@devrouter/cli 0.2.0 → 0.3.1

package/dist/devrouter.js

@@ -610,11 +610,11 @@ var init_file_lock = __esm({
 
 // src/core/workspace.ts
 function comparableWorkspacePath(filePath) {
-  const resolved = import_node_path3.default.resolve(filePath);
+  const resolved2 = import_node_path3.default.resolve(filePath);
   try {
-    return import_node_fs3.default.realpathSync.native(resolved);
+    return import_node_fs3.default.realpathSync.native(resolved2);
   } catch {
-    return resolved;
+    return resolved2;
   }
 }
 function sameWorkspacePath(left, right) {
@@ -1991,7 +1991,7 @@ function parseEnrollment(value, index, domains) {
     label2
   );
   const repoPath = parseCanonicalAbsolutePath(enrollment.repoPath, `${label2}.repoPath`);
-  const gitCommonDir = parseCanonicalAbsolutePath(enrollment.gitCommonDir, `${label2}.gitCommonDir`);
+  const gitCommonDir2 = parseCanonicalAbsolutePath(enrollment.gitCommonDir, `${label2}.gitCommonDir`);
   const workspace = parseBoundedString(enrollment.workspace, `${label2}.workspace`, 32);
   if (!WORKSPACE_TOKEN_RE.test(workspace)) {
     throw new Error(`${label2}.workspace must be an existing workspace token.`);
@@ -2032,7 +2032,7 @@ function parseEnrollment(value, index, domains) {
   );
   return {
     repoPath,
-    gitCommonDir,
+    gitCommonDir: gitCommonDir2,
     workspace,
     provider,
     providerId,
@@ -3163,10 +3163,10 @@ function normalizeOverridePattern(line) {
   const converted = `**/${rest}`;
   return isValidWorktreePattern(converted) ? converted : void 0;
 }
-function readDisposableOverride(gitCommonDir) {
+function readDisposableOverride(gitCommonDir2) {
   let content;
   try {
-    content = import_node_fs7.default.readFileSync(import_node_path9.default.join(gitCommonDir, DISPOSABLE_OVERRIDE_FILE), "utf-8");
+    content = import_node_fs7.default.readFileSync(import_node_path9.default.join(gitCommonDir2, DISPOSABLE_OVERRIDE_FILE), "utf-8");
   } catch {
     return [];
   }
@@ -3202,8 +3202,8 @@ function inspectLocalWorktreeSafety(worktreePath, options = {}) {
     "--git-dir",
     "--git-common-dir"
   ]);
-  const [gitDir, gitCommonDir] = dirs.stdout.split("\n").map((line) => line.trim());
-  if (!dirs.ok || !gitDir || !gitCommonDir) {
+  const [gitDir, gitCommonDir2] = dirs.stdout.split("\n").map((line) => line.trim());
+  if (!dirs.ok || !gitDir || !gitCommonDir2) {
     return { codes: ["git-error"], examples: {} };
   }
   if (!git(worktreePath, ["symbolic-ref", "-q", "HEAD"]).ok) safety.codes.push("detached");
@@ -3224,7 +3224,7 @@ function inspectLocalWorktreeSafety(worktreePath, options = {}) {
   }
   const disposable = [
     ...BUILTIN_DISPOSABLE_PATTERNS,
-    ...readDisposableOverride(gitCommonDir),
+    ...readDisposableOverride(gitCommonDir2),
     ...options.extraDisposablePatterns ?? []
   ];
   const entries = status.stdout.split("\0");
@@ -3315,8 +3315,8 @@ function classifyWorktreeSafety(input2) {
   }
   return result(change);
 }
-function readLedgerWorktreePaths(gitCommonDir) {
-  const directory = import_node_path9.default.join(gitCommonDir, "devrouter", "workspaces");
+function readLedgerWorktreePaths(gitCommonDir2) {
+  const directory = import_node_path9.default.join(gitCommonDir2, "devrouter", "workspaces");
   let names;
   try {
     names = import_node_fs7.default.readdirSync(directory).filter((name) => name.endsWith(".json"));
@@ -4764,7 +4764,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs8.default.read
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.2.0" : "0.0.0-dev";
+    const cliVersion = true ? "0.3.1" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -5041,13 +5041,13 @@ function applyWorkspace(config, workspace, repoPath) {
       app.host = namespaced;
     }
     if ("upstream" in app && app.upstream.includes(WORKSPACE_PLACEHOLDER)) {
-      const resolved = app.upstream.replaceAll(WORKSPACE_PLACEHOLDER, substitutionToken);
+      const resolved2 = app.upstream.replaceAll(WORKSPACE_PLACEHOLDER, substitutionToken);
       try {
-        parseUpstream(resolved);
+        parseUpstream(resolved2);
       } catch (err) {
-        throw new Error(`Resolved upstream '${resolved}' is invalid: ${err.message}`);
+        throw new Error(`Resolved upstream '${resolved2}' is invalid: ${err.message}`);
       }
-      app.upstream = resolved;
+      app.upstream = resolved2;
     }
     if (workspace && app.runtime === "docker") {
       app.docker.router = `${app.docker.router ?? app.name}-${workspace}`;
@@ -5056,11 +5056,11 @@ function applyWorkspace(config, workspace, repoPath) {
   return next;
 }
 function loadRuntimeConfig(repoPath, workspaceOverride, profileOverride) {
-  const resolved = resolveRepoPath(repoPath);
-  const raw = loadRepoConfig(resolved);
+  const resolved2 = resolveRepoPath(repoPath);
+  const raw = loadRepoConfig(resolved2);
   const resolvedProfile = resolveProfile(raw, profileOverride);
-  const workspace = resolveWorkspace(resolved, workspaceOverride);
-  const config = applyProfile(applyWorkspace(raw, workspace, resolved), resolvedProfile.profile);
+  const workspace = resolveWorkspace(resolved2, workspaceOverride);
+  const config = applyProfile(applyWorkspace(raw, workspace, resolved2), resolvedProfile.profile);
   return {
     config,
     workspace,
@@ -5213,28 +5213,28 @@ function selectedReadiness(config, profileName, profile, routedApps) {
   return sortedUnique(readiness);
 }
 function buildProfileResolutionReport(config, repoPath, profileOverride) {
-  const resolved = resolveProfile(config, profileOverride);
-  const filtered = applyProfile(config, resolved.profile);
+  const resolved2 = resolveProfile(config, profileOverride);
+  const filtered = applyProfile(config, resolved2.profile);
   const routedApps = filtered.apps.filter((app) => app.kind !== "dependency");
   const dependencies = filtered.apps.filter((app) => app.kind === "dependency");
-  const readiness = selectedReadiness(config, resolved.name, resolved.profile, routedApps);
+  const readiness = selectedReadiness(config, resolved2.name, resolved2.profile, routedApps);
   const managedRuntime = config.managedRuntime;
   const baseServices = sortedUnique(managedRuntime?.devcontainer.baseServices ?? []);
   const profileServices = managedRuntime ? selectedManagedResources(
-    resolved.profile,
-    resolved.profile?.devcontainerServices,
+    resolved2.profile,
+    resolved2.profile?.devcontainerServices,
     managedRuntime.devcontainer.profileServices
   ) : [];
   const processes = managedRuntime ? selectedManagedResources(
-    resolved.profile,
-    resolved.profile?.processes,
+    resolved2.profile,
+    resolved2.profile?.processes,
     managedRuntime.processes
   ) : [];
-  const notices = managedFullExpansionNotices(config, resolved.name);
+  const notices = managedFullExpansionNotices(config, resolved2.name);
   return {
     schemaVersion: 1,
     repoPath,
-    profile: resolved.name,
+    profile: resolved2.name,
     apps: sortedUnique(routedApps.map((app) => app.name)),
     dependencies: sortedUnique(dependencies.map((app) => app.name)),
     readiness: sortedUnique(readiness),
@@ -6763,7 +6763,7 @@ var init_reliability_contract = __esm({
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.2.0" : "0.0.0-dev";
+  return true ? "0.3.1" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -7529,9 +7529,9 @@ async function resolveCapacityEnrollment(policy, request2, signal, bindingResolv
     ["-C", environment.repoPath, "rev-parse", "--path-format=absolute", "--git-common-dir"],
     signal
   )).trim();
-  const gitCommonDir = import_node_fs13.default.realpathSync(common);
+  const gitCommonDir2 = import_node_fs13.default.realpathSync(common);
   const enrollment = policy.enrollments.find(
-    (entry) => entry.repoPath === environment.repoPath && entry.gitCommonDir === gitCommonDir && entry.workspace === environment.workspace && entry.provider === environment.provider && entry.providerId === environment.providerId
+    (entry) => entry.repoPath === environment.repoPath && entry.gitCommonDir === gitCommonDir2 && entry.workspace === environment.workspace && entry.provider === environment.provider && entry.providerId === environment.providerId
   );
   if (!enrollment?.profiles.includes(environment.profile))
     throw new Error("Canonical runtime profile is not enrolled for capacity admission.");
@@ -7550,8 +7550,8 @@ async function enrollCapacityLifecycle(policy, request2, signal, directory = imp
   const expectedPolicy = JSON.stringify(policy);
   if (policy.admissions !== "enabled" || JSON.stringify(readCapacityPolicy(directory)) !== expectedPolicy)
     throw new Error("Capacity enrollment policy is not current and enabled.");
-  const resolved = await resolveCapacityEnrollment(policy, request2, signal, bindingResolver);
-  const { environment, enrollment } = resolved;
+  const resolved2 = await resolveCapacityEnrollment(policy, request2, signal, bindingResolver);
+  const { environment, enrollment } = resolved2;
   const runtime = policy.domains[enrollment.runtimeDomain];
   if (policy.admissions !== "enabled" || runtime?.kind !== "runtime")
     throw new Error("Capacity enrollment policy is not enabled.");
@@ -7575,7 +7575,7 @@ async function enrollCapacityLifecycle(policy, request2, signal, directory = imp
     daemonId: runtime.daemonId,
     estimatesDigest: enrollment.estimatesDigest
   });
-  return resolved;
+  return resolved2;
 }
 var import_node_fs13, import_node_path15;
 var init_capacity_enrollment = __esm({
@@ -10000,9 +10000,9 @@ function writeManifestRecord(cacheRoot, manifest) {
 function pinnedManifest(version) {
   return version === PINNED_DEVSY_AGENT_VERSION ? { version, origin: "pinned", assets: DEVSY_AGENT_ASSETS } : void 0;
 }
-function manifestForVersion(resolved, version) {
-  if (resolved.assets) return { version, origin: "pinned", assets: resolved.assets };
-  return pinnedManifest(version) ?? readManifestRecord(resolved.cacheRoot, version);
+function manifestForVersion(resolved2, version) {
+  if (resolved2.assets) return { version, origin: "pinned", assets: resolved2.assets };
+  return pinnedManifest(version) ?? readManifestRecord(resolved2.cacheRoot, version);
 }
 async function resolveReleaseDevsyAgentManifest(version, fetcher) {
   const url = `${DEVSY_RELEASE_METADATA_BASE_URL}/${DEVSY_RELEASE_TAG_PREFIX}${version}`;
@@ -10124,9 +10124,9 @@ function resolvedOptions(options) {
   };
 }
 function inspectDevsyAgent(options = {}) {
-  const resolved = resolvedOptions(options);
-  const installedVersion = parseVersion2(resolved.versionOutput);
-  const explicitPath = resolved.env.DEVSY_AGENT_BINARY?.trim();
+  const resolved2 = resolvedOptions(options);
+  const installedVersion = parseVersion2(resolved2.versionOutput);
+  const explicitPath = resolved2.env.DEVSY_AGENT_BINARY?.trim();
   const source = explicitPath ? "explicit" : "managed";
   if (!installedVersion) {
     return {
@@ -10143,11 +10143,11 @@ function inspectDevsyAgent(options = {}) {
       installedVersion
     };
   }
-  const manifest = manifestForVersion(resolved, installedVersion);
+  const manifest = manifestForVersion(resolved2, installedVersion);
   if (!manifest) {
     if (explicitPath) {
       return {
-        ...inspectBinary(explicitPath, resolved.assets ?? DEVSY_AGENT_ASSETS, "invalid"),
+        ...inspectBinary(explicitPath, resolved2.assets ?? DEVSY_AGENT_ASSETS, "invalid"),
         source,
         binaryPath: explicitPath,
         installedVersion
@@ -10161,13 +10161,13 @@ function inspectDevsyAgent(options = {}) {
       drift: { installed: installedVersion, supported: PINNED_DEVSY_AGENT_VERSION }
     };
   }
-  const expectedName = resolved.nativeAssetName ?? nativeAssetName(resolved.platform, resolved.arch);
+  const expectedName = resolved2.nativeAssetName ?? nativeAssetName(resolved2.platform, resolved2.arch);
   const asset = manifest.assets.find((candidate) => candidate.name === expectedName);
   if (!asset) {
     return {
       state: "stale",
       source,
-      reason: `Devsy ${installedVersion} has no official agent for ${resolved.platform}/${resolved.arch}`,
+      reason: `Devsy ${installedVersion} has no official agent for ${resolved2.platform}/${resolved2.arch}`,
       installedVersion,
       manifestOrigin: manifest.origin
     };
@@ -10181,7 +10181,7 @@ function inspectDevsyAgent(options = {}) {
       manifestOrigin: manifest.origin
     };
   }
-  const binaryPath = managedBinaryPath(resolved.cacheRoot, installedVersion, asset);
+  const binaryPath = managedBinaryPath(resolved2.cacheRoot, installedVersion, asset);
   return {
     ...inspectBinary(binaryPath, [asset], "missing"),
     source,
@@ -10354,28 +10354,28 @@ function preparedFromInspection(inspection) {
     transport: "existing"
   };
 }
-function expectedAgentName(resolved) {
-  return resolved.nativeAssetName ?? nativeAssetName(resolved.platform, resolved.arch);
+function expectedAgentName(resolved2) {
+  return resolved2.nativeAssetName ?? nativeAssetName(resolved2.platform, resolved2.arch);
 }
-async function loadOrResolveManifest(resolved, version, options) {
-  const manifest = manifestForVersion(resolved, version);
+async function loadOrResolveManifest(resolved2, version, options) {
+  const manifest = manifestForVersion(resolved2, version);
   if (manifest) return manifest;
   const release = await resolveReleaseDevsyAgentManifest(version, options.fetcher ?? fetch);
-  writeManifestRecord(resolved.cacheRoot, release);
+  writeManifestRecord(resolved2.cacheRoot, release);
   return release;
 }
 async function prepareDevsyAgent(options = {}) {
-  const resolved = resolvedOptions(options);
-  const inspectOptions = resolved;
+  const resolved2 = resolvedOptions(options);
+  const inspectOptions = resolved2;
   const before = inspectDevsyAgent(inspectOptions);
   if (before.state === "stale") throw new DevsyAgentReadinessError(before);
   if (isReadyInspection(before) && before.source !== "host") {
     return preparedFromInspection(before);
   }
   const lock = options.withLock ?? ((operation) => {
-    import_node_fs17.default.mkdirSync(import_node_path23.default.dirname(resolved.lockPath), { recursive: true });
+    import_node_fs17.default.mkdirSync(import_node_path23.default.dirname(resolved2.lockPath), { recursive: true });
     return withFileLock(
-      resolved.lockPath,
+      resolved2.lockPath,
       {
         activity: "Devsy agent acquisition",
         waitMs: DEVSY_AGENT_LOCK_WAIT_MS,
@@ -10393,27 +10393,27 @@ async function prepareDevsyAgent(options = {}) {
     }
     const version = current.installedVersion;
     if (!version) throw new DevsyAgentReadinessError(current);
-    const manifest = await loadOrResolveManifest(resolved, version, options);
+    const manifest = await loadOrResolveManifest(resolved2, version, options);
     if (current.source === "explicit") {
       const verified = inspectDevsyAgent(inspectOptions);
       if (isReadyInspection(verified)) return preparedFromInspection(verified);
       throw new DevsyAgentReadinessError(verified);
     }
     const asset = manifest.assets.find(
-      (candidate) => candidate.name === expectedAgentName(resolved)
+      (candidate) => candidate.name === expectedAgentName(resolved2)
     );
     if (!asset) {
       throw new DevsyAgentReadinessError({
         state: "stale",
         source: current.source,
-        reason: `Devsy ${version} has no official agent for ${resolved.platform}/${resolved.arch}`,
+        reason: `Devsy ${version} has no official agent for ${resolved2.platform}/${resolved2.arch}`,
         installedVersion: version,
         manifestOrigin: manifest.origin
       });
     }
     const transport = await downloadAndPublish(
       asset,
-      managedBinaryPath(resolved.cacheRoot, version, asset),
+      managedBinaryPath(resolved2.cacheRoot, version, asset),
       options.fetcher ?? fetch,
       options.githubCliDownloader ?? downloadWithGitHubCli
     );
@@ -10525,11 +10525,11 @@ var init_devcontainer_config = __esm({
 // src/core/paths.ts
 function assertPathWithinRepo(filePath, repoRoot, label2) {
   const resolvedRoot = import_node_path25.default.resolve(repoRoot);
-  const resolved = import_node_path25.default.resolve(repoRoot, filePath);
-  if (resolved !== resolvedRoot && !resolved.startsWith(resolvedRoot + import_node_path25.default.sep)) {
+  const resolved2 = import_node_path25.default.resolve(repoRoot, filePath);
+  if (resolved2 !== resolvedRoot && !resolved2.startsWith(resolvedRoot + import_node_path25.default.sep)) {
     throw new Error(`${label2} path '${filePath}' escapes the repository root.`);
   }
-  return resolved;
+  return resolved2;
 }
 var import_node_path25;
 var init_paths = __esm({
@@ -10586,15 +10586,15 @@ function resolveComposeFiles(source, repoPath, linked) {
   }
   const directory = import_node_path26.default.join(repoPath, ".devcontainer");
   const files = references.map((reference) => {
-    const resolved2 = assertPathWithinRepo(
+    const resolved3 = assertPathWithinRepo(
       resolveComposeReference(reference, linked),
       directory,
       "dockerComposeFile"
     );
-    if (!import_node_fs19.default.existsSync(resolved2) || !import_node_fs19.default.lstatSync(resolved2).isFile()) {
-      throw new Error(`Managed Dev Container compose file does not exist: ${resolved2}`);
+    if (!import_node_fs19.default.existsSync(resolved3) || !import_node_fs19.default.lstatSync(resolved3).isFile()) {
+      throw new Error(`Managed Dev Container compose file does not exist: ${resolved3}`);
     }
-    return resolved2;
+    return resolved3;
   });
   for (const file of files) {
     let parsed;
@@ -10610,7 +10610,7 @@ function resolveComposeFiles(source, repoPath, linked) {
     }
   }
   const fileArgs = files.flatMap((file) => ["-f", file]);
-  const resolved = (0, import_node_child_process10.spawnSync)(
+  const resolved2 = (0, import_node_child_process10.spawnSync)(
     "docker",
     [
       "compose",
@@ -10626,10 +10626,10 @@ function resolveComposeFiles(source, repoPath, linked) {
     ],
     { cwd: directory, encoding: "utf-8" }
   );
-  if (resolved.status !== 0) {
+  if (resolved2.status !== 0) {
     throw new Error("Could not resolve the effective managed Dev Container Compose model.");
   }
-  const services = String(resolved.stdout ?? "").split(/\r?\n/).map((service) => service.trim()).filter(Boolean);
+  const services = String(resolved2.stdout ?? "").split(/\r?\n/).map((service) => service.trim()).filter(Boolean);
   if (services.length === 0 || new Set(services).size !== services.length) {
     throw new Error("The effective managed Dev Container Compose model has no unique services.");
   }
@@ -12882,7 +12882,7 @@ function proveInitialManagedDevsyAbsence(repoPath, expectedId) {
   const ownership = inspectDevsyWorkspaceOwnership(listDevsyWorkspaces(), devsyId, repoPath);
   if (ownership.status === "conflict") throw new Error(ownership.reason);
   if (ownership.status !== "absent") return void 0;
-  const gitCommonDir = resolveGitCommonDir(repoPath);
+  const gitCommonDir2 = resolveGitCommonDir(repoPath);
   const endpoint = resolveManagedStopEndpoint();
   if (!supportsManagedStopBaseline(endpoint))
     throw new Error("Initial managed stop requires a local Docker endpoint.");
@@ -12894,7 +12894,7 @@ function proveInitialManagedDevsyAbsence(repoPath, expectedId) {
   const legacyWorkspaces = readLegacy();
   const observe = () => {
     resetWorkspaceRuntimeCaches();
-    if (resolveWorkspaceRuntimeOrDefault(repoPath) !== "devsy" || !isLinkedWorktree(repoPath) || resolveWorktreeWorkspace(repoPath) !== workspace || resolveGitCommonDir(repoPath) !== gitCommonDir || !(0, import_node_util10.isDeepStrictEqual)(readWorkspaceOwnership(repoPath, workspace), record5) || inspectWorkspaceOwnership(record5, listGitWorktrees(repoPath), void 0).ownerStatus !== "present" || readManagedRuntimeState(repoPath, workspace))
+    if (resolveWorkspaceRuntimeOrDefault(repoPath) !== "devsy" || !isLinkedWorktree(repoPath) || resolveWorktreeWorkspace(repoPath) !== workspace || resolveGitCommonDir(repoPath) !== gitCommonDir2 || !(0, import_node_util10.isDeepStrictEqual)(readWorkspaceOwnership(repoPath, workspace), record5) || inspectWorkspaceOwnership(record5, listGitWorktrees(repoPath), void 0).ownerStatus !== "present" || readManagedRuntimeState(repoPath, workspace))
       throw new Error("Initial managed stop ownership or retained state changed.");
     if (devpodRegistryRoot() !== legacyHome || !(0, import_node_util10.isDeepStrictEqual)(readLegacy(), legacyWorkspaces))
       throw new Error("Initial managed stop legacy registry evidence changed.");
@@ -12920,7 +12920,7 @@ function proveInitialManagedDevsyAbsence(repoPath, expectedId) {
   return {
     workspace,
     record: record5,
-    gitCommonDir,
+    gitCommonDir: gitCommonDir2,
     endpoint,
     daemon,
     routes,
@@ -12949,8 +12949,8 @@ function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
     };
   };
   const authority = readAuthority();
-  const gitCommonDir = linked ? resolveGitCommonDir(repoPath) : void 0;
-  const workspaceEnv = workspace && gitCommonDir ? { token: workspace, gitCommonDir } : void 0;
+  const gitCommonDir2 = linked ? resolveGitCommonDir(repoPath) : void 0;
+  const workspaceEnv = workspace && gitCommonDir2 ? { token: workspace, gitCommonDir: gitCommonDir2 } : void 0;
   function canonicalProfile(recorded) {
     return resolveProfile(loadRepoConfig(repoPath), recorded).name;
   }
@@ -12963,7 +12963,7 @@ function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
       throw new Error("Initial managed stop requires one exact Devsy registration.");
     if (linked) {
       const record5 = workspace ? readWorkspaceOwnership(repoPath, workspace) : void 0;
-      if (!record5 || record5.devpodId !== devsyId || !sameWorkspacePath(record5.worktreePath, repoPath) || resolveWorktreeWorkspace(repoPath) !== workspace || resolveGitCommonDir(repoPath) !== gitCommonDir || inspectWorkspaceOwnership(record5, listGitWorktrees(repoPath), void 0).ownerStatus !== "present")
+      if (!record5 || record5.devpodId !== devsyId || !sameWorkspacePath(record5.worktreePath, repoPath) || resolveWorktreeWorkspace(repoPath) !== workspace || resolveGitCommonDir(repoPath) !== gitCommonDir2 || inspectWorkspaceOwnership(record5, listGitWorktrees(repoPath), void 0).ownerStatus !== "present")
         throw new Error("Initial managed stop workspace ownership changed.");
     }
     return owner2.workspace;
@@ -14185,9 +14185,9 @@ function validateRoot(root) {
   if (typeof root !== "string" || !import_node_path36.default.isAbsolute(root) || root.includes("\0")) {
     throw claimError("invalid-input", "network claim root is invalid");
   }
-  const resolved = import_node_path36.default.resolve(root);
-  if (resolved !== root) throw claimError("invalid-input", "network claim root is invalid");
-  return resolved;
+  const resolved2 = import_node_path36.default.resolve(root);
+  if (resolved2 !== root) throw claimError("invalid-input", "network claim root is invalid");
+  return resolved2;
 }
 function hashKey(value) {
   return (0, import_node_crypto15.createHash)("sha256").update(value).digest("hex");
@@ -14526,6 +14526,25 @@ function inspectExactOwnership(devsyId, worktreePath) {
   if (ownership.status === "conflict") throw new Error(ownership.reason);
   return ownership;
 }
+function checkoutVanished(worktreePath) {
+  try {
+    import_node_fs30.default.lstatSync(worktreePath);
+    return false;
+  } catch (error) {
+    return error.code === "ENOENT";
+  }
+}
+function deleteVanishedCheckoutRegistration(devsyId, worktreePath, originalError) {
+  if (!checkoutVanished(worktreePath)) throw originalError;
+  const runtime = inspectDevsyRuntimeStatus(devsyId);
+  if (runtime !== "stopped" && runtime !== "not-found") throw originalError;
+  runDevsyAction("delete", devsyId, true, worktreePath);
+  if (inspectExactOwnership(devsyId, worktreePath).status !== "absent") {
+    throw new Error(
+      `Devsy workspace '${devsyId}' still owns vanished checkout '${worktreePath}' after forced provider delete.`
+    );
+  }
+}
 function mutateOwnedDevsyWorkspace(action2, devsyId, worktreePath) {
   return withMutationLock(`Devsy ${action2}`, worktreePath, () => {
     restoreRecordedManagedDevcontainerConfig(worktreePath);
@@ -14539,7 +14558,13 @@ function mutateOwnedDevsyWorkspace(action2, devsyId, worktreePath) {
     }
     const before = inspectExactOwnership(devsyId, worktreePath);
     if (before.status === "absent") return { status: "absent" };
-    runDevsyAction(action2, devsyId, false, worktreePath);
+    try {
+      runDevsyAction(action2, devsyId, false, worktreePath);
+    } catch (error) {
+      if (action2 !== "delete") throw error;
+      deleteVanishedCheckoutRegistration(devsyId, worktreePath, error);
+      return { status: "changed" };
+    }
     let after = inspectExactOwnership(devsyId, worktreePath);
     if (action2 === "stop" && after.status !== "owned") {
       throw new Error(
@@ -19554,9 +19579,9 @@ function createCapacityController(options) {
   const resolveCapacityTarget = async (environment, signal) => {
     const current = readCapacityPolicy(options.directory);
     if (current?.admissions !== "enabled" || !(0, import_node_util13.isDeepStrictEqual)(current, policy)) return void 0;
-    let resolved;
+    let resolved2;
     try {
-      resolved = await resolveCapacityEnrollment(
+      resolved2 = await resolveCapacityEnrollment(
         current,
         { path: environment.repoPath, profile: environment.profile, require: [] },
         signal,
@@ -19565,12 +19590,12 @@ function createCapacityController(options) {
     } catch {
       return void 0;
     }
-    if (signal.aborted || !(0, import_node_util13.isDeepStrictEqual)(resolved.environment, environment)) return void 0;
+    if (signal.aborted || !(0, import_node_util13.isDeepStrictEqual)(resolved2.environment, environment)) return void 0;
     if (!(0, import_node_util13.isDeepStrictEqual)(readCapacityPolicy(options.directory), current)) return void 0;
-    const runtime = current.domains[resolved.enrollment.runtimeDomain];
-    if (runtime?.kind !== "runtime" || runtime.hostDomain !== resolved.enrollment.hostDomain || current.domains[runtime.hostDomain]?.kind !== "host" || !current.enrollments.some((entry) => (0, import_node_util13.isDeepStrictEqual)(entry, resolved.enrollment)))
+    const runtime = current.domains[resolved2.enrollment.runtimeDomain];
+    if (runtime?.kind !== "runtime" || runtime.hostDomain !== resolved2.enrollment.hostDomain || current.domains[runtime.hostDomain]?.kind !== "host" || !current.enrollments.some((entry) => (0, import_node_util13.isDeepStrictEqual)(entry, resolved2.enrollment)))
       return void 0;
-    return { current, resolved, runtime };
+    return { current, resolved: resolved2, runtime };
   };
   const capacityPool = (runtime, runtimeDomain) => ({
     daemonId: runtime.daemonId,
@@ -19692,7 +19717,7 @@ function createCapacityController(options) {
       if (current?.admissions !== "enabled" || !(0, import_node_util13.isDeepStrictEqual)(current, policy))
         throw new Error("Capacity controller policy changed.");
       validate3();
-      const resolved = await enrollCapacityLifecycle(
+      const resolved2 = await enrollCapacityLifecycle(
         current,
         {
           path: environment.repoPath,
@@ -19703,16 +19728,16 @@ function createCapacityController(options) {
         options.directory,
         bindingResolver
       );
-      if (!(0, import_node_util13.isDeepStrictEqual)(resolved.environment, environment) || signal.aborted)
+      if (!(0, import_node_util13.isDeepStrictEqual)(resolved2.environment, environment) || signal.aborted)
         throw new Error("Capacity submission binding changed.");
       if (!(0, import_node_util13.isDeepStrictEqual)(readCapacityPolicy(options.directory), current))
         throw new Error("Capacity submission policy changed during resolution.");
-      const runtime = current.domains[resolved.enrollment.runtimeDomain];
-      if (runtime?.kind !== "runtime" || runtime.hostDomain !== resolved.enrollment.hostDomain || current.domains[runtime.hostDomain]?.kind !== "host" || !current.enrollments.some((entry) => (0, import_node_util13.isDeepStrictEqual)(entry, resolved.enrollment)))
+      const runtime = current.domains[resolved2.enrollment.runtimeDomain];
+      if (runtime?.kind !== "runtime" || runtime.hostDomain !== resolved2.enrollment.hostDomain || current.domains[runtime.hostDomain]?.kind !== "host" || !current.enrollments.some((entry) => (0, import_node_util13.isDeepStrictEqual)(entry, resolved2.enrollment)))
         throw new Error("Capacity pool does not match policy enrollment.");
       const pool = {
         daemonId: runtime.daemonId,
-        runtimeDomain: resolved.enrollment.runtimeDomain,
+        runtimeDomain: resolved2.enrollment.runtimeDomain,
         hostDomain: runtime.hostDomain,
         hostChargeCeilingBytes: runtime.hostChargeCeilingBytes
       };
@@ -19723,11 +19748,11 @@ function createCapacityController(options) {
         settlePreparedLifecycleCapacity({
           identity: identity2,
           controller,
-          estimates: resolved.estimates,
-          enrollment: resolved.enrollment,
+          estimates: resolved2.estimates,
+          enrollment: resolved2.enrollment,
           directory: options.directory
         });
-      const charge = capacityRequest(resolved.estimates, resolved.enrollment, {
+      const charge = capacityRequest(resolved2.estimates, resolved2.enrollment, {
         environmentId: record5.state.environmentId,
         profile: environment.profile,
         ...record5.activeProfile ? { activeProfile: record5.activeProfile } : {},
@@ -19751,8 +19776,8 @@ function createCapacityController(options) {
         try {
           await publishQueuedStartupWitness({
             identity: identity2,
-            provider: resolved.enrollment.provider,
-            providerId: resolved.enrollment.providerId,
+            provider: resolved2.enrollment.provider,
+            providerId: resolved2.enrollment.providerId,
             operationId: prepared.operationId,
             fence: prepared.request.fence,
             profile: environment.profile,
@@ -19786,7 +19811,7 @@ function createCapacityController(options) {
               reservationId: (0, import_node_crypto24.randomUUID)(),
               policyRevision: current.revision
             },
-            { estimates: resolved.estimates, enrollment: resolved.enrollment, pool }
+            { estimates: resolved2.estimates, enrollment: resolved2.enrollment, pool }
           );
           acceptedPayloads.set(prepared.operationId, signature);
           for (const id5 of acceptedPayloads.keys()) {
@@ -19851,9 +19876,9 @@ function createCapacityController(options) {
       }
       if (!failedCapabilities.some((capability) => observed.failedCapabilities.includes(capability)))
         return;
-      let resolved;
+      let resolved2;
       try {
-        resolved = await resolveCapacityEnrollment(
+        resolved2 = await resolveCapacityEnrollment(
           current,
           { path: environment.repoPath, profile: environment.profile, require: [] },
           signal,
@@ -19862,15 +19887,15 @@ function createCapacityController(options) {
       } catch {
         return;
       }
-      if (signal.aborted || !(0, import_node_util13.isDeepStrictEqual)(resolved.environment, environment)) return;
+      if (signal.aborted || !(0, import_node_util13.isDeepStrictEqual)(resolved2.environment, environment)) return;
       if (!(0, import_node_util13.isDeepStrictEqual)(readCapacityPolicy(options.directory), current)) return;
-      const runtime = current.domains[resolved.enrollment.runtimeDomain];
-      if (runtime?.kind !== "runtime" || runtime.hostDomain !== resolved.enrollment.hostDomain || current.domains[runtime.hostDomain]?.kind !== "host" || !current.enrollments.some((entry) => (0, import_node_util13.isDeepStrictEqual)(entry, resolved.enrollment)))
+      const runtime = current.domains[resolved2.enrollment.runtimeDomain];
+      if (runtime?.kind !== "runtime" || runtime.hostDomain !== resolved2.enrollment.hostDomain || current.domains[runtime.hostDomain]?.kind !== "host" || !current.enrollments.some((entry) => (0, import_node_util13.isDeepStrictEqual)(entry, resolved2.enrollment)))
         return;
       const identity2 = environmentIdentity(environment);
       const record5 = readReliabilityOperation(identity2);
       const durable = record5?.enrollment;
-      if (!record5 || !durable || durable.policyRevision !== current.revision || durable.gitCommonDir !== resolved.enrollment.gitCommonDir || durable.providerId !== resolved.enrollment.providerId || durable.hostDomain !== resolved.enrollment.hostDomain || durable.runtimeDomain !== resolved.enrollment.runtimeDomain || durable.endpoint !== runtime.endpoint || durable.daemonId !== runtime.daemonId || durable.estimatesDigest !== resolved.enrollment.estimatesDigest)
+      if (!record5 || !durable || durable.policyRevision !== current.revision || durable.gitCommonDir !== resolved2.enrollment.gitCommonDir || durable.providerId !== resolved2.enrollment.providerId || durable.hostDomain !== resolved2.enrollment.hostDomain || durable.runtimeDomain !== resolved2.enrollment.runtimeDomain || durable.endpoint !== runtime.endpoint || durable.daemonId !== runtime.daemonId || durable.estimatesDigest !== resolved2.enrollment.estimatesDigest)
         return;
       if (record5.state.operation && queue.hasOperation(record5.state.operation.id)) return;
       let proof;
@@ -19885,7 +19910,7 @@ function createCapacityController(options) {
       if (required.length === 0) return;
       const pool = {
         daemonId: runtime.daemonId,
-        runtimeDomain: resolved.enrollment.runtimeDomain,
+        runtimeDomain: resolved2.enrollment.runtimeDomain,
         hostDomain: runtime.hostDomain,
         hostChargeCeilingBytes: runtime.hostChargeCeilingBytes
       };
@@ -19924,7 +19949,7 @@ function createCapacityController(options) {
         return;
       }
       if (!prepared) return;
-      const charge = capacityRequest(resolved.estimates, resolved.enrollment, {
+      const charge = capacityRequest(resolved2.estimates, resolved2.enrollment, {
         environmentId: record5.state.environmentId,
         profile: environment.profile,
         ...record5.activeProfile ? { activeProfile: record5.activeProfile } : {},
@@ -19939,7 +19964,7 @@ function createCapacityController(options) {
             reservationId: (0, import_node_crypto24.randomUUID)(),
             policyRevision: current.revision
           },
-          { estimates: resolved.estimates, enrollment: resolved.enrollment, pool }
+          { estimates: resolved2.estimates, enrollment: resolved2.enrollment, pool }
         );
       } catch {
         try {
@@ -20968,7 +20993,7 @@ async function runController(options) {
           );
           void initial.then(async ({ environment, identity: identity2, revision, requirements: requirements2 }) => {
             let persisted;
-            const resolved = await resolve(
+            const resolved2 = await resolve(
               {
                 path: environment.repoPath,
                 profile: environment.profile,
@@ -20980,7 +21005,7 @@ async function runController(options) {
               }
             );
             assertActive();
-            if (!persisted || JSON.stringify(resolved) !== JSON.stringify(environment))
+            if (!persisted || JSON.stringify(resolved2) !== JSON.stringify(environment))
               throw new Error("Protection ownership evidence unavailable or changed.");
             const proof = persisted;
             const finish2 = serial.then(() => {
@@ -21979,12 +22004,13 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - \`devrouter workspace up <branch> [--path <dir>] [--no-devpod] [--open]\`: create a worktree and start/prove it unless create-only mode is requested
 - \`devrouter workspace ensure [path] [--profile <name>] [--repair] [--open] [--json]\`: compatibility alias of \`devrouter ensure\`
 - \`devrouter workspace ls [--json]\`: list ownership, Git, workspace runtime, route, path, and branch evidence
-- \`devrouter workspace cleanup [--repo .] [--inactive-for 30d] [--check-merged] [--measure-size] [--all-worktrees] [--manifest [--action reclaim|trim] [--output <file>]] [--json]\`: report-only cleanup evidence and exact guarded suggestions; \`--manifest\` emits an approval manifest instead of the report
+- \`devrouter workspace cleanup [--repo .] [--inactive-for 30d] [--check-merged] [--measure-size] [--all-worktrees] [--manifest [--action reclaim|trim|leftover] [--output <file>]] [--json]\`: report-only cleanup evidence and exact guarded suggestions; \`--all-worktrees\` also lists Docker leftovers of deleted checkouts; \`--manifest\` emits an approval manifest instead of the report
 - \`devrouter workspace stop <workspace|branch>\`: stop DevPod and routes; preserve checkout, owner record, and data
 - \`devrouter workspace down <workspace|branch> [--keep-worktree]\`: delete runtime/routes and optionally remove the clean worktree and record
 - \`devrouter workspace gc [--json] [--yes]\`: report missing owners by default; apply exact eligible cleanup with \`--yes\`
 - \`devrouter workspace manifest hash|select <file>\`: print a manifest's SHA-256, or a canonical subset of exact candidate IDs (\`--expected-sha256\`, \`--id\`)
 - \`devrouter workspace reclaim|trim --manifest <file> --sha256 <hash> [--veto-command <abs>] [--yes] [--json]\`: apply an approved manifest; dry run without \`--yes\`
+- \`devrouter workspace leftover --manifest <file> --sha256 <hash> [--yes] [--json]\`: remove the Docker containers, volumes and networks of an approved leftover manifest; dry run without \`--yes\`
 
 ## Agent harness gating
 
@@ -22461,8 +22487,8 @@ var init_ai_prompt = __esm({
         purpose: "List owner, Git, workspace runtime, route, path, and branch evidence for managed workspaces."
       },
       {
-        command: "devrouter workspace cleanup [--repo <path>] [--inactive-for 30d] [--check-merged] [--measure-size] [--all-worktrees] [--manifest [--action reclaim|trim] [--output <file>]] [--json]",
-        purpose: "Report-only evidence for managed linked workspaces; activity is advisory, --check-merged alone enables read-only origin/forge checks, --all-worktrees adds RECLAIM/KEEP/PRUNE verdicts for every linked worktree, and --manifest emits an approval manifest instead of the report."
+        command: "devrouter workspace cleanup [--repo <path>] [--inactive-for 30d] [--check-merged] [--measure-size] [--all-worktrees] [--manifest [--action reclaim|trim|leftover] [--output <file>]] [--json]",
+        purpose: "Report-only evidence for managed linked workspaces; activity is advisory, --check-merged alone enables read-only origin/forge checks, --all-worktrees adds RECLAIM/KEEP/PRUNE verdicts for every linked worktree and lists Docker leftovers of deleted checkouts, and --manifest emits an approval manifest instead of the report."
       },
       {
         command: "devrouter workspace stop <workspace|branch>",
@@ -22480,6 +22506,10 @@ var init_ai_prompt = __esm({
         command: "devrouter workspace reclaim|trim --manifest <file> --sha256 <hash> [--veto-command <abs>] [--yes] [--json]",
         purpose: "Apply a person-approved manifest by its SHA-256; dry run without --yes, never adds targets, and re-checks each target inside its lifecycle lock."
       },
+      {
+        command: "devrouter workspace leftover --manifest <file> --sha256 <hash> [--yes] [--json]",
+        purpose: "Remove the Docker containers, volumes and networks of a person-approved leftover manifest; dry run without --yes, and each stack is re-derived inside the provider locks and skipped if it changed."
+      },
       {
         command: "devrouter workspace journal settle [path] [--json]",
         purpose: "Settle a lifecycle operation whose worker is provably gone as unobservable so ensure/stop can proceed; never hand-edit the devrouter state directory."
@@ -22661,6 +22691,48 @@ ${renderTable(
   if (!report.checkMerged) {
     process.stdout.write("Forge not checked: rerun with --check-merged for RECLAIM verdicts.\n");
   }
+  printDockerLeftovers(report);
+}
+function printDockerLeftovers(report) {
+  const leftovers = report.dockerLeftovers;
+  if (!leftovers) return;
+  if (leftovers.status === "unavailable") {
+    process.stdout.write(`
+Docker leftovers: not checked (${leftovers.reason}).
+`);
+    return;
+  }
+  const rows2 = [
+    ...leftovers.leftovers.map((entry) => [
+      entry.project,
+      entry.checkout,
+      `removable: ${entry.containers.length} container(s), ${entry.volumes.length} volume(s), ${entry.networks.length} network(s)`
+    ]),
+    ...leftovers.blocked.map((entry) => [
+      entry.project,
+      entry.checkout,
+      `blocked: ${entry.reason}; next: ${entry.next}`
+    ])
+  ];
+  if (rows2.length) {
+    process.stdout.write(
+      `
+Docker leftovers of deleted checkouts:
+${renderTable(["PROJECT", "CHECKOUT", "STATUS"], rows2)}
+`
+    );
+  }
+  if (leftovers.leftovers.length) {
+    process.stdout.write(
+      "Approve removal with `workspace cleanup --all-worktrees --manifest --action leftover --output <file>`, then `workspace leftover`.\n"
+    );
+  }
+  if (leftovers.unattributedVolumes.length) {
+    process.stdout.write(
+      `${leftovers.unattributedVolumes.length} unused Compose volume(s) cannot be traced to a checkout and are never removed by devrouter; list them with --json.
+`
+    );
+  }
 }
 function printReclaimReport(report, verb = "reclaim") {
   process.stdout.write(
@@ -23357,8 +23429,8 @@ function buildHostPortClaimsCheck(repoPath, workspace) {
       profile: runtime.resolvedProfile,
       linked
     });
-    const gitCommonDir = linked ? resolveGitCommonDir(repoPath) : void 0;
-    const workspaceEnv = linked && workspace && gitCommonDir ? { token: workspace, gitCommonDir } : void 0;
+    const gitCommonDir2 = linked ? resolveGitCommonDir(repoPath) : void 0;
+    const workspaceEnv = linked && workspace && gitCommonDir2 ? { token: workspace, gitCommonDir: gitCommonDir2 } : void 0;
     const conflicts = detectHostPortClaimConflicts({ repoPath, plan, workspace: workspaceEnv });
     if (conflicts.length === 0) {
       return {
@@ -24134,7 +24206,7 @@ function probeInstalledCliVersion(executable) {
 }
 function buildCliPathCheck(options = {}) {
   const id5 = "global.cli-path";
-  const runningVersion = options.runningVersion ?? (true ? "0.2.0" : "0.0.0-dev");
+  const runningVersion = options.runningVersion ?? (true ? "0.3.1" : "0.0.0-dev");
   if (runningVersion === "0.0.0-dev") {
     return {
       id: id5,
@@ -24155,12 +24227,12 @@ function buildCliPathCheck(options = {}) {
     if (!isExecutableFile(executable)) {
       continue;
     }
-    const resolved = realpathOrUndefined(executable) ?? executable;
-    if (seen.has(resolved)) {
+    const resolved2 = realpathOrUndefined(executable) ?? executable;
+    if (seen.has(resolved2)) {
       continue;
     }
-    seen.add(resolved);
-    const running = runningEntry !== void 0 && resolved === runningEntry;
+    seen.add(resolved2);
+    const running = runningEntry !== void 0 && resolved2 === runningEntry;
     entries.push({
       executable,
       running,
@@ -25030,7 +25102,7 @@ async function buildDoctorReport(options = {}) {
           suggestion: `Remedy ${expansionNotice.remedy.code}: set a named default profile other than '${expansionNotice.profile}'${remedyCandidates}.`
         });
       }
-      const cliVersion = true ? "0.2.0" : "0.0.0-dev";
+      const cliVersion = true ? "0.3.1" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       const installedKnown = cliVersion !== "0.0.0-dev";
       const versionComparison = installedKnown && configVersion ? compareSemver(configVersion, cliVersion) : void 0;
@@ -25689,11 +25761,11 @@ var init_up = __esm({
 
 // src/commands/environment-path.ts
 function resolveGitCheckoutPath(repoPath) {
-  const resolved = resolveRepoPath(repoPath);
+  const resolved2 = resolveRepoPath(repoPath);
   try {
-    return resolveGitTopLevel(resolved);
+    return resolveGitTopLevel(resolved2);
   } catch (error) {
-    throw new Error(`Environment commands require a Git repository: '${resolved}'.`, {
+    throw new Error(`Environment commands require a Git repository: '${resolved2}'.`, {
       cause: error
     });
   }
@@ -28714,8 +28786,8 @@ function prepareDockerOverlay(repoPath, appName, apps, publishTcpPorts = false)
 function runDockerComposeUp(repoPath, composeFiles2, overlayPath, services) {
   const fileArgs = [];
   for (const composeFile of composeFiles2) {
-    const resolved = assertPathWithinRepo(composeFile, repoPath, "composeFiles");
-    fileArgs.push("-f", resolved);
+    const resolved2 = assertPathWithinRepo(composeFile, repoPath, "composeFiles");
+    fileArgs.push("-f", resolved2);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "up", "-d", "--wait", ...services];
   const result = (0, import_node_child_process36.spawnSync)("docker", args, {
@@ -28732,8 +28804,8 @@ function runDockerComposeUp(repoPath, composeFiles2, overlayPath, services) {
 function queryRunningComposeServices(repoPath, composeFiles2, overlayPath, services) {
   const fileArgs = [];
   for (const composeFile of composeFiles2) {
-    const resolved = assertPathWithinRepo(composeFile, repoPath, "composeFiles");
-    fileArgs.push("-f", resolved);
+    const resolved2 = assertPathWithinRepo(composeFile, repoPath, "composeFiles");
+    fileArgs.push("-f", resolved2);
   }
   const args = [
     "compose",
@@ -28768,8 +28840,8 @@ function queryRunningComposeServices(repoPath, composeFiles2, overlayPath, servi
 function runDockerComposeStop(repoPath, composeFiles2, overlayPath, services) {
   const fileArgs = [];
   for (const composeFile of composeFiles2) {
-    const resolved = assertPathWithinRepo(composeFile, repoPath, "composeFiles");
-    fileArgs.push("-f", resolved);
+    const resolved2 = assertPathWithinRepo(composeFile, repoPath, "composeFiles");
+    fileArgs.push("-f", resolved2);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "stop", ...services];
   const result = (0, import_node_child_process36.spawnSync)("docker", args, {
@@ -28785,8 +28857,8 @@ function runDockerComposeStop(repoPath, composeFiles2, overlayPath, services) {
 function runDockerComposeLogs(repoPath, composeFiles2, overlayPath, services, tail = 20) {
   const fileArgs = [];
   for (const composeFile of composeFiles2) {
-    const resolved = assertPathWithinRepo(composeFile, repoPath, "composeFiles");
-    fileArgs.push("-f", resolved);
+    const resolved2 = assertPathWithinRepo(composeFile, repoPath, "composeFiles");
+    fileArgs.push("-f", resolved2);
   }
   const args = [
     "compose",
@@ -28806,8 +28878,8 @@ function runDockerComposeLogs(repoPath, composeFiles2, overlayPath, services, ta
 function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internalPort) {
   const fileArgs = [];
   for (const composeFile of composeFiles2) {
-    const resolved = assertPathWithinRepo(composeFile, repoPath, "composeFiles");
-    fileArgs.push("-f", resolved);
+    const resolved2 = assertPathWithinRepo(composeFile, repoPath, "composeFiles");
+    fileArgs.push("-f", resolved2);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "port", service, String(internalPort)];
   const result = (0, import_node_child_process36.spawnSync)("docker", args, {
@@ -29647,133 +29719,6 @@ var init_tls2 = __esm({
   }
 });
 
-// src/core/workspace-consumption.ts
-function measureWorktreeConsumption(worktreePath, options) {
-  const deadlineMs = options?.deadlineMs ?? DEFAULT_DEADLINE_MS;
-  const startedAt = Date.now();
-  let rootStat;
-  try {
-    rootStat = import_node_fs53.default.lstatSync(worktreePath);
-  } catch (error) {
-    return { status: "unknown", reason: describeError(error, worktreePath) };
-  }
-  let rootEntries;
-  try {
-    rootEntries = import_node_fs53.default.readdirSync(worktreePath, { withFileTypes: true });
-  } catch (error) {
-    return { status: "unknown", reason: describeError(error, worktreePath) };
-  }
-  const seenInodes = /* @__PURE__ */ new Set();
-  let bytes2 = 0;
-  let timedOut = false;
-  let unreadableReason = null;
-  const accumulate = (stat) => {
-    if (stat.nlink > 1) {
-      const key = `${stat.dev}:${stat.ino}`;
-      if (seenInodes.has(key)) return;
-      seenInodes.add(key);
-    }
-    bytes2 += stat.blocks * BLOCK_SIZE_BYTES;
-  };
-  const deadlineExceeded = () => Date.now() - startedAt >= deadlineMs;
-  accumulate(rootStat);
-  const stack = [{ dirPath: worktreePath, entries: rootEntries }];
-  while (stack.length > 0 && !timedOut && !unreadableReason) {
-    const { dirPath, entries } = stack.pop();
-    for (const entry of entries) {
-      if (deadlineExceeded()) {
-        timedOut = true;
-        break;
-      }
-      const entryPath = import_node_path66.default.join(dirPath, entry.name);
-      let entryStat;
-      try {
-        entryStat = import_node_fs53.default.lstatSync(entryPath);
-      } catch (error) {
-        if (error?.code === "ENOENT") continue;
-        unreadableReason = describeIncompleteWalk(error);
-        break;
-      }
-      accumulate(entryStat);
-      if (!entryStat.isDirectory()) continue;
-      let childEntries;
-      try {
-        childEntries = import_node_fs53.default.readdirSync(entryPath, { withFileTypes: true });
-      } catch (error) {
-        unreadableReason = describeIncompleteWalk(error);
-        break;
-      }
-      stack.push({ dirPath: entryPath, entries: childEntries });
-    }
-  }
-  if (timedOut) {
-    return { status: "unknown", reason: `exceeded deadline of ${deadlineMs}ms` };
-  }
-  if (unreadableReason) {
-    return { status: "unknown", reason: unreadableReason };
-  }
-  return { status: "measured", bytes: bytes2 };
-}
-function describeIncompleteWalk(error) {
-  return `could not read every path inside the worktree: ${error?.message ?? String(error)}`;
-}
-function measureContainerConsumption(worktreePaths, dependencies) {
-  const byWorktree = /* @__PURE__ */ new Map();
-  if (worktreePaths.length === 0) return byWorktree;
-  const inspect = dependencies?.inspect ?? inspectWorkspaceContainers;
-  const containers2 = inspect();
-  const attributedIds = /* @__PURE__ */ new Set();
-  for (const worktreePath of worktreePaths) {
-    for (const container of workspaceAppContainers(containers2, worktreePath)) {
-      attributedIds.add(container.id);
-    }
-  }
-  const sized = attributedIds.size === 0 ? [] : inspect({ withSize: true, ids: Array.from(attributedIds) });
-  for (const worktreePath of worktreePaths) {
-    byWorktree.set(worktreePath, summarizeContainers(workspaceAppContainers(sized, worktreePath)));
-  }
-  return byWorktree;
-}
-function summarizeContainers(containers2) {
-  let writable = 0;
-  let shared = 0;
-  for (const container of containers2) {
-    const { sizeRw, sizeRootFs } = container;
-    if (typeof sizeRw !== "number" || typeof sizeRootFs !== "number" || !Number.isFinite(sizeRw) || !Number.isFinite(sizeRootFs) || sizeRootFs < sizeRw) {
-      const unknown = {
-        status: "unknown",
-        reason: `container ${container.id.slice(0, 12)} reported no usable size`
-      };
-      return { containerWritable: unknown, imageShared: unknown };
-    }
-    writable += sizeRw;
-    shared += sizeRootFs - sizeRw;
-  }
-  return {
-    containerWritable: { status: "measured", bytes: writable },
-    imageShared: { status: "measured", bytes: shared }
-  };
-}
-function describeError(error, worktreePath) {
-  const code = error?.code;
-  if (code === "ENOENT") return `worktree path '${worktreePath}' does not exist`;
-  if (code === "EACCES" || code === "EPERM") {
-    return `permission denied reading worktree path '${worktreePath}'`;
-  }
-  return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
-}
-var import_node_fs53, import_node_path66, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
-var init_workspace_consumption = __esm({
-  "src/core/workspace-consumption.ts"() {
-    "use strict";
-    import_node_fs53 = __toESM(require("fs"));
-    import_node_path66 = __toESM(require("path"));
-    init_devpod_environment();
-    DEFAULT_DEADLINE_MS = 1e4;
-    BLOCK_SIZE_BYTES = 512;
-  }
-});
-
 // src/core/worktree-reclaim.ts
 function sortKeys(value) {
   if (Array.isArray(value)) return value.map(sortKeys);
@@ -29854,7 +29799,7 @@ function validateCandidate(value, index, action2, legacy) {
     }
   }
   for (const key of ["repo", "path", "commonDir", "gitDir"]) {
-    if (!import_node_path67.default.isAbsolute(candidate[key])) {
+    if (!import_node_path66.default.isAbsolute(candidate[key])) {
       throw new Error(`${label2}.${key} must be an absolute path`);
     }
   }
@@ -29960,7 +29905,7 @@ function validateManifest(value) {
   return root;
 }
 function readManifest(file) {
-  const raw = import_node_fs54.default.readFileSync(file);
+  const raw = import_node_fs53.default.readFileSync(file);
   let parsed;
   try {
     parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(raw));
@@ -30007,7 +29952,7 @@ function gitLine(cwd, args) {
   return result.status === 0 && !result.error && output2 ? output2 : void 0;
 }
 function readWorktreeIdentity(worktreePath) {
-  if (!import_node_fs54.default.existsSync(worktreePath)) return void 0;
+  if (!import_node_fs53.default.existsSync(worktreePath)) return void 0;
   const real = comparableWorkspacePath(worktreePath);
   const commonDir = gitLine(real, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
   const gitDir = gitLine(real, ["rev-parse", "--path-format=absolute", "--git-dir"]);
@@ -30027,13 +29972,13 @@ function identityMismatch(expected, actual) {
 function unmanagedActivityEpoch(worktreePath, gitDir) {
   let latest;
   for (const file of [
-    import_node_path67.default.join(gitDir, "index"),
-    import_node_path67.default.join(gitDir, "HEAD"),
-    import_node_path67.default.join(gitDir, "logs", "HEAD"),
+    import_node_path66.default.join(gitDir, "index"),
+    import_node_path66.default.join(gitDir, "HEAD"),
+    import_node_path66.default.join(gitDir, "logs", "HEAD"),
     worktreePath
   ]) {
     try {
-      const seconds = Math.floor(import_node_fs54.default.statSync(file).mtimeMs / 1e3);
+      const seconds = Math.floor(import_node_fs53.default.statSync(file).mtimeMs / 1e3);
       latest = latest === void 0 ? seconds : Math.max(latest, seconds);
     } catch {
     }
@@ -30087,12 +30032,12 @@ function buildReclaimManifest(report, createdAtEpoch) {
   return canonicalJson(manifest);
 }
 function receiptPath(commonDir, manifestSha256, id5) {
-  return import_node_path67.default.join(commonDir, "worktree-reclaim", "receipts", manifestSha256, `${id5}.json`);
+  return import_node_path66.default.join(commonDir, "worktree-reclaim", "receipts", manifestSha256, `${id5}.json`);
 }
 function matchingReceipt(candidate, manifestSha256) {
   try {
     const receipt = JSON.parse(
-      import_node_fs54.default.readFileSync(receiptPath(candidate.commonDir, manifestSha256, candidate.id), "utf-8")
+      import_node_fs53.default.readFileSync(receiptPath(candidate.commonDir, manifestSha256, candidate.id), "utf-8")
     );
     return receipt.kind === RECEIPT_KIND && receipt.schemaVersion === SCHEMA_VERSION && receipt.manifestSha256 === manifestSha256 && receipt.candidateId === candidate.id && receipt.path === candidate.path && receipt.head === candidate.head;
   } catch {
@@ -30101,7 +30046,7 @@ function matchingReceipt(candidate, manifestSha256) {
 }
 function writeReceipt(candidate, manifestSha256, steps, nowEpoch) {
   const file = receiptPath(candidate.commonDir, manifestSha256, candidate.id);
-  import_node_fs54.default.mkdirSync(import_node_path67.default.dirname(file), { recursive: true });
+  import_node_fs53.default.mkdirSync(import_node_path66.default.dirname(file), { recursive: true });
   writeFileAtomically(
     file,
     canonicalJson({
@@ -30132,9 +30077,9 @@ function runVetoCommand(command, worktreePath) {
   return result.status === 0 && !result.error && result.signal === null;
 }
 function assertVetoCommand(command) {
-  if (!import_node_path67.default.isAbsolute(command)) throw new Error("--veto-command must be an absolute path");
+  if (!import_node_path66.default.isAbsolute(command)) throw new Error("--veto-command must be an absolute path");
   try {
-    import_node_fs54.default.accessSync(command, import_node_fs54.default.constants.X_OK);
+    import_node_fs53.default.accessSync(command, import_node_fs53.default.constants.X_OK);
   } catch {
     throw new Error(`--veto-command '${command}' is missing or not executable`);
   }
@@ -30216,7 +30161,7 @@ async function applyReclaimManifest(options, dependencies) {
       outcome.status = "not-attempted";
       continue;
     }
-    if (!import_node_fs54.default.existsSync(candidate.path) && matchingReceipt(candidate, manifestSha256)) {
+    if (!import_node_fs53.default.existsSync(candidate.path) && matchingReceipt(candidate, manifestSha256)) {
       outcome.status = "already-done";
       continue;
     }
@@ -30285,14 +30230,14 @@ async function applyReclaimManifest(options, dependencies) {
   }
   return { manifestSha256, dryRun: !options.yes, targets, stoppedEarly };
 }
-var import_node_child_process38, import_node_crypto30, import_node_fs54, import_node_path67, MANIFEST_KIND, LEGACY_MANIFEST_KIND, RECEIPT_KIND, SCHEMA_VERSION, HEX_SHA, HEX_ID, VETO_TIMEOUT_MS, FUTURE_TOLERANCE_SECONDS, ROOT_KEYS, SESSION_ROOT_KEYS, LEGACY_ROOT_KEYS, CANDIDATE_KEYS, SESSION_CANDIDATE_KEYS, OPTIONAL_CANDIDATE_KEYS, ReclaimSkip;
+var import_node_child_process38, import_node_crypto30, import_node_fs53, import_node_path66, MANIFEST_KIND, LEGACY_MANIFEST_KIND, RECEIPT_KIND, SCHEMA_VERSION, HEX_SHA, HEX_ID, VETO_TIMEOUT_MS, FUTURE_TOLERANCE_SECONDS, ROOT_KEYS, SESSION_ROOT_KEYS, LEGACY_ROOT_KEYS, CANDIDATE_KEYS, SESSION_CANDIDATE_KEYS, OPTIONAL_CANDIDATE_KEYS, ReclaimSkip;
 var init_worktree_reclaim = __esm({
   "src/core/worktree-reclaim.ts"() {
     "use strict";
     import_node_child_process38 = require("child_process");
     import_node_crypto30 = require("crypto");
-    import_node_fs54 = __toESM(require("fs"));
-    import_node_path67 = __toESM(require("path"));
+    import_node_fs53 = __toESM(require("fs"));
+    import_node_path66 = __toESM(require("path"));
     init_atomic_file();
     init_workspace();
     MANIFEST_KIND = "worktree-reclaim-manifest";
@@ -30339,72 +30284,801 @@ var init_worktree_reclaim = __esm({
   }
 });
 
-// src/core/workspace-cleanup.ts
-function isRecord9(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
+// src/core/docker-leftovers.ts
+function dockerOutput(run, args) {
+  const result = run(args);
+  if (result.status !== 0) {
+    throw new Error(`docker ${args[0]} failed: ${result.stderr.trim() || "unknown error"}`);
+  }
+  return result.stdout;
 }
-function isSha2(value) {
-  return typeof value === "string" && /^[0-9a-f]{40,64}$/i.test(value);
+function listIds(run, args, kind) {
+  const ids2 = dockerOutput(run, args).split("\n").map((line) => line.trim()).filter(Boolean);
+  if (ids2.length > MAX_DOCKER_OBJECTS) {
+    throw new DockerListingBoundError(
+      `docker lists ${ids2.length} ${kind}; the leftover report reads at most ${MAX_DOCKER_OBJECTS}`
+    );
+  }
+  return ids2;
 }
-function parseTimestamp(value) {
-  if (typeof value !== "string") return void 0;
-  const timestamp = Date.parse(value);
-  return Number.isFinite(timestamp) ? timestamp : void 0;
+function inspectAll(run, command, ids2) {
+  const objects = [];
+  for (let start = 0; start < ids2.length; start += 200) {
+    const parsed = JSON.parse(dockerOutput(run, [...command, ...ids2.slice(start, start + 200)]));
+    if (!Array.isArray(parsed)) throw new Error(`docker ${command.join(" ")} returned no array`);
+    objects.push(...parsed);
+  }
+  return objects;
 }
-function validTimestamp(value) {
-  return parseTimestamp(value) !== void 0;
+function labelsOf(value) {
+  if (!value || typeof value !== "object") return {};
+  return Object.fromEntries(
+    Object.entries(value).filter(
+      (entry) => typeof entry[1] === "string"
+    )
+  );
 }
-function successfulOutput(result) {
-  if (result.status !== 0 || result.error) return void 0;
-  const output2 = result.stdout.trim();
-  return output2.length > 0 ? output2 : void 0;
+function readDockerInventory(run = defaultDockerRunner) {
+  const daemonId = dockerOutput(run, ["info", "--format", "{{.ID}}"]).trim();
+  if (!daemonId) throw new Error("docker info returned no daemon ID");
+  const containerIds = listIds(run, ["ps", "-a", "-q", "--no-trunc"], "containers");
+  const containers2 = inspectAll(run, ["container", "inspect"], containerIds).map((raw) => {
+    const entry = raw;
+    return {
+      id: entry.Id,
+      name: (entry.Name ?? "").replace(/^\//, ""),
+      state: entry.State?.Status ?? "unknown",
+      labels: labelsOf(entry.Config?.Labels),
+      volumes: (entry.Mounts ?? []).filter((mount) => mount.Type === "volume" && mount.Name).map((mount) => mount.Name)
+    };
+  });
+  const volumeNames = listIds(run, ["volume", "ls", "-q"], "volumes");
+  const volumes = inspectAll(run, ["volume", "inspect"], volumeNames).map((raw) => {
+    const entry = raw;
+    return { name: entry.Name, labels: labelsOf(entry.Labels), createdAt: entry.CreatedAt ?? "" };
+  });
+  const networkIds = listIds(
+    run,
+    ["network", "ls", "-q", "--no-trunc", "--filter", `label=${PROJECT_LABEL}`],
+    "networks"
+  );
+  const networks = inspectAll(run, ["network", "inspect"], networkIds).map((raw) => {
+    const entry = raw;
+    return {
+      id: entry.Id,
+      name: entry.Name,
+      labels: labelsOf(entry.Labels),
+      attached: Object.keys(entry.Containers ?? {}).length
+    };
+  });
+  return { daemonId, containers: containers2, volumes, networks };
 }
-function gitOutput(repoPath, args, commandRunner) {
-  return successfulOutput(commandRunner("git", ["-C", repoPath, ...args]));
+function checkoutOf(workingDir) {
+  return workingDir.replace(/\/+$/, "").replace(/\/\.devcontainer$/, "");
 }
-function quoteCommandArg(value) {
-  return /^[a-zA-Z0-9_./:@+-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+function isInsideOrEqual(parent, child) {
+  const relative2 = import_node_path67.default.relative(parent, child);
+  return relative2 === "" || !relative2.startsWith("..") && !import_node_path67.default.isAbsolute(relative2);
 }
-function workspaceCommand(repoPath, args, beforeRepo = [], afterRepo = []) {
-  return [
-    "devrouter",
-    "workspace",
-    ...args,
-    ...beforeRepo,
-    "--repo",
-    quoteCommandArg(repoPath),
-    ...afterRepo
-  ].join(" ");
+function isAnonymousVolume(volume) {
+  return /^[0-9a-f]{64}$/.test(volume.name) && !volume.labels[PROJECT_LABEL];
 }
-function parseInactiveFor(value = DEFAULT_INACTIVE_FOR) {
-  const match = /^(?<amount>[1-9]\d*)(?<unit>[smhdw])$/.exec(value);
-  if (!match?.groups) {
-    throw new Error(
-      "--inactive-for must be a positive integer followed by s, m, h, d, or w (for example 30d)."
-    );
-  }
-  const amount = Number(match.groups.amount);
-  const multiplier = { s: 1, m: 60, h: 3600, d: 86400, w: 604800 }[match.groups.unit];
-  const seconds = amount * multiplier;
-  if (!Number.isSafeInteger(seconds)) {
-    throw new Error("--inactive-for is too large.");
+function vanishedInsideTrees(checkout, context) {
+  const treesReal = context.realpath(context.treesPath);
+  if (!treesReal) return "out-of-scope";
+  const lexical = [context.treesPath, treesReal].some(
+    (prefix) => checkout !== prefix && isInsideOrEqual(prefix, checkout)
+  );
+  if (!lexical || context.exists(checkout)) return "out-of-scope";
+  let ancestor = import_node_path67.default.dirname(checkout);
+  while (!context.exists(ancestor)) {
+    const parent = import_node_path67.default.dirname(ancestor);
+    if (parent === ancestor) return "out-of-scope";
+    ancestor = parent;
+  }
+  const ancestorReal = context.realpath(ancestor);
+  if (ancestorReal === void 0 || !isInsideOrEqual(treesReal, ancestorReal)) {
+    return "out-of-scope";
+  }
+  for (let current = ancestor; ; current = import_node_path67.default.dirname(current)) {
+    const real = context.realpath(current);
+    if (real === void 0 || real === treesReal || !isInsideOrEqual(treesReal, real)) break;
+    if (context.exists(import_node_path67.default.join(current, ".git"))) return "inside-worktree";
+  }
+  return "vanished";
+}
+function resolved(file, context) {
+  const real = context.realpath(file);
+  return real && real !== import_node_path67.default.resolve(file) ? [import_node_path67.default.resolve(file), real] : [import_node_path67.default.resolve(file)];
+}
+function relation(entry, checkout, context) {
+  const entries = resolved(entry, context);
+  const checkouts = resolved(checkout, context);
+  if (entries.some((left) => checkouts.includes(left))) return "same";
+  const trees = resolved(context.treesPath, context);
+  const belowTrees = (left) => trees.some((root) => left !== root && isInsideOrEqual(root, left));
+  if (entries.some(
+    (left) => belowTrees(left) && checkouts.some((right) => isInsideOrEqual(left, right))
+  )) {
+    return "contains";
   }
-  return { input: value, seconds };
+  return void 0;
 }
-function evaluateWorkspaceActivity(evidence, cutoff) {
-  const cutoffTime = parseTimestamp(cutoff);
-  if (cutoffTime === void 0) {
-    throw new Error(`Invalid activity cutoff '${cutoff}'.`);
+function findDockerLeftovers(inventory, context) {
+  const byProject = /* @__PURE__ */ new Map();
+  for (const container of inventory.containers) {
+    const project = container.labels[PROJECT_LABEL];
+    if (!project) continue;
+    byProject.set(project, [...byProject.get(project) ?? [], container]);
+  }
+  const leftovers = [];
+  const blocked3 = [];
+  for (const [project, containers2] of [...byProject].sort(([a], [b]) => byteOrder(a, b))) {
+    const checkouts = new Set(
+      containers2.filter((container) => container.labels[WORKING_DIR_LABEL]).map((container) => checkoutOf(container.labels[WORKING_DIR_LABEL]))
+    );
+    if (checkouts.size !== 1) continue;
+    if (!containers2.some((container) => container.labels[PROVIDER_LABEL])) continue;
+    const [checkout] = checkouts;
+    const scope = vanishedInsideTrees(checkout, context);
+    if (scope === "out-of-scope") continue;
+    const block = (reason, next) => blocked3.push({ project, checkout, reason, next });
+    if (scope === "inside-worktree") {
+      block("the missing folder lies inside an existing checkout", "investigate");
+      continue;
+    }
+    if (!context.registriesReadable) {
+      block("a provider registry could not be read", "investigate");
+      continue;
+    }
+    const registered = (paths) => paths.map((entry) => relation(entry, checkout, context));
+    const all = [
+      ...registered(context.worktreePaths),
+      ...registered([...context.ownershipPaths, ...context.providerPaths])
+    ];
+    if (all.includes("contains")) {
+      block("a registered checkout contains the missing folder", "investigate");
+      continue;
+    }
+    if (registered(context.worktreePaths).includes("same")) {
+      block("Git still registers the vanished worktree", "git worktree prune");
+      continue;
+    }
+    if (all.includes("same")) {
+      block("a devrouter record or provider registration still names the checkout", "workspace gc");
+      continue;
+    }
+    const running = containers2.filter((container) => !STOPPED_STATES.has(container.state));
+    if (running.length) {
+      block(`${running.length} container(s) are not stopped`, "stop the stack");
+      continue;
+    }
+    leftovers.push(removableSet(project, checkout, containers2, inventory));
   }
-  const validEvidence = evidence.filter(
-    (entry) => entry.status === "valid" && validTimestamp(entry.timestamp)
-  );
-  const latestTime = validEvidence.reduce(
-    (latest, entry) => Math.max(
-      latest ?? Number.NEGATIVE_INFINITY,
-      parseTimestamp(entry.timestamp) ?? Number.NEGATIVE_INFINITY
-    ),
-    void 0
+  return {
+    daemonId: inventory.daemonId,
+    leftovers,
+    blocked: blocked3,
+    unattributedVolumes: unattributedVolumes(inventory, byProject)
+  };
+}
+function removableSet(project, checkout, containers2, inventory) {
+  const own = new Set(containers2.map((container) => container.id));
+  const mountedHere = new Set(containers2.flatMap((container) => container.volumes));
+  const mountedElsewhere = new Set(
+    inventory.containers.filter((container) => !own.has(container.id)).flatMap((container) => container.volumes)
+  );
+  return {
+    project,
+    checkout,
+    containers: containers2.map(({ id: id5, name, state }) => ({ id: id5, name, state })).sort((a, b) => byteOrder(a.id, b.id)),
+    volumes: inventory.volumes.filter(
+      (volume) => !mountedElsewhere.has(volume.name) && (volume.labels[PROJECT_LABEL] === project && volume.name.startsWith(`${project}_`) || isAnonymousVolume(volume) && mountedHere.has(volume.name))
+    ).map(({ name, createdAt }) => ({ name, createdAt })).sort((a, b) => byteOrder(a.name, b.name)),
+    networks: inventory.networks.filter(
+      (network) => network.labels[PROJECT_LABEL] === project && network.name.startsWith(`${project}_`) && network.attached === 0
+    ).map(({ id: id5, name }) => ({ id: id5, name })).sort((a, b) => byteOrder(a.id, b.id))
+  };
+}
+function unattributedVolumes(inventory, byProject) {
+  const mounted = new Set(inventory.containers.flatMap((container) => container.volumes));
+  return inventory.volumes.filter(
+    (volume) => volume.labels[PROJECT_LABEL] !== void 0 && !byProject.has(volume.labels[PROJECT_LABEL]) && !mounted.has(volume.name)
+  ).map((volume) => ({
+    name: volume.name,
+    project: volume.labels[PROJECT_LABEL],
+    reason: "no container of its Compose project remains, so no checkout can be proven"
+  })).sort((a, b) => byteOrder(a.name, b.name));
+}
+function readLeftoverContext(repoPath) {
+  resetWorkspaceRuntimeCaches();
+  const snapshots = getWorkspaceRegistrySnapshots();
+  return {
+    treesPath: import_node_path67.default.join(repoPath, "trees"),
+    worktreePaths: listGitWorktrees(repoPath).map((worktree) => worktree.path),
+    ownershipPaths: listWorkspaceOwnership(repoPath).map((record5) => record5.worktreePath),
+    providerPaths: listMergedRuntimeWorkspaces().map((workspace) => workspace.source.localFolder),
+    registriesReadable: snapshots.unavailable.length === 0,
+    realpath: (file) => {
+      try {
+        return import_node_fs54.default.realpathSync.native(file);
+      } catch {
+        return void 0;
+      }
+    },
+    exists: (file) => {
+      try {
+        import_node_fs54.default.lstatSync(file);
+        return true;
+      } catch (error) {
+        return error.code !== "ENOENT";
+      }
+    }
+  };
+}
+function leftoverCandidateId(daemonId, leftover) {
+  return sha256Hex(canonicalJson({ daemonId, ...leftover }));
+}
+function buildLeftoverManifest(repo, report, createdAtEpoch) {
+  const manifest = {
+    kind: LEFTOVER_MANIFEST_KIND,
+    schemaVersion: SCHEMA_VERSION2,
+    repo,
+    daemonId: report.daemonId,
+    createdAtEpoch,
+    candidateCount: report.leftovers.length,
+    candidates: report.leftovers.map((leftover) => ({
+      ...leftover,
+      id: leftoverCandidateId(report.daemonId, leftover)
+    }))
+  };
+  validateLeftoverManifest(manifest);
+  return canonicalJson(manifest);
+}
+function requireExactKeys2(value, keys2, label2) {
+  const actual = Object.keys(value).sort();
+  if (actual.join("\0") !== [...keys2].sort().join("\0")) {
+    throw new Error(`${label2} fields must be exactly: ${[...keys2].sort().join(", ")}`);
+  }
+}
+function requireString(value, label2) {
+  if (typeof value !== "string" || !value || value.includes("\0")) {
+    throw new Error(`${label2} must be a non-empty string`);
+  }
+}
+function requireSortedUnique(values, label2) {
+  const sorted = [...new Set(values)].sort(byteOrder);
+  if (sorted.length !== values.length || sorted.some((entry, index) => entry !== values[index])) {
+    throw new Error(`${label2} must be sorted and unique`);
+  }
+}
+function isLeftoverManifest(value) {
+  return Boolean(value) && typeof value === "object" && value.kind === LEFTOVER_MANIFEST_KIND;
+}
+function validateLeftoverManifest(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("manifest root must be an object");
+  }
+  const root = value;
+  if (root.kind !== LEFTOVER_MANIFEST_KIND) {
+    throw new Error(`manifest kind must be ${LEFTOVER_MANIFEST_KIND}`);
+  }
+  requireExactKeys2(
+    root,
+    ["candidateCount", "candidates", "createdAtEpoch", "daemonId", "kind", "repo", "schemaVersion"],
+    "manifest"
+  );
+  if (root.schemaVersion !== SCHEMA_VERSION2) {
+    throw new Error(`manifest schemaVersion must be ${SCHEMA_VERSION2}`);
+  }
+  requireString(root.repo, "manifest repo");
+  if (!import_node_path67.default.isAbsolute(root.repo)) throw new Error("manifest repo must be an absolute path");
+  requireString(root.daemonId, "manifest daemonId");
+  if (!Number.isInteger(root.createdAtEpoch) || root.createdAtEpoch < 0) {
+    throw new Error("manifest createdAtEpoch must be a non-negative integer");
+  }
+  if (!Array.isArray(root.candidates) || root.candidateCount !== root.candidates.length) {
+    throw new Error("manifest candidateCount does not match candidates");
+  }
+  const daemonId = root.daemonId;
+  root.candidates.forEach((raw, index) => {
+    const label2 = `candidate[${index}]`;
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+      throw new Error(`${label2} must be an object`);
+    }
+    const candidate = raw;
+    requireExactKeys2(
+      candidate,
+      ["checkout", "containers", "id", "networks", "project", "volumes"],
+      label2
+    );
+    requireString(candidate.project, `${label2}.project`);
+    requireString(candidate.checkout, `${label2}.checkout`);
+    if (!import_node_path67.default.isAbsolute(candidate.checkout)) {
+      throw new Error(`${label2}.checkout must be an absolute path`);
+    }
+    const members = [
+      ["containers", ["id", "name", "state"], "id"],
+      ["volumes", ["createdAt", "name"], "name"],
+      ["networks", ["id", "name"], "id"]
+    ];
+    for (const [key, fields2, sortKey] of members) {
+      const list2 = candidate[key];
+      if (!Array.isArray(list2)) throw new Error(`${label2}.${key} must be an array`);
+      for (const member of list2) {
+        requireExactKeys2(member, [...fields2], `${label2}.${key}[]`);
+        for (const field of fields2) {
+          if (field !== "createdAt") requireString(member[field], `${label2}.${key}[].${field}`);
+        }
+      }
+      requireSortedUnique(
+        list2.map((member) => member[sortKey]),
+        `${label2}.${key}`
+      );
+    }
+    if (!candidate.containers.length) {
+      throw new Error(`${label2}.containers must prove the checkout with at least one container`);
+    }
+    if (!HEX_ID2.test(String(candidate.id))) throw new Error(`${label2}.id is not a SHA-256`);
+    const { id: id5, ...leftover } = candidate;
+    if (id5 !== leftoverCandidateId(daemonId, leftover)) {
+      throw new Error(`${label2}.id does not match its contents`);
+    }
+  });
+  requireSortedUnique(
+    root.candidates.map((candidate) => candidate.project),
+    "manifest candidate projects"
+  );
+  return root;
+}
+function readLeftoverManifest(file) {
+  const raw = import_node_fs54.default.readFileSync(file);
+  let parsed;
+  try {
+    parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(raw));
+  } catch (error) {
+    throw new Error(`manifest is not valid UTF-8 JSON: ${error.message}`);
+  }
+  const manifest = validateLeftoverManifest(parsed);
+  if (canonicalJson(parsed) !== raw.toString("utf-8")) {
+    throw new Error("manifest is not in canonical JSON form");
+  }
+  return { raw, manifest };
+}
+function gitCommonDir(repo) {
+  const result = (0, import_node_child_process39.spawnSync)(
+    "git",
+    ["-C", repo, "rev-parse", "--path-format=absolute", "--git-common-dir"],
+    { encoding: "utf-8" }
+  );
+  const commonDir = result.stdout?.trim();
+  if (result.status !== 0 || !commonDir)
+    throw new Error(`cannot read the Git directory of ${repo}`);
+  return commonDir;
+}
+function currentRemovals(candidate, inventory, context) {
+  const report = findDockerLeftovers(inventory, context);
+  const projectContainers = inventory.containers.filter(
+    (container) => container.labels[PROJECT_LABEL] === candidate.project
+  );
+  let current;
+  if (projectContainers.length) {
+    const blocked3 = report.blocked.find((entry) => entry.project === candidate.project);
+    if (blocked3) throw new LeftoverSkip("blocked", `${blocked3.reason}; next: ${blocked3.next}`);
+    const leftover = report.leftovers.find((entry) => entry.project === candidate.project);
+    if (!leftover || leftover.checkout !== candidate.checkout) {
+      throw new LeftoverSkip("changed", "the project is no longer a leftover of this checkout");
+    }
+    current = leftover;
+  } else {
+    if (context.exists(candidate.checkout)) {
+      throw new LeftoverSkip("changed", "the checkout folder exists again");
+    }
+    const mounted = new Set(inventory.containers.flatMap((container) => container.volumes));
+    const ours = (object4) => object4.labels[PROJECT_LABEL] === candidate.project && object4.name.startsWith(`${candidate.project}_`);
+    current = {
+      project: candidate.project,
+      checkout: candidate.checkout,
+      containers: [],
+      volumes: inventory.volumes.filter(
+        (volume) => !mounted.has(volume.name) && (ours(volume) || isAnonymousVolume(volume) && candidate.volumes.some((approved) => approved.name === volume.name))
+      ).map(({ name, createdAt }) => ({ name, createdAt })),
+      networks: inventory.networks.filter((network) => ours(network) && network.attached === 0).map(({ id: id5, name }) => ({ id: id5, name }))
+    };
+  }
+  const approve = (present, approved, key, kind) => {
+    const allowed = new Set(approved.map(key));
+    const extra = present.filter((entry) => !allowed.has(key(entry)));
+    if (extra.length) {
+      throw new LeftoverSkip("changed", `${extra.length} unapproved ${kind} now belong to it`);
+    }
+  };
+  approve(current.containers, candidate.containers, (entry) => entry.id, "container(s)");
+  approve(
+    current.volumes,
+    candidate.volumes,
+    (entry) => `${entry.name}\0${entry.createdAt}`,
+    "volume(s)"
+  );
+  approve(current.networks, candidate.networks, (entry) => entry.id, "network(s)");
+  const stillPresent = (name) => inventory.volumes.some((volume) => volume.name === name);
+  const notRemovable = candidate.volumes.filter(
+    (volume) => stillPresent(volume.name) && !current.volumes.some((entry) => entry.name === volume.name)
+  );
+  if (notRemovable.length) {
+    throw new LeftoverSkip(
+      "changed",
+      `${notRemovable.length} approved volume(s) are now in use or re-created`
+    );
+  }
+  return current;
+}
+function removeMember(run, args, step, steps) {
+  const result = run(args);
+  if (result.status === 0) {
+    steps.push(`removed-${step}`);
+    return;
+  }
+  if (/no such (container|volume|network)/i.test(result.stderr)) {
+    steps.push(`gone-${step}`);
+    return;
+  }
+  throw new Error(`docker ${args.slice(0, 2).join(" ")} failed: ${result.stderr.trim()}`);
+}
+function applyLeftoverManifest(options, dependencies = {}) {
+  const { raw, manifest } = readLeftoverManifest(options.manifestFile);
+  const manifestSha256 = requireManifestHash(raw, options.sha256);
+  const now = dependencies.nowEpoch?.() ?? Math.floor(Date.now() / 1e3);
+  if (manifest.createdAtEpoch > now + FUTURE_TOLERANCE_SECONDS2) {
+    throw new Error("manifest creation time is in the future");
+  }
+  const age = Math.max(0, now - manifest.createdAtEpoch);
+  if (age > options.maxAgeSeconds) {
+    throw new Error(`manifest is ${age}s old; maximum allowed age is ${options.maxAgeSeconds}s`);
+  }
+  if (!manifest.candidates.length) throw new Error("approved manifest is empty");
+  const run = dependencies.run ?? defaultDockerRunner;
+  const readInventory = dependencies.readInventory ?? (() => readDockerInventory(run));
+  const readContext = dependencies.readContext ?? readLeftoverContext;
+  const withLocks = dependencies.withLocks ?? defaultWithLocks;
+  const targets = [];
+  for (const candidate of manifest.candidates) {
+    const outcome = {
+      id: candidate.id,
+      project: candidate.project,
+      status: "skipped",
+      steps: []
+    };
+    targets.push(outcome);
+    try {
+      withLocks(candidate.project, () => {
+        const inventory = readInventory();
+        if (inventory.daemonId !== manifest.daemonId) {
+          throw new LeftoverSkip(
+            "daemon-mismatch",
+            "the manifest was made for another Docker engine"
+          );
+        }
+        const current = currentRemovals(candidate, inventory, readContext(manifest.repo));
+        const count = current.containers.length + current.volumes.length + current.networks.length;
+        if (count === 0) {
+          outcome.status = "already-done";
+          return;
+        }
+        if (!options.yes) {
+          outcome.status = "would-remove";
+          outcome.reason = `${current.containers.length} container(s), ${current.volumes.length} volume(s), ${current.networks.length} network(s)`;
+          return;
+        }
+        const proves = (id5) => Boolean(
+          inventory.containers.find((container) => container.id === id5)?.labels[PROVIDER_LABEL]
+        );
+        const ordered = [
+          ...current.containers.filter((container) => !proves(container.id)),
+          ...current.containers.filter((container) => proves(container.id))
+        ];
+        for (const container of ordered) {
+          removeMember(run, ["rm", container.id], `container:${container.id}`, outcome.steps);
+        }
+        for (const volume of current.volumes) {
+          removeMember(run, ["volume", "rm", volume.name], `volume:${volume.name}`, outcome.steps);
+        }
+        for (const network of current.networks) {
+          removeMember(
+            run,
+            ["network", "rm", network.id],
+            `network:${network.name}`,
+            outcome.steps
+          );
+        }
+        writeLeftoverReceipt(
+          (dependencies.commonDir ?? gitCommonDir)(manifest.repo),
+          manifestSha256,
+          candidate,
+          outcome.steps,
+          now
+        );
+        outcome.status = "removed";
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      outcome.reason = message;
+      if (error instanceof LeftoverSkip) {
+        outcome.code = error.code;
+        continue;
+      }
+      outcome.status = "failed";
+      outcome.code = outcome.steps.length ? "teardown-failed" : "environment";
+    }
+  }
+  return { manifestSha256, dryRun: !options.yes, targets };
+}
+function leftoverReceiptPath(commonDir, manifestSha256, id5) {
+  return import_node_path67.default.join(commonDir, "devrouter-leftovers", "receipts", manifestSha256, `${id5}.json`);
+}
+function writeLeftoverReceipt(commonDir, manifestSha256, candidate, steps, nowEpoch) {
+  const file = leftoverReceiptPath(commonDir, manifestSha256, candidate.id);
+  import_node_fs54.default.mkdirSync(import_node_path67.default.dirname(file), { recursive: true });
+  writeFileAtomically(
+    file,
+    canonicalJson({
+      candidateId: candidate.id,
+      checkout: candidate.checkout,
+      completedAtEpoch: nowEpoch,
+      kind: LEFTOVER_RECEIPT_KIND,
+      manifestSha256,
+      project: candidate.project,
+      schemaVersion: SCHEMA_VERSION2,
+      steps,
+      tool: "devrouter"
+    })
+  );
+}
+var import_node_child_process39, import_node_fs54, import_node_path67, LEFTOVER_MANIFEST_KIND, LEFTOVER_RECEIPT_KIND, SCHEMA_VERSION2, MAX_DOCKER_OBJECTS, FUTURE_TOLERANCE_SECONDS2, PROJECT_LABEL, WORKING_DIR_LABEL, PROVIDER_LABEL, STOPPED_STATES, HEX_ID2, DockerListingBoundError, defaultDockerRunner, LeftoverSkip, defaultWithLocks;
+var init_docker_leftovers = __esm({
+  "src/core/docker-leftovers.ts"() {
+    "use strict";
+    import_node_child_process39 = require("child_process");
+    import_node_fs54 = __toESM(require("fs"));
+    import_node_path67 = __toESM(require("path"));
+    init_atomic_file();
+    init_devpod_mutation();
+    init_devpod_workspaces();
+    init_devsy_mutation();
+    init_workspace_ownership();
+    init_workspace_runtime();
+    init_worktree_reclaim();
+    LEFTOVER_MANIFEST_KIND = "docker-leftover-manifest";
+    LEFTOVER_RECEIPT_KIND = "docker-leftover-receipt";
+    SCHEMA_VERSION2 = 1;
+    MAX_DOCKER_OBJECTS = 5e3;
+    FUTURE_TOLERANCE_SECONDS2 = 300;
+    PROJECT_LABEL = "com.docker.compose.project";
+    WORKING_DIR_LABEL = "com.docker.compose.project.working_dir";
+    PROVIDER_LABEL = "dev.containers.id";
+    STOPPED_STATES = /* @__PURE__ */ new Set(["exited", "dead", "created"]);
+    HEX_ID2 = /^[0-9a-f]{64}$/;
+    DockerListingBoundError = class extends Error {
+    };
+    defaultDockerRunner = (args) => {
+      const result = (0, import_node_child_process39.spawnSync)("docker", args, {
+        encoding: "utf-8",
+        timeout: 6e4,
+        maxBuffer: 256 * 1024 * 1024
+      });
+      return {
+        status: result.error ? null : result.status,
+        stdout: result.stdout ?? "",
+        stderr: result.error?.message ?? result.stderr ?? ""
+      };
+    };
+    LeftoverSkip = class extends Error {
+      constructor(code, message) {
+        super(message);
+        this.code = code;
+      }
+    };
+    defaultWithLocks = (target, operation) => withMutationLock(
+      "Docker leftover removal",
+      target,
+      () => withMutationLock2("Docker leftover removal", target, operation)
+    );
+  }
+});
+
+// src/core/workspace-consumption.ts
+function measureWorktreeConsumption(worktreePath, options) {
+  const deadlineMs = options?.deadlineMs ?? DEFAULT_DEADLINE_MS;
+  const startedAt = Date.now();
+  let rootStat;
+  try {
+    rootStat = import_node_fs55.default.lstatSync(worktreePath);
+  } catch (error) {
+    return { status: "unknown", reason: describeError(error, worktreePath) };
+  }
+  let rootEntries;
+  try {
+    rootEntries = import_node_fs55.default.readdirSync(worktreePath, { withFileTypes: true });
+  } catch (error) {
+    return { status: "unknown", reason: describeError(error, worktreePath) };
+  }
+  const seenInodes = /* @__PURE__ */ new Set();
+  let bytes2 = 0;
+  let timedOut = false;
+  let unreadableReason = null;
+  const accumulate = (stat) => {
+    if (stat.nlink > 1) {
+      const key = `${stat.dev}:${stat.ino}`;
+      if (seenInodes.has(key)) return;
+      seenInodes.add(key);
+    }
+    bytes2 += stat.blocks * BLOCK_SIZE_BYTES;
+  };
+  const deadlineExceeded = () => Date.now() - startedAt >= deadlineMs;
+  accumulate(rootStat);
+  const stack = [{ dirPath: worktreePath, entries: rootEntries }];
+  while (stack.length > 0 && !timedOut && !unreadableReason) {
+    const { dirPath, entries } = stack.pop();
+    for (const entry of entries) {
+      if (deadlineExceeded()) {
+        timedOut = true;
+        break;
+      }
+      const entryPath = import_node_path68.default.join(dirPath, entry.name);
+      let entryStat;
+      try {
+        entryStat = import_node_fs55.default.lstatSync(entryPath);
+      } catch (error) {
+        if (error?.code === "ENOENT") continue;
+        unreadableReason = describeIncompleteWalk(error);
+        break;
+      }
+      accumulate(entryStat);
+      if (!entryStat.isDirectory()) continue;
+      let childEntries;
+      try {
+        childEntries = import_node_fs55.default.readdirSync(entryPath, { withFileTypes: true });
+      } catch (error) {
+        unreadableReason = describeIncompleteWalk(error);
+        break;
+      }
+      stack.push({ dirPath: entryPath, entries: childEntries });
+    }
+  }
+  if (timedOut) {
+    return { status: "unknown", reason: `exceeded deadline of ${deadlineMs}ms` };
+  }
+  if (unreadableReason) {
+    return { status: "unknown", reason: unreadableReason };
+  }
+  return { status: "measured", bytes: bytes2 };
+}
+function describeIncompleteWalk(error) {
+  return `could not read every path inside the worktree: ${error?.message ?? String(error)}`;
+}
+function measureContainerConsumption(worktreePaths, dependencies) {
+  const byWorktree = /* @__PURE__ */ new Map();
+  if (worktreePaths.length === 0) return byWorktree;
+  const inspect = dependencies?.inspect ?? inspectWorkspaceContainers;
+  const containers2 = inspect();
+  const attributedIds = /* @__PURE__ */ new Set();
+  for (const worktreePath of worktreePaths) {
+    for (const container of workspaceAppContainers(containers2, worktreePath)) {
+      attributedIds.add(container.id);
+    }
+  }
+  const sized = attributedIds.size === 0 ? [] : inspect({ withSize: true, ids: Array.from(attributedIds) });
+  for (const worktreePath of worktreePaths) {
+    byWorktree.set(worktreePath, summarizeContainers(workspaceAppContainers(sized, worktreePath)));
+  }
+  return byWorktree;
+}
+function summarizeContainers(containers2) {
+  let writable = 0;
+  let shared = 0;
+  for (const container of containers2) {
+    const { sizeRw, sizeRootFs } = container;
+    if (typeof sizeRw !== "number" || typeof sizeRootFs !== "number" || !Number.isFinite(sizeRw) || !Number.isFinite(sizeRootFs) || sizeRootFs < sizeRw) {
+      const unknown = {
+        status: "unknown",
+        reason: `container ${container.id.slice(0, 12)} reported no usable size`
+      };
+      return { containerWritable: unknown, imageShared: unknown };
+    }
+    writable += sizeRw;
+    shared += sizeRootFs - sizeRw;
+  }
+  return {
+    containerWritable: { status: "measured", bytes: writable },
+    imageShared: { status: "measured", bytes: shared }
+  };
+}
+function describeError(error, worktreePath) {
+  const code = error?.code;
+  if (code === "ENOENT") return `worktree path '${worktreePath}' does not exist`;
+  if (code === "EACCES" || code === "EPERM") {
+    return `permission denied reading worktree path '${worktreePath}'`;
+  }
+  return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
+}
+var import_node_fs55, import_node_path68, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var init_workspace_consumption = __esm({
+  "src/core/workspace-consumption.ts"() {
+    "use strict";
+    import_node_fs55 = __toESM(require("fs"));
+    import_node_path68 = __toESM(require("path"));
+    init_devpod_environment();
+    DEFAULT_DEADLINE_MS = 1e4;
+    BLOCK_SIZE_BYTES = 512;
+  }
+});
+
+// src/core/workspace-cleanup.ts
+function isRecord9(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isSha2(value) {
+  return typeof value === "string" && /^[0-9a-f]{40,64}$/i.test(value);
+}
+function parseTimestamp(value) {
+  if (typeof value !== "string") return void 0;
+  const timestamp = Date.parse(value);
+  return Number.isFinite(timestamp) ? timestamp : void 0;
+}
+function validTimestamp(value) {
+  return parseTimestamp(value) !== void 0;
+}
+function successfulOutput(result) {
+  if (result.status !== 0 || result.error) return void 0;
+  const output2 = result.stdout.trim();
+  return output2.length > 0 ? output2 : void 0;
+}
+function gitOutput(repoPath, args, commandRunner) {
+  return successfulOutput(commandRunner("git", ["-C", repoPath, ...args]));
+}
+function quoteCommandArg(value) {
+  return /^[a-zA-Z0-9_./:@+-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}
+function workspaceCommand(repoPath, args, beforeRepo = [], afterRepo = []) {
+  return [
+    "devrouter",
+    "workspace",
+    ...args,
+    ...beforeRepo,
+    "--repo",
+    quoteCommandArg(repoPath),
+    ...afterRepo
+  ].join(" ");
+}
+function parseInactiveFor(value = DEFAULT_INACTIVE_FOR) {
+  const match = /^(?<amount>[1-9]\d*)(?<unit>[smhdw])$/.exec(value);
+  if (!match?.groups) {
+    throw new Error(
+      "--inactive-for must be a positive integer followed by s, m, h, d, or w (for example 30d)."
+    );
+  }
+  const amount = Number(match.groups.amount);
+  const multiplier = { s: 1, m: 60, h: 3600, d: 86400, w: 604800 }[match.groups.unit];
+  const seconds = amount * multiplier;
+  if (!Number.isSafeInteger(seconds)) {
+    throw new Error("--inactive-for is too large.");
+  }
+  return { input: value, seconds };
+}
+function evaluateWorkspaceActivity(evidence, cutoff) {
+  const cutoffTime = parseTimestamp(cutoff);
+  if (cutoffTime === void 0) {
+    throw new Error(`Invalid activity cutoff '${cutoff}'.`);
+  }
+  const validEvidence = evidence.filter(
+    (entry) => entry.status === "valid" && validTimestamp(entry.timestamp)
+  );
+  const latestTime = validEvidence.reduce(
+    (latest, entry) => Math.max(
+      latest ?? Number.NEGATIVE_INFINITY,
+      parseTimestamp(entry.timestamp) ?? Number.NEGATIVE_INFINITY
+    ),
+    void 0
   );
   const latestTimestamp = latestTime === void 0 ? null : validEvidence.find((entry) => parseTimestamp(entry.timestamp) === latestTime)?.timestamp ?? null;
   const contributingEvidence = ACTIVITY_SOURCES.filter(
@@ -30433,7 +31107,7 @@ function evaluateWorkspaceActivity(evidence, cutoff) {
 }
 function readGitSnapshot(worktree, commandRunner) {
   const comparablePath = comparableWorkspacePath(worktree.path);
-  if (worktree.prunable || !import_node_fs55.default.existsSync(comparablePath)) {
+  if (worktree.prunable || !import_node_fs56.default.existsSync(comparablePath)) {
     return { worktree, checkout: "missing", head: null, committerDate: null };
   }
   const head = gitOutput(comparablePath, ["rev-parse", "--verify", "HEAD"], commandRunner);
@@ -31006,7 +31680,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
       containers2 = measureContainersFn(worktreePaths);
     } catch (error) {
       const reason = `container measurement failed: ${describeCause(error)}`;
-      containers2 = new Map(worktreePaths.map((path71) => [path71, unknownContainers(reason)]));
+      containers2 = new Map(worktreePaths.map((path72) => [path72, unknownContainers(reason)]));
     }
   }
   const rows2 = records.map((record5) => {
@@ -31065,7 +31739,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
     dependencies.listForge ?? ((identity2) => listForgeChanges(identity2))
   );
   const sources = (dependencies.readRuntimeSources ?? readRuntimeSources)(repoPath);
-  const disposable = import_node_fs55.default.existsSync(import_node_path68.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees?.disposable ?? [] : [];
+  const disposable = import_node_fs56.default.existsSync(import_node_path69.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees?.disposable ?? [] : [];
   const [primary, ...linked] = worktrees;
   const safetyFor = (worktree, worktreePath, evidence) => toSafety(
     classify({
@@ -31073,7 +31747,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
       branch: worktree?.branch,
       primary: primary !== void 0 && sameWorkspacePath(primary.path, worktreePath),
       locked: worktree?.locked ?? false,
-      missing: !worktree || worktree.prunable || !import_node_fs55.default.existsSync(worktreePath),
+      missing: !worktree || worktree.prunable || !import_node_fs56.default.existsSync(worktreePath),
       runtimeEvidence: evidence,
       forge,
       extraDisposablePatterns: disposable
@@ -31101,9 +31775,18 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
     ...base,
     workspaces: managedRows,
     worktrees: unmanaged,
+    dockerLeftovers: readDockerLeftoverEvidence(repoPath, dependencies),
     networkCapacity
   };
 }
+function readDockerLeftoverEvidence(repoPath, dependencies) {
+  try {
+    const read2 = dependencies.readDockerLeftovers ?? ((repo) => findDockerLeftovers(readDockerInventory(), readLeftoverContext(repo)));
+    return { status: "listed", ...read2(repoPath) };
+  } catch (error) {
+    return { status: "unavailable", reason: describeCause(error) };
+  }
+}
 function readPathEvidence(repoPath, worktreePath, inactiveFor, dependencies) {
   const records = (dependencies.listOwnership ?? listWorkspaceOwnership)(repoPath).filter(
     (record5) => sameWorkspacePath(record5.worktreePath, worktreePath)
@@ -31125,7 +31808,7 @@ function readPathEvidence(repoPath, worktreePath, inactiveFor, dependencies) {
   }
   const sources = (dependencies.readRuntimeSources ?? readRuntimeSources)(repoPath);
   const cutoffEpoch = Math.floor(Date.now() / 1e3) - parseInactiveFor(inactiveFor).seconds;
-  const gitDir = (0, import_node_child_process39.spawnSync)(
+  const gitDir = (0, import_node_child_process40.spawnSync)(
     "git",
     ["-C", worktreePath, "rev-parse", "--path-format=absolute", "--git-dir"],
     { encoding: "utf-8", env: READ_ONLY_GIT_ENV2 }
@@ -31145,7 +31828,7 @@ function classifyExactPath(repoPath, worktreePath, evidence, forge, extraDisposa
     branch: worktree?.branch,
     primary: worktrees[0] !== void 0 && sameWorkspacePath(worktrees[0].path, worktreePath),
     locked: worktree?.locked ?? false,
-    missing: !worktree || worktree.prunable || !import_node_fs55.default.existsSync(worktreePath),
+    missing: !worktree || worktree.prunable || !import_node_fs56.default.existsSync(worktreePath),
     runtimeEvidence: evidence.runtimeEvidence,
     forge,
     extraDisposablePatterns
@@ -31171,7 +31854,7 @@ function prepareReclaimVerdicts(repo, inactiveFor, dependencies = {}) {
     dependencies.listForge ?? ((identity2) => listForgeChanges(identity2))
   );
   const forge = evidence.status === "not-checked" ? { status: "unavailable", reason: "forge not checked" } : evidence;
-  const disposable = import_node_fs55.default.existsSync(import_node_path68.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees?.disposable ?? [] : [];
+  const disposable = import_node_fs56.default.existsSync(import_node_path69.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees?.disposable ?? [] : [];
   const paths = evidenceCache(
     (worktreePath) => readPathEvidence(repoPath, worktreePath, inactiveFor, dependencies)
   );
@@ -31190,7 +31873,7 @@ function prepareReclaimVerdicts(repo, inactiveFor, dependencies = {}) {
 }
 function prepareTrimChecks(repo, inactiveFor, dependencies = {}) {
   const repoPath = resolveRepoPath(repo);
-  const configured = import_node_fs55.default.existsSync(import_node_path68.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees : void 0;
+  const configured = import_node_fs56.default.existsSync(import_node_path69.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees : void 0;
   const patterns = configured?.trim ?? [];
   const paths = evidenceCache(
     (worktreePath) => readPathEvidence(repoPath, worktreePath, inactiveFor, dependencies)
@@ -31215,14 +31898,15 @@ function prepareTrimChecks(repo, inactiveFor, dependencies = {}) {
     isActive: (worktreePath) => paths.last(worktreePath).active
   };
 }
-var import_node_child_process39, import_node_fs55, import_node_path68, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var import_node_child_process40, import_node_fs56, import_node_path69, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
 var init_workspace_cleanup = __esm({
   "src/core/workspace-cleanup.ts"() {
     "use strict";
-    import_node_child_process39 = require("child_process");
-    import_node_fs55 = __toESM(require("fs"));
-    import_node_path68 = __toESM(require("path"));
+    import_node_child_process40 = require("child_process");
+    import_node_fs56 = __toESM(require("fs"));
+    import_node_path69 = __toESM(require("path"));
     init_devpod_workspaces();
+    init_docker_leftovers();
     init_forge_changes();
     init_host_routes();
     init_network_diagnostics();
@@ -31243,7 +31927,7 @@ var init_workspace_cleanup = __esm({
     ];
     defaultCommandRunner = (command, args, input2) => {
       const environment = command === "git" ? READ_ONLY_GIT_ENV2 : { ...process.env, LC_ALL: "C" };
-      const result = (0, import_node_child_process39.spawnSync)(command, args, {
+      const result = (0, import_node_child_process40.spawnSync)(command, args, {
         encoding: "utf-8",
         env: environment,
         ...input2 === void 0 ? {} : { input: input2 }
@@ -31337,20 +32021,20 @@ function warnMissingWorkspaceOwnership(repoPath) {
   );
 }
 function defaultWorktreePath(mainRepo, ws) {
-  return import_node_path69.default.join(mainRepo, "trees", ws);
+  return import_node_path70.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
-  const ignored = (0, import_node_child_process40.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
+  const ignored = (0, import_node_child_process41.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
     encoding: "utf-8"
   });
   if (ignored.status !== 0) {
     throw new Error(
-      `Default worktree root '${import_node_path69.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path69.default.join(mainRepo, ".gitignore")}' or use --path.`
+      `Default worktree root '${import_node_path70.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path70.default.join(mainRepo, ".gitignore")}' or use --path.`
     );
   }
 }
 function legacyDefaultWorktreePath(mainRepo, ws) {
-  return import_node_path69.default.join(import_node_path69.default.dirname(mainRepo), `${import_node_path69.default.basename(mainRepo)}-${ws}`);
+  return import_node_path70.default.join(import_node_path70.default.dirname(mainRepo), `${import_node_path70.default.basename(mainRepo)}-${ws}`);
 }
 function teardownFallbackPath(mainRepo, workspace) {
   const candidates = [
@@ -31462,7 +32146,7 @@ function assertFullDownPreflight(mainRepo, target) {
   if (sameWorkspacePath(target.worktreePath, mainRepo)) {
     throw new Error("Refusing to remove the primary Git checkout.");
   }
-  if (!target.worktree || target.worktree.prunable || !import_node_fs56.default.existsSync(target.worktreePath)) return;
+  if (!target.worktree || target.worktree.prunable || !import_node_fs57.default.existsSync(target.worktreePath)) return;
   if (target.worktree.locked) {
     throw new Error(
       `Worktree '${target.worktreePath}' is locked; unlock it before workspace down.`
@@ -31494,9 +32178,9 @@ async function workspaceUp(branch, opts = {}) {
       (candidate) => defaultWorktreePath(mainRepo, candidate)
     );
     const generatedPath = candidatePaths.find(
-      (candidate) => !import_node_fs56.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
+      (candidate) => !import_node_fs57.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
     );
-    const selectedPath = opts.path ? import_node_path69.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
+    const selectedPath = opts.path ? import_node_path70.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
     if (!selectedPath) {
       throw new Error(`Could not allocate a collision-safe worktree path for branch '${branch}'.`);
     }
@@ -31505,7 +32189,7 @@ async function workspaceUp(branch, opts = {}) {
         `Branch '${branch}' already uses worktree '${existingBranch.path}', not '${selectedPath}'.`
       );
     }
-    if (import_node_fs56.default.existsSync(selectedPath)) {
+    if (import_node_fs57.default.existsSync(selectedPath)) {
       const registered = worktrees.find(
         (worktree) => sameWorkspacePath(worktree.path, selectedPath)
       );
@@ -31524,11 +32208,11 @@ async function workspaceUp(branch, opts = {}) {
       return selectedPath;
     }
     if (!opts.path) assertDefaultWorktreeRootIgnored(mainRepo);
-    const add = (0, import_node_child_process40.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
+    const add = (0, import_node_child_process41.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
       encoding: "utf-8"
     });
     if (add.status !== 0) {
-      const addNew = (0, import_node_child_process40.spawnSync)(
+      const addNew = (0, import_node_child_process41.spawnSync)(
         "git",
         ["-C", mainRepo, "worktree", "add", "-b", branch, selectedPath],
         { encoding: "utf-8" }
@@ -31596,43 +32280,43 @@ function workspaceLs(repoPath) {
     };
   });
 }
-async function mutateWorkspaceRuntime(action2, resolved, worktrees, quiet = false) {
-  const devpods = listDevpodWorkspaces(resolved.worktreePath);
-  assertDevpodTargetSafe(resolved, worktrees, devpods);
-  const devpodId = resolved.record?.devpodId ?? resolved.workspace;
+async function mutateWorkspaceRuntime(action2, resolved2, worktrees, quiet = false) {
+  const devpods = listDevpodWorkspaces(resolved2.worktreePath);
+  assertDevpodTargetSafe(resolved2, worktrees, devpods);
+  const devpodId = resolved2.record?.devpodId ?? resolved2.workspace;
   claimLifecycleEffect();
-  const mutation = action2 === "stop" ? stopOwnedDevpodWorkspace(devpodId, resolved.worktreePath) : deleteOwnedDevpodWorkspace(devpodId, resolved.worktreePath);
-  if (action2 === "stop" && mutation.status === "absent" && readManagedRuntimeState(resolved.worktreePath, resolved.workspace)) {
+  const mutation = action2 === "stop" ? stopOwnedDevpodWorkspace(devpodId, resolved2.worktreePath) : deleteOwnedDevpodWorkspace(devpodId, resolved2.worktreePath);
+  if (action2 === "stop" && mutation.status === "absent" && readManagedRuntimeState(resolved2.worktreePath, resolved2.workspace)) {
     throw new Error(
       "Retained managed runtime has no exact provider registration; routes were preserved."
     );
   }
-  const retained = action2 === "stop" ? readManagedRuntimeState(resolved.worktreePath, resolved.workspace) : void 0;
+  const retained = action2 === "stop" ? readManagedRuntimeState(resolved2.worktreePath, resolved2.workspace) : void 0;
   let absent = mutation.status === "proven-absent";
   const remove = () => {
     if (retained?.stopBaseline) {
       absent = proveManagedStop(retained).status === "proven-absent";
-      if (absent && listRoutesForWorktreePath(resolved.worktreePath).some(
-        (route) => route.workspace !== resolved.workspace || !retained.desired.apps.includes(route.name)
+      if (absent && listRoutesForWorktreePath(resolved2.worktreePath).some(
+        (route) => route.workspace !== resolved2.workspace || !retained.desired.apps.includes(route.name)
       ))
         throw new Error("Absent stop contains routes outside the retained desired set.");
     }
     if (absent && !retained) {
-      if (listRoutesForWorktreePath(resolved.worktreePath).length)
+      if (listRoutesForWorktreePath(resolved2.worktreePath).length)
         throw new Error("Initial managed stop observed remaining workspace routes.");
       return [];
     }
     claimLifecycleEffect();
-    return removeWorkspaceRoutesForWorktree(resolved.workspace, resolved.worktreePath);
+    return removeWorkspaceRoutesForWorktree(resolved2.workspace, resolved2.worktreePath);
   };
-  const routes = retained?.stopBaseline ? withMutationLock("Revalidate stop routes", resolved.worktreePath, remove) : remove();
+  const routes = retained?.stopBaseline ? withMutationLock("Revalidate stop routes", resolved2.worktreePath, remove) : remove();
   await ensureTraefikRoutesRemoved([
     ...routes,
     ...absent && retained ? managedStopRouteReferences(retained) : []
   ]);
   if (!quiet) {
     process.stdout.write(
-      `Freed ${routes.length} route(s) for workspace '${resolved.workspace}'.
+      `Freed ${routes.length} route(s) for workspace '${resolved2.workspace}'.
 `
     );
   }
@@ -31641,20 +32325,20 @@ async function mutateWorkspaceRuntime(action2, resolved, worktrees, quiet = fals
     freedRoutes: routes.length,
     providerChanged: mutation.status === "changed",
     ...absent ? { runtimeAbsent: true } : {},
-    workspace: resolved.workspace
+    workspace: resolved2.workspace
   };
 }
 async function runWorkspaceLifecycle(action2, target, opts = {}) {
   const mainRepo = resolveRepoPath(opts.repoPath);
   const worktrees = identifyGitWorktrees(mainRepo);
   const records = listWorkspaceOwnership(mainRepo);
-  const resolved = resolveWorkspaceTarget(mainRepo, target, worktrees, records);
+  const resolved2 = resolveWorkspaceTarget(mainRepo, target, worktrees, records);
   if (action2 === "stop") {
-    const stopped = await superviseLifecycle("stop", resolved.worktreePath, {
+    const stopped = await superviseLifecycle("stop", resolved2.worktreePath, {
       quiet: opts.quiet
     });
     return {
-      workspace: resolved.workspace,
+      workspace: resolved2.workspace,
       devpodId: stopped.devpodId,
       freedRoutes: stopped.freedRoutes,
       providerChanged: stopped.stopped && !stopped.runtimeAbsent,
@@ -31664,30 +32348,30 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
   const operation = async () => {
     const removeWorktree = action2 === "down" && !opts.keepWorktree;
     if (removeWorktree) {
-      assertFullDownPreflight(mainRepo, resolved);
+      assertFullDownPreflight(mainRepo, resolved2);
     }
-    const result = await mutateWorkspaceRuntime("delete", resolved, worktrees, opts.quiet);
+    const result = await mutateWorkspaceRuntime("delete", resolved2, worktrees, opts.quiet);
     if (removeWorktree) {
-      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs56.default.existsSync(resolved.worktreePath)) {
-        const rm = (0, import_node_child_process40.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
+      if (resolved2.worktree && !resolved2.worktree.prunable && import_node_fs57.default.existsSync(resolved2.worktreePath)) {
+        const rm = (0, import_node_child_process41.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved2.worktreePath], {
           encoding: "utf-8"
         });
         if (rm.status !== 0) {
           const detail = [rm.error?.message, rm.stderr].filter(Boolean).join("\n").trim();
           throw new Error(
-            `git worktree remove failed for '${resolved.worktreePath}': ${detail || "unknown error"}`
+            `git worktree remove failed for '${resolved2.worktreePath}': ${detail || "unknown error"}`
           );
         }
-        process.stdout.write(`Removed worktree ${resolved.worktreePath}.
+        process.stdout.write(`Removed worktree ${resolved2.worktreePath}.
 `);
       }
-      if (resolved.record) {
-        removeWorkspaceOwnership(mainRepo, resolved.workspace);
+      if (resolved2.record) {
+        removeWorkspaceOwnership(mainRepo, resolved2.workspace);
       }
     }
     return result;
   };
-  return resolved.worktree && !resolved.worktree.prunable && import_node_fs56.default.existsSync(resolved.worktreePath) ? withLifecycleOperationLock(resolved.worktreePath, operation) : operation();
+  return resolved2.worktree && !resolved2.worktree.prunable && import_node_fs57.default.existsSync(resolved2.worktreePath) ? withLifecycleOperationLock(resolved2.worktreePath, operation) : operation();
 }
 async function reclaimWorktreeExactPath(mainRepo, worktreePath, verify, afterRemove, steps) {
   await withLifecycleOperationLock(worktreePath, async () => {
@@ -31713,7 +32397,7 @@ async function reclaimWorktreeExactPath(mainRepo, worktreePath, verify, afterRem
       );
       steps.push("runtime-deleted");
     }
-    const rm = (0, import_node_child_process40.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", worktreePath], {
+    const rm = (0, import_node_child_process41.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", worktreePath], {
       encoding: "utf-8"
     });
     if (rm.status !== 0) {
@@ -31734,13 +32418,13 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process40, import_node_fs56, import_node_path69, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
+var import_node_child_process41, import_node_fs57, import_node_path70, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
-    import_node_child_process40 = require("child_process");
-    import_node_fs56 = __toESM(require("fs"));
-    import_node_path69 = __toESM(require("path"));
+    import_node_child_process41 = require("child_process");
+    import_node_fs57 = __toESM(require("fs"));
+    import_node_path70 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_devsy_mutation();
@@ -31759,7 +32443,7 @@ var init_workspace_lifecycle = __esm({
 
 // src/core/worktree-trim.ts
 function listIgnoredPaths(worktreePath) {
-  const result = (0, import_node_child_process41.spawnSync)(
+  const result = (0, import_node_child_process42.spawnSync)(
     "git",
     [
       "-C",
@@ -31843,19 +32527,19 @@ function buildTrimManifest(report, patterns, createdAtEpoch) {
   return canonicalJson(manifest);
 }
 function isInside(parent, child) {
-  const relative2 = import_node_path70.default.relative(parent, child);
-  return relative2 !== "" && !relative2.startsWith("..") && !import_node_path70.default.isAbsolute(relative2);
+  const relative2 = import_node_path71.default.relative(parent, child);
+  return relative2 !== "" && !relative2.startsWith("..") && !import_node_path71.default.isAbsolute(relative2);
 }
 function exists(file) {
   try {
-    import_node_fs57.default.lstatSync(file);
+    import_node_fs58.default.lstatSync(file);
     return true;
   } catch {
     return false;
   }
 }
 function hasTrackedFiles(worktreePath, relative2) {
-  const result = (0, import_node_child_process41.spawnSync)(
+  const result = (0, import_node_child_process42.spawnSync)(
     "git",
     ["-C", worktreePath, "--literal-pathspecs", "ls-files", "-z", "--", relative2],
     { encoding: "utf-8", env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" } }
@@ -31863,10 +32547,10 @@ function hasTrackedFiles(worktreePath, relative2) {
   return result.status !== 0 || Boolean(result.error) || result.stdout.length > 0;
 }
 function trimOnePath(candidate, relative2, patterns, steps) {
-  const target = import_node_path70.default.join(candidate.path, relative2);
+  const target = import_node_path71.default.join(candidate.path, relative2);
   let stat;
   try {
-    stat = import_node_fs57.default.lstatSync(target);
+    stat = import_node_fs58.default.lstatSync(target);
   } catch (error) {
     if (error.code === "ENOENT") {
       steps.push(`gone:${relative2}`);
@@ -31878,7 +32562,7 @@ function trimOnePath(candidate, relative2, patterns, steps) {
     steps.push(`skipped-symlink:${relative2}`);
     return;
   }
-  if (!isInside(import_node_fs57.default.realpathSync.native(candidate.path), import_node_fs57.default.realpathSync.native(target))) {
+  if (!isInside(import_node_fs58.default.realpathSync.native(candidate.path), import_node_fs58.default.realpathSync.native(target))) {
     steps.push(`skipped-outside:${relative2}`);
     return;
   }
@@ -31891,7 +32575,7 @@ function trimOnePath(candidate, relative2, patterns, steps) {
     return;
   }
   try {
-    import_node_fs57.default.rmSync(target, { recursive: true, force: true });
+    import_node_fs58.default.rmSync(target, { recursive: true, force: true });
   } catch (error) {
     steps.push(`partial:${relative2}`);
     throw error;
@@ -31931,7 +32615,7 @@ async function applyTrimManifest(options, dependencies) {
       continue;
     }
     const listed = candidate.paths ?? [];
-    if (listed.every((relative2) => !exists(import_node_path70.default.join(candidate.path, relative2))) && matchingReceipt(candidate, manifestSha256)) {
+    if (listed.every((relative2) => !exists(import_node_path71.default.join(candidate.path, relative2))) && matchingReceipt(candidate, manifestSha256)) {
       outcome.status = "already-done";
       continue;
     }
@@ -31955,7 +32639,7 @@ async function applyTrimManifest(options, dependencies) {
       if (!options.yes) {
         verify();
         outcome.status = "would-trim";
-        const present = listed.filter((relative2) => exists(import_node_path70.default.join(candidate.path, relative2)));
+        const present = listed.filter((relative2) => exists(import_node_path71.default.join(candidate.path, relative2)));
         outcome.reason = present.length ? `would remove: ${present.join(", ")}` : "nothing present";
         continue;
       }
@@ -31992,13 +32676,13 @@ async function applyTrimManifest(options, dependencies) {
   }
   return { manifestSha256, dryRun: !options.yes, targets, stoppedEarly };
 }
-var import_node_child_process41, import_node_fs57, import_node_path70;
+var import_node_child_process42, import_node_fs58, import_node_path71;
 var init_worktree_trim = __esm({
   "src/core/worktree-trim.ts"() {
     "use strict";
-    import_node_child_process41 = require("child_process");
-    import_node_fs57 = __toESM(require("fs"));
-    import_node_path70 = __toESM(require("path"));
+    import_node_child_process42 = require("child_process");
+    import_node_fs58 = __toESM(require("fs"));
+    import_node_path71 = __toESM(require("path"));
     init_reliability_lifecycle();
     init_worktree_reclaim();
     init_worktree_safety();
@@ -32012,6 +32696,7 @@ __export(workspace_exports, {
   runWorkspaceDownCommand: () => runWorkspaceDownCommand,
   runWorkspaceGcCommand: () => runWorkspaceGcCommand,
   runWorkspaceJournalSettleCommand: () => runWorkspaceJournalSettleCommand,
+  runWorkspaceLeftoverCommand: () => runWorkspaceLeftoverCommand,
   runWorkspaceLsCommand: () => runWorkspaceLsCommand,
   runWorkspaceManifestHashCommand: () => runWorkspaceManifestHashCommand,
   runWorkspaceManifestSelectCommand: () => runWorkspaceManifestSelectCommand,
@@ -32021,15 +32706,15 @@ __export(workspace_exports, {
   runWorkspaceUpCommand: () => runWorkspaceUpCommand
 });
 function resolveGitWorkspaceRepo(repoPath) {
-  const resolved = resolveRepoPath(repoPath);
+  const resolved2 = resolveRepoPath(repoPath);
   try {
-    resolveGitCommonDir(resolved);
+    resolveGitCommonDir(resolved2);
   } catch (error) {
-    throw new Error(`Workspace commands require a Git repository: '${resolved}'.`, {
+    throw new Error(`Workspace commands require a Git repository: '${resolved2}'.`, {
       cause: error
     });
   }
-  return resolved;
+  return resolved2;
 }
 async function runWorkspaceUpCommand(branch, options) {
   const repoPath = resolveGitWorkspaceRepo(options.repo);
@@ -32061,13 +32746,30 @@ function runWorkspaceLsCommand(options) {
     );
   }
 }
+function writeManifestOutput(manifest, output2) {
+  if (output2) {
+    import_node_fs59.default.writeFileSync(output2, manifest, { flag: "wx" });
+    process.stdout.write(`${sha256Hex(manifest)}  ${output2}
+`);
+  } else {
+    process.stdout.write(manifest);
+  }
+}
 function runWorkspaceCleanupCommand(options) {
   const repoPath = resolveGitWorkspaceRepo(options.repo);
+  if (options.manifest && options.action === "leftover") {
+    const leftovers = findDockerLeftovers(readDockerInventory(), readLeftoverContext(repoPath));
+    writeManifestOutput(
+      buildLeftoverManifest(repoPath, leftovers, Math.floor(Date.now() / 1e3)),
+      options.output
+    );
+    return;
+  }
   const report = buildWorkspaceCleanupReport({ ...options, repo: repoPath });
   if (options.manifest) {
     const action2 = options.action ?? "reclaim";
     if (action2 !== "reclaim" && action2 !== "trim") {
-      throw new Error("--action must be reclaim or trim.");
+      throw new Error("--action must be reclaim, trim or leftover.");
     }
     if (action2 === "trim") {
       if (!options.allWorktrees)
@@ -32076,19 +32778,13 @@ function runWorkspaceCleanupCommand(options) {
       throw new Error("--manifest requires --all-worktrees and --check-merged.");
     }
     const createdAtEpoch = Math.floor(Date.now() / 1e3);
-    const worktrees = import_node_fs58.default.existsSync(import_node_path71.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees : void 0;
+    const worktrees = import_node_fs59.default.existsSync(import_node_path72.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees : void 0;
     const manifest = action2 === "trim" ? buildTrimManifest(
       report,
       { trim: worktrees?.trim ?? [], disposable: worktrees?.disposable },
       createdAtEpoch
     ) : buildReclaimManifest(report, createdAtEpoch);
-    if (options.output) {
-      import_node_fs58.default.writeFileSync(options.output, manifest, { flag: "wx" });
-      process.stdout.write(`${sha256Hex(manifest)}  ${options.output}
-`);
-    } else {
-      process.stdout.write(manifest);
-    }
+    writeManifestOutput(manifest, options.output);
     return;
   }
   if (options.json) {
@@ -32153,10 +32849,57 @@ async function runWorkspaceJournalSettleCommand(options) {
   );
 }
 function runWorkspaceManifestHashCommand(file) {
-  const { raw } = readManifest(file);
+  let leftover = false;
+  try {
+    leftover = isLeftoverManifest(JSON.parse(import_node_fs59.default.readFileSync(file, "utf-8")));
+  } catch {
+  }
+  const { raw } = leftover ? readLeftoverManifest(file) : readManifest(file);
   process.stdout.write(`${sha256Hex(raw)}
 `);
 }
+function runWorkspaceLeftoverCommand(options) {
+  const report = applyLeftoverManifest({
+    manifestFile: options.manifest,
+    sha256: options.sha256,
+    maxAgeSeconds: parseInactiveFor(options.maxAge ?? "24h").seconds,
+    yes: Boolean(options.yes)
+  });
+  if (options.json) {
+    printJSON(report);
+  } else {
+    printReclaimReport(
+      {
+        dryRun: report.dryRun,
+        stoppedEarly: false,
+        targets: report.targets.map((target) => ({
+          ...target,
+          path: target.project,
+          steps: summarizeLeftoverSteps(target.steps)
+        }))
+      },
+      "remove the leftovers"
+    );
+    if (!report.dryRun && report.targets.some((target) => target.steps.length)) {
+      process.stdout.write(
+        "Each removed object is listed in the stack's receipt; use --json for the full list.\n"
+      );
+    }
+  }
+  if (report.targets.some((target) => target.status === "failed")) process.exitCode = 1;
+}
+function summarizeLeftoverSteps(steps) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const step of steps) {
+    const [action2, kind] = step.slice(0, step.indexOf(":")).split("-");
+    const byKind = counts.get(action2) ?? /* @__PURE__ */ new Map();
+    byKind.set(kind, (byKind.get(kind) ?? 0) + 1);
+    counts.set(action2, byKind);
+  }
+  return [...counts].map(
+    ([action2, byKind]) => `${action2 === "gone" ? "already gone" : action2} ${[...byKind].map(([kind, count]) => `${count} ${kind}(s)`).join(", ")}`
+  );
+}
 function runWorkspaceManifestSelectCommand(file, options) {
   process.stdout.write(selectManifest(file, options.expectedSha256, options.id));
 }
@@ -32205,12 +32948,13 @@ async function runWorkspaceTrimCommand(options) {
     process.exitCode = 1;
   }
 }
-var import_node_fs58, import_node_path71;
+var import_node_fs59, import_node_path72;
 var init_workspace2 = __esm({
   "src/commands/workspace.ts"() {
     "use strict";
-    import_node_fs58 = __toESM(require("fs"));
-    import_node_path71 = __toESM(require("path"));
+    import_node_fs59 = __toESM(require("fs"));
+    import_node_path72 = __toESM(require("path"));
+    init_docker_leftovers();
     init_output();
     init_repo_config();
     init_workspace_cleanup();
@@ -32262,7 +33006,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.2.0" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.3.1" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {
@@ -32622,7 +33366,7 @@ workspaceCommand2.command("cleanup").description("Report managed workspace activ
   "Emit a canonical reclaim manifest of quiet RECLAIM trees (needs --all-worktrees --check-merged)"
 ).option("--output <file>", "Write the manifest to a new file and print its SHA-256").option(
   "--action <action>",
-  "Manifest action: reclaim (needs --check-merged) or trim (declared worktrees.trim paths)",
+  "Manifest action: reclaim (needs --check-merged), trim (declared worktrees.trim paths) or leftover (Docker stacks of deleted checkouts)",
   "reclaim"
 ).action(
   withErrorHandling(async (_options, command) => {
@@ -32691,6 +33435,15 @@ workspaceCommand2.command("trim").description(
     await runWorkspaceTrimCommand2(options);
   })
 );
+workspaceCommand2.command("leftover").description(
+  "Remove the Docker containers, volumes and networks of an approved leftover manifest, re-verifying each stack inside the provider locks"
+).requiredOption("--manifest <file>", "Approved leftover manifest").requiredOption("--sha256 <hash>", "Approved SHA-256 of the manifest").option("--max-age <duration>", "Refuse a manifest older than this (Ns, Nm, Nh, Nd, Nw)", "24h").option("--yes", "Remove; without it the command is a dry run").option("--json", "Output JSON").action(
+  withErrorHandling(async (_options, command) => {
+    const options = command.opts();
+    const { runWorkspaceLeftoverCommand: runWorkspaceLeftoverCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));
+    runWorkspaceLeftoverCommand2(options);
+  })
+);
 workspaceCommand2.command("gc").description("Report or clean missing ledger-owned workspace resources").option("--repo <path>", "Main repository path (defaults to current directory)").option("--json", "Output JSON").option("--yes", "Delete eligible workspace runtime, route, and ownership resources").action(
   withErrorHandling(async (_options, command) => {
     const options = command.opts();
@@ -32715,10 +33468,10 @@ workspaceCommand2.command("down").description("Delete a workspace's runtime and
 workspaceCommand2.command("journal").description("Inspect and recover workspace lifecycle journals").command("settle").description(
   "Settle an interrupted lifecycle operation as unobservable so ensure and stop can proceed"
 ).argument("[path]", "Checkout path (defaults to current directory)").option("--json", "Output JSON").action(
-  withErrorHandling(async (path71, _options, command) => {
+  withErrorHandling(async (path72, _options, command) => {
     const options = command.opts();
     const { runWorkspaceJournalSettleCommand: runWorkspaceJournalSettleCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));
-    await runWorkspaceJournalSettleCommand2({ ...path71 ? { path: path71 } : {}, ...options });
+    await runWorkspaceJournalSettleCommand2({ ...path72 ? { path: path72 } : {}, ...options });
   })
 );
 function parseVersionRequest(argv) {