@devrouter/cli 0.1.2 → 0.2.0

package/dist/devrouter-lifecycle-worker.js

@@ -23,7 +23,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/core/devpod-exec.ts
-var import_node_child_process29 = require("child_process");
+var import_node_child_process32 = require("child_process");
 var import_node_crypto23 = require("crypto");
 
 // src/core/devpod-environment.ts
@@ -1164,7 +1164,11 @@ function listDevpodWorkspacesRaw(options = {}) {
   }
   if (result.error || result.status !== 0) {
     const details = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
-    throw new Error(`devpod list failed: ${details || "devpod is not installed or unavailable"}`);
+    const failure = new Error(
+      `devpod list failed: ${details || "devpod is not installed or unavailable"}`
+    );
+    if (result.error) failure.code = result.error.code;
+    throw failure;
   }
   let parsed;
   try {
@@ -1303,9 +1307,11 @@ function listDevsyWorkspaces() {
   );
   if (result.status !== 0) {
     const details = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
-    throw new Error(
+    const failure = new Error(
       `devsy workspace list failed: ${details || "devsy is not installed or unavailable"}`
     );
+    if (result.error) failure.code = result.error.code;
+    throw failure;
   }
   let parsed;
   try {
@@ -1775,25 +1781,23 @@ function readWorkspaceRuntimeConfig() {
   }
   return config;
 }
+function readRegistrySnapshot(runtime, read2, snapshots) {
+  try {
+    return read2();
+  } catch (error) {
+    if (error?.code === "ENOENT") return void 0;
+    snapshots.unavailable.push(runtime);
+    snapshots.errors[runtime] = error instanceof Error ? error.message : String(error);
+    return void 0;
+  }
+}
 function getWorkspaceRegistrySnapshots() {
   if (cachedSnapshots) return cachedSnapshots;
   const snapshots = { unavailable: [], errors: {} };
-  if (isRuntimeInstalled("devsy")) {
-    try {
-      snapshots.devsy = listDevsyWorkspaces();
-    } catch (error) {
-      snapshots.unavailable.push("devsy");
-      snapshots.errors.devsy = error instanceof Error ? error.message : String(error);
-    }
-  }
-  if (isRuntimeInstalled("devpod")) {
-    try {
-      snapshots.devpod = listDevpodWorkspacesRaw();
-    } catch (error) {
-      snapshots.unavailable.push("devpod");
-      snapshots.errors.devpod = error instanceof Error ? error.message : String(error);
-    }
-  }
+  const devsy = readRegistrySnapshot("devsy", listDevsyWorkspaces, snapshots);
+  if (devsy !== void 0) snapshots.devsy = devsy;
+  const devpod = readRegistrySnapshot("devpod", listDevpodWorkspacesRaw, snapshots);
+  if (devpod !== void 0) snapshots.devpod = devpod;
   cachedSnapshots = snapshots;
   return snapshots;
 }
@@ -1954,7 +1958,7 @@ function selectDevpodWorkspace(workspaces, repoPath) {
 }
 
 // src/core/devsy-exec.ts
-var import_node_child_process28 = require("child_process");
+var import_node_child_process31 = require("child_process");
 
 // src/core/devsy-exec-proof.ts
 var import_node_fs7 = __toESM(require("fs"));
@@ -2042,9 +2046,9 @@ function revalidateDevsyExecProof(repoPath, proof) {
 }
 
 // src/core/devsy-mutation.ts
-var import_node_child_process16 = require("child_process");
-var import_node_fs25 = __toESM(require("fs"));
-var import_node_path29 = __toESM(require("path"));
+var import_node_child_process18 = require("child_process");
+var import_node_fs26 = __toESM(require("fs"));
+var import_node_path30 = __toESM(require("path"));
 
 // src/core/devsy-agent.ts
 var import_node_child_process9 = require("child_process");
@@ -2320,9 +2324,9 @@ function requireReadyDevsyAgent(options = {}) {
 }
 
 // src/core/managed-devsy-stop.ts
-var import_node_fs21 = __toESM(require("fs"));
+var import_node_fs22 = __toESM(require("fs"));
 var import_node_os5 = __toESM(require("os"));
-var import_node_path25 = __toESM(require("path"));
+var import_node_path26 = __toESM(require("path"));
 var import_node_util5 = require("util");
 
 // src/core/devcontainer-profile.ts
@@ -4040,11 +4044,19 @@ function absentRegistrationIdentity(state) {
   resetWorkspaceRuntimeCaches();
   if (resolveWorkspaceRuntimeOrDefault(state.repoPath) !== "devsy")
     throw new Error("Stop provider changed.");
-  if (!state.workspace || !isLinkedWorktree(state.repoPath))
-    throw new Error("Absent stop requires a linked workspace.");
-  const record5 = readWorkspaceOwnership(state.repoPath, state.workspace);
-  if (!record5 || record5.workspace !== state.workspace || record5.devpodId !== state.devpodId || !sameWorkspacePath(record5.worktreePath, state.repoPath) || resolveWorktreeWorkspace(state.repoPath) !== state.workspace || inspectWorkspaceOwnership(record5, listGitWorktrees(state.repoPath), void 0).ownerStatus !== "present")
-    throw new Error("Absent stop workspace ownership changed.");
+  const linked = isLinkedWorktree(state.repoPath);
+  if (linked !== (state.workspace !== void 0))
+    throw new Error("Absent stop requires the exact workspace identity.");
+  let identity2;
+  if (linked) {
+    const workspace = state.workspace;
+    const record5 = readWorkspaceOwnership(state.repoPath, workspace);
+    if (!record5 || record5.workspace !== workspace || record5.devpodId !== state.devpodId || !sameWorkspacePath(record5.worktreePath, state.repoPath) || resolveWorktreeWorkspace(state.repoPath) !== workspace || inspectWorkspaceOwnership(record5, listGitWorktrees(state.repoPath), void 0).ownerStatus !== "present")
+      throw new Error("Absent stop workspace ownership changed.");
+    identity2 = { kind: "linked", record: record5, gitCommonDir: resolveGitCommonDir(state.repoPath) };
+  } else {
+    identity2 = { kind: "primary", repoPath: state.repoPath, devpodId: state.devpodId };
+  }
   for (const entries of [
     listDevsyWorkspaces(),
     listDevpodWorkspacesRaw({ allowMissingExecutable: true })
@@ -4054,7 +4066,7 @@ function absentRegistrationIdentity(state) {
     ))
       throw new Error("Absent stop requires both provider registrations to remain absent.");
   }
-  return { record: record5, gitCommonDir: resolveGitCommonDir(state.repoPath) };
+  return identity2;
 }
 function replacementObservation(state) {
   resetWorkspaceRuntimeCaches();
@@ -4164,7 +4176,7 @@ function proveManagedStop(state) {
     const identityKeys = ["context", "providerId", "uid", "sourcePath", "sourceContainer"];
     const current = identityOf(owner.workspace);
     const changed = identityKeys.filter((key) => baseline[key] !== current[key]);
-    if (changed.length === 0 && state.workspace !== void 0 && isLinkedWorktree(state.repoPath) && inspectManagedStopContainers(baseline.project, baseline.endpoint).length === 0) {
+    if (changed.length === 0 && inspectManagedStopContainers(baseline.project, baseline.endpoint).length === 0) {
       proveAbsentPopulationStop(state, baseline, current);
       return { status: "proven-absent", containers: [] };
     }
@@ -5361,7 +5373,7 @@ function retain(session, previous) {
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.1.2" : "0.0.0-dev";
+  return true ? "0.2.0" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -5501,6 +5513,7 @@ function validate2(record5, identity2) {
     "revision",
     "state",
     "worker",
+    "stopWorkStarted",
     "effectSequence",
     "outcome",
     "result",
@@ -5682,6 +5695,9 @@ function validate2(record5, identity2) {
       throw new Error("Reliability worker identity is invalid.");
     }
   }
+  if (record5.stopWorkStarted !== void 0 && record5.stopWorkStarted !== null) {
+    if (record5.stopWorkStarted !== true) throw new Error("Invalid stop work marker.");
+  }
 }
 var ReliabilityJournalError = class extends Error {
   constructor(cause, location, message) {
@@ -6018,8 +6034,8 @@ function clearStartupWitness(identity2, fence) {
 
 // src/core/repo-config.ts
 var import_node_crypto10 = require("crypto");
-var import_node_fs18 = __toESM(require("fs"));
-var import_node_path22 = __toESM(require("path"));
+var import_node_fs19 = __toESM(require("fs"));
+var import_node_path23 = __toESM(require("path"));
 var import_yaml3 = __toESM(require("yaml"));
 
 // src/core/capabilities.ts
@@ -6044,6 +6060,44 @@ function formatSupportedTcpProtocols() {
   return SUPPORTED_TCP_PROTOCOLS.join(", ");
 }
 
+// src/core/worktree-safety.ts
+var import_node_child_process13 = require("child_process");
+var import_node_fs18 = __toESM(require("fs"));
+var import_node_path22 = __toESM(require("path"));
+
+// src/core/forge-changes.ts
+var import_node_child_process12 = require("child_process");
+
+// src/core/worktree-safety.ts
+var WORKTREE_LOCAL_SAFETY_CODES = [
+  "git-error",
+  "detached",
+  "index-lock",
+  "operation-in-progress",
+  "submodule",
+  "dirty",
+  "untracked",
+  "ignored-state"
+];
+var WORKTREE_SAFETY_CODES = [
+  ...WORKTREE_LOCAL_SAFETY_CODES,
+  "primary",
+  "locked",
+  "runtime-present",
+  "forge-not-checked",
+  "forge-unavailable",
+  "no-change",
+  "change-open",
+  "change-closed",
+  "head-beyond-merge",
+  "active"
+];
+var DISPOSABLE_OVERRIDE_FILE = import_node_path22.default.join("info", "worktree-reclaim-disposable");
+function isValidWorktreePattern(pattern) {
+  if (!pattern || pattern.startsWith("/") || pattern.includes("\\")) return false;
+  return pattern.split("/").every((segment) => segment && segment !== "." && segment !== "..");
+}
+
 // src/core/repo-config.ts
 function compareSemver2(a, b) {
   const parse2 = (v) => {
@@ -6878,6 +6932,7 @@ function parseConfig(raw, configPath) {
       "managedRuntime",
       "profiles",
       "capacity",
+      "worktrees",
       "apps"
     ],
     configPath
@@ -6952,6 +7007,7 @@ function parseConfig(raw, configPath) {
   const managedRuntime = parseManagedRuntime(root.managedRuntime, configPath);
   const profiles = parseProfiles(root.profiles, configPath, apps, managedRuntime);
   const capacity = parseCapacityEstimates(root.capacity, configPath, profiles);
+  const worktrees = parseWorktreesConfig(root.worktrees, configPath);
   return {
     version: 1,
     ...devrouter ? { devrouter } : {},
@@ -6960,9 +7016,30 @@ function parseConfig(raw, configPath) {
     ...managedRuntime ? { managedRuntime } : {},
     ...profiles ? { profiles } : {},
     ...capacity ? { capacity } : {},
+    ...worktrees ? { worktrees } : {},
     apps
   };
 }
+function parseWorktreesConfig(value, configPath) {
+  if (value === void 0) return void 0;
+  const raw = ensureObject(value, `${configPath}.worktrees`);
+  ensureAllowedKeys(raw, ["disposable", "trim"], `${configPath}.worktrees`);
+  const result = {};
+  for (const key of ["disposable", "trim"]) {
+    if (raw[key] === void 0) continue;
+    const label = `${configPath}.worktrees.${key}`;
+    if (!Array.isArray(raw[key])) throw new Error(`${label} must be an array of patterns.`);
+    result[key] = raw[key].map((pattern, index) => {
+      if (typeof pattern !== "string" || !isValidWorktreePattern(pattern)) {
+        throw new Error(
+          `${label}[${index}] must be a worktree-relative pattern without '..' or a leading '/'.`
+        );
+      }
+      return pattern;
+    });
+  }
+  return result;
+}
 var PROFILE_NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
 var MAX_PROFILES = 32;
 function parseProfiles(value, configPath, apps, managedRuntime) {
@@ -7276,15 +7353,15 @@ function applyProfile(config, profile) {
   return next;
 }
 function resolveRepoPath(repoPath) {
-  return import_node_path22.default.resolve(repoPath ?? process.cwd());
+  return import_node_path23.default.resolve(repoPath ?? process.cwd());
 }
 function getRepoConfigPath(repoPath) {
-  return import_node_path22.default.join(resolveRepoPath(repoPath), CONFIG_FILE_NAME);
+  return import_node_path23.default.join(resolveRepoPath(repoPath), CONFIG_FILE_NAME);
 }
-function loadRepoConfig(repoPath, read2 = (file) => import_node_fs18.default.readFileSync(file, "utf-8")) {
+function loadRepoConfig(repoPath, read2 = (file) => import_node_fs19.default.readFileSync(file, "utf-8")) {
   const resolvedRepoPath = resolveRepoPath(repoPath);
   const configPath = getRepoConfigPath(resolvedRepoPath);
-  if (!import_node_fs18.default.existsSync(configPath)) {
+  if (!import_node_fs19.default.existsSync(configPath)) {
     throw new Error(
       `Missing ${CONFIG_FILE_NAME} in ${resolvedRepoPath}. Run 'dev repo init --repo ${resolvedRepoPath}' first.`
     );
@@ -7294,7 +7371,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs18.default.rea
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.1.2" : "0.0.0-dev";
+    const cliVersion = true ? "0.2.0" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver2(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -7314,7 +7391,7 @@ function namespaceHost(host, workspace) {
   return `${base}.${workspace}${suffix}`;
 }
 function applyWorkspace(config, workspace, repoPath) {
-  const defaultToken = wsFromBranch(config.project?.name ?? import_node_path22.default.basename(import_node_path22.default.resolve(repoPath))) ?? "app";
+  const defaultToken = wsFromBranch(config.project?.name ?? import_node_path23.default.basename(import_node_path23.default.resolve(repoPath))) ?? "app";
   const substitutionToken = workspace ?? defaultToken;
   const next = structuredClone(config);
   for (const app of next.apps) {
@@ -7387,7 +7464,7 @@ function resolveAppDependencies(config, app) {
 }
 
 // src/core/docker.ts
-var import_node_child_process12 = require("child_process");
+var import_node_child_process14 = require("child_process");
 var dockerodeConstructorPromise = null;
 async function getDockerodeConstructor() {
   if (!dockerodeConstructorPromise) {
@@ -7399,7 +7476,7 @@ async function getDockerodeConstructor() {
   return dockerodeConstructorPromise;
 }
 function runDockerContextCommand(args) {
-  const result = (0, import_node_child_process12.spawnSync)("docker", ["context", ...args], {
+  const result = (0, import_node_child_process14.spawnSync)("docker", ["context", ...args], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -7412,7 +7489,7 @@ function getCurrentDockerContext() {
   return runDockerContextCommand(["show"]);
 }
 function getDockerHostFromContext(context) {
-  const result = (0, import_node_child_process12.spawnSync)(
+  const result = (0, import_node_child_process14.spawnSync)(
     "docker",
     ["context", "inspect", context, "--format", "{{ .Endpoints.docker.Host }}"],
     { encoding: "utf-8" }
@@ -7472,16 +7549,16 @@ async function ensureNetwork(name) {
 }
 
 // src/core/tls.ts
-var import_node_child_process13 = require("child_process");
+var import_node_child_process15 = require("child_process");
 var import_node_crypto11 = require("crypto");
-var import_node_fs19 = __toESM(require("fs"));
-var import_node_path23 = __toESM(require("path"));
+var import_node_fs20 = __toESM(require("fs"));
+var import_node_path24 = __toESM(require("path"));
 var DEFAULT_TLS_CERT_HOSTS = ["localhost", "*.localhost"];
-var TLS_CERTIFICATE_LOCK_FILE = import_node_path23.default.join(DEVROUTER_HOME, "tls-certificate.lock");
+var TLS_CERTIFICATE_LOCK_FILE = import_node_path24.default.join(DEVROUTER_HOME, "tls-certificate.lock");
 var TLS_CERTIFICATE_LOCK_WAIT_MS = 6e4;
 var TLS_CERTIFICATE_WRITE_ATTEMPTS = 2;
 function runOrThrow(command, args) {
-  const result = (0, import_node_child_process13.spawnSync)(command, args, {
+  const result = (0, import_node_child_process15.spawnSync)(command, args, {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -7491,7 +7568,7 @@ function runOrThrow(command, args) {
   return result.stdout.trim();
 }
 function commandExists(command) {
-  const result = (0, import_node_child_process13.spawnSync)("sh", ["-c", `command -v ${command}`], { encoding: "utf-8" });
+  const result = (0, import_node_child_process15.spawnSync)("sh", ["-c", `command -v ${command}`], { encoding: "utf-8" });
   return result.status === 0;
 }
 function ensureMkcert() {
@@ -7509,8 +7586,8 @@ function tlsSetupCommand(repoPath) {
 }
 function getMkcertRootCAPath(options = {}) {
   ensureMkcert();
-  const rootCAPath = import_node_path23.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
-  if (!import_node_fs19.default.existsSync(rootCAPath)) {
+  const rootCAPath = import_node_path24.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
+  if (!import_node_fs20.default.existsSync(rootCAPath)) {
     throw new Error(
       `mkcert root CA was not found at '${rootCAPath}'. Run: ${tlsSetupCommand(options.repoPath)}`
     );
@@ -7611,11 +7688,11 @@ function compactTLSCertificateHosts(hosts) {
   );
 }
 function readCurrentCertificateHosts(options = {}) {
-  if (!import_node_fs19.default.existsSync(CERT_FILE)) {
+  if (!import_node_fs20.default.existsSync(CERT_FILE)) {
     return [];
   }
   try {
-    const pem = import_node_fs19.default.readFileSync(CERT_FILE, "utf-8");
+    const pem = import_node_fs20.default.readFileSync(CERT_FILE, "utf-8");
     return parseCertificateDnsHosts(pem);
   } catch (error) {
     if (options.replaceMalformed) {
@@ -7807,11 +7884,11 @@ async function replacePublishedProxyRoutes(repoPath, config, workspace, options
 }
 
 // src/core/traefik-route-health.ts
-var import_node_child_process14 = require("child_process");
-var import_node_fs20 = __toESM(require("fs"));
-var import_node_path24 = __toESM(require("path"));
+var import_node_child_process16 = require("child_process");
+var import_node_fs21 = __toESM(require("fs"));
+var import_node_path25 = __toESM(require("path"));
 var ROUTER_API_BASE = "http://127.0.0.1:8080/api";
-var ROUTER_RELOAD_LOCK_FILE = import_node_path24.default.join(DEVROUTER_HOME, "router-reload.lock");
+var ROUTER_RELOAD_LOCK_FILE = import_node_path25.default.join(DEVROUTER_HOME, "router-reload.lock");
 var ROUTER_API_REQUEST_TIMEOUT_SECONDS = "2";
 var DEFAULT_INITIAL_TIMEOUT_MS = 3e3;
 var DEFAULT_RECOVERY_TIMEOUT_MS = 1e4;
@@ -7821,7 +7898,7 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function inspectRouterApi(protocol) {
-  const result = (0, import_node_child_process14.spawnSync)(
+  const result = (0, import_node_child_process16.spawnSync)(
     "curl",
     [
       "--silent",
@@ -7869,7 +7946,7 @@ function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function inspectNamedRouterApi(protocol, resource, name) {
-  const result = (0, import_node_child_process14.spawnSync)(
+  const result = (0, import_node_child_process16.spawnSync)(
     "curl",
     [
       "--silent",
@@ -8080,7 +8157,7 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
     throw new Error(
       "Traefik routes did not reload; shared router restart is disabled for this operation."
     );
-  import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs21.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     ROUTER_RELOAD_LOCK_FILE,
     {
@@ -8146,7 +8223,7 @@ function proveInitialManagedDevsyAbsence(repoPath, expectedId) {
   if (!isLinkedWorktree(repoPath)) return void 0;
   const workspace = resolveWorktreeWorkspace(repoPath);
   if (!workspace || readManagedRuntimeState(repoPath, workspace)) return void 0;
-  if (!import_node_fs21.default.existsSync(import_node_path25.default.join(repoPath, ".devrouter.yml"))) return void 0;
+  if (!import_node_fs22.default.existsSync(import_node_path26.default.join(repoPath, ".devrouter.yml"))) return void 0;
   const runtime = loadRuntimeConfig(repoPath, workspace);
   if (!runtime.config.managedRuntime) return void 0;
   const routes = proxyAppsFromConfig(runtime.config).flatMap(
@@ -8206,7 +8283,7 @@ function proveInitialManagedDevsyAbsence(repoPath, expectedId) {
   };
 }
 function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
-  if (!import_node_fs21.default.existsSync(import_node_path25.default.join(repoPath, ".devrouter.yml"))) return false;
+  if (!import_node_fs22.default.existsSync(import_node_path26.default.join(repoPath, ".devrouter.yml"))) return false;
   if (!loadRepoConfig(repoPath).managedRuntime) return false;
   const linked = isLinkedWorktree(repoPath);
   const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
@@ -8263,8 +8340,8 @@ function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
     profile: runtime.resolvedProfile,
     linked
   });
-  const providerRoot = import_node_path25.default.resolve(process.env.DEVSY_HOME || import_node_path25.default.join(import_node_os5.default.homedir(), ".devsy"));
-  const featureDirectory = import_node_path25.default.join(
+  const providerRoot = import_node_path26.default.resolve(process.env.DEVSY_HOME || import_node_path26.default.join(import_node_os5.default.homedir(), ".devsy"));
+  const featureDirectory = import_node_path26.default.join(
     providerRoot,
     "contexts",
     owner.context,
@@ -8372,6 +8449,41 @@ function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
     throw new Error("Initial managed stop left a workload running.");
   return true;
 }
+function restoreRecordedManagedDevcontainerConfig(repoPath) {
+  const plan = recordedManagedDevcontainerRestorePlan(repoPath);
+  if (!plan) return false;
+  writeManagedDevcontainerConfig(plan);
+  if (inspectManagedDevcontainerGeneratedConfig(plan).status !== "valid") {
+    throw new Error(
+      `Managed Dev Container path '${plan.generatedPath}' could not be restored from the recorded state.`
+    );
+  }
+  return true;
+}
+function recordedManagedDevcontainerRestorePlan(repoPath) {
+  try {
+    if (!import_node_fs22.default.existsSync(import_node_path26.default.join(repoPath, ".devrouter.yml"))) return void 0;
+    const linked = isLinkedWorktree(repoPath);
+    const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
+    const state = readManagedRuntimeState(repoPath, workspace);
+    if (!state) return void 0;
+    const runtime = loadRuntimeConfig(repoPath, workspace ?? "", state.profile);
+    if (!runtime.config.managedRuntime || runtime.profile !== state.profile || runtime.workspace !== workspace)
+      return void 0;
+    const plan = inspectManagedDevcontainerConfig({
+      repoPath,
+      config: runtime.config,
+      profile: runtime.resolvedProfile,
+      linked
+    });
+    if (inspectManagedDevcontainerGeneratedConfig(plan).status !== "missing") return void 0;
+    if (plan.sourceConfigSha256 !== state.sourceConfigSha256 || plan.effectiveConfigSha256 !== state.effectiveConfigSha256)
+      return void 0;
+    return plan;
+  } catch {
+    return void 0;
+  }
+}
 function stopRetainedManagedDevsyWorkspace(options) {
   const { repoPath, devsyId } = options;
   const linked = isLinkedWorktree(repoPath);
@@ -8441,7 +8553,7 @@ function stopRetainedManagedDevsyWorkspace(options) {
       const owned = inspectWorkspaceContainers().filter(
         (container) => sameWorkspacePath(
           container.labels["com.docker.compose.project.working_dir"] ?? "",
-          import_node_path25.default.join(repoPath, ".devcontainer")
+          import_node_path26.default.join(repoPath, ".devcontainer")
         )
       );
       if (owned.length !== 0) {
@@ -8470,8 +8582,8 @@ function stopRetainedManagedDevsyWorkspace(options) {
   if (!context || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(context) || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(devsyId)) {
     throw new Error("Managed stop requires a valid exact Devsy context and workspace ID.");
   }
-  const devsyRoot = import_node_path25.default.resolve(process.env.DEVSY_HOME || import_node_path25.default.join(import_node_os5.default.homedir(), ".devsy"));
-  const featureDirectory = import_node_path25.default.join(
+  const devsyRoot = import_node_path26.default.resolve(process.env.DEVSY_HOME || import_node_path26.default.join(import_node_os5.default.homedir(), ".devsy"));
+  const featureDirectory = import_node_path26.default.join(
     devsyRoot,
     "contexts",
     context,
@@ -8610,13 +8722,13 @@ function networkProviderEnvironment(binding, source) {
 
 // src/core/network-claim-lookup.ts
 var import_node_crypto13 = require("crypto");
-var import_node_fs24 = __toESM(require("fs"));
-var import_node_path28 = __toESM(require("path"));
+var import_node_fs25 = __toESM(require("fs"));
+var import_node_path29 = __toESM(require("path"));
 
 // src/core/network-claims.ts
 var import_node_crypto12 = require("crypto");
-var import_node_fs23 = __toESM(require("fs"));
-var import_node_path27 = __toESM(require("path"));
+var import_node_fs24 = __toESM(require("fs"));
+var import_node_path28 = __toESM(require("path"));
 
 // src/core/network-capacity.ts
 var import_node_net = require("net");
@@ -8957,10 +9069,10 @@ function overlaps(left, right) {
 }
 
 // src/core/network-policy.ts
-var import_node_fs22 = __toESM(require("fs"));
-var import_node_path26 = __toESM(require("path"));
+var import_node_fs23 = __toESM(require("fs"));
+var import_node_path27 = __toESM(require("path"));
 var NETWORK_POLICY_VERSION = 1;
-var NETWORK_POLICY_FILE = import_node_path26.default.join(DEVROUTER_HOME, "network-policy.json");
+var NETWORK_POLICY_FILE = import_node_path27.default.join(DEVROUTER_HOME, "network-policy.json");
 var DEFAULT_NETWORK_POLICY_ENDPOINT_RESERVE = 8;
 var NETWORK_POLICY_PREFIX_LENGTHS = [24, 25, 26];
 var MAX_NETWORK_POLICY_FILE_BYTES = 64 * 1024;
@@ -9153,7 +9265,7 @@ function hasControlCharacter(value) {
 function readPolicyFile(filePath) {
   let initialStats;
   try {
-    initialStats = import_node_fs22.default.lstatSync(filePath);
+    initialStats = import_node_fs23.default.lstatSync(filePath);
   } catch (error) {
     if (isErrno(error, "ENOENT")) return { status: "absent" };
     return { status: "invalid", error: "network policy could not be read" };
@@ -9166,16 +9278,16 @@ function readPolicyFile(filePath) {
   }
   let fileDescriptor;
   try {
-    fileDescriptor = import_node_fs22.default.openSync(
+    fileDescriptor = import_node_fs23.default.openSync(
       filePath,
-      import_node_fs22.default.constants.O_RDONLY | import_node_fs22.default.constants.O_NONBLOCK | (import_node_fs22.default.constants.O_NOFOLLOW ?? 0)
+      import_node_fs23.default.constants.O_RDONLY | import_node_fs23.default.constants.O_NONBLOCK | (import_node_fs23.default.constants.O_NOFOLLOW ?? 0)
     );
   } catch (error) {
     if (isErrno(error, "ENOENT")) return { status: "absent" };
     return { status: "invalid", error: "network policy could not be read" };
   }
   try {
-    const openedStats = import_node_fs22.default.fstatSync(fileDescriptor);
+    const openedStats = import_node_fs23.default.fstatSync(fileDescriptor);
     if (!openedStats.isFile()) {
       return { status: "invalid", error: "network policy must be a regular file" };
     }
@@ -9188,12 +9300,12 @@ function readPolicyFile(filePath) {
     const buffer = Buffer.alloc(openedStats.size);
     let offset = 0;
     while (offset < buffer.length) {
-      const bytesRead = import_node_fs22.default.readSync(fileDescriptor, buffer, offset, buffer.length - offset, null);
+      const bytesRead = import_node_fs23.default.readSync(fileDescriptor, buffer, offset, buffer.length - offset, null);
       if (bytesRead === 0)
         return { status: "invalid", error: "network policy changed during read" };
       offset += bytesRead;
     }
-    const finalStats = import_node_fs22.default.fstatSync(fileDescriptor);
+    const finalStats = import_node_fs23.default.fstatSync(fileDescriptor);
     if (!finalStats.isFile() || finalStats.size !== openedStats.size) {
       return { status: "invalid", error: "network policy changed during read" };
     }
@@ -9202,7 +9314,7 @@ function readPolicyFile(filePath) {
     return { status: "invalid", error: "network policy could not be read" };
   } finally {
     try {
-      import_node_fs22.default.closeSync(fileDescriptor);
+      import_node_fs23.default.closeSync(fileDescriptor);
     } catch {
     }
   }
@@ -9222,7 +9334,7 @@ function isErrno(error, code) {
 
 // src/core/network-claims.ts
 var NETWORK_CLAIMS_VERSION = 1;
-var NETWORK_CLAIMS_ROOT = import_node_path27.default.join(DEVROUTER_HOME, "networks");
+var NETWORK_CLAIMS_ROOT = import_node_path28.default.join(DEVROUTER_HOME, "networks");
 var NETWORK_CLAIMS_MAX_RECORDS = 256;
 var NETWORK_CLAIMS_MAX_FILE_BYTES = 512 * 1024;
 var NETWORK_CLAIMS_DEFAULT_PREFIX = 26;
@@ -9628,27 +9740,27 @@ function assertExactKeys(value, keys2) {
 function readDocument(store) {
   let descriptor;
   try {
-    descriptor = import_node_fs23.default.openSync(
+    descriptor = import_node_fs24.default.openSync(
       store.filePath,
-      import_node_fs23.default.constants.O_RDONLY | import_node_fs23.default.constants.O_NONBLOCK | (import_node_fs23.default.constants.O_NOFOLLOW ?? 0)
+      import_node_fs24.default.constants.O_RDONLY | import_node_fs24.default.constants.O_NONBLOCK | (import_node_fs24.default.constants.O_NOFOLLOW ?? 0)
     );
   } catch (error) {
     if (isErrno2(error, "ENOENT")) return void 0;
     throw claimError("invalid-state", "network claim state could not be read");
   }
   try {
-    const stat = import_node_fs23.default.fstatSync(descriptor);
+    const stat = import_node_fs24.default.fstatSync(descriptor);
     if (!stat.isFile() || stat.size > NETWORK_CLAIMS_MAX_FILE_BYTES || (stat.mode & 63) !== 0) {
       throw claimError("invalid-state", "network claim state is not a bounded private file");
     }
     const buffer = Buffer.alloc(NETWORK_CLAIMS_MAX_FILE_BYTES + 1);
     let count = 0;
     while (count < buffer.length) {
-      const bytesRead = import_node_fs23.default.readSync(descriptor, buffer, count, buffer.length - count, null);
+      const bytesRead = import_node_fs24.default.readSync(descriptor, buffer, count, buffer.length - count, null);
       if (bytesRead === 0) break;
       count += bytesRead;
     }
-    const finalStat = import_node_fs23.default.fstatSync(descriptor);
+    const finalStat = import_node_fs24.default.fstatSync(descriptor);
     if (count > NETWORK_CLAIMS_MAX_FILE_BYTES || finalStat.size !== stat.size) {
       throw claimError("invalid-state", "network claim state changed during read");
     }
@@ -9660,7 +9772,7 @@ function readDocument(store) {
     }
     return validateDocument(parsed, store.daemonId);
   } finally {
-    import_node_fs23.default.closeSync(descriptor);
+    import_node_fs24.default.closeSync(descriptor);
   }
 }
 function validateDocument(value, daemonId) {
@@ -9764,7 +9876,7 @@ function withStoreLock(daemonId, options, operation) {
   if (!Number.isSafeInteger(waitMs) || waitMs < 0 || waitMs > MAX_LOCK_WAIT_MS) {
     throw claimError("invalid-input", "network claim lock wait is invalid");
   }
-  import_node_fs23.default.mkdirSync(store.root, { recursive: true, mode: 448 });
+  import_node_fs24.default.mkdirSync(store.root, { recursive: true, mode: 448 });
   assertDirectory(store.root);
   return withFileLockSync(
     store.lockPath,
@@ -9779,23 +9891,23 @@ function createStore(daemonId, options) {
   return {
     root,
     daemonId,
-    filePath: import_node_path27.default.join(root, `${key}.json`),
-    lockPath: import_node_path27.default.join(root, `${key}.lock`),
+    filePath: import_node_path28.default.join(root, `${key}.json`),
+    lockPath: import_node_path28.default.join(root, `${key}.lock`),
     writeAtomic: options.writeAtomic ?? writeFileAtomically
   };
 }
 function validateRoot(root) {
-  if (typeof root !== "string" || !import_node_path27.default.isAbsolute(root) || root.includes("\0")) {
+  if (typeof root !== "string" || !import_node_path28.default.isAbsolute(root) || root.includes("\0")) {
     throw claimError("invalid-input", "network claim root is invalid");
   }
-  const resolved = import_node_path27.default.resolve(root);
+  const resolved = import_node_path28.default.resolve(root);
   if (resolved !== root) throw claimError("invalid-input", "network claim root is invalid");
   return resolved;
 }
 function assertDirectory(directory) {
   let stat;
   try {
-    stat = import_node_fs23.default.lstatSync(directory);
+    stat = import_node_fs24.default.lstatSync(directory);
   } catch {
     throw claimError("invalid-state", "network claim root could not be read");
   }
@@ -9830,14 +9942,14 @@ function claimError(code, message) {
 
 // src/core/network-claim-lookup.ts
 function networkOwnerKey(repoPath) {
-  if (!import_node_path28.default.isAbsolute(repoPath) || import_node_path28.default.resolve(repoPath) !== repoPath)
+  if (!import_node_path29.default.isAbsolute(repoPath) || import_node_path29.default.resolve(repoPath) !== repoPath)
     throw new Error("Invalid network owner path.");
   return (0, import_node_crypto13.createHash)("sha256").update(repoPath).digest("hex");
 }
 function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   let names;
   try {
-    names = import_node_fs24.default.readdirSync(root);
+    names = import_node_fs25.default.readdirSync(root);
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw new Error("Network claims cannot be inspected; repair is required.");
@@ -9846,21 +9958,21 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   if (files.length > 128) throw new Error("Network daemon inventory exceeds its bound.");
   let found;
   for (const file of files) {
-    const full = import_node_path28.default.join(root, file);
-    const stat = import_node_fs24.default.lstatSync(full);
+    const full = import_node_path29.default.join(root, file);
+    const stat = import_node_fs25.default.lstatSync(full);
     if (!stat.isFile() || stat.size > NETWORK_CLAIMS_MAX_FILE_BYTES)
       throw new Error("Invalid retained network claim file.");
     let value;
-    const descriptor = import_node_fs24.default.openSync(
+    const descriptor = import_node_fs25.default.openSync(
       full,
-      import_node_fs24.default.constants.O_RDONLY | import_node_fs24.default.constants.O_NONBLOCK | import_node_fs24.default.constants.O_NOFOLLOW
+      import_node_fs25.default.constants.O_RDONLY | import_node_fs25.default.constants.O_NONBLOCK | import_node_fs25.default.constants.O_NOFOLLOW
     );
     try {
-      if (!import_node_fs24.default.fstatSync(descriptor).isFile()) throw new Error();
+      if (!import_node_fs25.default.fstatSync(descriptor).isFile()) throw new Error();
       const bytes2 = Buffer.alloc(NETWORK_CLAIMS_MAX_FILE_BYTES + 1);
       let size = 0;
       while (size < bytes2.length) {
-        const count = import_node_fs24.default.readSync(descriptor, bytes2, size, bytes2.length - size, null);
+        const count = import_node_fs25.default.readSync(descriptor, bytes2, size, bytes2.length - size, null);
         if (!count) break;
         size += count;
       }
@@ -9870,7 +9982,7 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
     } catch {
       throw new Error("Retained network claim could not be read safely.");
     } finally {
-      import_node_fs24.default.closeSync(descriptor);
+      import_node_fs25.default.closeSync(descriptor);
     }
     if (typeof value.daemonId !== "string" || `${(0, import_node_crypto13.createHash)("sha256").update(value.daemonId).digest("hex")}.json` !== file)
       throw new Error("Retained network daemon identity is invalid.");
@@ -9888,7 +10000,7 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
 }
 
 // src/core/network-provider-inspect.ts
-var import_node_child_process15 = require("child_process");
+var import_node_child_process17 = require("child_process");
 var import_node_crypto14 = require("crypto");
 function object2(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
@@ -9912,7 +10024,7 @@ function qualifyNetworkProviderDefinition(value, provider) {
   return (0, import_node_crypto14.createHash)("sha256").update(JSON.stringify({ name: definition.name, agent, options, exec })).digest("hex");
 }
 function read(provider, args) {
-  const result = (0, import_node_child_process15.spawnSync)(provider, args, {
+  const result = (0, import_node_child_process17.spawnSync)(provider, args, {
     encoding: "utf8",
     timeout: 5e3,
     maxBuffer: 2 * 1024 * 1024
@@ -10026,7 +10138,7 @@ function networkProviderEffectOptions(provider, providerId, repoPath) {
 }
 
 // src/core/devsy-mutation.ts
-var DEVSY_MUTATION_LOCK_FILE = import_node_path29.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
+var DEVSY_MUTATION_LOCK_FILE = import_node_path30.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
 var DEVSY_MUTATION_WAIT_MS = 18e5;
 var DevsyStartPostconditionError = class extends Error {
 };
@@ -10041,7 +10153,7 @@ function failedStartMayHaveAttached(devsyId, repoPath) {
   }
 }
 function withMutationLock(activity, target, operation) {
-  import_node_fs25.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs26.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVSY_MUTATION_LOCK_FILE,
     {
@@ -10055,7 +10167,7 @@ function withMutationLock(activity, target, operation) {
   );
 }
 function withMutationLockAsync(activity, target, operation) {
-  import_node_fs25.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs26.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     DEVSY_MUTATION_LOCK_FILE,
     {
@@ -10076,7 +10188,7 @@ var DEVSY_STDERR_TAIL_BYTES = 8192;
 function runDevsyUp(args, env, quiet) {
   return new Promise((resolve) => {
     claimLifecycleEffect();
-    const child = (0, import_node_child_process16.spawn)("devsy", args, {
+    const child = (0, import_node_child_process18.spawn)("devsy", args, {
       stdio: ["inherit", quiet ? 2 : "inherit", "pipe"],
       env
     });
@@ -10110,7 +10222,7 @@ function runDevsyAction(action, devsyId, force = false, repoPath) {
   const args = action === "delete" ? ["delete", devsyId, ...force ? ["--force"] : [], "--ignore-not-found"] : ["stop", devsyId];
   claimLifecycleEffect();
   const binding = repoPath ? networkProviderEffectOptions("devsy", devsyId, repoPath) : { args: [] };
-  const result = (0, import_node_child_process16.spawnSync)("devsy", ["workspace", ...args, ...binding.args], {
+  const result = (0, import_node_child_process18.spawnSync)("devsy", ["workspace", ...args, ...binding.args], {
     encoding: "utf-8",
     ...binding.env ? { env: binding.env } : {}
   });
@@ -10127,6 +10239,7 @@ function inspectExactOwnership(devsyId, worktreePath) {
 }
 function mutateOwnedDevsyWorkspace(action, devsyId, worktreePath) {
   return withMutationLock(`Devsy ${action}`, worktreePath, () => {
+    restoreRecordedManagedDevcontainerConfig(worktreePath);
     if (action === "stop") {
       const stopped = stopRetainedManagedDevsyWorkspace({
         repoPath: worktreePath,
@@ -10293,21 +10406,21 @@ var ExecutionOutcomeError = class extends Error {
 
 // src/core/reliability-lifecycle.ts
 var import_node_crypto22 = require("crypto");
-var import_node_path40 = __toESM(require("path"));
+var import_node_path41 = __toESM(require("path"));
 var import_node_util7 = require("util");
 
 // src/core/capacity-policy.ts
-var import_node_fs26 = __toESM(require("fs"));
-var import_node_path30 = __toESM(require("path"));
+var import_node_fs27 = __toESM(require("fs"));
+var import_node_path31 = __toESM(require("path"));
 
 // src/core/controller-client.ts
 var import_node_crypto15 = require("crypto");
-var import_node_fs27 = __toESM(require("fs"));
+var import_node_fs28 = __toESM(require("fs"));
 var import_node_net2 = __toESM(require("net"));
-var import_node_path32 = __toESM(require("path"));
+var import_node_path33 = __toESM(require("path"));
 
 // src/core/controller-protocol.ts
-var import_node_path31 = __toESM(require("path"));
+var import_node_path32 = __toESM(require("path"));
 var CONTROLLER_FRAME_BYTES = 64 * 1024;
 var CONTROLLER_MAX_OPERATION_REQUEST_BYTES = 32 * 1024;
 var CONTROLLER_PROFILE_TOKEN_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
@@ -10647,7 +10760,7 @@ function handleOperationRequest(state, event) {
   if (state.phase === "stopping" || state.desired === "parked-for-capacity")
     return blocked(
       state,
-      `phase is '${state.phase}' with desired '${state.desired}'; wait for the running stop to finish.`
+      `phase is '${state.phase}' with desired '${state.desired}'; wait for the running stop to finish, or when no stop worker is running rerun 'devrouter stop <path> --delete', removing the exact provider registration first when the stop cannot prove the recorded population.`
     );
   if (event.kind === "exec" && (!event.runtimeRunning || state.desired !== "running" && state.intentRevision !== 0))
     return blocked(
@@ -11104,10 +11217,10 @@ function stepReliability(state, event, nowMs) {
 }
 
 // src/core/reliability-worker.ts
-var import_node_child_process17 = require("child_process");
+var import_node_child_process19 = require("child_process");
 var import_node_crypto17 = require("crypto");
-var import_node_fs28 = __toESM(require("fs"));
-var import_node_path33 = __toESM(require("path"));
+var import_node_fs29 = __toESM(require("fs"));
+var import_node_path34 = __toESM(require("path"));
 
 // src/core/lifecycle-progress.ts
 var ROLES = {
@@ -11174,20 +11287,20 @@ function workerGroupAbsent(pid) {
 }
 
 // src/core/workspace-ensure.ts
-var import_node_child_process27 = require("child_process");
-var import_node_fs34 = __toESM(require("fs"));
-var import_node_path39 = __toESM(require("path"));
+var import_node_child_process30 = require("child_process");
+var import_node_fs35 = __toESM(require("fs"));
+var import_node_path40 = __toESM(require("path"));
 
 // src/core/devpod-mutation.ts
-var import_node_child_process18 = require("child_process");
-var import_node_fs29 = __toESM(require("fs"));
-var import_node_path34 = __toESM(require("path"));
-var DEVPOD_MUTATION_LOCK_FILE = import_node_path34.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+var import_node_child_process20 = require("child_process");
+var import_node_fs30 = __toESM(require("fs"));
+var import_node_path35 = __toESM(require("path"));
+var DEVPOD_MUTATION_LOCK_FILE = import_node_path35.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
 var DEVPOD_MUTATION_WAIT_MS = 18e5;
 var DevpodStartPostconditionError = class extends Error {
 };
 function withMutationLock2(activity, target, operation) {
-  import_node_fs29.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs30.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
     {
@@ -11207,7 +11320,7 @@ function runDevpodAction(action, devpodId, force = false, repoPath) {
   const args = action === "delete" ? [action, devpodId, ...force ? ["--force"] : [], "--ignore-not-found"] : [action, devpodId];
   claimLifecycleEffect();
   const binding = repoPath ? networkProviderEffectOptions("devpod", devpodId, repoPath) : { args: [] };
-  const result = (0, import_node_child_process18.spawnSync)("devpod", [...args, ...binding.args], {
+  const result = (0, import_node_child_process20.spawnSync)("devpod", [...args, ...binding.args], {
     encoding: "utf-8",
     ...binding.env ? { env: binding.env } : {}
   });
@@ -11349,7 +11462,7 @@ async function startDevpodWorkspace(options) {
     }
     claimLifecycleEffect();
     network?.beforeDispatch?.();
-    const result = (0, import_node_child_process18.spawnSync)("devpod", args, {
+    const result = (0, import_node_child_process20.spawnSync)("devpod", args, {
       stdio: options.quiet ? ["inherit", 2, "inherit"] : "inherit",
       env
     });
@@ -11389,8 +11502,8 @@ async function startDevpodWorkspace(options) {
 }
 
 // src/core/host-port-claims.ts
-var import_node_child_process19 = require("child_process");
-var import_node_path35 = __toESM(require("path"));
+var import_node_child_process21 = require("child_process");
+var import_node_path36 = __toESM(require("path"));
 var COMPOSE_RENDER_TIMEOUT_MS = 3e4;
 var COMPOSE_RENDER_MAX_BUFFER = 8 * 1024 * 1024;
 var DOCKER_TIMEOUT_MS = 1e4;
@@ -11493,7 +11606,7 @@ function hostPortBindingsConflict(desired, holder) {
 }
 var HOST_PORT_INSPECT_TEMPLATE = '{"id":{{json .Id}},"name":{{json .Name}},"labels":{"com.docker.compose.project":{{json (index .Config.Labels "com.docker.compose.project")}},"com.docker.compose.project.working_dir":{{json (index .Config.Labels "com.docker.compose.project.working_dir")}}},"ports":{{json .NetworkSettings.Ports}}}';
 function runDocker(args) {
-  const result = (0, import_node_child_process19.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process21.spawnSync)("docker", args, {
     ...networkDockerOptions(),
     encoding: "utf-8",
     timeout: DOCKER_TIMEOUT_MS,
@@ -11563,7 +11676,7 @@ function listHolderSnapshots() {
 }
 function renderManagedComposeModel(plan, workspace) {
   const fileArgs = plan.composeFiles.flatMap((file) => ["-f", file]);
-  const result = (0, import_node_child_process19.spawnSync)(
+  const result = (0, import_node_child_process21.spawnSync)(
     "docker",
     [
       "compose",
@@ -11598,8 +11711,8 @@ function renderManagedComposeModel(plan, workspace) {
   }
 }
 function attributeHolderWorktree(workingDir) {
-  if (import_node_path35.default.basename(workingDir) !== ".devcontainer") return void 0;
-  return comparableWorkspacePath(import_node_path35.default.dirname(workingDir));
+  if (import_node_path36.default.basename(workingDir) !== ".devcontainer") return void 0;
+  return comparableWorkspacePath(import_node_path36.default.dirname(workingDir));
 }
 function holderAttribution(holder, repoPath) {
   const attribution = {};
@@ -11634,7 +11747,7 @@ function detectHostPortClaimConflicts(options) {
   );
   if (desired.length === 0) return [];
   const holders = listHolderSnapshots();
-  const devcontainerDir = import_node_path35.default.join(options.repoPath, ".devcontainer");
+  const devcontainerDir = import_node_path36.default.join(options.repoPath, ".devcontainer");
   const conflicts = [];
   for (const binding of desired) {
     for (const holder of holders) {
@@ -11658,7 +11771,7 @@ function detectHostPortClaimConflicts(options) {
 }
 
 // src/core/http-route-probe.ts
-var import_node_child_process20 = require("child_process");
+var import_node_child_process22 = require("child_process");
 var DEFAULT_MAX_TIME_SECONDS = 5;
 var PARENT_TIMEOUT_PADDING_MS = 250;
 var CONTRACT_MAX_BUFFER = 1024;
@@ -11691,7 +11804,7 @@ function probeHttpRoute(host, options = {}) {
     args.push("--cacert", CERT_FILE);
   }
   args.push(url);
-  const result = (0, import_node_child_process20.spawnSync)("curl", args, { encoding: "utf-8" });
+  const result = (0, import_node_child_process22.spawnSync)("curl", args, { encoding: "utf-8" });
   const stdout = result.stdout?.trim() ?? "";
   const status = /^\d{3}$/.test(stdout) ? Number(stdout) : void 0;
   const ok = result.status === 0 && status !== void 0 && status >= 100 && status < 500;
@@ -11710,7 +11823,7 @@ function probeHttpReadinessSync(host, readiness, maxTimeSeconds, repoPath) {
   }
   let result;
   try {
-    result = (0, import_node_child_process20.spawnSync)("curl", args, {
+    result = (0, import_node_child_process22.spawnSync)("curl", args, {
       encoding: "utf-8",
       maxBuffer: CONTRACT_MAX_BUFFER,
       timeout: Math.ceil(parentTimeoutMs)
@@ -11794,8 +11907,8 @@ function transportFailure() {
 }
 
 // src/core/managed-host-preparation.ts
-var import_node_child_process21 = require("child_process");
-var import_node_fs30 = __toESM(require("fs"));
+var import_node_child_process23 = require("child_process");
+var import_node_fs31 = __toESM(require("fs"));
 var PREPARATION_TIMEOUT_MS = 6e4;
 var CONFIG_READ_ERROR = "Managed host preparation could not read .devrouter.yml.";
 var CONFIG_CHANGED_ERROR = "Managed host preparation changed .devrouter.yml; refusing to continue.";
@@ -11806,7 +11919,7 @@ function runPreparationCommand(argv, cwd) {
   return new Promise((resolve) => {
     let child;
     try {
-      child = (0, import_node_child_process21.spawn)(argv[0], argv.slice(1), {
+      child = (0, import_node_child_process23.spawn)(argv[0], argv.slice(1), {
         cwd,
         detached: true,
         shell: false,
@@ -11838,7 +11951,7 @@ function runPreparationCommand(argv, cwd) {
 }
 function readConfigBytes(configPath) {
   try {
-    return import_node_fs30.default.readFileSync(configPath);
+    return import_node_fs31.default.readFileSync(configPath);
   } catch {
     return void 0;
   }
@@ -11872,10 +11985,10 @@ async function runManagedHostPreparation(repoPath, config) {
 }
 
 // src/core/managed-post-start.ts
-var import_node_child_process22 = require("child_process");
+var import_node_child_process24 = require("child_process");
 var import_node_crypto18 = require("crypto");
-var import_node_fs31 = __toESM(require("fs"));
-var import_node_path36 = __toESM(require("path"));
+var import_node_fs32 = __toESM(require("fs"));
+var import_node_path37 = __toESM(require("path"));
 var MANAGED_MARKER = "devrouter:managed devcontainer";
 var MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
 var RUNTIME_HELPER_PATH = "/tmp/devrouter/bin/devrouter-process";
@@ -11888,7 +12001,7 @@ function renderDeliveryScript(targetPath) {
   if (!/^\/tmp\/devrouter\/bin\/[a-zA-Z0-9._-]+$/.test(targetPath)) {
     throw new Error(`Unsafe managed runtime delivery path: ${targetPath}`);
   }
-  const temporaryPrefix = import_node_path36.default.posix.basename(targetPath);
+  const temporaryPrefix = import_node_path37.default.posix.basename(targetPath);
   return `set -eu
 umask 077
 runtime_root=/tmp/devrouter
@@ -11912,7 +12025,7 @@ function commandFailure3(result) {
   return [result.error?.message, result.stderr, result.stdout].filter(Boolean).map((value) => String(value).trim()).filter(Boolean).join("\n");
 }
 function deliverRuntimeFile(containerId, targetPath, contents, label) {
-  const result = (0, import_node_child_process22.spawnSync)(
+  const result = (0, import_node_child_process24.spawnSync)(
     "docker",
     ["exec", "-i", containerId, "sh", "-c", renderDeliveryScript(targetPath)],
     { input: contents, encoding: "utf-8", ...networkDockerOptions() }
@@ -11923,8 +12036,8 @@ function deliverRuntimeFile(containerId, targetPath, contents, label) {
   }
 }
 function readRegularFileBytes(filePath) {
-  if (!import_node_fs31.default.existsSync(filePath) || !import_node_fs31.default.lstatSync(filePath).isFile()) return void 0;
-  return import_node_fs31.default.readFileSync(filePath);
+  if (!import_node_fs32.default.existsSync(filePath) || !import_node_fs32.default.lstatSync(filePath).isFile()) return void 0;
+  return import_node_fs32.default.readFileSync(filePath);
 }
 function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
@@ -11934,21 +12047,21 @@ function adapterFingerprint(adapter) {
 }
 function resolveProcessHelperPath() {
   const candidates = [
-    import_node_path36.default.resolve(__dirname, "..", "bin", "devrouter-process"),
-    import_node_path36.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
+    import_node_path37.default.resolve(__dirname, "..", "bin", "devrouter-process"),
+    import_node_path37.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
   ];
-  const helperPath = candidates.find((candidate) => import_node_fs31.default.existsSync(candidate));
+  const helperPath = candidates.find((candidate) => import_node_fs32.default.existsSync(candidate));
   if (!helperPath) {
     throw new Error("Could not locate the packaged devrouter-process helper.");
   }
   return helperPath;
 }
 function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path36.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterPath = import_node_path37.default.join(repoPath, MANAGED_ADAPTER_PATH);
   const adapterBytes = readRegularFileBytes(adapterPath);
   const adapterText = adapterBytes?.toString("utf-8");
-  const dockerfilePath = import_node_path36.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path36.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfilePath = import_node_path37.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path37.default.join(repoPath, ".devcontainer", "devcontainer.json");
   const dockerfile = readRegularFile(dockerfilePath) ?? "";
   const devcontainer = readRegularFile(devcontainerPath) ?? "";
   const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
@@ -11989,7 +12102,7 @@ function resolveManagedPostStartPlan(repoPath) {
 }
 function runManagedPostStart(options) {
   if (options.plan.kind !== "runtime") return;
-  const helper = import_node_fs31.default.readFileSync(resolveProcessHelperPath());
+  const helper = import_node_fs32.default.readFileSync(resolveProcessHelperPath());
   deliverRuntimeFile(
     options.container.id,
     RUNTIME_HELPER_PATH,
@@ -12003,7 +12116,7 @@ function runManagedPostStart(options) {
     options.plan.adapterContents,
     "the managed post-start adapter"
   );
-  const started2 = (0, import_node_child_process22.spawnSync)(
+  const started2 = (0, import_node_child_process24.spawnSync)(
     "docker",
     [
       "exec",
@@ -12044,7 +12157,7 @@ function assertSafeProcessName(name) {
 }
 function runManagedProcessAction(options) {
   assertSafeProcessName(options.name);
-  const result = (0, import_node_child_process22.spawnSync)(
+  const result = (0, import_node_child_process24.spawnSync)(
     "docker",
     [
       "exec",
@@ -12082,6 +12195,96 @@ function runManagedProcessAction(options) {
   return "drifted";
 }
 
+// src/core/managed-mount-nesting.ts
+var import_node_child_process25 = require("child_process");
+var NESTED_MOUNT_REASON = "no configured mount is nested inside another configured mount";
+var UNREADABLE_MOUNT_REASON = "the container's own mount table could not be read";
+function normalizeDestination(value) {
+  const trimmed = value.trim().replace(/\/+$/, "");
+  return trimmed === "" ? "/" : trimmed;
+}
+function isNestedWithin(destination, candidate) {
+  return candidate === "/" ? destination !== "/" : destination.startsWith(`${candidate}/`);
+}
+function unescapeMountField(value) {
+  return value.replace(
+    /\\([0-7]{3})/g,
+    (_match, octal) => String.fromCharCode(Number.parseInt(octal, 8))
+  );
+}
+function parseMountinfoDestinations(text4) {
+  const destinations = /* @__PURE__ */ new Set();
+  for (const line of text4.split("\n")) {
+    const fields2 = line.split(" ");
+    if (fields2.length < 5 || !/^\d+$/.test(fields2[0] ?? "")) continue;
+    destinations.add(normalizeDestination(unescapeMountField(fields2[4] ?? "")));
+  }
+  return [...destinations];
+}
+function isNestedIndex(destinations, index) {
+  return destinations.some(
+    (candidate, other) => other !== index && isNestedWithin(destinations[index] ?? "", candidate)
+  );
+}
+function configuredDestinations(configured) {
+  return configured.map((mount) => normalizeDestination(mount.Destination));
+}
+function classifyManagedMountNesting(configured, effectiveDestinations, containerId) {
+  const destinations = configuredDestinations(configured);
+  const nested = configured.filter((_mount, index) => isNestedIndex(destinations, index));
+  const identity2 = containerId ? { container: containerId } : {};
+  if (nested.length === 0) {
+    return { status: "not-applicable", checked: [], unwound: [], reason: NESTED_MOUNT_REASON };
+  }
+  if (effectiveDestinations === null) {
+    return {
+      status: "unverified",
+      checked: [],
+      unwound: [],
+      ...identity2,
+      reason: UNREADABLE_MOUNT_REASON
+    };
+  }
+  const effective = new Set(effectiveDestinations.map(normalizeDestination));
+  const checked = [];
+  const unwound = [];
+  for (const mount of nested) {
+    const destination = normalizeDestination(mount.Destination);
+    if (effective.has(destination)) {
+      checked.push(mount.Destination);
+      continue;
+    }
+    const nestedWithin = destinations.filter((candidate) => isNestedWithin(destination, candidate)).sort((a, b) => a.length - b.length)[0];
+    unwound.push({
+      destination: mount.Destination,
+      source: mount.Source,
+      nestedWithin: nestedWithin ?? "/"
+    });
+  }
+  return {
+    status: unwound.length > 0 ? "unwound" : "effective",
+    checked,
+    unwound,
+    ...identity2
+  };
+}
+function readContainerMountinfo(containerId, options) {
+  const result = (0, import_node_child_process25.spawnSync)("docker", ["exec", containerId, "cat", "/proc/self/mountinfo"], {
+    encoding: "utf-8",
+    timeout: options.timeoutMs ?? 5e3,
+    stdio: ["ignore", "pipe", "pipe"],
+    ...networkDockerOptions()
+  });
+  if (result.status !== 0 || typeof result.stdout !== "string") return null;
+  const destinations = parseMountinfoDestinations(result.stdout);
+  return destinations.length > 0 ? destinations : null;
+}
+function observeManagedMountNesting(container, options = {}) {
+  const destinations = configuredDestinations(container.mounts);
+  const effective = destinations.some((_destination, index) => isNestedIndex(destinations, index)) ? readContainerMountinfo(container.id, options) : null;
+  return classifyManagedMountNesting(container.mounts, effective, container.id);
+}
+
 // src/core/managed-runtime-status.ts
 function recoveryPath(repoPath) {
   if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(repoPath)) return repoPath;
@@ -12362,6 +12565,7 @@ function inspectManagedRuntime(options) {
     (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
   )?.Destination;
   const primaryActive = Boolean(primary?.state.Running);
+  const mountNesting = primary && primaryActive ? observeManagedMountNesting(primary) : void 0;
   if (generatedConfigMissing && (state || primaryActive || managedServicesActive)) {
     drift.push("managed generated Dev Container configuration is missing");
   }
@@ -12428,7 +12632,8 @@ function inspectManagedRuntime(options) {
     processStatuses,
     activeServices: sortedUnique(activeServices),
     activeProcesses: sortedUnique(activeProcesses),
-    drift
+    drift,
+    ...mountNesting ? { mountNesting } : {}
   };
 }
 function collectManagedRuntimeStatus(options) {
@@ -12576,6 +12781,7 @@ function collectManagedRuntimeStatus(options) {
     baseServiceStatuses: inspection.baseStatuses,
     processStatuses: inspection.processStatuses,
     drift: sortedUnique(drift),
+    ...inspection.mountNesting ? { mountNesting: inspection.mountNesting } : {},
     ...inspection.plan?.sourceConfigSha256 || state?.sourceConfigSha256 ? { sourceConfigSha256: inspection.plan?.sourceConfigSha256 ?? state?.sourceConfigSha256 } : {},
     ...inspection.plan?.effectiveConfigSha256 || state?.effectiveConfigSha256 ? {
       effectiveConfigSha256: inspection.plan?.effectiveConfigSha256 ?? state?.effectiveConfigSha256
@@ -12585,19 +12791,19 @@ function collectManagedRuntimeStatus(options) {
 }
 
 // src/core/network-inventory.ts
-var import_node_child_process23 = require("child_process");
+var import_node_child_process26 = require("child_process");
 var NetworkInventoryError = class extends Error {
 };
 var MAX_IDS = 4096;
 var MAX_OUTPUT_BYTES = 2 * 1024 * 1024;
 var FULL_ID = /^[a-f0-9]{64}$/;
-var NETWORK_TEMPLATE = '{"id":{{json .Id}},"name":{{json .Name}},"driver":{{json .Driver}},"ipam":{{json .IPAM.Config}},"activeEndpoints":{{len .Containers}},"project":{{json (index .Labels "com.docker.compose.project")}},"network":{{json (index .Labels "com.docker.compose.network")}}';
+var NETWORK_TEMPLATE = '{"id":{{json .Id}},"name":{{json .Name}},"driver":{{json .Driver}},"ipam":{{json .IPAM.Config}},"activeEndpoints":{{len .Containers}},"project":{{json (index .Labels "com.docker.compose.project")}},"network":{{json (index .Labels "com.docker.compose.network")}}}';
 var CONTAINER_TEMPLATE = '{"id":{{json .Id}},"networks":{{json .NetworkSettings.Networks}}}';
 function readDocker(endpoint, args, timeoutMs) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process23.spawnSync)("docker", ["--host", endpoint, ...args], {
+  const result = (0, import_node_child_process26.spawnSync)("docker", ["--host", endpoint, ...args], {
     env,
     encoding: "utf-8",
     timeout: timeoutMs,
@@ -12628,7 +12834,14 @@ function id4(value) {
 }
 function rows(output) {
   const trimmed = output.trim();
-  return trimmed ? trimmed.split(/\r?\n/).map((line) => JSON.parse(line)) : [];
+  return trimmed ? trimmed.split(/\r?\n/).map((line) => parseRecord(line)) : [];
+}
+function parseRecord(line) {
+  try {
+    return JSON.parse(line);
+  } catch {
+    throw new NetworkInventoryError("Docker network inventory contains a malformed record.");
+  }
 }
 function ids(output) {
   const values = output.trim() ? output.trim().split(/\r?\n/).map(id4) : [];
@@ -12673,7 +12886,7 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
       return output;
     };
     const info = record4(
-      JSON.parse(
+      parseRecord(
         read2(["info", "--format", '{"id":{{json .ID}},"pools":{{json .DefaultAddressPools}}}'])
       )
     );
@@ -12754,37 +12967,37 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
 }
 
 // src/core/network-routes.ts
-var import_node_child_process24 = require("child_process");
+var import_node_child_process27 = require("child_process");
 var import_node_net3 = require("net");
 
 // src/core/network-local-daemon.ts
-var import_node_fs32 = __toESM(require("fs"));
-var import_node_path37 = __toESM(require("path"));
+var import_node_fs33 = __toESM(require("fs"));
+var import_node_path38 = __toESM(require("path"));
 function hasLocalDockerNetworkNamespace(endpoint, procRoot = "/proc") {
   const deadline = Date.now() + 2e3;
   try {
     if (!endpoint.startsWith("unix:///")) return false;
     const socket = endpoint.slice("unix://".length);
-    const table = import_node_fs32.default.readFileSync(import_node_path37.default.join(procRoot, "net/unix"), "utf8");
+    const table = import_node_fs33.default.readFileSync(import_node_path38.default.join(procRoot, "net/unix"), "utf8");
     if (Buffer.byteLength(table) > 1024 * 1024) return false;
     const rows2 = table.split("\n").map((line) => line.trim().split(/\s+/)).filter((row) => row[7] === socket && row[3] === "00010000");
     if (rows2.length !== 1 || !/^\d+$/.test(rows2[0][6])) return false;
     const inode = `socket:[${rows2[0][6]}]`;
-    const ownNamespace = import_node_fs32.default.readlinkSync(import_node_path37.default.join(procRoot, "self/ns/net"));
-    const pids = import_node_fs32.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
+    const ownNamespace = import_node_fs33.default.readlinkSync(import_node_path38.default.join(procRoot, "self/ns/net"));
+    const pids = import_node_fs33.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
     if (pids.length > 4096) return false;
     for (const pid of pids) {
       if (Date.now() > deadline) return false;
       try {
-        const root = import_node_path37.default.join(procRoot, pid);
-        if (import_node_path37.default.basename(import_node_fs32.default.readlinkSync(import_node_path37.default.join(root, "exe"))) !== "dockerd") continue;
-        if (import_node_fs32.default.readlinkSync(import_node_path37.default.join(root, "ns/net")) !== ownNamespace) continue;
-        const descriptors = import_node_fs32.default.readdirSync(import_node_path37.default.join(root, "fd"));
+        const root = import_node_path38.default.join(procRoot, pid);
+        if (import_node_path38.default.basename(import_node_fs33.default.readlinkSync(import_node_path38.default.join(root, "exe"))) !== "dockerd") continue;
+        if (import_node_fs33.default.readlinkSync(import_node_path38.default.join(root, "ns/net")) !== ownNamespace) continue;
+        const descriptors = import_node_fs33.default.readdirSync(import_node_path38.default.join(root, "fd"));
         if (descriptors.length > 4096) continue;
         if (descriptors.some((fd) => {
           if (Date.now() > deadline) return false;
           try {
-            return import_node_fs32.default.readlinkSync(import_node_path37.default.join(root, "fd", fd)) === inode;
+            return import_node_fs33.default.readlinkSync(import_node_path38.default.join(root, "fd", fd)) === inode;
           } catch {
             return false;
           }
@@ -12823,7 +13036,7 @@ function parseLinuxNetworkRoutes(output) {
 function collectNetworkRoutes(options) {
   if ((options.platform ?? process.platform) !== "linux" || !hasLocalDockerNetworkNamespace(options.endpoint))
     return { status: "unknown", routes: [] };
-  const result = (0, import_node_child_process24.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
+  const result = (0, import_node_child_process27.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
     encoding: "utf8",
     timeout: 5e3,
     maxBuffer: 1024 * 1024
@@ -13672,10 +13885,10 @@ function fingerprintComposeNetworkModel(input) {
 }
 
 // src/core/network-compose-files.ts
-var import_node_child_process25 = require("child_process");
+var import_node_child_process28 = require("child_process");
 var import_node_crypto20 = require("crypto");
-var import_node_fs33 = __toESM(require("fs"));
-var import_node_path38 = __toESM(require("path"));
+var import_node_fs34 = __toESM(require("fs"));
+var import_node_path39 = __toESM(require("path"));
 var import_yaml4 = __toESM(require("yaml"));
 var OVERLAY = "docker-compose.devrouter-network.yml";
 var MARKER = "# devrouter:managed workspace network";
@@ -13688,12 +13901,12 @@ function object3(value) {
 function inspectNetworkComposeFiles(input) {
   const authoredNetworks = {};
   for (const file of input.plan.composeFiles) {
-    const stat = import_node_fs33.default.lstatSync(file);
+    const stat = import_node_fs34.default.lstatSync(file);
     if (!stat.isFile() || stat.size > MAX_BYTES2)
       throw new Error("Network Compose source is unavailable or too large.");
     let source;
     try {
-      source = object3(import_yaml4.default.parse(import_node_fs33.default.readFileSync(file, "utf8")));
+      source = object3(import_yaml4.default.parse(import_node_fs34.default.readFileSync(file, "utf8")));
     } catch {
       throw new Error("Network Compose source could not be parsed safely.");
     }
@@ -13709,7 +13922,7 @@ function inspectNetworkComposeFiles(input) {
   const env = managedComposeEnvironment(input.workspace);
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process25.spawnSync)(
+  const result = (0, import_node_child_process28.spawnSync)(
     "docker",
     [
       "--host",
@@ -13743,8 +13956,8 @@ function inspectNetworkComposeFiles(input) {
 function prepareNetworkComposeFiles(plan, subnet) {
   const overlay = deriveComposeNetworkOverlay(subnet);
   if (overlay.status !== "ready" || !overlay.overlay) throw new Error("Network subnet is invalid.");
-  const overlayPath = import_node_path38.default.join(plan.composeDirectory, OVERLAY);
-  const ignored = (0, import_node_child_process25.spawnSync)("git", [
+  const overlayPath = import_node_path39.default.join(plan.composeDirectory, OVERLAY);
+  const ignored = (0, import_node_child_process28.spawnSync)("git", [
     "-C",
     plan.composeDirectory,
     "check-ignore",
@@ -13758,9 +13971,9 @@ function prepareNetworkComposeFiles(plan, subnet) {
   const bytes2 = `${MARKER}
 ${import_yaml4.default.stringify(overlay.overlay)}`;
   const assertOwnership = () => {
-    if (!import_node_fs33.default.existsSync(overlayPath)) return;
-    const stat = import_node_fs33.default.lstatSync(overlayPath);
-    if (!stat.isFile() || stat.size > MAX_BYTES2 || import_node_fs33.default.readFileSync(overlayPath, "utf8") !== bytes2)
+    if (!import_node_fs34.default.existsSync(overlayPath)) return;
+    const stat = import_node_fs34.default.lstatSync(overlayPath);
+    if (!stat.isFile() || stat.size > MAX_BYTES2 || import_node_fs34.default.readFileSync(overlayPath, "utf8") !== bytes2)
       throw new Error("Retained network overlay changed; repair is required.");
   };
   assertOwnership();
@@ -13786,7 +13999,7 @@ ${JSON.stringify(extended.config, null, 2)}
 }
 
 // src/core/network-connected-route.ts
-var import_node_child_process26 = require("child_process");
+var import_node_child_process29 = require("child_process");
 function bounds(cidr) {
   const canonical = parseIPv4Cidr(cidr);
   if (!canonical) throw new Error("Invalid connected route.");
@@ -13811,7 +14024,7 @@ function inspectClaimedBridge(claim2, networkId) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process26.spawnSync)(
+  const result = (0, import_node_child_process29.spawnSync)(
     "docker",
     [
       "--host",
@@ -13838,7 +14051,7 @@ function inspectClaimedBridge(claim2, networkId) {
     const [first, last] = bounds(claim2.subnet);
     const [address] = bounds(gateway);
     if (address <= first || address >= last) throw new Error();
-    const interfaces = (0, import_node_child_process26.spawnSync)("ip", ["-j", "-d", "-4", "address", "show", "dev", bridge], {
+    const interfaces = (0, import_node_child_process29.spawnSync)("ip", ["-j", "-d", "-4", "address", "show", "dev", bridge], {
       encoding: "utf8",
       timeout: 5e3,
       maxBuffer: 65536
@@ -14276,11 +14489,11 @@ var DEFAULT_READINESS_TIMEOUT_MS = 12e4;
 var POLL_INTERVAL_MS = 1e3;
 function assertOverlay(container, repoPath) {
   const workingDir = container.labels["com.docker.compose.project.working_dir"];
-  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path39.default.join(repoPath, ".devcontainer"))) {
+  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path40.default.join(repoPath, ".devcontainer"))) {
     throw new Error(`Container '${container.id}' does not belong to the exact worktree.`);
   }
   const configFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").filter(Boolean);
-  const expectedOverlay = import_node_path39.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+  const expectedOverlay = import_node_path40.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
   if (!configFiles.some((configFile) => sameWorkspacePath(configFile, expectedOverlay))) {
     throw new Error(`Container '${container.id}' was not started with ${DEVCONTAINER_OVERLAY}.`);
   }
@@ -14294,7 +14507,7 @@ function assertWorktreeOwnership(container, repoPath) {
 function isInsideWorktree(candidate, repoPath) {
   const normalizedCandidate = comparableWorkspacePath(candidate);
   const normalizedRoot = comparableWorkspacePath(repoPath);
-  return normalizedCandidate === normalizedRoot || normalizedCandidate.startsWith(`${normalizedRoot}${import_node_path39.default.sep}`);
+  return normalizedCandidate === normalizedRoot || normalizedCandidate.startsWith(`${normalizedRoot}${import_node_path40.default.sep}`);
 }
 function assertReady(container, label) {
   if (!container.state.Running) {
@@ -14486,7 +14699,7 @@ function hasExactManagedComposeProject(repoPath, state) {
     }).some((container) => {
       const workingDir = container.labels["com.docker.compose.project.working_dir"];
       return Boolean(
-        workingDir && sameWorkspacePath(workingDir, import_node_path39.default.join(repoPath, ".devcontainer"))
+        workingDir && sameWorkspacePath(workingDir, import_node_path40.default.join(repoPath, ".devcontainer"))
       );
     });
   } catch {
@@ -14594,7 +14807,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
         target
       });
       if (target.kind === "linked") {
-        const workspaceEnv = (0, import_node_child_process27.spawnSync)(
+        const workspaceEnv = (0, import_node_child_process30.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "WORKSPACE"],
           { encoding: "utf-8", ...networkDockerOptions() }
@@ -14604,7 +14817,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
             `Workspace app container must expose WORKSPACE='${target.workspace}' (got '${workspaceEnv.stdout.trim() || "(empty)"}').`
           );
         }
-        const devrouterWorkspaceEnv = (0, import_node_child_process27.spawnSync)(
+        const devrouterWorkspaceEnv = (0, import_node_child_process30.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "DEVROUTER_WORKSPACE"],
           { encoding: "utf-8", ...networkDockerOptions() }
@@ -14615,7 +14828,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
           );
         }
       }
-      const gitCheck = (0, import_node_child_process27.spawnSync)(
+      const gitCheck = (0, import_node_child_process30.spawnSync)(
         "docker",
         [
           "exec",
@@ -14888,14 +15101,14 @@ function resolvePrimaryTarget(repoPath) {
 }
 function isPrimaryCheckout(repoPath) {
   try {
-    return import_node_fs34.default.statSync(import_node_path39.default.join(repoPath, ".git")).isDirectory();
+    return import_node_fs35.default.statSync(import_node_path40.default.join(repoPath, ".git")).isDirectory();
   } catch {
     return false;
   }
 }
 function openUrls(urls) {
   for (const url of urls) {
-    const opened = (0, import_node_child_process27.spawnSync)("open", [url], { encoding: "utf-8" });
+    const opened = (0, import_node_child_process30.spawnSync)("open", [url], { encoding: "utf-8" });
     if (opened.status !== 0) {
       process.stderr.write(`Warning: could not open '${url}'.
 `);
@@ -14952,8 +15165,8 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       const target = options.repair ? resolveRepairTarget(repoPath, linked) : linked ? resolveLinkedTarget(repoPath) : resolvePrimaryTarget(repoPath);
       let devpodId = target.devpodId;
       if (target.kind === "linked") {
-        const overlayPath = import_node_path39.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
-        if (!import_node_fs34.default.existsSync(overlayPath)) {
+        const overlayPath = import_node_path40.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+        if (!import_node_fs35.default.existsSync(overlayPath)) {
           throw new Error(`Missing required DevPod compose overlay: ${overlayPath}`);
         }
       }
@@ -15053,7 +15266,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       }
       const apps = proxyAppsFromConfig(runtime.config);
       const parsedUpstreams = apps.map((app) => parseUpstream(app.upstream));
-      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path39.default.basename(repoPath)) ?? "app";
+      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path40.default.basename(repoPath)) ?? "app";
       for (const [index, app] of apps.entries()) {
         if (!parsedUpstreams[index].host.startsWith(`${aliasPrefix}-`)) {
           const owner = target.kind === "linked" ? "workspace" : "checkout";
@@ -15178,7 +15391,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
               transitionPhase = "service-start";
               reportLifecycleProgress("service-start");
               claimLifecycleEffect();
-              const result = (0, import_node_child_process27.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
+              const result = (0, import_node_child_process30.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
                 ...networkDockerOptions(),
                 encoding: "utf-8",
                 timeout: DEFAULT_READINESS_TIMEOUT_MS,
@@ -15895,9 +16108,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     }
     const repairLocked = () => {
       const runtime = resolveWorkspaceRuntimeOrDefault(repoPath);
-      import_node_fs34.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+      import_node_fs35.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
       return withFileLock(
-        import_node_path39.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
+        import_node_path40.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
         {
           activity: "Managed runtime repair",
           target: repoPath,
@@ -16111,7 +16324,7 @@ async function executeLifecycleWorker(request, operation) {
           const owned = containers.filter(
             (container) => sameWorkspacePath(
               container.labels["com.docker.compose.project.working_dir"] ?? "",
-              import_node_path40.default.join(request.repoPath, ".devcontainer")
+              import_node_path41.default.join(request.repoPath, ".devcontainer")
             )
           );
           const projects = owned.map((container) => container.labels["com.docker.compose.project"]);
@@ -16122,6 +16335,11 @@ async function executeLifecycleWorker(request, operation) {
           ];
           for (const project of stopProjects) inspectManagedStopContainers(project);
         }
+        updateReliabilityOperation(request.identity, (record5) => {
+          if (!matchesFence(record5, request.fence))
+            throw new Error("Lifecycle intent changed before stop work began.");
+          record5.stopWorkStarted = true;
+        });
       } else {
         updateReliabilityOperation(request.identity, (record5) => {
           stepRecord(record5, {
@@ -16217,7 +16435,7 @@ function proveLifecycleStopped() {
       const remaining = inspectWorkspaceContainers().filter(
         (container) => sameWorkspacePath(
           container.labels["com.docker.compose.project.working_dir"] ?? "",
-          import_node_path40.default.join(request.repoPath, ".devcontainer")
+          import_node_path41.default.join(request.repoPath, ".devcontainer")
         )
       );
       if (remaining.some(
@@ -16233,6 +16451,7 @@ function proveLifecycleStopped() {
     const settlement = updateReliabilityOperation(request.identity, (record5) => {
       if (!matchesFence(record5, request.fence) || record5.worker)
         throw new Error("Stop proof was superseded or an earlier worker remains.");
+      delete record5.stopWorkStarted;
       if (record5.version === 2) {
         if (record5.capacity) record5.capacity.validUntilMs = 0;
         return record5.state.environmentId;
@@ -16246,7 +16465,7 @@ function proveLifecycleStopped() {
       return void 0;
     });
     if (settlement) {
-      const capacity = createLifecycleCapacityStore(import_node_path40.default.join(DEVROUTER_HOME, "controller"));
+      const capacity = createLifecycleCapacityStore(import_node_path41.default.join(DEVROUTER_HOME, "controller"));
       for (let attempt = 0; ; attempt++) {
         try {
           const state = capacity.inspect();
@@ -16271,6 +16490,7 @@ function proveLifecycleStopped() {
         if (!matchesFence(record5, request.fence) || record5.worker || record5.state.environmentId !== settlement || record5.capacity && record5.capacity.validUntilMs !== 0)
           throw new Error("Capacity settlement was superseded before journal confirmation.");
         record5.capacity = null;
+        delete record5.stopWorkStarted;
         if (record5.enrollment) {
           record5.phaseSettlement = null;
           record5.activeProfile = null;
@@ -16324,7 +16544,7 @@ async function devsyExecOutcome(repoPath, command, retainedProof) {
         const launch = () => {
           if (retainedProof) revalidateDevsyExecProof(repoPath, retainedProof);
           claimLifecycleEffect();
-          return (0, import_node_child_process28.spawn)("devsy", args, { stdio: "inherit" });
+          return (0, import_node_child_process31.spawn)("devsy", args, { stdio: "inherit" });
         };
         child = retainedProof ? withMutationLock("Execute retained workspace", repoPath, launch) : launch();
       } catch (error) {
@@ -16372,7 +16592,7 @@ function ensureGuidance2(repoPath) {
   return `Run 'devrouter ensure ${repoPath}' first.`;
 }
 function assertRunningDevpod(devpodId, repoPath) {
-  const result = (0, import_node_child_process29.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
+  const result = (0, import_node_child_process32.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -16551,7 +16771,7 @@ async function devpodExecOutcome(repoPath, command) {
       let child;
       try {
         claimLifecycleEffect();
-        child = (0, import_node_child_process29.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
+        child = (0, import_node_child_process32.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
       } catch (error) {
         settled = true;
         reject(
@@ -16608,12 +16828,12 @@ async function devpodExecOutcome(repoPath, command) {
 }
 
 // src/core/workspace-lifecycle.ts
-var import_node_child_process30 = require("child_process");
-var import_node_fs36 = __toESM(require("fs"));
-var import_node_path41 = __toESM(require("path"));
+var import_node_child_process33 = require("child_process");
+var import_node_fs37 = __toESM(require("fs"));
+var import_node_path42 = __toESM(require("path"));
 
 // src/core/route-state.ts
-var import_node_fs35 = __toESM(require("fs"));
+var import_node_fs36 = __toESM(require("fs"));
 function listRoutesForWorktreePath(worktreePath, routes = listHostRouteState()) {
   return routes.filter((route) => sameWorkspacePath(route.repoPath, worktreePath));
 }