@devrouter/cli 0.6.1 → 0.6.3

package/dist/devrouter-lifecycle-worker.js

@@ -23,8 +23,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/core/devpod-exec.ts
-var import_node_child_process33 = require("child_process");
-var import_node_crypto25 = require("crypto");
+var import_node_child_process34 = require("child_process");
+var import_node_crypto26 = require("crypto");
 
 // src/core/devpod-environment.ts
 var import_node_child_process3 = require("child_process");
@@ -497,8 +497,8 @@ function wsFromBranch(branch) {
 function workspaceIdentityFallback(source, attempt) {
   const readablePrefix = (wsFromBranch(source) ?? "workspace").slice(0, WORKSPACE_IDENTITY_PREFIX_LENGTH).replace(/-+$/, "");
   const prefix = readablePrefix || "workspace";
-  const hash = (0, import_node_crypto3.createHash)("sha256").update(WORKSPACE_IDENTITY_HASH_DOMAIN, "utf-8").update("\0", "utf-8").update(source, "utf-8").update("\0", "utf-8").update(String(attempt), "utf-8").digest("hex").slice(0, WORKSPACE_IDENTITY_HASH_LENGTH);
-  return `${prefix}-${hash}`;
+  const hash2 = (0, import_node_crypto3.createHash)("sha256").update(WORKSPACE_IDENTITY_HASH_DOMAIN, "utf-8").update("\0", "utf-8").update(source, "utf-8").update("\0", "utf-8").update(String(attempt), "utf-8").digest("hex").slice(0, WORKSPACE_IDENTITY_HASH_LENGTH);
+  return `${prefix}-${hash2}`;
 }
 function workspaceIdentityCandidates(source) {
   const candidates = [];
@@ -1982,7 +1982,7 @@ function selectDevpodWorkspace(workspaces, repoPath) {
 }
 
 // src/core/devsy-exec.ts
-var import_node_child_process32 = require("child_process");
+var import_node_child_process33 = require("child_process");
 
 // src/core/devsy-exec-proof.ts
 var import_node_fs7 = __toESM(require("fs"));
@@ -2815,7 +2815,7 @@ function assertManagedContainerConfigUnchanged(options) {
         if (rendered.status !== 0 || rendered.error || !rendered.stdout?.trim()) {
           throw new Error("Compose configuration rendering failed.");
         }
-        const hash = (input2) => (0, import_node_child_process10.spawnSync)(
+        const hash2 = (input2) => (0, import_node_child_process10.spawnSync)(
           "docker",
           [...composeArgs, "-f", "-", "config", "--no-interpolate", "--hash", service],
           {
@@ -2829,7 +2829,7 @@ function assertManagedContainerConfigUnchanged(options) {
           }
         );
         const input = rendered.stdout.replaceAll("$$", "$");
-        const result2 = hash(input);
+        const result2 = hash2(input);
         const match2 = typeof result2.stdout === "string" ? /^(\S+)\s+([a-f0-9]{64})$/.exec(result2.stdout.trim()) : null;
         if (result2.status !== 0 || result2.error || !match2 || match2[1] !== service || match2[2] === expectedHash)
           return result2;
@@ -2844,7 +2844,7 @@ function assertManagedContainerConfigUnchanged(options) {
           serviceConfig,
           env
         });
-        const resolved = hash(JSON.stringify(model));
+        const resolved = hash2(JSON.stringify(model));
         revalidate();
         return resolved;
       } catch {
@@ -5589,7 +5589,7 @@ function retain(session, previous) {
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.6.1" : "0.0.0-dev";
+  return true ? "0.6.3" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -5737,6 +5737,7 @@ function validate2(record5, identity2) {
     "state",
     "worker",
     "stopWorkStarted",
+    "freshBootstrap",
     "effectSequence",
     "outcome",
     "result",
@@ -5754,6 +5755,47 @@ function validate2(record5, identity2) {
   ]);
   validateConsumerProtection(record5);
   validateIdleProtection(record5);
+  if (record5.freshBootstrap !== void 0) {
+    const attempt = record5.freshBootstrap;
+    keys(attempt, [
+      "version",
+      "operationId",
+      "workerId",
+      "runtimeGeneration",
+      "sourceSha256",
+      "providerId",
+      "providerContext",
+      "definitionSha256",
+      "endpoint",
+      "daemonId",
+      "previousVolumeNameDigests",
+      "stage",
+      "resources"
+    ]);
+    const digest = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+    const exact = (value) => typeof value === "string" && /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(value);
+    if (attempt.version !== 1 || !isReliabilityId(attempt.operationId) || !isReliabilityId(attempt.workerId) || !isReliabilityCounter(attempt.runtimeGeneration) || !digest(attempt.sourceSha256) || !digest(attempt.definitionSha256) || !exact(attempt.providerId) || !exact(attempt.providerContext) || typeof attempt.endpoint !== "string" || !attempt.endpoint.startsWith("unix:///") || attempt.endpoint.includes("\0") || typeof attempt.daemonId !== "string" || attempt.daemonId.length === 0 || attempt.daemonId.length > 256 || !["claimed", "provisioned", "initializing", "initialized", "ready", "failed"].includes(
+      attempt.stage
+    ) || !Array.isArray(attempt.previousVolumeNameDigests) || attempt.previousVolumeNameDigests.length > 4096 || !attempt.previousVolumeNameDigests.every(digest) || new Set(attempt.previousVolumeNameDigests).size !== attempt.previousVolumeNameDigests.length)
+      throw new Error("Invalid durable fresh-bootstrap attempt.");
+    if (attempt.resources !== void 0) {
+      const resources = attempt.resources;
+      keys(resources, ["primaryId", "project", "dataVolumes"]);
+      if (!digest(resources.primaryId) || !exact(resources.project) || !Array.isArray(resources.dataVolumes) || resources.dataVolumes.length === 0 || resources.dataVolumes.length > 64)
+        throw new Error("Invalid fresh-bootstrap resource binding.");
+      const names = /* @__PURE__ */ new Set();
+      const bindings = /* @__PURE__ */ new Set();
+      for (const volume of resources.dataVolumes) {
+        keys(volume, ["key", "name", "createdAt", "mountpoint"]);
+        if (!exact(volume.key) || typeof volume.name !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,255}$/.test(volume.name) || names.has(volume.name) || bindings.has(volume.key) || typeof volume.createdAt !== "string" || !Number.isFinite(Date.parse(volume.createdAt)) || typeof volume.mountpoint !== "string" || !import_node_path21.default.isAbsolute(volume.mountpoint) || volume.mountpoint.includes("\0"))
+          throw new Error("Invalid fresh-bootstrap data-volume binding.");
+        names.add(volume.name);
+        bindings.add(volume.key);
+      }
+    } else if (["provisioned", "initializing", "initialized", "ready"].includes(attempt.stage)) {
+      throw new Error("Fresh-bootstrap phase requires proven resource bindings.");
+    }
+  }
   if (record5.writtenByVersion !== void 0 && compareCliVersions(record5.writtenByVersion, installedCliVersion()) > 0) {
     throw new Error(
       `Reliability record was last written by devrouter ${record5.writtenByVersion}, which is newer than the installed ${installedCliVersion()}; upgrade devrouter (devrouter upgrade) before running lifecycle commands.`
@@ -6233,10 +6275,30 @@ function updateReliabilityOperation(identity2, operation) {
     const previousEnrollment = record5.enrollment && { ...record5.enrollment };
     const previousProtection = structuredClone(record5.consumerProtection);
     const previousIdleProtection = structuredClone(record5.idleProtection);
+    const previousBootstrap = structuredClone(record5.freshBootstrap);
     const result = operation(record5);
     if (result && typeof result.then === "function") {
       throw new Error("Reliability record updates must be synchronous.");
     }
+    if (previousBootstrap && !(0, import_node_util4.isDeepStrictEqual)(previousBootstrap, record5.freshBootstrap)) {
+      const current = record5.freshBootstrap;
+      const {
+        stage: previousStage,
+        resources: previousResources,
+        ...previousIdentity
+      } = previousBootstrap;
+      const { stage, resources, ...currentIdentity } = current ?? {};
+      const next = {
+        claimed: ["provisioned", "failed"],
+        provisioned: ["initializing", "failed"],
+        initializing: ["initialized", "failed"],
+        initialized: ["ready"],
+        ready: [],
+        failed: []
+      };
+      if (!current || !(0, import_node_util4.isDeepStrictEqual)(previousIdentity, currentIdentity) || !next[previousStage].includes(stage ?? "") || previousResources && !(0, import_node_util4.isDeepStrictEqual)(previousResources, resources))
+        throw new Error("Durable fresh-bootstrap attempt cannot be cleared, replaced or rearmed.");
+    }
     if (record5.version < previousVersion || previousEnrollment && !(0, import_node_util4.isDeepStrictEqual)(record5.enrollment, previousEnrollment))
       throw new Error("Durable capacity enrollment cannot be downgraded or replaced.");
     if (!(0, import_node_util4.isDeepStrictEqual)(record5.consumerProtection, previousProtection))
@@ -6702,7 +6764,7 @@ function parseApp(value, index) {
     if (objectValue.readiness !== void 0) {
       throw new Error(`${pathLabel}.readiness is only supported for HTTP proxy apps.`);
     }
-    const docker = parseDockerConfig(objectValue.docker, `${pathLabel}.docker`);
+    const docker2 = parseDockerConfig(objectValue.docker, `${pathLabel}.docker`);
     if (protocol === "http") {
       return {
         name,
@@ -6710,7 +6772,7 @@ function parseApp(value, index) {
         protocol: "http",
         runtime: "docker",
         dependencies,
-        docker
+        docker: docker2
       };
     }
     if (protocol === "tcp") {
@@ -6727,7 +6789,7 @@ function parseApp(value, index) {
         tcpProtocol,
         runtime: "docker",
         dependencies,
-        docker
+        docker: docker2
       };
     }
   }
@@ -6913,7 +6975,7 @@ function parseManagedRuntime(value, configPath) {
   );
   ensureAllowedKeys(
     devcontainer,
-    ["baseServices", "profileServices", "prepareCommand", "hostPorts"],
+    ["baseServices", "profileServices", "prepareCommand", "hostPorts", "freshBootstrap"],
     `${configPath}.managedRuntime.devcontainer`
   );
   const baseServices = parseRequiredUniqueStringArray(
@@ -6928,6 +6990,23 @@ function parseManagedRuntime(value, configPath) {
     devcontainer.prepareCommand,
     `${configPath}.managedRuntime.devcontainer.prepareCommand`
   );
+  let freshBootstrap;
+  if (devcontainer.freshBootstrap !== void 0) {
+    const label = `${configPath}.managedRuntime.devcontainer.freshBootstrap`;
+    const raw = ensureObject(devcontainer.freshBootstrap, label);
+    ensureAllowedKeys(raw, ["command", "dataVolumes", "sharedCaches"], label);
+    const command = parsePrepareCommand(raw.command, `${label}.command`);
+    if (!command) throw new Error(`${label}.command is required.`);
+    const dataVolumes = parseRequiredUniqueStringArray(raw.dataVolumes, `${label}.dataVolumes`);
+    const sharedCaches = raw.sharedCaches === void 0 ? [] : parseRequiredUniqueStringArray(raw.sharedCaches, `${label}.sharedCaches`);
+    if (dataVolumes.length === 0 || dataVolumes.length + sharedCaches.length > 64)
+      throw new Error(`${label} requires data volumes and at most 64 volume bindings.`);
+    if ([...dataVolumes, ...sharedCaches].some(
+      (key) => !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(key)
+    ) || dataVolumes.some((key) => sharedCaches.includes(key)))
+      throw new Error(`${label} requires distinct exact data-volume and shared-cache keys.`);
+    freshBootstrap = { command, dataVolumes, sharedCaches };
+  }
   const baseSet = new Set(baseServices);
   const overlappingServices = profileServices.filter((service) => baseSet.has(service));
   if (overlappingServices.length > 0) {
@@ -6989,7 +7068,8 @@ function parseManagedRuntime(value, configPath) {
       baseServices,
       profileServices,
       ...prepareCommand ? { prepareCommand } : {},
-      ...hostPorts !== void 0 ? { hostPorts } : {}
+      ...hostPorts !== void 0 ? { hostPorts } : {},
+      ...freshBootstrap ? { freshBootstrap } : {}
     },
     processes
   };
@@ -7692,7 +7772,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs19.default.rea
   const config = parseRepoConfigSource(raw, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.6.1" : "0.0.0-dev";
+    const cliVersion = true ? "0.6.3" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver2(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -7844,8 +7924,8 @@ async function createDockerClient() {
   throw new Error(`Unsupported docker host from context: ${host}`);
 }
 async function listContainers(all = true) {
-  const docker = await createDockerClient();
-  return docker.listContainers({ all });
+  const docker2 = await createDockerClient();
+  return docker2.listContainers({ all });
 }
 async function findContainerByName(name) {
   const containers = await listContainers(true);
@@ -7856,13 +7936,13 @@ async function isContainerRunning(name) {
   return container?.State === "running";
 }
 async function ensureNetwork(name) {
-  const docker = await createDockerClient();
+  const docker2 = await createDockerClient();
   try {
-    await docker.getNetwork(name).inspect();
+    await docker2.getNetwork(name).inspect();
     return;
   } catch {
   }
-  await docker.createNetwork({
+  await docker2.createNetwork({
     Name: name,
     Driver: "bridge",
     Attachable: true
@@ -10332,15 +10412,15 @@ function object2(value) {
 function qualifyNetworkProviderDefinition(value, provider) {
   const definition = object2(value);
   const agent = object2(definition.agent);
-  const docker = object2(agent.docker);
-  const env = object2(docker.env);
+  const docker2 = object2(agent.docker);
+  const env = object2(docker2.env);
   const options = object2(definition.options);
   const host = object2(options.DOCKER_HOST);
   const dockerPath = object2(options.DOCKER_PATH);
   const exec = object2(definition.exec);
   const command = provider === "devsy" ? '"${DEVSY}" internal sh -c "${COMMAND}"' : '"${DEVPOD}" helper sh -c "${COMMAND}"';
   const actualCommand = Array.isArray(exec.command) ? exec.command : [exec.command];
-  if (definition.name !== "docker" || ![true, "true"].includes(agent.local) || agent.driver !== void 0 && agent.driver !== "docker" && agent.driver !== "" || docker.path !== "${DOCKER_PATH}" || docker.builder !== "${DOCKER_BUILDER}" || ![false, "false"].includes(docker.install) || (provider === "devsy" ? docker.elevation !== "${DOCKER_ELEVATION}" : docker.elevation !== void 0 && docker.elevation !== "") || env.DOCKER_HOST !== "${DOCKER_HOST}" || Object.keys(env).some((key) => key !== "DOCKER_HOST") || host.global !== true || dockerPath.default !== "docker" || actualCommand.length !== 1 || typeof actualCommand[0] !== "string" || actualCommand[0].trim() !== command || Object.keys(exec).some((key) => key !== "command") || agent.path !== void 0 && agent.path !== "" || agent.downloadURL !== void 0 && agent.downloadURL !== "") {
+  if (definition.name !== "docker" || ![true, "true"].includes(agent.local) || agent.driver !== void 0 && agent.driver !== "docker" && agent.driver !== "" || docker2.path !== "${DOCKER_PATH}" || docker2.builder !== "${DOCKER_BUILDER}" || ![false, "false"].includes(docker2.install) || (provider === "devsy" ? docker2.elevation !== "${DOCKER_ELEVATION}" : docker2.elevation !== void 0 && docker2.elevation !== "") || env.DOCKER_HOST !== "${DOCKER_HOST}" || Object.keys(env).some((key) => key !== "DOCKER_HOST") || host.global !== true || dockerPath.default !== "docker" || actualCommand.length !== 1 || typeof actualCommand[0] !== "string" || actualCommand[0].trim() !== command || Object.keys(exec).some((key) => key !== "command") || agent.path !== void 0 && agent.path !== "" || agent.downloadURL !== void 0 && agent.downloadURL !== "") {
     throw new Error("Docker provider definition is not qualified for network allocation.");
   }
   return (0, import_node_crypto14.createHash)("sha256").update(JSON.stringify({ name: definition.name, agent, options, exec })).digest("hex");
@@ -10663,16 +10743,20 @@ async function startDevsyWorkspace(options) {
     if (!devsyId && options.recreate) {
       throw new Error("Cannot recreate a Devsy workspace before its exact id is known.");
     }
+    if (options.freshBootstrap && (!devsyId || options.recreate))
+      throw new Error("Fresh bootstrap requires an explicit new provider ID without recreation.");
     if (options.prepareNetwork && !devsyId)
       throw new Error("Network allocation requires an exact provider ID before dispatch.");
     const network = options.prepareNetwork?.(devsyId);
     if (network)
       assertNetworkProviderBinding(network.binding, network.evidence, network.firstAllocation);
+    const fresh = options.freshBootstrap?.prepare(devsyId, network?.binding);
+    const binding = network?.binding ?? fresh?.binding;
     const args = ["workspace", "up", options.repoPath];
     if (devsyId) args.push("--id", devsyId);
     const devcontainerPath = network?.devcontainerPath ?? options.devcontainerPath;
     if (devcontainerPath) args.push("--devcontainer", devcontainerPath);
-    if (network) args.push(...networkProviderStartupArguments(network.binding));
+    if (binding) args.push(...networkProviderStartupArguments(binding));
     args.push("--ide-launch", "skip");
     if (options.workspace) {
       args.push(
@@ -10684,7 +10768,7 @@ async function startDevsyWorkspace(options) {
     }
     args.push("--provider-option", "INACTIVITY_TIMEOUT=");
     if (options.recreate) args.push("--recreate");
-    const env = network ? networkProviderEnvironment(network.binding, process.env) : { ...process.env };
+    const env = binding ? networkProviderEnvironment(binding, process.env) : { ...process.env };
     if (agent.binaryPath) env.DEVSY_AGENT_BINARY = agent.binaryPath;
     else delete env.DEVSY_AGENT_BINARY;
     if (options.workspace) {
@@ -10699,7 +10783,11 @@ async function startDevsyWorkspace(options) {
       delete env.DEVCONTAINER_COMPOSE_OVERLAY;
     }
     network?.beforeDispatch?.();
-    const result = await runDevsyUp(args, env, options.quiet ?? false);
+    const result = await runDevsyUp(
+      fresh ? [...args, "--skip-post-create", "--skip-post-start", "--skip-post-attach"] : args,
+      env,
+      options.quiet ?? false
+    );
     if (result.status !== 0) {
       if (network) {
         network.retainUncertain();
@@ -10730,6 +10818,25 @@ async function startDevsyWorkspace(options) {
           `Devsy did not attach '${options.repoPath}' as '${devsyId}' after startup.`
         );
       }
+      if (fresh) {
+        const exactId = devsyId;
+        await fresh.afterStart(async () => {
+          const resumed = await runDevsyUp(args, env, options.quiet ?? false);
+          if (resumed.status !== 0 || resumed.error)
+            throw new Error(
+              "Preserving source hooks failed after fresh initialization; data was retained."
+            );
+          const current = inspectDevsyWorkspaceOwnership(
+            listDevsyWorkspaces(),
+            exactId,
+            options.repoPath
+          );
+          if (current.status !== "owned")
+            throw new Error(
+              "Fresh-bootstrap provider ownership changed during source-hook replay."
+            );
+        });
+      }
       return devsyId;
     } catch (error) {
       network?.retainUncertain();
@@ -10750,9 +10857,9 @@ var ExecutionOutcomeError = class extends Error {
 };
 
 // src/core/reliability-lifecycle.ts
-var import_node_crypto24 = require("crypto");
-var import_node_path42 = __toESM(require("path"));
-var import_node_util8 = require("util");
+var import_node_crypto25 = require("crypto");
+var import_node_path43 = __toESM(require("path"));
+var import_node_util9 = require("util");
 
 // src/core/capacity-policy.ts
 var import_node_fs27 = __toESM(require("fs"));
@@ -11409,15 +11516,467 @@ function reliabilityAttention(state) {
   return void 0;
 }
 
-// src/core/managed-post-start.ts
-var import_node_child_process20 = require("child_process");
-var import_node_crypto18 = require("crypto");
+// src/core/managed-fresh-bootstrap.ts
+var import_node_child_process19 = require("child_process");
+var import_node_crypto17 = require("crypto");
 var import_node_fs29 = __toESM(require("fs"));
+var import_node_os6 = __toESM(require("os"));
 var import_node_path34 = __toESM(require("path"));
+var import_node_util7 = require("util");
+var import_yaml4 = __toESM(require("yaml"));
+
+// src/core/lifecycle-progress.ts
+var ROLES = {
+  validation: "lifecycle-worker",
+  preparation: "repository-preparation",
+  "fresh-bootstrap": "repository-fresh-bootstrap",
+  provider: "provider-operation",
+  "service-start": "service-reconciliation",
+  "service-stop": "service-reconciliation",
+  "process-start": "repository-process-adapter",
+  "process-stop": "repository-process-adapter",
+  "route-publication": "lifecycle-worker",
+  "route-removal": "lifecycle-worker",
+  readiness: "lifecycle-worker",
+  rollback: "lifecycle-worker",
+  stop: "lifecycle-stop"
+};
+function isLifecycleProgressPhase(value) {
+  return typeof value === "string" && Object.hasOwn(ROLES, value);
+}
+var sender;
+function installLifecycleProgressSender(send) {
+  let active = true;
+  let pending = false;
+  let latest;
+  const report = (phase) => {
+    if (!active || !isLifecycleProgressPhase(phase)) return;
+    if (pending) {
+      latest = phase;
+      return;
+    }
+    pending = true;
+    try {
+      send({ lifecycleProgress: phase }, () => {
+        pending = false;
+        const next = latest;
+        latest = void 0;
+        if (active && next) report(next);
+      });
+    } catch {
+      pending = false;
+      latest = void 0;
+    }
+  };
+  sender = report;
+  return () => {
+    active = false;
+    latest = void 0;
+    if (sender === report) sender = void 0;
+  };
+}
+function reportLifecycleProgress(phase) {
+  sender?.(phase);
+}
+
+// src/core/managed-fresh-bootstrap.ts
+function hash(value) {
+  return (0, import_node_crypto17.createHash)("sha256").update(value).digest("hex");
+}
+function object3(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function qualifiedContext(source) {
+  if (source.userEnvProbe !== void 0 && source.userEnvProbe !== "loginInteractiveShell" || object3(source.remoteEnv) && Object.hasOwn(source.remoteEnv, "PATH") || object3(source.secrets) && Object.keys(source.secrets).length > 0 || object3(source.features) && Object.keys(source.features).length > 0 || source.onCreateCommand || source.updateContentCommand)
+    throw new Error(
+      "Fresh bootstrap requires a qualified default-probe context without PATH overrides, secrets, features or earlier container hooks."
+    );
+  if (source.postStartCommand && !["postStartCommand", "postAttachCommand"].includes(String(source.waitFor)))
+    throw new Error("Fresh bootstrap requires waitFor to include the declared post-start hook.");
+}
+function assertFreshBootstrapRequest(identity2, options) {
+  if (!options.initializeNew) return;
+  if (identity2.provider !== "devsy" || options.repair)
+    throw new Error(
+      "--initialize-new requires a fresh Devsy managed environment without --repair."
+    );
+  if (!loadRepoConfig(identity2.repoPath).managedRuntime?.devcontainer.freshBootstrap)
+    throw new Error("--initialize-new requires managedRuntime.devcontainer.freshBootstrap.");
+  if (readReliabilityOperation(identity2)?.freshBootstrap)
+    throw new Error(
+      "This environment already records an initialization attempt; initialization cannot be replayed. Use preserving recovery or a new disposable checkout."
+    );
+  if (readManagedRuntimeState(identity2.repoPath, identity2.workspace ?? void 0) || selectDevsyWorkspace(listDevsyWorkspaces(), identity2.repoPath))
+    throw new Error("Fresh bootstrap refuses a retained runtime or provider registration.");
+  qualifiedContext(readDevcontainerConfig(identity2.repoPath).source);
+}
+function docker(endpoint, args, cwd, environment = process.env) {
+  const env = { ...environment };
+  delete env.DOCKER_CONTEXT;
+  delete env.DOCKER_HOST;
+  const result = (0, import_node_child_process19.spawnSync)("docker", ["--host", endpoint, ...args], {
+    cwd,
+    env,
+    encoding: "utf8",
+    timeout: 15e3,
+    maxBuffer: 4 * 1024 * 1024
+  });
+  if (result.error || result.status !== 0)
+    throw new Error(
+      "Fresh-bootstrap Docker evidence is unavailable; initialization was not retried."
+    );
+  return result.stdout;
+}
+function sourceIdentity(repoPath, plan) {
+  return hash(
+    JSON.stringify([
+      hash(import_node_fs29.default.readFileSync(import_node_path34.default.join(repoPath, ".devrouter.yml"))),
+      hash(import_node_fs29.default.readFileSync(plan.sourcePath)),
+      plan.effectiveConfigSha256,
+      ...plan.composeFiles.map((file) => [file, hash(import_node_fs29.default.readFileSync(file))])
+    ])
+  );
+}
+function render(endpoint, plan, project, workspace) {
+  const args = [
+    "compose",
+    "--project-name",
+    project,
+    "--project-directory",
+    plan.composeDirectory,
+    ...plan.composeFiles.flatMap((file) => ["-f", file]),
+    "config",
+    "--format",
+    "json",
+    "--no-env-resolution"
+  ];
+  const env = managedComposeEnvironment(workspace);
+  const value = JSON.parse(docker(endpoint, args, plan.composeDirectory, env));
+  if (!object3(value) || !object3(value.services) || value.volumes !== void 0 && !object3(value.volumes))
+    throw new Error("Invalid fresh-bootstrap Compose model.");
+  return value;
+}
+function verifyFreshBootstrapMounts(repoPath, plan, model, declaration, workspace) {
+  const selected = /* @__PURE__ */ new Set();
+  for (const service of plan.desiredServices) {
+    const entry = model.services[service];
+    if (!entry)
+      throw new Error("Fresh-bootstrap selected service is absent from the Compose model.");
+    for (const mount of entry.volumes ?? []) {
+      if (mount.type === "volume") {
+        if (!mount.source || !model.volumes?.[mount.source])
+          throw new Error("Fresh bootstrap requires exact named volume declarations.");
+        selected.add(mount.source);
+      } else if (mount.type === "bind" && !mount.read_only) {
+        const source = import_node_fs29.default.realpathSync(mount.source ?? "");
+        const relative = import_node_path34.default.relative(repoPath, source);
+        const gitMount = workspace && service === plan.primaryService && source === import_node_fs29.default.realpathSync(workspace.gitCommonDir) && mount.target === workspace.gitCommonDir;
+        if (!gitMount && (relative === ".." || relative.startsWith(`..${import_node_path34.default.sep}`) || import_node_path34.default.isAbsolute(relative)))
+          throw new Error(
+            "Fresh bootstrap refuses writable bind mounts outside the checkout and its exact Git common directory."
+          );
+      } else if (!["bind", "tmpfs"].includes(mount.type)) {
+        throw new Error("Fresh bootstrap found an unsupported mount type.");
+      }
+    }
+  }
+  for (const key of [...declaration.dataVolumes, ...declaration.sharedCaches]) {
+    if (!selected.has(key))
+      throw new Error("Fresh-bootstrap volume binding is not mounted by the selected profile.");
+  }
+  for (const key of selected) {
+    const volume = model.volumes?.[key];
+    const cache = declaration.sharedCaches.includes(key);
+    if (!volume || (cache ? volume.external !== true : volume.external === true) || volume.driver && volume.driver !== "local" || volume.driver_opts !== void 0 && (!object3(volume.driver_opts) || Object.keys(volume.driver_opts).length > 0))
+      throw new Error(
+        "Fresh bootstrap requires new local volumes or explicitly declared external shared caches."
+      );
+  }
+}
+function volumeSnapshot(endpoint) {
+  const rows2 = docker(endpoint, ["volume", "ls", "--format", "{{json .Name}}"]).split(/\r?\n/).filter(Boolean).map((line) => JSON.parse(line));
+  if (rows2.length > 4096 || rows2.some(
+    (name) => typeof name !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,255}$/.test(name)
+  ) || new Set(rows2).size !== rows2.length)
+    throw new Error("Fresh-bootstrap volume inventory is incomplete or exceeds its bound.");
+  return rows2.map((name) => hash(name)).sort();
+}
+function assertNoCheckoutContainers(endpoint, repoPath) {
+  const ids2 = docker(endpoint, ["ps", "--all", "--quiet", "--no-trunc"]).split(/\r?\n/).filter(Boolean);
+  if (ids2.length > 4096 || ids2.some((id5) => !/^[a-f0-9]{64}$/.test(id5)) || new Set(ids2).size !== ids2.length)
+    throw new Error("Fresh-bootstrap container inventory is incomplete or exceeds its bound.");
+  for (let offset = 0; offset < ids2.length; offset += 64) {
+    const batch = ids2.slice(offset, offset + 64);
+    const rows2 = docker(endpoint, ["inspect", "--format", SAFE_INSPECT_TEMPLATE, ...batch]).split(/\r?\n/).filter(Boolean).map((line) => JSON.parse(line));
+    if (rows2.length !== batch.length || new Set(rows2.map((row) => row.id)).size !== batch.length)
+      throw new Error("Fresh-bootstrap container absence evidence changed.");
+    for (const row of rows2) {
+      if (!batch.includes(row.id) || !object3(row.labels) || !Array.isArray(row.mounts))
+        throw new Error("Fresh-bootstrap container absence evidence is invalid.");
+      if (sameWorkspacePath(
+        row.labels["com.docker.compose.project.working_dir"] ?? "",
+        import_node_path34.default.join(repoPath, ".devcontainer")
+      ) || row.mounts.some(
+        (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source ?? "", repoPath)
+      ))
+        throw new Error("Fresh bootstrap refuses surviving containers for this checkout.");
+    }
+  }
+}
+function verifyFreshVolume(volume, key, project, prior, sharedCache) {
+  if (!volume || typeof volume.Name !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,255}$/.test(volume.Name) || volume.Driver !== "local" || volume.Scope !== "local" || typeof volume.Mountpoint !== "string" || typeof volume.CreatedAt !== "string" || !import_node_path34.default.isAbsolute(volume.Mountpoint) || !Number.isFinite(Date.parse(volume.CreatedAt)) || volume.Options !== void 0 && volume.Options !== null && !object3(volume.Options) || object3(volume.Options) && Object.keys(volume.Options).length > 0)
+    throw new Error("Fresh-bootstrap volume identity is not qualified local storage.");
+  if (!sharedCache && (prior.includes(hash(volume.Name)) || volume.Labels?.["com.docker.compose.project"] !== project || volume.Labels?.["com.docker.compose.volume"] !== key))
+    throw new Error("Fresh bootstrap refuses retained or foreign data volumes.");
+}
+function proveVolumes(input) {
+  const containers = inspectManagedStopContainers(input.project, input.endpoint);
+  const result = [];
+  const names = /* @__PURE__ */ new Set();
+  const seen = /* @__PURE__ */ new Set();
+  for (const service of input.plan.desiredServices) {
+    const container = containers.find((c) => c.labels["com.docker.compose.service"] === service);
+    if (!container) throw new Error("Fresh-bootstrap volume owner is absent.");
+    for (const mount of input.model.services[service].volumes ?? []) {
+      if (mount.type !== "volume" || !mount.source) continue;
+      const key = mount.source;
+      const name = input.model.volumes?.[key]?.name;
+      if (!name || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,255}$/.test(name))
+        throw new Error("Fresh-bootstrap volume name did not resolve exactly.");
+      const inspected = JSON.parse(docker(input.endpoint, ["volume", "inspect", name]));
+      if (!Array.isArray(inspected) || inspected.length !== 1 || !object3(inspected[0]) || inspected[0].Name !== name)
+        throw new Error("Fresh-bootstrap volume inspection is ambiguous.");
+      const volume = inspected[0];
+      verifyFreshVolume(
+        volume,
+        key,
+        input.project,
+        input.prior,
+        input.declaration.sharedCaches.includes(key)
+      );
+      const attached = container.mounts.filter(
+        (m) => m.Type === "volume" && m.Destination === mount.target
+      );
+      if (attached.length !== 1 || attached[0].Source !== volume.Mountpoint)
+        throw new Error("Fresh-bootstrap data volume is not attached to its exact owner.");
+      if (seen.has(key)) continue;
+      if (names.has(name)) throw new Error("Fresh-bootstrap volume bindings alias each other.");
+      seen.add(key);
+      names.add(name);
+      if (input.declaration.dataVolumes.includes(key))
+        result.push({ key, name, createdAt: volume.CreatedAt, mountpoint: volume.Mountpoint });
+    }
+  }
+  if (result.length !== input.declaration.dataVolumes.length)
+    throw new Error("Fresh-bootstrap data-volume proof is incomplete.");
+  return result.sort((a, b) => a.key.localeCompare(b.key));
+}
+function createFreshBootstrap(options) {
+  const repoPath = options.identity.repoPath;
+  return {
+    prepare(providerId, network) {
+      assertFreshBootstrapRequest(options.identity, { initializeNew: true });
+      if (!["1.19.0", "1.24.0"].includes(requireReadyDevsyAgent().version))
+        throw new Error(
+          "Fresh bootstrap is qualified for Devsy 1.19.0 or 1.24.0; ordinary startup is unchanged."
+        );
+      const declaration = loadRepoConfig(repoPath).managedRuntime?.devcontainer.freshBootstrap;
+      if (!declaration) throw new Error("Fresh-bootstrap declaration disappeared.");
+      const plan = options.plan();
+      for (const file of plan.composeFiles) {
+        const source = import_yaml4.default.parse(import_node_fs29.default.readFileSync(file, "utf8"));
+        if (source?.name !== void 0)
+          throw new Error("Fresh bootstrap refuses an explicit shared Compose project name.");
+        for (const [key, value] of Object.entries(source?.volumes ?? {})) {
+          if (!declaration.sharedCaches.includes(key) && object3(value) && value.name !== void 0)
+            throw new Error(
+              "Fresh bootstrap refuses fixed names for non-cache volumes before provider startup."
+            );
+        }
+      }
+      const envFile = import_node_path34.default.join(plan.composeDirectory, ".env");
+      if (process.env.COMPOSE_PROJECT_NAME !== void 0 || import_node_fs29.default.existsSync(envFile) && /^\s*(?:export\s+)?COMPOSE_PROJECT_NAME\s*=/m.test(import_node_fs29.default.readFileSync(envFile, "utf8")))
+        throw new Error("Fresh bootstrap requires the provider's isolated project namespace.");
+      const endpoint = network?.endpoint ?? resolveManagedStopEndpoint();
+      if (!supportsManagedStopBaseline(endpoint))
+        throw new Error("Fresh bootstrap requires a local Docker endpoint.");
+      const evidence = inspectNetworkProviderBinding({
+        provider: "devsy",
+        providerId,
+        repoPath,
+        endpoint,
+        ...network ? { providerContext: network.providerContext } : {}
+      });
+      const binding = network ?? {
+        provider: "devsy",
+        providerId,
+        endpoint,
+        daemonId: evidence.daemonId,
+        definitionSha256: evidence.definitionSha256,
+        providerContext: evidence.providerContext
+      };
+      assertNetworkProviderBinding(binding, evidence, true);
+      const providerDirectory = import_node_path34.default.join(
+        process.env.DEVSY_HOME || import_node_path34.default.join(import_node_os6.default.homedir(), ".devsy"),
+        "contexts",
+        binding.providerContext,
+        "workspaces",
+        providerId
+      );
+      try {
+        import_node_fs29.default.lstatSync(providerDirectory);
+        throw new Error(
+          "Fresh bootstrap refuses retained provider files, even without a registration."
+        );
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+      assertNoCheckoutContainers(endpoint, repoPath);
+      verifyFreshBootstrapMounts(
+        repoPath,
+        plan,
+        render(endpoint, plan, "fresh-bootstrap-preflight", options.workspace),
+        declaration,
+        options.workspace
+      );
+      const sourceSha256 = sourceIdentity(repoPath, plan);
+      const prior = volumeSnapshot(endpoint);
+      claimActiveFreshBootstrap({
+        sourceSha256,
+        providerId,
+        providerContext: binding.providerContext,
+        definitionSha256: binding.definitionSha256,
+        endpoint,
+        daemonId: binding.daemonId,
+        previousVolumeNameDigests: prior
+      });
+      return {
+        binding,
+        async afterStart(resumeSourceHooks) {
+          const proof = captureDevsyExecProof(repoPath);
+          if (proof.id !== providerId || proof.endpoint !== endpoint || proof.daemon !== binding.daemonId || proof.context !== binding.providerContext)
+            throw new Error("Fresh-bootstrap provider or daemon changed during provisioning.");
+          const primary = workspaceAppContainers(inspectWorkspaceContainers(), repoPath).find(
+            (c) => c.id === proof.containerId
+          );
+          const project = primary?.labels["com.docker.compose.project"];
+          if (!project) throw new Error("Fresh-bootstrap primary project is unavailable.");
+          const state = {
+            version: 1,
+            repoPath,
+            ...options.identity.workspace ? { workspace: options.identity.workspace } : {},
+            devpodId: providerId,
+            composeProject: project,
+            profile: options.profile,
+            variant: options.variant,
+            ...options.hostPortDeclarationsSha256 !== void 0 ? { hostPortDeclarationsSha256: options.hostPortDeclarationsSha256 } : {},
+            desired: {
+              apps: [...options.apps].sort(),
+              services: [...plan.desiredProfileServices].sort(),
+              processes: [...options.processes].sort()
+            },
+            sourceConfigSha256: plan.sourceConfigSha256,
+            effectiveConfigSha256: plan.effectiveConfigSha256,
+            status: "degraded",
+            transitionPhase: "fresh-bootstrap",
+            updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+          };
+          state.stopBaseline = captureManagedStopBaseline(state, plan, proof.containerId, endpoint);
+          claimLifecycleEffect();
+          writeManagedRuntimeState(state);
+          options.onCaptured(state, { id: proof.containerId, workspacePath: proof.workspacePath });
+          const metadata = JSON.parse(
+            docker(endpoint, [
+              "inspect",
+              "--format",
+              '{{json (index .Config.Labels "devcontainer.metadata")}}',
+              proof.containerId
+            ])
+          );
+          if (typeof metadata === "string") {
+            const entries = JSON.parse(metadata);
+            if (!Array.isArray(entries) || entries.some((entry) => !object3(entry)))
+              throw new Error("Fresh-bootstrap image metadata is invalid.");
+            for (const entry of entries) qualifiedContext(entry);
+          } else if (metadata !== null)
+            throw new Error("Fresh-bootstrap image metadata is unavailable.");
+          const model = render(endpoint, plan, project, options.workspace);
+          verifyFreshBootstrapMounts(repoPath, plan, model, declaration, options.workspace);
+          const dataVolumes = proveVolumes({ endpoint, model, declaration, plan, project, prior });
+          const resources = { primaryId: proof.containerId, project, dataVolumes };
+          const revalidate = () => {
+            if (sourceIdentity(repoPath, options.plan()) !== sourceSha256 || inspectManagedStopDaemon(endpoint) !== binding.daemonId)
+              throw new Error("Fresh-bootstrap source or daemon changed.");
+            assertNetworkProviderBinding(
+              binding,
+              inspectNetworkProviderBinding({
+                provider: "devsy",
+                providerId,
+                repoPath,
+                endpoint,
+                providerContext: binding.providerContext
+              }),
+              false
+            );
+            revalidateDevsyExecProof(repoPath, proof);
+            proveRetainedManagedStop(state);
+            if (!(0, import_node_util7.isDeepStrictEqual)(
+              proveVolumes({ endpoint, model, declaration, plan, project, prior }),
+              dataVolumes
+            ))
+              throw new Error("Fresh-bootstrap volume identity changed.");
+          };
+          revalidate();
+          advanceActiveFreshBootstrap("provisioned", resources);
+          reportLifecycleProgress("fresh-bootstrap");
+          advanceActiveFreshBootstrap("initializing");
+          const outcome = await new Promise((resolve) => {
+            revalidate();
+            claimLifecycleEffect();
+            const child = (0, import_node_child_process19.spawn)(
+              "devsy",
+              [
+                "workspace",
+                "exec",
+                "--result-format",
+                "plain",
+                "--context",
+                binding.providerContext,
+                providerId,
+                "--",
+                ...declaration.command
+              ],
+              { stdio: "inherit", env: networkProviderEnvironment(binding, process.env) }
+            );
+            child.once("error", () => resolve({ code: null, error: true }));
+            child.once("close", (code) => resolve({ code }));
+          });
+          if (outcome.error || outcome.code !== 0) {
+            advanceActiveFreshBootstrap("failed");
+            throw new Error(
+              "Fresh initialization failed or completion is unknown; partial data and its attempt fence were retained. Initialization will not replay."
+            );
+          }
+          advanceActiveFreshBootstrap("initialized");
+          revalidate();
+          await resumeSourceHooks();
+          revalidate();
+          advanceActiveFreshBootstrap("ready");
+        }
+      };
+    }
+  };
+}
+
+// src/core/managed-post-start.ts
+var import_node_child_process21 = require("child_process");
+var import_node_crypto19 = require("crypto");
+var import_node_fs30 = __toESM(require("fs"));
+var import_node_path35 = __toESM(require("path"));
 
 // src/core/managed-host-ports.ts
-var import_node_child_process19 = require("child_process");
-var import_node_crypto17 = require("crypto");
+var import_node_child_process20 = require("child_process");
+var import_node_crypto18 = require("crypto");
 var PORT_LOOKUP_TIMEOUT_MS = 1e4;
 var PORT_LOOKUP_MAX_BUFFER = 64 * 1024;
 var LOOPBACK_BINDING = /^127\.0\.0\.1:(\d+)$/;
@@ -11425,7 +11984,7 @@ function unavailableEntry(declaration, reason2) {
   return { ...declaration, status: "unavailable", reason: reason2 };
 }
 function livePublishedBindings(containerId, target) {
-  const result = (0, import_node_child_process19.spawnSync)("docker", ["port", containerId, `${target}/tcp`], {
+  const result = (0, import_node_child_process20.spawnSync)("docker", ["port", containerId, `${target}/tcp`], {
     encoding: "utf-8",
     timeout: PORT_LOOKUP_TIMEOUT_MS,
     maxBuffer: PORT_LOOKUP_MAX_BUFFER,
@@ -11565,7 +12124,7 @@ function managedHostPortDeclarationsIdentity(declarations) {
   const keys2 = Object.keys(declarations).sort();
   if (keys2.length === 0) return void 0;
   const canonical = keys2.map((key) => [key, declarations[key].service, declarations[key].target]);
-  return (0, import_node_crypto17.createHash)("sha256").update(JSON.stringify(canonical)).digest("hex");
+  return (0, import_node_crypto18.createHash)("sha256").update(JSON.stringify(canonical)).digest("hex");
 }
 function managedHostPortVariables(report) {
   return Object.fromEntries(
@@ -11582,7 +12141,7 @@ function managedHostPortIdentity(report) {
     const entry = report[key];
     return [key, entry.status === "available" ? entry.endpoint?.port ?? null : entry.status];
   });
-  return (0, import_node_crypto17.createHash)("sha256").update(JSON.stringify(canonical)).digest("hex");
+  return (0, import_node_crypto18.createHash)("sha256").update(JSON.stringify(canonical)).digest("hex");
 }
 function assertManagedHostPortsAvailable(report) {
   const unavailable = Object.entries(report).filter(([, entry]) => entry.status === "unavailable").map(([key]) => key).sort();
@@ -11605,7 +12164,7 @@ function renderDeliveryScript(targetPath) {
   if (!/^\/tmp\/devrouter\/bin\/[a-zA-Z0-9._-]+$/.test(targetPath)) {
     throw new Error(`Unsafe managed runtime delivery path: ${targetPath}`);
   }
-  const temporaryPrefix = import_node_path34.default.posix.basename(targetPath);
+  const temporaryPrefix = import_node_path35.default.posix.basename(targetPath);
   return `set -eu
 umask 077
 runtime_root=/tmp/devrouter
@@ -11629,7 +12188,7 @@ function commandFailure2(result) {
   return [result.error?.message, result.stderr, result.stdout].filter(Boolean).map((value) => String(value).trim()).filter(Boolean).join("\n");
 }
 function deliverRuntimeFile(containerId, targetPath, contents, label) {
-  const result = (0, import_node_child_process20.spawnSync)(
+  const result = (0, import_node_child_process21.spawnSync)(
     "docker",
     ["exec", "-i", containerId, "sh", "-c", renderDeliveryScript(targetPath)],
     { input: contents, encoding: "utf-8", ...networkDockerOptions() }
@@ -11640,32 +12199,32 @@ function deliverRuntimeFile(containerId, targetPath, contents, label) {
   }
 }
 function readRegularFileBytes(filePath) {
-  if (!import_node_fs29.default.existsSync(filePath) || !import_node_fs29.default.lstatSync(filePath).isFile()) return void 0;
-  return import_node_fs29.default.readFileSync(filePath);
+  if (!import_node_fs30.default.existsSync(filePath) || !import_node_fs30.default.lstatSync(filePath).isFile()) return void 0;
+  return import_node_fs30.default.readFileSync(filePath);
 }
 function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
 }
 function adapterFingerprint(adapter) {
-  return (0, import_node_crypto18.createHash)("sha256").update(adapter).digest("hex");
+  return (0, import_node_crypto19.createHash)("sha256").update(adapter).digest("hex");
 }
 function resolveProcessHelperPath() {
   const candidates = [
-    import_node_path34.default.resolve(__dirname, "..", "bin", "devrouter-process"),
-    import_node_path34.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
+    import_node_path35.default.resolve(__dirname, "..", "bin", "devrouter-process"),
+    import_node_path35.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
   ];
-  const helperPath = candidates.find((candidate) => import_node_fs29.default.existsSync(candidate));
+  const helperPath = candidates.find((candidate) => import_node_fs30.default.existsSync(candidate));
   if (!helperPath) {
     throw new Error("Could not locate the packaged devrouter-process helper.");
   }
   return helperPath;
 }
 function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path34.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterPath = import_node_path35.default.join(repoPath, MANAGED_ADAPTER_PATH);
   const adapterBytes = readRegularFileBytes(adapterPath);
   const adapterText = adapterBytes?.toString("utf-8");
-  const dockerfilePath = import_node_path34.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path34.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfilePath = import_node_path35.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path35.default.join(repoPath, ".devcontainer", "devcontainer.json");
   const dockerfile = readRegularFile(dockerfilePath) ?? "";
   const devcontainer = readRegularFile(devcontainerPath) ?? "";
   const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
@@ -11716,7 +12275,7 @@ function runManagedPostStart(options) {
   assertManagedHostPortsAvailable(hostPorts);
   const portEnvironment = managedHostPortVariables(hostPorts);
   const portIdentity = managedHostPortIdentity(hostPorts) ?? "";
-  const helper = import_node_fs29.default.readFileSync(resolveProcessHelperPath());
+  const helper = import_node_fs30.default.readFileSync(resolveProcessHelperPath());
   deliverRuntimeFile(
     options.container.id,
     RUNTIME_HELPER_PATH,
@@ -11730,7 +12289,7 @@ function runManagedPostStart(options) {
     options.plan.adapterContents,
     "the managed post-start adapter"
   );
-  const started2 = (0, import_node_child_process20.spawnSync)(
+  const started2 = (0, import_node_child_process21.spawnSync)(
     "docker",
     [
       "exec",
@@ -11776,7 +12335,7 @@ function assertSafeProcessName(name) {
 }
 function runManagedProcessAction(options) {
   assertSafeProcessName(options.name);
-  const result = (0, import_node_child_process20.spawnSync)(
+  const result = (0, import_node_child_process21.spawnSync)(
     "docker",
     [
       "exec",
@@ -12582,103 +13141,48 @@ function stepReliability(state, event, nowMs) {
 }
 
 // src/core/reliability-worker.ts
-var import_node_child_process21 = require("child_process");
+var import_node_child_process22 = require("child_process");
+var import_node_crypto21 = require("crypto");
+var import_node_fs32 = __toESM(require("fs"));
+var import_node_path37 = __toESM(require("path"));
+
+// src/core/lifecycle-diagnostics.ts
 var import_node_crypto20 = require("crypto");
 var import_node_fs31 = __toESM(require("fs"));
 var import_node_path36 = __toESM(require("path"));
-
-// src/core/lifecycle-diagnostics.ts
-var import_node_crypto19 = require("crypto");
-var import_node_fs30 = __toESM(require("fs"));
-var import_node_path35 = __toESM(require("path"));
-var import_node_util7 = require("util");
-
-// src/core/lifecycle-progress.ts
-var ROLES = {
-  validation: "lifecycle-worker",
-  preparation: "repository-preparation",
-  provider: "provider-operation",
-  "service-start": "service-reconciliation",
-  "service-stop": "service-reconciliation",
-  "process-start": "repository-process-adapter",
-  "process-stop": "repository-process-adapter",
-  "route-publication": "lifecycle-worker",
-  "route-removal": "lifecycle-worker",
-  readiness: "lifecycle-worker",
-  rollback: "lifecycle-worker",
-  stop: "lifecycle-stop"
-};
-function isLifecycleProgressPhase(value) {
-  return typeof value === "string" && Object.hasOwn(ROLES, value);
-}
-var sender;
-function installLifecycleProgressSender(send) {
-  let active = true;
-  let pending = false;
-  let latest;
-  const report = (phase) => {
-    if (!active || !isLifecycleProgressPhase(phase)) return;
-    if (pending) {
-      latest = phase;
-      return;
-    }
-    pending = true;
-    try {
-      send({ lifecycleProgress: phase }, () => {
-        pending = false;
-        const next = latest;
-        latest = void 0;
-        if (active && next) report(next);
-      });
-    } catch {
-      pending = false;
-      latest = void 0;
-    }
-  };
-  sender = report;
-  return () => {
-    active = false;
-    latest = void 0;
-    if (sender === report) sender = void 0;
-  };
-}
-function reportLifecycleProgress(phase) {
-  sender?.(phase);
-}
-
-// src/core/lifecycle-diagnostics.ts
+var import_node_util8 = require("util");
 var MAX_TAIL_BYTES = 32768;
 var MAX_RECEIPT_BYTES = 65536;
 function privateDirectory(directory) {
-  const stat = import_node_fs30.default.lstatSync(directory);
+  const stat = import_node_fs31.default.lstatSync(directory);
   return stat.isDirectory() && stat.uid === process.getuid?.() && (stat.mode & 63) === 0;
 }
 function lifecycleDiagnosticsPath(identity2) {
-  return import_node_path35.default.join(
+  return import_node_path36.default.join(
     DEVROUTER_HOME,
     "lifecycle-diagnostics",
-    `${(0, import_node_crypto19.createHash)("sha256").update(identity2.repoPath).digest("hex")}.json`
+    `${(0, import_node_crypto20.createHash)("sha256").update(identity2.repoPath).digest("hex")}.json`
   );
 }
 function readReceipt(identity2) {
   let descriptor;
   try {
     const file = lifecycleDiagnosticsPath(identity2);
-    if (!privateDirectory(import_node_path35.default.dirname(file))) return void 0;
-    descriptor = import_node_fs30.default.openSync(
+    if (!privateDirectory(import_node_path36.default.dirname(file))) return void 0;
+    descriptor = import_node_fs31.default.openSync(
       file,
-      import_node_fs30.default.constants.O_RDONLY | import_node_fs30.default.constants.O_NOFOLLOW | import_node_fs30.default.constants.O_NONBLOCK
+      import_node_fs31.default.constants.O_RDONLY | import_node_fs31.default.constants.O_NOFOLLOW | import_node_fs31.default.constants.O_NONBLOCK
     );
-    const stat = import_node_fs30.default.fstatSync(descriptor);
+    const stat = import_node_fs31.default.fstatSync(descriptor);
     if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0 || stat.size > MAX_RECEIPT_BYTES)
       return void 0;
     const buffer = Buffer.alloc(MAX_RECEIPT_BYTES + 1);
-    const size = import_node_fs30.default.readSync(descriptor, buffer, 0, buffer.length, 0);
+    const size = import_node_fs31.default.readSync(descriptor, buffer, 0, buffer.length, 0);
     if (size > MAX_RECEIPT_BYTES) return void 0;
     const receipt = JSON.parse(buffer.subarray(0, size).toString("utf8"));
     const timestamp = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
     const optionalTime = (value) => value === null || timestamp(value);
-    if (receipt.version !== 1 || !(0, import_node_util7.isDeepStrictEqual)(receipt.identity, identity2) || typeof receipt.operationId !== "string" || typeof receipt.workerId !== "string" || !timestamp(receipt.startedAtMs) || !timestamp(receipt.updatedAtMs) || receipt.updatedAtMs < receipt.startedAtMs || !(receipt.phase === null || isLifecycleProgressPhase(receipt.phase)) || !optionalTime(receipt.phaseAtMs) || !optionalTime(receipt.lastOutputAtMs) || !optionalTime(receipt.lastProgressAtMs) || !(receipt.buildPackage === null || typeof receipt.buildPackage === "string" && receipt.buildPackage.length <= 128 && /^(?:@[a-zA-Z0-9_.-]+\/)?[a-zA-Z0-9_.-]+$/.test(receipt.buildPackage)) || typeof receipt.cancellationRequested !== "boolean" || typeof receipt.closed !== "boolean" || !Array.isArray(receipt.output) || receipt.output.length > 64)
+    if (receipt.version !== 1 || !(0, import_node_util8.isDeepStrictEqual)(receipt.identity, identity2) || typeof receipt.operationId !== "string" || typeof receipt.workerId !== "string" || !timestamp(receipt.startedAtMs) || !timestamp(receipt.updatedAtMs) || receipt.updatedAtMs < receipt.startedAtMs || !(receipt.phase === null || isLifecycleProgressPhase(receipt.phase)) || !optionalTime(receipt.phaseAtMs) || !optionalTime(receipt.lastOutputAtMs) || !optionalTime(receipt.lastProgressAtMs) || !(receipt.buildPackage === null || typeof receipt.buildPackage === "string" && receipt.buildPackage.length <= 128 && /^(?:@[a-zA-Z0-9_.-]+\/)?[a-zA-Z0-9_.-]+$/.test(receipt.buildPackage)) || typeof receipt.cancellationRequested !== "boolean" || typeof receipt.closed !== "boolean" || !Array.isArray(receipt.output) || receipt.output.length > 64)
       return void 0;
     let bytes2 = 0;
     for (const chunk of receipt.output) {
@@ -12690,7 +13194,7 @@ function readReceipt(identity2) {
   } catch {
     return void 0;
   } finally {
-    if (descriptor !== void 0) import_node_fs30.default.closeSync(descriptor);
+    if (descriptor !== void 0) import_node_fs31.default.closeSync(descriptor);
   }
 }
 function readLifecycleDiagnostics(identity2, now = Date.now()) {
@@ -12698,7 +13202,7 @@ function readLifecycleDiagnostics(identity2, now = Date.now()) {
     const before = readReliabilityOperation(identity2);
     const receipt = readReceipt(identity2);
     const after = readReliabilityOperation(identity2);
-    if (!before || !after || !receipt || before.revision !== after.revision || !(0, import_node_util7.isDeepStrictEqual)(before, after) || !(0, import_node_util7.isDeepStrictEqual)(receipt.fence, reliabilityFence(after.state)) || after.state.operation?.id !== receipt.operationId || after.state.operation.kind !== "ensure" || after.worker !== null && after.worker.id !== receipt.workerId || !receipt.closed && !after.worker || now < receipt.updatedAtMs || [receipt.phaseAtMs, receipt.lastOutputAtMs, receipt.lastProgressAtMs].some(
+    if (!before || !after || !receipt || before.revision !== after.revision || !(0, import_node_util8.isDeepStrictEqual)(before, after) || !(0, import_node_util8.isDeepStrictEqual)(receipt.fence, reliabilityFence(after.state)) || after.state.operation?.id !== receipt.operationId || after.state.operation.kind !== "ensure" || after.worker !== null && after.worker.id !== receipt.workerId || !receipt.closed && !after.worker || now < receipt.updatedAtMs || [receipt.phaseAtMs, receipt.lastOutputAtMs, receipt.lastProgressAtMs].some(
       (time) => time !== null && (time < receipt.startedAtMs || time > receipt.updatedAtMs)
     ))
       return void 0;
@@ -12740,11 +13244,11 @@ function workerGroupAbsent(pid) {
   if (process.platform !== "linux") return false;
   let observedZombie = false;
   try {
-    for (const entry of import_node_fs31.default.readdirSync("/proc")) {
+    for (const entry of import_node_fs32.default.readdirSync("/proc")) {
       if (!/^\d+$/.test(entry)) continue;
       let stat;
       try {
-        stat = import_node_fs31.default.readFileSync(`/proc/${entry}/stat`, "utf8");
+        stat = import_node_fs32.default.readFileSync(`/proc/${entry}/stat`, "utf8");
       } catch (error) {
         if (error.code === "ENOENT") continue;
         return false;
@@ -12764,20 +13268,20 @@ function workerGroupAbsent(pid) {
 }
 
 // src/core/workspace-ensure.ts
-var import_node_child_process31 = require("child_process");
-var import_node_fs36 = __toESM(require("fs"));
-var import_node_path41 = __toESM(require("path"));
+var import_node_child_process32 = require("child_process");
+var import_node_fs37 = __toESM(require("fs"));
+var import_node_path42 = __toESM(require("path"));
 
 // src/core/devpod-mutation.ts
-var import_node_child_process22 = require("child_process");
-var import_node_fs32 = __toESM(require("fs"));
-var import_node_path37 = __toESM(require("path"));
-var DEVPOD_MUTATION_LOCK_FILE = import_node_path37.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+var import_node_child_process23 = require("child_process");
+var import_node_fs33 = __toESM(require("fs"));
+var import_node_path38 = __toESM(require("path"));
+var DEVPOD_MUTATION_LOCK_FILE = import_node_path38.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
 var DEVPOD_MUTATION_WAIT_MS = 18e5;
 var DevpodStartPostconditionError = class extends Error {
 };
 function withMutationLock2(activity, target, operation) {
-  import_node_fs32.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs33.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
     {
@@ -12797,7 +13301,7 @@ function runDevpodAction(action, devpodId, force = false, repoPath) {
   const args = action === "delete" ? [action, devpodId, ...force ? ["--force"] : [], "--ignore-not-found"] : [action, devpodId];
   claimLifecycleEffect();
   const binding = repoPath ? networkProviderEffectOptions("devpod", devpodId, repoPath) : { args: [] };
-  const result = (0, import_node_child_process22.spawnSync)("devpod", [...args, ...binding.args], {
+  const result = (0, import_node_child_process23.spawnSync)("devpod", [...args, ...binding.args], {
     encoding: "utf-8",
     ...binding.env ? { env: binding.env } : {}
   });
@@ -12877,7 +13381,8 @@ async function startDevpodWorkspace(options) {
         recreate: options.recreate,
         quiet: options.quiet,
         workspace: options.workspace,
-        prepareNetwork: options.prepareNetwork
+        prepareNetwork: options.prepareNetwork,
+        ...options.freshBootstrap ? { freshBootstrap: options.freshBootstrap } : {}
       });
       resetWorkspaceRuntimeCaches();
       return result;
@@ -12889,6 +13394,8 @@ async function startDevpodWorkspace(options) {
       throw error;
     }
   }
+  if (options.freshBootstrap)
+    throw new Error("Fresh bootstrap is qualified only for the Devsy Docker provider.");
   const activity = options.recreate ? "DevPod recreate" : "DevPod start";
   return withMutationLock2(activity, options.repoPath, () => {
     const workspaces = listDevpodWorkspaces(options.repoPath);
@@ -12938,7 +13445,7 @@ async function startDevpodWorkspace(options) {
     }
     claimLifecycleEffect();
     network?.beforeDispatch?.();
-    const result = (0, import_node_child_process22.spawnSync)("devpod", args, {
+    const result = (0, import_node_child_process23.spawnSync)("devpod", args, {
       stdio: options.quiet ? ["inherit", 2, "inherit"] : "inherit",
       env
     });
@@ -12978,8 +13485,8 @@ async function startDevpodWorkspace(options) {
 }
 
 // src/core/host-port-claims.ts
-var import_node_child_process23 = require("child_process");
-var import_node_path38 = __toESM(require("path"));
+var import_node_child_process24 = require("child_process");
+var import_node_path39 = __toESM(require("path"));
 var COMPOSE_RENDER_TIMEOUT_MS = 3e4;
 var COMPOSE_RENDER_MAX_BUFFER = 8 * 1024 * 1024;
 var DOCKER_TIMEOUT_MS = 1e4;
@@ -13082,7 +13589,7 @@ function hostPortBindingsConflict(desired, holder) {
 }
 var HOST_PORT_INSPECT_TEMPLATE = '{"id":{{json .Id}},"name":{{json .Name}},"labels":{"com.docker.compose.project":{{json (index .Config.Labels "com.docker.compose.project")}},"com.docker.compose.project.working_dir":{{json (index .Config.Labels "com.docker.compose.project.working_dir")}}},"ports":{{json .NetworkSettings.Ports}}}';
 function runDocker(args) {
-  const result = (0, import_node_child_process23.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process24.spawnSync)("docker", args, {
     ...networkDockerOptions(),
     encoding: "utf-8",
     timeout: DOCKER_TIMEOUT_MS,
@@ -13152,7 +13659,7 @@ function listHolderSnapshots() {
 }
 function renderManagedComposeModel(plan, workspace) {
   const fileArgs = plan.composeFiles.flatMap((file) => ["-f", file]);
-  const result = (0, import_node_child_process23.spawnSync)(
+  const result = (0, import_node_child_process24.spawnSync)(
     "docker",
     [
       "compose",
@@ -13187,8 +13694,8 @@ function renderManagedComposeModel(plan, workspace) {
   }
 }
 function attributeHolderWorktree(workingDir) {
-  if (import_node_path38.default.basename(workingDir) !== ".devcontainer") return void 0;
-  return comparableWorkspacePath(import_node_path38.default.dirname(workingDir));
+  if (import_node_path39.default.basename(workingDir) !== ".devcontainer") return void 0;
+  return comparableWorkspacePath(import_node_path39.default.dirname(workingDir));
 }
 function holderAttribution(holder, repoPath) {
   const attribution = {};
@@ -13223,7 +13730,7 @@ function detectHostPortClaimConflicts(options) {
   );
   if (desired.length === 0) return [];
   const holders = listHolderSnapshots();
-  const devcontainerDir = import_node_path38.default.join(options.repoPath, ".devcontainer");
+  const devcontainerDir = import_node_path39.default.join(options.repoPath, ".devcontainer");
   const conflicts = [];
   for (const binding of desired) {
     for (const holder of holders) {
@@ -13247,7 +13754,7 @@ function detectHostPortClaimConflicts(options) {
 }
 
 // src/core/http-route-probe.ts
-var import_node_child_process24 = require("child_process");
+var import_node_child_process25 = require("child_process");
 var DEFAULT_MAX_TIME_SECONDS = 5;
 var PARENT_TIMEOUT_PADDING_MS = 250;
 var CONTRACT_MAX_BUFFER = 1024;
@@ -13280,7 +13787,7 @@ function probeHttpRoute(host, options = {}) {
     args.push("--cacert", CERT_FILE);
   }
   args.push(url);
-  const result = (0, import_node_child_process24.spawnSync)("curl", args, { encoding: "utf-8" });
+  const result = (0, import_node_child_process25.spawnSync)("curl", args, { encoding: "utf-8" });
   const stdout = result.stdout?.trim() ?? "";
   const status = /^\d{3}$/.test(stdout) ? Number(stdout) : void 0;
   const ok = result.status === 0 && status !== void 0 && status >= 100 && status < 500;
@@ -13299,7 +13806,7 @@ function probeHttpReadinessSync(host, readiness, maxTimeSeconds, repoPath) {
   }
   let result;
   try {
-    result = (0, import_node_child_process24.spawnSync)("curl", args, {
+    result = (0, import_node_child_process25.spawnSync)("curl", args, {
       encoding: "utf-8",
       maxBuffer: CONTRACT_MAX_BUFFER,
       timeout: Math.ceil(parentTimeoutMs)
@@ -13383,8 +13890,8 @@ function transportFailure() {
 }
 
 // src/core/managed-host-preparation.ts
-var import_node_child_process25 = require("child_process");
-var import_node_fs33 = __toESM(require("fs"));
+var import_node_child_process26 = require("child_process");
+var import_node_fs34 = __toESM(require("fs"));
 var PREPARATION_TIMEOUT_MS = 6e4;
 var CONFIG_READ_ERROR = "Managed host preparation could not read .devrouter.yml.";
 var CONFIG_CHANGED_ERROR = "Managed host preparation changed .devrouter.yml; refusing to continue.";
@@ -13395,7 +13902,7 @@ function runPreparationCommand(argv, cwd) {
   return new Promise((resolve) => {
     let child;
     try {
-      child = (0, import_node_child_process25.spawn)(argv[0], argv.slice(1), {
+      child = (0, import_node_child_process26.spawn)(argv[0], argv.slice(1), {
         cwd,
         detached: true,
         shell: false,
@@ -13427,7 +13934,7 @@ function runPreparationCommand(argv, cwd) {
 }
 function readConfigBytes(configPath) {
   try {
-    return import_node_fs33.default.readFileSync(configPath);
+    return import_node_fs34.default.readFileSync(configPath);
   } catch {
     return void 0;
   }
@@ -13498,7 +14005,7 @@ function projectLifecycleOperation(operation) {
 }
 
 // src/core/managed-mount-nesting.ts
-var import_node_child_process26 = require("child_process");
+var import_node_child_process27 = require("child_process");
 var NESTED_MOUNT_REASON = "no configured mount is nested inside another configured mount";
 var UNREADABLE_MOUNT_REASON = "the container's own mount table could not be read";
 function normalizeDestination(value) {
@@ -13571,7 +14078,7 @@ function classifyManagedMountNesting(configured, effectiveDestinations, containe
   };
 }
 function readContainerMountinfo(containerId, options) {
-  const result = (0, import_node_child_process26.spawnSync)("docker", ["exec", containerId, "cat", "/proc/self/mountinfo"], {
+  const result = (0, import_node_child_process27.spawnSync)("docker", ["exec", containerId, "cat", "/proc/self/mountinfo"], {
     encoding: "utf-8",
     timeout: options.timeoutMs ?? 5e3,
     stdio: ["ignore", "pipe", "pipe"],
@@ -13598,7 +14105,11 @@ function reliabilityRecovery(reason2, repoPath, variant) {
   switch (reason2) {
     case "stop-incomplete":
     case "operation-unknown":
-      return [`Run: devrouter stop ${checkout}`, `Run: devrouter ensure ${checkout} --repair`];
+      return [
+        `Run: devrouter stop ${checkout}`,
+        "Verify the repository startup hooks preserve retained data and startup is authorized before continuing.",
+        `Run: devrouter ensure ${checkout}${variantOption}`
+      ];
     case "start-refused":
       return [
         `Run: devrouter doctor --repo ${checkout} to read the refused fixed host-port claim and its holder`,
@@ -14116,7 +14627,7 @@ function collectManagedRuntimeStatus(options) {
 }
 
 // src/core/network-inventory.ts
-var import_node_child_process27 = require("child_process");
+var import_node_child_process28 = require("child_process");
 var NetworkInventoryError = class extends Error {
 };
 var MAX_IDS = 4096;
@@ -14128,7 +14639,7 @@ function readDocker(endpoint, args, timeoutMs) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process27.spawnSync)("docker", ["--host", endpoint, ...args], {
+  const result = (0, import_node_child_process28.spawnSync)("docker", ["--host", endpoint, ...args], {
     env,
     encoding: "utf-8",
     timeout: timeoutMs,
@@ -14292,37 +14803,37 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
 }
 
 // src/core/network-routes.ts
-var import_node_child_process28 = require("child_process");
+var import_node_child_process29 = require("child_process");
 var import_node_net3 = require("net");
 
 // src/core/network-local-daemon.ts
-var import_node_fs34 = __toESM(require("fs"));
-var import_node_path39 = __toESM(require("path"));
+var import_node_fs35 = __toESM(require("fs"));
+var import_node_path40 = __toESM(require("path"));
 function hasLocalDockerNetworkNamespace(endpoint, procRoot = "/proc") {
   const deadline = Date.now() + 2e3;
   try {
     if (!endpoint.startsWith("unix:///")) return false;
     const socket = endpoint.slice("unix://".length);
-    const table = import_node_fs34.default.readFileSync(import_node_path39.default.join(procRoot, "net/unix"), "utf8");
+    const table = import_node_fs35.default.readFileSync(import_node_path40.default.join(procRoot, "net/unix"), "utf8");
     if (Buffer.byteLength(table) > 1024 * 1024) return false;
     const rows2 = table.split("\n").map((line) => line.trim().split(/\s+/)).filter((row) => row[7] === socket && row[3] === "00010000");
     if (rows2.length !== 1 || !/^\d+$/.test(rows2[0][6])) return false;
     const inode = `socket:[${rows2[0][6]}]`;
-    const ownNamespace = import_node_fs34.default.readlinkSync(import_node_path39.default.join(procRoot, "self/ns/net"));
-    const pids = import_node_fs34.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
+    const ownNamespace = import_node_fs35.default.readlinkSync(import_node_path40.default.join(procRoot, "self/ns/net"));
+    const pids = import_node_fs35.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
     if (pids.length > 4096) return false;
     for (const pid of pids) {
       if (Date.now() > deadline) return false;
       try {
-        const root = import_node_path39.default.join(procRoot, pid);
-        if (import_node_path39.default.basename(import_node_fs34.default.readlinkSync(import_node_path39.default.join(root, "exe"))) !== "dockerd") continue;
-        if (import_node_fs34.default.readlinkSync(import_node_path39.default.join(root, "ns/net")) !== ownNamespace) continue;
-        const descriptors = import_node_fs34.default.readdirSync(import_node_path39.default.join(root, "fd"));
+        const root = import_node_path40.default.join(procRoot, pid);
+        if (import_node_path40.default.basename(import_node_fs35.default.readlinkSync(import_node_path40.default.join(root, "exe"))) !== "dockerd") continue;
+        if (import_node_fs35.default.readlinkSync(import_node_path40.default.join(root, "ns/net")) !== ownNamespace) continue;
+        const descriptors = import_node_fs35.default.readdirSync(import_node_path40.default.join(root, "fd"));
         if (descriptors.length > 4096) continue;
         if (descriptors.some((fd) => {
           if (Date.now() > deadline) return false;
           try {
-            return import_node_fs34.default.readlinkSync(import_node_path39.default.join(root, "fd", fd)) === inode;
+            return import_node_fs35.default.readlinkSync(import_node_path40.default.join(root, "fd", fd)) === inode;
           } catch {
             return false;
           }
@@ -14361,7 +14872,7 @@ function parseLinuxNetworkRoutes(output) {
 function collectNetworkRoutes(options) {
   if ((options.platform ?? process.platform) !== "linux" || !hasLocalDockerNetworkNamespace(options.endpoint))
     return { status: "unknown", routes: [] };
-  const result = (0, import_node_child_process28.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
+  const result = (0, import_node_child_process29.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
     encoding: "utf8",
     timeout: 5e3,
     maxBuffer: 1024 * 1024
@@ -14397,10 +14908,10 @@ function inspectLegacyNetworkCapacity(input) {
 }
 
 // src/core/network-managed.ts
-var import_node_crypto23 = require("crypto");
+var import_node_crypto24 = require("crypto");
 
 // src/core/network-compose.ts
-var import_node_crypto21 = require("crypto");
+var import_node_crypto22 = require("crypto");
 var SAFE_ENDPOINT_UPPER_BOUND_SEMANTICS = "full-lifecycle-demand";
 function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -15206,19 +15717,19 @@ function stableValue(value) {
 }
 function fingerprintComposeNetworkModel(input) {
   const projection = normalizedFingerprintProjection(input);
-  return (0, import_node_crypto21.createHash)("sha256").update(stableValue(projection), "utf8").digest("hex");
+  return (0, import_node_crypto22.createHash)("sha256").update(stableValue(projection), "utf8").digest("hex");
 }
 
 // src/core/network-compose-files.ts
-var import_node_child_process29 = require("child_process");
-var import_node_crypto22 = require("crypto");
-var import_node_fs35 = __toESM(require("fs"));
-var import_node_path40 = __toESM(require("path"));
-var import_yaml4 = __toESM(require("yaml"));
+var import_node_child_process30 = require("child_process");
+var import_node_crypto23 = require("crypto");
+var import_node_fs36 = __toESM(require("fs"));
+var import_node_path41 = __toESM(require("path"));
+var import_yaml5 = __toESM(require("yaml"));
 var OVERLAY = "docker-compose.devrouter-network.yml";
 var MARKER = "# devrouter:managed workspace network";
 var MAX_BYTES2 = 2 * 1024 * 1024;
-function object3(value) {
+function object4(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("Network Compose evidence is malformed.");
   return value;
@@ -15226,20 +15737,20 @@ function object3(value) {
 function inspectNetworkComposeFiles(input) {
   const authoredNetworks = {};
   for (const file of input.plan.composeFiles) {
-    const stat = import_node_fs35.default.lstatSync(file);
+    const stat = import_node_fs36.default.lstatSync(file);
     if (!stat.isFile() || stat.size > MAX_BYTES2)
       throw new Error("Network Compose source is unavailable or too large.");
     let source;
     try {
-      source = object3(import_yaml4.default.parse(import_node_fs35.default.readFileSync(file, "utf8")));
+      source = object4(import_yaml5.default.parse(import_node_fs36.default.readFileSync(file, "utf8")));
     } catch {
       throw new Error("Network Compose source could not be parsed safely.");
     }
     if (source.networks !== void 0) {
-      for (const [name, declaration] of Object.entries(object3(source.networks))) {
+      for (const [name, declaration] of Object.entries(object4(source.networks))) {
         authoredNetworks[name] = {
           ...authoredNetworks[name],
-          ...declaration === null ? {} : object3(declaration)
+          ...declaration === null ? {} : object4(declaration)
         };
       }
     }
@@ -15247,7 +15758,7 @@ function inspectNetworkComposeFiles(input) {
   const env = managedComposeEnvironment(input.workspace);
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process29.spawnSync)(
+  const result = (0, import_node_child_process30.spawnSync)(
     "docker",
     [
       "--host",
@@ -15273,7 +15784,7 @@ function inspectNetworkComposeFiles(input) {
   if (result.error || result.status !== 0)
     throw new Error("Complete network Compose evidence is unavailable.");
   try {
-    return { compose: object3(JSON.parse(result.stdout)), authoredNetworks };
+    return { compose: object4(JSON.parse(result.stdout)), authoredNetworks };
   } catch {
     throw new Error("Network Compose evidence is malformed.");
   }
@@ -15281,8 +15792,8 @@ function inspectNetworkComposeFiles(input) {
 function prepareNetworkComposeFiles(plan, subnet) {
   const overlay = deriveComposeNetworkOverlay(subnet);
   if (overlay.status !== "ready" || !overlay.overlay) throw new Error("Network subnet is invalid.");
-  const overlayPath = import_node_path40.default.join(plan.composeDirectory, OVERLAY);
-  const ignored = (0, import_node_child_process29.spawnSync)("git", [
+  const overlayPath = import_node_path41.default.join(plan.composeDirectory, OVERLAY);
+  const ignored = (0, import_node_child_process30.spawnSync)("git", [
     "-C",
     plan.composeDirectory,
     "check-ignore",
@@ -15294,11 +15805,11 @@ function prepareNetworkComposeFiles(plan, subnet) {
   if (ignored.status !== 0)
     throw new Error("Generated network overlay must be ignored before allocation.");
   const bytes2 = `${MARKER}
-${import_yaml4.default.stringify(overlay.overlay)}`;
+${import_yaml5.default.stringify(overlay.overlay)}`;
   const assertOwnership = () => {
-    if (!import_node_fs35.default.existsSync(overlayPath)) return;
-    const stat = import_node_fs35.default.lstatSync(overlayPath);
-    if (!stat.isFile() || stat.size > MAX_BYTES2 || import_node_fs35.default.readFileSync(overlayPath, "utf8") !== bytes2)
+    if (!import_node_fs36.default.existsSync(overlayPath)) return;
+    const stat = import_node_fs36.default.lstatSync(overlayPath);
+    if (!stat.isFile() || stat.size > MAX_BYTES2 || import_node_fs36.default.readFileSync(overlayPath, "utf8") !== bytes2)
       throw new Error("Retained network overlay changed; repair is required.");
   };
   assertOwnership();
@@ -15312,7 +15823,7 @@ ${JSON.stringify(extended.config, null, 2)}
     ...plan,
     contents,
     composeFiles: [...plan.composeFiles, overlayPath],
-    effectiveConfigSha256: (0, import_node_crypto22.createHash)("sha256").update(contents).digest("hex")
+    effectiveConfigSha256: (0, import_node_crypto23.createHash)("sha256").update(contents).digest("hex")
   };
   return {
     plan: result,
@@ -15324,7 +15835,7 @@ ${JSON.stringify(extended.config, null, 2)}
 }
 
 // src/core/network-connected-route.ts
-var import_node_child_process30 = require("child_process");
+var import_node_child_process31 = require("child_process");
 function bounds(cidr) {
   const canonical = parseIPv4Cidr(cidr);
   if (!canonical) throw new Error("Invalid connected route.");
@@ -15349,7 +15860,7 @@ function inspectClaimedBridge(claim2, networkId) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process30.spawnSync)(
+  const result = (0, import_node_child_process31.spawnSync)(
     "docker",
     [
       "--host",
@@ -15376,7 +15887,7 @@ function inspectClaimedBridge(claim2, networkId) {
     const [first, last] = bounds(claim2.subnet);
     const [address] = bounds(gateway);
     if (address <= first || address >= last) throw new Error();
-    const interfaces = (0, import_node_child_process30.spawnSync)("ip", ["-j", "-d", "-4", "address", "show", "dev", bridge], {
+    const interfaces = (0, import_node_child_process31.spawnSync)("ip", ["-j", "-d", "-4", "address", "show", "dev", bridge], {
       encoding: "utf8",
       timeout: 5e3,
       maxBuffer: 65536
@@ -15630,7 +16141,7 @@ function createManagedNetworkSession(input) {
           "Insufficient endpoint headroom; request an allowed larger network before first allocation."
         );
       const authority = readNetworkOperationAuthority(identity2);
-      const fingerprint = (0, import_node_crypto23.createHash)("sha256").update(input.plan().sourceConfigSha256).update(fingerprintComposeNetworkModel(model)).digest("hex");
+      const fingerprint = (0, import_node_crypto24.createHash)("sha256").update(input.plan().sourceConfigSha256).update(fingerprintComposeNetworkModel(model)).digest("hex");
       if (!saved) {
         if (policy.status !== "valid")
           throw new Error("New network allocation requires valid machine policy.");
@@ -15812,13 +16323,15 @@ function recoverUnattachedNetworkReservation(repoPath, managedRuntime) {
 var DEVCONTAINER_OVERLAY = "docker-compose.devrouter.yml";
 var DEFAULT_READINESS_TIMEOUT_MS = 12e4;
 var POLL_INTERVAL_MS = 1e3;
+var WorkspaceEnsureRefusalError = class extends Error {
+};
 function assertOverlay(container, repoPath) {
   const workingDir = container.labels["com.docker.compose.project.working_dir"];
-  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path41.default.join(repoPath, ".devcontainer"))) {
+  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path42.default.join(repoPath, ".devcontainer"))) {
     throw new Error(`Container '${container.id}' does not belong to the exact worktree.`);
   }
   const configFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").filter(Boolean);
-  const expectedOverlay = import_node_path41.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+  const expectedOverlay = import_node_path42.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
   if (!configFiles.some((configFile) => sameWorkspacePath(configFile, expectedOverlay))) {
     throw new Error(`Container '${container.id}' was not started with ${DEVCONTAINER_OVERLAY}.`);
   }
@@ -15832,7 +16345,7 @@ function assertWorktreeOwnership(container, repoPath) {
 function isInsideWorktree(candidate, repoPath) {
   const normalizedCandidate = comparableWorkspacePath(candidate);
   const normalizedRoot = comparableWorkspacePath(repoPath);
-  return normalizedCandidate === normalizedRoot || normalizedCandidate.startsWith(`${normalizedRoot}${import_node_path41.default.sep}`);
+  return normalizedCandidate === normalizedRoot || normalizedCandidate.startsWith(`${normalizedRoot}${import_node_path42.default.sep}`);
 }
 function assertReady(container, label) {
   if (!container.state.Running) {
@@ -16024,7 +16537,7 @@ function hasExactManagedComposeProject(repoPath, state) {
     }).some((container) => {
       const workingDir = container.labels["com.docker.compose.project.working_dir"];
       return Boolean(
-        workingDir && sameWorkspacePath(workingDir, import_node_path41.default.join(repoPath, ".devcontainer"))
+        workingDir && sameWorkspacePath(workingDir, import_node_path42.default.join(repoPath, ".devcontainer"))
       );
     });
   } catch {
@@ -16132,7 +16645,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
         target
       });
       if (target.kind === "linked") {
-        const workspaceEnv = (0, import_node_child_process31.spawnSync)(
+        const workspaceEnv = (0, import_node_child_process32.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "WORKSPACE"],
           { encoding: "utf-8", ...networkDockerOptions() }
@@ -16142,7 +16655,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
             `Workspace app container must expose WORKSPACE='${target.workspace}' (got '${workspaceEnv.stdout.trim() || "(empty)"}').`
           );
         }
-        const devrouterWorkspaceEnv = (0, import_node_child_process31.spawnSync)(
+        const devrouterWorkspaceEnv = (0, import_node_child_process32.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "DEVROUTER_WORKSPACE"],
           { encoding: "utf-8", ...networkDockerOptions() }
@@ -16153,7 +16666,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
           );
         }
       }
-      const gitCheck = (0, import_node_child_process31.spawnSync)(
+      const gitCheck = (0, import_node_child_process32.spawnSync)(
         "docker",
         [
           "exec",
@@ -16429,14 +16942,14 @@ function resolvePrimaryTarget(repoPath) {
 }
 function isPrimaryCheckout(repoPath) {
   try {
-    return import_node_fs36.default.statSync(import_node_path41.default.join(repoPath, ".git")).isDirectory();
+    return import_node_fs37.default.statSync(import_node_path42.default.join(repoPath, ".git")).isDirectory();
   } catch {
     return false;
   }
 }
 function openUrls(urls) {
   for (const url of urls) {
-    const opened = (0, import_node_child_process31.spawnSync)("open", [url], { encoding: "utf-8" });
+    const opened = (0, import_node_child_process32.spawnSync)("open", [url], { encoding: "utf-8" });
     if (opened.status !== 0) {
       process.stderr.write(`Warning: could not open '${url}'.
 `);
@@ -16466,6 +16979,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     let repairMutationStarted = false;
     let retainedRepairContainers = [];
     let environmentStarted = false;
+    let freshBootstrapPending = false;
     let managedPlan;
     let previousManagedState;
     let managedComposeProject;
@@ -16492,9 +17006,21 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       reportLifecycleProgress("validation");
       const target = options.repair ? resolveRepairTarget(repoPath, linked) : linked ? resolveLinkedTarget(repoPath) : resolvePrimaryTarget(repoPath);
       let devpodId = target.devpodId;
+      if (options.initializeNew) {
+        assertFreshBootstrapRequest(
+          {
+            repoPath,
+            workspace: target.workspace ?? null,
+            provider: resolveWorkspaceRuntimeOrDefault(repoPath)
+          },
+          options
+        );
+        devpodId ??= wsFromBranch(import_node_path42.default.basename(repoPath));
+        if (!devpodId) throw new Error("Fresh bootstrap requires an exact provider identifier.");
+      }
       if (target.kind === "linked") {
-        const overlayPath = import_node_path41.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
-        if (!import_node_fs36.default.existsSync(overlayPath)) {
+        const overlayPath = import_node_path42.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+        if (!import_node_fs37.default.existsSync(overlayPath)) {
           throw new Error(`Missing required DevPod compose overlay: ${overlayPath}`);
         }
       }
@@ -16604,7 +17130,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       }
       const apps = proxyAppsFromConfig(runtime.config);
       const parsedUpstreams = apps.map((app) => parseUpstream(app.upstream));
-      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path41.default.basename(repoPath)) ?? "app";
+      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path42.default.basename(repoPath)) ?? "app";
       for (const [index, app] of apps.entries()) {
         if (!parsedUpstreams[index].host.startsWith(`${aliasPrefix}-`)) {
           const owner = target.kind === "linked" ? "workspace" : "checkout";
@@ -16670,6 +17196,25 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         managedConfigWritten = true;
       }
       const upstreamHosts = parsedUpstreams.map((upstream) => upstream.host);
+      const freshBootstrap = options.initializeNew ? createFreshBootstrap({
+        identity: { repoPath, workspace: target.workspace ?? null, provider: "devsy" },
+        ...managedWorkspaceEnv ? { workspace: managedWorkspaceEnv } : {},
+        plan: () => {
+          if (!managedPlan) throw new Error("Fresh bootstrap requires a managed Compose plan.");
+          return managedPlan;
+        },
+        profile: runtime.profile,
+        variant,
+        apps: apps.map((app) => app.name),
+        processes: desiredProcesses,
+        ...hostPortDeclarationsSha256 !== void 0 ? { hostPortDeclarationsSha256 } : {},
+        onCaptured: (state, captured) => {
+          freshBootstrapPending = true;
+          capturedStopState = state;
+          managedContainer = captured;
+          managedComposeProject = state.composeProject;
+        }
+      }) : void 0;
       const currentTarget = () => target.kind === "linked" ? target : { ...target, devpodId };
       const startAndProveAttachment = async (recreate = false) => {
         reportLifecycleProgress("provider");
@@ -16682,6 +17227,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
             ...network ? { prepareNetwork: network.prepare } : {},
             recreate,
             quiet: options.quiet,
+            ...freshBootstrap ? { freshBootstrap } : {},
             ...requestedTarget.kind === "linked" ? {
               workspace: {
                 token: requestedTarget.workspace,
@@ -16690,6 +17236,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
             } : {}
           });
           environmentStarted = true;
+          freshBootstrapPending = false;
         } catch (error) {
           if (error instanceof DevpodStartPostconditionError) environmentStarted = true;
           throw error;
@@ -16730,7 +17277,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
               transitionPhase = "service-start";
               reportLifecycleProgress("service-start");
               claimLifecycleEffect();
-              const result = (0, import_node_child_process31.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
+              const result = (0, import_node_child_process32.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
                 ...networkDockerOptions(),
                 encoding: "utf-8",
                 timeout: DEFAULT_READINESS_TIMEOUT_MS,
@@ -17193,6 +17740,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           `${original} Reset candidate retained for recovery.${failures.length ? ` Recovery incomplete: ${failures.join("; ")}.` : " State is degraded."}`
         );
       }
+      if (freshBootstrapPending) throw error;
       if (options.repair && !repairMutationStarted) throw error;
       if (options.repair && repairMutationStarted && previousManagedState && managedPlan) {
         const failures = [];
@@ -17474,6 +18022,17 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
   return withLifecycleOperationLock(repoPath, async () => {
     preflightRuntimeVariant(repoPath, options);
     const preparationConfig = loadRepoConfig(repoPath);
+    if (options.repair) {
+      const workspace2 = linked ? readPersistedWorkspace(repoPath) : void 0;
+      if (linked && !workspace2) throw new Error("Repair requires an existing workspace identity.");
+      const retained2 = readManagedRuntimeState(repoPath, workspace2);
+      if (retained2?.status !== "degraded") {
+        const checkout = `'${repoPath.replaceAll("'", "'\\''")}'`;
+        throw new WorkspaceEnsureRefusalError(
+          `Repair requires a persisted degraded managed runtime. Inspect this checkout with: devrouter doctor --repo ${checkout} --json. Ordinary ensure may run repository startup hooks; verify their preservation contract before startup.`
+        );
+      }
+    }
     if (!options.repair)
       recoverUnattachedNetworkReservation(repoPath, Boolean(preparationConfig.managedRuntime));
     assertRetainedNetworkConfiguration({
@@ -17489,9 +18048,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     }
     const repairLocked = () => {
       const runtime = resolveWorkspaceRuntimeOrDefault(repoPath);
-      import_node_fs36.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+      import_node_fs37.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
       return withFileLock(
-        import_node_path41.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
+        import_node_path42.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
         {
           activity: "Managed runtime repair",
           target: repoPath,
@@ -17669,7 +18228,7 @@ function preflightRuntimeVariant(repoPath, options) {
   return variant;
 }
 function capacityPolicyTargets(repoPath) {
-  const policy = readCapacityPolicy(import_node_path42.default.join(DEVROUTER_HOME, "controller"));
+  const policy = readCapacityPolicy(import_node_path43.default.join(DEVROUTER_HOME, "controller"));
   return policy?.admissions === "enabled" && policy.enrollments.some((entry) => entry.repoPath === repoPath);
 }
 function clearActiveLifecycleStartupWitness() {
@@ -17679,6 +18238,40 @@ function clearActiveLifecycleStartupWitness() {
   if (record5?.startupWitness?.operationId !== request.operationId) return;
   clearStartupWitness(request.identity, reliabilityFence(record5.state));
 }
+function claimActiveFreshBootstrap(evidence) {
+  const request = activeWorker;
+  if (request?.kind !== "ensure" || request.options.initializeNew !== true || request.options.repair)
+    throw new Error("Fresh bootstrap requires an explicit initialization worker.");
+  claimLifecycleEffect();
+  return updateReliabilityOperation(request.identity, (record5) => {
+    if (!matchesFence(record5, request.fence) || record5.worker?.id !== request.workerId || record5.state.operation?.id !== request.operationId || record5.freshBootstrap)
+      throw new Error(
+        "Fresh-bootstrap authority is stale or already claimed; initialization was not retried."
+      );
+    record5.freshBootstrap = {
+      ...evidence,
+      version: 1,
+      operationId: request.operationId,
+      workerId: request.workerId,
+      runtimeGeneration: request.fence.runtimeGeneration,
+      stage: "claimed"
+    };
+    return structuredClone(record5.freshBootstrap);
+  });
+}
+function advanceActiveFreshBootstrap(stage, resources) {
+  const request = activeWorker;
+  if (request?.kind !== "ensure" || request.options.initializeNew !== true)
+    throw new Error("Fresh-bootstrap phase requires its initialization worker.");
+  claimLifecycleEffect();
+  updateReliabilityOperation(request.identity, (record5) => {
+    const attempt = record5.freshBootstrap;
+    if (!matchesFence(record5, request.fence) || record5.worker?.id !== request.workerId || attempt?.operationId !== request.operationId || attempt.workerId !== request.workerId || attempt.runtimeGeneration !== request.fence.runtimeGeneration)
+      throw new Error("Fresh-bootstrap attempt changed before its next phase.");
+    attempt.stage = stage;
+    if (resources !== void 0) attempt.resources = structuredClone(resources);
+  });
+}
 async function acquireWorkerLock(repoPath, operation) {
   const deadline = Date.now() + 3e4;
   for (; ; ) {
@@ -17775,7 +18368,7 @@ async function executeLifecycleWorker(request, operation) {
           const owned = containers.filter(
             (container) => sameWorkspacePath(
               container.labels["com.docker.compose.project.working_dir"] ?? "",
-              import_node_path42.default.join(request.repoPath, ".devcontainer")
+              import_node_path43.default.join(request.repoPath, ".devcontainer")
             )
           );
           const projects = owned.map((container) => container.labels["com.docker.compose.project"]);
@@ -17856,13 +18449,26 @@ function recordLifecycleUnknown(result) {
     if (result !== void 0) record5.result = result;
   });
 }
+function recordLifecycleRefusal(result) {
+  const request = activeWorker;
+  if (request?.kind !== "ensure") return;
+  updateReliabilityOperation(request.identity, (record5) => {
+    if (!matchesFence(record5, request.fence) || record5.worker?.id !== request.workerId || record5.state.operation?.id !== request.operationId || record5.state.operation.status !== "RUNNING")
+      return;
+    stepRecord(
+      record5,
+      request.options.repair && !cancelled && process.connected ? { ...request.fence, type: "completion", operationId: request.operationId, exitCode: 1 } : { ...request.fence, type: "interrupted", operationId: request.operationId }
+    );
+    record5.result = result;
+  });
+}
 function proveLifecycleStopped() {
   const request = activeWorker;
   if (request?.kind !== "stop")
     throw new Error("Full stop proof requires an explicit stop worker.");
   const settle = () => {
     claimLifecycleEffect();
-    if (initialStopAbsence && !(0, import_node_util8.isDeepStrictEqual)(
+    if (initialStopAbsence && !(0, import_node_util9.isDeepStrictEqual)(
       proveInitialManagedDevsyAbsence(request.repoPath, initialStopAbsence.record.devpodId),
       initialStopAbsence
     ))
@@ -17882,7 +18488,7 @@ function proveLifecycleStopped() {
       const remaining = inspectWorkspaceContainers().filter(
         (container) => sameWorkspacePath(
           container.labels["com.docker.compose.project.working_dir"] ?? "",
-          import_node_path42.default.join(request.repoPath, ".devcontainer")
+          import_node_path43.default.join(request.repoPath, ".devcontainer")
         )
       );
       if (remaining.some(
@@ -17912,7 +18518,7 @@ function proveLifecycleStopped() {
       return void 0;
     });
     if (settlement) {
-      const capacity = createLifecycleCapacityStore(import_node_path42.default.join(DEVROUTER_HOME, "controller"));
+      const capacity = createLifecycleCapacityStore(import_node_path43.default.join(DEVROUTER_HOME, "controller"));
       for (let attempt = 0; ; attempt++) {
         try {
           const state = capacity.inspect();
@@ -17991,7 +18597,7 @@ async function devsyExecOutcome(repoPath, command, retainedProof) {
         const launch = () => {
           if (retainedProof) revalidateDevsyExecProof(repoPath, retainedProof);
           claimLifecycleEffect();
-          return (0, import_node_child_process32.spawn)("devsy", args, { stdio: "inherit" });
+          return (0, import_node_child_process33.spawn)("devsy", args, { stdio: "inherit" });
         };
         child = retainedProof ? withMutationLock("Execute retained workspace", repoPath, launch) : launch();
       } catch (error) {
@@ -18039,7 +18645,7 @@ function ensureGuidance2(repoPath) {
   return `Run 'devrouter ensure ${repoPath}' first.`;
 }
 function assertRunningDevpod(devpodId, repoPath) {
-  const result = (0, import_node_child_process33.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
+  const result = (0, import_node_child_process34.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -18086,7 +18692,7 @@ async function devpodExecOutcome(repoPath, command) {
     }
     assertRunningDevpod(devpod.id, repoPath);
     const workspaceDirectory = resolveWorkspaceDirectory(repoPath);
-    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto25.randomUUID)()}__:`;
+    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto26.randomUUID)()}__:`;
     const statusMarkerBytes = Buffer.from(statusMarker, "ascii");
     const literalCommand = command.map(quotePosixArg).join(" ");
     const wrappedCommand = `${literalCommand}; __devrouter_status=$?; printf '${statusMarker}%s\\n' "$__devrouter_status" >&2; exit 0`;
@@ -18218,7 +18824,7 @@ async function devpodExecOutcome(repoPath, command) {
       let child;
       try {
         claimLifecycleEffect();
-        child = (0, import_node_child_process33.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
+        child = (0, import_node_child_process34.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
       } catch (error) {
         settled = true;
         reject(
@@ -18275,12 +18881,12 @@ async function devpodExecOutcome(repoPath, command) {
 }
 
 // src/core/workspace-lifecycle.ts
-var import_node_child_process34 = require("child_process");
-var import_node_fs38 = __toESM(require("fs"));
-var import_node_path43 = __toESM(require("path"));
+var import_node_child_process35 = require("child_process");
+var import_node_fs39 = __toESM(require("fs"));
+var import_node_path44 = __toESM(require("path"));
 
 // src/core/route-state.ts
-var import_node_fs37 = __toESM(require("fs"));
+var import_node_fs38 = __toESM(require("fs"));
 function listRoutesForWorktreePath(worktreePath, routes = listHostRouteState()) {
   return routes.filter((route) => sameWorkspacePath(route.repoPath, worktreePath));
 }
@@ -18516,6 +19122,7 @@ process.once("message", async (message) => {
         message: error instanceof Error ? error.message : String(error)
       };
       if (error instanceof ExecutionOutcomeError) recordLifecycleOutcome(error.outcome, failure);
+      else if (error instanceof WorkspaceEnsureRefusalError) recordLifecycleRefusal(failure);
       else recordLifecycleUnknown(failure);
     } catch {
     }