@devrouter/cli 0.5.5 → 0.5.6

package/dist/devrouter-lifecycle-worker.js

@@ -23,8 +23,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/core/devpod-exec.ts
-var import_node_child_process32 = require("child_process");
-var import_node_crypto23 = require("crypto");
+var import_node_child_process33 = require("child_process");
+var import_node_crypto24 = require("crypto");
 
 // src/core/devpod-environment.ts
 var import_node_child_process3 = require("child_process");
@@ -1982,7 +1982,7 @@ function selectDevpodWorkspace(workspaces, repoPath) {
 }
 
 // src/core/devsy-exec.ts
-var import_node_child_process31 = require("child_process");
+var import_node_child_process32 = require("child_process");
 
 // src/core/devsy-exec-proof.ts
 var import_node_fs7 = __toESM(require("fs"));
@@ -3390,6 +3390,12 @@ function validateState(value, repoPath, workspace) {
   if (typeof candidate.profile !== "string" || candidate.profile.length === 0) {
     throw new Error("Managed runtime state has no canonical profile.");
   }
+  if (candidate.variant !== void 0 && (typeof candidate.variant !== "string" || candidate.variant.length > 64 || !/^[a-z0-9]+(-[a-z0-9]+)*$/.test(candidate.variant))) {
+    throw new Error("Managed runtime state has an invalid runtime variant.");
+  }
+  if (candidate.hostPortDeclarationsSha256 !== void 0 && (typeof candidate.hostPortDeclarationsSha256 !== "string" || !/^[a-f0-9]{64}$/.test(candidate.hostPortDeclarationsSha256))) {
+    throw new Error("Managed runtime state has an invalid host-port declaration fingerprint.");
+  }
   if (!candidate.desired || typeof candidate.desired !== "object") {
     throw new Error("Managed runtime state has no desired resource set.");
   }
@@ -3416,6 +3422,8 @@ function validateState(value, repoPath, workspace) {
     devpodId: candidate.devpodId,
     composeProject: candidate.composeProject,
     profile: candidate.profile,
+    ...candidate.variant !== void 0 ? { variant: candidate.variant } : {},
+    ...candidate.hostPortDeclarationsSha256 !== void 0 ? { hostPortDeclarationsSha256: candidate.hostPortDeclarationsSha256 } : {},
     desired: {
       apps: [...desired.apps],
       services: [...desired.services],
@@ -4055,6 +4063,89 @@ function captureManagedStopBaseline(state, plan, primaryId, expectedEndpoint) {
   prove(state, baseline);
   return baseline;
 }
+function recoverManagedStopBaseline(state, readPlan, beforePersist) {
+  const baseline = validateManagedStopBaseline(state.stopBaseline, state);
+  const plan = readPlan();
+  const owner = registration(state);
+  if (Object.entries(owner).some(
+    ([key, value]) => baseline[key] !== value
+  ) || baseline.sourceContainer)
+    throw new Error("Stop recovery requires the unchanged provider registration.");
+  const observe = () => {
+    if (!(0, import_node_util3.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state) || !(0, import_node_util3.isDeepStrictEqual)(registration(state), owner) || !(0, import_node_util3.isDeepStrictEqual)(readPlan(), plan) || resolveManagedStopEndpoint() !== baseline.endpoint || inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId || listDevpodWorkspacesRaw({ allowMissingExecutable: true }).some(
+      (entry) => entry.id === state.devpodId || sameWorkspacePath(entry.source.localFolder, state.repoPath)
+    ))
+      throw new Error("Stop recovery authority changed.");
+    const currentOwner = inspectDevsyWorkspaceOwnership(
+      listDevsyWorkspaces(),
+      state.devpodId,
+      state.repoPath
+    );
+    if (currentOwner.status !== "owned") throw new Error("Stop recovery owner is unavailable.");
+    proveLocalDockerSelection(currentOwner.workspace);
+    assertManagedStopContainersAbsent(
+      baseline.endpoint,
+      baseline.containers.map((container) => container.id)
+    );
+    const containers = inspectManagedStopContainers(baseline.project, baseline.endpoint);
+    if (!(0, import_node_util3.isDeepStrictEqual)(
+      containers.map((container) => container.labels["com.docker.compose.service"]).sort(),
+      [...plan.desiredServices].sort()
+    ))
+      throw new Error("Stop recovery requires the complete selected service population.");
+    const primary2 = containers.find(
+      (container) => container.labels["com.docker.compose.service"] === plan.primaryService
+    );
+    if (!primary2 || !(0, import_node_util3.isDeepStrictEqual)(
+      inspectProviderRunnerContainers(
+        baseline.endpoint,
+        managedRunnerId(baseline.uid, baseline.providerId)
+      ).sort(),
+      [primary2.id]
+    ))
+      throw new Error("Stop recovery provider runner population changed.");
+    assertManagedContainerConfigUnchanged({
+      plan,
+      containers,
+      workspace: state.workspace ? {
+        token: state.workspace,
+        gitCommonDir: resolveGitCommonDir(state.repoPath)
+      } : void 0
+    });
+    if (!(0, import_node_util3.isDeepStrictEqual)(registration(state), owner) || !(0, import_node_util3.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state) || !(0, import_node_util3.isDeepStrictEqual)(readPlan(), plan) || resolveManagedStopEndpoint() !== baseline.endpoint || inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId)
+      throw new Error("Stop recovery authority changed during configuration inspection.");
+    return containers;
+  };
+  const first = observe();
+  const candidate = {
+    ...state,
+    sourceConfigSha256: plan.sourceConfigSha256,
+    effectiveConfigSha256: plan.effectiveConfigSha256,
+    status: "degraded",
+    transitionPhase: "stop-recovery",
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    stopBaseline: void 0
+  };
+  const primary = first.find(
+    (container) => container.labels["com.docker.compose.service"] === plan.primaryService
+  );
+  if (!primary) throw new Error("Stop recovery primary is unavailable.");
+  candidate.stopBaseline = captureManagedStopBaseline(
+    candidate,
+    plan,
+    primary.id,
+    baseline.endpoint
+  );
+  if (!(0, import_node_util3.isDeepStrictEqual)(
+    first.map(identity).sort((a, b) => compareText(a.id, b.id)),
+    observe().map(identity).sort((a, b) => compareText(a.id, b.id))
+  ))
+    throw new Error("Stop recovery population changed during inspection.");
+  beforePersist();
+  claimLifecycleEffect();
+  writeManagedRuntimeState(candidate);
+  return candidate;
+}
 function proveRetainedManagedStop(state) {
   const baseline = validateManagedStopBaseline(state.stopBaseline, state);
   if (!(0, import_node_util3.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state)) {
@@ -5399,7 +5490,7 @@ function retain(session, previous) {
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.5.5" : "0.0.0-dev";
+  return true ? "0.5.6" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -6158,6 +6249,9 @@ var MAX_CAPACITY_PROFILES = 256;
 var MAX_CAPACITY_OPERATIONS = 64;
 var MAX_CAPACITY_TRANSITIONS = 1024;
 var MAX_CAPACITY_NAME_LENGTH = 64;
+var MAX_RUNTIME_VARIANTS = 32;
+var MAX_RUNTIME_VARIANT_NAME_LENGTH = 64;
+var RUNTIME_VARIANT_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var UPSTREAM_TEMPLATE_RE = /^(?:\$\{WORKSPACE\}|[a-zA-Z0-9._-])+:\d{1,5}$/;
 function assertUpstreamSpec(upstream, label) {
   if (upstream.includes(WORKSPACE_PLACEHOLDER)) {
@@ -6634,6 +6728,53 @@ function parsePrepareCommand(value, pathLabel) {
     return item;
   });
 }
+function assertRuntimeVariantName(value, pathLabel) {
+  if (value.length === 0 || value.length > MAX_RUNTIME_VARIANT_NAME_LENGTH || !RUNTIME_VARIANT_NAME_RE.test(value)) {
+    throw new Error(
+      `${pathLabel} must use lowercase letters or digits separated by single hyphens, at most ${MAX_RUNTIME_VARIANT_NAME_LENGTH} characters.`
+    );
+  }
+  if (value === "default") {
+    throw new Error(`${pathLabel} 'default' is implicit and reserved.`);
+  }
+}
+function parseRuntimeVariants(value, pathLabel) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (!Array.isArray(value)) {
+    throw new Error(`${pathLabel} must be an array of strings.`);
+  }
+  if (value.length > MAX_RUNTIME_VARIANTS) {
+    throw new Error(`${pathLabel} accepts at most ${MAX_RUNTIME_VARIANTS} additional names.`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return value.map((item, index) => {
+    const itemPath = `${pathLabel}[${index}]`;
+    if (typeof item !== "string") {
+      throw new Error(`${itemPath} must be a string.`);
+    }
+    assertRuntimeVariantName(item, itemPath);
+    if (seen.has(item)) {
+      throw new Error(`${pathLabel} contains duplicate '${item}'.`);
+    }
+    seen.add(item);
+    return item;
+  });
+}
+function resolveRuntimeVariant(config, requested) {
+  if (requested === void 0) {
+    return "default";
+  }
+  if (requested === "default") {
+    return requested;
+  }
+  assertRuntimeVariantName(requested, "Runtime variant");
+  if (!config.managedRuntime?.variants?.includes(requested)) {
+    throw new Error(`Runtime variant '${requested}' is not declared in managedRuntime.variants.`);
+  }
+  return requested;
+}
 function parseManagedRuntime(value, configPath) {
   if (value === void 0) {
     return void 0;
@@ -6641,9 +6782,13 @@ function parseManagedRuntime(value, configPath) {
   const managedRuntime = ensureObject(value, `${configPath}.managedRuntime`);
   ensureAllowedKeys(
     managedRuntime,
-    ["devcontainer", "processes", "network"],
+    ["devcontainer", "processes", "network", "variants"],
     `${configPath}.managedRuntime`
   );
+  const variants = parseRuntimeVariants(
+    managedRuntime.variants,
+    `${configPath}.managedRuntime.variants`
+  );
   let network;
   if (managedRuntime.network !== void 0) {
     const value2 = ensureObject(managedRuntime.network, `${configPath}.managedRuntime.network`);
@@ -6669,7 +6814,7 @@ function parseManagedRuntime(value, configPath) {
   );
   ensureAllowedKeys(
     devcontainer,
-    ["baseServices", "profileServices", "prepareCommand"],
+    ["baseServices", "profileServices", "prepareCommand", "hostPorts"],
     `${configPath}.managedRuntime.devcontainer`
   );
   const baseServices = parseRequiredUniqueStringArray(
@@ -6691,6 +6836,41 @@ function parseManagedRuntime(value, configPath) {
       `${configPath}.managedRuntime.devcontainer.baseServices and profileServices overlap: ${overlappingServices.join(", ")}.`
     );
   }
+  let hostPorts;
+  if (devcontainer.hostPorts !== void 0) {
+    const ports = ensureObject(
+      devcontainer.hostPorts,
+      `${configPath}.managedRuntime.devcontainer.hostPorts`
+    );
+    if (Object.keys(ports).length > 32)
+      throw new Error("managedRuntime.devcontainer.hostPorts accepts at most 32 declarations.");
+    hostPorts = {};
+    const pairs = /* @__PURE__ */ new Set();
+    const registered = /* @__PURE__ */ new Set([...baseServices, ...profileServices]);
+    for (const [name, rawPort] of Object.entries(ports)) {
+      if (name.length > 64 || !/^[a-z0-9]+(-[a-z0-9]+)*$/.test(name))
+        throw new Error(
+          "Host-port names must be lowercase kebab-case identifiers of at most 64 characters."
+        );
+      const port = ensureObject(rawPort, `managedRuntime.devcontainer.hostPorts.${name}`);
+      ensureAllowedKeys(
+        port,
+        ["service", "target"],
+        `managedRuntime.devcontainer.hostPorts.${name}`
+      );
+      if (typeof port.service !== "string" || !registered.has(port.service))
+        throw new Error(`Host port '${name}' must reference a registered base or profile service.`);
+      if (!Number.isInteger(port.target) || port.target < 1 || port.target > 65535)
+        throw new Error(`Host port '${name}' target must be an integer from 1 to 65535.`);
+      const pair = `${port.service}:${port.target}`;
+      if (pairs.has(pair)) throw new Error(`Host port '${name}' duplicates a service and target.`);
+      pairs.add(pair);
+      Object.defineProperty(hostPorts, name, {
+        value: { service: port.service, target: port.target },
+        enumerable: true
+      });
+    }
+  }
   const processes = parseRequiredUniqueStringArray(
     managedRuntime.processes,
     `${configPath}.managedRuntime.processes`
@@ -6705,10 +6885,12 @@ function parseManagedRuntime(value, configPath) {
   }
   return {
     ...network ? { network } : {},
+    ...variants !== void 0 ? { variants } : {},
     devcontainer: {
       baseServices,
       profileServices,
-      ...prepareCommand ? { prepareCommand } : {}
+      ...prepareCommand ? { prepareCommand } : {},
+      ...hostPorts !== void 0 ? { hostPorts } : {}
     },
     processes
   };
@@ -7409,7 +7591,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs19.default.rea
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.5.5" : "0.0.0-dev";
+    const cliVersion = true ? "0.5.6" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver2(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -10466,151 +10648,1171 @@ var ExecutionOutcomeError = class extends Error {
 };
 
 // src/core/reliability-lifecycle.ts
-var import_node_crypto22 = require("crypto");
+var import_node_crypto23 = require("crypto");
 var import_node_path41 = __toESM(require("path"));
 var import_node_util7 = require("util");
 
 // src/core/capacity-policy.ts
 var import_node_fs27 = __toESM(require("fs"));
 var import_node_path31 = __toESM(require("path"));
-
-// src/core/controller-client.ts
-var import_node_crypto15 = require("crypto");
-var import_node_fs28 = __toESM(require("fs"));
-var import_node_net2 = __toESM(require("net"));
-var import_node_path33 = __toESM(require("path"));
-
-// src/core/controller-protocol.ts
-var import_node_path32 = __toESM(require("path"));
-var CONTROLLER_FRAME_BYTES = 64 * 1024;
-var CONTROLLER_MAX_OPERATION_REQUEST_BYTES = 32 * 1024;
-var CONTROLLER_PROFILE_TOKEN_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-var CONTROLLER_PROFILE_RE = new RegExp(
-  `^(?:${CONTROLLER_PROFILE_TOKEN_RE.source.slice(1, -1)})(?:,(?:${CONTROLLER_PROFILE_TOKEN_RE.source.slice(1, -1)}))*$`
-);
-
-// src/core/controller-monitor.ts
-var import_node_crypto16 = require("crypto");
-var import_node_util6 = require("util");
-
-// src/core/reliability-output.ts
-function reliabilityAttention(state) {
-  assertReliabilityState(state);
-  const completeStop = state.stopProof.workloadsStopped && state.stopProof.routesRemoved;
-  if (state.desired === "stopped-by-user") return completeStop ? void 0 : "stop-incomplete";
-  if (state.operation?.status === "COMPLETION_UNKNOWN" || state.operation?.status === "INTERRUPTED")
-    return "operation-unknown";
-  if (state.desired === "parked-for-capacity")
-    return completeStop ? "capacity-parked" : "stop-incomplete";
-  if (state.admission === "denied-unadmittable") return "unadmittable";
-  if (state.admission === "waiting") return "capacity-waiting";
-  if (state.phase === "recovering") return "recovering";
-  if (state.phase === "queued" || state.phase === "starting" || state.phase === "verifying")
-    return "starting";
-  return void 0;
-}
-
-// src/core/recovery-budget.ts
-function findRecoveryUnit(incident, unit) {
-  return (incident.units ?? []).find((record5) => record5.key === unit.key);
-}
-function restartsFor(kind, limits) {
-  return kind === "service" ? limits.maxServiceRestarts : limits.maxProcessRestarts;
-}
-function recoveryBudgetRefusal(input) {
-  const startedAtMs = input.incident.startedAtMs ?? input.nowMs;
-  const elapsed = input.activeElapsedMs ?? Math.max(0, input.nowMs - startedAtMs);
-  if (elapsed > input.limits.windowSeconds * 1e3) return "window-closed";
-  if (input.unit !== void 0) {
-    const record5 = findRecoveryUnit(input.incident, input.unit);
-    if (record5 !== void 0 && record5.actions >= restartsFor(input.unit.kind, input.limits))
-      return "unit-exhausted";
+var MAX_DOMAINS = 256;
+var MAX_ENROLLMENTS = 256;
+var MAX_PROFILES_PER_ENROLLMENT = 64;
+var MAX_STRING_LENGTH = 256;
+var MAX_PATH_LENGTH = 4096;
+function readCapacityPolicy(directory) {
+  const absolute2 = import_node_path31.default.resolve(directory);
+  let current = import_node_path31.default.parse(absolute2).root;
+  for (const part of absolute2.slice(current.length).split(import_node_path31.default.sep)) {
+    current = import_node_path31.default.join(current, part);
+    let stat;
+    try {
+      stat = import_node_fs27.default.lstatSync(current);
+    } catch (error) {
+      if (error.code === "ENOENT") return void 0;
+      throw error;
+    }
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+      throw new Error("Unsafe capacity policy directory.");
+    if (current === absolute2 && (stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0))
+      throw new Error("Capacity policy directory is not private.");
   }
-  if (input.incident.correctiveActionsTaken >= input.incident.actionLimit)
-    return "budget-exhausted";
-  return void 0;
+  let descriptor;
+  try {
+    descriptor = import_node_fs27.default.openSync(
+      import_node_path31.default.join(absolute2, "capacity-policy.json"),
+      import_node_fs27.default.constants.O_RDONLY | import_node_fs27.default.constants.O_NOFOLLOW | import_node_fs27.default.constants.O_NONBLOCK
+    );
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+  try {
+    const stat = import_node_fs27.default.fstatSync(descriptor);
+    const limit = 1048576;
+    if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0 || stat.size > limit)
+      throw new Error("Capacity policy is not a bounded private file.");
+    const bytes2 = Buffer.alloc(limit + 1);
+    const count = import_node_fs27.default.readSync(descriptor, bytes2, 0, bytes2.length, 0);
+    if (count > limit) throw new Error("Capacity policy exceeds byte limit.");
+    return parseCapacityPolicy(JSON.parse(bytes2.subarray(0, count).toString("utf8")));
+  } finally {
+    import_node_fs27.default.closeSync(descriptor);
+  }
+}
+var DOMAIN_ID_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var PROFILE_NAME_RE2 = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var WORKSPACE_TOKEN_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var SHA256_RE = /^[0-9a-f]{64}$/;
+var DEFAULT_CAPACITY_RECOVERY = {
+  enabled: false,
+  maxProcessRestarts: 2,
+  maxServiceRestarts: 1,
+  maxCorrectiveActions: 3,
+  windowSeconds: 600,
+  observationSeconds: 30,
+  resumeDwellSeconds: 300
+};
+function ensureObject2(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object.`);
+  }
+  return value;
 }
-function claimRecoveryUnit(input) {
-  const reason2 = recoveryBudgetRefusal(input);
-  if (reason2 !== void 0) return { ok: false, reason: reason2 };
-  const units = (input.incident.units ?? []).map((record5) => ({ ...record5 }));
-  if (input.unit !== void 0) {
-    const index = units.findIndex((record5) => record5.key === input.unit?.key);
-    if (index === -1) {
-      if (units.length >= RELIABILITY_MAX_ITEMS) return { ok: false, reason: "unit-exhausted" };
-      units.push({ ...input.unit, actions: 1, lastActionAtMs: input.nowMs });
-    } else {
-      const record5 = units[index];
-      units[index] = {
-        ...record5,
-        actions: record5.actions + 1,
-        lastActionAtMs: input.nowMs
-      };
+function ensureAllowedKeys2(value, allowedKeys, label) {
+  const allowed = new Set(allowedKeys);
+  for (const key of Object.keys(value)) {
+    if (!allowed.has(key)) {
+      throw new Error(`${label}.${key} is not supported.`);
     }
   }
-  return {
-    ok: true,
-    incident: {
-      ...input.incident,
-      startedAtMs: input.incident.startedAtMs ?? input.nowMs,
-      correctiveActionsTaken: input.incident.correctiveActionsTaken + 1,
-      units
-    }
-  };
 }
-
-// src/core/reliability-model.ts
-var INFRASTRUCTURE_VALUES = ["healthy", "failed", "unknown"];
-var APPLICATION_VALUES = ["verified", "unready", "unverified"];
-var ADMISSION_VALUES = ["admitted", "waiting", "unknown", "denied-unadmittable"];
-function record3(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
+function parseBoundedString(value, label, maxLength = MAX_STRING_LENGTH) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`${label} must be a non-empty string.`);
+  }
+  if (value !== value.trim()) {
+    throw new Error(`${label} must not have leading or trailing whitespace.`);
+  }
+  if (value.length > maxLength) {
+    throw new Error(`${label} exceeds the maximum length of ${maxLength} characters.`);
+  }
+  if ([...value].some(
+    (character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127
+  )) {
+    throw new Error(`${label} must not contain control characters.`);
+  }
+  return value;
 }
-function oneOf2(value, values) {
-  return typeof value === "string" && values.includes(value);
+function parseSafeInteger(value, label, minimum) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || Object.is(value, -0)) {
+    throw new Error(`${label} must be a safe integer.`);
+  }
+  if (value < minimum) {
+    throw new Error(`${label} must be at least ${minimum}.`);
+  }
+  return value;
 }
-function uniqueIds2(values) {
-  return new Set(values).size === values.length && values.every(isReliabilityId);
+function parsePositiveInteger(value, label) {
+  return parseSafeInteger(value, label, 1);
 }
-function isFence(value) {
-  return record3(value) && isReliabilityId(value.environmentId) && isReliabilityCounter(value.intentRevision) && isReliabilityCounter(value.runtimeGeneration) && isReliabilityCounter(value.controllerEpoch);
+function parseCanonicalAbsolutePath(value, label) {
+  const parsed = parseBoundedString(value, label, MAX_PATH_LENGTH);
+  if (!import_node_path31.default.posix.isAbsolute(parsed)) {
+    throw new Error(`${label} must be an absolute path.`);
+  }
+  if (import_node_path31.default.posix.resolve(parsed) !== parsed) {
+    throw new Error(`${label} must be a canonical absolute path.`);
+  }
+  return parsed;
 }
-function isConsumer(value) {
-  return record3(value) && isReliabilityId(value.id) && typeof value.pinned === "boolean" && Array.isArray(value.requiredCapabilities) && value.requiredCapabilities.length <= 128 && uniqueIds2(value.requiredCapabilities);
+function parseDomainId(value, label) {
+  const id5 = parseBoundedString(value, label, 64);
+  if (!DOMAIN_ID_RE.test(id5)) {
+    throw new Error(`${label} must be a lowercase alphanumeric or hyphen domain ID.`);
+  }
+  return id5;
 }
-function isObservation(value) {
-  return record3(value) && isReliabilityId(value.capability) && oneOf2(value.infrastructure, INFRASTRUCTURE_VALUES) && oneOf2(value.application, APPLICATION_VALUES) && isReliabilityCounter(value.observedAtMs) && isReliabilityCounter(value.validForMs);
+function parseProfileName(value, label) {
+  const combination = parseBoundedString(value, label, 64);
+  const names = combination.split(",");
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, name] of names.entries()) {
+    if (!PROFILE_NAME_RE2.test(name)) {
+      throw new Error(
+        `${label}[${index}] must be a lowercase alphanumeric or hyphen profile name.`
+      );
+    }
+    if (seen.has(name)) {
+      throw new Error(`${label} contains duplicate profile '${name}'.`);
+    }
+    seen.add(name);
+  }
+  return [...names].sort().join(",");
 }
-function assertReliabilityEvent(value) {
-  if (!record3(value) || !isFence(value) || typeof value.type !== "string") {
-    throw new Error("Invalid reliability event.");
+function parseUniqueProfiles(value, label) {
+  if (!Array.isArray(value) || value.length === 0) {
+    throw new Error(`${label} must be a non-empty array of profile names.`);
   }
-  let valid = false;
-  switch (value.type) {
-    case "request":
-      valid = oneOf2(value.mode, ["start", "attach"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer);
-      break;
-    case "operation-request":
-      valid = oneOf2(value.kind, ["ensure", "exec"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer) && typeof value.runtimeRunning === "boolean" && (value.recoverInterruptedEnsure === void 0 || typeof value.recoverInterruptedEnsure === "boolean");
-      break;
-    case "drained":
-      valid = isReliabilityId(value.operationId);
-      break;
-    case "release":
-      valid = isReliabilityId(value.consumerId);
-      break;
-    case "stop":
-    case "park":
-    case "dispatch":
-      valid = true;
-      break;
-    case "admission":
-      valid = oneOf2(value.result, ADMISSION_VALUES);
-      break;
-    case "resume":
-      valid = typeof value.pressureDwellSatisfied === "boolean" && isReliabilityId(value.operationId);
-      break;
-    case "dispatch-persisted":
+  if (value.length > MAX_PROFILES_PER_ENROLLMENT) {
+    throw new Error(
+      `${label} exceeds the maximum of ${MAX_PROFILES_PER_ENROLLMENT} profile names.`
+    );
+  }
+  const profiles = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, entry] of value.entries()) {
+    const profile = parseProfileName(entry, `${label}[${index}]`);
+    if (seen.has(profile)) {
+      throw new Error(`${label} contains duplicate or aliased profile combination '${profile}'.`);
+    }
+    seen.add(profile);
+    profiles.push(profile);
+  }
+  return profiles;
+}
+function parseDigest(value, label) {
+  const digest = parseBoundedString(value, label, 64);
+  if (!SHA256_RE.test(digest)) {
+    throw new Error(`${label} must be a lowercase SHA-256 hex digest.`);
+  }
+  return digest;
+}
+function parseDomain(value, domainId) {
+  const label = `domains.${domainId}`;
+  const domain = ensureObject2(value, label);
+  const kind = parseBoundedString(domain.kind, `${label}.kind`);
+  if (kind === "host") {
+    ensureAllowedKeys2(
+      domain,
+      [
+        "kind",
+        "adapter",
+        "capacityBytes",
+        "protectedHeadroomBytes",
+        "unmanagedAllowanceBytes",
+        "startupSlots",
+        "heavySlots"
+      ],
+      label
+    );
+    const adapter = parseBoundedString(domain.adapter, `${label}.adapter`);
+    if (adapter !== "macos-host-v1" && adapter !== "macos-declared-v1") {
+      throw new Error(`${label}.adapter must be 'macos-host-v1' or 'macos-declared-v1'.`);
+    }
+    const capacityBytes = parsePositiveInteger(domain.capacityBytes, `${label}.capacityBytes`);
+    const protectedHeadroomBytes = parsePositiveInteger(
+      domain.protectedHeadroomBytes,
+      `${label}.protectedHeadroomBytes`
+    );
+    if (protectedHeadroomBytes >= capacityBytes) {
+      throw new Error(`${label}.protectedHeadroomBytes must be less than capacityBytes.`);
+    }
+    const startupSlots = parsePositiveInteger(domain.startupSlots, `${label}.startupSlots`);
+    const heavySlots = parsePositiveInteger(domain.heavySlots, `${label}.heavySlots`);
+    if (adapter === "macos-host-v1") {
+      if (Object.hasOwn(domain, "unmanagedAllowanceBytes")) {
+        throw new Error(
+          `${label}.unmanagedAllowanceBytes is only supported for adapter 'macos-declared-v1'.`
+        );
+      }
+      return {
+        kind: "host",
+        adapter: "macos-host-v1",
+        capacityBytes,
+        protectedHeadroomBytes,
+        startupSlots,
+        heavySlots
+      };
+    }
+    const unmanagedAllowanceBytes = parseSafeInteger(
+      domain.unmanagedAllowanceBytes,
+      `${label}.unmanagedAllowanceBytes`,
+      0
+    );
+    if (unmanagedAllowanceBytes > capacityBytes - protectedHeadroomBytes) {
+      throw new Error(
+        `${label}.unmanagedAllowanceBytes must not exceed capacityBytes minus protectedHeadroomBytes.`
+      );
+    }
+    return {
+      kind: "host",
+      adapter: "macos-declared-v1",
+      capacityBytes,
+      protectedHeadroomBytes,
+      unmanagedAllowanceBytes,
+      startupSlots,
+      heavySlots
+    };
+  }
+  if (kind === "runtime") {
+    ensureAllowedKeys2(
+      domain,
+      [
+        "kind",
+        "adapter",
+        "endpoint",
+        "daemonId",
+        "hostDomain",
+        "hostChargeCeilingBytes",
+        "capacityBytes",
+        "protectedHeadroomBytes",
+        "guestUnmanagedAllowanceBytes",
+        "startupSlots",
+        "heavySlots"
+      ],
+      label
+    );
+    const adapter = parseBoundedString(domain.adapter, `${label}.adapter`);
+    if (adapter !== "orbstack-local-v1" && adapter !== "orbstack-declared-v1") {
+      throw new Error(`${label}.adapter must be 'orbstack-local-v1' or 'orbstack-declared-v1'.`);
+    }
+    const endpoint = parseCanonicalAbsolutePath(domain.endpoint, `${label}.endpoint`);
+    const daemonId = parseBoundedString(domain.daemonId, `${label}.daemonId`);
+    const hostDomain = parseDomainId(domain.hostDomain, `${label}.hostDomain`);
+    const hostChargeCeilingBytes = parsePositiveInteger(
+      domain.hostChargeCeilingBytes,
+      `${label}.hostChargeCeilingBytes`
+    );
+    const capacityBytes = parsePositiveInteger(domain.capacityBytes, `${label}.capacityBytes`);
+    const protectedHeadroomBytes = parsePositiveInteger(
+      domain.protectedHeadroomBytes,
+      `${label}.protectedHeadroomBytes`
+    );
+    if (protectedHeadroomBytes >= capacityBytes) {
+      throw new Error(`${label}.protectedHeadroomBytes must be less than capacityBytes.`);
+    }
+    const startupSlots = parsePositiveInteger(domain.startupSlots, `${label}.startupSlots`);
+    const heavySlots = parsePositiveInteger(domain.heavySlots, `${label}.heavySlots`);
+    if (adapter === "orbstack-local-v1") {
+      if (Object.hasOwn(domain, "guestUnmanagedAllowanceBytes")) {
+        throw new Error(
+          `${label}.guestUnmanagedAllowanceBytes is only supported for adapter 'orbstack-declared-v1'.`
+        );
+      }
+      return {
+        kind: "runtime",
+        adapter: "orbstack-local-v1",
+        endpoint,
+        daemonId,
+        hostDomain,
+        hostChargeCeilingBytes,
+        capacityBytes,
+        protectedHeadroomBytes,
+        startupSlots,
+        heavySlots
+      };
+    }
+    return {
+      kind: "runtime",
+      adapter: "orbstack-declared-v1",
+      endpoint,
+      daemonId,
+      hostDomain,
+      hostChargeCeilingBytes,
+      capacityBytes,
+      protectedHeadroomBytes,
+      guestUnmanagedAllowanceBytes: parseSafeInteger(
+        domain.guestUnmanagedAllowanceBytes,
+        `${label}.guestUnmanagedAllowanceBytes`,
+        0
+      ),
+      startupSlots,
+      heavySlots
+    };
+  }
+  throw new Error(`${label}.kind must be 'host' or 'runtime'.`);
+}
+function parseScheduling(value) {
+  const label = "scheduling";
+  const scheduling = ensureObject2(value, label);
+  ensureAllowedKeys2(
+    scheduling,
+    [
+      "maxQueuedPerDomain",
+      "maxQueuedTotal",
+      "queueLifetimeSeconds",
+      "clientWaitSeconds",
+      "maxClientWaitSeconds",
+      "watchSeconds",
+      "sampleIntervalSeconds",
+      "maxSampleAgeSeconds"
+    ],
+    label
+  );
+  const result = {
+    maxQueuedPerDomain: parsePositiveInteger(
+      scheduling.maxQueuedPerDomain,
+      `${label}.maxQueuedPerDomain`
+    ),
+    maxQueuedTotal: parsePositiveInteger(scheduling.maxQueuedTotal, `${label}.maxQueuedTotal`),
+    queueLifetimeSeconds: parsePositiveInteger(
+      scheduling.queueLifetimeSeconds,
+      `${label}.queueLifetimeSeconds`
+    ),
+    // Reserved for future runtime binding: validated and bounded today, but no
+    // consumer reads these scheduling knobs yet. Runtime constants remain
+    // authoritative (controller watch window, CLI admission wait, tick cadence).
+    clientWaitSeconds: parseSafeInteger(
+      scheduling.clientWaitSeconds,
+      `${label}.clientWaitSeconds`,
+      0
+    ),
+    maxClientWaitSeconds: parsePositiveInteger(
+      scheduling.maxClientWaitSeconds,
+      `${label}.maxClientWaitSeconds`
+    ),
+    watchSeconds: parsePositiveInteger(scheduling.watchSeconds, `${label}.watchSeconds`),
+    sampleIntervalSeconds: parsePositiveInteger(
+      scheduling.sampleIntervalSeconds,
+      `${label}.sampleIntervalSeconds`
+    ),
+    maxSampleAgeSeconds: parsePositiveInteger(
+      scheduling.maxSampleAgeSeconds,
+      `${label}.maxSampleAgeSeconds`
+    )
+  };
+  if (result.clientWaitSeconds > result.maxClientWaitSeconds) {
+    throw new Error(`${label}.clientWaitSeconds must not exceed maxClientWaitSeconds.`);
+  }
+  if (result.maxQueuedTotal > 64 || result.maxQueuedPerDomain > 32 || result.queueLifetimeSeconds > 900 || result.maxClientWaitSeconds > 900 || result.watchSeconds > 30 || result.maxSampleAgeSeconds > 15) {
+    throw new Error(`${label} exceeds supported controller bounds.`);
+  }
+  if (result.queueLifetimeSeconds < result.maxClientWaitSeconds) {
+    throw new Error(`${label}.queueLifetimeSeconds must cover maxClientWaitSeconds.`);
+  }
+  if (result.maxSampleAgeSeconds < result.sampleIntervalSeconds) {
+    throw new Error(`${label}.maxSampleAgeSeconds must be at least sampleIntervalSeconds.`);
+  }
+  return result;
+}
+function parseRecovery(value) {
+  if (value === void 0) return { ...DEFAULT_CAPACITY_RECOVERY };
+  const label = "recovery";
+  const recovery = ensureObject2(value, label);
+  ensureAllowedKeys2(
+    recovery,
+    [
+      "enabled",
+      "maxProcessRestarts",
+      "maxServiceRestarts",
+      "maxCorrectiveActions",
+      "windowSeconds",
+      "observationSeconds",
+      "resumeDwellSeconds"
+    ],
+    label
+  );
+  if (typeof recovery.enabled !== "boolean") {
+    throw new Error(`${label}.enabled must be a boolean.`);
+  }
+  const result = {
+    enabled: recovery.enabled,
+    maxProcessRestarts: parseSafeInteger(
+      recovery.maxProcessRestarts,
+      `${label}.maxProcessRestarts`,
+      0
+    ),
+    maxServiceRestarts: parseSafeInteger(
+      recovery.maxServiceRestarts,
+      `${label}.maxServiceRestarts`,
+      0
+    ),
+    maxCorrectiveActions: parsePositiveInteger(
+      recovery.maxCorrectiveActions,
+      `${label}.maxCorrectiveActions`
+    ),
+    windowSeconds: parsePositiveInteger(recovery.windowSeconds, `${label}.windowSeconds`),
+    observationSeconds: parsePositiveInteger(
+      recovery.observationSeconds,
+      `${label}.observationSeconds`
+    ),
+    resumeDwellSeconds: parsePositiveInteger(
+      recovery.resumeDwellSeconds,
+      `${label}.resumeDwellSeconds`
+    )
+  };
+  if (result.maxCorrectiveActions < result.maxProcessRestarts + result.maxServiceRestarts) {
+    throw new Error(
+      `${label}.maxCorrectiveActions must cover maxProcessRestarts and maxServiceRestarts.`
+    );
+  }
+  if (result.maxProcessRestarts > 4 || result.maxServiceRestarts > 2 || result.maxCorrectiveActions > 8 || result.windowSeconds > 3600 || result.observationSeconds > 300 || result.resumeDwellSeconds > 3600) {
+    throw new Error(`${label} exceeds supported controller bounds.`);
+  }
+  return result;
+}
+function validateDomainReferences(domains) {
+  const daemonIds = /* @__PURE__ */ new Map();
+  const endpoints = /* @__PURE__ */ new Map();
+  for (const [domainId, domain] of Object.entries(domains)) {
+    if (domain.kind !== "runtime") continue;
+    const previousDaemon = daemonIds.get(domain.daemonId);
+    if (previousDaemon) {
+      throw new Error(
+        `domains.${domainId}.daemonId duplicates runtime domain '${previousDaemon}'.`
+      );
+    }
+    daemonIds.set(domain.daemonId, domainId);
+    const previousEndpoint = endpoints.get(domain.endpoint);
+    if (previousEndpoint) {
+      throw new Error(`domains.${domainId}.endpoint aliases runtime domain '${previousEndpoint}'.`);
+    }
+    endpoints.set(domain.endpoint, domainId);
+    if (!Object.hasOwn(domains, domain.hostDomain)) {
+      throw new Error(
+        `domains.${domainId}.hostDomain references missing domain '${domain.hostDomain}'.`
+      );
+    }
+    const hostDomain = domains[domain.hostDomain];
+    if (hostDomain.kind !== "host") {
+      throw new Error(
+        `domains.${domainId}.hostDomain must reference a host domain, not '${domain.hostDomain}'.`
+      );
+    }
+    const unmanagedAllowanceBytes = hostDomain.adapter === "macos-declared-v1" ? hostDomain.unmanagedAllowanceBytes : 0;
+    const admissibleHostBytes = hostDomain.capacityBytes - hostDomain.protectedHeadroomBytes - unmanagedAllowanceBytes;
+    if (domain.hostChargeCeilingBytes > admissibleHostBytes) {
+      throw new Error(
+        `domains.${domainId}.hostChargeCeilingBytes exceeds admissible capacity of host domain '${domain.hostDomain}'.`
+      );
+    }
+  }
+}
+function parseEnrollment(value, index, domains) {
+  const label = `enrollments[${index}]`;
+  const enrollment = ensureObject2(value, label);
+  ensureAllowedKeys2(
+    enrollment,
+    [
+      "repoPath",
+      "gitCommonDir",
+      "workspace",
+      "provider",
+      "providerId",
+      "hostDomain",
+      "runtimeDomain",
+      "profiles",
+      "estimatesDigest",
+      "defaultOperation"
+    ],
+    label
+  );
+  const repoPath = parseCanonicalAbsolutePath(enrollment.repoPath, `${label}.repoPath`);
+  const gitCommonDir = parseCanonicalAbsolutePath(enrollment.gitCommonDir, `${label}.gitCommonDir`);
+  const workspace = parseBoundedString(enrollment.workspace, `${label}.workspace`, 32);
+  if (!WORKSPACE_TOKEN_RE.test(workspace)) {
+    throw new Error(`${label}.workspace must be an existing workspace token.`);
+  }
+  const provider = parseBoundedString(enrollment.provider, `${label}.provider`);
+  if (provider !== "devsy" && provider !== "devpod") {
+    throw new Error(`${label}.provider must be 'devsy' or 'devpod'.`);
+  }
+  const providerId = parseBoundedString(enrollment.providerId, `${label}.providerId`);
+  const hostDomain = parseDomainId(enrollment.hostDomain, `${label}.hostDomain`);
+  const runtimeDomain = parseDomainId(enrollment.runtimeDomain, `${label}.runtimeDomain`);
+  if (!Object.hasOwn(domains, hostDomain)) {
+    throw new Error(`${label}.hostDomain references missing domain '${hostDomain}'.`);
+  }
+  const host = domains[hostDomain];
+  if (host.kind !== "host") {
+    throw new Error(`${label}.hostDomain must reference a host domain.`);
+  }
+  if (!Object.hasOwn(domains, runtimeDomain)) {
+    throw new Error(`${label}.runtimeDomain references missing domain '${runtimeDomain}'.`);
+  }
+  const runtime = domains[runtimeDomain];
+  if (runtime.kind !== "runtime") {
+    throw new Error(`${label}.runtimeDomain must reference a runtime domain.`);
+  }
+  if (runtime.hostDomain !== hostDomain) {
+    throw new Error(
+      `${label}.runtimeDomain '${runtimeDomain}' is bound to host domain '${runtime.hostDomain}', not '${hostDomain}'.`
+    );
+  }
+  const profiles = parseUniqueProfiles(enrollment.profiles, `${label}.profiles`);
+  const estimatesDigest = parseDigest(enrollment.estimatesDigest, `${label}.estimatesDigest`);
+  const defaultOperation = ensureObject2(enrollment.defaultOperation, `${label}.defaultOperation`);
+  ensureAllowedKeys2(
+    defaultOperation,
+    ["hostIncrementBytes", "runtimeIncrementBytes"],
+    `${label}.defaultOperation`
+  );
+  return {
+    repoPath,
+    gitCommonDir,
+    workspace,
+    provider,
+    providerId,
+    hostDomain,
+    runtimeDomain,
+    profiles,
+    estimatesDigest,
+    defaultOperation: {
+      hostIncrementBytes: parseSafeInteger(
+        defaultOperation.hostIncrementBytes,
+        `${label}.defaultOperation.hostIncrementBytes`,
+        0
+      ),
+      runtimeIncrementBytes: parsePositiveInteger(
+        defaultOperation.runtimeIncrementBytes,
+        `${label}.defaultOperation.runtimeIncrementBytes`
+      )
+    }
+  };
+}
+function parseCapacityPolicy(value) {
+  const root = ensureObject2(value, "capacity policy");
+  ensureAllowedKeys2(
+    root,
+    ["version", "revision", "admissions", "scheduling", "recovery", "domains", "enrollments"],
+    "capacity policy"
+  );
+  const version = parsePositiveInteger(root.version, "capacity policy.version");
+  if (version !== 1) {
+    throw new Error("capacity policy.version must be 1.");
+  }
+  const revision = parsePositiveInteger(root.revision, "capacity policy.revision");
+  const admissions = parseBoundedString(root.admissions, "capacity policy.admissions");
+  if (admissions !== "enabled" && admissions !== "paused") {
+    throw new Error("capacity policy.admissions must be 'enabled' or 'paused'.");
+  }
+  const scheduling = parseScheduling(root.scheduling);
+  const recovery = parseRecovery(root.recovery);
+  const domainsValue = ensureObject2(root.domains, "capacity policy.domains");
+  const domainEntries = Object.entries(domainsValue);
+  if (domainEntries.length > MAX_DOMAINS) {
+    throw new Error(`capacity policy.domains exceeds the maximum of ${MAX_DOMAINS} domains.`);
+  }
+  const domains = {};
+  for (const [domainId, domainValue] of domainEntries) {
+    const parsedId = parseDomainId(domainId, "capacity policy.domains key");
+    domains[parsedId] = parseDomain(domainValue, parsedId);
+  }
+  validateDomainReferences(domains);
+  if (!Array.isArray(root.enrollments)) {
+    throw new Error("capacity policy.enrollments must be an array.");
+  }
+  if (root.enrollments.length > MAX_ENROLLMENTS) {
+    throw new Error(
+      `capacity policy.enrollments exceeds the maximum of ${MAX_ENROLLMENTS} enrollments.`
+    );
+  }
+  const enrollments = [];
+  const enrollmentKeys = /* @__PURE__ */ new Set();
+  const providerIds = /* @__PURE__ */ new Map();
+  for (const [index, enrollmentValue] of root.enrollments.entries()) {
+    const enrollment = parseEnrollment(enrollmentValue, index, domains);
+    const enrollmentKey = [enrollment.repoPath, enrollment.gitCommonDir, enrollment.workspace].join(
+      "\0"
+    );
+    if (enrollmentKeys.has(enrollmentKey)) {
+      throw new Error(`enrollments[${index}] duplicates an existing enrollment.`);
+    }
+    enrollmentKeys.add(enrollmentKey);
+    const providerKey = `${enrollment.provider}\0${enrollment.providerId}`;
+    const previousProviderIndex = providerIds.get(providerKey);
+    if (previousProviderIndex !== void 0) {
+      throw new Error(
+        `enrollments[${index}].providerId duplicates enrollments[${previousProviderIndex}].`
+      );
+    }
+    providerIds.set(providerKey, index);
+    enrollments.push(enrollment);
+  }
+  return {
+    version: 1,
+    revision,
+    admissions,
+    scheduling,
+    recovery,
+    domains,
+    enrollments
+  };
+}
+
+// src/core/controller-client.ts
+var import_node_crypto15 = require("crypto");
+var import_node_fs28 = __toESM(require("fs"));
+var import_node_net2 = __toESM(require("net"));
+var import_node_path33 = __toESM(require("path"));
+
+// src/core/controller-protocol.ts
+var import_node_path32 = __toESM(require("path"));
+var CONTROLLER_FRAME_BYTES = 64 * 1024;
+var CONTROLLER_MAX_OPERATION_REQUEST_BYTES = 32 * 1024;
+var CONTROLLER_PROFILE_TOKEN_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var CONTROLLER_PROFILE_RE = new RegExp(
+  `^(?:${CONTROLLER_PROFILE_TOKEN_RE.source.slice(1, -1)})(?:,(?:${CONTROLLER_PROFILE_TOKEN_RE.source.slice(1, -1)}))*$`
+);
+
+// src/core/controller-monitor.ts
+var import_node_crypto16 = require("crypto");
+var import_node_util6 = require("util");
+
+// src/core/reliability-output.ts
+function reliabilityAttention(state) {
+  assertReliabilityState(state);
+  const completeStop = state.stopProof.workloadsStopped && state.stopProof.routesRemoved;
+  if (state.desired === "stopped-by-user") return completeStop ? void 0 : "stop-incomplete";
+  if (state.operation?.status === "COMPLETION_UNKNOWN" || state.operation?.status === "INTERRUPTED")
+    return "operation-unknown";
+  if (state.desired === "parked-for-capacity")
+    return completeStop ? "capacity-parked" : "stop-incomplete";
+  if (state.admission === "denied-unadmittable") return "unadmittable";
+  if (state.admission === "waiting") return "capacity-waiting";
+  if (state.phase === "recovering") return "recovering";
+  if (state.phase === "queued" || state.phase === "starting" || state.phase === "verifying")
+    return "starting";
+  return void 0;
+}
+
+// src/core/managed-post-start.ts
+var import_node_child_process20 = require("child_process");
+var import_node_crypto18 = require("crypto");
+var import_node_fs29 = __toESM(require("fs"));
+var import_node_path34 = __toESM(require("path"));
+
+// src/core/managed-host-ports.ts
+var import_node_child_process19 = require("child_process");
+var import_node_crypto17 = require("crypto");
+var PORT_LOOKUP_TIMEOUT_MS = 1e4;
+var PORT_LOOKUP_MAX_BUFFER = 64 * 1024;
+var LOOPBACK_BINDING = /^127\.0\.0\.1:(\d+)$/;
+function unavailableEntry(declaration, reason2) {
+  return { ...declaration, status: "unavailable", reason: reason2 };
+}
+function livePublishedBindings(containerId, target) {
+  const result = (0, import_node_child_process19.spawnSync)("docker", ["port", containerId, `${target}/tcp`], {
+    encoding: "utf-8",
+    timeout: PORT_LOOKUP_TIMEOUT_MS,
+    maxBuffer: PORT_LOOKUP_MAX_BUFFER,
+    ...networkDockerOptions()
+  });
+  if (result.error || result.status === null) return void 0;
+  if (result.status !== 0) return "";
+  return typeof result.stdout === "string" ? result.stdout : void 0;
+}
+function parseLoopbackBinding(output) {
+  const lines = output.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  if (lines.length === 0) return { reason: "not-published" };
+  if (lines.length > 1) return { reason: "ambiguous" };
+  const match = LOOPBACK_BINDING.exec(lines[0]);
+  if (!match) return { reason: "not-published" };
+  const port = Number(match[1]);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return { reason: "not-published" };
+  return { endpoint: { host: "127.0.0.1", port } };
+}
+function revalidateLiveOwner(containerId, input, composeProject, composeFiles, service) {
+  try {
+    const current = inspectWorkspaceContainers({ ids: [containerId] });
+    if (current.length !== 1 || current[0].id !== containerId) return "unavailable";
+    if (!hasExactComposeIdentity(current[0], {
+      repoPath: input.repoPath,
+      service,
+      composeProject,
+      composeFiles
+    })) {
+      return "unavailable";
+    }
+    return current[0].state.Running ? "available" : "not-running";
+  } catch {
+    return "unavailable";
+  }
+}
+function resolveManagedHostPorts(input) {
+  const report = {};
+  const selectedServices = new Set(input.selectedServices);
+  const selectedKeys = [];
+  for (const [key, declaration] of Object.entries(input.declarations)) {
+    if (!selectedServices.has(declaration.service)) {
+      report[key] = { ...declaration, status: "inactive" };
+      continue;
+    }
+    selectedKeys.push(key);
+    report[key] = { ...declaration, status: "unavailable", reason: "unavailable" };
+  }
+  if (selectedKeys.length === 0) return report;
+  const composeProject = input.composeProject;
+  const composeFiles = input.composeFiles;
+  if (typeof composeProject !== "string" || composeProject.length === 0 || composeFiles === void 0 || composeFiles.length === 0 || composeFiles.some((file) => file.length === 0)) {
+    return report;
+  }
+  if (selectedKeys.some((key) => {
+    const target = input.declarations[key].target;
+    return !Number.isInteger(target) || target < 1 || target > 65535;
+  })) {
+    return report;
+  }
+  const liveContainers = input.containers === void 0;
+  let containers = input.containers;
+  if (containers === void 0) {
+    try {
+      containers = inspectWorkspaceContainers({ composeProject });
+    } catch {
+      return report;
+    }
+  }
+  const publishedBindings = input.publishedBindings ?? livePublishedBindings;
+  for (const key of selectedKeys) {
+    const declaration = input.declarations[key];
+    let owners;
+    try {
+      owners = containers.filter(
+        (container) => hasExactComposeIdentity(container, {
+          repoPath: input.repoPath,
+          service: declaration.service,
+          composeProject,
+          composeFiles
+        })
+      );
+    } catch {
+      report[key] = unavailableEntry(declaration, "unavailable");
+      continue;
+    }
+    if (owners.length === 0) {
+      report[key] = unavailableEntry(declaration, "not-found");
+      continue;
+    }
+    if (owners.length > 1) {
+      report[key] = unavailableEntry(declaration, "ambiguous");
+      continue;
+    }
+    const owner = owners[0];
+    if (!owner.state.Running) {
+      report[key] = unavailableEntry(declaration, "not-running");
+      continue;
+    }
+    let output;
+    try {
+      output = publishedBindings(owner.id, declaration.target);
+    } catch {
+      output = void 0;
+    }
+    if (typeof output !== "string") {
+      report[key] = unavailableEntry(declaration, "unavailable");
+      continue;
+    }
+    const binding = parseLoopbackBinding(output);
+    if (!binding.endpoint) {
+      report[key] = unavailableEntry(declaration, binding.reason ?? "unavailable");
+      continue;
+    }
+    if (liveContainers) {
+      const proof = revalidateLiveOwner(
+        owner.id,
+        input,
+        composeProject,
+        composeFiles,
+        declaration.service
+      );
+      if (proof !== "available") {
+        report[key] = unavailableEntry(declaration, proof);
+        continue;
+      }
+    }
+    report[key] = {
+      ...declaration,
+      status: "available",
+      endpoint: binding.endpoint
+    };
+  }
+  return report;
+}
+function managedHostPortDeclarationsIdentity(declarations) {
+  const keys2 = Object.keys(declarations).sort();
+  if (keys2.length === 0) return void 0;
+  const canonical = keys2.map((key) => [key, declarations[key].service, declarations[key].target]);
+  return (0, import_node_crypto17.createHash)("sha256").update(JSON.stringify(canonical)).digest("hex");
+}
+function managedHostPortVariables(report) {
+  return Object.fromEntries(
+    Object.entries(report).map(([key, entry]) => [
+      `DEVROUTER_HOST_PORT_${key.toUpperCase().replaceAll("-", "_")}`,
+      entry.status === "available" && entry.endpoint ? String(entry.endpoint.port) : ""
+    ])
+  );
+}
+function managedHostPortIdentity(report) {
+  const keys2 = Object.keys(report).sort();
+  if (keys2.length === 0) return void 0;
+  const canonical = keys2.map((key) => {
+    const entry = report[key];
+    return [key, entry.status === "available" ? entry.endpoint?.port ?? null : entry.status];
+  });
+  return (0, import_node_crypto17.createHash)("sha256").update(JSON.stringify(canonical)).digest("hex");
+}
+function assertManagedHostPortsAvailable(report) {
+  const unavailable = Object.entries(report).filter(([, entry]) => entry.status === "unavailable").map(([key]) => key).sort();
+  if (unavailable.length > 0) {
+    throw new Error(`Selected managed host ports are unavailable: ${unavailable.join(", ")}.`);
+  }
+}
+
+// src/core/managed-post-start.ts
+var MANAGED_MARKER = "devrouter:managed devcontainer";
+var MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
+var RUNTIME_HELPER_PATH = "/tmp/devrouter/bin/devrouter-process";
+var RUNTIME_VARIANT_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var ADAPTER_WRAPPER = `adapter_snapshot="$1"
+shift
+readonly DEVROUTER_PROCESS_HELPER DEVROUTER_PROCESS_ADAPTER_SHA256 DEVROUTER_RUNTIME_VARIANT DEVROUTER_PROCESS_HOST_PORTS_SHA256
+source "$adapter_snapshot"
+`;
+function renderDeliveryScript(targetPath) {
+  if (!/^\/tmp\/devrouter\/bin\/[a-zA-Z0-9._-]+$/.test(targetPath)) {
+    throw new Error(`Unsafe managed runtime delivery path: ${targetPath}`);
+  }
+  const temporaryPrefix = import_node_path34.default.posix.basename(targetPath);
+  return `set -eu
+umask 077
+runtime_root=/tmp/devrouter
+runtime_bin="$runtime_root/bin"
+target="${targetPath}"
+if [ -L "$runtime_root" ] || [ -L "$runtime_bin" ]; then
+  echo "Refusing symlinked devrouter runtime path." >&2
+  exit 1
+fi
+mkdir -p "$runtime_bin"
+chmod 700 "$runtime_root" "$runtime_bin"
+temporary="$(mktemp "$runtime_bin/.${temporaryPrefix}.XXXXXX")"
+trap 'rm -f "$temporary"' EXIT
+cat > "$temporary"
+chmod 700 "$temporary"
+mv -f "$temporary" "$target"
+trap - EXIT
+`;
+}
+function commandFailure2(result) {
+  return [result.error?.message, result.stderr, result.stdout].filter(Boolean).map((value) => String(value).trim()).filter(Boolean).join("\n");
+}
+function deliverRuntimeFile(containerId, targetPath, contents, label) {
+  const result = (0, import_node_child_process20.spawnSync)(
+    "docker",
+    ["exec", "-i", containerId, "sh", "-c", renderDeliveryScript(targetPath)],
+    { input: contents, encoding: "utf-8", ...networkDockerOptions() }
+  );
+  if (result.status !== 0) {
+    const details = commandFailure2(result);
+    throw new Error(`Could not deliver ${label}${details ? `: ${details}` : "."}`);
+  }
+}
+function readRegularFileBytes(filePath) {
+  if (!import_node_fs29.default.existsSync(filePath) || !import_node_fs29.default.lstatSync(filePath).isFile()) return void 0;
+  return import_node_fs29.default.readFileSync(filePath);
+}
+function readRegularFile(filePath) {
+  return readRegularFileBytes(filePath)?.toString("utf-8");
+}
+function adapterFingerprint(adapter) {
+  return (0, import_node_crypto18.createHash)("sha256").update(adapter).digest("hex");
+}
+function resolveProcessHelperPath() {
+  const candidates = [
+    import_node_path34.default.resolve(__dirname, "..", "bin", "devrouter-process"),
+    import_node_path34.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
+  ];
+  const helperPath = candidates.find((candidate) => import_node_fs29.default.existsSync(candidate));
+  if (!helperPath) {
+    throw new Error("Could not locate the packaged devrouter-process helper.");
+  }
+  return helperPath;
+}
+function resolveManagedPostStartPlan(repoPath) {
+  const adapterPath = import_node_path34.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterBytes = readRegularFileBytes(adapterPath);
+  const adapterText = adapterBytes?.toString("utf-8");
+  const dockerfilePath = import_node_path34.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path34.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfile = readRegularFile(dockerfilePath) ?? "";
+  const devcontainer = readRegularFile(devcontainerPath) ?? "";
+  const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
+    (value) => value.includes("DEVROUTER_PROCESS_HELPER") || value.includes("devrouter-process")
+  );
+  if (adapterBytes === void 0) {
+    if (devrouterPattern) {
+      throw new Error(
+        "Devrouter lifecycle wiring is incomplete: add the managed post-start adapter or remove the stale devrouter-process references."
+      );
+    }
+    return { kind: "unmanaged" };
+  }
+  const adapter = adapterBytes.toString("utf-8");
+  if (!adapter.includes(MANAGED_MARKER)) {
+    if (devrouterPattern) {
+      throw new Error(
+        "Devrouter-looking post-start adapter is missing the 'devrouter:managed devcontainer' marker. Regenerate or migrate the devcontainer, then retry devrouter ensure."
+      );
+    }
+    return { kind: "unmanaged" };
+  }
+  assertManagedDevcontainerLifecycle(repoPath);
+  if (adapter.includes("DEVROUTER_PROCESS_HELPER")) {
+    return {
+      kind: "runtime",
+      adapterPath: MANAGED_ADAPTER_PATH,
+      adapterSha256: adapterFingerprint(adapterBytes),
+      adapterContents: adapterBytes
+    };
+  }
+  if (dockerfile.includes("devrouter-process") && devcontainer.includes("postStartCommand")) {
+    return { kind: "legacy" };
+  }
+  throw new Error(
+    "Managed post-start must use DEVROUTER_PROCESS_HELPER before removing the legacy image helper and postStartCommand. Regenerate or migrate the devcontainer, then retry devrouter ensure."
+  );
+}
+function runManagedPostStart(options) {
+  if (options.plan.kind !== "runtime") return;
+  const runtimeVariant = options.variant ?? "default";
+  if (runtimeVariant.length > 64 || !RUNTIME_VARIANT_PATTERN.test(runtimeVariant)) {
+    throw new Error(
+      "Managed runtime variant must use lowercase alphanumeric segments separated by hyphens and be at most 64 characters."
+    );
+  }
+  const hostPorts = options.hostPorts ?? {};
+  assertManagedHostPortsAvailable(hostPorts);
+  const portEnvironment = managedHostPortVariables(hostPorts);
+  const portIdentity = managedHostPortIdentity(hostPorts) ?? "";
+  const helper = import_node_fs29.default.readFileSync(resolveProcessHelperPath());
+  deliverRuntimeFile(
+    options.container.id,
+    RUNTIME_HELPER_PATH,
+    helper,
+    "the managed process helper"
+  );
+  const runtimeAdapterPath = `/tmp/devrouter/bin/managed-post-start-${options.plan.adapterSha256}`;
+  deliverRuntimeFile(
+    options.container.id,
+    runtimeAdapterPath,
+    options.plan.adapterContents,
+    "the managed post-start adapter"
+  );
+  const started2 = (0, import_node_child_process20.spawnSync)(
+    "docker",
+    [
+      "exec",
+      "--workdir",
+      options.container.workspacePath,
+      "--env",
+      `DEVROUTER_PROCESS_HELPER=${RUNTIME_HELPER_PATH}`,
+      "--env",
+      `DEVROUTER_PROCESS_ADAPTER_SHA256=${options.plan.adapterSha256}`,
+      "--env",
+      `DEVROUTER_PROCESS_HOST_PORTS_SHA256=${portIdentity}`,
+      ...Object.entries(portEnvironment).flatMap(([name, value]) => ["--env", `${name}=${value}`]),
+      "--env",
+      `DEVROUTER_RUNTIME_VARIANT=${runtimeVariant}`,
+      ...options.profile ? ["--env", `DEVROUTER_PROFILE=${options.profile}`] : [],
+      ...options.processes ? [
+        "--env",
+        `DEVROUTER_PROCESS_SET=${options.processes.join(",")}`,
+        "--env",
+        "DEVROUTER_PROCESS_FINGERPRINT_ENV=DEVROUTER_PROFILE,DEVROUTER_PROCESS_SET"
+      ] : [],
+      options.container.id,
+      "bash",
+      "-c",
+      ADAPTER_WRAPPER,
+      options.plan.adapterPath,
+      runtimeAdapterPath
+    ],
+    {
+      stdio: options.quiet ? ["ignore", 2, "inherit"] : "inherit",
+      ...networkDockerOptions()
+    }
+  );
+  if (started2.status !== 0) {
+    const details = commandFailure2(started2);
+    throw new Error(`Managed post-start failed${details ? `: ${details}.` : "."}`);
+  }
+}
+function assertSafeProcessName(name) {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(name)) {
+    throw new Error(`Managed process '${name}' is not a safe exact identifier.`);
+  }
+}
+function runManagedProcessAction(options) {
+  assertSafeProcessName(options.name);
+  const result = (0, import_node_child_process20.spawnSync)(
+    "docker",
+    [
+      "exec",
+      "--workdir",
+      options.container.workspacePath,
+      "--env",
+      `DEVROUTER_PROCESS_HELPER=${RUNTIME_HELPER_PATH}`,
+      options.container.id,
+      "bash",
+      "-c",
+      'exec "$DEVROUTER_PROCESS_HELPER" "$1" --name "$2"',
+      "devrouter-process",
+      options.action,
+      options.name
+    ],
+    {
+      encoding: "utf-8",
+      stdio: options.action === "status" ? ["ignore", "pipe", "pipe"] : ["ignore", 2, "inherit"],
+      ...networkDockerOptions()
+    }
+  );
+  if (options.action === "stop") {
+    if (result.status !== 0) {
+      throw new Error(`Could not stop managed process '${options.name}'.`);
+    }
+    return "stopped";
+  }
+  try {
+    const parsed = JSON.parse(result.stdout.trim());
+    if (parsed.status === "running" || parsed.status === "stopped" || parsed.status === "foreign" || parsed.status === "drifted") {
+      return parsed.status;
+    }
+  } catch {
+  }
+  return "drifted";
+}
+
+// src/core/recovery-budget.ts
+function findRecoveryUnit(incident, unit) {
+  return (incident.units ?? []).find((record5) => record5.key === unit.key);
+}
+function restartsFor(kind, limits) {
+  return kind === "service" ? limits.maxServiceRestarts : limits.maxProcessRestarts;
+}
+function recoveryBudgetRefusal(input) {
+  const startedAtMs = input.incident.startedAtMs ?? input.nowMs;
+  const elapsed = input.activeElapsedMs ?? Math.max(0, input.nowMs - startedAtMs);
+  if (elapsed > input.limits.windowSeconds * 1e3) return "window-closed";
+  if (input.unit !== void 0) {
+    const record5 = findRecoveryUnit(input.incident, input.unit);
+    if (record5 !== void 0 && record5.actions >= restartsFor(input.unit.kind, input.limits))
+      return "unit-exhausted";
+  }
+  if (input.incident.correctiveActionsTaken >= input.incident.actionLimit)
+    return "budget-exhausted";
+  return void 0;
+}
+function claimRecoveryUnit(input) {
+  const reason2 = recoveryBudgetRefusal(input);
+  if (reason2 !== void 0) return { ok: false, reason: reason2 };
+  const units = (input.incident.units ?? []).map((record5) => ({ ...record5 }));
+  if (input.unit !== void 0) {
+    const index = units.findIndex((record5) => record5.key === input.unit?.key);
+    if (index === -1) {
+      if (units.length >= RELIABILITY_MAX_ITEMS) return { ok: false, reason: "unit-exhausted" };
+      units.push({ ...input.unit, actions: 1, lastActionAtMs: input.nowMs });
+    } else {
+      const record5 = units[index];
+      units[index] = {
+        ...record5,
+        actions: record5.actions + 1,
+        lastActionAtMs: input.nowMs
+      };
+    }
+  }
+  return {
+    ok: true,
+    incident: {
+      ...input.incident,
+      startedAtMs: input.incident.startedAtMs ?? input.nowMs,
+      correctiveActionsTaken: input.incident.correctiveActionsTaken + 1,
+      units
+    }
+  };
+}
+
+// src/core/reliability-model.ts
+var INFRASTRUCTURE_VALUES = ["healthy", "failed", "unknown"];
+var APPLICATION_VALUES = ["verified", "unready", "unverified"];
+var ADMISSION_VALUES = ["admitted", "waiting", "unknown", "denied-unadmittable"];
+function record3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function oneOf2(value, values) {
+  return typeof value === "string" && values.includes(value);
+}
+function uniqueIds2(values) {
+  return new Set(values).size === values.length && values.every(isReliabilityId);
+}
+function isFence(value) {
+  return record3(value) && isReliabilityId(value.environmentId) && isReliabilityCounter(value.intentRevision) && isReliabilityCounter(value.runtimeGeneration) && isReliabilityCounter(value.controllerEpoch);
+}
+function isConsumer(value) {
+  return record3(value) && isReliabilityId(value.id) && typeof value.pinned === "boolean" && Array.isArray(value.requiredCapabilities) && value.requiredCapabilities.length <= 128 && uniqueIds2(value.requiredCapabilities);
+}
+function isObservation(value) {
+  return record3(value) && isReliabilityId(value.capability) && oneOf2(value.infrastructure, INFRASTRUCTURE_VALUES) && oneOf2(value.application, APPLICATION_VALUES) && isReliabilityCounter(value.observedAtMs) && isReliabilityCounter(value.validForMs);
+}
+function assertReliabilityEvent(value) {
+  if (!record3(value) || !isFence(value) || typeof value.type !== "string") {
+    throw new Error("Invalid reliability event.");
+  }
+  let valid = false;
+  switch (value.type) {
+    case "request":
+      valid = oneOf2(value.mode, ["start", "attach"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer);
+      break;
+    case "operation-request":
+      valid = oneOf2(value.kind, ["ensure", "exec"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer) && typeof value.runtimeRunning === "boolean" && (value.recoverInterruptedEnsure === void 0 || typeof value.recoverInterruptedEnsure === "boolean");
+      break;
+    case "drained":
+      valid = isReliabilityId(value.operationId);
+      break;
+    case "release":
+      valid = isReliabilityId(value.consumerId);
+      break;
+    case "stop":
+    case "park":
+    case "dispatch":
+      valid = true;
+      break;
+    case "admission":
+      valid = oneOf2(value.result, ADMISSION_VALUES);
+      break;
+    case "resume":
+      valid = typeof value.pressureDwellSatisfied === "boolean" && isReliabilityId(value.operationId);
+      break;
+    case "dispatch-persisted":
     case "launched":
     case "interrupted":
     case "not-started":
@@ -11278,10 +12480,10 @@ function stepReliability(state, event, nowMs) {
 }
 
 // src/core/reliability-worker.ts
-var import_node_child_process19 = require("child_process");
-var import_node_crypto17 = require("crypto");
-var import_node_fs29 = __toESM(require("fs"));
-var import_node_path34 = __toESM(require("path"));
+var import_node_child_process21 = require("child_process");
+var import_node_crypto19 = require("crypto");
+var import_node_fs30 = __toESM(require("fs"));
+var import_node_path35 = __toESM(require("path"));
 
 // src/core/lifecycle-progress.ts
 var ROLES = {
@@ -11347,11 +12549,11 @@ function workerGroupAbsent(pid) {
   if (process.platform !== "linux") return false;
   let observedZombie = false;
   try {
-    for (const entry of import_node_fs29.default.readdirSync("/proc")) {
+    for (const entry of import_node_fs30.default.readdirSync("/proc")) {
       if (!/^\d+$/.test(entry)) continue;
       let stat;
       try {
-        stat = import_node_fs29.default.readFileSync(`/proc/${entry}/stat`, "utf8");
+        stat = import_node_fs30.default.readFileSync(`/proc/${entry}/stat`, "utf8");
       } catch (error) {
         if (error.code === "ENOENT") continue;
         return false;
@@ -11371,20 +12573,20 @@ function workerGroupAbsent(pid) {
 }
 
 // src/core/workspace-ensure.ts
-var import_node_child_process30 = require("child_process");
+var import_node_child_process31 = require("child_process");
 var import_node_fs35 = __toESM(require("fs"));
 var import_node_path40 = __toESM(require("path"));
 
 // src/core/devpod-mutation.ts
-var import_node_child_process20 = require("child_process");
-var import_node_fs30 = __toESM(require("fs"));
-var import_node_path35 = __toESM(require("path"));
-var DEVPOD_MUTATION_LOCK_FILE = import_node_path35.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+var import_node_child_process22 = require("child_process");
+var import_node_fs31 = __toESM(require("fs"));
+var import_node_path36 = __toESM(require("path"));
+var DEVPOD_MUTATION_LOCK_FILE = import_node_path36.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
 var DEVPOD_MUTATION_WAIT_MS = 18e5;
 var DevpodStartPostconditionError = class extends Error {
 };
 function withMutationLock2(activity, target, operation) {
-  import_node_fs30.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs31.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
     {
@@ -11397,20 +12599,20 @@ function withMutationLock2(activity, target, operation) {
     operation
   );
 }
-function commandFailure2(result) {
+function commandFailure3(result) {
   return [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
 }
 function runDevpodAction(action, devpodId, force = false, repoPath) {
   const args = action === "delete" ? [action, devpodId, ...force ? ["--force"] : [], "--ignore-not-found"] : [action, devpodId];
   claimLifecycleEffect();
   const binding = repoPath ? networkProviderEffectOptions("devpod", devpodId, repoPath) : { args: [] };
-  const result = (0, import_node_child_process20.spawnSync)("devpod", [...args, ...binding.args], {
+  const result = (0, import_node_child_process22.spawnSync)("devpod", [...args, ...binding.args], {
     encoding: "utf-8",
     ...binding.env ? { env: binding.env } : {}
   });
   if (result.status !== 0) {
     throw new Error(
-      `devpod ${action}${force ? " --force" : ""} failed for '${devpodId}': ${commandFailure2(result) || "unknown error"}`
+      `devpod ${action}${force ? " --force" : ""} failed for '${devpodId}': ${commandFailure3(result) || "unknown error"}`
     );
   }
 }
@@ -11545,7 +12747,7 @@ async function startDevpodWorkspace(options) {
     }
     claimLifecycleEffect();
     network?.beforeDispatch?.();
-    const result = (0, import_node_child_process20.spawnSync)("devpod", args, {
+    const result = (0, import_node_child_process22.spawnSync)("devpod", args, {
       stdio: options.quiet ? ["inherit", 2, "inherit"] : "inherit",
       env
     });
@@ -11585,8 +12787,8 @@ async function startDevpodWorkspace(options) {
 }
 
 // src/core/host-port-claims.ts
-var import_node_child_process21 = require("child_process");
-var import_node_path36 = __toESM(require("path"));
+var import_node_child_process23 = require("child_process");
+var import_node_path37 = __toESM(require("path"));
 var COMPOSE_RENDER_TIMEOUT_MS = 3e4;
 var COMPOSE_RENDER_MAX_BUFFER = 8 * 1024 * 1024;
 var DOCKER_TIMEOUT_MS = 1e4;
@@ -11689,7 +12891,7 @@ function hostPortBindingsConflict(desired, holder) {
 }
 var HOST_PORT_INSPECT_TEMPLATE = '{"id":{{json .Id}},"name":{{json .Name}},"labels":{"com.docker.compose.project":{{json (index .Config.Labels "com.docker.compose.project")}},"com.docker.compose.project.working_dir":{{json (index .Config.Labels "com.docker.compose.project.working_dir")}}},"ports":{{json .NetworkSettings.Ports}}}';
 function runDocker(args) {
-  const result = (0, import_node_child_process21.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process23.spawnSync)("docker", args, {
     ...networkDockerOptions(),
     encoding: "utf-8",
     timeout: DOCKER_TIMEOUT_MS,
@@ -11759,7 +12961,7 @@ function listHolderSnapshots() {
 }
 function renderManagedComposeModel(plan, workspace) {
   const fileArgs = plan.composeFiles.flatMap((file) => ["-f", file]);
-  const result = (0, import_node_child_process21.spawnSync)(
+  const result = (0, import_node_child_process23.spawnSync)(
     "docker",
     [
       "compose",
@@ -11794,8 +12996,8 @@ function renderManagedComposeModel(plan, workspace) {
   }
 }
 function attributeHolderWorktree(workingDir) {
-  if (import_node_path36.default.basename(workingDir) !== ".devcontainer") return void 0;
-  return comparableWorkspacePath(import_node_path36.default.dirname(workingDir));
+  if (import_node_path37.default.basename(workingDir) !== ".devcontainer") return void 0;
+  return comparableWorkspacePath(import_node_path37.default.dirname(workingDir));
 }
 function holderAttribution(holder, repoPath) {
   const attribution = {};
@@ -11830,7 +13032,7 @@ function detectHostPortClaimConflicts(options) {
   );
   if (desired.length === 0) return [];
   const holders = listHolderSnapshots();
-  const devcontainerDir = import_node_path36.default.join(options.repoPath, ".devcontainer");
+  const devcontainerDir = import_node_path37.default.join(options.repoPath, ".devcontainer");
   const conflicts = [];
   for (const binding of desired) {
     for (const holder of holders) {
@@ -11854,7 +13056,7 @@ function detectHostPortClaimConflicts(options) {
 }
 
 // src/core/http-route-probe.ts
-var import_node_child_process22 = require("child_process");
+var import_node_child_process24 = require("child_process");
 var DEFAULT_MAX_TIME_SECONDS = 5;
 var PARENT_TIMEOUT_PADDING_MS = 250;
 var CONTRACT_MAX_BUFFER = 1024;
@@ -11887,7 +13089,7 @@ function probeHttpRoute(host, options = {}) {
     args.push("--cacert", CERT_FILE);
   }
   args.push(url);
-  const result = (0, import_node_child_process22.spawnSync)("curl", args, { encoding: "utf-8" });
+  const result = (0, import_node_child_process24.spawnSync)("curl", args, { encoding: "utf-8" });
   const stdout = result.stdout?.trim() ?? "";
   const status = /^\d{3}$/.test(stdout) ? Number(stdout) : void 0;
   const ok = result.status === 0 && status !== void 0 && status >= 100 && status < 500;
@@ -11906,7 +13108,7 @@ function probeHttpReadinessSync(host, readiness, maxTimeSeconds, repoPath) {
   }
   let result;
   try {
-    result = (0, import_node_child_process22.spawnSync)("curl", args, {
+    result = (0, import_node_child_process24.spawnSync)("curl", args, {
       encoding: "utf-8",
       maxBuffer: CONTRACT_MAX_BUFFER,
       timeout: Math.ceil(parentTimeoutMs)
@@ -11990,8 +13192,8 @@ function transportFailure() {
 }
 
 // src/core/managed-host-preparation.ts
-var import_node_child_process23 = require("child_process");
-var import_node_fs31 = __toESM(require("fs"));
+var import_node_child_process25 = require("child_process");
+var import_node_fs32 = __toESM(require("fs"));
 var PREPARATION_TIMEOUT_MS = 6e4;
 var CONFIG_READ_ERROR = "Managed host preparation could not read .devrouter.yml.";
 var CONFIG_CHANGED_ERROR = "Managed host preparation changed .devrouter.yml; refusing to continue.";
@@ -12002,7 +13204,7 @@ function runPreparationCommand(argv, cwd) {
   return new Promise((resolve) => {
     let child;
     try {
-      child = (0, import_node_child_process23.spawn)(argv[0], argv.slice(1), {
+      child = (0, import_node_child_process25.spawn)(argv[0], argv.slice(1), {
         cwd,
         detached: true,
         shell: false,
@@ -12034,7 +13236,7 @@ function runPreparationCommand(argv, cwd) {
 }
 function readConfigBytes(configPath) {
   try {
-    return import_node_fs31.default.readFileSync(configPath);
+    return import_node_fs32.default.readFileSync(configPath);
   } catch {
     return void 0;
   }
@@ -12067,219 +13269,8 @@ async function runManagedHostPreparation(repoPath, config) {
   }
 }
 
-// src/core/managed-post-start.ts
-var import_node_child_process24 = require("child_process");
-var import_node_crypto18 = require("crypto");
-var import_node_fs32 = __toESM(require("fs"));
-var import_node_path37 = __toESM(require("path"));
-var MANAGED_MARKER = "devrouter:managed devcontainer";
-var MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
-var RUNTIME_HELPER_PATH = "/tmp/devrouter/bin/devrouter-process";
-var ADAPTER_WRAPPER = `adapter_snapshot="$1"
-shift
-readonly DEVROUTER_PROCESS_HELPER DEVROUTER_PROCESS_ADAPTER_SHA256
-source "$adapter_snapshot"
-`;
-function renderDeliveryScript(targetPath) {
-  if (!/^\/tmp\/devrouter\/bin\/[a-zA-Z0-9._-]+$/.test(targetPath)) {
-    throw new Error(`Unsafe managed runtime delivery path: ${targetPath}`);
-  }
-  const temporaryPrefix = import_node_path37.default.posix.basename(targetPath);
-  return `set -eu
-umask 077
-runtime_root=/tmp/devrouter
-runtime_bin="$runtime_root/bin"
-target="${targetPath}"
-if [ -L "$runtime_root" ] || [ -L "$runtime_bin" ]; then
-  echo "Refusing symlinked devrouter runtime path." >&2
-  exit 1
-fi
-mkdir -p "$runtime_bin"
-chmod 700 "$runtime_root" "$runtime_bin"
-temporary="$(mktemp "$runtime_bin/.${temporaryPrefix}.XXXXXX")"
-trap 'rm -f "$temporary"' EXIT
-cat > "$temporary"
-chmod 700 "$temporary"
-mv -f "$temporary" "$target"
-trap - EXIT
-`;
-}
-function commandFailure3(result) {
-  return [result.error?.message, result.stderr, result.stdout].filter(Boolean).map((value) => String(value).trim()).filter(Boolean).join("\n");
-}
-function deliverRuntimeFile(containerId, targetPath, contents, label) {
-  const result = (0, import_node_child_process24.spawnSync)(
-    "docker",
-    ["exec", "-i", containerId, "sh", "-c", renderDeliveryScript(targetPath)],
-    { input: contents, encoding: "utf-8", ...networkDockerOptions() }
-  );
-  if (result.status !== 0) {
-    const details = commandFailure3(result);
-    throw new Error(`Could not deliver ${label}${details ? `: ${details}` : "."}`);
-  }
-}
-function readRegularFileBytes(filePath) {
-  if (!import_node_fs32.default.existsSync(filePath) || !import_node_fs32.default.lstatSync(filePath).isFile()) return void 0;
-  return import_node_fs32.default.readFileSync(filePath);
-}
-function readRegularFile(filePath) {
-  return readRegularFileBytes(filePath)?.toString("utf-8");
-}
-function adapterFingerprint(adapter) {
-  return (0, import_node_crypto18.createHash)("sha256").update(adapter).digest("hex");
-}
-function resolveProcessHelperPath() {
-  const candidates = [
-    import_node_path37.default.resolve(__dirname, "..", "bin", "devrouter-process"),
-    import_node_path37.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
-  ];
-  const helperPath = candidates.find((candidate) => import_node_fs32.default.existsSync(candidate));
-  if (!helperPath) {
-    throw new Error("Could not locate the packaged devrouter-process helper.");
-  }
-  return helperPath;
-}
-function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path37.default.join(repoPath, MANAGED_ADAPTER_PATH);
-  const adapterBytes = readRegularFileBytes(adapterPath);
-  const adapterText = adapterBytes?.toString("utf-8");
-  const dockerfilePath = import_node_path37.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path37.default.join(repoPath, ".devcontainer", "devcontainer.json");
-  const dockerfile = readRegularFile(dockerfilePath) ?? "";
-  const devcontainer = readRegularFile(devcontainerPath) ?? "";
-  const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
-    (value) => value.includes("DEVROUTER_PROCESS_HELPER") || value.includes("devrouter-process")
-  );
-  if (adapterBytes === void 0) {
-    if (devrouterPattern) {
-      throw new Error(
-        "Devrouter lifecycle wiring is incomplete: add the managed post-start adapter or remove the stale devrouter-process references."
-      );
-    }
-    return { kind: "unmanaged" };
-  }
-  const adapter = adapterBytes.toString("utf-8");
-  if (!adapter.includes(MANAGED_MARKER)) {
-    if (devrouterPattern) {
-      throw new Error(
-        "Devrouter-looking post-start adapter is missing the 'devrouter:managed devcontainer' marker. Regenerate or migrate the devcontainer, then retry devrouter ensure."
-      );
-    }
-    return { kind: "unmanaged" };
-  }
-  assertManagedDevcontainerLifecycle(repoPath);
-  if (adapter.includes("DEVROUTER_PROCESS_HELPER")) {
-    return {
-      kind: "runtime",
-      adapterPath: MANAGED_ADAPTER_PATH,
-      adapterSha256: adapterFingerprint(adapterBytes),
-      adapterContents: adapterBytes
-    };
-  }
-  if (dockerfile.includes("devrouter-process") && devcontainer.includes("postStartCommand")) {
-    return { kind: "legacy" };
-  }
-  throw new Error(
-    "Managed post-start must use DEVROUTER_PROCESS_HELPER before removing the legacy image helper and postStartCommand. Regenerate or migrate the devcontainer, then retry devrouter ensure."
-  );
-}
-function runManagedPostStart(options) {
-  if (options.plan.kind !== "runtime") return;
-  const helper = import_node_fs32.default.readFileSync(resolveProcessHelperPath());
-  deliverRuntimeFile(
-    options.container.id,
-    RUNTIME_HELPER_PATH,
-    helper,
-    "the managed process helper"
-  );
-  const runtimeAdapterPath = `/tmp/devrouter/bin/managed-post-start-${options.plan.adapterSha256}`;
-  deliverRuntimeFile(
-    options.container.id,
-    runtimeAdapterPath,
-    options.plan.adapterContents,
-    "the managed post-start adapter"
-  );
-  const started2 = (0, import_node_child_process24.spawnSync)(
-    "docker",
-    [
-      "exec",
-      "--workdir",
-      options.container.workspacePath,
-      "--env",
-      `DEVROUTER_PROCESS_HELPER=${RUNTIME_HELPER_PATH}`,
-      "--env",
-      `DEVROUTER_PROCESS_ADAPTER_SHA256=${options.plan.adapterSha256}`,
-      ...options.profile ? ["--env", `DEVROUTER_PROFILE=${options.profile}`] : [],
-      ...options.processes ? [
-        "--env",
-        `DEVROUTER_PROCESS_SET=${options.processes.join(",")}`,
-        "--env",
-        "DEVROUTER_PROCESS_FINGERPRINT_ENV=DEVROUTER_PROFILE,DEVROUTER_PROCESS_SET"
-      ] : [],
-      options.container.id,
-      "bash",
-      "-c",
-      ADAPTER_WRAPPER,
-      options.plan.adapterPath,
-      runtimeAdapterPath
-    ],
-    {
-      stdio: options.quiet ? ["ignore", 2, "inherit"] : "inherit",
-      ...networkDockerOptions()
-    }
-  );
-  if (started2.status !== 0) {
-    const details = commandFailure3(started2);
-    throw new Error(`Managed post-start failed${details ? `: ${details}.` : "."}`);
-  }
-}
-function assertSafeProcessName(name) {
-  if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(name)) {
-    throw new Error(`Managed process '${name}' is not a safe exact identifier.`);
-  }
-}
-function runManagedProcessAction(options) {
-  assertSafeProcessName(options.name);
-  const result = (0, import_node_child_process24.spawnSync)(
-    "docker",
-    [
-      "exec",
-      "--workdir",
-      options.container.workspacePath,
-      "--env",
-      `DEVROUTER_PROCESS_HELPER=${RUNTIME_HELPER_PATH}`,
-      options.container.id,
-      "bash",
-      "-c",
-      'exec "$DEVROUTER_PROCESS_HELPER" "$1" --name "$2"',
-      "devrouter-process",
-      options.action,
-      options.name
-    ],
-    {
-      encoding: "utf-8",
-      stdio: options.action === "status" ? ["ignore", "pipe", "pipe"] : ["ignore", 2, "inherit"],
-      ...networkDockerOptions()
-    }
-  );
-  if (options.action === "stop") {
-    if (result.status !== 0) {
-      throw new Error(`Could not stop managed process '${options.name}'.`);
-    }
-    return "stopped";
-  }
-  try {
-    const parsed = JSON.parse(result.stdout.trim());
-    if (parsed.status === "running" || parsed.status === "stopped" || parsed.status === "foreign" || parsed.status === "drifted") {
-      return parsed.status;
-    }
-  } catch {
-  }
-  return "drifted";
-}
-
 // src/core/managed-mount-nesting.ts
-var import_node_child_process25 = require("child_process");
+var import_node_child_process26 = require("child_process");
 var NESTED_MOUNT_REASON = "no configured mount is nested inside another configured mount";
 var UNREADABLE_MOUNT_REASON = "the container's own mount table could not be read";
 function normalizeDestination(value) {
@@ -12352,7 +13343,7 @@ function classifyManagedMountNesting(configured, effectiveDestinations, containe
   };
 }
 function readContainerMountinfo(containerId, options) {
-  const result = (0, import_node_child_process25.spawnSync)("docker", ["exec", containerId, "cat", "/proc/self/mountinfo"], {
+  const result = (0, import_node_child_process26.spawnSync)("docker", ["exec", containerId, "cat", "/proc/self/mountinfo"], {
     encoding: "utf-8",
     timeout: options.timeoutMs ?? 5e3,
     stdio: ["ignore", "pipe", "pipe"],
@@ -12373,8 +13364,9 @@ function recoveryPath(repoPath) {
   if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(repoPath)) return repoPath;
   return `'${repoPath.replaceAll("'", "'\\''")}'`;
 }
-function reliabilityRecovery(reason2, repoPath) {
+function reliabilityRecovery(reason2, repoPath, variant) {
   const checkout = recoveryPath(repoPath);
+  const variantOption = variant && variant !== "default" ? ` --variant ${variant}` : "";
   switch (reason2) {
     case "stop-incomplete":
     case "operation-unknown":
@@ -12382,12 +13374,12 @@ function reliabilityRecovery(reason2, repoPath) {
     case "start-refused":
       return [
         `Run: devrouter doctor --repo ${checkout} to read the refused fixed host-port claim and its holder`,
-        `Stop the holding workspace or change this repository's own published binding, then run: devrouter ensure ${checkout}`
+        `Stop the holding workspace or change this repository's own published binding, then run: devrouter ensure ${checkout}${variantOption}`
       ];
     case "unadmittable":
       return [
         `Run: devrouter stop ${checkout}`,
-        `Lower the requested capacity in .devrouter.yml, then run: devrouter ensure ${checkout}`
+        `Lower the requested capacity in .devrouter.yml, then run: devrouter ensure ${checkout}${variantOption}`
       ];
     case "capacity-parked":
       return [
@@ -12396,7 +13388,9 @@ function reliabilityRecovery(reason2, repoPath) {
         `'devrouter ensure' refuses while the journal stays parked; release the intent instead with: devrouter stop ${checkout}`
       ];
     case "capacity-waiting":
-      return [`Run: devrouter ensure ${checkout} (still queued until capacity frees up)`];
+      return [
+        `Run: devrouter ensure ${checkout}${variantOption} (still queued until capacity frees up)`
+      ];
     default:
       return [];
   }
@@ -12437,7 +13431,12 @@ function readReliabilityStatus(options) {
       correctiveActionsTaken: record5.state.incident.correctiveActionsTaken,
       actionLimit: record5.state.incident.actionLimit
     } : null,
-    ...reason2 ? { attention: { reason: reason2, recovery: reliabilityRecovery(reason2, options.repoPath) } } : {}
+    ...reason2 ? {
+      attention: {
+        reason: reason2,
+        recovery: reliabilityRecovery(reason2, options.repoPath, options.variant)
+      }
+    } : {}
   };
 }
 var EMPTY_RESOURCES = {
@@ -12762,6 +13761,10 @@ function collectManagedRuntimeStatus(options) {
   }
   const drift = [];
   if (stateReadFailed) drift.push("managed runtime state could not be read");
+  if (state && options.variant !== void 0 && (state.variant ?? "default") !== options.variant)
+    drift.push("active runtime variant differs from the selected variant");
+  if (state?.variant && state.variant !== "default" && !managedRuntime.variants?.includes(state.variant))
+    drift.push("active runtime variant is no longer declared");
   if (state?.status === "degraded") drift.push("the last managed transition is degraded");
   if (state) {
     const desiredState = {
@@ -12843,6 +13846,7 @@ function collectManagedRuntimeStatus(options) {
   };
   const reliability = readReliabilityStatus({
     repoPath: options.repoPath,
+    variant: state?.variant,
     ...options.workspace !== void 0 ? { workspace: options.workspace } : {}
   });
   return {
@@ -12850,7 +13854,7 @@ function collectManagedRuntimeStatus(options) {
     status,
     profile: options.profile,
     ...reliability ? { reliability } : {},
-    ...state?.profile ? { activeProfile: state.profile } : {},
+    ...state?.profile ? { activeProfile: state.profile, activeVariant: state.variant ?? "default" } : {},
     ...options.workspace !== void 0 ? { workspace: options.workspace } : {},
     ...state?.devpodId ? { devpodId: state.devpodId } : {},
     ...inspection.composeProject ? { composeProject: inspection.composeProject } : {},
@@ -12874,7 +13878,7 @@ function collectManagedRuntimeStatus(options) {
 }
 
 // src/core/network-inventory.ts
-var import_node_child_process26 = require("child_process");
+var import_node_child_process27 = require("child_process");
 var NetworkInventoryError = class extends Error {
 };
 var MAX_IDS = 4096;
@@ -12886,7 +13890,7 @@ function readDocker(endpoint, args, timeoutMs) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process26.spawnSync)("docker", ["--host", endpoint, ...args], {
+  const result = (0, import_node_child_process27.spawnSync)("docker", ["--host", endpoint, ...args], {
     env,
     encoding: "utf-8",
     timeout: timeoutMs,
@@ -13050,7 +14054,7 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
 }
 
 // src/core/network-routes.ts
-var import_node_child_process27 = require("child_process");
+var import_node_child_process28 = require("child_process");
 var import_node_net3 = require("net");
 
 // src/core/network-local-daemon.ts
@@ -13119,7 +14123,7 @@ function parseLinuxNetworkRoutes(output) {
 function collectNetworkRoutes(options) {
   if ((options.platform ?? process.platform) !== "linux" || !hasLocalDockerNetworkNamespace(options.endpoint))
     return { status: "unknown", routes: [] };
-  const result = (0, import_node_child_process27.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
+  const result = (0, import_node_child_process28.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
     encoding: "utf8",
     timeout: 5e3,
     maxBuffer: 1024 * 1024
@@ -13155,10 +14159,10 @@ function inspectLegacyNetworkCapacity(input) {
 }
 
 // src/core/network-managed.ts
-var import_node_crypto21 = require("crypto");
+var import_node_crypto22 = require("crypto");
 
 // src/core/network-compose.ts
-var import_node_crypto19 = require("crypto");
+var import_node_crypto20 = require("crypto");
 var SAFE_ENDPOINT_UPPER_BOUND_SEMANTICS = "full-lifecycle-demand";
 function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -13964,12 +14968,12 @@ function stableValue(value) {
 }
 function fingerprintComposeNetworkModel(input) {
   const projection = normalizedFingerprintProjection(input);
-  return (0, import_node_crypto19.createHash)("sha256").update(stableValue(projection), "utf8").digest("hex");
+  return (0, import_node_crypto20.createHash)("sha256").update(stableValue(projection), "utf8").digest("hex");
 }
 
 // src/core/network-compose-files.ts
-var import_node_child_process28 = require("child_process");
-var import_node_crypto20 = require("crypto");
+var import_node_child_process29 = require("child_process");
+var import_node_crypto21 = require("crypto");
 var import_node_fs34 = __toESM(require("fs"));
 var import_node_path39 = __toESM(require("path"));
 var import_yaml4 = __toESM(require("yaml"));
@@ -14005,7 +15009,7 @@ function inspectNetworkComposeFiles(input) {
   const env = managedComposeEnvironment(input.workspace);
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process28.spawnSync)(
+  const result = (0, import_node_child_process29.spawnSync)(
     "docker",
     [
       "--host",
@@ -14040,7 +15044,7 @@ function prepareNetworkComposeFiles(plan, subnet) {
   const overlay = deriveComposeNetworkOverlay(subnet);
   if (overlay.status !== "ready" || !overlay.overlay) throw new Error("Network subnet is invalid.");
   const overlayPath = import_node_path39.default.join(plan.composeDirectory, OVERLAY);
-  const ignored = (0, import_node_child_process28.spawnSync)("git", [
+  const ignored = (0, import_node_child_process29.spawnSync)("git", [
     "-C",
     plan.composeDirectory,
     "check-ignore",
@@ -14070,7 +15074,7 @@ ${JSON.stringify(extended.config, null, 2)}
     ...plan,
     contents,
     composeFiles: [...plan.composeFiles, overlayPath],
-    effectiveConfigSha256: (0, import_node_crypto20.createHash)("sha256").update(contents).digest("hex")
+    effectiveConfigSha256: (0, import_node_crypto21.createHash)("sha256").update(contents).digest("hex")
   };
   return {
     plan: result,
@@ -14082,7 +15086,7 @@ ${JSON.stringify(extended.config, null, 2)}
 }
 
 // src/core/network-connected-route.ts
-var import_node_child_process29 = require("child_process");
+var import_node_child_process30 = require("child_process");
 function bounds(cidr) {
   const canonical = parseIPv4Cidr(cidr);
   if (!canonical) throw new Error("Invalid connected route.");
@@ -14107,7 +15111,7 @@ function inspectClaimedBridge(claim2, networkId) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process29.spawnSync)(
+  const result = (0, import_node_child_process30.spawnSync)(
     "docker",
     [
       "--host",
@@ -14134,7 +15138,7 @@ function inspectClaimedBridge(claim2, networkId) {
     const [first, last] = bounds(claim2.subnet);
     const [address] = bounds(gateway);
     if (address <= first || address >= last) throw new Error();
-    const interfaces = (0, import_node_child_process29.spawnSync)("ip", ["-j", "-d", "-4", "address", "show", "dev", bridge], {
+    const interfaces = (0, import_node_child_process30.spawnSync)("ip", ["-j", "-d", "-4", "address", "show", "dev", bridge], {
       encoding: "utf8",
       timeout: 5e3,
       maxBuffer: 65536
@@ -14388,7 +15392,7 @@ function createManagedNetworkSession(input) {
           "Insufficient endpoint headroom; request an allowed larger network before first allocation."
         );
       const authority = readNetworkOperationAuthority(identity2);
-      const fingerprint = (0, import_node_crypto21.createHash)("sha256").update(input.plan().sourceConfigSha256).update(fingerprintComposeNetworkModel(model)).digest("hex");
+      const fingerprint = (0, import_node_crypto22.createHash)("sha256").update(input.plan().sourceConfigSha256).update(fingerprintComposeNetworkModel(model)).digest("hex");
       if (!saved) {
         if (policy.status !== "valid")
           throw new Error("New network allocation requires valid machine policy.");
@@ -14890,7 +15894,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
         target
       });
       if (target.kind === "linked") {
-        const workspaceEnv = (0, import_node_child_process30.spawnSync)(
+        const workspaceEnv = (0, import_node_child_process31.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "WORKSPACE"],
           { encoding: "utf-8", ...networkDockerOptions() }
@@ -14900,7 +15904,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
             `Workspace app container must expose WORKSPACE='${target.workspace}' (got '${workspaceEnv.stdout.trim() || "(empty)"}').`
           );
         }
-        const devrouterWorkspaceEnv = (0, import_node_child_process30.spawnSync)(
+        const devrouterWorkspaceEnv = (0, import_node_child_process31.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "DEVROUTER_WORKSPACE"],
           { encoding: "utf-8", ...networkDockerOptions() }
@@ -14911,7 +15915,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
           );
         }
       }
-      const gitCheck = (0, import_node_child_process30.spawnSync)(
+      const gitCheck = (0, import_node_child_process31.spawnSync)(
         "docker",
         [
           "exec",
@@ -15073,6 +16077,9 @@ function assertRepairBaseline(options) {
   };
   const reasons = [];
   if (state.profile !== profile) reasons.push("profile");
+  if ((state.variant ?? "default") !== (options.variant ?? "default")) reasons.push("variant");
+  if (state.hostPortDeclarationsSha256 !== managedHostPortDeclarationsIdentity(config.managedRuntime?.devcontainer.hostPorts ?? {}))
+    reasons.push("host-ports");
   if (state.sourceConfigSha256 !== plan.sourceConfigSha256) reasons.push("source-config");
   if (state.effectiveConfigSha256 !== plan.effectiveConfigSha256) reasons.push("effective-config");
   for (const resource of ["apps", "services", "processes"]) {
@@ -15191,7 +16198,7 @@ function isPrimaryCheckout(repoPath) {
 }
 function openUrls(urls) {
   for (const url of urls) {
-    const opened = (0, import_node_child_process30.spawnSync)("open", [url], { encoding: "utf-8" });
+    const opened = (0, import_node_child_process31.spawnSync)("open", [url], { encoding: "utf-8" });
     if (opened.status !== 0) {
       process.stderr.write(`Warning: could not open '${url}'.
 `);
@@ -15262,6 +16269,12 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         target.kind === "primary" ? "" : target.workspace,
         options.profile ?? (options.repair ? previousManagedState?.profile : void 0)
       );
+      const variant = resolveRuntimeVariant(
+        runtime.config,
+        options.variant ?? (options.repair ? previousManagedState?.variant : void 0)
+      );
+      if (variant !== "default" && managedPostStart.kind !== "runtime")
+        throw new Error("Runtime variants require a managed runtime post-start adapter.");
       const managedRuntime = runtime.config.managedRuntime;
       if (options.repair && !managedRuntime)
         throw new Error("Repair requires managedRuntime configuration.");
@@ -15337,6 +16350,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
             repoPath,
             ...target.kind === "linked" ? { workspace: target.workspace } : {},
             profile: runtime.profile,
+            variant,
             // A refusal precedes the provider start, so the exact id may not
             // be known yet on a primary checkout.
             devpodId: devpodId ?? "(absent)",
@@ -15366,6 +16380,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           plan: managedPlan,
           config: runtime.config,
           profile: runtime.profile,
+          variant,
           processes: desiredProcesses,
           routes: previousRoutes,
           workspace: managedWorkspaceEnv
@@ -15474,7 +16489,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
               transitionPhase = "service-start";
               reportLifecycleProgress("service-start");
               claimLifecycleEffect();
-              const result = (0, import_node_child_process30.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
+              const result = (0, import_node_child_process31.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
                 ...networkDockerOptions(),
                 encoding: "utf-8",
                 timeout: DEFAULT_READINESS_TIMEOUT_MS,
@@ -15584,6 +16599,10 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
                 devpodId: captureId,
                 composeProject: captureProject,
                 profile: runtime.profile,
+                variant,
+                hostPortDeclarationsSha256: managedHostPortDeclarationsIdentity(
+                  managedRuntime?.devcontainer.hostPorts ?? {}
+                ),
                 desired: {
                   apps: apps.map((app) => app.name).sort(),
                   services: [...capturePlan.desiredProfileServices].sort(),
@@ -15630,6 +16649,10 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
             devpodId,
             composeProject: managedComposeProject,
             profile: runtime.profile,
+            variant,
+            hostPortDeclarationsSha256: managedHostPortDeclarationsIdentity(
+              managedRuntime?.devcontainer.hostPorts ?? {}
+            ),
             desired: {
               apps: apps.map((app) => app.name).sort(),
               services: [...managedPlan.desiredProfileServices].sort(),
@@ -15653,7 +16676,17 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         container,
         quiet: options.quiet,
         profile: runtime.profile,
-        ...managedPlan ? { processes: desiredProcesses } : {}
+        variant,
+        ...managedPlan ? {
+          processes: desiredProcesses,
+          hostPorts: resolveManagedHostPorts({
+            repoPath,
+            declarations: managedRuntime?.devcontainer.hostPorts ?? {},
+            selectedServices: managedPlan.desiredServices,
+            composeProject: managedComposeProject,
+            composeFiles: managedPlan.composeFiles
+          })
+        } : {}
       });
       if (managedPlan && managedComposeProject) {
         const processRegistry = runtime.config.managedRuntime?.processes ?? [];
@@ -15746,7 +16779,8 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           plan: managedPostStart,
           container: recoveredContainer,
           quiet: options.quiet,
-          profile: runtime.profile
+          profile: runtime.profile,
+          variant
         });
         recreated = true;
         claimLifecycleEffect();
@@ -15778,6 +16812,10 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           devpodId,
           composeProject: managedComposeProject,
           profile: runtime.profile,
+          variant,
+          hostPortDeclarationsSha256: managedHostPortDeclarationsIdentity(
+            managedRuntime?.devcontainer.hostPorts ?? {}
+          ),
           desired: {
             apps: apps.map((app) => app.name).sort(),
             services: [...managedPlan.desiredProfileServices].sort(),
@@ -15809,6 +16847,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         workspace: target.workspace,
         config: runtime.config,
         profile: runtime.profile,
+        variant,
         resolvedProfile: runtime.resolvedProfile,
         ...options.repair ? { candidateState } : {}
       }) : void 0;
@@ -15826,6 +16865,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         repoPath,
         workspace: target.workspace,
         profile: runtime.profile,
+        variant,
         devpodId,
         urls,
         recreated,
@@ -16018,13 +17058,32 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
             throw new Error("Managed post-start plan disappeared during rollback.");
           }
           if (previousProcesses.length > 0 && previousManagedState?.status !== "degraded") {
+            if (previousManagedState?.hostPortDeclarationsSha256 !== managedHostPortDeclarationsIdentity(
+              managedRuntimeConfig?.managedRuntime?.devcontainer.hostPorts ?? {}
+            )) {
+              throw new Error(
+                "Host-port declarations changed; restore the retained declarations before repair."
+              );
+            }
             claimLifecycleEffect();
             runManagedPostStart({
               plan: managedPostStartPlan,
               container: managedContainer,
               quiet: options.quiet,
               profile: previousManagedState?.profile ?? "full",
-              processes: previousProcesses
+              variant: previousManagedState?.variant ?? "default",
+              processes: previousProcesses,
+              hostPorts: resolveManagedHostPorts({
+                repoPath,
+                declarations: managedRuntimeConfig?.managedRuntime?.devcontainer.hostPorts ?? {},
+                selectedServices: [
+                  managedPlan.primaryService,
+                  ...managedPlan.baseServices,
+                  ...previousServices
+                ],
+                composeProject: managedComposeProject,
+                composeFiles: managedPlan.composeFiles
+              })
             });
           }
           for (const process2 of managedProcessRegistry) {
@@ -16174,7 +17233,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     ensureNetworkLocked,
     () => network?.endpoint
   );
+  preflightRuntimeVariant(repoPath, options);
   return withLifecycleOperationLock(repoPath, async () => {
+    preflightRuntimeVariant(repoPath, options);
     const preparationConfig = loadRepoConfig(repoPath);
     if (!options.repair)
       recoverUnattachedNetworkReservation(repoPath, Boolean(preparationConfig.managedRuntime));
@@ -16215,7 +17276,8 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       linked ? workspace : "",
       requestedOptions.profile
     ).profile;
-    if (desiredProfile !== retained.profile) {
+    const desiredVariant = resolveRuntimeVariant(preparationConfig, requestedOptions.variant);
+    if (desiredProfile !== retained.profile && desiredVariant === (retained.variant ?? "default")) {
       const target = resolveRepairTarget(repoPath, linked);
       const baseline = loadRuntimeConfig(repoPath, linked ? workspace : "", retained.profile);
       const plan = inspectManagedDevcontainerConfig({
@@ -16233,6 +17295,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         plan,
         config: baseline.config,
         profile: baseline.profile,
+        variant: retained.variant ?? "default",
         processes: desiredManagedProcesses(
           baseline.config.managedRuntime,
           baseline.resolvedProfile
@@ -16244,7 +17307,13 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       claimLifecycleEffect();
       return ensureLocked();
     }
-    options = { ...requestedOptions, repair: true, profile: retained.profile, open: false };
+    options = {
+      ...requestedOptions,
+      repair: true,
+      profile: retained.profile,
+      variant: retained.variant ?? "default",
+      open: false
+    };
     let repaired;
     try {
       repaired = await repairLocked();
@@ -16252,7 +17321,8 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       options = requestedOptions;
     }
     claimLifecycleEffect();
-    if (desiredProfile !== repaired.profile) return ensureLocked();
+    if (desiredProfile !== repaired.profile || desiredVariant !== (repaired.variant ?? "default"))
+      return ensureLocked();
     if (options.open) openUrls(repaired.urls);
     return repaired;
   });
@@ -16338,6 +17408,33 @@ function reconcileDrained(record5) {
     record5.worker = null;
   }
 }
+function preflightRuntimeVariant(repoPath, options) {
+  if (options.variant === void 0 && !options.repair) return "default";
+  const workspace = isLinkedWorktree(repoPath) ? readPersistedWorkspace(repoPath) : void 0;
+  const retained = options.repair ? readManagedRuntimeState(repoPath, workspace) : void 0;
+  const variant = resolveRuntimeVariant(
+    loadRepoConfig(repoPath),
+    options.variant ?? retained?.variant
+  );
+  if (options.repair && variant !== (retained?.variant ?? "default"))
+    throw new Error("Repair requires the retained runtime variant.");
+  if (variant !== "default") {
+    if (resolveManagedPostStartPlan(repoPath).kind !== "runtime")
+      throw new Error("Runtime variants require a managed runtime post-start adapter.");
+    const previous = readReliabilityOperation({
+      repoPath,
+      workspace: workspace ?? null,
+      provider: resolveWorkspaceRuntimeOrDefault(repoPath)
+    });
+    if (capacityPolicyTargets(repoPath) || previous?.state.executionPolicy === "capacity-managed")
+      throw new Error("Non-default runtime variants require manual lifecycle admission.");
+  }
+  return variant;
+}
+function capacityPolicyTargets(repoPath) {
+  const policy = readCapacityPolicy(import_node_path41.default.join(DEVROUTER_HOME, "controller"));
+  return policy?.admissions === "enabled" && policy.enrollments.some((entry) => entry.repoPath === repoPath);
+}
 function clearActiveLifecycleStartupWitness() {
   const request = activeWorker;
   if (!request || request.kind === "stop") return;
@@ -16395,12 +17492,46 @@ async function executeLifecycleWorker(request, operation) {
             request.repoPath,
             () => proveInitialManagedDevsyAbsence(request.repoPath)
           );
+        const markStopWorkStarted = () => updateReliabilityOperation(request.identity, (record5) => {
+          if (!matchesFence(record5, request.fence))
+            throw new Error("Lifecycle intent changed before stop work began.");
+          record5.stopWorkStarted = true;
+        });
+        if (request.options.repair && (!retained?.stopBaseline || request.options.delete || request.identity.provider !== "devsy"))
+          throw new Error("Stop recovery requires a retained Devsy baseline and preserves data.");
         if (retained?.stopBaseline) {
-          stopBaselineState = retained;
-          withMutationLock(
+          stopBaselineState = withMutationLock(
             "Verify retained stop",
             request.repoPath,
-            () => proveManagedStop(retained)
+            () => {
+              let needsRecovery = false;
+              if (request.options.repair) {
+                try {
+                  proveManagedStop(retained);
+                } catch {
+                  needsRecovery = true;
+                }
+              }
+              const candidate = needsRecovery ? recoverManagedStopBaseline(
+                retained,
+                () => {
+                  const runtime = loadRuntimeConfig(
+                    request.repoPath,
+                    request.identity.workspace ?? "",
+                    retained.profile
+                  );
+                  return inspectManagedDevcontainerConfig({
+                    repoPath: request.repoPath,
+                    config: runtime.config,
+                    profile: runtime.resolvedProfile,
+                    linked: isLinkedWorktree(request.repoPath)
+                  });
+                },
+                markStopWorkStarted
+              ) : retained;
+              proveManagedStop(candidate);
+              return candidate;
+            }
           );
         } else {
           const containers = inspectWorkspaceContainers();
@@ -16418,11 +17549,7 @@ async function executeLifecycleWorker(request, operation) {
           ];
           for (const project of stopProjects) inspectManagedStopContainers(project);
         }
-        updateReliabilityOperation(request.identity, (record5) => {
-          if (!matchesFence(record5, request.fence))
-            throw new Error("Lifecycle intent changed before stop work began.");
-          record5.stopWorkStarted = true;
-        });
+        markStopWorkStarted();
       } else {
         updateReliabilityOperation(request.identity, (record5) => {
           stepRecord(record5, {
@@ -16627,7 +17754,7 @@ async function devsyExecOutcome(repoPath, command, retainedProof) {
         const launch = () => {
           if (retainedProof) revalidateDevsyExecProof(repoPath, retainedProof);
           claimLifecycleEffect();
-          return (0, import_node_child_process31.spawn)("devsy", args, { stdio: "inherit" });
+          return (0, import_node_child_process32.spawn)("devsy", args, { stdio: "inherit" });
         };
         child = retainedProof ? withMutationLock("Execute retained workspace", repoPath, launch) : launch();
       } catch (error) {
@@ -16675,7 +17802,7 @@ function ensureGuidance2(repoPath) {
   return `Run 'devrouter ensure ${repoPath}' first.`;
 }
 function assertRunningDevpod(devpodId, repoPath) {
-  const result = (0, import_node_child_process32.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
+  const result = (0, import_node_child_process33.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -16722,7 +17849,7 @@ async function devpodExecOutcome(repoPath, command) {
     }
     assertRunningDevpod(devpod.id, repoPath);
     const workspaceDirectory = resolveWorkspaceDirectory(repoPath);
-    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto23.randomUUID)()}__:`;
+    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto24.randomUUID)()}__:`;
     const statusMarkerBytes = Buffer.from(statusMarker, "ascii");
     const literalCommand = command.map(quotePosixArg).join(" ");
     const wrappedCommand = `${literalCommand}; __devrouter_status=$?; printf '${statusMarker}%s\\n' "$__devrouter_status" >&2; exit 0`;
@@ -16854,7 +17981,7 @@ async function devpodExecOutcome(repoPath, command) {
       let child;
       try {
         claimLifecycleEffect();
-        child = (0, import_node_child_process32.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
+        child = (0, import_node_child_process33.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
       } catch (error) {
         settled = true;
         reject(
@@ -16911,7 +18038,7 @@ async function devpodExecOutcome(repoPath, command) {
 }
 
 // src/core/workspace-lifecycle.ts
-var import_node_child_process33 = require("child_process");
+var import_node_child_process34 = require("child_process");
 var import_node_fs37 = __toESM(require("fs"));
 var import_node_path42 = __toESM(require("path"));