@devrouter/cli 0.0.77 → 0.0.79

package/dist/devrouter-lifecycle-worker.js

@@ -24,7 +24,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 
 // src/core/devpod-exec.ts
 var import_node_child_process29 = require("child_process");
-var import_node_crypto21 = require("crypto");
+var import_node_crypto22 = require("crypto");
 
 // src/core/devpod-environment.ts
 var import_node_child_process3 = require("child_process");
@@ -350,9 +350,25 @@ function acquireFileLock(lockPath, options) {
         }
         if (options.onWait && now - lastProgressAt >= progressIntervalMs) {
           lastProgressAt = now;
+          let holder;
+          try {
+            const bytes2 = import_node_fs2.default.readFileSync(lockPath, "utf-8");
+            const record6 = parseLockRecord(bytes2);
+            if (record6.owner && isLockOwnerLive(record6.owner, livenessCache) && import_node_fs2.default.readFileSync(lockPath, "utf-8") === bytes2) {
+              holder = {
+                kind: "live",
+                pid: record6.owner.pid,
+                acquiredAtMs: record6.acquiredAtMs
+              };
+            }
+          } catch {
+          }
           options.onWait({
             waitingMs: now - waitStartedAt,
-            holderPid: queueState.leaderPid,
+            remainingWaitMs: Math.max(0, deadline - now),
+            queueLeaderPid: queueState.leaderPid,
+            holderPid: holder?.pid,
+            holderHeldMs: holder?.acquiredAtMs !== void 0 ? Math.max(0, now - holder.acquiredAtMs) : void 0,
             queuePosition: queueState.position,
             waitingOn: "queue"
           });
@@ -390,6 +406,7 @@ function acquireFileLock(lockPath, options) {
           lastProgressAt = now;
           options.onWait({
             waitingMs: now - waitStartedAt,
+            remainingWaitMs: Math.max(0, deadline - now),
             holderPid: state.pid,
             holderHeldMs: state.acquiredAtMs !== void 0 ? Math.max(0, now - state.acquiredAtMs) : void 0,
             queuePosition: queueState?.position,
@@ -444,9 +461,11 @@ async function withFileLock(lockPath, options, operation) {
 function createStderrWaitReporter(activity, target) {
   return (progress) => {
     const heldSeconds = progress.holderHeldMs !== void 0 ? `, held for ${Math.round(progress.holderHeldMs / 1e3)}s` : "";
-    const status = progress.waitingOn === "queue" ? `waiting in provider queue position ${progress.queuePosition} led by PID ${progress.holderPid}` : progress.queuePosition !== void 0 && progress.queuePosition > 1 ? `waiting in provider queue position ${progress.queuePosition}; provider lock held by PID ${progress.holderPid}${heldSeconds}` : `waiting for the provider lock held by PID ${progress.holderPid}${heldSeconds}`;
+    const holder = progress.holderPid !== void 0 ? `provider lock held by PID ${progress.holderPid}${heldSeconds}` : "provider lock holder unknown";
+    const remaining = progress.remainingWaitMs !== void 0 ? `; queue acquisition timeout in ${Math.ceil(progress.remainingWaitMs / 1e3)}s (does not stop the holder)` : "";
+    const status = progress.waitingOn === "queue" ? `waiting in provider queue position ${progress.queuePosition}; first waiter PID ${progress.queueLeaderPid}; ${holder}` : progress.queuePosition !== void 0 && progress.queuePosition > 1 ? `waiting in provider queue position ${progress.queuePosition}; provider lock held by PID ${progress.holderPid}${heldSeconds}` : `waiting for the provider lock held by PID ${progress.holderPid}${heldSeconds}`;
     process.stderr.write(
-      `${activity} for ${target}: ${status}; waited ${Math.round(progress.waitingMs / 1e3)}s so far
+      `${activity} for ${target}: ${status}; waited ${Math.round(progress.waitingMs / 1e3)}s so far${remaining}
 `
     );
   };
@@ -1841,6 +1860,21 @@ function resolveWorkspaceRuntimeDetailed(repoPath, override) {
 function resolveWorkspaceRuntimeOrDefault(repoPath) {
   return resolveWorkspaceRuntimeDetailed(repoPath).runtime;
 }
+function resolveWorkspaceRuntimeForReport(repoPath) {
+  const snapshots = getWorkspaceRegistrySnapshots();
+  const envRaw = process.env.DEVROUTER_WORKSPACE_RUNTIME?.trim();
+  if (envRaw) {
+    const runtime2 = parseWorkspaceRuntime(envRaw);
+    return snapshots[runtime2] ? runtime2 : void 0;
+  }
+  if (repoPath) {
+    const owner = pathOwnerRuntime(repoPath, snapshots);
+    if (owner.status === "conflict" || owner.status === "unavailable") return void 0;
+    if (owner.status === "owner") return owner.runtime;
+  }
+  const runtime = resolveWorkspaceRuntimeDetailed().runtime;
+  return snapshots[runtime] ? runtime : void 0;
+}
 function resetWorkspaceRuntimeCaches() {
   cachedRuntime = void 0;
   cachedSnapshots = void 0;
@@ -2048,6 +2082,16 @@ function parseVersion(output) {
     /\bv?(\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)\b/
   )?.[1];
 }
+function compareVersionCore(left, right) {
+  const core = (value) => value.split(/[-+]/, 1)[0].split(".").map((part) => Number.parseInt(part, 10));
+  const leftParts = core(left);
+  const rightParts = core(right);
+  for (let index = 0; index < 3; index += 1) {
+    const difference = (leftParts[index] ?? 0) - (rightParts[index] ?? 0);
+    if (difference !== 0) return difference > 0 ? 1 : -1;
+  }
+  return 0;
+}
 function devsyAgentRepairSuggestion(inspection) {
   if (inspection.state === "stale") {
     return `Install Devsy ${SUPPORTED_DEVSY_VERSION} for a supported host, then run: ${DEVSY_AGENT_SETUP_COMMAND}`;
@@ -2119,7 +2163,7 @@ function inspectDevsyAgent(options = {}) {
   const installedVersion = parseVersion(resolved.versionOutput);
   const explicitPath = resolved.env.DEVSY_AGENT_BINARY?.trim();
   const source = explicitPath ? "explicit" : "managed";
-  if (installedVersion !== SUPPORTED_DEVSY_VERSION) {
+  if (installedVersion === void 0 || installedVersion !== SUPPORTED_DEVSY_VERSION && compareVersionCore(installedVersion, SUPPORTED_DEVSY_VERSION) <= 0) {
     return {
       state: "stale",
       source,
@@ -2135,6 +2179,15 @@ function inspectDevsyAgent(options = {}) {
       installedVersion
     };
   }
+  if (installedVersion !== SUPPORTED_DEVSY_VERSION) {
+    return {
+      state: "ready",
+      source: "host",
+      reason: `installed Devsy ${installedVersion} is newer than the verified ${SUPPORTED_DEVSY_VERSION} agent; the host CLI governs its own agent`,
+      installedVersion,
+      drift: { installed: installedVersion, supported: SUPPORTED_DEVSY_VERSION }
+    };
+  }
   const expectedName = resolved.nativeAssetName ?? nativeAssetName(resolved.platform, resolved.arch);
   const asset = resolved.assets.find((candidate) => candidate.name === expectedName);
   if (!asset) {
@@ -2156,9 +2209,7 @@ function inspectDevsyAgent(options = {}) {
 }
 function requireReadyDevsyAgent(options = {}) {
   const inspection = inspectDevsyAgent(options);
-  if (inspection.state !== "ready" || !inspection.binaryPath || !inspection.asset) {
-    throw new DevsyAgentReadinessError(inspection);
-  }
+  if (inspection.state !== "ready") throw new DevsyAgentReadinessError(inspection);
   return {
     binaryPath: inspection.binaryPath,
     source: inspection.source,
@@ -3963,6 +4014,45 @@ function proveReplacementStopAbsence(state, baseline, replacement) {
   );
   assertEmptyPopulation();
 }
+function proveAbsentPopulationStop(state, baseline, expected) {
+  const observation = () => {
+    const owner = inspectDevsyWorkspaceOwnership(
+      listDevsyWorkspaces(),
+      state.devpodId,
+      state.repoPath
+    );
+    if (owner.status !== "owned")
+      throw new Error("Absent stop registration changed during inspection.");
+    const current = identityOf(owner.workspace);
+    if (!(0, import_node_util3.isDeepStrictEqual)(current, expected))
+      throw new Error("Absent stop registration identity changed during inspection.");
+    if (resolveManagedStopEndpoint() !== baseline.endpoint)
+      throw new Error("Stop endpoint changed.");
+    if (inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId)
+      throw new Error("Stop daemon changed.");
+    proveLocalDockerSelection(owner.workspace);
+    return current;
+  };
+  const assertAbsentPopulation = () => {
+    assertManagedStopContainersAbsent(
+      baseline.endpoint,
+      baseline.containers.map((container) => container.id)
+    );
+    if (inspectManagedStopContainers(baseline.project, baseline.endpoint).length !== 0 || inspectManagedStopWorkspaceIds(baseline.endpoint, baseline.composeDirectory).length !== 0 || inspectProviderRunnerContainers(
+      baseline.endpoint,
+      managedRunnerId(baseline.uid, baseline.providerId)
+    ).length !== 0)
+      throw new Error("Absent stop observed a remaining workspace population.");
+  };
+  const before = observation();
+  if (!(0, import_node_util3.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state))
+    throw new Error("Retained stop generation changed.");
+  assertAbsentPopulation();
+  const after = observation();
+  if (!(0, import_node_util3.isDeepStrictEqual)(after, before) || !(0, import_node_util3.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state))
+    throw new Error("Absent stop authority changed during inspection.");
+  assertAbsentPopulation();
+}
 function proveManagedStop(state) {
   const baseline = validateManagedStopBaseline(state.stopBaseline, state);
   const owner = inspectDevsyWorkspaceOwnership(
@@ -3974,6 +4064,10 @@ function proveManagedStop(state) {
     const identityKeys = ["context", "providerId", "uid", "sourcePath", "sourceContainer"];
     const current = identityOf(owner.workspace);
     const changed = identityKeys.filter((key) => baseline[key] !== current[key]);
+    if (changed.length === 0 && state.workspace !== void 0 && isLinkedWorktree(state.repoPath) && inspectManagedStopContainers(baseline.project, baseline.endpoint).length === 0) {
+      proveAbsentPopulationStop(state, baseline, current);
+      return { status: "proven-absent", containers: [] };
+    }
     if (changed.length === 1 && changed[0] === "uid" && !baseline.sourceContainer && !current.sourceContainer && state.workspace !== void 0 && isLinkedWorktree(state.repoPath)) {
       proveReplacementStopAbsence(state, baseline, { uid: current.uid || void 0 });
       return { status: "proven-absent", containers: [] };
@@ -4068,6 +4162,9 @@ function validOperation(value) {
     "COMPLETION_UNKNOWN"
   ]) && (value.status === "COMPLETED" ? isReliabilityCounter(value.exitCode) : value.exitCode === null);
 }
+function validIncidentUnit(value) {
+  return record2(value) && isReliabilityId(value.key) && (value.kind === "process" || value.kind === "service") && isReliabilityCounter(value.actions) && isReliabilityCounter(value.lastActionAtMs);
+}
 function assertReliabilityState(value) {
   const intentRevision = record2(value) ? value.intentRevision : void 0;
   const valid = record2(value) && value.contractVersion === RELIABILITY_CONTRACT_VERSION && oneOf(value.executionPolicy, ["manual", "capacity-managed"]) && (value.executionPolicy === "manual" ? value.admission === "not-applicable" && value.chargeHeld === false : value.admission !== "not-applicable") && boundedArray(value.operationHistory) && uniqueIds(value.operationHistory, "key") && uniqueIds(value.operationHistory, "id") && value.operationHistory.every(
@@ -4092,7 +4189,7 @@ function assertReliabilityState(value) {
     (request) => record2(request) && oneOf(request.mode, ["start", "attach"]) && isReliabilityId(request.consumerId) && isReliabilityId(request.operationId) && isReliabilityProfile(request.profile) && isReliabilityCounter(request.intentRevision) && isReliabilityCounter(intentRevision) && request.intentRevision <= intentRevision
   ) && boundedArray(value.observations) && uniqueIds(value.observations, "capability") && value.observations.every(
     (observation) => record2(observation) && oneOf(observation.infrastructure, ["healthy", "failed", "unknown"]) && oneOf(observation.application, ["verified", "unready", "unverified"]) && isReliabilityCounter(observation.observedAtMs) && isReliabilityCounter(observation.validForMs)
-  ) && (value.operation === null || validOperation(value.operation)) && (value.executionPolicy !== "manual" || value.desired !== "parked-for-capacity" && value.incident === null) && (value.incident === null || record2(value.incident) && isReliabilityId(value.incident.id) && isReliabilityCounter(value.incident.correctiveActionsTaken) && isReliabilityCounter(value.incident.actionLimit) && value.incident.actionLimit > 0 && value.incident.correctiveActionsTaken <= value.incident.actionLimit);
+  ) && (value.operation === null || validOperation(value.operation)) && (value.executionPolicy !== "manual" || value.desired !== "parked-for-capacity" && value.incident === null) && (value.incident === null || record2(value.incident) && isReliabilityId(value.incident.id) && isReliabilityCounter(value.incident.correctiveActionsTaken) && isReliabilityCounter(value.incident.actionLimit) && value.incident.actionLimit > 0 && value.incident.correctiveActionsTaken <= value.incident.actionLimit && (value.incident.startedAtMs === void 0 || isReliabilityCounter(value.incident.startedAtMs)) && (value.incident.units === void 0 || boundedArray(value.incident.units) && uniqueIds(value.incident.units, "key") && value.incident.units.every(validIncidentUnit)));
   if (!valid) throw new Error("Invalid reliability state.");
 }
 function createReliabilityState(environmentId, controllerEpoch, executionPolicy = "capacity-managed") {
@@ -4195,6 +4292,15 @@ function evaluateCapacity(budgets, samples, charges, requested, nowMs, maxSample
 
 // src/core/capacity-store.ts
 var MAX_BYTES = 1048576;
+var CapacityHistoryError = class extends Error {
+  constructor(code) {
+    super(
+      code === "capacity-ledger-lost" ? "Capacity ledger history is lost; restore verified capacity-reservations.json." : "Capacity history cannot be proven; inspect the private lifecycle journals."
+    );
+    this.code = code;
+    this.name = "CapacityHistoryError";
+  }
+};
 var CapacitySnapshotChangedError = class extends Error {
   constructor() {
     super("Capacity snapshot changed.");
@@ -4286,18 +4392,57 @@ function serializeSnapshot(snapshot) {
   return contents;
 }
 var CapacityStore = class {
-  constructor(directory) {
+  constructor(directory, write = writeFileAtomically, minimumRevision = () => 0) {
     this.directory = directory;
+    this.write = write;
+    this.minimumRevision = minimumRevision;
     this.file = import_node_path19.default.join(directory, "capacity-reservations.json");
+    this.establishedFile = import_node_path19.default.join(directory, "capacity-ledger.established");
   }
   file;
+  establishedFile;
+  observedLedger = false;
+  readEstablished() {
+    let descriptor;
+    try {
+      descriptor = import_node_fs15.default.openSync(
+        this.establishedFile,
+        import_node_fs15.default.constants.O_RDONLY | import_node_fs15.default.constants.O_NOFOLLOW | import_node_fs15.default.constants.O_NONBLOCK
+      );
+    } catch (error) {
+      if (error.code === "ENOENT") return false;
+      throw error;
+    }
+    try {
+      const stat = import_node_fs15.default.fstatSync(descriptor);
+      if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0 || stat.size > 4096)
+        throw new Error("Unsafe capacity ledger marker.");
+      const bytes2 = Buffer.alloc(4097);
+      const count = import_node_fs15.default.readSync(descriptor, bytes2, 0, bytes2.length, 0);
+      if (count > 4096) throw new Error("Capacity ledger marker exceeds byte limit.");
+      const marker = JSON.parse(bytes2.subarray(0, count).toString("utf8"));
+      object(marker, ["version"]);
+      if (marker.version !== 1) throw new Error("Invalid capacity ledger marker.");
+      return true;
+    } finally {
+      import_node_fs15.default.closeSync(descriptor);
+    }
+  }
   read() {
+    const minimumRevision = this.minimumRevision();
+    const established = this.readEstablished();
     let descriptor;
     try {
-      descriptor = import_node_fs15.default.openSync(this.file, import_node_fs15.default.constants.O_RDONLY | import_node_fs15.default.constants.O_NOFOLLOW);
+      descriptor = import_node_fs15.default.openSync(
+        this.file,
+        import_node_fs15.default.constants.O_RDONLY | import_node_fs15.default.constants.O_NOFOLLOW | import_node_fs15.default.constants.O_NONBLOCK
+      );
     } catch (error) {
-      if (error.code === "ENOENT")
+      if (error.code === "ENOENT") {
+        if (established || this.observedLedger || minimumRevision > 0)
+          throw new CapacityHistoryError("capacity-ledger-lost");
         return { version: 1, revision: 0, reservations: [] };
+      }
       throw error;
     }
     try {
@@ -4309,11 +4454,40 @@ var CapacityStore = class {
       if (count > MAX_BYTES) throw new Error("Capacity reservation snapshot exceeds byte limit.");
       const value = JSON.parse(buffer.subarray(0, count).toString("utf8"));
       validate(value);
+      if (value.revision < minimumRevision) throw new CapacityHistoryError("capacity-ledger-lost");
+      this.observedLedger = true;
       return value;
     } finally {
       import_node_fs15.default.closeSync(descriptor);
     }
   }
+  establish() {
+    if (!this.readEstablished()) this.write(this.establishedFile, '{"version":1}\n');
+    for (const file of [this.file, this.establishedFile, this.directory]) {
+      const descriptor = import_node_fs15.default.openSync(
+        file,
+        import_node_fs15.default.constants.O_RDONLY | import_node_fs15.default.constants.O_NOFOLLOW | import_node_fs15.default.constants.O_NONBLOCK
+      );
+      try {
+        const stat = import_node_fs15.default.fstatSync(descriptor);
+        if ((file === this.directory ? !stat.isDirectory() : !stat.isFile()) || stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0)
+          throw new Error("Unsafe capacity ledger durability artifact.");
+        import_node_fs15.default.fsyncSync(descriptor);
+      } finally {
+        import_node_fs15.default.closeSync(descriptor);
+      }
+    }
+  }
+  readForMutation() {
+    const snapshot = this.read();
+    if (this.observedLedger) this.establish();
+    return snapshot;
+  }
+  commit(snapshot) {
+    this.write(this.file, serializeSnapshot(snapshot));
+    this.observedLedger = true;
+    this.establish();
+  }
   /**
    * Caller must revoke journal authority and prove exact physical cessation first.
    * An absent reservation still advances the revision to fence that proof.
@@ -4327,7 +4501,7 @@ var CapacityStore = class {
       `${this.file}.lock`,
       { activity: "capacity settlement", waitMs: 100 },
       () => {
-        const snapshot = this.read();
+        const snapshot = this.readForMutation();
         if (snapshot.revision !== expectedRevision) throw new CapacitySnapshotChangedError();
         if (snapshot.revision === Number.MAX_SAFE_INTEGER)
           throw new Error("Capacity reservation revision exhausted.");
@@ -4337,7 +4511,7 @@ var CapacityStore = class {
         if (index >= 0) snapshot.reservations.splice(index, 1);
         snapshot.revision++;
         validate(snapshot);
-        writeFileAtomically(this.file, serializeSnapshot(snapshot));
+        this.commit(snapshot);
         return { settled: index >= 0, revision: snapshot.revision };
       }
     );
@@ -4352,16 +4526,19 @@ var CapacityStore = class {
       `${this.file}.lock`,
       { activity: "capacity pool observation", waitMs: 100 },
       () => {
-        const snapshot = this.read();
+        const snapshot = this.readForMutation();
         if (snapshot.revision !== expectedRevision) throw new CapacitySnapshotChangedError();
         const merged = structuredClone(snapshot.pools ?? []);
-        if (!mergePools(merged, pools)) return { changed: false, revision: snapshot.revision };
+        if (!mergePools(merged, pools)) {
+          if (!this.observedLedger) this.commit(snapshot);
+          return { changed: false, revision: snapshot.revision };
+        }
         if (snapshot.revision === Number.MAX_SAFE_INTEGER)
           throw new Error("Capacity reservation revision exhausted.");
         snapshot.pools = merged;
         snapshot.revision++;
         validate(snapshot);
-        writeFileAtomically(this.file, serializeSnapshot(snapshot));
+        this.commit(snapshot);
         return { changed: true, revision: snapshot.revision };
       }
     );
@@ -4380,7 +4557,7 @@ var CapacityStore = class {
       `${this.file}.lock`,
       { activity: "capacity pool settlement", waitMs: 100 },
       () => {
-        const snapshot = this.read();
+        const snapshot = this.readForMutation();
         if (snapshot.revision !== expectedRevision) throw new CapacitySnapshotChangedError();
         const pools = snapshot.pools ?? [];
         const index = pools.findIndex((pool2) => pool2.daemonId === identity2.daemonId);
@@ -4394,7 +4571,7 @@ var CapacityStore = class {
         if (pool) pools.splice(index, 1);
         snapshot.revision++;
         validate(snapshot);
-        writeFileAtomically(this.file, serializeSnapshot(snapshot));
+        this.commit(snapshot);
         return { settled: !!pool, revision: snapshot.revision };
       }
     );
@@ -4409,7 +4586,7 @@ var CapacityStore = class {
       `${this.file}.lock`,
       { activity: "capacity phase settlement", waitMs: 100 },
       () => {
-        const snapshot = this.read();
+        const snapshot = this.readForMutation();
         if (snapshot.revision !== expectedRevision) throw new CapacitySnapshotChangedError();
         const index = snapshot.reservations.findIndex(
           (entry) => entry.environmentId === target.environmentId
@@ -4426,7 +4603,7 @@ var CapacityStore = class {
         snapshot.reservations[index] = structuredClone(target);
         snapshot.revision++;
         validate(snapshot);
-        writeFileAtomically(this.file, serializeSnapshot(snapshot));
+        this.commit(snapshot);
       }
     );
   }
@@ -4444,7 +4621,7 @@ var CapacityStore = class {
       `${this.file}.lock`,
       { activity: "capacity reservation", waitMs: 100 },
       () => {
-        const snapshot = this.read();
+        const snapshot = this.readForMutation();
         if (snapshot.revision !== expectedRevision) throw new CapacitySnapshotChangedError();
         const pools = structuredClone(snapshot.pools ?? []);
         const poolChanged = mergePools(pools, requestedPool === void 0 ? [] : [requestedPool]);
@@ -4489,7 +4666,7 @@ var CapacityStore = class {
           snapshot.reservations[snapshot.reservations.indexOf(existing)] = structuredClone(request);
         else snapshot.reservations.push(structuredClone(request));
         validate(snapshot);
-        writeFileAtomically(this.file, serializeSnapshot(snapshot));
+        this.commit(snapshot);
         return { admitted: true, revision: snapshot.revision, joined: false };
       }
     );
@@ -4501,6 +4678,28 @@ var import_node_crypto7 = require("crypto");
 var import_node_fs16 = __toESM(require("fs"));
 var import_node_path20 = __toESM(require("path"));
 var CONTROLLER_SNAPSHOT_BYTES = 1048576;
+var EVENT_KINDS = [
+  "acquired",
+  "renewed",
+  "released",
+  "expired",
+  "invalidated",
+  "observed",
+  "consent",
+  "reconnected"
+];
+var LEGACY_EVENT_KINDS = EVENT_KINDS.slice(0, 6);
+var PROJECTION_STATUSES = [
+  "READY",
+  "APP_ERROR",
+  "BLOCKED",
+  "STOPPED",
+  "STARTING",
+  "RECOVERING",
+  "WAITING_CAPACITY",
+  "PARKED_CAPACITY",
+  "UNKNOWN"
+];
 function fail() {
   throw new Error("Invalid controller snapshot.");
 }
@@ -4518,38 +4717,150 @@ function id3(value) {
 function counter(value) {
   return Number.isSafeInteger(value) && Number(value) >= 0;
 }
+function requirements(value) {
+  return Array.isArray(value) && value.length >= 1 && value.length <= 16 && new Set(value).size === value.length && value.every(
+    (entry) => text2(entry, 132) && /^(runtime|app:[a-z0-9][a-z0-9-]*)$/.test(entry)
+  );
+}
+function parkingConsent(value) {
+  return value === "protected" || value === "allow-unusable";
+}
+function retainedReason(value) {
+  return value === "expired" || value === "restart" || value === "discontinuity" || value === "binding-changed";
+}
+function checkEnvironment(value, ids2, paths) {
+  fields(value, [
+    "id",
+    "repoPath",
+    "workspace",
+    "provider",
+    "providerId",
+    "profile",
+    "fingerprint"
+  ]);
+  if (!id3(value.id) || !text2(value.repoPath, 4096) || !import_node_path20.default.isAbsolute(value.repoPath) || import_node_path20.default.resolve(value.repoPath) !== value.repoPath || !id3(value.workspace) || !id3(value.providerId) || !text2(value.profile) || !/^[a-z0-9-]+(?:,[a-z0-9-]+)*$/.test(value.profile) || !text2(value.fingerprint, 128) || !/^[a-f0-9]{64}$/.test(value.fingerprint) || !["devpod", "devsy"].includes(String(value.provider)))
+    fail();
+  const knownPath = ids2.get(value.id);
+  if (knownPath !== void 0 && knownPath !== value.repoPath) fail();
+  const knownId = paths.get(value.repoPath);
+  if (knownId !== void 0 && knownId !== value.id) fail();
+  ids2.set(value.id, value.repoPath);
+  paths.set(value.repoPath, value.id);
+}
+function checkProjection(session) {
+  if (session.observation === void 0) return;
+  const observation = session.observation;
+  fields(observation, [
+    "status",
+    "sampledAtMs",
+    "validUntilMs",
+    "journalRevision",
+    "runtimeFingerprint"
+  ]);
+  if (!PROJECTION_STATUSES.includes(String(observation.status)) || !counter(observation.sampledAtMs) || !counter(observation.validUntilMs) || observation.validUntilMs < observation.sampledAtMs || !counter(observation.journalRevision) || !text2(observation.runtimeFingerprint, 128) || !/^[a-f0-9]{64}$/.test(observation.runtimeFingerprint))
+    fail();
+}
+function checkEvents(events, nextSequence, kinds) {
+  let previous = 0;
+  for (const event of events) {
+    fields(event, ["sequence", "session", "generation", "kind"]);
+    if (!counter(event.sequence) || event.sequence <= previous || event.sequence >= nextSequence || !id3(event.session) || !id3(event.generation) || typeof event.kind !== "string" || !kinds.includes(event.kind))
+      fail();
+    previous = event.sequence;
+  }
+  if (Buffer.byteLength(JSON.stringify(events)) > 262144) fail();
+}
 function validateControllerSnapshot(value) {
   fields(value, [
     "version",
     "store",
     "epoch",
     "revision",
+    "parkingRevision",
+    "history",
     "nextSequence",
     "environments",
     "sessions",
-    "events"
+    "retainedSessions",
+    "events",
+    ...value?.version === 3 ? ["fingerprint"] : []
   ]);
-  if (value.version !== 1 || !id3(value.store) || !counter(value.epoch) || !counter(value.revision) || !counter(value.nextSequence) || value.nextSequence < 1 || !Array.isArray(value.environments) || value.environments.length > 32 || !Array.isArray(value.sessions) || value.sessions.length > 128 || !Array.isArray(value.events) || value.events.length > 256)
+  if (value.version !== 2 && value.version !== 3 || !id3(value.store) || !counter(value.epoch) || !counter(value.revision) || !counter(value.parkingRevision) || value.history !== "complete" && value.history !== "legacy-unknown" || !counter(value.nextSequence) || value.nextSequence < 1 || !Array.isArray(value.environments) || !Array.isArray(value.sessions) || !Array.isArray(value.retainedSessions) || !Array.isArray(value.events) || value.events.length > 256 || value.sessions.length + value.retainedSessions.length > 128)
     fail();
-  const environments = /* @__PURE__ */ new Set();
-  const checkouts = /* @__PURE__ */ new Set();
-  for (const env of value.environments) {
-    fields(env, [
+  if (value.version === 3) {
+    fields(value.fingerprint, ["digest", "enrolledEpoch"]);
+    if (typeof value.fingerprint.digest !== "string" || !/^[a-f0-9]{64}$/.test(value.fingerprint.digest) || !counter(value.fingerprint.enrolledEpoch) || value.fingerprint.enrolledEpoch < 1 || value.fingerprint.enrolledEpoch > Number(value.epoch))
+      fail();
+  }
+  const ids2 = /* @__PURE__ */ new Map();
+  const paths = /* @__PURE__ */ new Map();
+  for (const environment of value.environments) checkEnvironment(environment, ids2, paths);
+  if (ids2.size !== value.environments.length) fail();
+  const activeEnvironments = new Set(ids2.keys());
+  const usedEnvironments = /* @__PURE__ */ new Set();
+  const activeSessions = /* @__PURE__ */ new Set();
+  const tuples = /* @__PURE__ */ new Set();
+  for (const session of value.sessions) {
+    fields(session, [
       "id",
-      "repoPath",
-      "workspace",
-      "provider",
-      "providerId",
-      "profile",
-      "fingerprint"
+      "environmentId",
+      "generation",
+      "requirements",
+      "renewedAtMs",
+      "parkingConsent",
+      "consentRevision",
+      ...Object.hasOwn(session, "observation") ? ["observation"] : []
     ]);
-    if (!id3(env.id) || environments.has(env.id) || !text2(env.repoPath, 4096) || !import_node_path20.default.isAbsolute(env.repoPath) || import_node_path20.default.resolve(env.repoPath) !== env.repoPath || checkouts.has(env.repoPath) || !id3(env.workspace) || !id3(env.providerId) || !text2(env.profile) || !/^[a-z0-9-]+(?:,[a-z0-9-]+)*$/.test(env.profile) || !text2(env.fingerprint, 128) || !/^[a-f0-9]{64}$/.test(env.fingerprint) || !["devpod", "devsy"].includes(String(env.provider)))
+    const tuple = `${session.id}\0${value.epoch}\0${session.generation}`;
+    if (!id3(session.id) || activeSessions.has(session.id) || !id3(session.environmentId) || !activeEnvironments.has(session.environmentId) || !id3(session.generation) || !counter(session.renewedAtMs) || !requirements(session.requirements) || !parkingConsent(session.parkingConsent) || !counter(session.consentRevision) || tuples.has(tuple))
       fail();
-    environments.add(env.id);
-    checkouts.add(env.repoPath);
+    activeSessions.add(session.id);
+    usedEnvironments.add(session.environmentId);
+    tuples.add(tuple);
+    checkProjection(session);
   }
-  const sessions = /* @__PURE__ */ new Set();
+  if (usedEnvironments.size !== value.environments.length) fail();
+  for (const retainedSession of value.retainedSessions) {
+    fields(retainedSession, [
+      "id",
+      "generation",
+      "epoch",
+      "requirements",
+      "parkingConsent",
+      "consentRevision",
+      "reason",
+      "environment"
+    ]);
+    const tuple = `${retainedSession.id}\0${retainedSession.epoch}\0${retainedSession.generation}`;
+    if (!id3(retainedSession.id) || !id3(retainedSession.generation) || !counter(retainedSession.epoch) || retainedSession.epoch > value.epoch || !requirements(retainedSession.requirements) || !parkingConsent(retainedSession.parkingConsent) || !counter(retainedSession.consentRevision) || !retainedReason(retainedSession.reason) || tuples.has(tuple))
+      fail();
+    tuples.add(tuple);
+    checkEnvironment(retainedSession.environment, ids2, paths);
+  }
+  if (ids2.size > 32) fail();
+  checkEvents(value.events, value.nextSequence, EVENT_KINDS);
+  if (Buffer.byteLength(JSON.stringify(value)) + 1 > CONTROLLER_SNAPSHOT_BYTES) fail();
+}
+function validateLegacySnapshot(value) {
+  fields(value, [
+    "version",
+    "store",
+    "epoch",
+    "revision",
+    "nextSequence",
+    "environments",
+    "sessions",
+    "events"
+  ]);
+  if (value.version !== 1 || !id3(value.store) || !counter(value.epoch) || !counter(value.revision) || !counter(value.nextSequence) || value.nextSequence < 1 || !Array.isArray(value.environments) || value.environments.length > 32 || !Array.isArray(value.sessions) || value.sessions.length > 128 || !Array.isArray(value.events) || value.events.length > 256)
+    fail();
+  const ids2 = /* @__PURE__ */ new Map();
+  const paths = /* @__PURE__ */ new Map();
+  for (const environment of value.environments) checkEnvironment(environment, ids2, paths);
+  if (ids2.size !== value.environments.length) fail();
+  const activeEnvironments = new Set(ids2.keys());
   const usedEnvironments = /* @__PURE__ */ new Set();
+  const sessions = /* @__PURE__ */ new Set();
   for (const session of value.sessions) {
     fields(session, [
       "id",
@@ -4559,60 +4870,66 @@ function validateControllerSnapshot(value) {
       "renewedAtMs",
       ...Object.hasOwn(session, "observation") ? ["observation"] : []
     ]);
-    if (!id3(session.id) || sessions.has(session.id) || !id3(session.environmentId) || !environments.has(session.environmentId) || !id3(session.generation) || !counter(session.renewedAtMs) || !Array.isArray(session.requirements) || session.requirements.length < 1 || session.requirements.length > 16 || new Set(session.requirements).size !== session.requirements.length || session.requirements.some(
-      (r) => !text2(r, 132) || !/^(runtime|app:[a-z0-9][a-z0-9-]*)$/.test(r)
-    ))
+    if (!id3(session.id) || sessions.has(session.id) || !id3(session.environmentId) || !activeEnvironments.has(session.environmentId) || !id3(session.generation) || !counter(session.renewedAtMs) || !requirements(session.requirements))
       fail();
-    if (session.observation !== void 0) {
-      const observation = session.observation;
-      fields(observation, [
-        "status",
-        "sampledAtMs",
-        "validUntilMs",
-        "journalRevision",
-        "runtimeFingerprint"
-      ]);
-      if (![
-        "READY",
-        "APP_ERROR",
-        "BLOCKED",
-        "STOPPED",
-        "STARTING",
-        "RECOVERING",
-        "WAITING_CAPACITY",
-        "PARKED_CAPACITY",
-        "UNKNOWN"
-      ].includes(String(observation.status)) || !counter(observation.sampledAtMs) || !counter(observation.validUntilMs) || observation.validUntilMs < observation.sampledAtMs || !counter(observation.journalRevision) || !text2(observation.runtimeFingerprint, 128) || !/^[a-f0-9]{64}$/.test(observation.runtimeFingerprint))
-        fail();
-    }
     sessions.add(session.id);
     usedEnvironments.add(session.environmentId);
+    checkProjection(session);
   }
-  if (usedEnvironments.size !== environments.size) fail();
-  let previous = 0;
-  for (const event of value.events) {
-    fields(event, ["sequence", "session", "generation", "kind"]);
-    if (!counter(event.sequence) || event.sequence <= previous || event.sequence >= value.nextSequence || !id3(event.session) || !id3(event.generation) || !["acquired", "renewed", "released", "expired", "invalidated", "observed"].includes(
-      String(event.kind)
-    ))
-      fail();
-    previous = event.sequence;
+  if (usedEnvironments.size !== value.environments.length) fail();
+  checkEvents(value.events, value.nextSequence, LEGACY_EVENT_KINDS);
+  if (Buffer.byteLength(JSON.stringify(value)) + 1 > CONTROLLER_SNAPSHOT_BYTES) fail();
+}
+function normalizeLegacySnapshot(value) {
+  return {
+    version: 2,
+    store: value.store,
+    epoch: value.epoch,
+    revision: value.revision,
+    parkingRevision: 0,
+    history: "legacy-unknown",
+    nextSequence: value.nextSequence,
+    environments: value.environments.map((environment) => ({ ...environment })),
+    sessions: value.sessions.map((session) => ({
+      id: session.id,
+      environmentId: session.environmentId,
+      generation: session.generation,
+      requirements: [...session.requirements],
+      renewedAtMs: session.renewedAtMs,
+      parkingConsent: "protected",
+      consentRevision: 0,
+      ...session.observation ? { observation: { ...session.observation } } : {}
+    })),
+    retainedSessions: [],
+    events: value.events.map((event) => ({ ...event }))
+  };
+}
+function parseStoredSnapshot(value) {
+  if (value && typeof value === "object" && !Array.isArray(value) && value.version === 1) {
+    validateLegacySnapshot(value);
+    return normalizeLegacySnapshot(value);
   }
-  if (Buffer.byteLength(JSON.stringify(value.events)) > 262144 || Buffer.byteLength(JSON.stringify(value)) + 1 > CONTROLLER_SNAPSHOT_BYTES)
-    fail();
+  validateControllerSnapshot(value);
+  return value;
 }
 var ControllerStore = class {
-  constructor(directory, write = writeFileAtomically) {
+  constructor(directory, write = writeFileAtomically, ownsLifetimeLock = false) {
     this.directory = directory;
     this.write = write;
+    this.ownsLifetimeLock = ownsLifetimeLock;
     this.file = import_node_path20.default.join(directory, "snapshot.json");
+    this.identityFile = import_node_path20.default.join(directory, "store-identity.json");
   }
   file;
-  read() {
+  identityFile;
+  identity;
+  observedStore;
+  observedFingerprint;
+  readBytes(file = this.file, limit = CONTROLLER_SNAPSHOT_BYTES) {
     let fd;
     try {
       fd = import_node_fs16.default.openSync(
-        this.file,
+        file,
         import_node_fs16.default.constants.O_RDONLY | import_node_fs16.default.constants.O_NOFOLLOW | import_node_fs16.default.constants.O_NONBLOCK
       );
     } catch (error) {
@@ -4621,39 +4938,150 @@ var ControllerStore = class {
     }
     try {
       const stat = import_node_fs16.default.fstatSync(fd);
-      if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0 || stat.size > CONTROLLER_SNAPSHOT_BYTES)
+      if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0 || stat.size > limit)
         fail();
-      const bytes2 = Buffer.alloc(CONTROLLER_SNAPSHOT_BYTES + 1);
+      const bytes2 = Buffer.alloc(limit + 1);
       let length = 0;
       while (length < bytes2.length) {
         const count = import_node_fs16.default.readSync(fd, bytes2, length, bytes2.length - length, null);
         if (!count) break;
         length += count;
       }
-      if (length > CONTROLLER_SNAPSHOT_BYTES) fail();
-      const value = JSON.parse(bytes2.subarray(0, length).toString("utf8"));
-      validateControllerSnapshot(value);
-      return value;
+      if (length > limit) fail();
+      return bytes2.subarray(0, length);
     } catch {
       throw new Error("Controller snapshot is unreadable or invalid.");
     } finally {
       import_node_fs16.default.closeSync(fd);
     }
   }
+  readIdentity() {
+    try {
+      const bytes2 = this.readBytes(this.identityFile, 4096);
+      if (!bytes2) return void 0;
+      const value = JSON.parse(bytes2.toString("utf8"));
+      fields(value, [
+        "version",
+        "store",
+        ...value?.version === 2 ? ["key", "enrolledEpoch"] : []
+      ]);
+      if (value.version !== 1 && value.version !== 2 || !id3(value.store)) fail();
+      if (value.version === 2 && (typeof value.key !== "string" || !/^[a-f0-9]{64}$/.test(value.key) || !counter(value.enrolledEpoch) || Number(value.enrolledEpoch) < 1))
+        fail();
+      return value;
+    } catch {
+      throw new Error("Controller store-identity.json is unreadable or invalid.");
+    }
+  }
+  provenance(identity2) {
+    if (identity2.version !== 2) throw new Error("Controller binding provenance is unavailable.");
+    return {
+      digest: (0, import_node_crypto7.createHash)("sha256").update(JSON.stringify(["devrouter-controller-binding-v1", identity2.store, identity2.key])).digest("hex"),
+      enrolledEpoch: identity2.enrolledEpoch
+    };
+  }
+  checkProvenance(snapshot, identity2) {
+    if (snapshot.version === 3) {
+      if (!identity2 || identity2.store !== snapshot.store || JSON.stringify(this.provenance(identity2)) !== JSON.stringify(snapshot.fingerprint))
+        throw new Error("Controller binding provenance changed.");
+    } else if (identity2?.version === 2 && identity2.enrolledEpoch !== snapshot.epoch + 1) {
+      throw new Error("Controller binding enrollment epoch changed.");
+    }
+    if (this.observedFingerprint && (snapshot.version !== 3 || JSON.stringify(snapshot.fingerprint) !== this.observedFingerprint))
+      throw new Error("Controller binding provenance disappeared or changed.");
+  }
+  /** Return an incarnation-fenced capability; private key bytes never leave this store. */
+  bindingFingerprint() {
+    const captured = this.read();
+    if (captured?.version !== 3) throw new Error("Controller binding provenance is unavailable.");
+    return (owner, config) => {
+      const current = this.read();
+      const identity2 = this.readIdentity();
+      if (!current || current.store !== captured.store || current.epoch !== captured.epoch || JSON.stringify(current.fingerprint) !== JSON.stringify(captured.fingerprint) || identity2?.version !== 2)
+        throw new Error("Controller binding incarnation changed.");
+      this.checkProvenance(current, identity2);
+      return (0, import_node_crypto7.createHmac)("sha256", Buffer.from(identity2.key, "hex")).update(JSON.stringify({ owner, config })).digest("hex");
+    };
+  }
+  read() {
+    const identity2 = this.readIdentity();
+    if (this.identity && JSON.stringify(identity2) !== this.identity)
+      throw new Error("Controller store-identity.json disappeared or changed.");
+    const bytes2 = this.readBytes();
+    if (!bytes2) {
+      if (identity2 || this.observedStore)
+        throw new Error(
+          "Controller snapshot.json is missing; restore verified history matching store-identity.json."
+        );
+      return void 0;
+    }
+    try {
+      const snapshot = parseStoredSnapshot(JSON.parse(bytes2.toString("utf8")));
+      if (identity2 && identity2.store !== snapshot.store || this.observedStore && this.observedStore !== snapshot.store)
+        fail();
+      this.checkProvenance(snapshot, identity2);
+      this.observedStore = snapshot.store;
+      this.identity = identity2 ? JSON.stringify(identity2) : void 0;
+      if (snapshot.version === 3) this.observedFingerprint = JSON.stringify(snapshot.fingerprint);
+      return snapshot;
+    } catch {
+      throw new Error("Controller snapshot is unreadable or invalid.");
+    }
+  }
+  assertEmptyDirectory(ignoreOwnerLock) {
+    let entries;
+    try {
+      entries = import_node_fs16.default.readdirSync(this.directory);
+    } catch (error) {
+      if (error.code === "ENOENT") return;
+      throw error;
+    }
+    if (entries.some(
+      (entry) => entry !== "capacity-policy.json" && !(ignoreOwnerLock && entry === "owner.lock")
+    ))
+      throw new Error(
+        "Controller history is missing with surviving artifacts; restore verified history."
+      );
+  }
+  /** Refuse before acquiring a lock could consume the last surviving history evidence. */
+  assertStartup() {
+    if (!this.read()) this.assertEmptyDirectory(false);
+  }
+  enroll(store, epoch) {
+    const existing = this.readIdentity();
+    if (existing && existing.store !== store) throw new Error("Controller store identity changed.");
+    const identity2 = existing?.version === 2 ? existing : {
+      version: 2,
+      store,
+      key: (0, import_node_crypto7.randomBytes)(32).toString("hex"),
+      enrolledEpoch: epoch
+    };
+    if (existing?.version !== 2)
+      this.commitBytes(this.identityFile, `${JSON.stringify(identity2)}
+`, 4096);
+    this.identity = JSON.stringify(identity2);
+    return this.provenance(identity2);
+  }
   persist(snapshot) {
     validateControllerSnapshot(snapshot);
-    this.read();
+    const previous = this.read();
+    if (previous && previous.store !== snapshot.store)
+      throw new Error("Controller store identity changed.");
+    this.checkProvenance(snapshot, this.readIdentity());
     const contents = `${JSON.stringify(snapshot)}
 `;
+    this.commitBytes(this.file, contents, CONTROLLER_SNAPSHOT_BYTES);
+    if (snapshot.version === 3) this.observedFingerprint = JSON.stringify(snapshot.fingerprint);
+  }
+  commitBytes(file, contents, limit) {
     try {
-      this.write(this.file, contents);
+      this.write(file, contents);
     } catch {
-      const current = this.read();
-      if (!current || `${JSON.stringify(current)}
-` !== contents)
+      const stored = this.readBytes(file, limit);
+      if (!stored || stored.toString("utf8") !== contents)
         throw new Error("Controller snapshot commit failed.");
-      for (const file of [this.file, this.directory]) {
-        const fd = import_node_fs16.default.openSync(file, import_node_fs16.default.constants.O_RDONLY | import_node_fs16.default.constants.O_NOFOLLOW);
+      for (const target of [file, this.directory]) {
+        const fd = import_node_fs16.default.openSync(target, import_node_fs16.default.constants.O_RDONLY | import_node_fs16.default.constants.O_NOFOLLOW);
         try {
           import_node_fs16.default.fsyncSync(fd);
         } finally {
@@ -4663,27 +5091,66 @@ var ControllerStore = class {
     }
   }
   startIncarnation() {
-    const previous = this.read();
-    if (previous && (previous.epoch === Number.MAX_SAFE_INTEGER || previous.revision === Number.MAX_SAFE_INTEGER))
+    let previous = this.read();
+    const pristine = !previous;
+    if (!previous) this.assertEmptyDirectory(this.ownsLifetimeLock);
+    if (previous && (previous.epoch === Number.MAX_SAFE_INTEGER || previous.revision === Number.MAX_SAFE_INTEGER || previous.parkingRevision === Number.MAX_SAFE_INTEGER))
       throw new Error("Controller snapshot counters exhausted.");
+    if (!previous) {
+      previous = {
+        version: 2,
+        store: (0, import_node_crypto7.randomUUID)(),
+        epoch: 0,
+        revision: 0,
+        parkingRevision: 0,
+        history: "complete",
+        nextSequence: 1,
+        environments: [],
+        sessions: [],
+        retainedSessions: [],
+        events: []
+      };
+      this.persist(previous);
+    }
+    const fingerprint = this.enroll(previous.store, previous.epoch + 1);
     const snapshot = {
-      version: 1,
-      store: previous?.store ?? (0, import_node_crypto7.randomUUID)(),
+      version: 3,
+      fingerprint,
+      store: previous.store,
       epoch: (previous?.epoch ?? 0) + 1,
       revision: (previous?.revision ?? 0) + 1,
+      parkingRevision: pristine ? 0 : previous.parkingRevision + 1,
+      history: previous?.history ?? "complete",
       nextSequence: 1,
       environments: [],
       sessions: [],
+      retainedSessions: previous ? [...previous.retainedSessions, ...previous.sessions.map((s) => retain(s, previous))] : [],
       events: []
     };
     this.persist(snapshot);
     return snapshot;
   }
 };
+function retain(session, previous) {
+  const environment = previous.environments.find(
+    (candidate) => candidate.id === session.environmentId
+  );
+  if (!environment) fail();
+  return {
+    id: session.id,
+    generation: session.generation,
+    epoch: previous.epoch,
+    requirements: [...session.requirements],
+    parkingConsent: session.parkingConsent,
+    consentRevision: session.consentRevision,
+    reason: "restart",
+    environment: { ...environment }
+  };
+}
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.0.77" : "0.0.0-dev";
+  return true ? "0.0.79" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -4698,6 +5165,10 @@ function compareCliVersions(left, right) {
 var MAX_RECORD_BYTES = 1048576;
 var MAX_RELIABILITY_JOURNALS = 256;
 var MAX_RELIABILITY_DIRECTORY_ENTRIES = MAX_RELIABILITY_JOURNALS * 2;
+var MAX_RELIABILITY_ENUMERATION_MS = 2e3;
+var RELIABILITY_JOURNAL_NAME_RE = /^([0-9a-f]{64})\.json$/;
+var RELIABILITY_LOCK_NAME_RE = /^[0-9a-f]{64}\.json\.lock(?:\.[0-9]+\.[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\.candidate(?:\.stale)?|\.queue\.[0-9]+\.[0-9]+\.[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}(?:\.candidate)?)?$/;
+var RELIABILITY_ATOMIC_TEMP_NAME_RE = /^\.[0-9a-f]{64}\.json\.[0-9]+\.[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\.tmp$/;
 function identityKey(identity2) {
   if (!import_node_path21.default.isAbsolute(identity2.repoPath) || import_node_path21.default.resolve(identity2.repoPath) !== identity2.repoPath || identity2.repoPath.includes("\0") || identity2.workspace !== null && !isReliabilityId(identity2.workspace) || !["devpod", "devsy"].includes(identity2.provider)) {
     throw new Error("Invalid reliability workspace identity.");
@@ -4717,6 +5188,17 @@ function exactKeys(value, expected, message) {
     throw new Error(message);
   }
 }
+function validateConsumerProtection(record5) {
+  const protection = record5.consumerProtection;
+  if (protection === void 0) return;
+  exactKeys(
+    protection,
+    ["version", "revision", "humanPinned"],
+    "Invalid consumer protection fields."
+  );
+  if (protection.version !== 1 || !isReliabilityCounter(protection.revision) || typeof protection.humanPinned !== "boolean")
+    throw new Error("Invalid consumer protection.");
+}
 function validateCapacityPhaseSettlement(record5, state, enrollment) {
   const settlement = record5.phaseSettlement;
   if (settlement === void 0 || settlement === null) return;
@@ -4812,6 +5294,7 @@ function validate2(record5, identity2) {
     "outcome",
     "result",
     "writtenByVersion",
+    "consumerProtection",
     ...record5.version === 2 ? [
       "capacity",
       "enrollment",
@@ -4821,6 +5304,7 @@ function validate2(record5, identity2) {
       "startupWitness"
     ] : []
   ]);
+  validateConsumerProtection(record5);
   if (record5.writtenByVersion !== void 0 && compareCliVersions(record5.writtenByVersion, installedCliVersion()) > 0) {
     throw new Error(
       `Reliability record was last written by devrouter ${record5.writtenByVersion}, which is newer than the installed ${installedCliVersion()}; upgrade devrouter (devrouter upgrade) before running lifecycle commands.`
@@ -4988,6 +5472,19 @@ function validate2(record5, identity2) {
     }
   }
 }
+function createLifecycleCapacityStore(directory = import_node_path21.default.join(DEVROUTER_HOME, "controller")) {
+  return new CapacityStore(directory, void 0, () => {
+    try {
+      let revision = 0;
+      for (const record5 of listReliabilityOperations()) {
+        if (record5.capacity) revision = Math.max(revision, record5.capacity.snapshotRevision ?? 1);
+      }
+      return revision;
+    } catch {
+      throw new CapacityHistoryError("capacity-history-unprovable");
+    }
+  });
+}
 function assertCapacityEffect(record5, workerId, nowMs, directory = import_node_path21.default.join(DEVROUTER_HOME, "controller")) {
   if (record5.version === 1) return;
   const binding = record5.capacity;
@@ -4998,7 +5495,7 @@ function assertCapacityEffect(record5, workerId, nowMs, directory = import_node_
     if (!binding.controller || !controller || controller.store !== binding.controller.store || controller.epoch !== binding.controller.epoch)
       throw new Error("Capacity controller incarnation changed.");
   }
-  const snapshot = new CapacityStore(directory).read();
+  const snapshot = createLifecycleCapacityStore(directory).read();
   if (binding.snapshotRevision === void 0 || snapshot.revision !== binding.snapshotRevision)
     throw new Error("Capacity snapshot authority is absent or stale.");
   const reservation = snapshot.reservations.find(
@@ -5039,6 +5536,79 @@ function readBoundedPrivateJson(file, label) {
     import_node_fs17.default.closeSync(descriptor);
   }
 }
+function assertReliabilityEnumerationTime(startedAtMs) {
+  if (performance.now() - startedAtMs > MAX_RELIABILITY_ENUMERATION_MS)
+    throw new Error("Reliability journal enumeration exceeded its time limit.");
+}
+function reliabilityDirectory() {
+  return import_node_path21.default.join(DEVROUTER_HOME, "reliability");
+}
+function journalIdentity(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Reliability journal identity is invalid.");
+  const identity2 = value.identity;
+  if (!identity2 || typeof identity2 !== "object" || Array.isArray(identity2))
+    throw new Error("Reliability journal identity is invalid.");
+  return identity2;
+}
+function listReliabilityOperations() {
+  const startedAtMs = performance.now();
+  const directory = reliabilityDirectory();
+  let stat;
+  try {
+    stat = import_node_fs17.default.lstatSync(directory);
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  }
+  if (!stat.isDirectory() || stat.isSymbolicLink())
+    throw new Error("Reliability journal directory is unsafe.");
+  if (stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0)
+    throw new Error("Reliability journal directory is not private.");
+  const entries = [];
+  const handle = import_node_fs17.default.opendirSync(directory);
+  try {
+    for (; ; ) {
+      assertReliabilityEnumerationTime(startedAtMs);
+      const entry = handle.readSync();
+      if (!entry) break;
+      entries.push(entry);
+      if (entries.length > MAX_RELIABILITY_DIRECTORY_ENTRIES)
+        throw new Error("Reliability journal directory exceeds its entry limit.");
+    }
+  } finally {
+    handle.closeSync();
+  }
+  const journals = [];
+  for (const entry of entries) {
+    assertReliabilityEnumerationTime(startedAtMs);
+    if (entry.isSymbolicLink())
+      throw new Error("Reliability journal directory contains a symlink.");
+    if (!entry.isFile())
+      throw new Error("Reliability journal directory contains an unsupported entry.");
+    if (RELIABILITY_LOCK_NAME_RE.test(entry.name) || RELIABILITY_ATOMIC_TEMP_NAME_RE.test(entry.name))
+      continue;
+    const match = RELIABILITY_JOURNAL_NAME_RE.exec(entry.name);
+    if (!match) throw new Error("Reliability journal directory contains an unsupported entry.");
+    journals.push({ name: entry.name, key: match[1] });
+  }
+  if (journals.length > MAX_RELIABILITY_JOURNALS)
+    throw new Error("Reliability journal directory exceeds its journal limit.");
+  journals.sort((left, right) => left.name.localeCompare(right.name));
+  const records = [];
+  for (const journal of journals) {
+    assertReliabilityEnumerationTime(startedAtMs);
+    const file = import_node_path21.default.join(directory, journal.name);
+    const identity2 = journalIdentity(readBoundedPrivateJson(file, "Reliability journal"));
+    if (identityKey(identity2) !== journal.key)
+      throw new Error("Reliability journal filename does not match its identity.");
+    const record5 = readReliabilityOperation(identity2);
+    if (!record5) throw new Error("Reliability journal disappeared during enumeration.");
+    records.push(record5);
+    assertReliabilityEnumerationTime(startedAtMs);
+  }
+  return records;
+}
 function persist(record5) {
   validate2(record5, record5.identity);
   const contents = `${JSON.stringify(record5)}
@@ -5082,12 +5652,15 @@ function updateReliabilityOperation(identity2, operation) {
       throw new Error("Reliability record revision is exhausted.");
     const previousVersion = record5.version;
     const previousEnrollment = record5.enrollment && { ...record5.enrollment };
+    const previousProtection = structuredClone(record5.consumerProtection);
     const result = operation(record5);
     if (result && typeof result.then === "function") {
       throw new Error("Reliability record updates must be synchronous.");
     }
     if (record5.version < previousVersion || previousEnrollment && !(0, import_node_util4.isDeepStrictEqual)(record5.enrollment, previousEnrollment))
       throw new Error("Durable capacity enrollment cannot be downgraded or replaced.");
+    if (!(0, import_node_util4.isDeepStrictEqual)(record5.consumerProtection, previousProtection))
+      throw new Error("Consumer protection is only writable through the dedicated pin authority.");
     record5.writtenByVersion = installedCliVersion();
     validate2(record5, identity2);
     record5.revision += 1;
@@ -6383,7 +6956,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs18.default.rea
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.77" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.79" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -9315,7 +9888,8 @@ async function startDevsyWorkspace(options) {
     }
     if (options.recreate) args.push("--recreate");
     const env = network ? networkProviderEnvironment(network.binding, process.env) : { ...process.env };
-    env.DEVSY_AGENT_BINARY = agent.binaryPath;
+    if (agent.binaryPath) env.DEVSY_AGENT_BINARY = agent.binaryPath;
+    else delete env.DEVSY_AGENT_BINARY;
     if (options.workspace) {
       env.WORKSPACE = options.workspace.token;
       env.DEVROUTER_WORKSPACE = options.workspace.token;
@@ -9339,7 +9913,7 @@ async function startDevsyWorkspace(options) {
       let message = `devsy workspace up failed for '${devsyId ?? options.repoPath}'.`;
       if (result.error?.message) message += ` ${result.error.message}`;
       if (AGENT_ACQUISITION_RE.test(result.stderrTail)) {
-        message += ` Devsy rejected the verified agent source. Run: ${DEVSY_AGENT_SETUP_COMMAND}`;
+        message += agent.binaryPath ? ` Devsy rejected the verified agent source. Run: ${DEVSY_AGENT_SETUP_COMMAND}` : " Devsy could not acquire an agent binary for this host CLI.";
       }
       if (failedStartMayHaveAttached(devsyId, options.repoPath)) {
         throw new DevsyStartPostconditionError(message);
@@ -9379,9 +9953,9 @@ var ExecutionOutcomeError = class extends Error {
 };
 
 // src/core/reliability-lifecycle.ts
-var import_node_crypto20 = require("crypto");
+var import_node_crypto21 = require("crypto");
 var import_node_path40 = __toESM(require("path"));
-var import_node_util6 = require("util");
+var import_node_util7 = require("util");
 
 // src/core/capacity-policy.ts
 var import_node_fs26 = __toESM(require("fs"));
@@ -9402,6 +9976,76 @@ var CONTROLLER_PROFILE_RE = new RegExp(
   `^(?:${CONTROLLER_PROFILE_TOKEN_RE.source.slice(1, -1)})(?:,(?:${CONTROLLER_PROFILE_TOKEN_RE.source.slice(1, -1)}))*$`
 );
 
+// src/core/controller-monitor.ts
+var import_node_crypto15 = require("crypto");
+var import_node_util6 = require("util");
+
+// src/core/reliability-output.ts
+function reliabilityAttention(state) {
+  assertReliabilityState(state);
+  const completeStop = state.stopProof.workloadsStopped && state.stopProof.routesRemoved;
+  if (state.desired === "stopped-by-user") return completeStop ? void 0 : "stop-incomplete";
+  if (state.operation?.status === "COMPLETION_UNKNOWN" || state.operation?.status === "INTERRUPTED")
+    return "operation-unknown";
+  if (state.desired === "parked-for-capacity")
+    return completeStop ? "capacity-parked" : "stop-incomplete";
+  if (state.admission === "denied-unadmittable") return "unadmittable";
+  if (state.admission === "waiting") return "capacity-waiting";
+  if (state.phase === "recovering") return "recovering";
+  if (state.phase === "queued" || state.phase === "starting" || state.phase === "verifying")
+    return "starting";
+  return void 0;
+}
+
+// src/core/recovery-budget.ts
+function findRecoveryUnit(incident, unit) {
+  return (incident.units ?? []).find((record5) => record5.key === unit.key);
+}
+function restartsFor(kind, limits) {
+  return kind === "service" ? limits.maxServiceRestarts : limits.maxProcessRestarts;
+}
+function recoveryBudgetRefusal(input) {
+  const startedAtMs = input.incident.startedAtMs ?? input.nowMs;
+  const elapsed = input.activeElapsedMs ?? Math.max(0, input.nowMs - startedAtMs);
+  if (elapsed > input.limits.windowSeconds * 1e3) return "window-closed";
+  if (input.unit !== void 0) {
+    const record5 = findRecoveryUnit(input.incident, input.unit);
+    if (record5 !== void 0 && record5.actions >= restartsFor(input.unit.kind, input.limits))
+      return "unit-exhausted";
+  }
+  if (input.incident.correctiveActionsTaken >= input.incident.actionLimit)
+    return "budget-exhausted";
+  return void 0;
+}
+function claimRecoveryUnit(input) {
+  const reason2 = recoveryBudgetRefusal(input);
+  if (reason2 !== void 0) return { ok: false, reason: reason2 };
+  const units = (input.incident.units ?? []).map((record5) => ({ ...record5 }));
+  if (input.unit !== void 0) {
+    const index = units.findIndex((record5) => record5.key === input.unit?.key);
+    if (index === -1) {
+      if (units.length >= RELIABILITY_MAX_ITEMS) return { ok: false, reason: "unit-exhausted" };
+      units.push({ ...input.unit, actions: 1, lastActionAtMs: input.nowMs });
+    } else {
+      const record5 = units[index];
+      units[index] = {
+        ...record5,
+        actions: record5.actions + 1,
+        lastActionAtMs: input.nowMs
+      };
+    }
+  }
+  return {
+    ok: true,
+    incident: {
+      ...input.incident,
+      startedAtMs: input.incident.startedAtMs ?? input.nowMs,
+      correctiveActionsTaken: input.incident.correctiveActionsTaken + 1,
+      units
+    }
+  };
+}
+
 // src/core/reliability-model.ts
 var INFRASTRUCTURE_VALUES = ["healthy", "failed", "unknown"];
 var APPLICATION_VALUES = ["verified", "unready", "unverified"];
@@ -9474,7 +10118,7 @@ function assertReliabilityEvent(value) {
       valid = isReliabilityCounter(value.type === "epoch" ? value.nextEpoch : value.nextGeneration);
       break;
     case "recover":
-      valid = isReliabilityId(value.incidentId) && isReliabilityCounter(value.actionLimit) && value.actionLimit > 0 && isReliabilityId(value.operationId);
+      valid = isReliabilityId(value.incidentId) && isReliabilityCounter(value.actionLimit) && value.actionLimit > 0 && isReliabilityId(value.operationId) && (value.unit === null || record3(value.unit) && isReliabilityId(value.unit.key) && (value.unit.kind === "process" || value.unit.kind === "service")) && record3(value.recoveryLimits) && isReliabilityCounter(value.recoveryLimits.maxProcessRestarts) && isReliabilityCounter(value.recoveryLimits.maxServiceRestarts) && isReliabilityCounter(value.recoveryLimits.windowSeconds) && value.recoveryLimits.windowSeconds > 0 && (value.activeElapsedMs === null || isReliabilityCounter(value.activeElapsedMs));
       break;
     case "rearm":
       valid = isReliabilityId(value.incidentId);
@@ -9494,7 +10138,10 @@ function cloneOperation(operation) {
   return { ...operation };
 }
 function cloneIncident(incident) {
-  return { ...incident };
+  return {
+    ...incident,
+    ...incident.units ? { units: incident.units.map((unit) => ({ ...unit })) } : {}
+  };
 }
 function cloneState(state) {
   return {
@@ -9546,6 +10193,12 @@ function possibleDispatch(operation) {
 function pendingCommand(operation) {
   return operation !== null && !["COMPLETED", "NOT_LAUNCHED", "INTERRUPTED"].includes(operation.status);
 }
+function retirableEntryIndex(state) {
+  const latestEnsureId = [...state.operationHistory].reverse().find((entry) => entry.kind === "ensure")?.id;
+  return state.operationHistory.findIndex(
+    (entry) => entry.id !== state.operation?.id && entry.id !== latestEnsureId && entry.drained && ["COMPLETED", "NOT_LAUNCHED", "INTERRUPTED"].includes(entry.status)
+  );
+}
 function setUnknown(operation) {
   if (!operation || !possibleDispatch(operation)) return operation;
   return { ...operation, status: "COMPLETION_UNKNOWN", exitCode: null };
@@ -9665,10 +10318,7 @@ function handleOperationRequest(state, event) {
   const rollover = state.operationHistory.length >= RELIABILITY_MAX_ITEMS;
   let retired = -1;
   if (rollover) {
-    const latestEnsureId = [...state.operationHistory].reverse().find((entry) => entry.kind === "ensure")?.id;
-    retired = state.operationHistory.findIndex(
-      (entry) => entry.id !== state.operation?.id && entry.id !== latestEnsureId && entry.drained && ["COMPLETED", "NOT_LAUNCHED", "INTERRUPTED"].includes(entry.status)
-    );
+    retired = retirableEntryIndex(state);
     if (retired === -1)
       return blocked(
         state,
@@ -9721,7 +10371,7 @@ function handleAdmission(state, event) {
     return unchanged(state, "blocked");
   }
   if (state.admission === event.result) return unchanged(state, "joined");
-  if (state.desired === "parked-for-capacity" && event.result === "admitted" && (!state.stopProof.workloadsStopped || !state.stopProof.routesRemoved))
+  if (state.desired === "parked-for-capacity" && event.result === "admitted")
     return unchanged(state, "blocked");
   state.admission = event.result;
   if (event.result === "admitted") {
@@ -9756,16 +10406,7 @@ function handleDispatchPersisted(state, event) {
       `dispatch persistence requires desired 'running' (desired='${state.desired}'); the operation outcome is unknown.`
     );
   }
-  if (state.phase === "recovering" && state.incident !== null && state.incident.correctiveActionsTaken >= state.incident.actionLimit) {
-    return unchanged(state, "blocked");
-  }
   state.operation = { ...state.operation, status: "DISPATCH_RECORDED", exitCode: null };
-  if (state.phase === "recovering" && state.incident !== null) {
-    state.incident = {
-      ...state.incident,
-      correctiveActionsTaken: state.incident.correctiveActionsTaken + 1
-    };
-  }
   return transition(state, "accepted", [effect(state, "launch", event.operationId)]);
 }
 function handleLaunched(state, event) {
@@ -9898,9 +10539,18 @@ function handlePark(state) {
   return transition(state, "accepted", [effect(state, "stop", operationId)]);
 }
 function handleResume(state, event) {
-  if (state.executionPolicy === "manual" || state.desired !== "parked-for-capacity" || !event.pressureDwellSatisfied || !state.stopProof.workloadsStopped || !state.stopProof.routesRemoved || state.consumers.length === 0 || state.admission !== "admitted" || state.profile === null || state.incident !== null && state.incident.correctiveActionsTaken >= state.incident.actionLimit || state.operation === null || !["NOT_STARTED", "COMPLETED", "INTERRUPTED"].includes(state.operation.status) || ["COMPLETED", "INTERRUPTED"].includes(state.operation.status) && event.operationId === state.operation.id) {
+  if (state.executionPolicy === "manual" || state.desired !== "parked-for-capacity" || !event.pressureDwellSatisfied || !state.stopProof.workloadsStopped || !state.stopProof.routesRemoved || state.consumers.length === 0 || state.profile === null || state.incident !== null && state.incident.correctiveActionsTaken >= state.incident.actionLimit || state.operation === null || !["NOT_STARTED", "COMPLETED", "INTERRUPTED"].includes(state.operation.status) || ["COMPLETED", "INTERRUPTED"].includes(state.operation.status) && event.operationId === state.operation.id) {
     return unchanged(state, "blocked");
   }
+  if (state.operationHistory.some((entry) => entry.id === event.operationId))
+    return unchanged(state, "conflict");
+  const rollover = state.operationHistory.length >= RELIABILITY_MAX_ITEMS;
+  const retired = rollover ? retirableEntryIndex(state) : -1;
+  if (rollover && retired === -1)
+    return blocked(
+      state,
+      `journal holds ${state.operationHistory.length} entries and every retirable entry is the current operation or the latest ensure.`
+    );
   const intentRevision = advance(state.intentRevision);
   const runtimeGeneration = advance(state.runtimeGeneration);
   if (intentRevision === null || runtimeGeneration === null) return unchanged(state, "blocked");
@@ -9908,9 +10558,10 @@ function handleResume(state, event) {
   state.runtimeGeneration = runtimeGeneration;
   state.desired = "running";
   state.phase = "queued";
+  state.admission = "waiting";
   state.stopProof = { workloadsStopped: false, routesRemoved: false };
   state.observations = [];
-  state.chargeHeld = true;
+  state.chargeHeld = false;
   state.operation = {
     id: event.operationId,
     kind: "ensure",
@@ -9923,6 +10574,13 @@ function handleResume(state, event) {
     operationId: event.operationId,
     intentRevision
   }));
+  if (retired !== -1) state.operationHistory.splice(retired, 1);
+  state.operationHistory.push({
+    ...state.operation,
+    key: event.operationId,
+    profile: state.profile,
+    consumer: cloneConsumer(state.consumers[0])
+  });
   return transition(state, "accepted");
 }
 function handleGenerationChange(state, kind, nextValue) {
@@ -9941,9 +10599,10 @@ function handleGenerationChange(state, kind, nextValue) {
   }
   return transition(state, "accepted");
 }
-function handleRecover(state, event) {
+function handleRecover(state, event, nowMs) {
   if (state.executionPolicy === "manual" || state.desired !== "running")
     return unchanged(state, "blocked");
+  if (state.phase === "stopping") return unchanged(state, "blocked");
   if (possibleDispatch(state.operation)) return unchanged(state, "blocked");
   const stranded = state.operation?.drained === true && ["NOT_STARTED", "NOT_LAUNCHED"].includes(state.operation.status);
   const operation = stranded ? null : state.operation;
@@ -9961,37 +10620,58 @@ function handleRecover(state, event) {
       return unchanged(state, "blocked");
     }
   }
-  if (state.incident === null) {
-    if (operation?.status === "NOT_STARTED") return unchanged(state, "blocked");
-    if (operation?.id === event.operationId) return unchanged(state, "conflict");
-    state.incident = {
-      id: event.incidentId,
-      correctiveActionsTaken: 0,
-      actionLimit: event.actionLimit
-    };
-  }
-  if (!operation || operation.status === "COMPLETED" || operation.status === "INTERRUPTED") {
-    const runtimeGeneration = advance(state.runtimeGeneration);
-    if (runtimeGeneration === null) return unchanged(state, "blocked");
-    const consumer = state.consumers[0];
-    if (state.profile === null || consumer === void 0) return unchanged(state, "blocked");
-    if (state.operationHistory.length >= RELIABILITY_MAX_ITEMS) return unchanged(state, "blocked");
-    state.runtimeGeneration = runtimeGeneration;
-    state.observations = [];
-    state.operation = {
-      id: event.operationId,
-      kind: "ensure",
-      drained: false,
-      status: "NOT_STARTED",
-      exitCode: null
-    };
-    state.operationHistory.push({
-      ...state.operation,
-      key: event.operationId,
-      profile: state.profile,
-      consumer: cloneConsumer(consumer)
-    });
-  }
+  const createsIncident = state.incident === null;
+  const replaceable = operation === null || operation.drained && (operation.status === "COMPLETED" || operation.status === "INTERRUPTED" && operation.kind === "ensure");
+  if (!replaceable) return unchanged(state, "blocked");
+  const consumer = state.consumers[0];
+  if (state.profile === null || consumer === void 0) return unchanged(state, "blocked");
+  if (state.operation?.id === event.operationId || state.operationHistory.some(
+    (entry) => entry.id === event.operationId || entry.key === event.operationId
+  ))
+    return unchanged(state, "conflict");
+  const runtimeGeneration = advance(state.runtimeGeneration);
+  if (runtimeGeneration === null) return unchanged(state, "blocked");
+  const rollover = state.operationHistory.length >= RELIABILITY_MAX_ITEMS;
+  const retired = rollover ? retirableEntryIndex(state) : -1;
+  if (rollover && retired === -1)
+    return blocked(
+      state,
+      `journal holds ${state.operationHistory.length} entries and every retirable entry is the current operation or the latest ensure.`
+    );
+  const incident = createsIncident ? {
+    id: event.incidentId,
+    correctiveActionsTaken: 0,
+    actionLimit: event.actionLimit
+  } : state.incident;
+  const claim2 = claimRecoveryUnit({
+    incident,
+    limits: event.recoveryLimits,
+    unit: event.unit ?? void 0,
+    nowMs,
+    activeElapsedMs: event.activeElapsedMs
+  });
+  if (!claim2.ok)
+    return blocked(
+      state,
+      `recovery budget refused the action (${claim2.reason})${event.unit ? ` for ${event.unit.kind} unit ${event.unit.key}` : ""}.`
+    );
+  state.incident = claim2.incident;
+  if (retired !== -1) state.operationHistory.splice(retired, 1);
+  state.runtimeGeneration = runtimeGeneration;
+  state.observations = [];
+  state.operation = {
+    id: event.operationId,
+    kind: "ensure",
+    drained: false,
+    status: "NOT_STARTED",
+    exitCode: null
+  };
+  state.operationHistory.push({
+    ...state.operation,
+    key: event.operationId,
+    profile: state.profile,
+    consumer: cloneConsumer(consumer)
+  });
   state.phase = "recovering";
   return transition(state, "accepted");
 }
@@ -10062,7 +10742,7 @@ function applyReliabilityEvent(state, event, nowMs) {
     case "runtime":
       return handleGenerationChange(next, "runtime", event.nextGeneration);
     case "recover":
-      return handleRecover(next, event);
+      return handleRecover(next, event, nowMs);
     case "rearm":
       return handleRearm(next, event);
   }
@@ -10086,9 +10766,64 @@ function stepReliability(state, event, nowMs) {
 
 // src/core/reliability-worker.ts
 var import_node_child_process17 = require("child_process");
-var import_node_crypto15 = require("crypto");
+var import_node_crypto16 = require("crypto");
 var import_node_fs28 = __toESM(require("fs"));
 var import_node_path33 = __toESM(require("path"));
+
+// src/core/lifecycle-progress.ts
+var ROLES = {
+  validation: "lifecycle-worker",
+  preparation: "repository-preparation",
+  provider: "provider-operation",
+  "service-start": "service-reconciliation",
+  "service-stop": "service-reconciliation",
+  "process-start": "repository-process-adapter",
+  "process-stop": "repository-process-adapter",
+  "route-publication": "lifecycle-worker",
+  "route-removal": "lifecycle-worker",
+  readiness: "lifecycle-worker",
+  rollback: "lifecycle-worker",
+  stop: "lifecycle-stop"
+};
+function isLifecycleProgressPhase(value) {
+  return typeof value === "string" && Object.hasOwn(ROLES, value);
+}
+var sender;
+function installLifecycleProgressSender(send) {
+  let active = true;
+  let pending = false;
+  let latest;
+  const report = (phase) => {
+    if (!active || !isLifecycleProgressPhase(phase)) return;
+    if (pending) {
+      latest = phase;
+      return;
+    }
+    pending = true;
+    try {
+      send({ lifecycleProgress: phase }, () => {
+        pending = false;
+        const next = latest;
+        latest = void 0;
+        if (active && next) report(next);
+      });
+    } catch {
+      pending = false;
+      latest = void 0;
+    }
+  };
+  sender = report;
+  return () => {
+    active = false;
+    latest = void 0;
+    if (sender === report) sender = void 0;
+  };
+}
+function reportLifecycleProgress(phase) {
+  sender?.(phase);
+}
+
+// src/core/reliability-worker.ts
 var DEFAULT_OUTPUT_PAGE_BYTES = 48 * 1024;
 function workerGroupAbsent(pid) {
   try {
@@ -10796,7 +11531,7 @@ async function runManagedHostPreparation(repoPath, config) {
 
 // src/core/managed-post-start.ts
 var import_node_child_process22 = require("child_process");
-var import_node_crypto16 = require("crypto");
+var import_node_crypto17 = require("crypto");
 var import_node_fs31 = __toESM(require("fs"));
 var import_node_path36 = __toESM(require("path"));
 var MANAGED_MARKER = "devrouter:managed devcontainer";
@@ -10853,7 +11588,7 @@ function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
 }
 function adapterFingerprint(adapter) {
-  return (0, import_node_crypto16.createHash)("sha256").update(adapter).digest("hex");
+  return (0, import_node_crypto17.createHash)("sha256").update(adapter).digest("hex");
 }
 function resolveProcessHelperPath() {
   const candidates = [
@@ -11006,6 +11741,56 @@ function runManagedProcessAction(options) {
 }
 
 // src/core/managed-runtime-status.ts
+function reliabilityRecovery(reason2, repoPath) {
+  switch (reason2) {
+    case "stop-incomplete":
+    case "operation-unknown":
+      return [`Run: devrouter stop ${repoPath}`, `Run: devrouter ensure ${repoPath} --repair`];
+    case "unadmittable":
+      return [
+        `Run: devrouter stop ${repoPath}`,
+        `Lower the requested capacity in .devrouter.yml, then run: devrouter ensure ${repoPath}`
+      ];
+    case "capacity-parked":
+      return [`Run: devrouter ensure ${repoPath} (waits for capacity to free up)`];
+    case "capacity-waiting":
+      return [`Run: devrouter ensure ${repoPath} (still queued until capacity frees up)`];
+    default:
+      return [];
+  }
+}
+function readReliabilityStatus(options) {
+  let provider;
+  try {
+    provider = resolveWorkspaceRuntimeForReport(options.repoPath);
+  } catch {
+    return void 0;
+  }
+  if (!provider) return void 0;
+  let record5;
+  try {
+    record5 = readReliabilityOperation({
+      repoPath: options.repoPath,
+      workspace: options.workspace ?? null,
+      provider
+    });
+  } catch {
+    return void 0;
+  }
+  if (!record5) return void 0;
+  const reason2 = reliabilityAttention(record5.state);
+  return {
+    desired: record5.state.desired,
+    phase: record5.state.phase,
+    admission: record5.state.admission,
+    chargeHeld: record5.state.chargeHeld,
+    incident: record5.state.incident ? {
+      correctiveActionsTaken: record5.state.incident.correctiveActionsTaken,
+      actionLimit: record5.state.incident.actionLimit
+    } : null,
+    ...reason2 ? { attention: { reason: reason2, recovery: reliabilityRecovery(reason2, options.repoPath) } } : {}
+  };
+}
 var EMPTY_RESOURCES = {
   apps: [],
   services: [],
@@ -11405,10 +12190,15 @@ function collectManagedRuntimeStatus(options) {
     services: inspection.activeServices,
     processes: inspection.activeProcesses
   };
+  const reliability = readReliabilityStatus({
+    repoPath: options.repoPath,
+    ...options.workspace !== void 0 ? { workspace: options.workspace } : {}
+  });
   return {
     mode: "managed",
     status,
     profile: options.profile,
+    ...reliability ? { reliability } : {},
     ...state?.profile ? { activeProfile: state.profile } : {},
     ...options.workspace !== void 0 ? { workspace: options.workspace } : {},
     ...state?.devpodId ? { devpodId: state.devpodId } : {},
@@ -11706,10 +12496,10 @@ function inspectLegacyNetworkCapacity(input) {
 }
 
 // src/core/network-managed.ts
-var import_node_crypto19 = require("crypto");
+var import_node_crypto20 = require("crypto");
 
 // src/core/network-compose.ts
-var import_node_crypto17 = require("crypto");
+var import_node_crypto18 = require("crypto");
 var SAFE_ENDPOINT_UPPER_BOUND_SEMANTICS = "full-lifecycle-demand";
 function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -12515,12 +13305,12 @@ function stableValue(value) {
 }
 function fingerprintComposeNetworkModel(input) {
   const projection = normalizedFingerprintProjection(input);
-  return (0, import_node_crypto17.createHash)("sha256").update(stableValue(projection), "utf8").digest("hex");
+  return (0, import_node_crypto18.createHash)("sha256").update(stableValue(projection), "utf8").digest("hex");
 }
 
 // src/core/network-compose-files.ts
 var import_node_child_process25 = require("child_process");
-var import_node_crypto18 = require("crypto");
+var import_node_crypto19 = require("crypto");
 var import_node_fs33 = __toESM(require("fs"));
 var import_node_path38 = __toESM(require("path"));
 var import_yaml4 = __toESM(require("yaml"));
@@ -12621,7 +13411,7 @@ ${JSON.stringify(extended.config, null, 2)}
     ...plan,
     contents,
     composeFiles: [...plan.composeFiles, overlayPath],
-    effectiveConfigSha256: (0, import_node_crypto18.createHash)("sha256").update(contents).digest("hex")
+    effectiveConfigSha256: (0, import_node_crypto19.createHash)("sha256").update(contents).digest("hex")
   };
   return {
     plan: result,
@@ -12939,7 +13729,7 @@ function createManagedNetworkSession(input) {
           "Insufficient endpoint headroom; request an allowed larger network before first allocation."
         );
       const authority = readNetworkOperationAuthority(identity2);
-      const fingerprint = (0, import_node_crypto19.createHash)("sha256").update(input.plan().sourceConfigSha256).update(fingerprintComposeNetworkModel(model)).digest("hex");
+      const fingerprint = (0, import_node_crypto20.createHash)("sha256").update(input.plan().sourceConfigSha256).update(fingerprintComposeNetworkModel(model)).digest("hex");
       if (!saved) {
         if (policy.status !== "valid")
           throw new Error("New network allocation requires valid machine policy.");
@@ -13595,6 +14385,15 @@ function resolveRepairTarget(repoPath, linked) {
   }
   return { kind: "primary", devpodId: state.devpodId, hadExactDevpod: true };
 }
+var RepairBaselineMismatchError = class extends Error {
+  constructor(reasons) {
+    super(
+      `Repair requires the recorded profile, resource sets, and unchanged managed configuration. [MANAGED_REPAIR_BASELINE_MISMATCH: ${reasons.join(", ")}] Inspect the retained baseline before choosing recovery; missing routes do not prove configuration ownership.`
+    );
+    this.reasons = reasons;
+  }
+  code = "MANAGED_REPAIR_BASELINE_MISMATCH";
+};
 function assertRepairBaseline(options) {
   const { repoPath, target, state, plan, config, profile, processes } = options;
   const desired = {
@@ -13602,14 +14401,23 @@ function assertRepairBaseline(options) {
     services: plan.desiredProfileServices,
     processes
   };
-  if (state.profile !== profile || state.sourceConfigSha256 !== plan.sourceConfigSha256 || state.effectiveConfigSha256 !== plan.effectiveConfigSha256 || Object.keys(desired).some((key) => {
-    const resource = key;
-    return JSON.stringify([...desired[resource]].sort()) !== JSON.stringify([...state.desired[resource]].sort());
-  }) || inspectManagedDevcontainerGeneratedConfig(plan).status !== "valid") {
-    throw new Error(
-      "Repair requires the recorded profile, resource sets, and unchanged managed configuration."
-    );
+  const reasons = [];
+  if (state.profile !== profile) reasons.push("profile");
+  if (state.sourceConfigSha256 !== plan.sourceConfigSha256) reasons.push("source-config");
+  if (state.effectiveConfigSha256 !== plan.effectiveConfigSha256) reasons.push("effective-config");
+  for (const resource of ["apps", "services", "processes"]) {
+    if (JSON.stringify([...desired[resource]].sort()) !== JSON.stringify([...state.desired[resource]].sort())) {
+      reasons.push(resource);
+    }
   }
+  if (reasons.length > 0) throw new RepairBaselineMismatchError(reasons);
+  let generated;
+  try {
+    generated = inspectManagedDevcontainerGeneratedConfig(plan).status;
+  } catch {
+    throw new RepairBaselineMismatchError(["generated-unavailable"]);
+  }
+  if (generated !== "valid") throw new RepairBaselineMismatchError([`generated-${generated}`]);
   if (options.routes.some(
     (route) => route.workspace !== target.workspace || !desired.apps.includes(route.name)
   )) {
@@ -13766,6 +14574,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       ...options.repair ? { allowRestart: false } : {}
     };
     try {
+      reportLifecycleProgress("validation");
       const target = options.repair ? resolveRepairTarget(repoPath, linked) : linked ? resolveLinkedTarget(repoPath) : resolvePrimaryTarget(repoPath);
       let devpodId = target.devpodId;
       if (target.kind === "linked") {
@@ -13826,6 +14635,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         });
         managedWorkspaceEnv = target.kind === "linked" ? { token: target.workspace, gitCommonDir: target.gitCommonDir } : void 0;
         if (previousManagedState && isWarmWorkspaceActive(repoPath) && previousManagedState.sourceConfigSha256 !== managedPlan.sourceConfigSha256) {
+          if (options.repair) throw new RepairBaselineMismatchError(["source-config"]);
           throw new Error(
             `Managed Dev Container source configuration changed since the last successful transition; a warm ensure cannot apply it to the existing runtime for '${repoPath}'. Stop and delete the exact runtime, then run ensure again to recreate it from the current source configuration.`
           );
@@ -13936,6 +14746,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       const upstreamHosts = parsedUpstreams.map((upstream) => upstream.host);
       const currentTarget = () => target.kind === "linked" ? target : { ...target, devpodId };
       const startAndProveAttachment = async (recreate = false) => {
+        reportLifecycleProgress("provider");
         const requestedTarget = currentTarget();
         try {
           devpodId = await startDevpodWorkspace({
@@ -13991,6 +14802,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
             if (stopped.length > 0) {
               repairMutationStarted = true;
               transitionPhase = "service-start";
+              reportLifecycleProgress("service-start");
               claimLifecycleEffect();
               const result = (0, import_node_child_process27.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
                 ...networkDockerOptions(),
@@ -14028,6 +14840,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       managedContainer = container;
       if (managedPlan) {
         transitionPhase = "service-start";
+        reportLifecycleProgress("service-start");
         const initialContainers = inspectWorkspaceContainers();
         managedComposeProject = resolveComposeProject(
           initialContainers,
@@ -14163,6 +14976,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       if (options.repair && managedPlan)
         assertRetainedRepairContainers(repoPath, managedPlan, retainedRepairContainers);
       transitionPhase = "process-start";
+      reportLifecycleProgress("process-start");
       claimLifecycleEffect();
       runManagedPostStart({
         plan: managedPostStart,
@@ -14187,6 +15001,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
             }
             continue;
           }
+          reportLifecycleProgress("process-stop");
           claimLifecycleEffect();
           runManagedProcessAction({
             container,
@@ -14207,6 +15022,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           }
         }
         transitionPhase = "service-stop";
+        reportLifecycleProgress("service-stop");
         if (!options.repair)
           stopDroppedManagedServices(managedPlan, repoPath, managedComposeProject);
         assertDroppedManagedServicesStopped(managedPlan, repoPath, managedComposeProject);
@@ -14220,6 +15036,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         );
       }
       transitionPhase = "route-publication";
+      reportLifecycleProgress("route-publication");
       claimLifecycleEffect();
       const publication = await replacePublishedProxyRoutes(
         repoPath,
@@ -14237,6 +15054,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       );
       let applicationReadiness;
       try {
+        reportLifecycleProgress("readiness");
         applicationReadiness = await waitForHttpRoutes(
           repoPath,
           apps,
@@ -14464,6 +15282,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         const rollbackErrors = [];
         const failedPhase = transitionPhase;
         transitionPhase = "rollback";
+        reportLifecycleProgress("rollback");
         const previousServices = previousManagedState?.desired.services ?? firstTransitionBaseline?.services ?? [];
         const previousProcesses = previousManagedState?.desired.processes ?? firstTransitionBaseline?.processes ?? [];
         const previousServiceSet = new Set(previousServices);
@@ -14695,6 +15514,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       repair: Boolean(options.repair)
     });
     if (preparationConfig.managedRuntime?.devcontainer.prepareCommand) {
+      reportLifecycleProgress("preparation");
       claimLifecycleEffect();
       await runManagedHostPreparation(repoPath, preparationConfig);
       claimLifecycleEffect();
@@ -15003,7 +15823,7 @@ function proveLifecycleStopped() {
     throw new Error("Full stop proof requires an explicit stop worker.");
   const settle = () => {
     claimLifecycleEffect();
-    if (initialStopAbsence && !(0, import_node_util6.isDeepStrictEqual)(
+    if (initialStopAbsence && !(0, import_node_util7.isDeepStrictEqual)(
       proveInitialManagedDevsyAbsence(request.repoPath, initialStopAbsence.record.devpodId),
       initialStopAbsence
     ))
@@ -15052,7 +15872,7 @@ function proveLifecycleStopped() {
       return void 0;
     });
     if (settlement) {
-      const capacity = new CapacityStore(import_node_path40.default.join(DEVROUTER_HOME, "controller"));
+      const capacity = createLifecycleCapacityStore(import_node_path40.default.join(DEVROUTER_HOME, "controller"));
       for (let attempt = 0; ; attempt++) {
         try {
           capacity.settleEnvironmentAfterStop(settlement, capacity.read().revision);
@@ -15213,7 +16033,7 @@ async function devpodExecOutcome(repoPath, command) {
     }
     assertRunningDevpod(devpod.id, repoPath);
     const workspaceDirectory = resolveWorkspaceDirectory(repoPath);
-    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto21.randomUUID)()}__:`;
+    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto22.randomUUID)()}__:`;
     const statusMarkerBytes = Buffer.from(statusMarker, "ascii");
     const literalCommand = command.map(quotePosixArg).join(" ");
     const wrappedCommand = `${literalCommand}; __devrouter_status=$?; printf '${statusMarker}%s\\n' "$__devrouter_status" >&2; exit 0`;
@@ -15529,6 +16349,7 @@ async function workspaceDeleteOwnedPath(worktreePath, opts = {}) {
 
 // src/core/environment-stop.ts
 async function environmentStop(repoPath, options = {}) {
+  reportLifecycleProgress("stop");
   const linked = isLinkedWorktree(repoPath);
   const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
   if (linked && !workspace) {
@@ -15579,6 +16400,7 @@ async function environmentStop(repoPath, options = {}) {
     const removedRoutes = removeHostRoutesWhere(
       (route) => sameWorkspacePath(route.repoPath, repoPath)
     );
+    reportLifecycleProgress("route-removal");
     await ensureTraefikRoutesRemoved(removedRoutes);
     return {
       kind: linked ? "linked" : "primary",
@@ -15604,6 +16426,10 @@ process.on("disconnect", cancel);
 process.once("message", async (message) => {
   started = true;
   let result;
+  const stopProgress = message.request.kind === "exec" ? void 0 : installLifecycleProgressSender((progress, done) => {
+    if (process.connected && process.send) process.send(progress, () => done());
+    else done();
+  });
   try {
     const request = message.request;
     const value = await executeLifecycleWorker(request, async () => {
@@ -15641,6 +16467,8 @@ process.once("message", async (message) => {
     } catch {
     }
     result = { ok: false, message: error instanceof Error ? error.message : String(error) };
+  } finally {
+    stopProgress?.();
   }
   if (process.connected && process.send) process.send(result, () => process.disconnect());
 });