repoPath, ".devrouter.yml"))) return false;
+  if (!import_node_fs25.default.existsSync(import_node_path33.default.join(repoPath, ".devrouter.yml"))) return false;
+  if (!loadRepoConfig(repoPath).managedRuntime) return false;
   const linked = isLinkedWorktree(repoPath);
   const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
+  const identity2 = { repoPath, workspace: workspace ?? null, provider: "devsy" };
+  const readAuthority = () => {
+    const record5 = readReliabilityOperation(identity2);
+    const operation = record5?.state.operation;
+    const entries = record5?.state.operationHistory.filter((entry2) => entry2.id === operation?.id);
+    const entry = entries?.[0];
+    if (!record5 || !(0, import_node_util9.isDeepStrictEqual)(record5.identity, identity2) || record5.worker || !operation || operation.kind !== "ensure" || !operation.drained || !["COMPLETED", "INTERRUPTED", "COMPLETION_UNKNOWN"].includes(operation.status) || record5.state.phase !== "stopping" || record5.state.desired !== "stopped-by-user" || entries?.length !== 1 || !entry || entry.kind !== "ensure" || !entry.profile || !entry.drained || entry.status !== operation.status)
+      throw new Error("Initial managed stop requires the drained ensure's recorded profile.");
+    return {
+      identity: record5.identity,
+      fence: reliabilityFence(record5.state),
+      operation,
+      entry
+    };
+  };
+  const authority = readAuthority();
+  const gitCommonDir = linked ? resolveGitCommonDir(repoPath) : void 0;
+  const workspaceEnv = workspace && gitCommonDir ? { token: workspace, gitCommonDir } : void 0;
   const registration2 = () => {
     resetWorkspaceRuntimeCaches();
     if (resolveWorkspaceRuntimeOrDefault(repoPath) !== "devsy")
@@ -10158,14 +10651,20 @@ function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
       throw new Error("Initial managed stop requires one exact Devsy registration.");
     if (linked) {
       const record5 = workspace ? readWorkspaceOwnership(repoPath, workspace) : void 0;
-      if (!record5 || record5.devpodId !== devsyId || !sameWorkspacePath(record5.worktreePath, repoPath) || resolveWorktreeWorkspace(repoPath) !== workspace)
+      if (!record5 || record5.devpodId !== devsyId || !sameWorkspacePath(record5.worktreePath, repoPath) || resolveWorktreeWorkspace(repoPath) !== workspace || resolveGitCommonDir(repoPath) !== gitCommonDir || inspectWorkspaceOwnership(record5, listGitWorktrees(repoPath), void 0).ownerStatus !== "present")
         throw new Error("Initial managed stop workspace ownership changed.");
     }
     return owner2.workspace;
   };
-  const runtime = loadRuntimeConfig(repoPath, workspace ?? "");
-  if (!runtime.config.managedRuntime) return false;
+  const runtime = loadRuntimeConfig(repoPath, workspace ?? "", authority.entry.profile);
+  if (!runtime.config.managedRuntime || runtime.profile !== authority.entry.profile)
+    throw new Error("Initial managed stop requires the recorded managed profile.");
   const owner = registration2();
+  proveLocalDockerSelection(owner);
+  const endpoint = resolveManagedStopEndpoint();
+  if (!supportsManagedStopBaseline(endpoint))
+    throw new Error("Initial managed stop requires a pinned local Docker endpoint.");
+  const daemon = inspectManagedStopDaemon(endpoint);
   if (!owner.context || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(owner.context) || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(devsyId))
     throw new Error("Initial managed stop requires exact provider context.");
   const plan = inspectManagedDevcontainerConfig({
@@ -10174,8 +10673,8 @@ function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
     profile: runtime.resolvedProfile,
     linked
   });
-  const providerRoot = import_node_path31.default.resolve(process.env.DEVSY_HOME || import_node_path31.default.join(import_node_os4.default.homedir(), ".devsy"));
-  const featureDirectory = import_node_path31.default.join(
+  const providerRoot = import_node_path33.default.resolve(process.env.DEVSY_HOME || import_node_path33.default.join(import_node_os5.default.homedir(), ".devsy"));
+  const featureDirectory = import_node_path33.default.join(
     providerRoot,
     "contexts",
     owner.context,
@@ -10185,27 +10684,51 @@ function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
     ".docker-compose"
   );
   const observe = () => {
-    if (!(0, import_node_util9.isDeepStrictEqual)(registration2(), owner) || readManagedRuntimeState(repoPath, workspace))
-      throw new Error("Initial managed stop ownership or runtime state changed.");
+    if (!(0, import_node_util9.isDeepStrictEqual)(readAuthority(), authority) || !(0, import_node_util9.isDeepStrictEqual)(registration2(), owner) || readManagedRuntimeState(repoPath, workspace) || resolveManagedStopEndpoint() !== endpoint || inspectManagedStopDaemon(endpoint) !== daemon)
+      throw new Error("Initial managed stop authority or runtime state changed.");
+    proveLocalDockerSelection(owner);
+    if (listDevpodWorkspacesRaw({ readLocalWhenMissing: true }).some(
+      (entry) => entry.id === devsyId || entry.source.localFolder !== "" && sameWorkspacePath(entry.source.localFolder, repoPath)
+    ))
+      throw new Error("Initial managed stop found conflicting provider ownership.");
+    const currentRuntime = loadRuntimeConfig(repoPath, workspace ?? "", authority.entry.profile);
+    const currentPlan = inspectManagedDevcontainerConfig({
+      repoPath,
+      config: currentRuntime.config,
+      profile: currentRuntime.resolvedProfile,
+      linked
+    });
+    if (currentRuntime.profile !== authority.entry.profile || !(0, import_node_util9.isDeepStrictEqual)(currentRuntime.resolvedProfile, runtime.resolvedProfile) || !(0, import_node_util9.isDeepStrictEqual)(currentPlan, plan) || inspectManagedDevcontainerGeneratedConfig(currentPlan).status !== "valid")
+      throw new Error("Initial managed stop configuration changed.");
     const matches = inspectWorkspaceContainers().filter(
       (c) => sameWorkspacePath(
         c.labels["com.docker.compose.project.working_dir"] ?? "",
         plan.composeDirectory
       )
     );
-    if (!matches.length) return [];
+    if (!matches.length)
+      throw new Error("Initial managed stop requires its complete selected population.");
     const projects = new Set(matches.map((c) => c.labels["com.docker.compose.project"]));
     if (projects.size !== 1 || !matches[0]?.labels["com.docker.compose.project"])
       throw new Error("Initial managed stop requires one exact Compose project.");
     const population = inspectManagedStopContainers(
-      matches[0].labels["com.docker.compose.project"]
+      matches[0].labels["com.docker.compose.project"],
+      endpoint
     );
     if (!sameSet(
+      inspectManagedStopWorkspaceIds(endpoint, plan.composeDirectory),
+      population.map((c) => c.id)
+    ) || !sameSet(
       matches.map((c) => c.id),
       population.map((c) => c.id)
     ))
       throw new Error("Initial managed stop population changed.");
-    proveManagedComposePopulation({
+    if (!sameSet(
+      population.map((c) => c.labels["com.docker.compose.service"] ?? ""),
+      plan.desiredServices
+    ))
+      throw new Error("Initial managed stop requires its complete selected population.");
+    const primary = proveManagedComposePopulation({
       plan,
       repoPath,
       composeProject: matches[0].labels["com.docker.compose.project"],
@@ -10213,9 +10736,23 @@ function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
       featureDirectory,
       containers: population
     });
+    const uidBytes = Buffer.byteLength(owner.uid ?? "");
+    const runnerId = (uidBytes === 16 || uidBytes === 40 ? owner.uid : void 0) ?? devsyId;
+    if (owner.source.container && owner.source.container !== primary.id || !owner.source.container && inspectManagedStopRunnerId(endpoint, primary.id) !== runnerId)
+      throw new Error("Initial managed stop provider-to-container binding changed.");
+    if (!owner.source.container && !sameSet(inspectProviderRunnerContainers(endpoint, runnerId), [primary.id]))
+      throw new Error("Initial managed stop provider runner population changed.");
+    assertManagedContainerConfigUnchanged({
+      plan,
+      containers: population,
+      workspace: workspaceEnv
+    });
+    if (!(0, import_node_util9.isDeepStrictEqual)(readAuthority(), authority) || !(0, import_node_util9.isDeepStrictEqual)(registration2(), owner) || resolveManagedStopEndpoint() !== endpoint || inspectManagedStopDaemon(endpoint) !== daemon)
+      throw new Error("Initial managed stop authority changed during inspection.");
     return population;
   };
   const initial = observe();
+  const stopped = new Set(initial.filter((c) => !c.state.Running).map((c) => c.id));
   const stable = () => {
     const current = observe();
     if (!sameSet(
@@ -10223,19 +10760,21 @@ function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
       current.map((c) => c.id)
     ) || current.some((c) => {
       const prior = initial.find((p) => p.id === c.id);
-      return !prior || containerIdentity(prior) !== containerIdentity(c) || !prior.state.Running && c.state.Running;
+      return !prior || containerIdentity(prior) !== containerIdentity(c) || stopped.has(c.id) && c.state.Running;
     }))
       throw new Error("Initial managed stop population or identity changed.");
+    for (const c of current) if (!c.state.Running) stopped.add(c.id);
     return current;
   };
   stable();
-  if (!initial.length) return false;
   for (const container of initial) {
     const current = stable().find((c) => c.id === container.id);
-    if (current?.state.Running)
-      stopExactManagedService(current.id, current.labels["com.docker.compose.service"] ?? "", {
-        timeoutMs: 3e4
-      });
+    if (current?.state.Running) {
+      claimLifecycleEffect();
+      stopPinnedManagedContainer(endpoint, current.id);
+      if (stable().find((c) => c.id === current.id)?.state.Running)
+        throw new Error("Initial managed stop container cessation is not proven.");
+    }
   }
   if (stable().some((c) => c.state.Running))
     throw new Error("Initial managed stop left a workload running.");
@@ -10246,7 +10785,10 @@ function stopRetainedManagedDevsyWorkspace(options) {
   const linked = isLinkedWorktree(repoPath);
   const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
   const retainedState = readManagedRuntimeState(repoPath, workspace);
-  if (!retainedState) return stopInitialManagedDevsyWorkspace(repoPath, devsyId);
+  if (!retainedState) {
+    if (proveInitialManagedDevsyAbsence(repoPath, devsyId)) return "proven-absent";
+    return stopInitialManagedDevsyWorkspace(repoPath, devsyId);
+  }
   const state = retainedState;
   if (state.devpodId !== devsyId || linked && !workspace) {
     throw new Error("Managed stop requires the exact retained workspace identity.");
@@ -10307,7 +10849,7 @@ function stopRetainedManagedDevsyWorkspace(options) {
       const owned = inspectWorkspaceContainers().filter(
         (container) => sameWorkspacePath(
           container.labels["com.docker.compose.project.working_dir"] ?? "",
-          import_node_path31.default.join(repoPath, ".devcontainer")
+          import_node_path33.default.join(repoPath, ".devcontainer")
         )
       );
       if (owned.length !== 0) {
@@ -10336,8 +10878,8 @@ function stopRetainedManagedDevsyWorkspace(options) {
   if (!context || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(context) || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(devsyId)) {
     throw new Error("Managed stop requires a valid exact Devsy context and workspace ID.");
   }
-  const devsyRoot = import_node_path31.default.resolve(process.env.DEVSY_HOME || import_node_path31.default.join(import_node_os4.default.homedir(), ".devsy"));
-  const featureDirectory = import_node_path31.default.join(
+  const devsyRoot = import_node_path33.default.resolve(process.env.DEVSY_HOME || import_node_path33.default.join(import_node_os5.default.homedir(), ".devsy"));
+  const featureDirectory = import_node_path33.default.join(
     devsyRoot,
     "contexts",
     context,
@@ -10441,23 +10983,29 @@ function stopRetainedManagedDevsyWorkspace(options) {
   if (providerFailed) throw providerError;
   return true;
 }
-var import_node_fs23, import_node_os4, import_node_path31, import_node_util9;
+var import_node_fs25, import_node_os5, import_node_path33, import_node_util9;
 var init_managed_devsy_stop = __esm({
   "src/core/managed-devsy-stop.ts"() {
     "use strict";
-    import_node_fs23 = __toESM(require("fs"));
-    import_node_os4 = __toESM(require("os"));
-    import_node_path31 = __toESM(require("path"));
+    import_node_fs25 = __toESM(require("fs"));
+    import_node_os5 = __toESM(require("os"));
+    import_node_path33 = __toESM(require("path"));
     import_node_util9 = require("util");
     init_devcontainer_profile();
     init_devpod_environment();
     init_devpod_registry();
+    init_devsy_exec_proof();
     init_devsy_workspaces();
+    init_host_routes();
     init_managed_compose_population();
     init_managed_runtime_state();
     init_managed_stop_recovery();
+    init_reliability_context();
+    init_reliability_contract();
+    init_reliability_operation_store();
     init_repo_config();
     init_route_publication();
+    init_traefik_route_health();
     init_workspace();
     init_workspace_ownership();
     init_workspace_runtime();
@@ -11003,7 +11551,7 @@ function hasControlCharacter2(value) {
 function readPolicyFile(filePath) {
   let initialStats;
   try {
-    initialStats = import_node_fs24.default.lstatSync(filePath);
+    initialStats = import_node_fs26.default.lstatSync(filePath);
   } catch (error) {
     if (isErrno(error, "ENOENT")) return { status: "absent" };
     return { status: "invalid", error: "network policy could not be read" };
@@ -11016,16 +11564,16 @@ function readPolicyFile(filePath) {
   }
   let fileDescriptor;
   try {
-    fileDescriptor = import_node_fs24.default.openSync(
+    fileDescriptor = import_node_fs26.default.openSync(
       filePath,
-      import_node_fs24.default.constants.O_RDONLY | import_node_fs24.default.constants.O_NONBLOCK | (import_node_fs24.default.constants.O_NOFOLLOW ?? 0)
+      import_node_fs26.default.constants.O_RDONLY | import_node_fs26.default.constants.O_NONBLOCK | (import_node_fs26.default.constants.O_NOFOLLOW ?? 0)
     );
   } catch (error) {
     if (isErrno(error, "ENOENT")) return { status: "absent" };
     return { status: "invalid", error: "network policy could not be read" };
   }
   try {
-    const openedStats = import_node_fs24.default.fstatSync(fileDescriptor);
+    const openedStats = import_node_fs26.default.fstatSync(fileDescriptor);
     if (!openedStats.isFile()) {
       return { status: "invalid", error: "network policy must be a regular file" };
     }
@@ -11038,12 +11586,12 @@ function readPolicyFile(filePath) {
     const buffer = Buffer.alloc(openedStats.size);
     let offset = 0;
     while (offset < buffer.length) {
-      const bytesRead = import_node_fs24.default.readSync(fileDescriptor, buffer, offset, buffer.length - offset, null);
+      const bytesRead = import_node_fs26.default.readSync(fileDescriptor, buffer, offset, buffer.length - offset, null);
       if (bytesRead === 0)
         return { status: "invalid", error: "network policy changed during read" };
       offset += bytesRead;
     }
-    const finalStats = import_node_fs24.default.fstatSync(fileDescriptor);
+    const finalStats = import_node_fs26.default.fstatSync(fileDescriptor);
     if (!finalStats.isFile() || finalStats.size !== openedStats.size) {
       return { status: "invalid", error: "network policy changed during read" };
     }
@@ -11052,7 +11600,7 @@ function readPolicyFile(filePath) {
     return { status: "invalid", error: "network policy could not be read" };
   } finally {
     try {
-      import_node_fs24.default.closeSync(fileDescriptor);
+      import_node_fs26.default.closeSync(fileDescriptor);
     } catch {
     }
   }
@@ -11069,16 +11617,16 @@ function assertDisjoint(cidrs, message) {
 function isErrno(error, code) {
   return typeof error === "object" && error !== null && "code" in error && error.code === code;
 }
-var import_node_fs24, import_node_path32, NETWORK_POLICY_VERSION, NETWORK_POLICY_FILE, DEFAULT_NETWORK_POLICY_ENDPOINT_RESERVE, NETWORK_POLICY_PREFIX_LENGTHS, MAX_NETWORK_POLICY_FILE_BYTES, MAX_NETWORK_POLICY_ARRAY_ENTRIES, MAX_NETWORK_POLICY_DAEMON_ID_LENGTH, NetworkPolicyValidationError, NETWORK_POLICY_KEYS, PRIVATE_IPV4_RANGES;
+var import_node_fs26, import_node_path34, NETWORK_POLICY_VERSION, NETWORK_POLICY_FILE, DEFAULT_NETWORK_POLICY_ENDPOINT_RESERVE, NETWORK_POLICY_PREFIX_LENGTHS, MAX_NETWORK_POLICY_FILE_BYTES, MAX_NETWORK_POLICY_ARRAY_ENTRIES, MAX_NETWORK_POLICY_DAEMON_ID_LENGTH, NetworkPolicyValidationError, NETWORK_POLICY_KEYS, PRIVATE_IPV4_RANGES;
 var init_network_policy = __esm({
   "src/core/network-policy.ts"() {
     "use strict";
-    import_node_fs24 = __toESM(require("fs"));
-    import_node_path32 = __toESM(require("path"));
+    import_node_fs26 = __toESM(require("fs"));
+    import_node_path34 = __toESM(require("path"));
     init_network_capacity();
     init_router();
     NETWORK_POLICY_VERSION = 1;
-    NETWORK_POLICY_FILE = import_node_path32.default.join(DEVROUTER_HOME, "network-policy.json");
+    NETWORK_POLICY_FILE = import_node_path34.default.join(DEVROUTER_HOME, "network-policy.json");
     DEFAULT_NETWORK_POLICY_ENDPOINT_RESERVE = 8;
     NETWORK_POLICY_PREFIX_LENGTHS = [24, 25, 26];
     MAX_NETWORK_POLICY_FILE_BYTES = 64 * 1024;
@@ -11179,27 +11727,27 @@ function assertExactKeys(value, keys2) {
 function readDocument(store) {
   let descriptor;
   try {
-    descriptor = import_node_fs25.default.openSync(
+    descriptor = import_node_fs27.default.openSync(
       store.filePath,
-      import_node_fs25.default.constants.O_RDONLY | import_node_fs25.default.constants.O_NONBLOCK | (import_node_fs25.default.constants.O_NOFOLLOW ?? 0)
+      import_node_fs27.default.constants.O_RDONLY | import_node_fs27.default.constants.O_NONBLOCK | (import_node_fs27.default.constants.O_NOFOLLOW ?? 0)
     );
   } catch (error) {
     if (isErrno2(error, "ENOENT")) return void 0;
     throw claimError("invalid-state", "network claim state could not be read");
   }
   try {
-    const stat = import_node_fs25.default.fstatSync(descriptor);
+    const stat = import_node_fs27.default.fstatSync(descriptor);
     if (!stat.isFile() || stat.size > NETWORK_CLAIMS_MAX_FILE_BYTES || (stat.mode & 63) !== 0) {
       throw claimError("invalid-state", "network claim state is not a bounded private file");
     }
     const buffer = Buffer.alloc(NETWORK_CLAIMS_MAX_FILE_BYTES + 1);
     let count = 0;
     while (count < buffer.length) {
-      const bytesRead = import_node_fs25.default.readSync(descriptor, buffer, count, buffer.length - count, null);
+      const bytesRead = import_node_fs27.default.readSync(descriptor, buffer, count, buffer.length - count, null);
       if (bytesRead === 0) break;
       count += bytesRead;
     }
-    const finalStat = import_node_fs25.default.fstatSync(descriptor);
+    const finalStat = import_node_fs27.default.fstatSync(descriptor);
     if (count > NETWORK_CLAIMS_MAX_FILE_BYTES || finalStat.size !== stat.size) {
       throw claimError("invalid-state", "network claim state changed during read");
     }
@@ -11211,7 +11759,7 @@ function readDocument(store) {
     }
     return validateDocument(parsed, store.daemonId);
   } finally {
-    import_node_fs25.default.closeSync(descriptor);
+    import_node_fs27.default.closeSync(descriptor);
   }
 }
 function validateDocument(value, daemonId) {
@@ -11278,16 +11826,16 @@ function createStore(daemonId, options) {
   return {
     root,
     daemonId,
-    filePath: import_node_path33.default.join(root, `${key}.json`),
-    lockPath: import_node_path33.default.join(root, `${key}.lock`),
+    filePath: import_node_path35.default.join(root, `${key}.json`),
+    lockPath: import_node_path35.default.join(root, `${key}.lock`),
     writeAtomic: options.writeAtomic ?? writeFileAtomically
   };
 }
 function validateRoot(root) {
-  if (typeof root !== "string" || !import_node_path33.default.isAbsolute(root) || root.includes("\0")) {
+  if (typeof root !== "string" || !import_node_path35.default.isAbsolute(root) || root.includes("\0")) {
     throw claimError("invalid-input", "network claim root is invalid");
   }
-  const resolved = import_node_path33.default.resolve(root);
+  const resolved = import_node_path35.default.resolve(root);
   if (resolved !== root) throw claimError("invalid-input", "network claim root is invalid");
   return resolved;
 }
@@ -11315,20 +11863,20 @@ function isErrno2(error, code) {
 function claimError(code, message) {
   return new NetworkClaimError(code, message);
 }
-var import_node_crypto13, import_node_fs25, import_node_path33, NETWORK_CLAIMS_VERSION, NETWORK_CLAIMS_ROOT, NETWORK_CLAIMS_MAX_RECORDS, NETWORK_CLAIMS_MAX_FILE_BYTES, NetworkClaimError, CLAIM_CORE_KEYS, CLAIM_KEYS, FENCE_KEYS, DOCUMENT_KEYS, MAX_CLAIM_TEXT, MAX_ENDPOINT_TEXT;
+var import_node_crypto13, import_node_fs27, import_node_path35, NETWORK_CLAIMS_VERSION, NETWORK_CLAIMS_ROOT, NETWORK_CLAIMS_MAX_RECORDS, NETWORK_CLAIMS_MAX_FILE_BYTES, NetworkClaimError, CLAIM_CORE_KEYS, CLAIM_KEYS, FENCE_KEYS, DOCUMENT_KEYS, MAX_CLAIM_TEXT, MAX_ENDPOINT_TEXT;
 var init_network_claims = __esm({
   "src/core/network-claims.ts"() {
     "use strict";
     import_node_crypto13 = require("crypto");
-    import_node_fs25 = __toESM(require("fs"));
-    import_node_path33 = __toESM(require("path"));
+    import_node_fs27 = __toESM(require("fs"));
+    import_node_path35 = __toESM(require("path"));
     init_atomic_file();
     init_file_lock();
     init_network_capacity();
     init_network_policy();
     init_router();
     NETWORK_CLAIMS_VERSION = 1;
-    NETWORK_CLAIMS_ROOT = import_node_path33.default.join(DEVROUTER_HOME, "networks");
+    NETWORK_CLAIMS_ROOT = import_node_path35.default.join(DEVROUTER_HOME, "networks");
     NETWORK_CLAIMS_MAX_RECORDS = 256;
     NETWORK_CLAIMS_MAX_FILE_BYTES = 512 * 1024;
     NetworkClaimError = class extends Error {
@@ -11370,14 +11918,14 @@ var init_network_claims = __esm({
 
 // src/core/network-claim-lookup.ts
 function networkOwnerKey(repoPath) {
-  if (!import_node_path34.default.isAbsolute(repoPath) || import_node_path34.default.resolve(repoPath) !== repoPath)
+  if (!import_node_path36.default.isAbsolute(repoPath) || import_node_path36.default.resolve(repoPath) !== repoPath)
     throw new Error("Invalid network owner path.");
   return (0, import_node_crypto14.createHash)("sha256").update(repoPath).digest("hex");
 }
 function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   let names;
   try {
-    names = import_node_fs26.default.readdirSync(root);
+    names = import_node_fs28.default.readdirSync(root);
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw new Error("Network claims cannot be inspected; repair is required.");
@@ -11386,21 +11934,21 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   if (files.length > 128) throw new Error("Network daemon inventory exceeds its bound.");
   let found;
   for (const file of files) {
-    const full = import_node_path34.default.join(root, file);
-    const stat = import_node_fs26.default.lstatSync(full);
+    const full = import_node_path36.default.join(root, file);
+    const stat = import_node_fs28.default.lstatSync(full);
     if (!stat.isFile() || stat.size > NETWORK_CLAIMS_MAX_FILE_BYTES)
       throw new Error("Invalid retained network claim file.");
     let value;
-    const descriptor = import_node_fs26.default.openSync(
+    const descriptor = import_node_fs28.default.openSync(
       full,
-      import_node_fs26.default.constants.O_RDONLY | import_node_fs26.default.constants.O_NONBLOCK | import_node_fs26.default.constants.O_NOFOLLOW
+      import_node_fs28.default.constants.O_RDONLY | import_node_fs28.default.constants.O_NONBLOCK | import_node_fs28.default.constants.O_NOFOLLOW
     );
     try {
-      if (!import_node_fs26.default.fstatSync(descriptor).isFile()) throw new Error();
+      if (!import_node_fs28.default.fstatSync(descriptor).isFile()) throw new Error();
       const bytes2 = Buffer.alloc(NETWORK_CLAIMS_MAX_FILE_BYTES + 1);
       let size = 0;
       while (size < bytes2.length) {
-        const count = import_node_fs26.default.readSync(descriptor, bytes2, size, bytes2.length - size, null);
+        const count = import_node_fs28.default.readSync(descriptor, bytes2, size, bytes2.length - size, null);
         if (!count) break;
         size += count;
       }
@@ -11410,7 +11958,7 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
     } catch {
       throw new Error("Retained network claim could not be read safely.");
     } finally {
-      import_node_fs26.default.closeSync(descriptor);
+      import_node_fs28.default.closeSync(descriptor);
     }
     if (typeof value.daemonId !== "string" || `${(0, import_node_crypto14.createHash)("sha256").update(value.daemonId).digest("hex")}.json` !== file)
       throw new Error("Retained network daemon identity is invalid.");
@@ -11426,13 +11974,13 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   }
   return found;
 }
-var import_node_crypto14, import_node_fs26, import_node_path34;
+var import_node_crypto14, import_node_fs28, import_node_path36;
 var init_network_claim_lookup = __esm({
   "src/core/network-claim-lookup.ts"() {
     "use strict";
     import_node_crypto14 = require("crypto");
-    import_node_fs26 = __toESM(require("fs"));
-    import_node_path34 = __toESM(require("path"));
+    import_node_fs28 = __toESM(require("fs"));
+    import_node_path36 = __toESM(require("path"));
     init_network_claims();
   }
 });
@@ -11460,7 +12008,7 @@ function qualifyNetworkProviderDefinition(value, provider) {
   return (0, import_node_crypto15.createHash)("sha256").update(JSON.stringify({ name: definition.name, agent, options, exec })).digest("hex");
 }
 function read(provider, args) {
-  const result = (0, import_node_child_process15.spawnSync)(provider, args, {
+  const result = (0, import_node_child_process16.spawnSync)(provider, args, {
     encoding: "utf8",
     timeout: 5e3,
     maxBuffer: 2 * 1024 * 1024
@@ -11548,11 +12096,11 @@ function inspectNetworkProviderBinding(input2) {
     );
   }
 }
-var import_node_child_process15, import_node_crypto15;
+var import_node_child_process16, import_node_crypto15;
 var init_network_provider_inspect = __esm({
   "src/core/network-provider-inspect.ts"() {
     "use strict";
-    import_node_child_process15 = require("child_process");
+    import_node_child_process16 = require("child_process");
     import_node_crypto15 = require("crypto");
     init_devpod_environment();
   }
@@ -11591,7 +12139,7 @@ var init_network_provider_effect = __esm({
 
 // src/core/devsy-mutation.ts
 function withMutationLock(activity, target, operation) {
-  import_node_fs27.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs29.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVSY_MUTATION_LOCK_FILE,
     {
@@ -11611,7 +12159,7 @@ function runDevsyAction(action2, devsyId, force = false, repoPath) {
   const args = action2 === "delete" ? ["delete", devsyId, ...force ? ["--force"] : [], "--ignore-not-found"] : ["stop", devsyId];
   claimLifecycleEffect();
   const binding = repoPath ? networkProviderEffectOptions("devsy", devsyId, repoPath) : { args: [] };
-  const result = (0, import_node_child_process16.spawnSync)("devsy", ["workspace", ...args, ...binding.args], {
+  const result = (0, import_node_child_process17.spawnSync)("devsy", ["workspace", ...args, ...binding.args], {
     encoding: "utf-8",
     ...binding.env ? { env: binding.env } : {}
   });
@@ -11672,13 +12220,13 @@ function stopOwnedDevsyWorkspace(devsyId, worktreePath) {
 function deleteOwnedDevsyWorkspace(devsyId, worktreePath) {
   return mutateOwnedDevsyWorkspace("delete", devsyId, worktreePath);
 }
-var import_node_child_process16, import_node_fs27, import_node_path35, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS;
+var import_node_child_process17, import_node_fs29, import_node_path37, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS;
 var init_devsy_mutation = __esm({
   "src/core/devsy-mutation.ts"() {
     "use strict";
-    import_node_child_process16 = require("child_process");
-    import_node_fs27 = __toESM(require("fs"));
-    import_node_path35 = __toESM(require("path"));
+    import_node_child_process17 = require("child_process");
+    import_node_fs29 = __toESM(require("fs"));
+    import_node_path37 = __toESM(require("path"));
     init_devsy_agent();
     init_devsy_workspaces();
     init_file_lock();
@@ -11687,7 +12235,7 @@ var init_devsy_mutation = __esm({
     init_network_provider_effect();
     init_reliability_context();
     init_router();
-    DEVSY_MUTATION_LOCK_FILE = import_node_path35.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
+    DEVSY_MUTATION_LOCK_FILE = import_node_path37.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
     DEVSY_MUTATION_WAIT_MS = 18e5;
   }
 });
@@ -12459,10 +13007,10 @@ async function runLifecycleWorker(request2, supervision, beforeAdmission) {
     throw new Error("Lifecycle invocation was cancelled before dispatch.");
   if (process.platform === "win32")
     throw new Error("Lifecycle workers require POSIX process-group ownership.");
-  const workerPath = import_node_path36.default.join(__dirname, "devrouter-lifecycle-worker.js");
-  if (!import_node_fs28.default.existsSync(workerPath))
+  const workerPath = import_node_path38.default.join(__dirname, "devrouter-lifecycle-worker.js");
+  if (!import_node_fs30.default.existsSync(workerPath))
     throw new Error("The packaged lifecycle worker is missing; rebuild the CLI.");
-  const child = (0, import_node_child_process17.fork)(workerPath, [], {
+  const child = (0, import_node_child_process18.fork)(workerPath, [], {
     detached: true,
     stdio: supervision ? ["ignore", "pipe", "pipe", "ipc"] : ["inherit", "inherit", "inherit", "ipc"],
     execArgv: []
@@ -12689,14 +13237,14 @@ async function runLifecycleWorker(request2, supervision, beforeAdmission) {
 function newLifecycleIds() {
   return { requestId: (0, import_node_crypto16.randomUUID)(), operationId: (0, import_node_crypto16.randomUUID)(), workerId: (0, import_node_crypto16.randomUUID)() };
 }
-var import_node_child_process17, import_node_crypto16, import_node_fs28, import_node_path36, OUTPUT_BUFFER_LIMIT, DEFAULT_OUTPUT_PAGE_BYTES, LifecycleOutput, LifecycleWorkerAdmissionBusyError;
+var import_node_child_process18, import_node_crypto16, import_node_fs30, import_node_path38, OUTPUT_BUFFER_LIMIT, DEFAULT_OUTPUT_PAGE_BYTES, LifecycleOutput, LifecycleWorkerAdmissionBusyError;
 var init_reliability_worker = __esm({
   "src/core/reliability-worker.ts"() {
     "use strict";
-    import_node_child_process17 = require("child_process");
-    import_node_crypto16 = require("crypto");
-    import_node_fs28 = __toESM(require("fs"));
-    import_node_path36 = __toESM(require("path"));
+    import_node_child_process18 = require("child_process");
+    import_node_crypto16 = require("crypto");
+    import_node_fs30 = __toESM(require("fs"));
+    import_node_path38 = __toESM(require("path"));
     init_file_lock();
     init_reliability_contract();
     init_reliability_model();
@@ -12811,173 +13359,9 @@ var init_reliability_worker = __esm({
   }
 });
 
-// src/core/traefik-route-health.ts
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function inspectRouterApi(protocol) {
-  const result = (0, import_node_child_process18.spawnSync)(
-    "curl",
-    [
-      "--silent",
-      "--show-error",
-      "--fail",
-      "--max-time",
-      ROUTER_API_REQUEST_TIMEOUT_SECONDS,
-      `${ROUTER_API_BASE}/${protocol}/routers?per_page=${ROUTER_API_PAGE_SIZE}`
-    ],
-    { encoding: "utf-8" }
-  );
-  if (result.status !== 0) {
-    return {
-      ok: false,
-      details: result.stderr?.trim() || `curl exited with status ${result.status ?? "unknown"}`
-    };
-  }
-  let value;
-  try {
-    value = JSON.parse(result.stdout);
-  } catch {
-    return { ok: false, details: `${protocol.toUpperCase()} router API returned invalid JSON` };
-  }
-  if (!Array.isArray(value)) {
-    return { ok: false, details: `${protocol.toUpperCase()} router API returned a non-array` };
-  }
-  if (value.some((item) => !isRecord5(item) || typeof item.name !== "string" || !item.name))
-    return {
-      ok: false,
-      details: `${protocol.toUpperCase()} router API returned malformed entries`
-    };
-  return {
-    ok: true,
-    reachedPageLimit: value.length >= ROUTER_API_PAGE_SIZE,
-    names: new Set(
-      value.flatMap((item) => {
-        if (!item || typeof item !== "object") return [];
-        const name = item.name;
-        return typeof name === "string" ? [name] : [];
-      })
-    )
-  };
-}
-function isRecord5(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function inspectExpectedRoutes(routes, expectation) {
-  const mismatched = [];
-  const failures = [];
-  for (const protocol of ["http", "tcp"]) {
-    const expected = routes.filter((route) => (route.protocol ?? "http") === protocol).map((route) => buildHostRouteRouterName(route.repoPath, route.name));
-    if (expected.length === 0) continue;
-    const result = inspectRouterApi(protocol);
-    if (!result.ok) {
-      failures.push(result.details);
-      mismatched.push(...expected);
-      continue;
-    }
-    const unexpected = expected.filter(
-      (name) => expectation === "loaded" ? !result.names.has(name) : result.names.has(name)
-    );
-    const boundedAbsenceIsUncertain = result.reachedPageLimit && (expectation === "loaded" ? unexpected.length > 0 : unexpected.length === 0);
-    if (boundedAbsenceIsUncertain) {
-      failures.push(
-        `${protocol.toUpperCase()} router API reached the ${ROUTER_API_PAGE_SIZE}-entry safety limit`
-      );
-    }
-    mismatched.push(...unexpected);
-    if (expectation === "removed" && unexpected.length === 0 && result.reachedPageLimit) {
-      mismatched.push(...expected);
-    }
-  }
-  return mismatched.length === 0 ? { ok: true } : {
-    ok: false,
-    routes: mismatched,
-    details: failures.length > 0 ? failures.join("; ") : expectation === "loaded" ? "router names are absent" : "router names are still present"
-  };
-}
-async function waitForExpectedRoutes(routes, expectation, timeoutMs, pollIntervalMs) {
-  const deadline = Date.now() + timeoutMs;
-  let result;
-  do {
-    result = inspectExpectedRoutes(routes, expectation);
-    if (result.ok) return result;
-    if (Date.now() < deadline) {
-      await sleep(Math.min(pollIntervalMs, Math.max(1, deadline - Date.now())));
-    }
-  } while (Date.now() < deadline);
-  return result;
-}
-async function ensureTraefikRouteExpectation(routes, expectation, options) {
-  if (routes.length === 0) return { restarted: false };
-  const initialTimeoutMs = options.initialTimeoutMs ?? DEFAULT_INITIAL_TIMEOUT_MS;
-  const recoveryTimeoutMs = options.recoveryTimeoutMs ?? DEFAULT_RECOVERY_TIMEOUT_MS;
-  const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-  const initial = await waitForExpectedRoutes(
-    routes,
-    expectation,
-    initialTimeoutMs,
-    pollIntervalMs
-  );
-  if (initial.ok) return { restarted: false };
-  if (options.allowRestart === false)
-    throw new Error(
-      "Traefik routes did not reload; shared router restart is disabled for this operation."
-    );
-  import_node_fs29.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
-  return withFileLock(
-    ROUTER_RELOAD_LOCK_FILE,
-    {
-      activity: "Traefik route reload recovery",
-      waitMs: initialTimeoutMs + recoveryTimeoutMs + 1e4,
-      fair: true,
-      onWait: createStderrWaitReporter("Traefik route reload recovery", "shared router")
-    },
-    async () => {
-      const recheck = await waitForExpectedRoutes(routes, expectation, 0, pollIntervalMs);
-      if (recheck.ok) return { restarted: false };
-      claimLifecycleEffect();
-      restartRouterStack();
-      const recovered = await waitForExpectedRoutes(
-        routes,
-        expectation,
-        recoveryTimeoutMs,
-        pollIntervalMs
-      );
-      if (recovered.ok) return { restarted: true };
-      const action2 = expectation === "loaded" ? "load" : "remove";
-      throw new Error(
-        `Traefik did not ${action2} file-provider routes after one restart: ${recovered.routes.join(", ")} (${recovered.details}). Inspect: devrouter logs --tail 100`
-      );
-    }
-  );
-}
-async function ensureTraefikRoutesRemoved(routes, options = {}) {
-  return ensureTraefikRouteExpectation(routes, "removed", options);
-}
-var import_node_child_process18, import_node_fs29, import_node_path37, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, ROUTER_API_REQUEST_TIMEOUT_SECONDS, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, ROUTER_API_PAGE_SIZE;
-var init_traefik_route_health = __esm({
-  "src/core/traefik-route-health.ts"() {
-    "use strict";
-    import_node_child_process18 = require("child_process");
-    import_node_fs29 = __toESM(require("fs"));
-    import_node_path37 = __toESM(require("path"));
-    init_file_lock();
-    init_host_routes();
-    init_reliability_context();
-    init_router();
-    ROUTER_API_BASE = "http://127.0.0.1:8080/api";
-    ROUTER_RELOAD_LOCK_FILE = import_node_path37.default.join(DEVROUTER_HOME, "router-reload.lock");
-    ROUTER_API_REQUEST_TIMEOUT_SECONDS = "2";
-    DEFAULT_INITIAL_TIMEOUT_MS = 3e3;
-    DEFAULT_RECOVERY_TIMEOUT_MS = 1e4;
-    DEFAULT_POLL_INTERVAL_MS = 250;
-    ROUTER_API_PAGE_SIZE = 1e3;
-  }
-});
-
 // src/core/devpod-mutation.ts
 function withMutationLock2(activity, target, operation) {
-  import_node_fs30.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs31.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
     {
@@ -13067,13 +13451,13 @@ function deleteOwnedDevpodWorkspace(devpodId, worktreePath) {
   resetWorkspaceRuntimeCaches();
   return result;
 }
-var import_node_child_process19, import_node_fs30, import_node_path38, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS;
+var import_node_child_process19, import_node_fs31, import_node_path39, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS;
 var init_devpod_mutation = __esm({
   "src/core/devpod-mutation.ts"() {
     "use strict";
     import_node_child_process19 = require("child_process");
-    import_node_fs30 = __toESM(require("fs"));
-    import_node_path38 = __toESM(require("path"));
+    import_node_fs31 = __toESM(require("fs"));
+    import_node_path39 = __toESM(require("path"));
     init_devpod_workspaces();
     init_devsy_mutation();
     init_file_lock();
@@ -13082,7 +13466,7 @@ var init_devpod_mutation = __esm({
     init_reliability_context();
     init_router();
     init_workspace_runtime();
-    DEVPOD_MUTATION_LOCK_FILE = import_node_path38.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+    DEVPOD_MUTATION_LOCK_FILE = import_node_path39.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
     DEVPOD_MUTATION_WAIT_MS = 18e5;
   }
 });
@@ -13288,8 +13672,8 @@ function renderManagedComposeModel(plan, workspace) {
   }
 }
 function attributeHolderWorktree(workingDir) {
-  if (import_node_path39.default.basename(workingDir) !== ".devcontainer") return void 0;
-  return comparableWorkspacePath(import_node_path39.default.dirname(workingDir));
+  if (import_node_path40.default.basename(workingDir) !== ".devcontainer") return void 0;
+  return comparableWorkspacePath(import_node_path40.default.dirname(workingDir));
 }
 function holderAttribution(holder, repoPath) {
   const attribution = {};
@@ -13321,7 +13705,7 @@ function detectHostPortClaimConflicts(options) {
   );
   if (desired.length === 0) return [];
   const holders = listHolderSnapshots();
-  const devcontainerDir = import_node_path39.default.join(options.repoPath, ".devcontainer");
+  const devcontainerDir = import_node_path40.default.join(options.repoPath, ".devcontainer");
   const conflicts = [];
   for (const binding of desired) {
     for (const holder of holders) {
@@ -13343,12 +13727,12 @@ function detectHostPortClaimConflicts(options) {
   }
   return conflicts;
 }
-var import_node_child_process20, import_node_path39, COMPOSE_RENDER_TIMEOUT_MS, COMPOSE_RENDER_MAX_BUFFER, DOCKER_TIMEOUT_MS, DOCKER_MAX_BUFFER, MAX_DESIRED_HOST_PORTS, MAX_RUNNING_HOLDERS, HOST_PORT_INSPECT_TEMPLATE;
+var import_node_child_process20, import_node_path40, COMPOSE_RENDER_TIMEOUT_MS, COMPOSE_RENDER_MAX_BUFFER, DOCKER_TIMEOUT_MS, DOCKER_MAX_BUFFER, MAX_DESIRED_HOST_PORTS, MAX_RUNNING_HOLDERS, HOST_PORT_INSPECT_TEMPLATE;
 var init_host_port_claims = __esm({
   "src/core/host-port-claims.ts"() {
     "use strict";
     import_node_child_process20 = require("child_process");
-    import_node_path39 = __toESM(require("path"));
+    import_node_path40 = __toESM(require("path"));
     init_devcontainer_profile();
     init_network_effect_scope();
     init_workspace();
@@ -13522,20 +13906,20 @@ var init_http_route_probe = __esm({
 });
 
 // src/core/managed-host-preparation.ts
-var import_node_child_process22, import_node_fs31;
+var import_node_child_process22, import_node_fs32;
 var init_managed_host_preparation = __esm({
   "src/core/managed-host-preparation.ts"() {
     "use strict";
     import_node_child_process22 = require("child_process");
-    import_node_fs31 = __toESM(require("fs"));
+    import_node_fs32 = __toESM(require("fs"));
     init_repo_config();
   }
 });
 
 // src/core/managed-post-start.ts
 function readRegularFileBytes(filePath) {
-  if (!import_node_fs32.default.existsSync(filePath) || !import_node_fs32.default.lstatSync(filePath).isFile()) return void 0;
-  return import_node_fs32.default.readFileSync(filePath);
+  if (!import_node_fs33.default.existsSync(filePath) || !import_node_fs33.default.lstatSync(filePath).isFile()) return void 0;
+  return import_node_fs33.default.readFileSync(filePath);
 }
 function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
@@ -13544,11 +13928,11 @@ function adapterFingerprint(adapter) {
   return (0, import_node_crypto17.createHash)("sha256").update(adapter).digest("hex");
 }
 function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path40.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterPath = import_node_path41.default.join(repoPath, MANAGED_ADAPTER_PATH);
   const adapterBytes = readRegularFileBytes(adapterPath);
   const adapterText = adapterBytes?.toString("utf-8");
-  const dockerfilePath = import_node_path40.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path40.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfilePath = import_node_path41.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path41.default.join(repoPath, ".devcontainer", "devcontainer.json");
   const dockerfile = readRegularFile(dockerfilePath) ?? "";
   const devcontainer = readRegularFile(devcontainerPath) ?? "";
   const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
@@ -13631,14 +14015,14 @@ function runManagedProcessAction(options) {
   }
   return "drifted";
 }
-var import_node_child_process23, import_node_crypto17, import_node_fs32, import_node_path40, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH;
+var import_node_child_process23, import_node_crypto17, import_node_fs33, import_node_path41, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH;
 var init_managed_post_start = __esm({
   "src/core/managed-post-start.ts"() {
     "use strict";
     import_node_child_process23 = require("child_process");
     import_node_crypto17 = require("crypto");
-    import_node_fs32 = __toESM(require("fs"));
-    import_node_path40 = __toESM(require("path"));
+    import_node_fs33 = __toESM(require("fs"));
+    import_node_path41 = __toESM(require("path"));
     init_devcontainer_config();
     init_network_effect_scope();
     MANAGED_MARKER = "devrouter:managed devcontainer";
@@ -14577,26 +14961,26 @@ function hasLocalDockerNetworkNamespace(endpoint, procRoot = "/proc") {
   try {
     if (!endpoint.startsWith("unix:///")) return false;
     const socket = endpoint.slice("unix://".length);
-    const table = import_node_fs33.default.readFileSync(import_node_path41.default.join(procRoot, "net/unix"), "utf8");
+    const table = import_node_fs34.default.readFileSync(import_node_path42.default.join(procRoot, "net/unix"), "utf8");
     if (Buffer.byteLength(table) > 1024 * 1024) return false;
     const rows2 = table.split("\n").map((line) => line.trim().split(/\s+/)).filter((row) => row[7] === socket && row[3] === "00010000");
     if (rows2.length !== 1 || !/^\d+$/.test(rows2[0][6])) return false;
     const inode = `socket:[${rows2[0][6]}]`;
-    const ownNamespace = import_node_fs33.default.readlinkSync(import_node_path41.default.join(procRoot, "self/ns/net"));
-    const pids = import_node_fs33.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
+    const ownNamespace = import_node_fs34.default.readlinkSync(import_node_path42.default.join(procRoot, "self/ns/net"));
+    const pids = import_node_fs34.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
     if (pids.length > 4096) return false;
     for (const pid of pids) {
       if (Date.now() > deadline) return false;
       try {
-        const root = import_node_path41.default.join(procRoot, pid);
-        if (import_node_path41.default.basename(import_node_fs33.default.readlinkSync(import_node_path41.default.join(root, "exe"))) !== "dockerd") continue;
-        if (import_node_fs33.default.readlinkSync(import_node_path41.default.join(root, "ns/net")) !== ownNamespace) continue;
-        const descriptors = import_node_fs33.default.readdirSync(import_node_path41.default.join(root, "fd"));
+        const root = import_node_path42.default.join(procRoot, pid);
+        if (import_node_path42.default.basename(import_node_fs34.default.readlinkSync(import_node_path42.default.join(root, "exe"))) !== "dockerd") continue;
+        if (import_node_fs34.default.readlinkSync(import_node_path42.default.join(root, "ns/net")) !== ownNamespace) continue;
+        const descriptors = import_node_fs34.default.readdirSync(import_node_path42.default.join(root, "fd"));
         if (descriptors.length > 4096) continue;
         if (descriptors.some((fd) => {
           if (Date.now() > deadline) return false;
           try {
-            return import_node_fs33.default.readlinkSync(import_node_path41.default.join(root, "fd", fd)) === inode;
+            return import_node_fs34.default.readlinkSync(import_node_path42.default.join(root, "fd", fd)) === inode;
           } catch {
             return false;
           }
@@ -14610,12 +14994,12 @@ function hasLocalDockerNetworkNamespace(endpoint, procRoot = "/proc") {
   }
   return false;
 }
-var import_node_fs33, import_node_path41;
+var import_node_fs34, import_node_path42;
 var init_network_local_daemon = __esm({
   "src/core/network-local-daemon.ts"() {
     "use strict";
-    import_node_fs33 = __toESM(require("fs"));
-    import_node_path41 = __toESM(require("path"));
+    import_node_fs34 = __toESM(require("fs"));
+    import_node_path42 = __toESM(require("path"));
   }
 });
 
@@ -14731,14 +15115,14 @@ var init_network_compose = __esm({
 });
 
 // src/core/network-compose-files.ts
-var import_node_child_process26, import_node_crypto19, import_node_fs34, import_node_path42, import_yaml4, MAX_BYTES3;
+var import_node_child_process26, import_node_crypto19, import_node_fs35, import_node_path43, import_yaml4, MAX_BYTES3;
 var init_network_compose_files = __esm({
   "src/core/network-compose-files.ts"() {
     "use strict";
     import_node_child_process26 = require("child_process");
     import_node_crypto19 = require("crypto");
-    import_node_fs34 = __toESM(require("fs"));
-    import_node_path42 = __toESM(require("path"));
+    import_node_fs35 = __toESM(require("fs"));
+    import_node_path43 = __toESM(require("path"));
     import_yaml4 = __toESM(require("yaml"));
     init_atomic_file();
     init_devcontainer_profile();
@@ -14842,13 +15226,13 @@ function resolveLinkedTarget(repoPath) {
     gitCommonDir: resolveGitCommonDir(repoPath)
   };
 }
-var import_node_child_process28, import_node_fs35, import_node_path43;
+var import_node_child_process28, import_node_fs36, import_node_path44;
 var init_workspace_ensure = __esm({
   "src/core/workspace-ensure.ts"() {
     "use strict";
     import_node_child_process28 = require("child_process");
-    import_node_fs35 = __toESM(require("fs"));
-    import_node_path43 = __toESM(require("path"));
+    import_node_fs36 = __toESM(require("fs"));
+    import_node_path44 = __toESM(require("path"));
     init_devcontainer_profile();
     init_devpod_environment();
     init_devpod_mutation();
@@ -14984,7 +15368,7 @@ function prepareManagedLifecycleOperation(input2) {
     };
   });
 }
-function assertCurrentCapacityController(expected, directory = import_node_path44.default.join(DEVROUTER_HOME, "controller")) {
+function assertCurrentCapacityController(expected, directory = import_node_path45.default.join(DEVROUTER_HOME, "controller")) {
   const current = new ControllerStore(directory).read();
   if (!expected || current?.store !== expected.store || current.epoch !== expected.epoch)
     throw new Error("Capacity controller incarnation changed.");
@@ -15036,7 +15420,7 @@ function prepareRecoveryLifecycleOperation(input2) {
   });
 }
 function settlePreparedLifecycleCapacity(input2) {
-  const directory = input2.directory ?? import_node_path44.default.join(DEVROUTER_HOME, "controller");
+  const directory = input2.directory ?? import_node_path45.default.join(DEVROUTER_HOME, "controller");
   const store = new CapacityStore(directory);
   for (let attempt = 0; attempt < 3; attempt++) {
     const snapshot = store.read();
@@ -15250,7 +15634,7 @@ async function superviseLifecycle(kind, repoPath, options = {}, command) {
     removeSignals();
   }
 }
-function admitLifecycleCapacity(request2, reservation, budgets, samples, nowMs, maxSampleAgeMs, directory = import_node_path44.default.join(DEVROUTER_HOME, "controller"), controller, admission) {
+function admitLifecycleCapacity(request2, reservation, budgets, samples, nowMs, maxSampleAgeMs, directory = import_node_path45.default.join(DEVROUTER_HOME, "controller"), controller, admission) {
   if (request2.kind === "stop") throw new Error("Stop never requires capacity admission.");
   const capacity = new CapacityStore(directory);
   const snapshot = capacity.read();
@@ -15350,7 +15734,7 @@ function admitLifecycleCapacity(request2, reservation, budgets, samples, nowMs,
   return decision;
 }
 function capacityPolicyTargets(repoPath) {
-  const policy = readCapacityPolicy(import_node_path44.default.join(DEVROUTER_HOME, "controller"));
+  const policy = readCapacityPolicy(import_node_path45.default.join(DEVROUTER_HOME, "controller"));
   return policy?.admissions === "enabled" && policy.enrollments.some((entry) => entry.repoPath === repoPath);
 }
 function controllerWaitSeconds(deadline) {
@@ -15359,7 +15743,7 @@ function controllerWaitSeconds(deadline) {
 async function superviseThroughController(input2) {
   if (input2.kind === "exec" && !input2.command)
     throw new Error("Exec requires a command for controller admission.");
-  const directory = import_node_path44.default.join(DEVROUTER_HOME, "controller");
+  const directory = import_node_path45.default.join(DEVROUTER_HOME, "controller");
   const cancellation = { requested: false };
   const removeSignals = installLifecycleWaitSignals(cancellation);
   const cancelled = () => {
@@ -15431,7 +15815,7 @@ async function superviseThroughController(input2) {
     removeSignals();
   }
 }
-function renewLifecycleCapacity(request2, policy, samples, controller, directory = import_node_path44.default.join(DEVROUTER_HOME, "controller"), nowMs = Date.now()) {
+function renewLifecycleCapacity(request2, policy, samples, controller, directory = import_node_path45.default.join(DEVROUTER_HOME, "controller"), nowMs = Date.now()) {
   return updateReliabilityOperation(request2.identity, (record5) => {
     const binding = record5.capacity;
     if (!matchesFence(record5, request2.fence) || !binding || binding.operationId !== request2.operationId || binding.workerId !== request2.workerId || binding.controller?.store !== controller.store || binding.controller?.epoch !== controller.epoch)
@@ -15519,7 +15903,7 @@ function retireQueuedLifecycle(request2, supersededOnly = false) {
     return true;
   });
 }
-function bindLifecycleCapacity(request2, binding, directory = import_node_path44.default.join(DEVROUTER_HOME, "controller")) {
+function bindLifecycleCapacity(request2, binding, directory = import_node_path45.default.join(DEVROUTER_HOME, "controller")) {
   if (request2.kind === "stop") throw new Error("Stop never requires capacity admission.");
   updateReliabilityOperation(request2.identity, (record5) => {
     if (!matchesFence(record5, request2.fence) || record5.worker || record5.state.operation?.id !== request2.operationId || record5.state.operation.status !== "NOT_STARTED" || record5.state.operation.drained)
@@ -15534,12 +15918,12 @@ function bindLifecycleCapacity(request2, binding, directory = import_node_path44
       stepRecord(record5, { ...request2.fence, type: "admission", result: "admitted" });
   });
 }
-var import_node_crypto21, import_node_path44, import_node_util10, activeWorker, lockHeld, BUSY_LIFECYCLE_WAIT_MS, BUSY_LIFECYCLE_POLL_MS, CAPACITY_CLIENT_WAIT_MS, BUSY_LIFECYCLE_PROGRESS_MS;
+var import_node_crypto21, import_node_path45, import_node_util10, activeWorker, lockHeld, BUSY_LIFECYCLE_WAIT_MS, BUSY_LIFECYCLE_POLL_MS, CAPACITY_CLIENT_WAIT_MS, BUSY_LIFECYCLE_PROGRESS_MS;
 var init_reliability_lifecycle = __esm({
   "src/core/reliability-lifecycle.ts"() {
     "use strict";
     import_node_crypto21 = require("crypto");
-    import_node_path44 = __toESM(require("path"));
+    import_node_path45 = __toESM(require("path"));
     import_node_util10 = require("util");
     init_capacity_accounting();
     init_capacity_policy();
@@ -15552,6 +15936,7 @@ var init_reliability_lifecycle = __esm({
     init_devsy_mutation();
     init_file_lock();
     init_host_routes();
+    init_managed_devsy_stop();
     init_managed_runtime_state();
     init_managed_stop_recovery();
     init_reliability_context();
@@ -16031,7 +16416,7 @@ function createCapacityController(options) {
         const record5 = readReliabilityOperation(identity2);
         if (!record5?.capacity || !record5.preparation && !record5.capacity.execSteady || record5.worker || !record5.state.operation?.drained || !["ensure", "exec"].includes(record5.state.operation.kind))
           continue;
-        const bytes2 = readControllerEvidence(import_node_path45.default.join(enrollment.repoPath, ".devrouter.yml"));
+        const bytes2 = readControllerEvidence(import_node_path46.default.join(enrollment.repoPath, ".devrouter.yml"));
         const estimates = loadRepoConfig(enrollment.repoPath, () => bytes2).capacity;
         if (!estimates) continue;
         settlePreparedLifecycleCapacity({
@@ -16272,12 +16657,12 @@ function createCapacityController(options) {
     }
   };
 }
-var import_node_crypto22, import_node_path45, import_node_util12;
+var import_node_crypto22, import_node_path46, import_node_util12;
 var init_capacity_controller = __esm({
   "src/core/capacity-controller.ts"() {
     "use strict";
     import_node_crypto22 = require("crypto");
-    import_node_path45 = __toESM(require("path"));
+    import_node_path46 = __toESM(require("path"));
     import_node_util12 = require("util");
     init_capacity_docker_probe();
     init_capacity_enrollment();
@@ -16637,12 +17022,12 @@ async function containers(project, signal) {
   }
   return values.sort((a, b) => a.id.localeCompare(b.id));
 }
-var import_node_crypto24, import_node_path46, OBSERVATION_INSPECT_TEMPLATE, collectControllerObservation;
+var import_node_crypto24, import_node_path47, OBSERVATION_INSPECT_TEMPLATE, collectControllerObservation;
 var init_controller_observation = __esm({
   "src/core/controller-observation.ts"() {
     "use strict";
     import_node_crypto24 = require("crypto");
-    import_node_path46 = __toESM(require("path"));
+    import_node_path47 = __toESM(require("path"));
     init_controller_binding();
     init_controller_monitor();
     init_controller_probe();
@@ -16685,14 +17070,14 @@ var init_controller_observation = __esm({
       )).trim().split("\n");
       if (metadata.length !== 2) throw new Error("Observation ownership paths unavailable.");
       const [gitDir, commonDir] = metadata;
-      const sourcePath = import_node_path46.default.join(environment.repoPath, ".devcontainer/devcontainer.json");
+      const sourcePath = import_node_path47.default.join(environment.repoPath, ".devcontainer/devcontainer.json");
       const files = [
-        import_node_path46.default.join(commonDir, "devrouter/workspaces", `${environment.workspace}.json`),
-        import_node_path46.default.join(environment.repoPath, ".devrouter.yml"),
-        import_node_path46.default.join(gitDir, "devrouter-workspace"),
+        import_node_path47.default.join(commonDir, "devrouter/workspaces", `${environment.workspace}.json`),
+        import_node_path47.default.join(environment.repoPath, ".devrouter.yml"),
+        import_node_path47.default.join(gitDir, "devrouter-workspace"),
         managedRuntimeStatePath(environment.repoPath, environment.workspace),
         sourcePath,
-        import_node_path46.default.join(environment.repoPath, MANAGED_DEVCONTAINER_PATH)
+        import_node_path47.default.join(environment.repoPath, MANAGED_DEVCONTAINER_PATH)
       ];
       const persisted = captureControllerEvidence(files);
       if (controllerBindingFingerprint(persisted.contents[0], persisted.contents[1]) !== environment.fingerprint)
@@ -16717,7 +17102,7 @@ var init_controller_observation = __esm({
       if (!journal) throw new Error("Observation journal is unavailable.");
       const routes = readRoutes().filter((route) => route.repoPath === environment.repoPath);
       const before = await containers(state.composeProject, signal);
-      const composeDirectory = import_node_path46.default.join(environment.repoPath, ".devcontainer");
+      const composeDirectory = import_node_path47.default.join(environment.repoPath, ".devcontainer");
       const references = typeof source.dockerComposeFile === "string" ? [source.dockerComposeFile] : source.dockerComposeFile;
       if (!Array.isArray(references) || !references.length || references.some((value) => typeof value !== "string"))
         throw new Error("Observation Compose source is unavailable.");
@@ -16734,7 +17119,7 @@ var init_controller_observation = __esm({
         if (!recorded || container.labels["com.docker.compose.project.working_dir"] !== composeDirectory)
           throw new Error("Observation Compose ownership is unavailable.");
         const files2 = recorded.split(",").map((file) => file.trim());
-        if (files2.some((file) => !import_node_path46.default.isAbsolute(file)) || !hasExactComposeIdentity(container, {
+        if (files2.some((file) => !import_node_path47.default.isAbsolute(file)) || !hasExactComposeIdentity(container, {
           repoPath: environment.repoPath,
           service: container.labels["com.docker.compose.service"] ?? "",
           composeProject: state.composeProject,
@@ -17099,26 +17484,26 @@ var init_controller_sessions = __esm({
 
 // src/core/controller-server.ts
 function privateDirectory(directory) {
-  const absolute2 = import_node_path47.default.resolve(directory);
-  let current = import_node_path47.default.parse(absolute2).root;
-  for (const part of absolute2.slice(current.length).split(import_node_path47.default.sep)) {
-    current = import_node_path47.default.join(current, part);
+  const absolute2 = import_node_path48.default.resolve(directory);
+  let current = import_node_path48.default.parse(absolute2).root;
+  for (const part of absolute2.slice(current.length).split(import_node_path48.default.sep)) {
+    current = import_node_path48.default.join(current, part);
     try {
-      const stat2 = import_node_fs36.default.lstatSync(current);
+      const stat2 = import_node_fs37.default.lstatSync(current);
       if (!stat2.isDirectory() || stat2.isSymbolicLink())
         throw new Error("Unsafe controller directory.");
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
-      import_node_fs36.default.mkdirSync(current, { mode: 448 });
+      import_node_fs37.default.mkdirSync(current, { mode: 448 });
     }
   }
-  const stat = import_node_fs36.default.lstatSync(absolute2);
+  const stat = import_node_fs37.default.lstatSync(absolute2);
   if (stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0)
     throw new Error("Controller directory is not private.");
 }
 function validateOwnedFile(file, socket) {
   try {
-    const stat = import_node_fs36.default.lstatSync(file);
+    const stat = import_node_fs37.default.lstatSync(file);
     if (stat.uid !== process.getuid?.() || (socket ? !stat.isSocket() : !stat.isFile()) || (stat.mode & 63) !== 0)
       throw new Error("Unsafe controller artifact.");
     return true;
@@ -17130,19 +17515,19 @@ function validateOwnedFile(file, socket) {
 async function runController(options) {
   if (options.operations && options.createOperations)
     throw new Error("Controller operations have multiple owners.");
-  const socketPath = import_node_path47.default.join(options.directory, "control.sock");
+  const socketPath = import_node_path48.default.join(options.directory, "control.sock");
   if (Buffer.byteLength(socketPath) > 103) throw new Error("Controller socket path is too long.");
   privateDirectory(options.directory);
-  const lockPath = import_node_path47.default.join(options.directory, "owner.lock");
+  const lockPath = import_node_path48.default.join(options.directory, "owner.lock");
   try {
-    const stat = import_node_fs36.default.lstatSync(lockPath);
+    const stat = import_node_fs37.default.lstatSync(lockPath);
     if (!stat.isFile() || stat.uid !== process.getuid?.())
       throw new Error("Unsafe controller owner lock.");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
   await withFileLock(lockPath, { activity: "controller ownership", waitMs: 0 }, async () => {
-    if (validateOwnedFile(socketPath, true)) import_node_fs36.default.unlinkSync(socketPath);
+    if (validateOwnedFile(socketPath, true)) import_node_fs37.default.unlinkSync(socketPath);
     const sessions = new ControllerSessions(new ControllerStore(options.directory));
     const incarnation = sessions.read();
     let startupAvailable = true;
@@ -17531,7 +17916,7 @@ async function runController(options) {
           resolve();
         });
       });
-      import_node_fs36.default.chmodSync(socketPath, 384);
+      import_node_fs37.default.chmodSync(socketPath, 384);
       await new Promise((resolve) => {
         finish = resolve;
         options.signal.addEventListener("abort", shutdown, { once: true });
@@ -17550,13 +17935,13 @@ async function runController(options) {
     }
   });
 }
-var import_node_fs36, import_node_net4, import_node_path47, FRAME_BYTES;
+var import_node_fs37, import_node_net4, import_node_path48, FRAME_BYTES;
 var init_controller_server = __esm({
   "src/core/controller-server.ts"() {
     "use strict";
-    import_node_fs36 = __toESM(require("fs"));
+    import_node_fs37 = __toESM(require("fs"));
     import_node_net4 = __toESM(require("net"));
-    import_node_path47 = __toESM(require("path"));
+    import_node_path48 = __toESM(require("path"));
     init_controller_monitor();
     init_controller_protocol();
     init_controller_sessions();
@@ -17573,7 +17958,7 @@ __export(controller_exports, {
   runControllerCommand: () => runControllerCommand
 });
 async function runControllerCommand(method, options, repo, dependencies = {}) {
-  const directory = import_node_path48.default.join(DEVROUTER_HOME, "controller");
+  const directory = import_node_path49.default.join(DEVROUTER_HOME, "controller");
   try {
     if (method === "run") {
       const controller = new AbortController();
@@ -17608,7 +17993,7 @@ async function runControllerCommand(method, options, repo, dependencies = {}) {
     if (fields2.timeout !== void 0) fields2.timeout = Number(fields2.timeout);
     await controllerRequest(
       directory,
-      { method, ...fields2, ...repo ? { path: import_node_path48.default.resolve(repo) } : {} },
+      { method, ...fields2, ...repo ? { path: import_node_path49.default.resolve(repo) } : {} },
       (value) => process.stdout.write(`${JSON.stringify(value)}
 `)
     );
@@ -17623,11 +18008,11 @@ async function runControllerCommand(method, options, repo, dependencies = {}) {
     process.exitCode = 1;
   }
 }
-var import_node_path48;
+var import_node_path49;
 var init_controller = __esm({
   "src/commands/controller.ts"() {
     "use strict";
-    import_node_path48 = __toESM(require("path"));
+    import_node_path49 = __toESM(require("path"));
     init_capacity_collector();
     init_capacity_controller();
     init_capacity_policy();
@@ -17678,28 +18063,28 @@ function replaceDevrouterSection(content) {
   return `${content.slice(0, start)}${buildDevrouterSection()}${content.slice(end)}`;
 }
 function writeRepoFile(repoPath, relPath, content) {
-  const absolutePath = (0, import_node_path49.join)(repoPath, relPath);
-  (0, import_node_fs37.mkdirSync)((0, import_node_path49.dirname)(absolutePath), { recursive: true });
-  (0, import_node_fs37.writeFileSync)(absolutePath, content, "utf-8");
+  const absolutePath = (0, import_node_path50.join)(repoPath, relPath);
+  (0, import_node_fs38.mkdirSync)((0, import_node_path50.dirname)(absolutePath), { recursive: true });
+  (0, import_node_fs38.writeFileSync)(absolutePath, content, "utf-8");
   return absolutePath;
 }
 function ensureAgentsMdSection(repoPath) {
-  const filePath = (0, import_node_path49.join)(repoPath, AGENTS_MD);
-  if ((0, import_node_fs37.existsSync)(filePath)) {
-    const content = (0, import_node_fs37.readFileSync)(filePath, "utf-8");
+  const filePath = (0, import_node_path50.join)(repoPath, AGENTS_MD);
+  if ((0, import_node_fs38.existsSync)(filePath)) {
+    const content = (0, import_node_fs38.readFileSync)(filePath, "utf-8");
     if (content.includes(DEVROUTER_SENTINEL)) {
       const updated = replaceDevrouterSection(content);
       if (updated === void 0 || updated === content) return { path: filePath, written: false };
-      (0, import_node_fs37.writeFileSync)(filePath, updated, "utf-8");
+      (0, import_node_fs38.writeFileSync)(filePath, updated, "utf-8");
       return { path: filePath, written: true };
     }
-    (0, import_node_fs37.writeFileSync)(filePath, `${content.trimEnd()}
+    (0, import_node_fs38.writeFileSync)(filePath, `${content.trimEnd()}
 
 ${buildDevrouterSection()}
 `, "utf-8");
     return { path: filePath, written: true };
   }
-  (0, import_node_fs37.writeFileSync)(filePath, `# AGENTS.md
+  (0, import_node_fs38.writeFileSync)(filePath, `# AGENTS.md
 
 ${buildDevrouterSection()}
 `, "utf-8");
@@ -17709,12 +18094,12 @@ function ensureSkillFile(repoPath) {
   const filePath = writeRepoFile(repoPath, DEVROUTER_SKILL_REL_PATH, DEVROUTER_SKILL_CONTENT);
   return { path: filePath, written: true };
 }
-var import_node_fs37, import_node_path49, DEVROUTER_SENTINEL, DEVROUTER_END_SENTINEL, LEGACY_DEVROUTER_SECTION_END, AGENTS_MD, DEVROUTER_SKILL_REL_PATH, DEVROUTER_SKILL_CONTENT;
+var import_node_fs38, import_node_path50, DEVROUTER_SENTINEL, DEVROUTER_END_SENTINEL, LEGACY_DEVROUTER_SECTION_END, AGENTS_MD, DEVROUTER_SKILL_REL_PATH, DEVROUTER_SKILL_CONTENT;
 var init_agents_md = __esm({
   "src/core/agents-md.ts"() {
     "use strict";
-    import_node_fs37 = require("fs");
-    import_node_path49 = require("path");
+    import_node_fs38 = require("fs");
+    import_node_path50 = require("path");
     DEVROUTER_SENTINEL = "<!-- devrouter -->";
     DEVROUTER_END_SENTINEL = "<!-- /devrouter -->";
     LEGACY_DEVROUTER_SECTION_END = "- `devrouter ls`";
@@ -18439,7 +18824,7 @@ var init_ai_prompt = __esm({
       },
       {
         command: "devrouter stop [path] [--delete] [--json]",
-        purpose: "Stop the exact checkout workspace runtime and routes; --delete explicitly deletes the ownership-proven runtime without removing the checkout."
+        purpose: "Stop the exact checkout workspace runtime and routes, or prove absence after pre-registration failure; --delete explicitly deletes the ownership-proven runtime without removing the checkout."
       },
       {
         command: "devrouter exec [path] -- <command...>",
@@ -18993,11 +19378,11 @@ function extractCurrentVersionFromRepoConfig(repoPath) {
   };
 }
 function readPromptDirectory(promptDirPath) {
-  if (!import_node_fs38.default.existsSync(promptDirPath)) {
+  if (!import_node_fs39.default.existsSync(promptDirPath)) {
     throw new Error(`Missing ${UPGRADE_PROMPTS_DIR} directory at ${promptDirPath}.`);
   }
   const releases = [];
-  const files = import_node_fs38.default.readdirSync(promptDirPath, { withFileTypes: true });
+  const files = import_node_fs39.default.readdirSync(promptDirPath, { withFileTypes: true });
   for (const file of files) {
     if (!file.isFile() || !file.name.endsWith(".md")) {
       continue;
@@ -19007,8 +19392,8 @@ function readPromptDirectory(promptDirPath) {
       continue;
     }
     const version = normalizeVersion(basename);
-    const promptPath = import_node_path50.default.join(promptDirPath, file.name);
-    const prompt = import_node_fs38.default.readFileSync(promptPath, "utf-8").trim();
+    const promptPath = import_node_path51.default.join(promptDirPath, file.name);
+    const prompt = import_node_fs39.default.readFileSync(promptPath, "utf-8").trim();
     releases.push({ version, prompt, promptPath });
   }
   const deduped = /* @__PURE__ */ new Map();
@@ -19029,19 +19414,19 @@ function listAvailableUpgradeTargets(currentVersion, releases) {
 }
 function resolvePromptDirectory(explicitPath) {
   if (explicitPath) {
-    return import_node_path50.default.resolve(explicitPath);
+    return import_node_path51.default.resolve(explicitPath);
   }
-  const entryFile = process.argv[1] ? import_node_path50.default.resolve(process.argv[1]) : __filename;
-  const entryDir = import_node_path50.default.dirname(entryFile);
-  const resolvedEntryDir = import_node_fs38.default.existsSync(entryFile) ? import_node_path50.default.dirname(import_node_fs38.default.realpathSync(entryFile)) : entryDir;
+  const entryFile = process.argv[1] ? import_node_path51.default.resolve(process.argv[1]) : __filename;
+  const entryDir = import_node_path51.default.dirname(entryFile);
+  const resolvedEntryDir = import_node_fs39.default.existsSync(entryFile) ? import_node_path51.default.dirname(import_node_fs39.default.realpathSync(entryFile)) : entryDir;
   const candidates = [
-    import_node_path50.default.resolve(resolvedEntryDir, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path50.default.resolve(entryDir, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path50.default.resolve(__dirname, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path50.default.resolve(__dirname, "..", "..", UPGRADE_PROMPTS_DIR),
-    import_node_path50.default.resolve(process.cwd(), UPGRADE_PROMPTS_DIR)
+    import_node_path51.default.resolve(resolvedEntryDir, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path51.default.resolve(entryDir, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path51.default.resolve(__dirname, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path51.default.resolve(__dirname, "..", "..", UPGRADE_PROMPTS_DIR),
+    import_node_path51.default.resolve(process.cwd(), UPGRADE_PROMPTS_DIR)
   ];
-  const existing = candidates.find((candidate) => import_node_fs38.default.existsSync(candidate));
+  const existing = candidates.find((candidate) => import_node_fs39.default.existsSync(candidate));
   return existing ?? candidates[0];
 }
 function loadUpgradeCatalog(options = {}) {
@@ -19057,12 +19442,12 @@ function loadUpgradeCatalog(options = {}) {
     releases
   };
 }
-var import_node_fs38, import_node_path50, SEMVER_RE, UPGRADE_PROMPTS_DIR;
+var import_node_fs39, import_node_path51, SEMVER_RE, UPGRADE_PROMPTS_DIR;
 var init_upgrade = __esm({
   "src/core/upgrade.ts"() {
     "use strict";
-    import_node_fs38 = __toESM(require("fs"));
-    import_node_path50 = __toESM(require("path"));
+    import_node_fs39 = __toESM(require("fs"));
+    import_node_path51 = __toESM(require("path"));
     init_repo_config();
     SEMVER_RE = /^v?(\d+)\.(\d+)\.(\d+)$/;
     UPGRADE_PROMPTS_DIR = "upgrade-prompts";
@@ -19205,7 +19590,7 @@ function isLoopbackHost(host) {
   return host === "127.0.0.1" || host === "localhost" || host === "host.docker.internal";
 }
 function inspectCompose(composeFile, _workspace) {
-  if (!import_node_fs39.default.existsSync(composeFile)) {
+  if (!import_node_fs40.default.existsSync(composeFile)) {
     return {
       aliases: [],
       publishedPorts: [],
@@ -19214,7 +19599,7 @@ function inspectCompose(composeFile, _workspace) {
     };
   }
   try {
-    const raw = import_node_fs39.default.readFileSync(composeFile, "utf-8");
+    const raw = import_node_fs40.default.readFileSync(composeFile, "utf-8");
     const parsed = import_yaml5.default.parse(raw);
     const root = asRecord(parsed);
     const services = asRecord(root?.services);
@@ -19310,11 +19695,11 @@ function buildHostPortClaimsCheck(repoPath, workspace) {
   }
 }
 function buildDevcontainerChecks(repoPath, config, workspace) {
-  const devcontainerDir = import_node_path51.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs39.default.existsSync(devcontainerDir)) {
+  const devcontainerDir = import_node_path52.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs40.default.existsSync(devcontainerDir)) {
     return [];
   }
-  const compose = inspectCompose(import_node_path51.default.join(devcontainerDir, "docker-compose.yml"), workspace);
+  const compose = inspectCompose(import_node_path52.default.join(devcontainerDir, "docker-compose.yml"), workspace);
   const checks = [];
   if (compose.parseError) {
     checks.push({
@@ -19341,9 +19726,9 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
     details: compose.publishedPorts.length > 0 ? compose.publishedPorts.join(", ") : void 0,
     suggestion: compose.parseError || compose.publishedPorts.length > 0 ? "Remove published ports and route services through devnet aliases with devrouter proxy apps." : void 0
   });
-  const dockerfilePath = import_node_path51.default.join(devcontainerDir, "Dockerfile");
-  const dockerfileExists = import_node_fs39.default.existsSync(dockerfilePath);
-  const dockerfile = dockerfileExists ? import_node_fs39.default.readFileSync(dockerfilePath, "utf-8") : "";
+  const dockerfilePath = import_node_path52.default.join(devcontainerDir, "Dockerfile");
+  const dockerfileExists = import_node_fs40.default.existsSync(dockerfilePath);
+  const dockerfile = dockerfileExists ? import_node_fs40.default.readFileSync(dockerfilePath, "utf-8") : "";
   const devrouterArtifacts = ["@devrouter/cli", "devrouter-process"].filter(
     (artifact) => dockerfile.includes(artifact)
   );
@@ -19401,12 +19786,12 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
   });
   return checks;
 }
-var import_node_fs39, import_node_path51, import_yaml5;
+var import_node_fs40, import_node_path52, import_yaml5;
 var init_devcontainer_diagnostics = __esm({
   "src/core/devcontainer-diagnostics.ts"() {
     "use strict";
-    import_node_fs39 = __toESM(require("fs"));
-    import_node_path51 = __toESM(require("path"));
+    import_node_fs40 = __toESM(require("fs"));
+    import_node_path52 = __toESM(require("path"));
     import_yaml5 = __toESM(require("yaml"));
     init_devcontainer_profile();
     init_host_port_claims();
@@ -19501,11 +19886,11 @@ function reconcileRouteRunConflict(repoPath, app) {
     }
   }
 }
-var import_node_fs40;
+var import_node_fs41;
 var init_route_state = __esm({
   "src/core/route-state.ts"() {
     "use strict";
-    import_node_fs40 = __toESM(require("fs"));
+    import_node_fs41 = __toESM(require("fs"));
     init_host_routes();
     init_workspace();
   }
@@ -19680,7 +20065,7 @@ function toRepoStatus(repoPath) {
   const resolvedRepoPath = resolveRepoPath(repoPath);
   const configPath = getRepoConfigPath(resolvedRepoPath);
   const explicitRepo = typeof repoPath === "string" && repoPath.trim().length > 0;
-  const configExists = import_node_fs41.default.existsSync(configPath);
+  const configExists = import_node_fs42.default.existsSync(configPath);
   if (!explicitRepo && !configExists) {
     return void 0;
   }
@@ -19828,11 +20213,11 @@ async function collectRouterStatus(repoPath) {
     }
   };
 }
-var import_node_fs41;
+var import_node_fs42;
 var init_status = __esm({
   "src/core/status.ts"() {
     "use strict";
-    import_node_fs41 = __toESM(require("fs"));
+    import_node_fs42 = __toESM(require("fs"));
     init_docker();
     init_managed_runtime_state();
     init_managed_runtime_status();
@@ -19906,12 +20291,12 @@ function parseMinimumNodeMajor(value) {
   return Number(match[1]);
 }
 function readPackageJson(repoPath) {
-  const packagePath = import_node_path52.default.join(repoPath, "package.json");
-  if (!import_node_fs42.default.existsSync(packagePath)) {
+  const packagePath = import_node_path53.default.join(repoPath, "package.json");
+  if (!import_node_fs43.default.existsSync(packagePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs42.default.readFileSync(packagePath, "utf-8"));
+    return JSON.parse(import_node_fs43.default.readFileSync(packagePath, "utf-8"));
   } catch {
     return void 0;
   }
@@ -20095,13 +20480,13 @@ function buildGlobalToolChecksWithoutTelemetry(repoPath) {
   checks.push(nodeToolchainCheck(repoPath));
   return checks;
 }
-var import_node_child_process29, import_node_fs42, import_node_path52, DEVSY_DISABLE_TELEMETRY;
+var import_node_child_process29, import_node_fs43, import_node_path53, DEVSY_DISABLE_TELEMETRY;
 var init_tool_diagnostics = __esm({
   "src/core/tool-diagnostics.ts"() {
     "use strict";
     import_node_child_process29 = require("child_process");
-    import_node_fs42 = __toESM(require("fs"));
-    import_node_path52 = __toESM(require("path"));
+    import_node_fs43 = __toESM(require("fs"));
+    import_node_path53 = __toESM(require("path"));
     init_devsy_agent();
     init_workspace_runtime();
     DEVSY_DISABLE_TELEMETRY = "DEVSY_DISABLE_TELEMETRY";
@@ -20118,10 +20503,10 @@ function inRepositoryWorkspaceScope(repoPath, worktreePath, livePaths) {
   if (livePaths.some((candidate) => sameWorkspacePath(candidate, worktreePath))) return true;
   const comparableRepo = comparableWorkspacePath(repoPath);
   const comparableWorktree = comparableWorkspacePath(worktreePath);
-  const localRoot = import_node_path53.default.join(comparableRepo, "trees") + import_node_path53.default.sep;
+  const localRoot = import_node_path54.default.join(comparableRepo, "trees") + import_node_path54.default.sep;
   if (comparableWorktree.startsWith(localRoot)) return true;
-  const legacyPrefix = `${import_node_path53.default.basename(comparableRepo)}-`;
-  return import_node_path53.default.dirname(comparableWorktree) === import_node_path53.default.dirname(comparableRepo) && import_node_path53.default.basename(comparableWorktree).startsWith(legacyPrefix);
+  const legacyPrefix = `${import_node_path54.default.basename(comparableRepo)}-`;
+  return import_node_path54.default.dirname(comparableWorktree) === import_node_path54.default.dirname(comparableRepo) && import_node_path54.default.basename(comparableWorktree).startsWith(legacyPrefix);
 }
 function previewActions(devpodStatus, routeCount, includeRecord) {
   const actions = [
@@ -20373,11 +20758,11 @@ function applyWorkspaceGc(plan) {
     candidates
   };
 }
-var import_node_path53;
+var import_node_path54;
 var init_workspace_gc = __esm({
   "src/core/workspace-gc.ts"() {
     "use strict";
-    import_node_path53 = __toESM(require("path"));
+    import_node_path54 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_host_routes();
@@ -20447,11 +20832,11 @@ function inspectPostgresCredentials(repoPath, config) {
         parseErrors.push(`${app.name}: ${composeFile} (${message})`);
         continue;
       }
-      if (!import_node_fs43.default.existsSync(absolutePath)) {
+      if (!import_node_fs44.default.existsSync(absolutePath)) {
         continue;
       }
       try {
-        const raw = import_node_fs43.default.readFileSync(absolutePath, "utf-8");
+        const raw = import_node_fs44.default.readFileSync(absolutePath, "utf-8");
         const parsed = import_yaml6.default.parse(raw);
         const root = asRecord2(parsed);
         const services = asRecord2(root?.services);
@@ -20731,7 +21116,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.73" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.75" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -20761,9 +21146,9 @@ async function buildDoctorReport(options = {}) {
         (app) => app.docker.composeFiles.map((filePath) => ({
           app: app.name,
           filePath,
-          absolutePath: import_node_path54.default.resolve(repo.path, filePath)
+          absolutePath: import_node_path55.default.resolve(repo.path, filePath)
         }))
-      ).filter((entry) => !import_node_fs43.default.existsSync(entry.absolutePath));
+      ).filter((entry) => !import_node_fs44.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.compose-files",
         level: missingComposeFiles.length === 0 ? "ok" : "error",
@@ -20806,8 +21191,8 @@ async function buildDoctorReport(options = {}) {
       const missingHostCwds = config.apps.filter((app) => app.runtime === "host").map((app) => ({
         app: app.name,
         cwd: app.hostRun.cwd,
-        absolutePath: import_node_path54.default.resolve(repo.path, app.hostRun.cwd)
-      })).filter((entry) => !import_node_fs43.default.existsSync(entry.absolutePath));
+        absolutePath: import_node_path55.default.resolve(repo.path, app.hostRun.cwd)
+      })).filter((entry) => !import_node_fs44.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.host-cwd",
         level: missingHostCwds.length === 0 ? "ok" : "error",
@@ -20951,12 +21336,12 @@ async function buildDoctorReport(options = {}) {
     nextSteps
   };
 }
-var import_node_fs43, import_node_path54, import_yaml6, POSTGRES_DEFAULTS;
+var import_node_fs44, import_node_path55, import_yaml6, POSTGRES_DEFAULTS;
 var init_doctor = __esm({
   "src/core/doctor.ts"() {
     "use strict";
-    import_node_fs43 = __toESM(require("fs"));
-    import_node_path54 = __toESM(require("path"));
+    import_node_fs44 = __toESM(require("fs"));
+    import_node_path55 = __toESM(require("path"));
     import_yaml6 = __toESM(require("yaml"));
     init_docker();
     init_host_routes();
@@ -21454,6 +21839,11 @@ async function runStopCommand(options) {
     return;
   }
   const label2 = result.kind === "primary" ? "Primary checkout" : `Workspace '${result.workspace}'`;
+  if (result.runtimeAbsent) {
+    process.stdout.write(`${label2} has no runtime or routes; stop is complete.
+`);
+    return;
+  }
   if (!result.stopped && !result.deleted && result.freedRoutes === 0) {
     process.stdout.write(`${label2} is already stopped; no routes needed removal.
 `);
@@ -21774,17 +22164,17 @@ function asRecord3(value) {
   return value;
 }
 function readJson(filePath) {
-  if (!import_node_fs44.default.existsSync(filePath)) {
+  if (!import_node_fs45.default.existsSync(filePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs44.default.readFileSync(filePath, "utf-8"));
+    return JSON.parse(import_node_fs45.default.readFileSync(filePath, "utf-8"));
   } catch {
     return void 0;
   }
 }
 function relative(repoPath, filePath) {
-  return import_node_path55.default.relative(repoPath, filePath) || ".";
+  return import_node_path56.default.relative(repoPath, filePath) || ".";
 }
 function redactEnvAssignments(value) {
   return value.replace(
@@ -21825,7 +22215,7 @@ function inspectPackageManager(repoPath, pkg) {
     ["bun.lock", "bun"]
   ];
   for (const [fileName, name] of lockfiles) {
-    if (import_node_fs44.default.existsSync(import_node_path55.default.join(repoPath, fileName))) {
+    if (import_node_fs45.default.existsSync(import_node_path56.default.join(repoPath, fileName))) {
       return { name, source: fileName };
     }
   }
@@ -21840,9 +22230,9 @@ function inspectNode(repoPath, pkg) {
   if (typeof engines?.node === "string") {
     return { version: engines.node, source: "package.json:engines.node" };
   }
-  const nvmrc = import_node_path55.default.join(repoPath, ".nvmrc");
-  if (import_node_fs44.default.existsSync(nvmrc)) {
-    const version = import_node_fs44.default.readFileSync(nvmrc, "utf-8").trim();
+  const nvmrc = import_node_path56.default.join(repoPath, ".nvmrc");
+  if (import_node_fs45.default.existsSync(nvmrc)) {
+    const version = import_node_fs45.default.readFileSync(nvmrc, "utf-8").trim();
     return { version, source: ".nvmrc" };
   }
   return void 0;
@@ -21903,7 +22293,7 @@ function configuredComposeFiles(repoPath) {
     const files = config.apps.filter(
       (app) => app.runtime === "docker"
     ).flatMap((app) => app.docker.composeFiles).filter(
-      (fileName) => !import_node_path55.default.isAbsolute(fileName) && !import_node_path55.default.normalize(fileName).startsWith("..")
+      (fileName) => !import_node_path56.default.isAbsolute(fileName) && !import_node_path56.default.normalize(fileName).startsWith("..")
     );
     return Array.from(new Set(files));
   } catch {
@@ -21921,7 +22311,7 @@ function composeFiles(repoPath) {
     ...configuredComposeFiles(repoPath)
   ];
   return Array.from(new Set(candidates)).filter(
-    (fileName) => import_node_fs44.default.existsSync(import_node_path55.default.join(repoPath, fileName))
+    (fileName) => import_node_fs45.default.existsSync(import_node_path56.default.join(repoPath, fileName))
   );
 }
 function stringArray2(value) {
@@ -21959,7 +22349,7 @@ function inspectServices(repoPath) {
   const services = [];
   for (const fileName of composeFiles(repoPath)) {
     try {
-      const parsed = import_yaml7.default.parse(import_node_fs44.default.readFileSync(import_node_path55.default.join(repoPath, fileName), "utf-8"));
+      const parsed = import_yaml7.default.parse(import_node_fs45.default.readFileSync(import_node_path56.default.join(repoPath, fileName), "utf-8"));
       const serviceMap = asRecord3(asRecord3(parsed)?.services);
       for (const [name, value] of Object.entries(serviceMap ?? {})) {
         const service = asRecord3(value);
@@ -21994,8 +22384,8 @@ function inspectServices(repoPath) {
   return services;
 }
 function inspectEnvFiles(repoPath) {
-  const files = import_node_fs44.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
-    const content = import_node_fs44.default.readFileSync(import_node_path55.default.join(repoPath, fileName), "utf-8");
+  const files = import_node_fs45.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
+    const content = import_node_fs45.default.readFileSync(import_node_path56.default.join(repoPath, fileName), "utf-8");
     const names = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=")[0]?.trim()).filter((name) => Boolean(name)).sort();
     return { path: fileName, names };
   });
@@ -22009,18 +22399,18 @@ function inspectEnvFiles(repoPath) {
   };
 }
 function inspectDevcontainer(repoPath) {
-  const dir = import_node_path55.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs44.default.existsSync(dir)) {
+  const dir = import_node_path56.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs45.default.existsSync(dir)) {
     return { exists: false, files: [] };
   }
   return {
     exists: true,
-    files: import_node_fs44.default.readdirSync(dir).filter((fileName) => import_node_fs44.default.statSync(import_node_path55.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
+    files: import_node_fs45.default.readdirSync(dir).filter((fileName) => import_node_fs45.default.statSync(import_node_path56.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
   };
 }
 function inspectDevrouter(repoPath) {
   const configPath = getRepoConfigPath(repoPath);
-  if (!import_node_fs44.default.existsSync(configPath)) {
+  if (!import_node_fs45.default.existsSync(configPath)) {
     return {
       exists: false,
       configPath,
@@ -22064,15 +22454,15 @@ function inspectAgentGuidance(repoPath) {
     ["AGENTS.md", "agents"],
     ["CLAUDE.md", "claude"]
   ]) {
-    if (import_node_fs44.default.existsSync(import_node_path55.default.join(repoPath, fileName))) {
+    if (import_node_fs45.default.existsSync(import_node_path56.default.join(repoPath, fileName))) {
       results.push({ path: fileName, kind });
     }
   }
-  const skillsDir = import_node_path55.default.join(repoPath, ".agents", "skills");
-  if (import_node_fs44.default.existsSync(skillsDir)) {
-    for (const name of import_node_fs44.default.readdirSync(skillsDir).sort()) {
-      const skillPath = import_node_path55.default.join(skillsDir, name, "SKILL.md");
-      if (import_node_fs44.default.existsSync(skillPath)) {
+  const skillsDir = import_node_path56.default.join(repoPath, ".agents", "skills");
+  if (import_node_fs45.default.existsSync(skillsDir)) {
+    for (const name of import_node_fs45.default.readdirSync(skillsDir).sort()) {
+      const skillPath = import_node_path56.default.join(skillsDir, name, "SKILL.md");
+      if (import_node_fs45.default.existsSync(skillPath)) {
         results.push({ path: relative(repoPath, skillPath), kind: "skill" });
       }
     }
@@ -22115,7 +22505,7 @@ function buildIssues(report) {
 }
 function inspectRepo(options = {}) {
   const repoPath = resolveRepoPath(options.repo);
-  const pkg = readJson(import_node_path55.default.join(repoPath, "package.json"));
+  const pkg = readJson(import_node_path56.default.join(repoPath, "package.json"));
   const scripts = inspectScripts(pkg);
   const reportWithoutIssues = {
     repoPath,
@@ -22134,12 +22524,12 @@ function inspectRepo(options = {}) {
     issues: buildIssues(reportWithoutIssues)
   };
 }
-var import_node_fs44, import_node_path55, import_yaml7;
+var import_node_fs45, import_node_path56, import_yaml7;
 var init_repo_inspect = __esm({
   "src/core/repo-inspect.ts"() {
     "use strict";
-    import_node_fs44 = __toESM(require("fs"));
-    import_node_path55 = __toESM(require("path"));
+    import_node_fs45 = __toESM(require("fs"));
+    import_node_path56 = __toESM(require("path"));
     import_yaml7 = __toESM(require("yaml"));
     init_repo_config();
   }
@@ -22244,7 +22634,7 @@ function requiredFileChecks(repoPath) {
     ".devcontainer/docker-compose.yml",
     ".devrouter.yml"
   ];
-  const missing = required.filter((fileName) => !import_node_fs45.default.existsSync(import_node_path56.default.join(repoPath, fileName)));
+  const missing = required.filter((fileName) => !import_node_fs46.default.existsSync(import_node_path57.default.join(repoPath, fileName)));
   return {
     id: "repo.devcontainer.verify-files",
     level: missing.length === 0 ? "ok" : "error",
@@ -22469,12 +22859,12 @@ async function verifyDevcontainer(options = {}) {
     nextSteps: collectNextSteps3(checks)
   };
 }
-var import_node_fs45, import_node_path56;
+var import_node_fs46, import_node_path57;
 var init_devcontainer_verify = __esm({
   "src/core/devcontainer-verify.ts"() {
     "use strict";
-    import_node_fs45 = __toESM(require("fs"));
-    import_node_path56 = __toESM(require("path"));
+    import_node_fs46 = __toESM(require("fs"));
+    import_node_path57 = __toESM(require("path"));
     init_capabilities();
     init_doctor();
     init_host_routes();
@@ -22771,7 +23161,7 @@ function packageManagerIssues(repo) {
 }
 function plannedFiles(repoPath, version) {
   const repo = inspectRepo({ repo: repoPath });
-  const projectName = sanitizeProjectName(import_node_path57.default.basename(repo.repoPath));
+  const projectName = sanitizeProjectName(import_node_path58.default.basename(repo.repoPath));
   const nodeMajor = majorVersion(repo.node?.version, "24");
   const pnpmVersion = repo.packageManager?.name === "pnpm" && repo.packageManager.version ? repo.packageManager.version : DEFAULT_PNPM_VERSION;
   const port = inferPort2(repo);
@@ -22816,8 +23206,8 @@ function plannedFiles(repoPath, version) {
   };
 }
 function classifyFile(repoPath, file) {
-  const absolutePath = import_node_path57.default.join(repoPath, file.relativePath);
-  if (!import_node_fs46.default.existsSync(absolutePath)) {
+  const absolutePath = import_node_path58.default.join(repoPath, file.relativePath);
+  if (!import_node_fs47.default.existsSync(absolutePath)) {
     return {
       path: file.relativePath,
       action: "create",
@@ -22825,7 +23215,7 @@ function classifyFile(repoPath, file) {
       bytes: Buffer.byteLength(file.content)
     };
   }
-  const current = import_node_fs46.default.readFileSync(absolutePath, "utf-8");
+  const current = import_node_fs47.default.readFileSync(absolutePath, "utf-8");
   if (!current.includes(MANAGED_MARKER2)) {
     return {
       path: file.relativePath,
@@ -22882,11 +23272,11 @@ function buildPlan(repoPath, dryRun, version) {
   };
 }
 function writeFile(repoPath, file) {
-  const absolutePath = import_node_path57.default.join(repoPath, file.relativePath);
-  import_node_fs46.default.mkdirSync(import_node_path57.default.dirname(absolutePath), { recursive: true });
-  import_node_fs46.default.writeFileSync(absolutePath, file.content, "utf-8");
+  const absolutePath = import_node_path58.default.join(repoPath, file.relativePath);
+  import_node_fs47.default.mkdirSync(import_node_path58.default.dirname(absolutePath), { recursive: true });
+  import_node_fs47.default.writeFileSync(absolutePath, file.content, "utf-8");
   if (file.executable) {
-    import_node_fs46.default.chmodSync(absolutePath, 493);
+    import_node_fs47.default.chmodSync(absolutePath, 493);
   }
 }
 function writeDevcontainer(options = {}) {
@@ -22924,12 +23314,12 @@ function writeDevcontainer(options = {}) {
     nextSteps: postWriteNextSteps(repoPath)
   };
 }
-var import_node_fs46, import_node_path57, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
+var import_node_fs47, import_node_path58, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
 var init_devcontainer_write = __esm({
   "src/core/devcontainer-write.ts"() {
     "use strict";
-    import_node_fs46 = __toESM(require("fs"));
-    import_node_path57 = __toESM(require("path"));
+    import_node_fs47 = __toESM(require("fs"));
+    import_node_path58 = __toESM(require("path"));
     init_repo_config();
     init_repo_inspect();
     MANAGED_MARKER2 = "devrouter:managed devcontainer";
@@ -23263,13 +23653,13 @@ function buildProfilePlanReport(options) {
   return { ...report, contractPath, bindings };
 }
 function loadContract(repoPath, contractPath) {
-  if (import_node_path58.default.isAbsolute(contractPath)) {
+  if (import_node_path59.default.isAbsolute(contractPath)) {
     fail3("profile plan contract path must be relative to the repository.");
   }
   const absolutePath = assertPathWithinRepo(contractPath, repoPath, "Profile plan contract");
   let metadata;
   try {
-    metadata = import_node_fs47.default.lstatSync(absolutePath);
+    metadata = import_node_fs48.default.lstatSync(absolutePath);
   } catch (error) {
     fail3(`could not inspect profile plan contract '${contractPath}': ${error.message}`);
   }
@@ -23279,16 +23669,16 @@ function loadContract(repoPath, contractPath) {
   if (metadata.size > MAX_CONTRACT_BYTES) {
     fail3(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
-  const realRepo = import_node_fs47.default.realpathSync(repoPath);
-  const realContract = import_node_fs47.default.realpathSync(absolutePath);
+  const realRepo = import_node_fs48.default.realpathSync(repoPath);
+  const realContract = import_node_fs48.default.realpathSync(absolutePath);
   assertPathWithinRepo(realContract, realRepo, "Profile plan contract");
-  const source = import_node_fs47.default.readFileSync(absolutePath, "utf-8");
+  const source = import_node_fs48.default.readFileSync(absolutePath, "utf-8");
   if (Buffer.byteLength(source, "utf-8") > MAX_CONTRACT_BYTES) {
     fail3(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
   return {
     contract: parseProfilePlanContract(source),
-    contractPath: import_node_path58.default.relative(repoPath, absolutePath).split(import_node_path58.default.sep).join("/")
+    contractPath: import_node_path59.default.relative(repoPath, absolutePath).split(import_node_path59.default.sep).join("/")
   };
 }
 function resolveProfilePlan(options) {
@@ -23302,12 +23692,12 @@ function resolveProfilePlan(options) {
     contractPath: loaded.contractPath
   });
 }
-var import_node_fs47, import_node_path58, import_yaml8, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
+var import_node_fs48, import_node_path59, import_yaml8, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
 var init_profile_plan = __esm({
   "src/core/profile-plan.ts"() {
     "use strict";
-    import_node_fs47 = __toESM(require("fs"));
-    import_node_path58 = __toESM(require("path"));
+    import_node_fs48 = __toESM(require("fs"));
+    import_node_path59 = __toESM(require("path"));
     import_yaml8 = require("yaml");
     init_paths();
     init_profile_resolution();
@@ -23339,7 +23729,7 @@ async function runProfileResolveCommand(options) {
 async function runProfilePlanCommand(options) {
   const report = resolveProfilePlan(options);
   if (options.output) {
-    writeFileAtomically(import_node_path59.default.resolve(options.output), `${JSON.stringify(report, null, 2)}
+    writeFileAtomically(import_node_path60.default.resolve(options.output), `${JSON.stringify(report, null, 2)}
 `);
   }
   if (options.json) {
@@ -23375,14 +23765,14 @@ function printProfilePlanSummary(report, output2) {
     process.stdout.write(`Binding ${key}: ${renderValues(report.bindings[key] ?? [])}
 `);
   }
-  if (output2) process.stdout.write(`Output: ${import_node_path59.default.resolve(output2)}
+  if (output2) process.stdout.write(`Output: ${import_node_path60.default.resolve(output2)}
 `);
 }
-var import_node_path59;
+var import_node_path60;
 var init_profile = __esm({
   "src/commands/profile.ts"() {
     "use strict";
-    import_node_path59 = __toESM(require("path"));
+    import_node_path60 = __toESM(require("path"));
     init_atomic_file();
     init_output();
     init_profile_plan();
@@ -23672,7 +24062,7 @@ function sanitizeRouterId(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function repoHash(repoPath) {
-  return (0, import_node_crypto26.createHash)("sha1").update(import_node_path60.default.resolve(repoPath)).digest("hex").slice(0, 12);
+  return (0, import_node_crypto26.createHash)("sha1").update(import_node_path61.default.resolve(repoPath)).digest("hex").slice(0, 12);
 }
 function asDockerApp(app) {
   return app.runtime === "docker";
@@ -23751,11 +24141,11 @@ function prepareDockerOverlay(repoPath, appName, apps, publishTcpPorts = false)
   if (dockerApps.length === 0) {
     throw new Error("No docker apps selected to prepare compose overlay.");
   }
-  const cachePath = import_node_path60.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
-  import_node_fs48.default.mkdirSync(cachePath, { recursive: true });
-  const overlayPath = import_node_path60.default.join(cachePath, "compose.devrouter.yml");
+  const cachePath = import_node_path61.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
+  import_node_fs49.default.mkdirSync(cachePath, { recursive: true });
+  const overlayPath = import_node_path61.default.join(cachePath, "compose.devrouter.yml");
   const overlayDocument = buildOverlayDocument(dockerApps, publishTcpPorts);
-  import_node_fs48.default.writeFileSync(overlayPath, import_yaml9.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
+  import_node_fs49.default.writeFileSync(overlayPath, import_yaml9.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
   return {
     overlayPath,
     composeFiles: ensureComposeFiles(dockerApps),
@@ -23875,14 +24265,14 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process33, import_node_crypto26, import_node_fs48, import_node_path60, import_yaml9;
+var import_node_child_process33, import_node_crypto26, import_node_fs49, import_node_path61, import_yaml9;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
     import_node_child_process33 = require("child_process");
     import_node_crypto26 = require("crypto");
-    import_node_fs48 = __toESM(require("fs"));
-    import_node_path60 = __toESM(require("path"));
+    import_node_fs49 = __toESM(require("fs"));
+    import_node_path61 = __toESM(require("path"));
     import_yaml9 = __toESM(require("yaml"));
     init_docker_error_guidance();
     init_paths();
@@ -24704,13 +25094,13 @@ function measureWorktreeConsumption(worktreePath, options) {
   const startedAt = Date.now();
   let rootStat;
   try {
-    rootStat = import_node_fs49.default.lstatSync(worktreePath);
+    rootStat = import_node_fs50.default.lstatSync(worktreePath);
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
   let rootEntries;
   try {
-    rootEntries = import_node_fs49.default.readdirSync(worktreePath, { withFileTypes: true });
+    rootEntries = import_node_fs50.default.readdirSync(worktreePath, { withFileTypes: true });
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
@@ -24736,10 +25126,10 @@ function measureWorktreeConsumption(worktreePath, options) {
         timedOut = true;
         break;
       }
-      const entryPath = import_node_path61.default.join(dirPath, entry.name);
+      const entryPath = import_node_path62.default.join(dirPath, entry.name);
       let entryStat;
       try {
-        entryStat = import_node_fs49.default.lstatSync(entryPath);
+        entryStat = import_node_fs50.default.lstatSync(entryPath);
       } catch (error) {
         if (error?.code === "ENOENT") continue;
         unreadableReason = describeIncompleteWalk(error);
@@ -24749,7 +25139,7 @@ function measureWorktreeConsumption(worktreePath, options) {
       if (!entryStat.isDirectory()) continue;
       let childEntries;
       try {
-        childEntries = import_node_fs49.default.readdirSync(entryPath, { withFileTypes: true });
+        childEntries = import_node_fs50.default.readdirSync(entryPath, { withFileTypes: true });
       } catch (error) {
         unreadableReason = describeIncompleteWalk(error);
         break;
@@ -24813,12 +25203,12 @@ function describeError(error, worktreePath) {
   }
   return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
 }
-var import_node_fs49, import_node_path61, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var import_node_fs50, import_node_path62, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
 var init_workspace_consumption = __esm({
   "src/core/workspace-consumption.ts"() {
     "use strict";
-    import_node_fs49 = __toESM(require("fs"));
-    import_node_path61 = __toESM(require("path"));
+    import_node_fs50 = __toESM(require("fs"));
+    import_node_path62 = __toESM(require("path"));
     init_devpod_environment();
     DEFAULT_DEADLINE_MS = 1e4;
     BLOCK_SIZE_BYTES = 512;
@@ -24919,7 +25309,7 @@ function evaluateWorkspaceActivity(evidence, cutoff) {
 }
 function readGitSnapshot(worktree, commandRunner) {
   const comparablePath = comparableWorkspacePath(worktree.path);
-  if (worktree.prunable || !import_node_fs50.default.existsSync(comparablePath)) {
+  if (worktree.prunable || !import_node_fs51.default.existsSync(comparablePath)) {
     return { worktree, checkout: "missing", head: null, committerDate: null };
   }
   const head = gitOutput(comparablePath, ["rev-parse", "--verify", "HEAD"], commandRunner);
@@ -25444,7 +25834,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
       containers2 = measureContainersFn(worktreePaths);
     } catch (error) {
       const reason = `container measurement failed: ${describeCause(error)}`;
-      containers2 = new Map(worktreePaths.map((path62) => [path62, unknownContainers(reason)]));
+      containers2 = new Map(worktreePaths.map((path63) => [path63, unknownContainers(reason)]));
     }
   }
   const rows2 = records.map((record5) => {
@@ -25494,12 +25884,12 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
     networkCapacity: (dependencies.inspectNetworkCapacity ?? inspectNetworkCapacity)()
   };
 }
-var import_node_child_process35, import_node_fs50, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var import_node_child_process35, import_node_fs51, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
 var init_workspace_cleanup = __esm({
   "src/core/workspace-cleanup.ts"() {
     "use strict";
     import_node_child_process35 = require("child_process");
-    import_node_fs50 = __toESM(require("fs"));
+    import_node_fs51 = __toESM(require("fs"));
     init_devpod_workspaces();
     init_host_routes();
     init_network_diagnostics();
@@ -25611,7 +26001,7 @@ function warnMissingWorkspaceOwnership(repoPath) {
   );
 }
 function defaultWorktreePath(mainRepo, ws) {
-  return import_node_path62.default.join(mainRepo, "trees", ws);
+  return import_node_path63.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
   const ignored = (0, import_node_child_process36.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
@@ -25619,12 +26009,12 @@ function assertDefaultWorktreeRootIgnored(mainRepo) {
   });
   if (ignored.status !== 0) {
     throw new Error(
-      `Default worktree root '${import_node_path62.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path62.default.join(mainRepo, ".gitignore")}' or use --path.`
+      `Default worktree root '${import_node_path63.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path63.default.join(mainRepo, ".gitignore")}' or use --path.`
     );
   }
 }
 function legacyDefaultWorktreePath(mainRepo, ws) {
-  return import_node_path62.default.join(import_node_path62.default.dirname(mainRepo), `${import_node_path62.default.basename(mainRepo)}-${ws}`);
+  return import_node_path63.default.join(import_node_path63.default.dirname(mainRepo), `${import_node_path63.default.basename(mainRepo)}-${ws}`);
 }
 function teardownFallbackPath(mainRepo, workspace) {
   const candidates = [
@@ -25736,7 +26126,7 @@ function assertFullDownPreflight(mainRepo, target) {
   if (sameWorkspacePath(target.worktreePath, mainRepo)) {
     throw new Error("Refusing to remove the primary Git checkout.");
   }
-  if (!target.worktree || target.worktree.prunable || !import_node_fs51.default.existsSync(target.worktreePath)) return;
+  if (!target.worktree || target.worktree.prunable || !import_node_fs52.default.existsSync(target.worktreePath)) return;
   if (target.worktree.locked) {
     throw new Error(
       `Worktree '${target.worktreePath}' is locked; unlock it before workspace down.`
@@ -25776,9 +26166,9 @@ async function workspaceUp(branch, opts = {}) {
       (candidate) => defaultWorktreePath(mainRepo, candidate)
     );
     const generatedPath = candidatePaths.find(
-      (candidate) => !import_node_fs51.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
+      (candidate) => !import_node_fs52.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
     );
-    const selectedPath = opts.path ? import_node_path62.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
+    const selectedPath = opts.path ? import_node_path63.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
     if (!selectedPath) {
       throw new Error(`Could not allocate a collision-safe worktree path for branch '${branch}'.`);
     }
@@ -25787,7 +26177,7 @@ async function workspaceUp(branch, opts = {}) {
         `Branch '${branch}' already uses worktree '${existingBranch.path}', not '${selectedPath}'.`
       );
     }
-    if (import_node_fs51.default.existsSync(selectedPath)) {
+    if (import_node_fs52.default.existsSync(selectedPath)) {
       const registered = worktrees.find(
         (worktree) => sameWorkspacePath(worktree.path, selectedPath)
       );
@@ -25890,7 +26280,7 @@ async function mutateWorkspaceRuntime(action2, resolved, worktrees, quiet = fals
     );
   }
   const retained = action2 === "stop" ? readManagedRuntimeState(resolved.worktreePath, resolved.workspace) : void 0;
-  let absent = false;
+  let absent = mutation.status === "proven-absent";
   const remove = () => {
     if (retained?.stopBaseline) {
       absent = proveManagedStop(retained).status === "proven-absent";
@@ -25899,6 +26289,11 @@ async function mutateWorkspaceRuntime(action2, resolved, worktrees, quiet = fals
       ))
         throw new Error("Absent stop contains routes outside the retained desired set.");
     }
+    if (absent && !retained) {
+      if (listRoutesForWorktreePath(resolved.worktreePath).length)
+        throw new Error("Initial managed stop observed remaining workspace routes.");
+      return [];
+    }
     claimLifecycleEffect();
     return removeWorkspaceRoutesForWorktree(resolved.workspace, resolved.worktreePath);
   };
@@ -25934,7 +26329,8 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
       workspace: resolved.workspace,
       devpodId: stopped.devpodId,
       freedRoutes: stopped.freedRoutes,
-      providerChanged: stopped.stopped
+      providerChanged: stopped.stopped && !stopped.runtimeAbsent,
+      ...stopped.runtimeAbsent ? { runtimeAbsent: true } : {}
     };
   }
   const operation = async () => {
@@ -25944,7 +26340,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     const result = await mutateWorkspaceRuntime("delete", resolved, worktrees, opts.quiet);
     if (removeWorktree) {
-      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs51.default.existsSync(resolved.worktreePath)) {
+      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs52.default.existsSync(resolved.worktreePath)) {
         const rm = (0, import_node_child_process36.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
           encoding: "utf-8"
         });
@@ -25963,7 +26359,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     return result;
   };
-  return resolved.worktree && !resolved.worktree.prunable && import_node_fs51.default.existsSync(resolved.worktreePath) ? withLifecycleOperationLock(resolved.worktreePath, operation) : operation();
+  return resolved.worktree && !resolved.worktree.prunable && import_node_fs52.default.existsSync(resolved.worktreePath) ? withLifecycleOperationLock(resolved.worktreePath, operation) : operation();
 }
 async function workspaceStop(target, opts = {}) {
   return runWorkspaceLifecycle("stop", target, opts);
@@ -25971,13 +26367,13 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process36, import_node_fs51, import_node_path62, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
+var import_node_child_process36, import_node_fs52, import_node_path63, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
     import_node_child_process36 = require("child_process");
-    import_node_fs51 = __toESM(require("fs"));
-    import_node_path62 = __toESM(require("path"));
+    import_node_fs52 = __toESM(require("fs"));
+    import_node_path63 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_devsy_mutation();
@@ -26161,7 +26557,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.73" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.75" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {
@@ -26534,10 +26930,10 @@ workspaceCommand2.command("down").description("Delete a workspace's runtime and
 workspaceCommand2.command("journal").description("Inspect and recover workspace lifecycle journals").command("settle").description(
   "Settle an interrupted lifecycle operation as unobservable so ensure and stop can proceed"
 ).argument("[path]", "Checkout path (defaults to current directory)").option("--json", "Output JSON").action(
-  withErrorHandling(async (path62, _options, command) => {
+  withErrorHandling(async (path63, _options, command) => {
     const options = command.opts();
     const { runWorkspaceJournalSettleCommand: runWorkspaceJournalSettleCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));
-    await runWorkspaceJournalSettleCommand2({ ...path62 ? { path: path62 } : {}, ...options });
+    await runWorkspaceJournalSettleCommand2({ ...path63 ? { path: path63 } : {}, ...options });
   })
 );
 function parseVersionRequest(argv) {