@devrouter/cli 0.1.2 → 0.1.3

package/dist/devrouter-lifecycle-worker.js

@@ -23,7 +23,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/core/devpod-exec.ts
-var import_node_child_process29 = require("child_process");
+var import_node_child_process30 = require("child_process");
 var import_node_crypto23 = require("crypto");
 
 // src/core/devpod-environment.ts
@@ -1164,7 +1164,11 @@ function listDevpodWorkspacesRaw(options = {}) {
   }
   if (result.error || result.status !== 0) {
     const details = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
-    throw new Error(`devpod list failed: ${details || "devpod is not installed or unavailable"}`);
+    const failure = new Error(
+      `devpod list failed: ${details || "devpod is not installed or unavailable"}`
+    );
+    if (result.error) failure.code = result.error.code;
+    throw failure;
   }
   let parsed;
   try {
@@ -1303,9 +1307,11 @@ function listDevsyWorkspaces() {
   );
   if (result.status !== 0) {
     const details = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
-    throw new Error(
+    const failure = new Error(
       `devsy workspace list failed: ${details || "devsy is not installed or unavailable"}`
     );
+    if (result.error) failure.code = result.error.code;
+    throw failure;
   }
   let parsed;
   try {
@@ -1775,25 +1781,23 @@ function readWorkspaceRuntimeConfig() {
   }
   return config;
 }
+function readRegistrySnapshot(runtime, read2, snapshots) {
+  try {
+    return read2();
+  } catch (error) {
+    if (error?.code === "ENOENT") return void 0;
+    snapshots.unavailable.push(runtime);
+    snapshots.errors[runtime] = error instanceof Error ? error.message : String(error);
+    return void 0;
+  }
+}
 function getWorkspaceRegistrySnapshots() {
   if (cachedSnapshots) return cachedSnapshots;
   const snapshots = { unavailable: [], errors: {} };
-  if (isRuntimeInstalled("devsy")) {
-    try {
-      snapshots.devsy = listDevsyWorkspaces();
-    } catch (error) {
-      snapshots.unavailable.push("devsy");
-      snapshots.errors.devsy = error instanceof Error ? error.message : String(error);
-    }
-  }
-  if (isRuntimeInstalled("devpod")) {
-    try {
-      snapshots.devpod = listDevpodWorkspacesRaw();
-    } catch (error) {
-      snapshots.unavailable.push("devpod");
-      snapshots.errors.devpod = error instanceof Error ? error.message : String(error);
-    }
-  }
+  const devsy = readRegistrySnapshot("devsy", listDevsyWorkspaces, snapshots);
+  if (devsy !== void 0) snapshots.devsy = devsy;
+  const devpod = readRegistrySnapshot("devpod", listDevpodWorkspacesRaw, snapshots);
+  if (devpod !== void 0) snapshots.devpod = devpod;
   cachedSnapshots = snapshots;
   return snapshots;
 }
@@ -1954,7 +1958,7 @@ function selectDevpodWorkspace(workspaces, repoPath) {
 }
 
 // src/core/devsy-exec.ts
-var import_node_child_process28 = require("child_process");
+var import_node_child_process29 = require("child_process");
 
 // src/core/devsy-exec-proof.ts
 var import_node_fs7 = __toESM(require("fs"));
@@ -4040,11 +4044,19 @@ function absentRegistrationIdentity(state) {
   resetWorkspaceRuntimeCaches();
   if (resolveWorkspaceRuntimeOrDefault(state.repoPath) !== "devsy")
     throw new Error("Stop provider changed.");
-  if (!state.workspace || !isLinkedWorktree(state.repoPath))
-    throw new Error("Absent stop requires a linked workspace.");
-  const record5 = readWorkspaceOwnership(state.repoPath, state.workspace);
-  if (!record5 || record5.workspace !== state.workspace || record5.devpodId !== state.devpodId || !sameWorkspacePath(record5.worktreePath, state.repoPath) || resolveWorktreeWorkspace(state.repoPath) !== state.workspace || inspectWorkspaceOwnership(record5, listGitWorktrees(state.repoPath), void 0).ownerStatus !== "present")
-    throw new Error("Absent stop workspace ownership changed.");
+  const linked = isLinkedWorktree(state.repoPath);
+  if (linked !== (state.workspace !== void 0))
+    throw new Error("Absent stop requires the exact workspace identity.");
+  let identity2;
+  if (linked) {
+    const workspace = state.workspace;
+    const record5 = readWorkspaceOwnership(state.repoPath, workspace);
+    if (!record5 || record5.workspace !== workspace || record5.devpodId !== state.devpodId || !sameWorkspacePath(record5.worktreePath, state.repoPath) || resolveWorktreeWorkspace(state.repoPath) !== workspace || inspectWorkspaceOwnership(record5, listGitWorktrees(state.repoPath), void 0).ownerStatus !== "present")
+      throw new Error("Absent stop workspace ownership changed.");
+    identity2 = { kind: "linked", record: record5, gitCommonDir: resolveGitCommonDir(state.repoPath) };
+  } else {
+    identity2 = { kind: "primary", repoPath: state.repoPath, devpodId: state.devpodId };
+  }
   for (const entries of [
     listDevsyWorkspaces(),
     listDevpodWorkspacesRaw({ allowMissingExecutable: true })
@@ -4054,7 +4066,7 @@ function absentRegistrationIdentity(state) {
     ))
       throw new Error("Absent stop requires both provider registrations to remain absent.");
   }
-  return { record: record5, gitCommonDir: resolveGitCommonDir(state.repoPath) };
+  return identity2;
 }
 function replacementObservation(state) {
   resetWorkspaceRuntimeCaches();
@@ -4164,7 +4176,7 @@ function proveManagedStop(state) {
     const identityKeys = ["context", "providerId", "uid", "sourcePath", "sourceContainer"];
     const current = identityOf(owner.workspace);
     const changed = identityKeys.filter((key) => baseline[key] !== current[key]);
-    if (changed.length === 0 && state.workspace !== void 0 && isLinkedWorktree(state.repoPath) && inspectManagedStopContainers(baseline.project, baseline.endpoint).length === 0) {
+    if (changed.length === 0 && inspectManagedStopContainers(baseline.project, baseline.endpoint).length === 0) {
       proveAbsentPopulationStop(state, baseline, current);
       return { status: "proven-absent", containers: [] };
     }
@@ -5361,7 +5373,7 @@ function retain(session, previous) {
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.1.2" : "0.0.0-dev";
+  return true ? "0.1.3" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -5501,6 +5513,7 @@ function validate2(record5, identity2) {
     "revision",
     "state",
     "worker",
+    "stopWorkStarted",
     "effectSequence",
     "outcome",
     "result",
@@ -5682,6 +5695,9 @@ function validate2(record5, identity2) {
       throw new Error("Reliability worker identity is invalid.");
     }
   }
+  if (record5.stopWorkStarted !== void 0 && record5.stopWorkStarted !== null) {
+    if (record5.stopWorkStarted !== true) throw new Error("Invalid stop work marker.");
+  }
 }
 var ReliabilityJournalError = class extends Error {
   constructor(cause, location, message) {
@@ -7294,7 +7310,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs18.default.rea
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.1.2" : "0.0.0-dev";
+    const cliVersion = true ? "0.1.3" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver2(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -8372,6 +8388,41 @@ function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
     throw new Error("Initial managed stop left a workload running.");
   return true;
 }
+function restoreRecordedManagedDevcontainerConfig(repoPath) {
+  const plan = recordedManagedDevcontainerRestorePlan(repoPath);
+  if (!plan) return false;
+  writeManagedDevcontainerConfig(plan);
+  if (inspectManagedDevcontainerGeneratedConfig(plan).status !== "valid") {
+    throw new Error(
+      `Managed Dev Container path '${plan.generatedPath}' could not be restored from the recorded state.`
+    );
+  }
+  return true;
+}
+function recordedManagedDevcontainerRestorePlan(repoPath) {
+  try {
+    if (!import_node_fs21.default.existsSync(import_node_path25.default.join(repoPath, ".devrouter.yml"))) return void 0;
+    const linked = isLinkedWorktree(repoPath);
+    const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
+    const state = readManagedRuntimeState(repoPath, workspace);
+    if (!state) return void 0;
+    const runtime = loadRuntimeConfig(repoPath, workspace ?? "", state.profile);
+    if (!runtime.config.managedRuntime || runtime.profile !== state.profile || runtime.workspace !== workspace)
+      return void 0;
+    const plan = inspectManagedDevcontainerConfig({
+      repoPath,
+      config: runtime.config,
+      profile: runtime.resolvedProfile,
+      linked
+    });
+    if (inspectManagedDevcontainerGeneratedConfig(plan).status !== "missing") return void 0;
+    if (plan.sourceConfigSha256 !== state.sourceConfigSha256 || plan.effectiveConfigSha256 !== state.effectiveConfigSha256)
+      return void 0;
+    return plan;
+  } catch {
+    return void 0;
+  }
+}
 function stopRetainedManagedDevsyWorkspace(options) {
   const { repoPath, devsyId } = options;
   const linked = isLinkedWorktree(repoPath);
@@ -10127,6 +10178,7 @@ function inspectExactOwnership(devsyId, worktreePath) {
 }
 function mutateOwnedDevsyWorkspace(action, devsyId, worktreePath) {
   return withMutationLock(`Devsy ${action}`, worktreePath, () => {
+    restoreRecordedManagedDevcontainerConfig(worktreePath);
     if (action === "stop") {
       const stopped = stopRetainedManagedDevsyWorkspace({
         repoPath: worktreePath,
@@ -10647,7 +10699,7 @@ function handleOperationRequest(state, event) {
   if (state.phase === "stopping" || state.desired === "parked-for-capacity")
     return blocked(
       state,
-      `phase is '${state.phase}' with desired '${state.desired}'; wait for the running stop to finish.`
+      `phase is '${state.phase}' with desired '${state.desired}'; wait for the running stop to finish, or when no stop worker is running rerun 'devrouter stop <path> --delete', removing the exact provider registration first when the stop cannot prove the recorded population.`
     );
   if (event.kind === "exec" && (!event.runtimeRunning || state.desired !== "running" && state.intentRevision !== 0))
     return blocked(
@@ -11174,7 +11226,7 @@ function workerGroupAbsent(pid) {
 }
 
 // src/core/workspace-ensure.ts
-var import_node_child_process27 = require("child_process");
+var import_node_child_process28 = require("child_process");
 var import_node_fs34 = __toESM(require("fs"));
 var import_node_path39 = __toESM(require("path"));
 
@@ -12082,6 +12134,96 @@ function runManagedProcessAction(options) {
   return "drifted";
 }
 
+// src/core/managed-mount-nesting.ts
+var import_node_child_process23 = require("child_process");
+var NESTED_MOUNT_REASON = "no configured mount is nested inside another configured mount";
+var UNREADABLE_MOUNT_REASON = "the container's own mount table could not be read";
+function normalizeDestination(value) {
+  const trimmed = value.trim().replace(/\/+$/, "");
+  return trimmed === "" ? "/" : trimmed;
+}
+function isNestedWithin(destination, candidate) {
+  return candidate === "/" ? destination !== "/" : destination.startsWith(`${candidate}/`);
+}
+function unescapeMountField(value) {
+  return value.replace(
+    /\\([0-7]{3})/g,
+    (_match, octal) => String.fromCharCode(Number.parseInt(octal, 8))
+  );
+}
+function parseMountinfoDestinations(text4) {
+  const destinations = /* @__PURE__ */ new Set();
+  for (const line of text4.split("\n")) {
+    const fields2 = line.split(" ");
+    if (fields2.length < 5 || !/^\d+$/.test(fields2[0] ?? "")) continue;
+    destinations.add(normalizeDestination(unescapeMountField(fields2[4] ?? "")));
+  }
+  return [...destinations];
+}
+function isNestedIndex(destinations, index) {
+  return destinations.some(
+    (candidate, other) => other !== index && isNestedWithin(destinations[index] ?? "", candidate)
+  );
+}
+function configuredDestinations(configured) {
+  return configured.map((mount) => normalizeDestination(mount.Destination));
+}
+function classifyManagedMountNesting(configured, effectiveDestinations, containerId) {
+  const destinations = configuredDestinations(configured);
+  const nested = configured.filter((_mount, index) => isNestedIndex(destinations, index));
+  const identity2 = containerId ? { container: containerId } : {};
+  if (nested.length === 0) {
+    return { status: "not-applicable", checked: [], unwound: [], reason: NESTED_MOUNT_REASON };
+  }
+  if (effectiveDestinations === null) {
+    return {
+      status: "unverified",
+      checked: [],
+      unwound: [],
+      ...identity2,
+      reason: UNREADABLE_MOUNT_REASON
+    };
+  }
+  const effective = new Set(effectiveDestinations.map(normalizeDestination));
+  const checked = [];
+  const unwound = [];
+  for (const mount of nested) {
+    const destination = normalizeDestination(mount.Destination);
+    if (effective.has(destination)) {
+      checked.push(mount.Destination);
+      continue;
+    }
+    const nestedWithin = destinations.filter((candidate) => isNestedWithin(destination, candidate)).sort((a, b) => a.length - b.length)[0];
+    unwound.push({
+      destination: mount.Destination,
+      source: mount.Source,
+      nestedWithin: nestedWithin ?? "/"
+    });
+  }
+  return {
+    status: unwound.length > 0 ? "unwound" : "effective",
+    checked,
+    unwound,
+    ...identity2
+  };
+}
+function readContainerMountinfo(containerId, options) {
+  const result = (0, import_node_child_process23.spawnSync)("docker", ["exec", containerId, "cat", "/proc/self/mountinfo"], {
+    encoding: "utf-8",
+    timeout: options.timeoutMs ?? 5e3,
+    stdio: ["ignore", "pipe", "pipe"],
+    ...networkDockerOptions()
+  });
+  if (result.status !== 0 || typeof result.stdout !== "string") return null;
+  const destinations = parseMountinfoDestinations(result.stdout);
+  return destinations.length > 0 ? destinations : null;
+}
+function observeManagedMountNesting(container, options = {}) {
+  const destinations = configuredDestinations(container.mounts);
+  const effective = destinations.some((_destination, index) => isNestedIndex(destinations, index)) ? readContainerMountinfo(container.id, options) : null;
+  return classifyManagedMountNesting(container.mounts, effective, container.id);
+}
+
 // src/core/managed-runtime-status.ts
 function recoveryPath(repoPath) {
   if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(repoPath)) return repoPath;
@@ -12362,6 +12504,7 @@ function inspectManagedRuntime(options) {
     (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
   )?.Destination;
   const primaryActive = Boolean(primary?.state.Running);
+  const mountNesting = primary && primaryActive ? observeManagedMountNesting(primary) : void 0;
   if (generatedConfigMissing && (state || primaryActive || managedServicesActive)) {
     drift.push("managed generated Dev Container configuration is missing");
   }
@@ -12428,7 +12571,8 @@ function inspectManagedRuntime(options) {
     processStatuses,
     activeServices: sortedUnique(activeServices),
     activeProcesses: sortedUnique(activeProcesses),
-    drift
+    drift,
+    ...mountNesting ? { mountNesting } : {}
   };
 }
 function collectManagedRuntimeStatus(options) {
@@ -12576,6 +12720,7 @@ function collectManagedRuntimeStatus(options) {
     baseServiceStatuses: inspection.baseStatuses,
     processStatuses: inspection.processStatuses,
     drift: sortedUnique(drift),
+    ...inspection.mountNesting ? { mountNesting: inspection.mountNesting } : {},
     ...inspection.plan?.sourceConfigSha256 || state?.sourceConfigSha256 ? { sourceConfigSha256: inspection.plan?.sourceConfigSha256 ?? state?.sourceConfigSha256 } : {},
     ...inspection.plan?.effectiveConfigSha256 || state?.effectiveConfigSha256 ? {
       effectiveConfigSha256: inspection.plan?.effectiveConfigSha256 ?? state?.effectiveConfigSha256
@@ -12585,19 +12730,19 @@ function collectManagedRuntimeStatus(options) {
 }
 
 // src/core/network-inventory.ts
-var import_node_child_process23 = require("child_process");
+var import_node_child_process24 = require("child_process");
 var NetworkInventoryError = class extends Error {
 };
 var MAX_IDS = 4096;
 var MAX_OUTPUT_BYTES = 2 * 1024 * 1024;
 var FULL_ID = /^[a-f0-9]{64}$/;
-var NETWORK_TEMPLATE = '{"id":{{json .Id}},"name":{{json .Name}},"driver":{{json .Driver}},"ipam":{{json .IPAM.Config}},"activeEndpoints":{{len .Containers}},"project":{{json (index .Labels "com.docker.compose.project")}},"network":{{json (index .Labels "com.docker.compose.network")}}';
+var NETWORK_TEMPLATE = '{"id":{{json .Id}},"name":{{json .Name}},"driver":{{json .Driver}},"ipam":{{json .IPAM.Config}},"activeEndpoints":{{len .Containers}},"project":{{json (index .Labels "com.docker.compose.project")}},"network":{{json (index .Labels "com.docker.compose.network")}}}';
 var CONTAINER_TEMPLATE = '{"id":{{json .Id}},"networks":{{json .NetworkSettings.Networks}}}';
 function readDocker(endpoint, args, timeoutMs) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process23.spawnSync)("docker", ["--host", endpoint, ...args], {
+  const result = (0, import_node_child_process24.spawnSync)("docker", ["--host", endpoint, ...args], {
     env,
     encoding: "utf-8",
     timeout: timeoutMs,
@@ -12628,7 +12773,14 @@ function id4(value) {
 }
 function rows(output) {
   const trimmed = output.trim();
-  return trimmed ? trimmed.split(/\r?\n/).map((line) => JSON.parse(line)) : [];
+  return trimmed ? trimmed.split(/\r?\n/).map((line) => parseRecord(line)) : [];
+}
+function parseRecord(line) {
+  try {
+    return JSON.parse(line);
+  } catch {
+    throw new NetworkInventoryError("Docker network inventory contains a malformed record.");
+  }
 }
 function ids(output) {
   const values = output.trim() ? output.trim().split(/\r?\n/).map(id4) : [];
@@ -12673,7 +12825,7 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
       return output;
     };
     const info = record4(
-      JSON.parse(
+      parseRecord(
         read2(["info", "--format", '{"id":{{json .ID}},"pools":{{json .DefaultAddressPools}}}'])
       )
     );
@@ -12754,7 +12906,7 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
 }
 
 // src/core/network-routes.ts
-var import_node_child_process24 = require("child_process");
+var import_node_child_process25 = require("child_process");
 var import_node_net3 = require("net");
 
 // src/core/network-local-daemon.ts
@@ -12823,7 +12975,7 @@ function parseLinuxNetworkRoutes(output) {
 function collectNetworkRoutes(options) {
   if ((options.platform ?? process.platform) !== "linux" || !hasLocalDockerNetworkNamespace(options.endpoint))
     return { status: "unknown", routes: [] };
-  const result = (0, import_node_child_process24.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
+  const result = (0, import_node_child_process25.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
     encoding: "utf8",
     timeout: 5e3,
     maxBuffer: 1024 * 1024
@@ -13672,7 +13824,7 @@ function fingerprintComposeNetworkModel(input) {
 }
 
 // src/core/network-compose-files.ts
-var import_node_child_process25 = require("child_process");
+var import_node_child_process26 = require("child_process");
 var import_node_crypto20 = require("crypto");
 var import_node_fs33 = __toESM(require("fs"));
 var import_node_path38 = __toESM(require("path"));
@@ -13709,7 +13861,7 @@ function inspectNetworkComposeFiles(input) {
   const env = managedComposeEnvironment(input.workspace);
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process25.spawnSync)(
+  const result = (0, import_node_child_process26.spawnSync)(
     "docker",
     [
       "--host",
@@ -13744,7 +13896,7 @@ function prepareNetworkComposeFiles(plan, subnet) {
   const overlay = deriveComposeNetworkOverlay(subnet);
   if (overlay.status !== "ready" || !overlay.overlay) throw new Error("Network subnet is invalid.");
   const overlayPath = import_node_path38.default.join(plan.composeDirectory, OVERLAY);
-  const ignored = (0, import_node_child_process25.spawnSync)("git", [
+  const ignored = (0, import_node_child_process26.spawnSync)("git", [
     "-C",
     plan.composeDirectory,
     "check-ignore",
@@ -13786,7 +13938,7 @@ ${JSON.stringify(extended.config, null, 2)}
 }
 
 // src/core/network-connected-route.ts
-var import_node_child_process26 = require("child_process");
+var import_node_child_process27 = require("child_process");
 function bounds(cidr) {
   const canonical = parseIPv4Cidr(cidr);
   if (!canonical) throw new Error("Invalid connected route.");
@@ -13811,7 +13963,7 @@ function inspectClaimedBridge(claim2, networkId) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process26.spawnSync)(
+  const result = (0, import_node_child_process27.spawnSync)(
     "docker",
     [
       "--host",
@@ -13838,7 +13990,7 @@ function inspectClaimedBridge(claim2, networkId) {
     const [first, last] = bounds(claim2.subnet);
     const [address] = bounds(gateway);
     if (address <= first || address >= last) throw new Error();
-    const interfaces = (0, import_node_child_process26.spawnSync)("ip", ["-j", "-d", "-4", "address", "show", "dev", bridge], {
+    const interfaces = (0, import_node_child_process27.spawnSync)("ip", ["-j", "-d", "-4", "address", "show", "dev", bridge], {
       encoding: "utf8",
       timeout: 5e3,
       maxBuffer: 65536
@@ -14594,7 +14746,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
         target
       });
       if (target.kind === "linked") {
-        const workspaceEnv = (0, import_node_child_process27.spawnSync)(
+        const workspaceEnv = (0, import_node_child_process28.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "WORKSPACE"],
           { encoding: "utf-8", ...networkDockerOptions() }
@@ -14604,7 +14756,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
             `Workspace app container must expose WORKSPACE='${target.workspace}' (got '${workspaceEnv.stdout.trim() || "(empty)"}').`
           );
         }
-        const devrouterWorkspaceEnv = (0, import_node_child_process27.spawnSync)(
+        const devrouterWorkspaceEnv = (0, import_node_child_process28.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "DEVROUTER_WORKSPACE"],
           { encoding: "utf-8", ...networkDockerOptions() }
@@ -14615,7 +14767,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
           );
         }
       }
-      const gitCheck = (0, import_node_child_process27.spawnSync)(
+      const gitCheck = (0, import_node_child_process28.spawnSync)(
         "docker",
         [
           "exec",
@@ -14895,7 +15047,7 @@ function isPrimaryCheckout(repoPath) {
 }
 function openUrls(urls) {
   for (const url of urls) {
-    const opened = (0, import_node_child_process27.spawnSync)("open", [url], { encoding: "utf-8" });
+    const opened = (0, import_node_child_process28.spawnSync)("open", [url], { encoding: "utf-8" });
     if (opened.status !== 0) {
       process.stderr.write(`Warning: could not open '${url}'.
 `);
@@ -15178,7 +15330,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
               transitionPhase = "service-start";
               reportLifecycleProgress("service-start");
               claimLifecycleEffect();
-              const result = (0, import_node_child_process27.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
+              const result = (0, import_node_child_process28.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
                 ...networkDockerOptions(),
                 encoding: "utf-8",
                 timeout: DEFAULT_READINESS_TIMEOUT_MS,
@@ -16122,6 +16274,11 @@ async function executeLifecycleWorker(request, operation) {
           ];
           for (const project of stopProjects) inspectManagedStopContainers(project);
         }
+        updateReliabilityOperation(request.identity, (record5) => {
+          if (!matchesFence(record5, request.fence))
+            throw new Error("Lifecycle intent changed before stop work began.");
+          record5.stopWorkStarted = true;
+        });
       } else {
         updateReliabilityOperation(request.identity, (record5) => {
           stepRecord(record5, {
@@ -16233,6 +16390,7 @@ function proveLifecycleStopped() {
     const settlement = updateReliabilityOperation(request.identity, (record5) => {
       if (!matchesFence(record5, request.fence) || record5.worker)
         throw new Error("Stop proof was superseded or an earlier worker remains.");
+      delete record5.stopWorkStarted;
       if (record5.version === 2) {
         if (record5.capacity) record5.capacity.validUntilMs = 0;
         return record5.state.environmentId;
@@ -16271,6 +16429,7 @@ function proveLifecycleStopped() {
         if (!matchesFence(record5, request.fence) || record5.worker || record5.state.environmentId !== settlement || record5.capacity && record5.capacity.validUntilMs !== 0)
           throw new Error("Capacity settlement was superseded before journal confirmation.");
         record5.capacity = null;
+        delete record5.stopWorkStarted;
         if (record5.enrollment) {
           record5.phaseSettlement = null;
           record5.activeProfile = null;
@@ -16324,7 +16483,7 @@ async function devsyExecOutcome(repoPath, command, retainedProof) {
         const launch = () => {
           if (retainedProof) revalidateDevsyExecProof(repoPath, retainedProof);
           claimLifecycleEffect();
-          return (0, import_node_child_process28.spawn)("devsy", args, { stdio: "inherit" });
+          return (0, import_node_child_process29.spawn)("devsy", args, { stdio: "inherit" });
         };
         child = retainedProof ? withMutationLock("Execute retained workspace", repoPath, launch) : launch();
       } catch (error) {
@@ -16372,7 +16531,7 @@ function ensureGuidance2(repoPath) {
   return `Run 'devrouter ensure ${repoPath}' first.`;
 }
 function assertRunningDevpod(devpodId, repoPath) {
-  const result = (0, import_node_child_process29.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
+  const result = (0, import_node_child_process30.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -16551,7 +16710,7 @@ async function devpodExecOutcome(repoPath, command) {
       let child;
       try {
         claimLifecycleEffect();
-        child = (0, import_node_child_process29.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
+        child = (0, import_node_child_process30.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
       } catch (error) {
         settled = true;
         reject(
@@ -16608,7 +16767,7 @@ async function devpodExecOutcome(repoPath, command) {
 }
 
 // src/core/workspace-lifecycle.ts
-var import_node_child_process30 = require("child_process");
+var import_node_child_process31 = require("child_process");
 var import_node_fs36 = __toESM(require("fs"));
 var import_node_path41 = __toESM(require("path"));