@devrouter/cli 0.6.1 → 0.6.3

package/dist/devrouter.js

@@ -4033,7 +4033,7 @@ function parseManagedRuntime(value, configPath) {
   );
   ensureAllowedKeys2(
     devcontainer,
-    ["baseServices", "profileServices", "prepareCommand", "hostPorts"],
+    ["baseServices", "profileServices", "prepareCommand", "hostPorts", "freshBootstrap"],
     `${configPath}.managedRuntime.devcontainer`
   );
   const baseServices = parseRequiredUniqueStringArray(
@@ -4048,6 +4048,23 @@ function parseManagedRuntime(value, configPath) {
     devcontainer.prepareCommand,
     `${configPath}.managedRuntime.devcontainer.prepareCommand`
   );
+  let freshBootstrap;
+  if (devcontainer.freshBootstrap !== void 0) {
+    const label2 = `${configPath}.managedRuntime.devcontainer.freshBootstrap`;
+    const raw = ensureObject2(devcontainer.freshBootstrap, label2);
+    ensureAllowedKeys2(raw, ["command", "dataVolumes", "sharedCaches"], label2);
+    const command = parsePrepareCommand(raw.command, `${label2}.command`);
+    if (!command) throw new Error(`${label2}.command is required.`);
+    const dataVolumes = parseRequiredUniqueStringArray(raw.dataVolumes, `${label2}.dataVolumes`);
+    const sharedCaches = raw.sharedCaches === void 0 ? [] : parseRequiredUniqueStringArray(raw.sharedCaches, `${label2}.sharedCaches`);
+    if (dataVolumes.length === 0 || dataVolumes.length + sharedCaches.length > 64)
+      throw new Error(`${label2} requires data volumes and at most 64 volume bindings.`);
+    if ([...dataVolumes, ...sharedCaches].some(
+      (key) => !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(key)
+    ) || dataVolumes.some((key) => sharedCaches.includes(key)))
+      throw new Error(`${label2} requires distinct exact data-volume and shared-cache keys.`);
+    freshBootstrap = { command, dataVolumes, sharedCaches };
+  }
   const baseSet = new Set(baseServices);
   const overlappingServices = profileServices.filter((service) => baseSet.has(service));
   if (overlappingServices.length > 0) {
@@ -4109,7 +4126,8 @@ function parseManagedRuntime(value, configPath) {
       baseServices,
       profileServices,
       ...prepareCommand ? { prepareCommand } : {},
-      ...hostPorts !== void 0 ? { hostPorts } : {}
+      ...hostPorts !== void 0 ? { hostPorts } : {},
+      ...freshBootstrap ? { freshBootstrap } : {}
     },
     processes
   };
@@ -4880,7 +4898,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs8.default.read
   const config = parseRepoConfigSource(raw, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.6.1" : "0.0.0-dev";
+    const cliVersion = true ? "0.6.3" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -7153,7 +7171,7 @@ var init_reliability_contract = __esm({
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.6.1" : "0.0.0-dev";
+  return true ? "0.6.3" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -7294,6 +7312,7 @@ function validate2(record6, identity2) {
     "state",
     "worker",
     "stopWorkStarted",
+    "freshBootstrap",
     "effectSequence",
     "outcome",
     "result",
@@ -7311,6 +7330,47 @@ function validate2(record6, identity2) {
   ]);
   validateConsumerProtection(record6);
   validateIdleProtection(record6);
+  if (record6.freshBootstrap !== void 0) {
+    const attempt = record6.freshBootstrap;
+    keys(attempt, [
+      "version",
+      "operationId",
+      "workerId",
+      "runtimeGeneration",
+      "sourceSha256",
+      "providerId",
+      "providerContext",
+      "definitionSha256",
+      "endpoint",
+      "daemonId",
+      "previousVolumeNameDigests",
+      "stage",
+      "resources"
+    ]);
+    const digest5 = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+    const exact = (value) => typeof value === "string" && /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(value);
+    if (attempt.version !== 1 || !isReliabilityId(attempt.operationId) || !isReliabilityId(attempt.workerId) || !isReliabilityCounter(attempt.runtimeGeneration) || !digest5(attempt.sourceSha256) || !digest5(attempt.definitionSha256) || !exact(attempt.providerId) || !exact(attempt.providerContext) || typeof attempt.endpoint !== "string" || !attempt.endpoint.startsWith("unix:///") || attempt.endpoint.includes("\0") || typeof attempt.daemonId !== "string" || attempt.daemonId.length === 0 || attempt.daemonId.length > 256 || !["claimed", "provisioned", "initializing", "initialized", "ready", "failed"].includes(
+      attempt.stage
+    ) || !Array.isArray(attempt.previousVolumeNameDigests) || attempt.previousVolumeNameDigests.length > 4096 || !attempt.previousVolumeNameDigests.every(digest5) || new Set(attempt.previousVolumeNameDigests).size !== attempt.previousVolumeNameDigests.length)
+      throw new Error("Invalid durable fresh-bootstrap attempt.");
+    if (attempt.resources !== void 0) {
+      const resources = attempt.resources;
+      keys(resources, ["primaryId", "project", "dataVolumes"]);
+      if (!digest5(resources.primaryId) || !exact(resources.project) || !Array.isArray(resources.dataVolumes) || resources.dataVolumes.length === 0 || resources.dataVolumes.length > 64)
+        throw new Error("Invalid fresh-bootstrap resource binding.");
+      const names = /* @__PURE__ */ new Set();
+      const bindings2 = /* @__PURE__ */ new Set();
+      for (const volume of resources.dataVolumes) {
+        keys(volume, ["key", "name", "createdAt", "mountpoint"]);
+        if (!exact(volume.key) || typeof volume.name !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,255}$/.test(volume.name) || names.has(volume.name) || bindings2.has(volume.key) || typeof volume.createdAt !== "string" || !Number.isFinite(Date.parse(volume.createdAt)) || typeof volume.mountpoint !== "string" || !import_node_path16.default.isAbsolute(volume.mountpoint) || volume.mountpoint.includes("\0"))
+          throw new Error("Invalid fresh-bootstrap data-volume binding.");
+        names.add(volume.name);
+        bindings2.add(volume.key);
+      }
+    } else if (["provisioned", "initializing", "initialized", "ready"].includes(attempt.stage)) {
+      throw new Error("Fresh-bootstrap phase requires proven resource bindings.");
+    }
+  }
   if (record6.writtenByVersion !== void 0 && compareCliVersions(record6.writtenByVersion, installedCliVersion()) > 0) {
     throw new Error(
       `Reliability record was last written by devrouter ${record6.writtenByVersion}, which is newer than the installed ${installedCliVersion()}; upgrade devrouter (devrouter upgrade) before running lifecycle commands.`
@@ -7775,10 +7835,30 @@ function updateReliabilityOperation(identity2, operation) {
     const previousEnrollment = record6.enrollment && { ...record6.enrollment };
     const previousProtection = structuredClone(record6.consumerProtection);
     const previousIdleProtection = structuredClone(record6.idleProtection);
+    const previousBootstrap = structuredClone(record6.freshBootstrap);
     const result = operation(record6);
     if (result && typeof result.then === "function") {
       throw new Error("Reliability record updates must be synchronous.");
     }
+    if (previousBootstrap && !(0, import_node_util3.isDeepStrictEqual)(previousBootstrap, record6.freshBootstrap)) {
+      const current = record6.freshBootstrap;
+      const {
+        stage: previousStage,
+        resources: previousResources,
+        ...previousIdentity
+      } = previousBootstrap;
+      const { stage, resources, ...currentIdentity } = current ?? {};
+      const next = {
+        claimed: ["provisioned", "failed"],
+        provisioned: ["initializing", "failed"],
+        initializing: ["initialized", "failed"],
+        initialized: ["ready"],
+        ready: [],
+        failed: []
+      };
+      if (!current || !(0, import_node_util3.isDeepStrictEqual)(previousIdentity, currentIdentity) || !next[previousStage].includes(stage ?? "") || previousResources && !(0, import_node_util3.isDeepStrictEqual)(previousResources, resources))
+        throw new Error("Durable fresh-bootstrap attempt cannot be cleared, replaced or rearmed.");
+    }
     if (record6.version < previousVersion || previousEnrollment && !(0, import_node_util3.isDeepStrictEqual)(record6.enrollment, previousEnrollment))
       throw new Error("Durable capacity enrollment cannot be downgraded or replaced.");
     if (!(0, import_node_util3.isDeepStrictEqual)(record6.consumerProtection, previousProtection))
@@ -8936,13 +9016,15 @@ function parseControllerRequest(input2) {
           input2,
           "operation-submit",
           ["session", "store", "epoch", "generation", "requestId", "kind"],
-          ["operation", "command"]
+          ["operation", "command", "initializeNew"]
         );
         const kind = input2.kind;
         if (kind !== "ensure" && kind !== "exec") invalidRequest();
         const operation = optionalString(input2, "operation", parseId);
         if (kind === "ensure") {
           if (Object.hasOwn(input2, "command")) invalidRequest();
+          if (Object.hasOwn(input2, "initializeNew") && input2.initializeNew !== true)
+            invalidRequest();
           return {
             ...header,
             session: parseId(input2.session),
@@ -8951,10 +9033,12 @@ function parseControllerRequest(input2) {
             generation: parseId(input2.generation),
             requestId: parseId(input2.requestId),
             kind,
-            ...operation === void 0 ? {} : { operation }
+            ...operation === void 0 ? {} : { operation },
+            ...input2.initializeNew === true ? { initializeNew: true } : {}
           };
         }
-        if (!Object.hasOwn(input2, "command")) invalidRequest();
+        if (!Object.hasOwn(input2, "command") || Object.hasOwn(input2, "initializeNew"))
+          invalidRequest();
         return {
           ...header,
           session: parseId(input2.session),
@@ -14923,12 +15007,113 @@ var init_devsy_mutation = __esm({
   }
 });
 
+// src/core/lifecycle-progress.ts
+function isLifecycleProgressPhase(value) {
+  return typeof value === "string" && Object.hasOwn(ROLES, value);
+}
+function muteLifecycleProgressHeartbeat() {
+  heartbeatMuted = true;
+}
+function lifecycleProgressHeartbeatMuted() {
+  return heartbeatMuted;
+}
+function lifecycleProgressSnapshot(phase, receivedAt, now) {
+  const elapsedMs = receivedAt === void 0 ? null : Math.max(0, Math.floor(now - receivedAt));
+  return {
+    type: "lifecycle-progress",
+    phase: phase ?? "unknown",
+    role: phase ? ROLES[phase] : "unknown",
+    elapsedMs,
+    evidence: elapsedMs === null ? "unknown" : elapsedMs >= 3e4 ? "stale" : "recent",
+    liveness: "unknown"
+  };
+}
+var ROLES, heartbeatMuted;
+var init_lifecycle_progress = __esm({
+  "src/core/lifecycle-progress.ts"() {
+    "use strict";
+    ROLES = {
+      validation: "lifecycle-worker",
+      preparation: "repository-preparation",
+      "fresh-bootstrap": "repository-fresh-bootstrap",
+      provider: "provider-operation",
+      "service-start": "service-reconciliation",
+      "service-stop": "service-reconciliation",
+      "process-start": "repository-process-adapter",
+      "process-stop": "repository-process-adapter",
+      "route-publication": "lifecycle-worker",
+      "route-removal": "lifecycle-worker",
+      readiness: "lifecycle-worker",
+      rollback: "lifecycle-worker",
+      stop: "lifecycle-stop"
+    };
+    heartbeatMuted = false;
+  }
+});
+
+// src/core/managed-fresh-bootstrap.ts
+function object4(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function qualifiedContext(source) {
+  if (source.userEnvProbe !== void 0 && source.userEnvProbe !== "loginInteractiveShell" || object4(source.remoteEnv) && Object.hasOwn(source.remoteEnv, "PATH") || object4(source.secrets) && Object.keys(source.secrets).length > 0 || object4(source.features) && Object.keys(source.features).length > 0 || source.onCreateCommand || source.updateContentCommand)
+    throw new Error(
+      "Fresh bootstrap requires a qualified default-probe context without PATH overrides, secrets, features or earlier container hooks."
+    );
+  if (source.postStartCommand && !["postStartCommand", "postAttachCommand"].includes(String(source.waitFor)))
+    throw new Error("Fresh bootstrap requires waitFor to include the declared post-start hook.");
+}
+function assertFreshBootstrapRequest(identity2, options) {
+  if (!options.initializeNew) return;
+  if (identity2.provider !== "devsy" || options.repair)
+    throw new Error(
+      "--initialize-new requires a fresh Devsy managed environment without --repair."
+    );
+  if (!loadRepoConfig(identity2.repoPath).managedRuntime?.devcontainer.freshBootstrap)
+    throw new Error("--initialize-new requires managedRuntime.devcontainer.freshBootstrap.");
+  if (readReliabilityOperation(identity2)?.freshBootstrap)
+    throw new Error(
+      "This environment already records an initialization attempt; initialization cannot be replayed. Use preserving recovery or a new disposable checkout."
+    );
+  if (readManagedRuntimeState(identity2.repoPath, identity2.workspace ?? void 0) || selectDevsyWorkspace(listDevsyWorkspaces(), identity2.repoPath))
+    throw new Error("Fresh bootstrap refuses a retained runtime or provider registration.");
+  qualifiedContext(readDevcontainerConfig(identity2.repoPath).source);
+}
+var import_node_child_process20, import_node_crypto18, import_node_fs31, import_node_os6, import_node_path39, import_node_util11, import_yaml4;
+var init_managed_fresh_bootstrap = __esm({
+  "src/core/managed-fresh-bootstrap.ts"() {
+    "use strict";
+    import_node_child_process20 = require("child_process");
+    import_node_crypto18 = require("crypto");
+    import_node_fs31 = __toESM(require("fs"));
+    import_node_os6 = __toESM(require("os"));
+    import_node_path39 = __toESM(require("path"));
+    import_node_util11 = require("util");
+    import_yaml4 = __toESM(require("yaml"));
+    init_devcontainer_config();
+    init_devcontainer_profile();
+    init_devpod_environment();
+    init_devsy_agent();
+    init_devsy_exec_proof();
+    init_devsy_workspaces();
+    init_lifecycle_progress();
+    init_managed_runtime_state();
+    init_managed_stop_recovery();
+    init_network_provider_binding();
+    init_network_provider_inspect();
+    init_reliability_lifecycle();
+    init_reliability_operation_store();
+    init_repo_config();
+    init_workspace();
+  }
+});
+
 // src/core/managed-host-ports.ts
 function unavailableEntry(declaration, reason2) {
   return { ...declaration, status: "unavailable", reason: reason2 };
 }
 function livePublishedBindings(containerId, target) {
-  const result = (0, import_node_child_process20.spawnSync)("docker", ["port", containerId, `${target}/tcp`], {
+  const result = (0, import_node_child_process21.spawnSync)("docker", ["port", containerId, `${target}/tcp`], {
     encoding: "utf-8",
     timeout: PORT_LOOKUP_TIMEOUT_MS,
     maxBuffer: PORT_LOOKUP_MAX_BUFFER,
@@ -15068,7 +15253,7 @@ function managedHostPortDeclarationsIdentity(declarations) {
   const keys2 = Object.keys(declarations).sort();
   if (keys2.length === 0) return void 0;
   const canonical = keys2.map((key) => [key, declarations[key].service, declarations[key].target]);
-  return (0, import_node_crypto18.createHash)("sha256").update(JSON.stringify(canonical)).digest("hex");
+  return (0, import_node_crypto19.createHash)("sha256").update(JSON.stringify(canonical)).digest("hex");
 }
 function assertManagedHostPortsAvailable(report) {
   const unavailable = Object.entries(report).filter(([, entry]) => entry.status === "unavailable").map(([key]) => key).sort();
@@ -15076,12 +15261,12 @@ function assertManagedHostPortsAvailable(report) {
     throw new Error(`Selected managed host ports are unavailable: ${unavailable.join(", ")}.`);
   }
 }
-var import_node_child_process20, import_node_crypto18, PORT_LOOKUP_TIMEOUT_MS, PORT_LOOKUP_MAX_BUFFER, LOOPBACK_BINDING;
+var import_node_child_process21, import_node_crypto19, PORT_LOOKUP_TIMEOUT_MS, PORT_LOOKUP_MAX_BUFFER, LOOPBACK_BINDING;
 var init_managed_host_ports = __esm({
   "src/core/managed-host-ports.ts"() {
     "use strict";
-    import_node_child_process20 = require("child_process");
-    import_node_crypto18 = require("crypto");
+    import_node_child_process21 = require("child_process");
+    import_node_crypto19 = require("crypto");
     init_devpod_environment();
     init_network_effect_scope();
     PORT_LOOKUP_TIMEOUT_MS = 1e4;
@@ -15092,21 +15277,21 @@ var init_managed_host_ports = __esm({
 
 // src/core/managed-post-start.ts
 function readRegularFileBytes(filePath) {
-  if (!import_node_fs31.default.existsSync(filePath) || !import_node_fs31.default.lstatSync(filePath).isFile()) return void 0;
-  return import_node_fs31.default.readFileSync(filePath);
+  if (!import_node_fs32.default.existsSync(filePath) || !import_node_fs32.default.lstatSync(filePath).isFile()) return void 0;
+  return import_node_fs32.default.readFileSync(filePath);
 }
 function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
 }
 function adapterFingerprint(adapter) {
-  return (0, import_node_crypto19.createHash)("sha256").update(adapter).digest("hex");
+  return (0, import_node_crypto20.createHash)("sha256").update(adapter).digest("hex");
 }
 function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path39.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterPath = import_node_path40.default.join(repoPath, MANAGED_ADAPTER_PATH);
   const adapterBytes = readRegularFileBytes(adapterPath);
   const adapterText = adapterBytes?.toString("utf-8");
-  const dockerfilePath = import_node_path39.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path39.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfilePath = import_node_path40.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path40.default.join(repoPath, ".devcontainer", "devcontainer.json");
   const dockerfile = readRegularFile(dockerfilePath) ?? "";
   const devcontainer = readRegularFile(devcontainerPath) ?? "";
   const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
@@ -15152,7 +15337,7 @@ function assertSafeProcessName(name) {
 }
 function runManagedProcessAction(options) {
   assertSafeProcessName(options.name);
-  const result = (0, import_node_child_process21.spawnSync)(
+  const result = (0, import_node_child_process22.spawnSync)(
     "docker",
     [
       "exec",
@@ -15189,14 +15374,14 @@ function runManagedProcessAction(options) {
   }
   return "drifted";
 }
-var import_node_child_process21, import_node_crypto19, import_node_fs31, import_node_path39, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH;
+var import_node_child_process22, import_node_crypto20, import_node_fs32, import_node_path40, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH;
 var init_managed_post_start = __esm({
   "src/core/managed-post-start.ts"() {
     "use strict";
-    import_node_child_process21 = require("child_process");
-    import_node_crypto19 = require("crypto");
-    import_node_fs31 = __toESM(require("fs"));
-    import_node_path39 = __toESM(require("path"));
+    import_node_child_process22 = require("child_process");
+    import_node_crypto20 = require("crypto");
+    import_node_fs32 = __toESM(require("fs"));
+    import_node_path40 = __toESM(require("path"));
     init_devcontainer_config();
     init_managed_host_ports();
     init_network_effect_scope();
@@ -16060,80 +16245,37 @@ var init_reliability_model = __esm({
   }
 });
 
-// src/core/lifecycle-progress.ts
-function isLifecycleProgressPhase(value) {
-  return typeof value === "string" && Object.hasOwn(ROLES, value);
-}
-function muteLifecycleProgressHeartbeat() {
-  heartbeatMuted = true;
-}
-function lifecycleProgressHeartbeatMuted() {
-  return heartbeatMuted;
-}
-function lifecycleProgressSnapshot(phase, receivedAt, now) {
-  const elapsedMs = receivedAt === void 0 ? null : Math.max(0, Math.floor(now - receivedAt));
-  return {
-    type: "lifecycle-progress",
-    phase: phase ?? "unknown",
-    role: phase ? ROLES[phase] : "unknown",
-    elapsedMs,
-    evidence: elapsedMs === null ? "unknown" : elapsedMs >= 3e4 ? "stale" : "recent",
-    liveness: "unknown"
-  };
-}
-var ROLES, heartbeatMuted;
-var init_lifecycle_progress = __esm({
-  "src/core/lifecycle-progress.ts"() {
-    "use strict";
-    ROLES = {
-      validation: "lifecycle-worker",
-      preparation: "repository-preparation",
-      provider: "provider-operation",
-      "service-start": "service-reconciliation",
-      "service-stop": "service-reconciliation",
-      "process-start": "repository-process-adapter",
-      "process-stop": "repository-process-adapter",
-      "route-publication": "lifecycle-worker",
-      "route-removal": "lifecycle-worker",
-      readiness: "lifecycle-worker",
-      rollback: "lifecycle-worker",
-      stop: "lifecycle-stop"
-    };
-    heartbeatMuted = false;
-  }
-});
-
 // src/core/lifecycle-diagnostics.ts
 function privateDirectory(directory) {
-  const stat = import_node_fs32.default.lstatSync(directory);
+  const stat = import_node_fs33.default.lstatSync(directory);
   return stat.isDirectory() && stat.uid === process.getuid?.() && (stat.mode & 63) === 0;
 }
 function lifecycleDiagnosticsPath(identity2) {
-  return import_node_path40.default.join(
+  return import_node_path41.default.join(
     DEVROUTER_HOME,
     "lifecycle-diagnostics",
-    `${(0, import_node_crypto20.createHash)("sha256").update(identity2.repoPath).digest("hex")}.json`
+    `${(0, import_node_crypto21.createHash)("sha256").update(identity2.repoPath).digest("hex")}.json`
   );
 }
 function readReceipt(identity2) {
   let descriptor;
   try {
     const file = lifecycleDiagnosticsPath(identity2);
-    if (!privateDirectory(import_node_path40.default.dirname(file))) return void 0;
-    descriptor = import_node_fs32.default.openSync(
+    if (!privateDirectory(import_node_path41.default.dirname(file))) return void 0;
+    descriptor = import_node_fs33.default.openSync(
       file,
-      import_node_fs32.default.constants.O_RDONLY | import_node_fs32.default.constants.O_NOFOLLOW | import_node_fs32.default.constants.O_NONBLOCK
+      import_node_fs33.default.constants.O_RDONLY | import_node_fs33.default.constants.O_NOFOLLOW | import_node_fs33.default.constants.O_NONBLOCK
     );
-    const stat = import_node_fs32.default.fstatSync(descriptor);
+    const stat = import_node_fs33.default.fstatSync(descriptor);
     if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0 || stat.size > MAX_RECEIPT_BYTES)
       return void 0;
     const buffer = Buffer.alloc(MAX_RECEIPT_BYTES + 1);
-    const size = import_node_fs32.default.readSync(descriptor, buffer, 0, buffer.length, 0);
+    const size = import_node_fs33.default.readSync(descriptor, buffer, 0, buffer.length, 0);
     if (size > MAX_RECEIPT_BYTES) return void 0;
     const receipt = JSON.parse(buffer.subarray(0, size).toString("utf8"));
     const timestamp = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
     const optionalTime = (value) => value === null || timestamp(value);
-    if (receipt.version !== 1 || !(0, import_node_util11.isDeepStrictEqual)(receipt.identity, identity2) || typeof receipt.operationId !== "string" || typeof receipt.workerId !== "string" || !timestamp(receipt.startedAtMs) || !timestamp(receipt.updatedAtMs) || receipt.updatedAtMs < receipt.startedAtMs || !(receipt.phase === null || isLifecycleProgressPhase(receipt.phase)) || !optionalTime(receipt.phaseAtMs) || !optionalTime(receipt.lastOutputAtMs) || !optionalTime(receipt.lastProgressAtMs) || !(receipt.buildPackage === null || typeof receipt.buildPackage === "string" && receipt.buildPackage.length <= 128 && /^(?:@[a-zA-Z0-9_.-]+\/)?[a-zA-Z0-9_.-]+$/.test(receipt.buildPackage)) || typeof receipt.cancellationRequested !== "boolean" || typeof receipt.closed !== "boolean" || !Array.isArray(receipt.output) || receipt.output.length > 64)
+    if (receipt.version !== 1 || !(0, import_node_util12.isDeepStrictEqual)(receipt.identity, identity2) || typeof receipt.operationId !== "string" || typeof receipt.workerId !== "string" || !timestamp(receipt.startedAtMs) || !timestamp(receipt.updatedAtMs) || receipt.updatedAtMs < receipt.startedAtMs || !(receipt.phase === null || isLifecycleProgressPhase(receipt.phase)) || !optionalTime(receipt.phaseAtMs) || !optionalTime(receipt.lastOutputAtMs) || !optionalTime(receipt.lastProgressAtMs) || !(receipt.buildPackage === null || typeof receipt.buildPackage === "string" && receipt.buildPackage.length <= 128 && /^(?:@[a-zA-Z0-9_.-]+\/)?[a-zA-Z0-9_.-]+$/.test(receipt.buildPackage)) || typeof receipt.cancellationRequested !== "boolean" || typeof receipt.closed !== "boolean" || !Array.isArray(receipt.output) || receipt.output.length > 64)
       return void 0;
     let bytes2 = 0;
     for (const chunk of receipt.output) {
@@ -16145,7 +16287,7 @@ function readReceipt(identity2) {
   } catch {
     return void 0;
   } finally {
-    if (descriptor !== void 0) import_node_fs32.default.closeSync(descriptor);
+    if (descriptor !== void 0) import_node_fs33.default.closeSync(descriptor);
   }
 }
 function readLifecycleDiagnostics(identity2, now = Date.now()) {
@@ -16153,7 +16295,7 @@ function readLifecycleDiagnostics(identity2, now = Date.now()) {
     const before = readReliabilityOperation(identity2);
     const receipt = readReceipt(identity2);
     const after = readReliabilityOperation(identity2);
-    if (!before || !after || !receipt || before.revision !== after.revision || !(0, import_node_util11.isDeepStrictEqual)(before, after) || !(0, import_node_util11.isDeepStrictEqual)(receipt.fence, reliabilityFence(after.state)) || after.state.operation?.id !== receipt.operationId || after.state.operation.kind !== "ensure" || after.worker !== null && after.worker.id !== receipt.workerId || !receipt.closed && !after.worker || now < receipt.updatedAtMs || [receipt.phaseAtMs, receipt.lastOutputAtMs, receipt.lastProgressAtMs].some(
+    if (!before || !after || !receipt || before.revision !== after.revision || !(0, import_node_util12.isDeepStrictEqual)(before, after) || !(0, import_node_util12.isDeepStrictEqual)(receipt.fence, reliabilityFence(after.state)) || after.state.operation?.id !== receipt.operationId || after.state.operation.kind !== "ensure" || after.worker !== null && after.worker.id !== receipt.workerId || !receipt.closed && !after.worker || now < receipt.updatedAtMs || [receipt.phaseAtMs, receipt.lastOutputAtMs, receipt.lastProgressAtMs].some(
       (time) => time !== null && (time < receipt.startedAtMs || time > receipt.updatedAtMs)
     ))
       return void 0;
@@ -16183,14 +16325,14 @@ function readLifecycleDiagnostics(identity2, now = Date.now()) {
     return void 0;
   }
 }
-var import_node_crypto20, import_node_fs32, import_node_path40, import_node_util11, MAX_TAIL_BYTES, MAX_RECEIPT_BYTES, PACKAGE_TASK, LifecycleDiagnosticRecorder;
+var import_node_crypto21, import_node_fs33, import_node_path41, import_node_util12, MAX_TAIL_BYTES, MAX_RECEIPT_BYTES, PACKAGE_TASK, LifecycleDiagnosticRecorder;
 var init_lifecycle_diagnostics = __esm({
   "src/core/lifecycle-diagnostics.ts"() {
     "use strict";
-    import_node_crypto20 = require("crypto");
-    import_node_fs32 = __toESM(require("fs"));
-    import_node_path40 = __toESM(require("path"));
-    import_node_util11 = require("util");
+    import_node_crypto21 = require("crypto");
+    import_node_fs33 = __toESM(require("fs"));
+    import_node_path41 = __toESM(require("path"));
+    import_node_util12 = require("util");
     init_atomic_file();
     init_lifecycle_progress();
     init_reliability_contract();
@@ -16242,7 +16384,7 @@ var init_lifecycle_diagnostics = __esm({
         const lines = text6.split(/[\r\n]/);
         this.fragments[stream] = (lines.pop() ?? "").slice(-4096);
         for (const raw of lines) {
-          const line = (0, import_node_util11.stripVTControlCharacters)(raw).trim();
+          const line = (0, import_node_util12.stripVTControlCharacters)(raw).trim();
           if (!line || line === this.lastLine || [...line].some(
             (character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127
           ) || line.startsWith('{"type":"lifecycle-progress"'))
@@ -16271,7 +16413,7 @@ var init_lifecycle_diagnostics = __esm({
         this.pending = void 0;
         try {
           const record6 = readReliabilityOperation(this.request.identity);
-          if (!record6 || record6.state.operation?.id !== this.request.operationId || !(0, import_node_util11.isDeepStrictEqual)(reliabilityFence(record6.state), this.request.fence) || record6.worker && record6.worker.id !== this.request.workerId)
+          if (!record6 || record6.state.operation?.id !== this.request.operationId || !(0, import_node_util12.isDeepStrictEqual)(reliabilityFence(record6.state), this.request.fence) || record6.worker && record6.worker.id !== this.request.workerId)
             return;
           let remaining = MAX_TAIL_BYTES;
           const chunks = [];
@@ -16284,8 +16426,8 @@ var init_lifecycle_diagnostics = __esm({
           this.receipt.output = chunks;
           this.receipt.updatedAtMs = Date.now();
           const file = lifecycleDiagnosticsPath(this.request.identity);
-          import_node_fs32.default.mkdirSync(import_node_path40.default.dirname(file), { recursive: true, mode: 448 });
-          if (!privateDirectory(import_node_path40.default.dirname(file))) return;
+          import_node_fs33.default.mkdirSync(import_node_path41.default.dirname(file), { recursive: true, mode: 448 });
+          if (!privateDirectory(import_node_path41.default.dirname(file))) return;
           writeFileAtomically(file, `${JSON.stringify(this.receipt)}
 `);
         } catch {
@@ -16318,11 +16460,11 @@ function workerGroupAbsent(pid) {
   if (process.platform !== "linux") return false;
   let observedZombie = false;
   try {
-    for (const entry of import_node_fs33.default.readdirSync("/proc")) {
+    for (const entry of import_node_fs34.default.readdirSync("/proc")) {
       if (!/^\d+$/.test(entry)) continue;
       let stat;
       try {
-        stat = import_node_fs33.default.readFileSync(`/proc/${entry}/stat`, "utf8");
+        stat = import_node_fs34.default.readFileSync(`/proc/${entry}/stat`, "utf8");
       } catch (error) {
         if (error.code === "ENOENT") continue;
         return false;
@@ -16353,10 +16495,10 @@ async function runLifecycleWorker(request2, supervision, beforeAdmission) {
     throw new Error("Lifecycle invocation was cancelled before dispatch.");
   if (process.platform === "win32")
     throw new Error("Lifecycle workers require POSIX process-group ownership.");
-  const workerPath = import_node_path41.default.join(__dirname, "devrouter-lifecycle-worker.js");
-  if (!import_node_fs33.default.existsSync(workerPath))
+  const workerPath = import_node_path42.default.join(__dirname, "devrouter-lifecycle-worker.js");
+  if (!import_node_fs34.default.existsSync(workerPath))
     throw new Error("The packaged lifecycle worker is missing; rebuild the CLI.");
-  const child = (0, import_node_child_process22.fork)(workerPath, [], {
+  const child = (0, import_node_child_process23.fork)(workerPath, [], {
     detached: true,
     stdio: supervision ? ["ignore", "pipe", "pipe", "ipc"] : request2.kind === "ensure" ? ["inherit", "pipe", "pipe", "ipc"] : ["inherit", "inherit", "inherit", "ipc"],
     execArgv: []
@@ -16645,16 +16787,16 @@ async function runLifecycleWorker(request2, supervision, beforeAdmission) {
   }
 }
 function newLifecycleIds() {
-  return { requestId: (0, import_node_crypto21.randomUUID)(), operationId: (0, import_node_crypto21.randomUUID)(), workerId: (0, import_node_crypto21.randomUUID)() };
+  return { requestId: (0, import_node_crypto22.randomUUID)(), operationId: (0, import_node_crypto22.randomUUID)(), workerId: (0, import_node_crypto22.randomUUID)() };
 }
-var import_node_child_process22, import_node_crypto21, import_node_fs33, import_node_path41, OUTPUT_BUFFER_LIMIT, DEFAULT_OUTPUT_PAGE_BYTES, LifecycleOutput, LifecycleWorkerAdmissionBusyError;
+var import_node_child_process23, import_node_crypto22, import_node_fs34, import_node_path42, OUTPUT_BUFFER_LIMIT, DEFAULT_OUTPUT_PAGE_BYTES, LifecycleOutput, LifecycleWorkerAdmissionBusyError;
 var init_reliability_worker = __esm({
   "src/core/reliability-worker.ts"() {
     "use strict";
-    import_node_child_process22 = require("child_process");
-    import_node_crypto21 = require("crypto");
-    import_node_fs33 = __toESM(require("fs"));
-    import_node_path41 = __toESM(require("path"));
+    import_node_child_process23 = require("child_process");
+    import_node_crypto22 = require("crypto");
+    import_node_fs34 = __toESM(require("fs"));
+    import_node_path42 = __toESM(require("path"));
     init_file_lock();
     init_lifecycle_diagnostics();
     init_lifecycle_progress();
@@ -16773,7 +16915,7 @@ var init_reliability_worker = __esm({
 
 // src/core/devpod-mutation.ts
 function withMutationLock2(activity, target, operation) {
-  import_node_fs34.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs35.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
     {
@@ -16793,7 +16935,7 @@ function runDevpodAction(action2, devpodId, force = false, repoPath) {
   const args = action2 === "delete" ? [action2, devpodId, ...force ? ["--force"] : [], "--ignore-not-found"] : [action2, devpodId];
   claimLifecycleEffect();
   const binding = repoPath ? networkProviderEffectOptions("devpod", devpodId, repoPath) : { args: [] };
-  const result = (0, import_node_child_process23.spawnSync)("devpod", [...args, ...binding.args], {
+  const result = (0, import_node_child_process24.spawnSync)("devpod", [...args, ...binding.args], {
     encoding: "utf-8",
     ...binding.env ? { env: binding.env } : {}
   });
@@ -16863,13 +17005,13 @@ function deleteOwnedDevpodWorkspace(devpodId, worktreePath) {
   resetWorkspaceRuntimeCaches();
   return result;
 }
-var import_node_child_process23, import_node_fs34, import_node_path42, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS;
+var import_node_child_process24, import_node_fs35, import_node_path43, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS;
 var init_devpod_mutation = __esm({
   "src/core/devpod-mutation.ts"() {
     "use strict";
-    import_node_child_process23 = require("child_process");
-    import_node_fs34 = __toESM(require("fs"));
-    import_node_path42 = __toESM(require("path"));
+    import_node_child_process24 = require("child_process");
+    import_node_fs35 = __toESM(require("fs"));
+    import_node_path43 = __toESM(require("path"));
     init_devpod_workspaces();
     init_devsy_mutation();
     init_file_lock();
@@ -16878,7 +17020,7 @@ var init_devpod_mutation = __esm({
     init_reliability_context();
     init_router();
     init_workspace_runtime();
-    DEVPOD_MUTATION_LOCK_FILE = import_node_path42.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+    DEVPOD_MUTATION_LOCK_FILE = import_node_path43.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
     DEVPOD_MUTATION_WAIT_MS = 18e5;
   }
 });
@@ -16979,7 +17121,7 @@ function hostPortBindingsConflict(desired, holder) {
   (desired.hostIp === null || holder.hostIp === null || desired.hostIp === holder.hostIp);
 }
 function runDocker(args) {
-  const result = (0, import_node_child_process24.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process25.spawnSync)("docker", args, {
     ...networkDockerOptions(),
     encoding: "utf-8",
     timeout: DOCKER_TIMEOUT_MS,
@@ -17049,7 +17191,7 @@ function listHolderSnapshots() {
 }
 function renderManagedComposeModel(plan, workspace) {
   const fileArgs = plan.composeFiles.flatMap((file) => ["-f", file]);
-  const result = (0, import_node_child_process24.spawnSync)(
+  const result = (0, import_node_child_process25.spawnSync)(
     "docker",
     [
       "compose",
@@ -17084,8 +17226,8 @@ function renderManagedComposeModel(plan, workspace) {
   }
 }
 function attributeHolderWorktree(workingDir) {
-  if (import_node_path43.default.basename(workingDir) !== ".devcontainer") return void 0;
-  return comparableWorkspacePath(import_node_path43.default.dirname(workingDir));
+  if (import_node_path44.default.basename(workingDir) !== ".devcontainer") return void 0;
+  return comparableWorkspacePath(import_node_path44.default.dirname(workingDir));
 }
 function holderAttribution(holder, repoPath) {
   const attribution = {};
@@ -17120,7 +17262,7 @@ function detectHostPortClaimConflicts(options) {
   );
   if (desired.length === 0) return [];
   const holders = listHolderSnapshots();
-  const devcontainerDir = import_node_path43.default.join(options.repoPath, ".devcontainer");
+  const devcontainerDir = import_node_path44.default.join(options.repoPath, ".devcontainer");
   const conflicts = [];
   for (const binding of desired) {
     for (const holder of holders) {
@@ -17142,12 +17284,12 @@ function detectHostPortClaimConflicts(options) {
   }
   return conflicts;
 }
-var import_node_child_process24, import_node_path43, COMPOSE_RENDER_TIMEOUT_MS, COMPOSE_RENDER_MAX_BUFFER, DOCKER_TIMEOUT_MS, DOCKER_MAX_BUFFER, MAX_DESIRED_HOST_PORTS, MAX_RUNNING_HOLDERS, HOST_PORT_INSPECT_TEMPLATE;
+var import_node_child_process25, import_node_path44, COMPOSE_RENDER_TIMEOUT_MS, COMPOSE_RENDER_MAX_BUFFER, DOCKER_TIMEOUT_MS, DOCKER_MAX_BUFFER, MAX_DESIRED_HOST_PORTS, MAX_RUNNING_HOLDERS, HOST_PORT_INSPECT_TEMPLATE;
 var init_host_port_claims = __esm({
   "src/core/host-port-claims.ts"() {
     "use strict";
-    import_node_child_process24 = require("child_process");
-    import_node_path43 = __toESM(require("path"));
+    import_node_child_process25 = require("child_process");
+    import_node_path44 = __toESM(require("path"));
     init_devcontainer_profile();
     init_network_effect_scope();
     init_router();
@@ -17189,7 +17331,7 @@ function probeHttpRoute(host, options = {}) {
     args.push("--cacert", CERT_FILE);
   }
   args.push(url);
-  const result = (0, import_node_child_process25.spawnSync)("curl", args, { encoding: "utf-8" });
+  const result = (0, import_node_child_process26.spawnSync)("curl", args, { encoding: "utf-8" });
   const stdout = result.stdout?.trim() ?? "";
   const status = /^\d{3}$/.test(stdout) ? Number(stdout) : void 0;
   const ok = result.status === 0 && status !== void 0 && status >= 100 && status < 500;
@@ -17224,7 +17366,7 @@ function probeHttpReadinessSync(host, readiness, maxTimeSeconds, repoPath) {
   }
   let result;
   try {
-    result = (0, import_node_child_process25.spawnSync)("curl", args, {
+    result = (0, import_node_child_process26.spawnSync)("curl", args, {
       encoding: "utf-8",
       maxBuffer: CONTRACT_MAX_BUFFER,
       timeout: Math.ceil(parentTimeoutMs)
@@ -17306,11 +17448,11 @@ function transportFailure() {
     classification: "transport"
   };
 }
-var import_node_child_process25, DEFAULT_MAX_TIME_SECONDS, CONTROLLER_CURL_MAX_TIME_SECONDS, PARENT_TIMEOUT_PADDING_MS, CONTRACT_MAX_BUFFER, MIME_TOKEN_RE2;
+var import_node_child_process26, DEFAULT_MAX_TIME_SECONDS, CONTROLLER_CURL_MAX_TIME_SECONDS, PARENT_TIMEOUT_PADDING_MS, CONTRACT_MAX_BUFFER, MIME_TOKEN_RE2;
 var init_http_route_probe = __esm({
   "src/core/http-route-probe.ts"() {
     "use strict";
-    import_node_child_process25 = require("child_process");
+    import_node_child_process26 = require("child_process");
     init_router();
     init_tls();
     DEFAULT_MAX_TIME_SECONDS = 5;
@@ -17322,12 +17464,12 @@ var init_http_route_probe = __esm({
 });
 
 // src/core/managed-host-preparation.ts
-var import_node_child_process26, import_node_fs35;
+var import_node_child_process27, import_node_fs36;
 var init_managed_host_preparation = __esm({
   "src/core/managed-host-preparation.ts"() {
     "use strict";
-    import_node_child_process26 = require("child_process");
-    import_node_fs35 = __toESM(require("fs"));
+    import_node_child_process27 = require("child_process");
+    import_node_fs36 = __toESM(require("fs"));
     init_repo_config();
   }
 });
@@ -17452,7 +17594,7 @@ function classifyManagedMountNesting(configured, effectiveDestinations, containe
   };
 }
 function readContainerMountinfo(containerId, options) {
-  const result = (0, import_node_child_process27.spawnSync)("docker", ["exec", containerId, "cat", "/proc/self/mountinfo"], {
+  const result = (0, import_node_child_process28.spawnSync)("docker", ["exec", containerId, "cat", "/proc/self/mountinfo"], {
     encoding: "utf-8",
     timeout: options.timeoutMs ?? 5e3,
     stdio: ["ignore", "pipe", "pipe"],
@@ -17467,11 +17609,11 @@ function observeManagedMountNesting(container, options = {}) {
   const effective = destinations.some((_destination, index) => isNestedIndex(destinations, index)) ? readContainerMountinfo(container.id, options) : null;
   return classifyManagedMountNesting(container.mounts, effective, container.id);
 }
-var import_node_child_process27, NESTED_MOUNT_REASON, UNREADABLE_MOUNT_REASON;
+var import_node_child_process28, NESTED_MOUNT_REASON, UNREADABLE_MOUNT_REASON;
 var init_managed_mount_nesting = __esm({
   "src/core/managed-mount-nesting.ts"() {
     "use strict";
-    import_node_child_process27 = require("child_process");
+    import_node_child_process28 = require("child_process");
     init_network_effect_scope();
     NESTED_MOUNT_REASON = "no configured mount is nested inside another configured mount";
     UNREADABLE_MOUNT_REASON = "the container's own mount table could not be read";
@@ -17489,7 +17631,11 @@ function reliabilityRecovery(reason2, repoPath, variant) {
   switch (reason2) {
     case "stop-incomplete":
     case "operation-unknown":
-      return [`Run: devrouter stop ${checkout}`, `Run: devrouter ensure ${checkout} --repair`];
+      return [
+        `Run: devrouter stop ${checkout}`,
+        "Verify the repository startup hooks preserve retained data and startup is authorized before continuing.",
+        `Run: devrouter ensure ${checkout}${variantOption}`
+      ];
     case "start-refused":
       return [
         `Run: devrouter doctor --repo ${checkout} to read the refused fixed host-port claim and its holder`,
@@ -18029,7 +18175,7 @@ function readDocker(endpoint, args, timeoutMs) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process28.spawnSync)("docker", ["--host", endpoint, ...args], {
+  const result = (0, import_node_child_process29.spawnSync)("docker", ["--host", endpoint, ...args], {
     env,
     encoding: "utf-8",
     timeout: timeoutMs,
@@ -18191,11 +18337,11 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
   }
   return result;
 }
-var import_node_child_process28, NetworkInventoryError, MAX_IDS, MAX_OUTPUT_BYTES, FULL_ID, NETWORK_TEMPLATE, CONTAINER_TEMPLATE;
+var import_node_child_process29, NetworkInventoryError, MAX_IDS, MAX_OUTPUT_BYTES, FULL_ID, NETWORK_TEMPLATE, CONTAINER_TEMPLATE;
 var init_network_inventory = __esm({
   "src/core/network-inventory.ts"() {
     "use strict";
-    import_node_child_process28 = require("child_process");
+    import_node_child_process29 = require("child_process");
     init_devpod_environment();
     NetworkInventoryError = class extends Error {
     };
@@ -18523,26 +18669,26 @@ function hasLocalDockerNetworkNamespace(endpoint, procRoot = "/proc") {
   try {
     if (!endpoint.startsWith("unix:///")) return false;
     const socket = endpoint.slice("unix://".length);
-    const table = import_node_fs36.default.readFileSync(import_node_path44.default.join(procRoot, "net/unix"), "utf8");
+    const table = import_node_fs37.default.readFileSync(import_node_path45.default.join(procRoot, "net/unix"), "utf8");
     if (Buffer.byteLength(table) > 1024 * 1024) return false;
     const rows2 = table.split("\n").map((line) => line.trim().split(/\s+/)).filter((row) => row[7] === socket && row[3] === "00010000");
     if (rows2.length !== 1 || !/^\d+$/.test(rows2[0][6])) return false;
     const inode = `socket:[${rows2[0][6]}]`;
-    const ownNamespace = import_node_fs36.default.readlinkSync(import_node_path44.default.join(procRoot, "self/ns/net"));
-    const pids = import_node_fs36.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
+    const ownNamespace = import_node_fs37.default.readlinkSync(import_node_path45.default.join(procRoot, "self/ns/net"));
+    const pids = import_node_fs37.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
     if (pids.length > 4096) return false;
     for (const pid of pids) {
       if (Date.now() > deadline) return false;
       try {
-        const root = import_node_path44.default.join(procRoot, pid);
-        if (import_node_path44.default.basename(import_node_fs36.default.readlinkSync(import_node_path44.default.join(root, "exe"))) !== "dockerd") continue;
-        if (import_node_fs36.default.readlinkSync(import_node_path44.default.join(root, "ns/net")) !== ownNamespace) continue;
-        const descriptors = import_node_fs36.default.readdirSync(import_node_path44.default.join(root, "fd"));
+        const root = import_node_path45.default.join(procRoot, pid);
+        if (import_node_path45.default.basename(import_node_fs37.default.readlinkSync(import_node_path45.default.join(root, "exe"))) !== "dockerd") continue;
+        if (import_node_fs37.default.readlinkSync(import_node_path45.default.join(root, "ns/net")) !== ownNamespace) continue;
+        const descriptors = import_node_fs37.default.readdirSync(import_node_path45.default.join(root, "fd"));
         if (descriptors.length > 4096) continue;
         if (descriptors.some((fd) => {
           if (Date.now() > deadline) return false;
           try {
-            return import_node_fs36.default.readlinkSync(import_node_path44.default.join(root, "fd", fd)) === inode;
+            return import_node_fs37.default.readlinkSync(import_node_path45.default.join(root, "fd", fd)) === inode;
           } catch {
             return false;
           }
@@ -18556,12 +18702,12 @@ function hasLocalDockerNetworkNamespace(endpoint, procRoot = "/proc") {
   }
   return false;
 }
-var import_node_fs36, import_node_path44;
+var import_node_fs37, import_node_path45;
 var init_network_local_daemon = __esm({
   "src/core/network-local-daemon.ts"() {
     "use strict";
-    import_node_fs36 = __toESM(require("fs"));
-    import_node_path44 = __toESM(require("path"));
+    import_node_fs37 = __toESM(require("fs"));
+    import_node_path45 = __toESM(require("path"));
   }
 });
 
@@ -18589,7 +18735,7 @@ function parseLinuxNetworkRoutes(output2) {
 function collectNetworkRoutes(options) {
   if ((options.platform ?? process.platform) !== "linux" || !hasLocalDockerNetworkNamespace(options.endpoint))
     return { status: "unknown", routes: [] };
-  const result = (0, import_node_child_process29.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
+  const result = (0, import_node_child_process30.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
     encoding: "utf8",
     timeout: 5e3,
     maxBuffer: 1024 * 1024
@@ -18597,11 +18743,11 @@ function collectNetworkRoutes(options) {
   if (result.error || result.status !== 0) return { status: "unknown", routes: [] };
   return parseLinuxNetworkRoutes(result.stdout);
 }
-var import_node_child_process29, import_node_net3;
+var import_node_child_process30, import_node_net3;
 var init_network_routes = __esm({
   "src/core/network-routes.ts"() {
     "use strict";
-    import_node_child_process29 = require("child_process");
+    import_node_child_process30 = require("child_process");
     import_node_net3 = require("net");
     init_network_capacity();
     init_network_local_daemon();
@@ -18769,11 +18915,11 @@ function extendDockerComposeFile(nativeConfig, overlayPath) {
   const config = { ...nativeConfig, dockerComposeFile };
   return { status: "ready", config, reasons: [] };
 }
-var import_node_crypto22;
+var import_node_crypto23;
 var init_network_compose = __esm({
   "src/core/network-compose.ts"() {
     "use strict";
-    import_node_crypto22 = require("crypto");
+    import_node_crypto23 = require("crypto");
   }
 });
 
@@ -18781,8 +18927,8 @@ var init_network_compose = __esm({
 function prepareNetworkComposeFiles(plan, subnet) {
   const overlay = deriveComposeNetworkOverlay(subnet);
   if (overlay.status !== "ready" || !overlay.overlay) throw new Error("Network subnet is invalid.");
-  const overlayPath = import_node_path45.default.join(plan.composeDirectory, OVERLAY);
-  const ignored = (0, import_node_child_process30.spawnSync)("git", [
+  const overlayPath = import_node_path46.default.join(plan.composeDirectory, OVERLAY);
+  const ignored = (0, import_node_child_process31.spawnSync)("git", [
     "-C",
     plan.composeDirectory,
     "check-ignore",
@@ -18794,11 +18940,11 @@ function prepareNetworkComposeFiles(plan, subnet) {
   if (ignored.status !== 0)
     throw new Error("Generated network overlay must be ignored before allocation.");
   const bytes2 = `${MARKER}
-${import_yaml4.default.stringify(overlay.overlay)}`;
+${import_yaml5.default.stringify(overlay.overlay)}`;
   const assertOwnership = () => {
-    if (!import_node_fs37.default.existsSync(overlayPath)) return;
-    const stat = import_node_fs37.default.lstatSync(overlayPath);
-    if (!stat.isFile() || stat.size > MAX_BYTES3 || import_node_fs37.default.readFileSync(overlayPath, "utf8") !== bytes2)
+    if (!import_node_fs38.default.existsSync(overlayPath)) return;
+    const stat = import_node_fs38.default.lstatSync(overlayPath);
+    if (!stat.isFile() || stat.size > MAX_BYTES3 || import_node_fs38.default.readFileSync(overlayPath, "utf8") !== bytes2)
       throw new Error("Retained network overlay changed; repair is required.");
   };
   assertOwnership();
@@ -18812,7 +18958,7 @@ ${JSON.stringify(extended.config, null, 2)}
     ...plan,
     contents,
     composeFiles: [...plan.composeFiles, overlayPath],
-    effectiveConfigSha256: (0, import_node_crypto23.createHash)("sha256").update(contents).digest("hex")
+    effectiveConfigSha256: (0, import_node_crypto24.createHash)("sha256").update(contents).digest("hex")
   };
   return {
     plan: result,
@@ -18822,15 +18968,15 @@ ${JSON.stringify(extended.config, null, 2)}
     }
   };
 }
-var import_node_child_process30, import_node_crypto23, import_node_fs37, import_node_path45, import_yaml4, OVERLAY, MARKER, MAX_BYTES3;
+var import_node_child_process31, import_node_crypto24, import_node_fs38, import_node_path46, import_yaml5, OVERLAY, MARKER, MAX_BYTES3;
 var init_network_compose_files = __esm({
   "src/core/network-compose-files.ts"() {
     "use strict";
-    import_node_child_process30 = require("child_process");
-    import_node_crypto23 = require("crypto");
-    import_node_fs37 = __toESM(require("fs"));
-    import_node_path45 = __toESM(require("path"));
-    import_yaml4 = __toESM(require("yaml"));
+    import_node_child_process31 = require("child_process");
+    import_node_crypto24 = require("crypto");
+    import_node_fs38 = __toESM(require("fs"));
+    import_node_path46 = __toESM(require("path"));
+    import_yaml5 = __toESM(require("yaml"));
     init_atomic_file();
     init_devcontainer_profile();
     init_network_compose();
@@ -18841,11 +18987,11 @@ var init_network_compose_files = __esm({
 });
 
 // src/core/network-connected-route.ts
-var import_node_child_process31;
+var import_node_child_process32;
 var init_network_connected_route = __esm({
   "src/core/network-connected-route.ts"() {
     "use strict";
-    import_node_child_process31 = require("child_process");
+    import_node_child_process32 = require("child_process");
     init_network_capacity();
   }
 });
@@ -18861,11 +19007,11 @@ var init_network_lifecycle = __esm({
 });
 
 // src/core/network-managed.ts
-var import_node_crypto24;
+var import_node_crypto25;
 var init_network_managed = __esm({
   "src/core/network-managed.ts"() {
     "use strict";
-    import_node_crypto24 = require("crypto");
+    import_node_crypto25 = require("crypto");
     init_devpod_environment();
     init_network_capacity();
     init_network_claim_lookup();
@@ -18935,13 +19081,13 @@ function resolveLinkedTarget(repoPath) {
     gitCommonDir: resolveGitCommonDir(repoPath)
   };
 }
-var import_node_child_process32, import_node_fs38, import_node_path46;
+var import_node_child_process33, import_node_fs39, import_node_path47;
 var init_workspace_ensure = __esm({
   "src/core/workspace-ensure.ts"() {
     "use strict";
-    import_node_child_process32 = require("child_process");
-    import_node_fs38 = __toESM(require("fs"));
-    import_node_path46 = __toESM(require("path"));
+    import_node_child_process33 = require("child_process");
+    import_node_fs39 = __toESM(require("fs"));
+    import_node_path47 = __toESM(require("path"));
     init_devcontainer_profile();
     init_devpod_environment();
     init_devpod_mutation();
@@ -18952,6 +19098,7 @@ var init_workspace_ensure = __esm({
     init_host_routes();
     init_http_route_probe();
     init_lifecycle_progress();
+    init_managed_fresh_bootstrap();
     init_managed_host_ports();
     init_managed_host_preparation();
     init_managed_post_start();
@@ -19057,6 +19204,9 @@ function prepareManagedLifecycleOperation(input2) {
     throw new Error("Invalid managed operation command.");
   if (Buffer.byteLength(JSON.stringify(input2)) > 32768)
     throw new Error("Managed operation input exceeds its byte limit.");
+  if (input2.initializeNew && input2.kind !== "ensure")
+    throw new Error("Initialization intent is valid only for an ensure operation.");
+  if (input2.kind === "ensure") assertFreshBootstrapRequest(input2.identity, input2);
   const ids2 = newLifecycleIds();
   return updateReliabilityOperation(input2.identity, (record6) => {
     const retained = readManagedRuntimeState(
@@ -19105,13 +19255,17 @@ function prepareManagedLifecycleOperation(input2) {
         repoPath: input2.identity.repoPath,
         identity: { ...input2.identity },
         fence: reliabilityFence(record6.state),
-        options: { profile: input2.profile, quiet: true },
+        options: {
+          profile: input2.profile,
+          quiet: true,
+          ...input2.initializeNew ? { initializeNew: true } : {}
+        },
         ...input2.command ? { command: [...input2.command] } : {}
       }
     };
   });
 }
-function assertCurrentCapacityController(expected, directory = import_node_path47.default.join(DEVROUTER_HOME, "controller")) {
+function assertCurrentCapacityController(expected, directory = import_node_path48.default.join(DEVROUTER_HOME, "controller")) {
   const current = new ControllerStore(directory).read();
   if (!expected || current?.store !== expected.store || current.epoch !== expected.epoch)
     throw new Error("Capacity controller incarnation changed.");
@@ -19282,7 +19436,7 @@ function withdrawUnstartedLifecycleStop(input2) {
     if (record6.worker || record6.stopWorkStarted) return false;
     if (state.desired !== "stopped-by-user" || state.phase !== "stopping") return false;
     if (state.stopProof.workloadsStopped || state.stopProof.routesRemoved) return false;
-    if (!(0, import_node_util12.isDeepStrictEqual)(state.operation, intent.recordedOperation)) return false;
+    if (!(0, import_node_util13.isDeepStrictEqual)(state.operation, intent.recordedOperation)) return false;
     const prior = intent.prior;
     state.intentRevision = prior.intentRevision;
     state.observationsAfterMs = prior.observationsAfterMs;
@@ -19360,7 +19514,7 @@ function prepareResumeLifecycleOperation(input2) {
   });
 }
 function settlePreparedLifecycleCapacity(input2) {
-  const directory = input2.directory ?? import_node_path47.default.join(DEVROUTER_HOME, "controller");
+  const directory = input2.directory ?? import_node_path48.default.join(DEVROUTER_HOME, "controller");
   const store = createLifecycleCapacityStore(directory);
   for (let attempt = 0; attempt < 3; attempt++) {
     const snapshot = store.read();
@@ -19388,21 +19542,21 @@ function settlePreparedLifecycleCapacity(input2) {
         reservationId: binding.reservationId,
         policyRevision: binding.policyRevision
       };
-      if (operation.kind === "exec" && !(0, import_node_util12.isDeepStrictEqual)(target.totals, binding.execSteady?.totals))
+      if (operation.kind === "exec" && !(0, import_node_util13.isDeepStrictEqual)(target.totals, binding.execSteady?.totals))
         return null;
       const retained = snapshot.reservations.find(
         (entry) => entry.environmentId === target.environmentId
       );
       if (!retained || retained.reservationId !== target.reservationId || retained.operationId !== target.operationId || retained.policyRevision !== target.policyRevision)
         return null;
-      if (!record6.phaseSettlement && (0, import_node_util12.isDeepStrictEqual)(retained, target)) return null;
+      if (!record6.phaseSettlement && (0, import_node_util13.isDeepStrictEqual)(retained, target)) return null;
       const marker = {
         id: binding.reservationId,
         fence: { ...proof.fence },
         target,
         estimatesDigest: input2.enrollment.estimatesDigest
       };
-      if (record6.phaseSettlement && !(0, import_node_util12.isDeepStrictEqual)(record6.phaseSettlement, marker))
+      if (record6.phaseSettlement && !(0, import_node_util13.isDeepStrictEqual)(record6.phaseSettlement, marker))
         throw new Error("Capacity phase settlement proof changed.");
       binding.validUntilMs = 0;
       record6.phaseSettlement = marker;
@@ -19417,7 +19571,7 @@ function settlePreparedLifecycleCapacity(input2) {
     }
     return updateReliabilityOperation(input2.identity, (record6) => {
       assertCurrentCapacityController(input2.controller, directory);
-      if (!matchesFence(record6, pending.fence) || !(0, import_node_util12.isDeepStrictEqual)(record6.phaseSettlement, pending))
+      if (!matchesFence(record6, pending.fence) || !(0, import_node_util13.isDeepStrictEqual)(record6.phaseSettlement, pending))
         return false;
       record6.phaseSettlement = null;
       return true;
@@ -19467,6 +19621,7 @@ async function superviseLifecycle(kind, repoPath, options = {}, command, hooks =
   };
   const ids2 = newLifecycleIds();
   const copiedOptions = { ...options };
+  if (kind === "ensure") assertFreshBootstrapRequest(identity2, options);
   const copiedCommand = command ? [...command] : void 0;
   if (kind === "stop") {
     const intent = updateReliabilityOperation(identity2, (record6) => {
@@ -19510,6 +19665,7 @@ async function superviseLifecycle(kind, repoPath, options = {}, command, hooks =
       identity: identity2,
       requestId: ids2.requestId,
       profile: copiedOptions.profile,
+      ...copiedOptions.initializeNew ? { initializeNew: true } : {},
       ...copiedCommand ? { command: copiedCommand } : {}
     });
   if (initial.state.executionPolicy !== "manual")
@@ -19616,7 +19772,7 @@ async function superviseLifecycle(kind, repoPath, options = {}, command, hooks =
     removeSignals();
   }
 }
-function admitLifecycleCapacity(request2, reservation, budgets, samples, nowMs, maxSampleAgeMs, directory = import_node_path47.default.join(DEVROUTER_HOME, "controller"), controller, admission) {
+function admitLifecycleCapacity(request2, reservation, budgets, samples, nowMs, maxSampleAgeMs, directory = import_node_path48.default.join(DEVROUTER_HOME, "controller"), controller, admission) {
   if (request2.kind === "stop") throw new Error("Stop never requires capacity admission.");
   const capacity = createLifecycleCapacityStore(directory);
   const snapshot = capacity.read();
@@ -19672,10 +19828,10 @@ function admitLifecycleCapacity(request2, reservation, budgets, samples, nowMs,
         totals
       };
       if (binding.operationId === request2.operationId) {
-        if (binding.execSteady && !(0, import_node_util12.isDeepStrictEqual)(binding.execSteady, receipt))
+        if (binding.execSteady && !(0, import_node_util13.isDeepStrictEqual)(binding.execSteady, receipt))
           throw new Error("Repeated exec settlement proof changed.");
         execSteady = binding.execSteady;
-      } else if (!retained.startup && !retained.heavy && (0, import_node_util12.isDeepStrictEqual)(retained.totals, totals)) {
+      } else if (!retained.startup && !retained.heavy && (0, import_node_util13.isDeepStrictEqual)(retained.totals, totals)) {
         execSteady = receipt;
       }
     } else if (binding.operationId === request2.operationId && binding.execSteady) {
@@ -19716,7 +19872,7 @@ function admitLifecycleCapacity(request2, reservation, budgets, samples, nowMs,
   return decision;
 }
 function capacityPolicyTargets(repoPath) {
-  const policy = readCapacityPolicy(import_node_path47.default.join(DEVROUTER_HOME, "controller"));
+  const policy = readCapacityPolicy(import_node_path48.default.join(DEVROUTER_HOME, "controller"));
   return policy?.admissions === "enabled" && policy.enrollments.some((entry) => entry.repoPath === repoPath);
 }
 function controllerWaitSeconds(deadline) {
@@ -19725,7 +19881,7 @@ function controllerWaitSeconds(deadline) {
 async function superviseThroughController(input2) {
   if (input2.kind === "exec" && !input2.command)
     throw new Error("Exec requires a command for controller admission.");
-  const directory = import_node_path47.default.join(DEVROUTER_HOME, "controller");
+  const directory = import_node_path48.default.join(DEVROUTER_HOME, "controller");
   const cancellation = { requested: false };
   const removeSignals = installLifecycleWaitSignals(cancellation);
   const cancelled = () => {
@@ -19749,7 +19905,7 @@ async function superviseThroughController(input2) {
   try {
     const bind = () => observeControllerBinding(directory, {
       path: input2.repoPath,
-      session: (0, import_node_crypto25.randomUUID)(),
+      session: (0, import_node_crypto26.randomUUID)(),
       profile: input2.profile ?? "full",
       // The protocol requires at least one readiness selector, and every
       // supervised operation depends on runtime readiness; "runtime" is the
@@ -19759,7 +19915,12 @@ async function superviseThroughController(input2) {
     let binding = await bind();
     let pending = await submitControllerOperation(
       directory,
-      input2.kind === "exec" ? { ...binding, requestId: input2.requestId, kind: "exec", command: input2.command ?? [] } : { ...binding, requestId: input2.requestId, kind: "ensure" },
+      input2.kind === "exec" ? { ...binding, requestId: input2.requestId, kind: "exec", command: input2.command ?? [] } : {
+        ...binding,
+        requestId: input2.requestId,
+        kind: "ensure",
+        ...input2.initializeNew ? { initializeNew: true } : {}
+      },
       { waitSeconds: controllerWaitSeconds(deadline), onOutput }
     );
     while (pending.status !== "terminal") {
@@ -19797,7 +19958,7 @@ async function superviseThroughController(input2) {
     removeSignals();
   }
 }
-function renewLifecycleCapacity(request2, policy, samples, controller, directory = import_node_path47.default.join(DEVROUTER_HOME, "controller"), nowMs = Date.now()) {
+function renewLifecycleCapacity(request2, policy, samples, controller, directory = import_node_path48.default.join(DEVROUTER_HOME, "controller"), nowMs = Date.now()) {
   return updateReliabilityOperation(request2.identity, (record6) => {
     const binding = record6.capacity;
     if (!matchesFence(record6, request2.fence) || !binding || binding.operationId !== request2.operationId || binding.workerId !== request2.workerId || binding.controller?.store !== controller.store || binding.controller?.epoch !== controller.epoch)
@@ -19885,7 +20046,7 @@ function retireQueuedLifecycle(request2, supersededOnly = false) {
     return true;
   });
 }
-function bindLifecycleCapacity(request2, binding, directory = import_node_path47.default.join(DEVROUTER_HOME, "controller")) {
+function bindLifecycleCapacity(request2, binding, directory = import_node_path48.default.join(DEVROUTER_HOME, "controller")) {
   if (request2.kind === "stop") throw new Error("Stop never requires capacity admission.");
   updateReliabilityOperation(request2.identity, (record6) => {
     if (!matchesFence(record6, request2.fence) || record6.worker || record6.state.operation?.id !== request2.operationId || record6.state.operation.status !== "NOT_STARTED" || record6.state.operation.drained)
@@ -19900,13 +20061,13 @@ function bindLifecycleCapacity(request2, binding, directory = import_node_path47
       stepRecord(record6, { ...request2.fence, type: "admission", result: "admitted" });
   });
 }
-var import_node_crypto25, import_node_path47, import_node_util12, activeWorker, lockHeld, BUSY_LIFECYCLE_WAIT_MS, BUSY_LIFECYCLE_POLL_MS, CAPACITY_CLIENT_WAIT_MS, BUSY_LIFECYCLE_PROGRESS_MS;
+var import_node_crypto26, import_node_path48, import_node_util13, activeWorker, lockHeld, BUSY_LIFECYCLE_WAIT_MS, BUSY_LIFECYCLE_POLL_MS, CAPACITY_CLIENT_WAIT_MS, BUSY_LIFECYCLE_PROGRESS_MS;
 var init_reliability_lifecycle = __esm({
   "src/core/reliability-lifecycle.ts"() {
     "use strict";
-    import_node_crypto25 = require("crypto");
-    import_node_path47 = __toESM(require("path"));
-    import_node_util12 = require("util");
+    import_node_crypto26 = require("crypto");
+    import_node_path48 = __toESM(require("path"));
+    import_node_util13 = require("util");
     init_capacity_accounting();
     init_capacity_policy();
     init_capacity_request();
@@ -19922,6 +20083,7 @@ var init_reliability_lifecycle = __esm({
     init_file_lock();
     init_host_routes();
     init_managed_devsy_stop();
+    init_managed_fresh_bootstrap();
     init_managed_post_start();
     init_managed_runtime_state();
     init_managed_stop_recovery();
@@ -19947,11 +20109,11 @@ var init_reliability_lifecycle = __esm({
 });
 
 // src/core/capacity-queue.ts
-var import_node_util13, CapacityQueue;
+var import_node_util14, CapacityQueue;
 var init_capacity_queue = __esm({
   "src/core/capacity-queue.ts"() {
     "use strict";
-    import_node_util13 = require("util");
+    import_node_util14 = require("util");
     init_capacity_policy();
     init_capacity_store();
     init_reliability_contract();
@@ -19987,7 +20149,7 @@ var init_capacity_queue = __esm({
         if (existing) {
           const existingRequest = existing.phase === "terminal" ? { ...existing.request, command: void 0 } : existing.request;
           const incomingRequest = existing.phase === "terminal" ? { ...request2, command: void 0 } : request2;
-          if (!(0, import_node_util13.isDeepStrictEqual)(existingRequest, incomingRequest) || !(0, import_node_util13.isDeepStrictEqual)(existing.reservation, reservation) || !(0, import_node_util13.isDeepStrictEqual)(existing.admission, admission) || existing.autoResume !== autoResume)
+          if (!(0, import_node_util14.isDeepStrictEqual)(existingRequest, incomingRequest) || !(0, import_node_util14.isDeepStrictEqual)(existing.reservation, reservation) || !(0, import_node_util14.isDeepStrictEqual)(existing.admission, admission) || existing.autoResume !== autoResume)
             throw new Error("Operation reference belongs to another accepted request.");
           return request2.operationId;
         }
@@ -20150,7 +20312,7 @@ var init_capacity_queue = __esm({
                   const operation = record6?.state.operation?.id === entry.request.operationId ? record6.state.operation : record6?.state.operationHistory.find(
                     (operation2) => operation2.id === entry.request.operationId
                   );
-                  if (record6 && (!(0, import_node_util13.isDeepStrictEqual)(reliabilityFence(record6.state), entry.request.fence) || record6.state.operation?.id !== entry.request.operationId) && operation?.drained && ["NOT_STARTED", "NOT_LAUNCHED"].includes(operation.status) && record6.worker?.operationId !== entry.request.operationId) {
+                  if (record6 && (!(0, import_node_util14.isDeepStrictEqual)(reliabilityFence(record6.state), entry.request.fence) || record6.state.operation?.id !== entry.request.operationId) && operation?.drained && ["NOT_STARTED", "NOT_LAUNCHED"].includes(operation.status) && record6.worker?.operationId !== entry.request.operationId) {
                     entry.reason = "intent-superseded";
                     entry.phase = "terminal";
                     entry.request.command = void 0;
@@ -20286,7 +20448,7 @@ var init_capacity_startup_witness = __esm({
 function readHostWakeEpoch(platform = process.platform) {
   if (platform !== "darwin") return void 0;
   try {
-    const result = (0, import_node_child_process33.spawnSync)("/usr/sbin/sysctl", ["-n", "kern.wake_abs_time"], {
+    const result = (0, import_node_child_process34.spawnSync)("/usr/sbin/sysctl", ["-n", "kern.wake_abs_time"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       timeout: 250,
@@ -20301,11 +20463,11 @@ function readHostWakeEpoch(platform = process.platform) {
     return null;
   }
 }
-var import_node_child_process33;
+var import_node_child_process34;
 var init_host_wake = __esm({
   "src/core/host-wake.ts"() {
     "use strict";
-    import_node_child_process33 = require("child_process");
+    import_node_child_process34 = require("child_process");
   }
 });
 
@@ -20379,7 +20541,7 @@ function createCapacityController(options) {
     let matches = false;
     try {
       current = new ControllerStore(options.directory).read();
-      matches = current?.store === controller.store && current.epoch === controller.epoch && (0, import_node_util14.isDeepStrictEqual)(readCapacityPolicy(options.directory), policy);
+      matches = current?.store === controller.store && current.epoch === controller.epoch && (0, import_node_util15.isDeepStrictEqual)(readCapacityPolicy(options.directory), policy);
     } catch {
     }
     if (invalidated || lifetime.signal.aborted || !matches) {
@@ -20531,12 +20693,12 @@ function createCapacityController(options) {
     controller,
     policyRevision: policy.revision
   });
-  const payloadKey = (0, import_node_crypto26.randomBytes)(32);
+  const payloadKey = (0, import_node_crypto27.randomBytes)(32);
   const acceptedPayloads = /* @__PURE__ */ new Map();
   const settlePreparations = () => {
     if (lifetime.signal.aborted) return;
     try {
-      if (!(0, import_node_util14.isDeepStrictEqual)(readCapacityPolicy(options.directory), policy)) return;
+      if (!(0, import_node_util15.isDeepStrictEqual)(readCapacityPolicy(options.directory), policy)) return;
     } catch {
       return;
     }
@@ -20550,7 +20712,7 @@ function createCapacityController(options) {
         const record6 = readReliabilityOperation(identity2);
         if (!record6?.capacity || !record6.preparation && !record6.capacity.execSteady || record6.worker || !record6.state.operation?.drained || !["ensure", "exec"].includes(record6.state.operation.kind))
           continue;
-        const bytes2 = readControllerEvidence(import_node_path48.default.join(enrollment.repoPath, ".devrouter.yml"));
+        const bytes2 = readControllerEvidence(import_node_path49.default.join(enrollment.repoPath, ".devrouter.yml"));
         const estimates = loadRepoConfig(enrollment.repoPath, () => bytes2).capacity;
         if (!estimates) continue;
         settlePreparedLifecycleCapacity({
@@ -20588,7 +20750,7 @@ function createCapacityController(options) {
   };
   const resolveCapacityTarget = async (environment, signal) => {
     const current = readCapacityPolicy(options.directory);
-    if (current?.admissions !== "enabled" || !(0, import_node_util14.isDeepStrictEqual)(current, policy)) return void 0;
+    if (current?.admissions !== "enabled" || !(0, import_node_util15.isDeepStrictEqual)(current, policy)) return void 0;
     let resolved2;
     try {
       resolved2 = await resolveCapacityEnrollment(
@@ -20600,10 +20762,10 @@ function createCapacityController(options) {
     } catch {
       return void 0;
     }
-    if (signal.aborted || !(0, import_node_util14.isDeepStrictEqual)(resolved2.environment, environment)) return void 0;
-    if (!(0, import_node_util14.isDeepStrictEqual)(readCapacityPolicy(options.directory), current)) return void 0;
+    if (signal.aborted || !(0, import_node_util15.isDeepStrictEqual)(resolved2.environment, environment)) return void 0;
+    if (!(0, import_node_util15.isDeepStrictEqual)(readCapacityPolicy(options.directory), current)) return void 0;
     const runtime = current.domains[resolved2.enrollment.runtimeDomain];
-    if (runtime?.kind !== "runtime" || runtime.hostDomain !== resolved2.enrollment.hostDomain || current.domains[runtime.hostDomain]?.kind !== "host" || !current.enrollments.some((entry) => (0, import_node_util14.isDeepStrictEqual)(entry, resolved2.enrollment)))
+    if (runtime?.kind !== "runtime" || runtime.hostDomain !== resolved2.enrollment.hostDomain || current.domains[runtime.hostDomain]?.kind !== "host" || !current.enrollments.some((entry) => (0, import_node_util15.isDeepStrictEqual)(entry, resolved2.enrollment)))
       return void 0;
     return { current, resolved: resolved2, runtime };
   };
@@ -20645,7 +20807,7 @@ function createCapacityController(options) {
       const bounded = AbortSignal.any([signal, lifetime.signal]);
       if (bounded.aborted) return false;
       const current = readCapacityPolicy(options.directory);
-      if (current?.admissions !== "enabled" || !(0, import_node_util14.isDeepStrictEqual)(current, policy)) return false;
+      if (current?.admissions !== "enabled" || !(0, import_node_util15.isDeepStrictEqual)(current, policy)) return false;
       const request2 = reconcileParkedLifecycleStop({
         identity: { ...identity2 },
         controller,
@@ -20695,7 +20857,7 @@ function createCapacityController(options) {
           {
             ...charge,
             operationId: prepared.operationId,
-            reservationId: (0, import_node_crypto26.randomUUID)(),
+            reservationId: (0, import_node_crypto27.randomUUID)(),
             policyRevision: target.current.revision
           },
           {
@@ -20724,7 +20886,7 @@ function createCapacityController(options) {
       signal = AbortSignal.any([signal, lifetime.signal]);
       if (signal.aborted) throw new Error("Capacity submission unavailable.");
       const current = readCapacityPolicy(options.directory);
-      if (current?.admissions !== "enabled" || !(0, import_node_util14.isDeepStrictEqual)(current, policy))
+      if (current?.admissions !== "enabled" || !(0, import_node_util15.isDeepStrictEqual)(current, policy))
         throw new Error("Capacity controller policy changed.");
       validate3();
       const resolved2 = await enrollCapacityLifecycle(
@@ -20738,12 +20900,12 @@ function createCapacityController(options) {
         options.directory,
         bindingResolver
       );
-      if (!(0, import_node_util14.isDeepStrictEqual)(resolved2.environment, environment) || signal.aborted)
+      if (!(0, import_node_util15.isDeepStrictEqual)(resolved2.environment, environment) || signal.aborted)
         throw new Error("Capacity submission binding changed.");
-      if (!(0, import_node_util14.isDeepStrictEqual)(readCapacityPolicy(options.directory), current))
+      if (!(0, import_node_util15.isDeepStrictEqual)(readCapacityPolicy(options.directory), current))
         throw new Error("Capacity submission policy changed during resolution.");
       const runtime = current.domains[resolved2.enrollment.runtimeDomain];
-      if (runtime?.kind !== "runtime" || runtime.hostDomain !== resolved2.enrollment.hostDomain || current.domains[runtime.hostDomain]?.kind !== "host" || !current.enrollments.some((entry) => (0, import_node_util14.isDeepStrictEqual)(entry, resolved2.enrollment)))
+      if (runtime?.kind !== "runtime" || runtime.hostDomain !== resolved2.enrollment.hostDomain || current.domains[runtime.hostDomain]?.kind !== "host" || !current.enrollments.some((entry) => (0, import_node_util15.isDeepStrictEqual)(entry, resolved2.enrollment)))
         throw new Error("Capacity pool does not match policy enrollment.");
       const pool = {
         daemonId: runtime.daemonId,
@@ -20780,7 +20942,8 @@ function createCapacityController(options) {
         profile: environment.profile,
         consumer: initialConsumer,
         runtimeRunning: request2.kind === "exec" && Boolean(resolveRunningWorkspaceContainer(environment.repoPath)),
-        ...request2.kind === "exec" ? { command: request2.command } : {}
+        ...request2.kind === "exec" ? { command: request2.command } : {},
+        ...request2.kind === "ensure" && request2.initializeNew ? { initializeNew: true } : {}
       });
       if (prepared.request && request2.kind === "ensure") {
         try {
@@ -20798,13 +20961,14 @@ function createCapacityController(options) {
           throw error;
         }
       }
-      const signature = (0, import_node_crypto26.createHmac)("sha256", payloadKey).update(
+      const signature = (0, import_node_crypto27.createHmac)("sha256", payloadKey).update(
         JSON.stringify({
           repoPath: identity2.repoPath,
           profile: environment.profile,
           kind: request2.kind,
           operation: request2.operation ?? null,
-          command: request2.kind === "exec" ? request2.command : null
+          command: request2.kind === "exec" ? request2.command : null,
+          ...request2.kind === "ensure" && request2.initializeNew ? { initializeNew: true } : {}
         })
       ).digest("hex");
       const previousPayload = acceptedPayloads.get(prepared.operationId);
@@ -20818,7 +20982,7 @@ function createCapacityController(options) {
             {
               ...charge,
               operationId: prepared.operationId,
-              reservationId: (0, import_node_crypto26.randomUUID)(),
+              reservationId: (0, import_node_crypto27.randomUUID)(),
               policyRevision: current.revision
             },
             { estimates: resolved2.estimates, enrollment: resolved2.enrollment, pool }
@@ -20877,7 +21041,7 @@ function createCapacityController(options) {
       if (signal.aborted || !policy.recovery.enabled) return;
       if (failedCapabilities.length === 0 || failedCapabilities.length > 64) return;
       const current = readCapacityPolicy(options.directory);
-      if (current?.admissions !== "enabled" || !(0, import_node_util14.isDeepStrictEqual)(current, policy)) return;
+      if (current?.admissions !== "enabled" || !(0, import_node_util15.isDeepStrictEqual)(current, policy)) return;
       let observed;
       try {
         observed = revalidate();
@@ -20897,10 +21061,10 @@ function createCapacityController(options) {
       } catch {
         return;
       }
-      if (signal.aborted || !(0, import_node_util14.isDeepStrictEqual)(resolved2.environment, environment)) return;
-      if (!(0, import_node_util14.isDeepStrictEqual)(readCapacityPolicy(options.directory), current)) return;
+      if (signal.aborted || !(0, import_node_util15.isDeepStrictEqual)(resolved2.environment, environment)) return;
+      if (!(0, import_node_util15.isDeepStrictEqual)(readCapacityPolicy(options.directory), current)) return;
       const runtime = current.domains[resolved2.enrollment.runtimeDomain];
-      if (runtime?.kind !== "runtime" || runtime.hostDomain !== resolved2.enrollment.hostDomain || current.domains[runtime.hostDomain]?.kind !== "host" || !current.enrollments.some((entry) => (0, import_node_util14.isDeepStrictEqual)(entry, resolved2.enrollment)))
+      if (runtime?.kind !== "runtime" || runtime.hostDomain !== resolved2.enrollment.hostDomain || current.domains[runtime.hostDomain]?.kind !== "host" || !current.enrollments.some((entry) => (0, import_node_util15.isDeepStrictEqual)(entry, resolved2.enrollment)))
         return;
       const identity2 = environmentIdentity(environment);
       const record6 = readReliabilityOperation(identity2);
@@ -20953,7 +21117,7 @@ function createCapacityController(options) {
           // the budget module then falls back to the conservative wall duration.
           activeElapsedMs: null,
           profile: environment.profile,
-          incidentId: `incident-${(0, import_node_crypto26.randomUUID)()}`
+          incidentId: `incident-${(0, import_node_crypto27.randomUUID)()}`
         });
       } catch {
         return;
@@ -20971,7 +21135,7 @@ function createCapacityController(options) {
           {
             ...charge,
             operationId: prepared.operationId,
-            reservationId: (0, import_node_crypto26.randomUUID)(),
+            reservationId: (0, import_node_crypto27.randomUUID)(),
             policyRevision: current.revision
           },
           { estimates: resolved2.estimates, enrollment: resolved2.enrollment, pool }
@@ -20991,13 +21155,13 @@ function createCapacityController(options) {
     }
   };
 }
-var import_node_crypto26, import_node_path48, import_node_util14;
+var import_node_crypto27, import_node_path49, import_node_util15;
 var init_capacity_controller = __esm({
   "src/core/capacity-controller.ts"() {
     "use strict";
-    import_node_crypto26 = require("crypto");
-    import_node_path48 = __toESM(require("path"));
-    import_node_util14 = require("util");
+    import_node_crypto27 = require("crypto");
+    import_node_path49 = __toESM(require("path"));
+    import_node_util15 = require("util");
     init_capacity_accounting();
     init_capacity_docker_probe();
     init_capacity_enrollment();
@@ -21093,7 +21257,7 @@ printf '%s %s %s\n' "$pid" "$birth" "$fingerprint"
 
 // src/core/controller-observation.ts
 function digest2(value) {
-  return (0, import_node_crypto27.createHash)("sha256").update(JSON.stringify(value)).digest("hex");
+  return (0, import_node_crypto28.createHash)("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function readRoutes() {
   return readHostRouteStateReadOnly((file) => readControllerEvidence(file, 1048576));
@@ -21156,14 +21320,14 @@ function createControllerObservationCollector(resolve, fingerprint) {
     )).trim().split("\n");
     if (metadata.length !== 2) throw new Error("Observation ownership paths unavailable.");
     const [gitDir, commonDir] = metadata;
-    const sourcePath = import_node_path49.default.join(environment.repoPath, ".devcontainer/devcontainer.json");
+    const sourcePath = import_node_path50.default.join(environment.repoPath, ".devcontainer/devcontainer.json");
     const files = [
-      import_node_path49.default.join(commonDir, "devrouter/workspaces", `${environment.workspace}.json`),
-      import_node_path49.default.join(environment.repoPath, ".devrouter.yml"),
-      import_node_path49.default.join(gitDir, "devrouter-workspace"),
+      import_node_path50.default.join(commonDir, "devrouter/workspaces", `${environment.workspace}.json`),
+      import_node_path50.default.join(environment.repoPath, ".devrouter.yml"),
+      import_node_path50.default.join(gitDir, "devrouter-workspace"),
       managedRuntimeStatePath(environment.repoPath, environment.workspace),
       sourcePath,
-      import_node_path49.default.join(environment.repoPath, MANAGED_DEVCONTAINER_PATH)
+      import_node_path50.default.join(environment.repoPath, MANAGED_DEVCONTAINER_PATH)
     ];
     const persisted = captureControllerEvidence(files);
     if (fingerprint(persisted.contents[0], persisted.contents[1]) !== environment.fingerprint)
@@ -21177,7 +21341,7 @@ function createControllerObservationCollector(resolve, fingerprint) {
       () => persisted.contents[3]
     );
     const source = parseDevcontainerConfig(persisted.contents[4], sourcePath);
-    if (!state || state.devpodId !== environment.providerId || state.profile !== environment.profile || typeof source.service !== "string" || !source.service || (0, import_node_crypto27.createHash)("sha256").update(persisted.contents[4]).digest("hex") !== state.sourceConfigSha256 || (0, import_node_crypto27.createHash)("sha256").update(persisted.contents[5]).digest("hex") !== state.effectiveConfigSha256)
+    if (!state || state.devpodId !== environment.providerId || state.profile !== environment.profile || typeof source.service !== "string" || !source.service || (0, import_node_crypto28.createHash)("sha256").update(persisted.contents[4]).digest("hex") !== state.sourceConfigSha256 || (0, import_node_crypto28.createHash)("sha256").update(persisted.contents[5]).digest("hex") !== state.effectiveConfigSha256)
       throw new ControllerObservationBindingChanged("Observation retained configuration changed.");
     const identity2 = {
       repoPath: environment.repoPath,
@@ -21188,7 +21352,7 @@ function createControllerObservationCollector(resolve, fingerprint) {
     if (!journal) throw new Error("Observation journal is unavailable.");
     const routes = readRoutes().filter((route) => route.repoPath === environment.repoPath);
     const before = await containers(state.composeProject, signal);
-    const composeDirectory = import_node_path49.default.join(environment.repoPath, ".devcontainer");
+    const composeDirectory = import_node_path50.default.join(environment.repoPath, ".devcontainer");
     const references = typeof source.dockerComposeFile === "string" ? [source.dockerComposeFile] : source.dockerComposeFile;
     if (!Array.isArray(references) || !references.length || references.some((value) => typeof value !== "string"))
       throw new Error("Observation Compose source is unavailable.");
@@ -21205,7 +21369,7 @@ function createControllerObservationCollector(resolve, fingerprint) {
       if (!recorded || container.labels["com.docker.compose.project.working_dir"] !== composeDirectory)
         throw new Error("Observation Compose ownership is unavailable.");
       const files2 = recorded.split(",").map((file) => file.trim());
-      if (files2.some((file) => !import_node_path49.default.isAbsolute(file)) || !hasExactComposeIdentity(container, {
+      if (files2.some((file) => !import_node_path50.default.isAbsolute(file)) || !hasExactComposeIdentity(container, {
         repoPath: environment.repoPath,
         service: container.labels["com.docker.compose.service"] ?? "",
         composeProject: state.composeProject,
@@ -21352,12 +21516,12 @@ function createControllerObservationCollector(resolve, fingerprint) {
     };
   };
 }
-var import_node_crypto27, import_node_path49, OBSERVATION_INSPECT_TEMPLATE;
+var import_node_crypto28, import_node_path50, OBSERVATION_INSPECT_TEMPLATE;
 var init_controller_observation = __esm({
   "src/core/controller-observation.ts"() {
     "use strict";
-    import_node_crypto27 = require("crypto");
-    import_node_path49 = __toESM(require("path"));
+    import_node_crypto28 = require("crypto");
+    import_node_path50 = __toESM(require("path"));
     init_controller_binding();
     init_controller_monitor();
     init_controller_probe();
@@ -21381,12 +21545,12 @@ var init_controller_observation = __esm({
 });
 
 // src/core/controller-sessions.ts
-var import_node_crypto28, import_node_util15, ControllerSessions;
+var import_node_crypto29, import_node_util16, ControllerSessions;
 var init_controller_sessions = __esm({
   "src/core/controller-sessions.ts"() {
     "use strict";
-    import_node_crypto28 = require("crypto");
-    import_node_util15 = require("util");
+    import_node_crypto29 = require("crypto");
+    import_node_util16 = require("util");
     ControllerSessions = class {
       constructor(store, readWakeEpoch = () => void 0) {
         this.store = store;
@@ -21465,7 +21629,7 @@ var init_controller_sessions = __esm({
       }
       checkEnvironment(next, environment) {
         const shared = next.environments.find((entry) => entry.repoPath === environment.repoPath);
-        if (shared && !(0, import_node_util15.isDeepStrictEqual)(shared, environment))
+        if (shared && !(0, import_node_util16.isDeepStrictEqual)(shared, environment))
           throw new Error("Controller environment binding conflicts.");
         const known = [
           ...next.environments,
@@ -21579,7 +21743,7 @@ var init_controller_sessions = __esm({
         const session = {
           id: id5,
           environmentId: environment.id,
-          generation: (0, import_node_crypto28.randomUUID)(),
+          generation: (0, import_node_crypto29.randomUUID)(),
           requirements: required,
           renewedAtMs: wall,
           parkingConsent: "protected",
@@ -21601,13 +21765,13 @@ var init_controller_sessions = __esm({
         const retained = next.retainedSessions.find(
           (entry) => entry.id === previous.session && entry.epoch === previous.epoch && entry.generation === previous.generation
         );
-        if (previous.store !== next.store || next.version !== 3 || previous.epoch < next.fingerprint.enrolledEpoch || !retained || next.sessions.some((entry) => entry.id === previous.session) || !(0, import_node_util15.isDeepStrictEqual)(retained.environment, environment) || !(0, import_node_util15.isDeepStrictEqual)([...retained.requirements].sort(), required))
+        if (previous.store !== next.store || next.version !== 3 || previous.epoch < next.fingerprint.enrolledEpoch || !retained || next.sessions.some((entry) => entry.id === previous.session) || !(0, import_node_util16.isDeepStrictEqual)(retained.environment, environment) || !(0, import_node_util16.isDeepStrictEqual)([...retained.requirements].sort(), required))
           throw new Error("Controller reconnect binding is unavailable or changed.");
         const shared = this.checkEnvironment(next, environment);
         const session = {
           id: previous.session,
           environmentId: environment.id,
-          generation: (0, import_node_crypto28.randomUUID)(),
+          generation: (0, import_node_crypto29.randomUUID)(),
           requirements: required,
           renewedAtMs: wall,
           parkingConsent: "protected",
@@ -21767,26 +21931,26 @@ var init_controller_sessions = __esm({
 
 // src/core/controller-server.ts
 function privateDirectory2(directory) {
-  const absolute2 = import_node_path50.default.resolve(directory);
-  let current = import_node_path50.default.parse(absolute2).root;
-  for (const part of absolute2.slice(current.length).split(import_node_path50.default.sep)) {
-    current = import_node_path50.default.join(current, part);
+  const absolute2 = import_node_path51.default.resolve(directory);
+  let current = import_node_path51.default.parse(absolute2).root;
+  for (const part of absolute2.slice(current.length).split(import_node_path51.default.sep)) {
+    current = import_node_path51.default.join(current, part);
     try {
-      const stat2 = import_node_fs39.default.lstatSync(current);
+      const stat2 = import_node_fs40.default.lstatSync(current);
       if (!stat2.isDirectory() || stat2.isSymbolicLink())
         throw new Error("Unsafe controller directory.");
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
-      import_node_fs39.default.mkdirSync(current, { mode: 448 });
+      import_node_fs40.default.mkdirSync(current, { mode: 448 });
     }
   }
-  const stat = import_node_fs39.default.lstatSync(absolute2);
+  const stat = import_node_fs40.default.lstatSync(absolute2);
   if (stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0)
     throw new Error("Controller directory is not private.");
 }
 function validateOwnedFile(file, socket) {
   try {
-    const stat = import_node_fs39.default.lstatSync(file);
+    const stat = import_node_fs40.default.lstatSync(file);
     if (stat.uid !== process.getuid?.() || (socket ? !stat.isSocket() : !stat.isFile()) || (stat.mode & 63) !== 0)
       throw new Error("Unsafe controller artifact.");
     return true;
@@ -21806,12 +21970,12 @@ async function runController(options) {
     throw new Error("Controller bindings require one owner.");
   if (options.operations && options.createOperations)
     throw new Error("Controller operations have multiple owners.");
-  const socketPath = import_node_path50.default.join(options.directory, "control.sock");
+  const socketPath = import_node_path51.default.join(options.directory, "control.sock");
   if (Buffer.byteLength(socketPath) > 103) throw new Error("Controller socket path is too long.");
   privateDirectory2(options.directory);
-  const lockPath = import_node_path50.default.join(options.directory, "owner.lock");
+  const lockPath = import_node_path51.default.join(options.directory, "owner.lock");
   try {
-    const stat = import_node_fs39.default.lstatSync(lockPath);
+    const stat = import_node_fs40.default.lstatSync(lockPath);
     if (!stat.isFile() || stat.uid !== process.getuid?.())
       throw new Error("Unsafe controller owner lock.");
   } catch (error) {
@@ -21822,7 +21986,7 @@ async function runController(options) {
   await withFileLock(lockPath, { activity: "controller ownership", waitMs: 0 }, async () => {
     const staleSocket = validateOwnedFile(socketPath, true);
     const sessions = new ControllerSessions(store, options.wakeEpoch ?? readHostWakeEpoch);
-    if (staleSocket) import_node_fs39.default.unlinkSync(socketPath);
+    if (staleSocket) import_node_fs40.default.unlinkSync(socketPath);
     const incarnation = sessions.read();
     const { resolve, collect } = options.createBindings?.(store.bindingFingerprint()) ?? {
       resolve: options.resolve,
@@ -22368,7 +22532,7 @@ async function runController(options) {
           resolve2();
         });
       });
-      import_node_fs39.default.chmodSync(socketPath, 384);
+      import_node_fs40.default.chmodSync(socketPath, 384);
       await new Promise((resolve2) => {
         finish = resolve2;
         options.signal.addEventListener("abort", shutdown, { once: true });
@@ -22387,13 +22551,13 @@ async function runController(options) {
     }
   });
 }
-var import_node_fs39, import_node_net4, import_node_path50, FRAME_BYTES;
+var import_node_fs40, import_node_net4, import_node_path51, FRAME_BYTES;
 var init_controller_server = __esm({
   "src/core/controller-server.ts"() {
     "use strict";
-    import_node_fs39 = __toESM(require("fs"));
+    import_node_fs40 = __toESM(require("fs"));
     import_node_net4 = __toESM(require("net"));
-    import_node_path50 = __toESM(require("path"));
+    import_node_path51 = __toESM(require("path"));
     init_controller_monitor();
     init_controller_protocol();
     init_controller_sessions();
@@ -22412,7 +22576,7 @@ __export(controller_exports, {
   runControllerCommand: () => runControllerCommand
 });
 async function runControllerCommand(method, options, repo, dependencies = {}) {
-  const directory = import_node_path51.default.join(DEVROUTER_HOME, "controller");
+  const directory = import_node_path52.default.join(DEVROUTER_HOME, "controller");
   try {
     if (method === "run") {
       const controller = new AbortController();
@@ -22458,7 +22622,7 @@ async function runControllerCommand(method, options, repo, dependencies = {}) {
     if (fields2.timeout !== void 0) fields2.timeout = Number(fields2.timeout);
     await controllerRequest(
       directory,
-      { method, ...fields2, ...repo ? { path: import_node_path51.default.resolve(repo) } : {} },
+      { method, ...fields2, ...repo ? { path: import_node_path52.default.resolve(repo) } : {} },
       (value) => process.stdout.write(`${JSON.stringify(value)}
 `)
     );
@@ -22473,11 +22637,11 @@ async function runControllerCommand(method, options, repo, dependencies = {}) {
     process.exitCode = 1;
   }
 }
-var import_node_path51;
+var import_node_path52;
 var init_controller = __esm({
   "src/commands/controller.ts"() {
     "use strict";
-    import_node_path51 = __toESM(require("path"));
+    import_node_path52 = __toESM(require("path"));
     init_capacity_collector();
     init_capacity_controller();
     init_capacity_policy();
@@ -22561,7 +22725,7 @@ function refusalLines(refusal) {
 }
 async function runCapacityCommand(method, options, dependencies = {}) {
   if (method !== "reconcile") throw new Error(`Unsupported capacity command: ${method}`);
-  const directory = dependencies.directory ?? import_node_path52.default.join(DEVROUTER_HOME, "controller");
+  const directory = dependencies.directory ?? import_node_path53.default.join(DEVROUTER_HOME, "controller");
   const json = Boolean(options.json);
   const emit = (payload, human) => {
     process.stdout.write(json ? `${JSON.stringify(payload, null, 2)}
@@ -22617,11 +22781,11 @@ async function runCapacityCommand(method, options, dependencies = {}) {
     );
   }
 }
-var import_node_path52, POOL_PROBE_TIMEOUT_MS, CapacityReconcileRefusal;
+var import_node_path53, POOL_PROBE_TIMEOUT_MS, CapacityReconcileRefusal;
 var init_capacity = __esm({
   "src/commands/capacity.ts"() {
     "use strict";
-    import_node_path52 = __toESM(require("path"));
+    import_node_path53 = __toESM(require("path"));
     init_capacity_docker_probe();
     init_capacity_policy();
     init_reliability_operation_store();
@@ -22677,28 +22841,28 @@ function replaceDevrouterSection(content) {
   return `${content.slice(0, start)}${buildDevrouterSection()}${content.slice(end)}`;
 }
 function writeRepoFile(repoPath, relPath, content) {
-  const absolutePath = (0, import_node_path53.join)(repoPath, relPath);
-  (0, import_node_fs40.mkdirSync)((0, import_node_path53.dirname)(absolutePath), { recursive: true });
-  (0, import_node_fs40.writeFileSync)(absolutePath, content, "utf-8");
+  const absolutePath = (0, import_node_path54.join)(repoPath, relPath);
+  (0, import_node_fs41.mkdirSync)((0, import_node_path54.dirname)(absolutePath), { recursive: true });
+  (0, import_node_fs41.writeFileSync)(absolutePath, content, "utf-8");
   return absolutePath;
 }
 function ensureAgentsMdSection(repoPath) {
-  const filePath = (0, import_node_path53.join)(repoPath, AGENTS_MD);
-  if ((0, import_node_fs40.existsSync)(filePath)) {
-    const content = (0, import_node_fs40.readFileSync)(filePath, "utf-8");
+  const filePath = (0, import_node_path54.join)(repoPath, AGENTS_MD);
+  if ((0, import_node_fs41.existsSync)(filePath)) {
+    const content = (0, import_node_fs41.readFileSync)(filePath, "utf-8");
     if (content.includes(DEVROUTER_SENTINEL)) {
       const updated = replaceDevrouterSection(content);
       if (updated === void 0 || updated === content) return { path: filePath, written: false };
-      (0, import_node_fs40.writeFileSync)(filePath, updated, "utf-8");
+      (0, import_node_fs41.writeFileSync)(filePath, updated, "utf-8");
       return { path: filePath, written: true };
     }
-    (0, import_node_fs40.writeFileSync)(filePath, `${content.trimEnd()}
+    (0, import_node_fs41.writeFileSync)(filePath, `${content.trimEnd()}
 
 ${buildDevrouterSection()}
 `, "utf-8");
     return { path: filePath, written: true };
   }
-  (0, import_node_fs40.writeFileSync)(filePath, `# AGENTS.md
+  (0, import_node_fs41.writeFileSync)(filePath, `# AGENTS.md
 
 ${buildDevrouterSection()}
 `, "utf-8");
@@ -22708,12 +22872,12 @@ function ensureSkillFile(repoPath) {
   const filePath = writeRepoFile(repoPath, DEVROUTER_SKILL_REL_PATH, DEVROUTER_SKILL_CONTENT);
   return { path: filePath, written: true };
 }
-var import_node_fs40, import_node_path53, DEVROUTER_SENTINEL, DEVROUTER_END_SENTINEL, LEGACY_DEVROUTER_SECTION_END, AGENTS_MD, DEVROUTER_SKILL_REL_PATH, DEVROUTER_SKILL_CONTENT;
+var import_node_fs41, import_node_path54, DEVROUTER_SENTINEL, DEVROUTER_END_SENTINEL, LEGACY_DEVROUTER_SECTION_END, AGENTS_MD, DEVROUTER_SKILL_REL_PATH, DEVROUTER_SKILL_CONTENT;
 var init_agents_md = __esm({
   "src/core/agents-md.ts"() {
     "use strict";
-    import_node_fs40 = require("fs");
-    import_node_path53 = require("path");
+    import_node_fs41 = require("fs");
+    import_node_path54 = require("path");
     DEVROUTER_SENTINEL = "<!-- devrouter -->";
     DEVROUTER_END_SENTINEL = "<!-- /devrouter -->";
     LEGACY_DEVROUTER_SECTION_END = "- `devrouter ls`";
@@ -23335,6 +23499,7 @@ function buildOnboardingPrompt(options = {}) {
     "- Managed process reuse fingerprints command argv, workspace identity, and the exact adapter snapshot. Variant and current host-port identity always compose with an explicit --fingerprint. If a non-secret runtime value also affects reuse, set `DEVROUTER_PROCESS_FINGERPRINT_ENV` to its comma-separated environment names; secret-like names are rejected and raw values are never persisted.",
     "- Managed adapters may use devrouter-process ensure --prepare-command <command> for synchronous dependency preparation under the process lock before app launch. Unchanged owned processes skip preparation; it participates in default fingerprints and must not daemonize or detach.",
     "- Host-generated Compose inputs may use managedRuntime.devcontainer.prepareCommand as literal argv. Ensure runs it once from the checkout root before Compose inspection, with a 60-second bound and no implicit shell. Keep .devrouter.yml unchanged. Diagnostics never run it; changed warm mounts require separate verification.",
+    "- Explicit first initialization: managedRuntime.devcontainer.freshBootstrap declares literal command argv, dataVolumes and optional sharedCaches keys. ensure <new-checkout> --initialize-new requires qualified Devsy 1.19.0 or 1.24.0, new local data volumes and repository-owned database identity/emptiness checks. A durable attempt prevents replay after failure, unknown completion, cancellation, stop, replacement or settlement. Ordinary hooks must preserve data. Consult docs/DEVCONTAINER.md for context and mount prerequisites; never clear the attempt fence or infer reset authority.",
     "- Managed Devsy startup on supported local Unix Docker endpoints captures exact stop ownership before application readiness. With that baseline, canonical stop tolerates changed or missing repository configuration and preserves containers and volumes. Older records without a baseline retain configuration-dependent stop; installing a new CLI does not establish historical ownership. Invalid or changed ownership never falls back. Do not replay destructive bootstrap hooks to obtain a baseline.",
     "- Owner status is `present`, `missing`, `locked`, or `conflict`. Dirty or locked full down fails before side effects. `workspace gc` is a dry run; only `--yes` deletes exact eligible missing resources and records, never Git worktrees, branches, or prune state.",
     "- `devrouter workspace cleanup --repo . --inactive-for 30d --check-merged --json` is report-only and never mutates the workspace runtime, routes, ownership, Git, Docker, applications, worktrees, or branches. It reports ownership, workspace runtime registration, runtime state (`running|stopped|busy|not-found|absent|unknown`), checkout, advisory activity, route, and integration evidence. Local DevPod/Devsy list/status checks always run; `--check-merged` alone enables read-only origin and matching GitHub/GitLab checks. Treat `not-found` as stale runtime after Docker pruning; busy, unavailable, or conflicting evidence suppresses destructive suggestions. Explicit `gc`/`down` can remove exact stale registration only after expected-ID `NotFound` proof and ownership revalidation. Runtime `lastUsed` remains advisory.",
@@ -23504,7 +23669,7 @@ var init_ai_prompt = __esm({
         purpose: "Write/update devrouter section in the repo's AGENTS.md and install the devrouter skill."
       },
       {
-        command: "devrouter ensure [path] [--profile <name>] [--variant <name>] [--repair] [--open] [--json]",
+        command: "devrouter ensure [path] [--profile <name>] [--variant <name>] [--repair | --initialize-new] [--open] [--json]",
         purpose: "Canonical startup and proof for an exact primary or linked checkout; atomically publishes routes after readiness."
       },
       {
@@ -24222,11 +24387,11 @@ function extractCurrentVersionFromRepoConfig(repoPath) {
   };
 }
 function readPromptDirectory(promptDirPath) {
-  if (!import_node_fs41.default.existsSync(promptDirPath)) {
+  if (!import_node_fs42.default.existsSync(promptDirPath)) {
     throw new Error(`Missing ${UPGRADE_PROMPTS_DIR} directory at ${promptDirPath}.`);
   }
   const releases = [];
-  const files = import_node_fs41.default.readdirSync(promptDirPath, { withFileTypes: true });
+  const files = import_node_fs42.default.readdirSync(promptDirPath, { withFileTypes: true });
   for (const file of files) {
     if (!file.isFile() || !file.name.endsWith(".md")) {
       continue;
@@ -24236,8 +24401,8 @@ function readPromptDirectory(promptDirPath) {
       continue;
     }
     const version = normalizeVersion(basename);
-    const promptPath = import_node_path54.default.join(promptDirPath, file.name);
-    const prompt = import_node_fs41.default.readFileSync(promptPath, "utf-8").trim();
+    const promptPath = import_node_path55.default.join(promptDirPath, file.name);
+    const prompt = import_node_fs42.default.readFileSync(promptPath, "utf-8").trim();
     releases.push({ version, prompt, promptPath });
   }
   const deduped = /* @__PURE__ */ new Map();
@@ -24258,19 +24423,19 @@ function listAvailableUpgradeTargets(currentVersion, releases) {
 }
 function resolvePromptDirectory(explicitPath) {
   if (explicitPath) {
-    return import_node_path54.default.resolve(explicitPath);
+    return import_node_path55.default.resolve(explicitPath);
   }
-  const entryFile = process.argv[1] ? import_node_path54.default.resolve(process.argv[1]) : __filename;
-  const entryDir = import_node_path54.default.dirname(entryFile);
-  const resolvedEntryDir = import_node_fs41.default.existsSync(entryFile) ? import_node_path54.default.dirname(import_node_fs41.default.realpathSync(entryFile)) : entryDir;
+  const entryFile = process.argv[1] ? import_node_path55.default.resolve(process.argv[1]) : __filename;
+  const entryDir = import_node_path55.default.dirname(entryFile);
+  const resolvedEntryDir = import_node_fs42.default.existsSync(entryFile) ? import_node_path55.default.dirname(import_node_fs42.default.realpathSync(entryFile)) : entryDir;
   const candidates = [
-    import_node_path54.default.resolve(resolvedEntryDir, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path54.default.resolve(entryDir, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path54.default.resolve(__dirname, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path54.default.resolve(__dirname, "..", "..", UPGRADE_PROMPTS_DIR),
-    import_node_path54.default.resolve(process.cwd(), UPGRADE_PROMPTS_DIR)
+    import_node_path55.default.resolve(resolvedEntryDir, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path55.default.resolve(entryDir, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path55.default.resolve(__dirname, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path55.default.resolve(__dirname, "..", "..", UPGRADE_PROMPTS_DIR),
+    import_node_path55.default.resolve(process.cwd(), UPGRADE_PROMPTS_DIR)
   ];
-  const existing = candidates.find((candidate) => import_node_fs41.default.existsSync(candidate));
+  const existing = candidates.find((candidate) => import_node_fs42.default.existsSync(candidate));
   return existing ?? candidates[0];
 }
 function loadUpgradeCatalog(options = {}) {
@@ -24286,12 +24451,12 @@ function loadUpgradeCatalog(options = {}) {
     releases
   };
 }
-var import_node_fs41, import_node_path54, SEMVER_RE, UPGRADE_PROMPTS_DIR;
+var import_node_fs42, import_node_path55, SEMVER_RE, UPGRADE_PROMPTS_DIR;
 var init_upgrade = __esm({
   "src/core/upgrade.ts"() {
     "use strict";
-    import_node_fs41 = __toESM(require("fs"));
-    import_node_path54 = __toESM(require("path"));
+    import_node_fs42 = __toESM(require("fs"));
+    import_node_path55 = __toESM(require("path"));
     init_repo_config();
     SEMVER_RE = /^v?(\d+)\.(\d+)\.(\d+)$/;
     UPGRADE_PROMPTS_DIR = "upgrade-prompts";
@@ -24444,7 +24609,7 @@ function isLoopbackHost(host) {
   return host === "127.0.0.1" || host === "localhost" || host === "host.docker.internal";
 }
 function inspectCompose(composeFile, _workspace) {
-  if (!import_node_fs42.default.existsSync(composeFile)) {
+  if (!import_node_fs43.default.existsSync(composeFile)) {
     return {
       aliases: [],
       publishedPorts: [],
@@ -24453,8 +24618,8 @@ function inspectCompose(composeFile, _workspace) {
     };
   }
   try {
-    const raw = import_node_fs42.default.readFileSync(composeFile, "utf-8");
-    const parsed = import_yaml5.default.parse(raw);
+    const raw = import_node_fs43.default.readFileSync(composeFile, "utf-8");
+    const parsed = import_yaml6.default.parse(raw);
     const root = asRecord(parsed);
     const services = asRecord(root?.services);
     const networks = asRecord(root?.networks);
@@ -24550,11 +24715,11 @@ function buildHostPortClaimsCheck(repoPath, workspace) {
   }
 }
 function buildDevcontainerChecks(repoPath, config, workspace) {
-  const devcontainerDir = import_node_path55.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs42.default.existsSync(devcontainerDir)) {
+  const devcontainerDir = import_node_path56.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs43.default.existsSync(devcontainerDir)) {
     return [];
   }
-  const compose = inspectCompose(import_node_path55.default.join(devcontainerDir, "docker-compose.yml"), workspace);
+  const compose = inspectCompose(import_node_path56.default.join(devcontainerDir, "docker-compose.yml"), workspace);
   const checks = [];
   if (compose.parseError) {
     checks.push({
@@ -24581,9 +24746,9 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
     details: compose.publishedPorts.length > 0 ? compose.publishedPorts.join(", ") : void 0,
     suggestion: compose.parseError || compose.publishedPorts.length > 0 ? "Remove published ports and route services through devnet aliases with devrouter proxy apps." : void 0
   });
-  const dockerfilePath = import_node_path55.default.join(devcontainerDir, "Dockerfile");
-  const dockerfileExists = import_node_fs42.default.existsSync(dockerfilePath);
-  const dockerfile = dockerfileExists ? import_node_fs42.default.readFileSync(dockerfilePath, "utf-8") : "";
+  const dockerfilePath = import_node_path56.default.join(devcontainerDir, "Dockerfile");
+  const dockerfileExists = import_node_fs43.default.existsSync(dockerfilePath);
+  const dockerfile = dockerfileExists ? import_node_fs43.default.readFileSync(dockerfilePath, "utf-8") : "";
   const devrouterArtifacts = ["@devrouter/cli", "devrouter-process"].filter(
     (artifact) => dockerfile.includes(artifact)
   );
@@ -24641,13 +24806,13 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
   });
   return checks;
 }
-var import_node_fs42, import_node_path55, import_yaml5;
+var import_node_fs43, import_node_path56, import_yaml6;
 var init_devcontainer_diagnostics = __esm({
   "src/core/devcontainer-diagnostics.ts"() {
     "use strict";
-    import_node_fs42 = __toESM(require("fs"));
-    import_node_path55 = __toESM(require("path"));
-    import_yaml5 = __toESM(require("yaml"));
+    import_node_fs43 = __toESM(require("fs"));
+    import_node_path56 = __toESM(require("path"));
+    import_yaml6 = __toESM(require("yaml"));
     init_devcontainer_profile();
     init_host_port_claims();
     init_managed_post_start();
@@ -24742,11 +24907,11 @@ function reconcileRouteRunConflict(repoPath, app) {
     }
   }
 }
-var import_node_fs43;
+var import_node_fs44;
 var init_route_state = __esm({
   "src/core/route-state.ts"() {
     "use strict";
-    import_node_fs43 = __toESM(require("fs"));
+    import_node_fs44 = __toESM(require("fs"));
     init_host_routes();
     init_workspace();
   }
@@ -24921,7 +25086,7 @@ function toRepoStatus(repoPath) {
   const resolvedRepoPath = resolveRepoPath(repoPath);
   const configPath = getRepoConfigPath(resolvedRepoPath);
   const explicitRepo = typeof repoPath === "string" && repoPath.trim().length > 0;
-  const configExists = import_node_fs44.default.existsSync(configPath);
+  const configExists = import_node_fs45.default.existsSync(configPath);
   if (!explicitRepo && !configExists) {
     return void 0;
   }
@@ -25074,11 +25239,11 @@ async function collectRouterStatus(repoPath) {
     }
   };
 }
-var import_node_fs44;
+var import_node_fs45;
 var init_status = __esm({
   "src/core/status.ts"() {
     "use strict";
-    import_node_fs44 = __toESM(require("fs"));
+    import_node_fs45 = __toESM(require("fs"));
     init_docker();
     init_managed_runtime_state();
     init_managed_runtime_status();
@@ -25088,14 +25253,14 @@ var init_status = __esm({
 });
 
 // src/core/idle-sweep.ts
-function idleSweepPaths(home = import_node_os6.default.homedir(), devrouterHome = DEVROUTER_HOME) {
-  const directory = import_node_path56.default.join(devrouterHome, "idle");
+function idleSweepPaths(home = import_node_os7.default.homedir(), devrouterHome = DEVROUTER_HOME) {
+  const directory = import_node_path57.default.join(devrouterHome, "idle");
   return {
-    plist: import_node_path56.default.join(home, "Library", "LaunchAgents", `${IDLE_SWEEP_LABEL}.plist`),
+    plist: import_node_path57.default.join(home, "Library", "LaunchAgents", `${IDLE_SWEEP_LABEL}.plist`),
     directory,
-    log: import_node_path56.default.join(directory, "sweep.log"),
-    lastSweep: import_node_path56.default.join(directory, "last-sweep.json"),
-    lock: import_node_path56.default.join(directory, "sweep.lock")
+    log: import_node_path57.default.join(directory, "sweep.log"),
+    lastSweep: import_node_path57.default.join(directory, "last-sweep.json"),
+    lock: import_node_path57.default.join(directory, "sweep.lock")
   };
 }
 function xml(value) {
@@ -25140,14 +25305,14 @@ ${env}
 function readInstalledIdleFor(plistPath) {
   let contents;
   try {
-    contents = import_node_fs45.default.readFileSync(plistPath, "utf-8");
+    contents = import_node_fs46.default.readFileSync(plistPath, "utf-8");
   } catch {
     return void 0;
   }
   return /<string>--idle-for<\/string>\s*<string>([^<]+)<\/string>/.exec(contents)?.[1] ?? "unknown";
 }
 function locateTool(name) {
-  const result = (0, import_node_child_process34.spawnSync)("/bin/sh", ["-c", `command -v ${name}`], { encoding: "utf-8" });
+  const result = (0, import_node_child_process35.spawnSync)("/bin/sh", ["-c", `command -v ${name}`], { encoding: "utf-8" });
   const found = result.status === 0 ? result.stdout.trim() : "";
   return found.startsWith("/") ? found : void 0;
 }
@@ -25155,7 +25320,7 @@ function resolveIdleSweepEnvironment(env = process.env, locate = locateTool) {
   const docker = locate("docker");
   if (!docker)
     throw new Error("docker is not on PATH; the idle sweep cannot inspect environments.");
-  const toolDirs = [docker, locate("devsy"), locate("devpod"), process.execPath].filter((tool) => Boolean(tool)).map((tool) => import_node_path56.default.dirname(tool));
+  const toolDirs = [docker, locate("devsy"), locate("devpod"), process.execPath].filter((tool) => Boolean(tool)).map((tool) => import_node_path57.default.dirname(tool));
   const environment = {
     PATH: [.../* @__PURE__ */ new Set([...toolDirs, ...SYSTEM_PATH])].join(":")
   };
@@ -25173,9 +25338,9 @@ function installIdleSweep(input2) {
     throw new Error("The idle sweep uses launchd and is only available on macOS.");
   const paths = input2.paths ?? idleSweepPaths();
   const launchctl = input2.launchctl ?? defaultLaunchctl;
-  const entryPath = input2.entryPath ?? import_node_fs45.default.realpathSync(process.argv[1]);
-  import_node_fs45.default.mkdirSync(paths.directory, { recursive: true, mode: 448 });
-  import_node_fs45.default.mkdirSync(import_node_path56.default.dirname(paths.plist), { recursive: true });
+  const entryPath = input2.entryPath ?? import_node_fs46.default.realpathSync(process.argv[1]);
+  import_node_fs46.default.mkdirSync(paths.directory, { recursive: true, mode: 448 });
+  import_node_fs46.default.mkdirSync(import_node_path57.default.dirname(paths.plist), { recursive: true });
   const contents = renderIdleSweepPlist({
     nodePath: process.execPath,
     entryPath,
@@ -25184,7 +25349,7 @@ function installIdleSweep(input2) {
     logPath: paths.log
   });
   launchctl(["bootout", `${launchDomain()}/${IDLE_SWEEP_LABEL}`]);
-  import_node_fs45.default.writeFileSync(paths.plist, contents, { mode: 420 });
+  import_node_fs46.default.writeFileSync(paths.plist, contents, { mode: 420 });
   const loaded = launchctl(["bootstrap", launchDomain(), paths.plist]);
   if (loaded.status !== 0)
     throw new Error(
@@ -25194,9 +25359,9 @@ function installIdleSweep(input2) {
 }
 function removeIdleSweep(input2 = {}) {
   const paths = input2.paths ?? idleSweepPaths();
-  if (!import_node_fs45.default.existsSync(paths.plist)) return false;
+  if (!import_node_fs46.default.existsSync(paths.plist)) return false;
   (input2.launchctl ?? defaultLaunchctl)(["bootout", `${launchDomain()}/${IDLE_SWEEP_LABEL}`]);
-  import_node_fs45.default.rmSync(paths.plist, { force: true });
+  import_node_fs46.default.rmSync(paths.plist, { force: true });
   return true;
 }
 function summarizeSweep(idleFor, stops, error) {
@@ -25211,13 +25376,13 @@ function summarizeSweep(idleFor, stops, error) {
   };
 }
 function writeLastSweep(record6, paths = idleSweepPaths()) {
-  import_node_fs45.default.mkdirSync(paths.directory, { recursive: true, mode: 448 });
-  import_node_fs45.default.writeFileSync(paths.lastSweep, `${JSON.stringify(record6, null, 2)}
+  import_node_fs46.default.mkdirSync(paths.directory, { recursive: true, mode: 448 });
+  import_node_fs46.default.writeFileSync(paths.lastSweep, `${JSON.stringify(record6, null, 2)}
 `, { mode: 384 });
 }
 function readLastSweep(paths) {
   try {
-    return JSON.parse(import_node_fs45.default.readFileSync(paths.lastSweep, "utf-8"));
+    return JSON.parse(import_node_fs46.default.readFileSync(paths.lastSweep, "utf-8"));
   } catch {
     return void 0;
   }
@@ -25262,20 +25427,20 @@ function idleSweepCheck(paths = idleSweepPaths(), nowMs = Date.now()) {
     ...stale || last.failed > 0 ? { suggestion: `Inspect: ${paths.log}` } : {}
   };
 }
-var import_node_child_process34, import_node_fs45, import_node_os6, import_node_path56, IDLE_SWEEP_LABEL, SWEEP_INTERVAL_SECONDS, SYSTEM_PATH, defaultLaunchctl;
+var import_node_child_process35, import_node_fs46, import_node_os7, import_node_path57, IDLE_SWEEP_LABEL, SWEEP_INTERVAL_SECONDS, SYSTEM_PATH, defaultLaunchctl;
 var init_idle_sweep = __esm({
   "src/core/idle-sweep.ts"() {
     "use strict";
-    import_node_child_process34 = require("child_process");
-    import_node_fs45 = __toESM(require("fs"));
-    import_node_os6 = __toESM(require("os"));
-    import_node_path56 = __toESM(require("path"));
+    import_node_child_process35 = require("child_process");
+    import_node_fs46 = __toESM(require("fs"));
+    import_node_os7 = __toESM(require("os"));
+    import_node_path57 = __toESM(require("path"));
     init_router();
     IDLE_SWEEP_LABEL = "dev.devrouter.idle-stop";
     SWEEP_INTERVAL_SECONDS = 300;
     SYSTEM_PATH = ["/usr/bin", "/bin", "/usr/sbin", "/sbin"];
     defaultLaunchctl = (args) => {
-      const result = (0, import_node_child_process34.spawnSync)("launchctl", args, { encoding: "utf-8" });
+      const result = (0, import_node_child_process35.spawnSync)("launchctl", args, { encoding: "utf-8" });
       return { status: result.status, stderr: result.stderr || result.error?.message || "" };
     };
   }
@@ -25289,7 +25454,7 @@ function outputFromResult(result) {
   return output2.length > 0 ? output2 : void 0;
 }
 function runTool(command, args = []) {
-  const result = (0, import_node_child_process35.spawnSync)(command, args, {
+  const result = (0, import_node_child_process36.spawnSync)(command, args, {
     encoding: "utf-8"
   });
   if (result.error) {
@@ -25346,12 +25511,12 @@ function parseMinimumNodeMajor(value) {
   return Number(match[1]);
 }
 function readPackageJson(repoPath) {
-  const packagePath = import_node_path57.default.join(repoPath, "package.json");
-  if (!import_node_fs46.default.existsSync(packagePath)) {
+  const packagePath = import_node_path58.default.join(repoPath, "package.json");
+  if (!import_node_fs47.default.existsSync(packagePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs46.default.readFileSync(packagePath, "utf-8"));
+    return JSON.parse(import_node_fs47.default.readFileSync(packagePath, "utf-8"));
   } catch {
     return void 0;
   }
@@ -25456,17 +25621,17 @@ function realpathOrUndefined(value) {
     return void 0;
   }
   try {
-    return import_node_fs46.default.realpathSync(value);
+    return import_node_fs47.default.realpathSync(value);
   } catch {
     return void 0;
   }
 }
 function isExecutableFile(filePath) {
   try {
-    if (!import_node_fs46.default.statSync(filePath).isFile()) {
+    if (!import_node_fs47.default.statSync(filePath).isFile()) {
       return false;
     }
-    import_node_fs46.default.accessSync(filePath, import_node_fs46.default.constants.X_OK);
+    import_node_fs47.default.accessSync(filePath, import_node_fs47.default.constants.X_OK);
     return true;
   } catch {
     return false;
@@ -25474,13 +25639,13 @@ function isExecutableFile(filePath) {
 }
 function displayPath(filePath) {
   const home = process.env.HOME;
-  if (!home || home.length < 2 || !filePath.startsWith(`${home}${import_node_path57.default.sep}`)) {
+  if (!home || home.length < 2 || !filePath.startsWith(`${home}${import_node_path58.default.sep}`)) {
     return filePath;
   }
   return `~${filePath.slice(home.length)}`;
 }
 function probeInstalledCliVersion(executable) {
-  const result = (0, import_node_child_process35.spawnSync)(executable, ["-V"], {
+  const result = (0, import_node_child_process36.spawnSync)(executable, ["-V"], {
     encoding: "utf-8",
     timeout: CLI_PATH_PROBE_TIMEOUT_MS
   });
@@ -25491,7 +25656,7 @@ function probeInstalledCliVersion(executable) {
 }
 function buildCliPathCheck(options = {}) {
   const id5 = "global.cli-path";
-  const runningVersion = options.runningVersion ?? (true ? "0.6.1" : "0.0.0-dev");
+  const runningVersion = options.runningVersion ?? (true ? "0.6.3" : "0.0.0-dev");
   if (runningVersion === "0.0.0-dev") {
     return {
       id: id5,
@@ -25504,11 +25669,11 @@ function buildCliPathCheck(options = {}) {
   const probeVersion = options.probeVersion ?? probeInstalledCliVersion;
   const entries = [];
   const seen = /* @__PURE__ */ new Set();
-  for (const dir of (options.pathValue ?? process.env.PATH ?? "").split(import_node_path57.default.delimiter)) {
+  for (const dir of (options.pathValue ?? process.env.PATH ?? "").split(import_node_path58.default.delimiter)) {
     if (dir.length === 0) {
       continue;
     }
-    const executable = import_node_path57.default.join(dir, "devrouter");
+    const executable = import_node_path58.default.join(dir, "devrouter");
     if (!isExecutableFile(executable)) {
       continue;
     }
@@ -25665,13 +25830,13 @@ function buildGlobalToolChecksWithoutTelemetry(repoPath) {
   checks.push(nodeToolchainCheck(repoPath));
   return checks;
 }
-var import_node_child_process35, import_node_fs46, import_node_path57, DEVSY_DISABLE_TELEMETRY, CLI_PATH_PROBE_TIMEOUT_MS, INSTALLED_CLI_VERSION_RE;
+var import_node_child_process36, import_node_fs47, import_node_path58, DEVSY_DISABLE_TELEMETRY, CLI_PATH_PROBE_TIMEOUT_MS, INSTALLED_CLI_VERSION_RE;
 var init_tool_diagnostics = __esm({
   "src/core/tool-diagnostics.ts"() {
     "use strict";
-    import_node_child_process35 = require("child_process");
-    import_node_fs46 = __toESM(require("fs"));
-    import_node_path57 = __toESM(require("path"));
+    import_node_child_process36 = require("child_process");
+    import_node_fs47 = __toESM(require("fs"));
+    import_node_path58 = __toESM(require("path"));
     init_devsy_agent();
     init_idle_sweep();
     init_repo_config();
@@ -25692,10 +25857,10 @@ function inRepositoryWorkspaceScope(repoPath, worktreePath, livePaths) {
   if (livePaths.some((candidate) => sameWorkspacePath(candidate, worktreePath))) return true;
   const comparableRepo = comparableWorkspacePath(repoPath);
   const comparableWorktree = comparableWorkspacePath(worktreePath);
-  const localRoot = import_node_path58.default.join(comparableRepo, "trees") + import_node_path58.default.sep;
+  const localRoot = import_node_path59.default.join(comparableRepo, "trees") + import_node_path59.default.sep;
   if (comparableWorktree.startsWith(localRoot)) return true;
-  const legacyPrefix = `${import_node_path58.default.basename(comparableRepo)}-`;
-  return import_node_path58.default.dirname(comparableWorktree) === import_node_path58.default.dirname(comparableRepo) && import_node_path58.default.basename(comparableWorktree).startsWith(legacyPrefix);
+  const legacyPrefix = `${import_node_path59.default.basename(comparableRepo)}-`;
+  return import_node_path59.default.dirname(comparableWorktree) === import_node_path59.default.dirname(comparableRepo) && import_node_path59.default.basename(comparableWorktree).startsWith(legacyPrefix);
 }
 function previewActions(devpodStatus, routeCount, includeRecord) {
   const actions = [
@@ -25947,11 +26112,11 @@ function applyWorkspaceGc(plan) {
     candidates
   };
 }
-var import_node_path58;
+var import_node_path59;
 var init_workspace_gc = __esm({
   "src/core/workspace-gc.ts"() {
     "use strict";
-    import_node_path58 = __toESM(require("path"));
+    import_node_path59 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_host_routes();
@@ -26021,12 +26186,12 @@ function inspectPostgresCredentials(repoPath, config) {
         parseErrors.push(`${app.name}: ${composeFile} (${message})`);
         continue;
       }
-      if (!import_node_fs47.default.existsSync(absolutePath)) {
+      if (!import_node_fs48.default.existsSync(absolutePath)) {
         continue;
       }
       try {
-        const raw = import_node_fs47.default.readFileSync(absolutePath, "utf-8");
-        const parsed = import_yaml6.default.parse(raw);
+        const raw = import_node_fs48.default.readFileSync(absolutePath, "utf-8");
+        const parsed = import_yaml7.default.parse(raw);
         const root = asRecord2(parsed);
         const services = asRecord2(root?.services);
         const service = asRecord2(services?.[app.docker.service]);
@@ -26389,7 +26554,7 @@ async function buildDoctorReport(options = {}) {
           suggestion: `Remedy ${expansionNotice.remedy.code}: set a named default profile other than '${expansionNotice.profile}'${remedyCandidates}.`
         });
       }
-      const cliVersion = true ? "0.6.1" : "0.0.0-dev";
+      const cliVersion = true ? "0.6.3" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       const installedKnown = cliVersion !== "0.0.0-dev";
       const versionComparison = installedKnown && configVersion ? compareSemver(configVersion, cliVersion) : void 0;
@@ -26425,9 +26590,9 @@ async function buildDoctorReport(options = {}) {
         (app) => app.docker.composeFiles.map((filePath) => ({
           app: app.name,
           filePath,
-          absolutePath: import_node_path59.default.resolve(repo.path, filePath)
+          absolutePath: import_node_path60.default.resolve(repo.path, filePath)
         }))
-      ).filter((entry) => !import_node_fs47.default.existsSync(entry.absolutePath));
+      ).filter((entry) => !import_node_fs48.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.compose-files",
         level: missingComposeFiles.length === 0 ? "ok" : "error",
@@ -26470,8 +26635,8 @@ async function buildDoctorReport(options = {}) {
       const missingHostCwds = config.apps.filter((app) => app.runtime === "host").map((app) => ({
         app: app.name,
         cwd: app.hostRun.cwd,
-        absolutePath: import_node_path59.default.resolve(repo.path, app.hostRun.cwd)
-      })).filter((entry) => !import_node_fs47.default.existsSync(entry.absolutePath));
+        absolutePath: import_node_path60.default.resolve(repo.path, app.hostRun.cwd)
+      })).filter((entry) => !import_node_fs48.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.host-cwd",
         level: missingHostCwds.length === 0 ? "ok" : "error",
@@ -26615,13 +26780,13 @@ async function buildDoctorReport(options = {}) {
     nextSteps
   };
 }
-var import_node_fs47, import_node_path59, import_yaml6, POSTGRES_DEFAULTS, CAPACITY_RECOVERY_BY_CAUSE;
+var import_node_fs48, import_node_path60, import_yaml7, POSTGRES_DEFAULTS, CAPACITY_RECOVERY_BY_CAUSE;
 var init_doctor = __esm({
   "src/core/doctor.ts"() {
     "use strict";
-    import_node_fs47 = __toESM(require("fs"));
-    import_node_path59 = __toESM(require("path"));
-    import_yaml6 = __toESM(require("yaml"));
+    import_node_fs48 = __toESM(require("fs"));
+    import_node_path60 = __toESM(require("path"));
+    import_yaml7 = __toESM(require("yaml"));
     init_capacity_store();
     init_docker();
     init_host_routes();
@@ -27016,12 +27181,12 @@ function parseSsPortListeners(stdout, port) {
   return listeners;
 }
 function findPortListeners(port) {
-  const result = (0, import_node_child_process36.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
+  const result = (0, import_node_child_process37.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process36.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process37.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsPortListeners(ssResult.stdout, port);
       }
@@ -27050,11 +27215,11 @@ function findPortListeners(port) {
     };
   });
 }
-var import_node_child_process36;
+var import_node_child_process37;
 var init_ports = __esm({
   "src/util/ports.ts"() {
     "use strict";
-    import_node_child_process36 = require("child_process");
+    import_node_child_process37 = require("child_process");
   }
 });
 
@@ -27140,6 +27305,7 @@ async function runEnsureCommand(options) {
     quiet: Boolean(options.json),
     profile: options.profile,
     ...options.repair ? { repair: true } : {},
+    ...options.initializeNew ? { initializeNew: true } : {},
     ...options.variant !== void 0 ? { variant: options.variant } : {}
   };
   const result = await superviseLifecycle(
@@ -27327,7 +27493,7 @@ function resolveLoopback(app, repoPath, evidence) {
   if (!evidence.containers) {
     return { loopback: null, loopbackReason: "unavailable" };
   }
-  const devcontainerDir = import_node_path60.default.join(repoPath, ".devcontainer");
+  const devcontainerDir = import_node_path61.default.join(repoPath, ".devcontainer");
   const owners = evidence.containers.filter(
     (container) => sameWorkspacePath(
       container.labels["com.docker.compose.project.working_dir"] ?? "",
@@ -27387,13 +27553,13 @@ function buildHostEnvReport(input2) {
   };
 }
 function listDevcontainerContainers(repoPath) {
-  const listed = (0, import_node_child_process37.spawnSync)(
+  const listed = (0, import_node_child_process38.spawnSync)(
     "docker",
     [
       "ps",
       "-a",
       "--filter",
-      `label=com.docker.compose.project.working_dir=${import_node_path60.default.join(repoPath, ".devcontainer")}`,
+      `label=com.docker.compose.project.working_dir=${import_node_path61.default.join(repoPath, ".devcontainer")}`,
       "--format",
       "{{.ID}}"
     ],
@@ -27408,7 +27574,7 @@ function listDevcontainerContainers(repoPath) {
   }
 }
 function dockerPortBindings(containerId, port) {
-  const result = (0, import_node_child_process37.spawnSync)("docker", ["port", containerId, `${port}/tcp`], {
+  const result = (0, import_node_child_process38.spawnSync)("docker", ["port", containerId, `${port}/tcp`], {
     encoding: "utf-8",
     ...networkDockerOptions()
   });
@@ -27523,12 +27689,12 @@ function hostEnvVariables(report, processEnv) {
   }
   return variables;
 }
-var import_node_child_process37, import_node_path60, LOOPBACK_UPSTREAM_HOSTS, ROUTED_TCP_PARAMS;
+var import_node_child_process38, import_node_path61, LOOPBACK_UPSTREAM_HOSTS, ROUTED_TCP_PARAMS;
 var init_host_env = __esm({
   "src/core/host-env.ts"() {
     "use strict";
-    import_node_child_process37 = require("child_process");
-    import_node_path60 = __toESM(require("path"));
+    import_node_child_process38 = require("child_process");
+    import_node_path61 = __toESM(require("path"));
     init_devcontainer_profile();
     init_devpod_environment();
     init_docker();
@@ -27625,7 +27791,7 @@ function hostCommandEnvironment(report, processEnv) {
 }
 function runHostCommand(command, env) {
   return new Promise((resolve) => {
-    const child = (0, import_node_child_process38.spawn)(command[0], command.slice(1), { env, stdio: "inherit" });
+    const child = (0, import_node_child_process39.spawn)(command[0], command.slice(1), { env, stdio: "inherit" });
     const forward = (signal) => () => child.kill(signal);
     const handlers = [
       ["SIGINT", forward("SIGINT")],
@@ -27645,7 +27811,7 @@ function runHostCommand(command, env) {
       settle(error.code === "ENOENT" ? 127 : 126);
     });
     child.on("exit", (code, signal) => {
-      settle(code ?? 128 + (signal ? import_node_os7.constants.signals[signal] ?? 0 : 0));
+      settle(code ?? 128 + (signal ? import_node_os8.constants.signals[signal] ?? 0 : 0));
     });
   });
 }
@@ -27665,12 +27831,12 @@ async function runEnvCommand(invocation) {
   }
   process.stdout.write(formatEnvReport(report));
 }
-var import_node_child_process38, import_node_os7, HOST_PORT_ENV_PREFIX;
+var import_node_child_process39, import_node_os8, HOST_PORT_ENV_PREFIX;
 var init_env = __esm({
   "src/commands/env.ts"() {
     "use strict";
-    import_node_child_process38 = require("child_process");
-    import_node_os7 = require("os");
+    import_node_child_process39 = require("child_process");
+    import_node_os8 = require("os");
     init_host_env();
     init_managed_host_ports();
     init_output();
@@ -27719,8 +27885,8 @@ var init_status2 = __esm({
 
 // src/core/harness-continuation.ts
 function harnessContinuationPath(repoRoot) {
-  const key = (0, import_node_crypto29.createHash)("sha256").update(comparableWorkspacePath(repoRoot)).digest("hex");
-  return import_node_path61.default.join(DEVROUTER_HOME, "harness", `${key}.json`);
+  const key = (0, import_node_crypto30.createHash)("sha256").update(comparableWorkspacePath(repoRoot)).digest("hex");
+  return import_node_path62.default.join(DEVROUTER_HOME, "harness", `${key}.json`);
 }
 function counter4(value) {
   return Number.isSafeInteger(value) && value >= 0;
@@ -27733,7 +27899,7 @@ function validEntry(value) {
 function readLedgerSync(file, nowMs) {
   let stat;
   try {
-    stat = import_node_fs48.default.lstatSync(file);
+    stat = import_node_fs49.default.lstatSync(file);
   } catch {
     return [];
   }
@@ -27741,7 +27907,7 @@ function readLedgerSync(file, nowMs) {
   if (stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0) return [];
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs48.default.readFileSync(file, "utf-8"));
+    parsed = JSON.parse(import_node_fs49.default.readFileSync(file, "utf-8"));
   } catch {
     return [];
   }
@@ -27761,7 +27927,7 @@ function claimHarnessContinuation(repoRoot, claim2) {
   const nowMs = claim2.nowMs ?? Date.now();
   try {
     const file = harnessContinuationPath(repoRoot);
-    import_node_fs48.default.mkdirSync(import_node_path61.default.dirname(file), { recursive: true, mode: 448 });
+    import_node_fs49.default.mkdirSync(import_node_path62.default.dirname(file), { recursive: true, mode: 448 });
     return withFileLockSync(
       `${file}.lock`,
       { activity: "harness continuation claim", waitMs: HARNESS_CONTINUATION_LOCK_WAIT_MS },
@@ -27793,7 +27959,7 @@ function settleHarnessContinuation(repoRoot, toolUseId, settlement) {
   const nowMs = settlement.nowMs ?? Date.now();
   try {
     const file = harnessContinuationPath(repoRoot);
-    import_node_fs48.default.mkdirSync(import_node_path61.default.dirname(file), { recursive: true, mode: 448 });
+    import_node_fs49.default.mkdirSync(import_node_path62.default.dirname(file), { recursive: true, mode: 448 });
     withFileLockSync(
       `${file}.lock`,
       { activity: "harness continuation settlement", waitMs: HARNESS_CONTINUATION_LOCK_WAIT_MS },
@@ -27817,13 +27983,13 @@ function settleHarnessContinuation(repoRoot, toolUseId, settlement) {
   } catch {
   }
 }
-var import_node_crypto29, import_node_fs48, import_node_path61, HARNESS_CONTINUATION_MAX_ENTRIES, HARNESS_CONTINUATION_TTL_MS, HARNESS_CONTINUATION_LOCK_WAIT_MS, MAX_LEDGER_BYTES, MAX_TOOL_USE_ID_LENGTH, MAX_PHASE_LENGTH;
+var import_node_crypto30, import_node_fs49, import_node_path62, HARNESS_CONTINUATION_MAX_ENTRIES, HARNESS_CONTINUATION_TTL_MS, HARNESS_CONTINUATION_LOCK_WAIT_MS, MAX_LEDGER_BYTES, MAX_TOOL_USE_ID_LENGTH, MAX_PHASE_LENGTH;
 var init_harness_continuation = __esm({
   "src/core/harness-continuation.ts"() {
     "use strict";
-    import_node_crypto29 = require("crypto");
-    import_node_fs48 = __toESM(require("fs"));
-    import_node_path61 = __toESM(require("path"));
+    import_node_crypto30 = require("crypto");
+    import_node_fs49 = __toESM(require("fs"));
+    import_node_path62 = __toESM(require("path"));
     init_atomic_file();
     init_file_lock();
     init_router();
@@ -27842,12 +28008,12 @@ function isTransitionalHarnessPhase(phase) {
   return TRANSITIONAL_PHASES.includes(phase);
 }
 function findHarnessGateRepoRoot(cwd) {
-  let current = import_node_path62.default.resolve(cwd);
+  let current = import_node_path63.default.resolve(cwd);
   for (let depth = 0; depth < REPO_ROOT_MAX_DEPTH; depth += 1) {
-    if (import_node_fs49.default.existsSync(import_node_path62.default.join(current, ".devrouter.yml"))) {
+    if (import_node_fs50.default.existsSync(import_node_path63.default.join(current, ".devrouter.yml"))) {
       return current;
     }
-    const parent = import_node_path62.default.dirname(current);
+    const parent = import_node_path63.default.dirname(current);
     if (parent === current) {
       return void 0;
     }
@@ -27939,12 +28105,12 @@ function parseHarnessGateBudget(value) {
   }
   return Math.min(Math.trunc(parsed), HARNESS_GATE_MAX_BUDGET_MS);
 }
-var import_node_fs49, import_node_path62, HARNESS_GATE_DEFAULT_BUDGET_MS, HARNESS_GATE_MAX_BUDGET_MS, HARNESS_GATE_POLL_INTERVAL_MS, TRANSITIONAL_PHASES, REPO_ROOT_MAX_DEPTH;
+var import_node_fs50, import_node_path63, HARNESS_GATE_DEFAULT_BUDGET_MS, HARNESS_GATE_MAX_BUDGET_MS, HARNESS_GATE_POLL_INTERVAL_MS, TRANSITIONAL_PHASES, REPO_ROOT_MAX_DEPTH;
 var init_harness_gate = __esm({
   "src/core/harness-gate.ts"() {
     "use strict";
-    import_node_fs49 = __toESM(require("fs"));
-    import_node_path62 = __toESM(require("path"));
+    import_node_fs50 = __toESM(require("fs"));
+    import_node_path63 = __toESM(require("path"));
     init_reliability_operation_store();
     init_workspace();
     init_workspace_runtime();
@@ -28203,7 +28369,7 @@ async function runHarnessCommand(method, options, repoPath, dependencies = {}) {
   }
   const budgetMs = parseHarnessGateBudget(options.waitBudgetMs);
   const toolUseId = typeof payload.tool_use_id === "string" && payload.tool_use_id.length > 0 && payload.tool_use_id.length <= MAX_TOOL_USE_ID_LENGTH2 ? payload.tool_use_id : void 0;
-  const payloadSha256 = (0, import_node_crypto30.createHash)("sha256").update(JSON.stringify(toolInput)).digest("hex");
+  const payloadSha256 = (0, import_node_crypto31.createHash)("sha256").update(JSON.stringify(toolInput)).digest("hex");
   const claim2 = dependencies.claim ?? ((root, input2) => {
     const outcome = claimHarnessContinuation(root, input2);
     if (outcome.kind === "claimed") {
@@ -28311,11 +28477,11 @@ async function runHarnessCommand(method, options, repoPath, dependencies = {}) {
 `
   );
 }
-var import_node_crypto30, MAX_HOOK_PAYLOAD_BYTES, STDIN_TIMEOUT_MS, MAX_TOOL_USE_ID_LENGTH2, DEVROUTER_EXECUTABLES, LAUNCHER_WORDS, LAUNCHER_SUBCOMMANDS, COMMAND_WORD_LIMIT;
+var import_node_crypto31, MAX_HOOK_PAYLOAD_BYTES, STDIN_TIMEOUT_MS, MAX_TOOL_USE_ID_LENGTH2, DEVROUTER_EXECUTABLES, LAUNCHER_WORDS, LAUNCHER_SUBCOMMANDS, COMMAND_WORD_LIMIT;
 var init_harness = __esm({
   "src/commands/harness.ts"() {
     "use strict";
-    import_node_crypto30 = require("crypto");
+    import_node_crypto31 = require("crypto");
     init_harness_continuation();
     init_harness_gate();
     MAX_HOOK_PAYLOAD_BYTES = 256 * 1024;
@@ -28431,7 +28597,7 @@ async function runOpenCommand(name) {
     );
     return;
   }
-  const result = (0, import_node_child_process39.spawnSync)("open", [url], { encoding: "utf-8" });
+  const result = (0, import_node_child_process40.spawnSync)("open", [url], { encoding: "utf-8" });
   if (result.status !== 0) {
     const details = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     throw new Error(`Unable to open '${url}': ${details || "unknown error"}`);
@@ -28439,11 +28605,11 @@ async function runOpenCommand(name) {
   process.stdout.write(`Opened ${url}
 `);
 }
-var import_node_child_process39;
+var import_node_child_process40;
 var init_open = __esm({
   "src/commands/open.ts"() {
     "use strict";
-    import_node_child_process39 = require("child_process");
+    import_node_child_process40 = require("child_process");
     init_docker();
     init_host_routes();
     init_repo_config();
@@ -28487,7 +28653,7 @@ async function runLogsCommand(options) {
   const args = ["logs", "--tail", tail, ROUTER_CONTAINER_NAME];
   if (options.follow) {
     args.splice(1, 0, "-f");
-    const child = (0, import_node_child_process40.spawn)("docker", args, { stdio: "inherit" });
+    const child = (0, import_node_child_process41.spawn)("docker", args, { stdio: "inherit" });
     const onSignal = () => {
       child.kill("SIGTERM");
     };
@@ -28501,17 +28667,17 @@ async function runLogsCommand(options) {
       });
     });
   } else {
-    const result = (0, import_node_child_process40.spawnSync)("docker", args, { stdio: "inherit" });
+    const result = (0, import_node_child_process41.spawnSync)("docker", args, { stdio: "inherit" });
     if (result.status !== 0) {
       throw new Error("Failed to retrieve router logs.");
     }
   }
 }
-var import_node_child_process40;
+var import_node_child_process41;
 var init_logs = __esm({
   "src/commands/logs.ts"() {
     "use strict";
-    import_node_child_process40 = require("child_process");
+    import_node_child_process41 = require("child_process");
     init_docker();
     init_lifecycle_diagnostics();
     init_router();
@@ -28555,17 +28721,17 @@ function asRecord3(value) {
   return value;
 }
 function readJson(filePath) {
-  if (!import_node_fs50.default.existsSync(filePath)) {
+  if (!import_node_fs51.default.existsSync(filePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs50.default.readFileSync(filePath, "utf-8"));
+    return JSON.parse(import_node_fs51.default.readFileSync(filePath, "utf-8"));
   } catch {
     return void 0;
   }
 }
 function relative(repoPath, filePath) {
-  return import_node_path63.default.relative(repoPath, filePath) || ".";
+  return import_node_path64.default.relative(repoPath, filePath) || ".";
 }
 function redactEnvAssignments(value) {
   return value.replace(
@@ -28606,7 +28772,7 @@ function inspectPackageManager(repoPath, pkg) {
     ["bun.lock", "bun"]
   ];
   for (const [fileName, name] of lockfiles) {
-    if (import_node_fs50.default.existsSync(import_node_path63.default.join(repoPath, fileName))) {
+    if (import_node_fs51.default.existsSync(import_node_path64.default.join(repoPath, fileName))) {
       return { name, source: fileName };
     }
   }
@@ -28621,9 +28787,9 @@ function inspectNode(repoPath, pkg) {
   if (typeof engines?.node === "string") {
     return { version: engines.node, source: "package.json:engines.node" };
   }
-  const nvmrc = import_node_path63.default.join(repoPath, ".nvmrc");
-  if (import_node_fs50.default.existsSync(nvmrc)) {
-    const version = import_node_fs50.default.readFileSync(nvmrc, "utf-8").trim();
+  const nvmrc = import_node_path64.default.join(repoPath, ".nvmrc");
+  if (import_node_fs51.default.existsSync(nvmrc)) {
+    const version = import_node_fs51.default.readFileSync(nvmrc, "utf-8").trim();
     return { version, source: ".nvmrc" };
   }
   return void 0;
@@ -28684,7 +28850,7 @@ function configuredComposeFiles(repoPath) {
     const files = config.apps.filter(
       (app) => app.runtime === "docker"
     ).flatMap((app) => app.docker.composeFiles).filter(
-      (fileName) => !import_node_path63.default.isAbsolute(fileName) && !import_node_path63.default.normalize(fileName).startsWith("..")
+      (fileName) => !import_node_path64.default.isAbsolute(fileName) && !import_node_path64.default.normalize(fileName).startsWith("..")
     );
     return Array.from(new Set(files));
   } catch {
@@ -28702,7 +28868,7 @@ function composeFiles(repoPath) {
     ...configuredComposeFiles(repoPath)
   ];
   return Array.from(new Set(candidates)).filter(
-    (fileName) => import_node_fs50.default.existsSync(import_node_path63.default.join(repoPath, fileName))
+    (fileName) => import_node_fs51.default.existsSync(import_node_path64.default.join(repoPath, fileName))
   );
 }
 function stringArray2(value) {
@@ -28740,7 +28906,7 @@ function inspectServices(repoPath) {
   const services = [];
   for (const fileName of composeFiles(repoPath)) {
     try {
-      const parsed = import_yaml7.default.parse(import_node_fs50.default.readFileSync(import_node_path63.default.join(repoPath, fileName), "utf-8"));
+      const parsed = import_yaml8.default.parse(import_node_fs51.default.readFileSync(import_node_path64.default.join(repoPath, fileName), "utf-8"));
       const serviceMap = asRecord3(asRecord3(parsed)?.services);
       for (const [name, value] of Object.entries(serviceMap ?? {})) {
         const service = asRecord3(value);
@@ -28775,8 +28941,8 @@ function inspectServices(repoPath) {
   return services;
 }
 function inspectEnvFiles(repoPath) {
-  const files = import_node_fs50.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
-    const content = import_node_fs50.default.readFileSync(import_node_path63.default.join(repoPath, fileName), "utf-8");
+  const files = import_node_fs51.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
+    const content = import_node_fs51.default.readFileSync(import_node_path64.default.join(repoPath, fileName), "utf-8");
     const names = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=")[0]?.trim()).filter((name) => Boolean(name)).sort();
     return { path: fileName, names };
   });
@@ -28790,18 +28956,18 @@ function inspectEnvFiles(repoPath) {
   };
 }
 function inspectDevcontainer(repoPath) {
-  const dir = import_node_path63.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs50.default.existsSync(dir)) {
+  const dir = import_node_path64.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs51.default.existsSync(dir)) {
     return { exists: false, files: [] };
   }
   return {
     exists: true,
-    files: import_node_fs50.default.readdirSync(dir).filter((fileName) => import_node_fs50.default.statSync(import_node_path63.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
+    files: import_node_fs51.default.readdirSync(dir).filter((fileName) => import_node_fs51.default.statSync(import_node_path64.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
   };
 }
 function inspectDevrouter(repoPath) {
   const configPath = getRepoConfigPath(repoPath);
-  if (!import_node_fs50.default.existsSync(configPath)) {
+  if (!import_node_fs51.default.existsSync(configPath)) {
     return {
       exists: false,
       configPath,
@@ -28845,15 +29011,15 @@ function inspectAgentGuidance(repoPath) {
     ["AGENTS.md", "agents"],
     ["CLAUDE.md", "claude"]
   ]) {
-    if (import_node_fs50.default.existsSync(import_node_path63.default.join(repoPath, fileName))) {
+    if (import_node_fs51.default.existsSync(import_node_path64.default.join(repoPath, fileName))) {
       results.push({ path: fileName, kind });
     }
   }
-  const skillsDir = import_node_path63.default.join(repoPath, ".agents", "skills");
-  if (import_node_fs50.default.existsSync(skillsDir)) {
-    for (const name of import_node_fs50.default.readdirSync(skillsDir).sort()) {
-      const skillPath = import_node_path63.default.join(skillsDir, name, "SKILL.md");
-      if (import_node_fs50.default.existsSync(skillPath)) {
+  const skillsDir = import_node_path64.default.join(repoPath, ".agents", "skills");
+  if (import_node_fs51.default.existsSync(skillsDir)) {
+    for (const name of import_node_fs51.default.readdirSync(skillsDir).sort()) {
+      const skillPath = import_node_path64.default.join(skillsDir, name, "SKILL.md");
+      if (import_node_fs51.default.existsSync(skillPath)) {
         results.push({ path: relative(repoPath, skillPath), kind: "skill" });
       }
     }
@@ -28896,7 +29062,7 @@ function buildIssues(report) {
 }
 function inspectRepo(options = {}) {
   const repoPath = resolveRepoPath(options.repo);
-  const pkg = readJson(import_node_path63.default.join(repoPath, "package.json"));
+  const pkg = readJson(import_node_path64.default.join(repoPath, "package.json"));
   const scripts = inspectScripts(pkg);
   const reportWithoutIssues = {
     repoPath,
@@ -28915,13 +29081,13 @@ function inspectRepo(options = {}) {
     issues: buildIssues(reportWithoutIssues)
   };
 }
-var import_node_fs50, import_node_path63, import_yaml7;
+var import_node_fs51, import_node_path64, import_yaml8;
 var init_repo_inspect = __esm({
   "src/core/repo-inspect.ts"() {
     "use strict";
-    import_node_fs50 = __toESM(require("fs"));
-    import_node_path63 = __toESM(require("path"));
-    import_yaml7 = __toESM(require("yaml"));
+    import_node_fs51 = __toESM(require("fs"));
+    import_node_path64 = __toESM(require("path"));
+    import_yaml8 = __toESM(require("yaml"));
     init_repo_config();
   }
 });
@@ -29025,7 +29191,7 @@ function requiredFileChecks(repoPath) {
     ".devcontainer/docker-compose.yml",
     ".devrouter.yml"
   ];
-  const missing = required.filter((fileName) => !import_node_fs51.default.existsSync(import_node_path64.default.join(repoPath, fileName)));
+  const missing = required.filter((fileName) => !import_node_fs52.default.existsSync(import_node_path65.default.join(repoPath, fileName)));
   return {
     id: "repo.devcontainer.verify-files",
     level: missing.length === 0 ? "ok" : "error",
@@ -29250,12 +29416,12 @@ async function verifyDevcontainer(options = {}) {
     nextSteps: collectNextSteps3(checks)
   };
 }
-var import_node_fs51, import_node_path64;
+var import_node_fs52, import_node_path65;
 var init_devcontainer_verify = __esm({
   "src/core/devcontainer-verify.ts"() {
     "use strict";
-    import_node_fs51 = __toESM(require("fs"));
-    import_node_path64 = __toESM(require("path"));
+    import_node_fs52 = __toESM(require("fs"));
+    import_node_path65 = __toESM(require("path"));
     init_capabilities();
     init_doctor();
     init_host_routes();
@@ -29552,7 +29718,7 @@ function packageManagerIssues(repo) {
 }
 function plannedFiles(repoPath, version) {
   const repo = inspectRepo({ repo: repoPath });
-  const projectName = sanitizeProjectName(import_node_path65.default.basename(repo.repoPath));
+  const projectName = sanitizeProjectName(import_node_path66.default.basename(repo.repoPath));
   const nodeMajor = majorVersion(repo.node?.version, "24");
   const pnpmVersion = repo.packageManager?.name === "pnpm" && repo.packageManager.version ? repo.packageManager.version : DEFAULT_PNPM_VERSION;
   const port = inferPort2(repo);
@@ -29597,8 +29763,8 @@ function plannedFiles(repoPath, version) {
   };
 }
 function classifyFile(repoPath, file) {
-  const absolutePath = import_node_path65.default.join(repoPath, file.relativePath);
-  if (!import_node_fs52.default.existsSync(absolutePath)) {
+  const absolutePath = import_node_path66.default.join(repoPath, file.relativePath);
+  if (!import_node_fs53.default.existsSync(absolutePath)) {
     return {
       path: file.relativePath,
       action: "create",
@@ -29606,7 +29772,7 @@ function classifyFile(repoPath, file) {
       bytes: Buffer.byteLength(file.content)
     };
   }
-  const current = import_node_fs52.default.readFileSync(absolutePath, "utf-8");
+  const current = import_node_fs53.default.readFileSync(absolutePath, "utf-8");
   if (!current.includes(MANAGED_MARKER2)) {
     return {
       path: file.relativePath,
@@ -29663,11 +29829,11 @@ function buildPlan(repoPath, dryRun, version) {
   };
 }
 function writeFile(repoPath, file) {
-  const absolutePath = import_node_path65.default.join(repoPath, file.relativePath);
-  import_node_fs52.default.mkdirSync(import_node_path65.default.dirname(absolutePath), { recursive: true });
-  import_node_fs52.default.writeFileSync(absolutePath, file.content, "utf-8");
+  const absolutePath = import_node_path66.default.join(repoPath, file.relativePath);
+  import_node_fs53.default.mkdirSync(import_node_path66.default.dirname(absolutePath), { recursive: true });
+  import_node_fs53.default.writeFileSync(absolutePath, file.content, "utf-8");
   if (file.executable) {
-    import_node_fs52.default.chmodSync(absolutePath, 493);
+    import_node_fs53.default.chmodSync(absolutePath, 493);
   }
 }
 function writeDevcontainer(options = {}) {
@@ -29705,12 +29871,12 @@ function writeDevcontainer(options = {}) {
     nextSteps: postWriteNextSteps(repoPath)
   };
 }
-var import_node_fs52, import_node_path65, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
+var import_node_fs53, import_node_path66, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
 var init_devcontainer_write = __esm({
   "src/core/devcontainer-write.ts"() {
     "use strict";
-    import_node_fs52 = __toESM(require("fs"));
-    import_node_path65 = __toESM(require("path"));
+    import_node_fs53 = __toESM(require("fs"));
+    import_node_path66 = __toESM(require("path"));
     init_repo_config();
     init_repo_inspect();
     MANAGED_MARKER2 = "devrouter:managed devcontainer";
@@ -29895,7 +30061,7 @@ function parseMappings(value) {
   return Object.fromEntries(mappings);
 }
 function parseProfilePlanContract(source) {
-  const document = (0, import_yaml8.parseDocument)(source, {
+  const document = (0, import_yaml9.parseDocument)(source, {
     merge: false,
     schema: "core",
     uniqueKeys: true
@@ -30044,13 +30210,13 @@ function buildProfilePlanReport(options) {
   return { ...report, contractPath, bindings: bindings2 };
 }
 function loadContract(repoPath, contractPath) {
-  if (import_node_path66.default.isAbsolute(contractPath)) {
+  if (import_node_path67.default.isAbsolute(contractPath)) {
     fail3("profile plan contract path must be relative to the repository.");
   }
   const absolutePath = assertPathWithinRepo(contractPath, repoPath, "Profile plan contract");
   let metadata;
   try {
-    metadata = import_node_fs53.default.lstatSync(absolutePath);
+    metadata = import_node_fs54.default.lstatSync(absolutePath);
   } catch (error) {
     fail3(`could not inspect profile plan contract '${contractPath}': ${error.message}`);
   }
@@ -30060,16 +30226,16 @@ function loadContract(repoPath, contractPath) {
   if (metadata.size > MAX_CONTRACT_BYTES) {
     fail3(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
-  const realRepo = import_node_fs53.default.realpathSync(repoPath);
-  const realContract = import_node_fs53.default.realpathSync(absolutePath);
+  const realRepo = import_node_fs54.default.realpathSync(repoPath);
+  const realContract = import_node_fs54.default.realpathSync(absolutePath);
   assertPathWithinRepo(realContract, realRepo, "Profile plan contract");
-  const source = import_node_fs53.default.readFileSync(absolutePath, "utf-8");
+  const source = import_node_fs54.default.readFileSync(absolutePath, "utf-8");
   if (Buffer.byteLength(source, "utf-8") > MAX_CONTRACT_BYTES) {
     fail3(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
   return {
     contract: parseProfilePlanContract(source),
-    contractPath: import_node_path66.default.relative(repoPath, absolutePath).split(import_node_path66.default.sep).join("/")
+    contractPath: import_node_path67.default.relative(repoPath, absolutePath).split(import_node_path67.default.sep).join("/")
   };
 }
 function resolveProfilePlan(options) {
@@ -30083,13 +30249,13 @@ function resolveProfilePlan(options) {
     contractPath: loaded.contractPath
   });
 }
-var import_node_fs53, import_node_path66, import_yaml8, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
+var import_node_fs54, import_node_path67, import_yaml9, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
 var init_profile_plan = __esm({
   "src/core/profile-plan.ts"() {
     "use strict";
-    import_node_fs53 = __toESM(require("fs"));
-    import_node_path66 = __toESM(require("path"));
-    import_yaml8 = require("yaml");
+    import_node_fs54 = __toESM(require("fs"));
+    import_node_path67 = __toESM(require("path"));
+    import_yaml9 = require("yaml");
     init_paths();
     init_profile_resolution();
     init_repo_config();
@@ -30120,7 +30286,7 @@ async function runProfileResolveCommand(options) {
 async function runProfilePlanCommand(options) {
   const report = resolveProfilePlan(options);
   if (options.output) {
-    writeFileAtomically(import_node_path67.default.resolve(options.output), `${JSON.stringify(report, null, 2)}
+    writeFileAtomically(import_node_path68.default.resolve(options.output), `${JSON.stringify(report, null, 2)}
 `);
   }
   if (options.json) {
@@ -30167,14 +30333,14 @@ function printProfilePlanSummary(report, output2) {
     process.stdout.write(`Binding ${key}: ${renderValues(report.bindings[key] ?? [])}
 `);
   }
-  if (output2) process.stdout.write(`Output: ${import_node_path67.default.resolve(output2)}
+  if (output2) process.stdout.write(`Output: ${import_node_path68.default.resolve(output2)}
 `);
 }
-var import_node_path67;
+var import_node_path68;
 var init_profile = __esm({
   "src/commands/profile.ts"() {
     "use strict";
-    import_node_path67 = __toESM(require("path"));
+    import_node_path68 = __toESM(require("path"));
     init_atomic_file();
     init_output();
     init_profile_plan();
@@ -30524,7 +30690,7 @@ function assertResourceGraph(resources) {
   for (const id5 of Object.keys(resources).sort()) visit(id5);
 }
 function parsePreviewManifest(source) {
-  const document = (0, import_yaml9.parseDocument)(source, {
+  const document = (0, import_yaml10.parseDocument)(source, {
     merge: false,
     schema: "core",
     uniqueKeys: true
@@ -30557,11 +30723,11 @@ function parsePreviewManifest(source) {
   return { version: 1, aliases, bindings: bindings2, resources, selection };
 }
 function loadPreviewManifest(repoPath) {
-  const resolvedRepo = import_node_path68.default.resolve(repoPath);
+  const resolvedRepo = import_node_path69.default.resolve(repoPath);
   const manifestPath = assertPathWithinRepo(MANIFEST_FILE_NAME, resolvedRepo, "Preview manifest");
   let metadata;
   try {
-    metadata = import_node_fs54.default.lstatSync(manifestPath);
+    metadata = import_node_fs55.default.lstatSync(manifestPath);
   } catch (error) {
     fail4(`could not inspect preview manifest '${MANIFEST_FILE_NAME}': ${error.message}`);
   }
@@ -30571,26 +30737,26 @@ function loadPreviewManifest(repoPath) {
   if (metadata.size > MAX_MANIFEST_BYTES) {
     fail4(`preview manifest exceeds the ${MAX_MANIFEST_BYTES}-byte limit.`);
   }
-  const realRepo = import_node_fs54.default.realpathSync(resolvedRepo);
-  const realManifest = import_node_fs54.default.realpathSync(manifestPath);
+  const realRepo = import_node_fs55.default.realpathSync(resolvedRepo);
+  const realManifest = import_node_fs55.default.realpathSync(manifestPath);
   assertPathWithinRepo(realManifest, realRepo, "Preview manifest");
-  const source = import_node_fs54.default.readFileSync(manifestPath, "utf-8");
+  const source = import_node_fs55.default.readFileSync(manifestPath, "utf-8");
   if (Buffer.byteLength(source, "utf-8") > MAX_MANIFEST_BYTES) {
     fail4(`preview manifest exceeds the ${MAX_MANIFEST_BYTES}-byte limit.`);
   }
   return {
     manifest: parsePreviewManifest(source),
-    digest: (0, import_node_crypto31.createHash)("sha256").update(source, "utf-8").digest("hex")
+    digest: (0, import_node_crypto32.createHash)("sha256").update(source, "utf-8").digest("hex")
   };
 }
-var import_node_crypto31, import_node_fs54, import_node_path68, import_yaml9, MANIFEST_FILE_NAME, MAX_MANIFEST_BYTES, MAX_COLLECTION_ENTRIES, MAX_BINDING_VALUES2, MAX_COMMAND_ARGS, MAX_LITERAL_LENGTH2, MAX_REPO_PATH_LENGTH, NAME_RE, IMAGE_REFERENCE_RE;
+var import_node_crypto32, import_node_fs55, import_node_path69, import_yaml10, MANIFEST_FILE_NAME, MAX_MANIFEST_BYTES, MAX_COLLECTION_ENTRIES, MAX_BINDING_VALUES2, MAX_COMMAND_ARGS, MAX_LITERAL_LENGTH2, MAX_REPO_PATH_LENGTH, NAME_RE, IMAGE_REFERENCE_RE;
 var init_manifest = __esm({
   "src/core/preview/manifest.ts"() {
     "use strict";
-    import_node_crypto31 = require("crypto");
-    import_node_fs54 = __toESM(require("fs"));
-    import_node_path68 = __toESM(require("path"));
-    import_yaml9 = require("yaml");
+    import_node_crypto32 = require("crypto");
+    import_node_fs55 = __toESM(require("fs"));
+    import_node_path69 = __toESM(require("path"));
+    import_yaml10 = require("yaml");
     init_paths();
     MANIFEST_FILE_NAME = ".devrouter.preview.yml";
     MAX_MANIFEST_BYTES = 1024 * 1024;
@@ -31385,7 +31551,7 @@ function createPreviewPool(installationId) {
     processedCommands: []
   });
 }
-function object4(value, required, optional = []) {
+function object5(value, required, optional = []) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("Invalid preview state object.");
   const record6 = value;
@@ -31412,7 +31578,7 @@ function oneOf3(value, allowed) {
   if (!allowed.includes(value)) throw new Error("Invalid preview state enum.");
 }
 function decodeSession(value) {
-  const row = object4(
+  const row = object5(
     value,
     [
       "generation",
@@ -31463,7 +31629,7 @@ function decodeSession(value) {
   if (row.stopReason !== void 0)
     oneOf3(row.stopReason, ["stop", "closed", "expiry", "setup-timeout"]);
   if (row.pendingDeadline !== void 0) {
-    const pending = object4(row.pendingDeadline, ["target", "commandId"]);
+    const pending = object5(row.pendingDeadline, ["target", "commandId"]);
     integer(pending.target);
     text4(pending.commandId);
   }
@@ -31491,7 +31657,7 @@ function decodeSession(value) {
   return session;
 }
 function decodePlan(value) {
-  const row = object4(
+  const row = object5(
     value,
     [
       "schemaVersion",
@@ -31520,7 +31686,7 @@ function decodePlan(value) {
     if (!/^[a-f0-9]{64}$/.test(row[key]))
       throw new Error("Invalid preview config digest.");
   }
-  const source = object4(row.source, ["head", "target", "mergeBase", "complete", "changes"]);
+  const source = object5(row.source, ["head", "target", "mergeBase", "complete", "changes"]);
   for (const key of ["head", "target", "mergeBase"]) {
     text4(source[key], 64);
     if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(source[key]))
@@ -31529,7 +31695,7 @@ function decodePlan(value) {
   if (source.complete !== true || !Array.isArray(source.changes) || source.changes.length > 1e4)
     throw new Error("Incomplete stored preview source.");
   for (const change of source.changes) {
-    const item = object4(change, ["status", "path"], ["oldPath"]);
+    const item = object5(change, ["status", "path"], ["oldPath"]);
     oneOf3(item.status, ["A", "M", "D", "R", "C", "T"]);
     for (const key of ["path", ...item.oldPath === void 0 ? [] : ["oldPath"]]) {
       text4(item[key], 4096);
@@ -31543,7 +31709,7 @@ function decodePlan(value) {
     throw new Error("Invalid stored preview graph.");
   const resources = {};
   for (const resource of row.resources) {
-    const item = object4(
+    const item = object5(
       resource,
       ["id", "kind"],
       ["dependsOn", "image", "imageTarget", "build", "ports", "command"]
@@ -31559,7 +31725,7 @@ function decodePlan(value) {
   if (!aliases.length || row.reasons.includes("source-unbound"))
     throw new Error("Unbound stored preview plan.");
   parsePreviewManifest(
-    (0, import_yaml10.stringify)({
+    (0, import_yaml11.stringify)({
       version: 1,
       aliases: Object.fromEntries(
         aliases.map((alias) => [alias, { resources: Object.keys(resources) }])
@@ -31574,7 +31740,7 @@ function decodePlan(value) {
 function decodePreviewPool(value) {
   if (Buffer.byteLength(JSON.stringify(value) ?? "") > 1024 * 1024)
     throw new Error("Preview pool exceeds its bound.");
-  const root = object4(value, [
+  const root = object5(value, [
     "schemaVersion",
     "installationId",
     "sessions",
@@ -31588,7 +31754,7 @@ function decodePreviewPool(value) {
     throw new Error("Invalid preview command window.");
   const receiptIds = /* @__PURE__ */ new Set();
   for (const receipt of root.processedCommands) {
-    const item = object4(receipt, ["id", "admittedAt"]);
+    const item = object5(receipt, ["id", "admittedAt"]);
     text4(item.id, 512);
     integer(item.admittedAt);
     if (receiptIds.has(item.id)) throw new Error("Duplicate preview command receipt.");
@@ -31599,7 +31765,7 @@ function decodePreviewPool(value) {
     throw new Error("Invalid preview stop fence window.");
   for (const [key, raw] of Object.entries(fences)) {
     if (!/^[a-f0-9]{64}$/.test(key)) throw new Error("Invalid stop fence identity.");
-    const fence = object4(raw, ["createdAt", "recordedAt", "commandId"]);
+    const fence = object5(raw, ["createdAt", "recordedAt", "commandId"]);
     text4(fence.commandId, 128);
     integer(fence.createdAt);
     integer(fence.recordedAt);
@@ -31609,7 +31775,7 @@ function decodePreviewPool(value) {
     throw new Error("Preview pool session bound exceeded.");
   for (const [id5, value2] of Object.entries(sessions)) {
     if (!/^[a-f0-9]{64}$/.test(id5)) throw new Error("Invalid preview identity key.");
-    const entry = object4(
+    const entry = object5(
       value2,
       ["session", "plan", "reservedCents", "hourlyCents", "operations", "effectSequence"],
       [
@@ -31623,7 +31789,7 @@ function decodePreviewPool(value) {
       ]
     );
     if (entry.identity !== void 0) {
-      const identity2 = object4(entry.identity, ["forgeHost", "projectId", "change"]);
+      const identity2 = object5(entry.identity, ["forgeHost", "projectId", "change"]);
       text4(identity2.forgeHost, 253);
       text4(identity2.projectId, 128);
       integer(identity2.change, 1);
@@ -31649,7 +31815,7 @@ function decodePreviewPool(value) {
     if (!entry.operations || typeof entry.operations !== "object" || Array.isArray(entry.operations) || Object.keys(entry.operations).length > 1024)
       throw new Error("Invalid preview operation registry.");
     for (const [operationId, raw] of Object.entries(entry.operations)) {
-      const effect2 = object4(
+      const effect2 = object5(
         raw,
         [
           "id",
@@ -31687,7 +31853,7 @@ function decodePreviewPool(value) {
           throw new Error("Preview provider step journal exceeds its bound.");
         const names = /* @__PURE__ */ new Set();
         for (const rawStep of effect2.steps) {
-          const step = object4(rawStep, ["name", "mode", "state", "at"], ["ref", "fingerprint"]);
+          const step = object5(rawStep, ["name", "mode", "state", "at"], ["ref", "fingerprint"]);
           text4(step.name, 64);
           if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(step.name) || names.has(step.name))
             throw new Error("Invalid preview provider step identity.");
@@ -31713,11 +31879,11 @@ function decodePreviewPool(value) {
   }
   return structuredClone(root);
 }
-var import_yaml10, PreviewStateConflict;
+var import_yaml11, PreviewStateConflict;
 var init_state = __esm({
   "src/core/preview/state.ts"() {
     "use strict";
-    import_yaml10 = require("yaml");
+    import_yaml11 = require("yaml");
     init_manifest();
     PreviewStateConflict = class extends Error {
       constructor() {
@@ -31732,7 +31898,7 @@ var init_state = __esm({
 function previewIdentityKey(identity2) {
   if (!/^[a-z0-9.-]+$/.test(identity2.forgeHost) || identity2.forgeHost.length > 253 || !/^[A-Za-z0-9_-]{1,128}$/.test(identity2.projectId) || !Number.isSafeInteger(identity2.change) || identity2.change < 1)
     throw new Error("Invalid immutable preview identity.");
-  return (0, import_node_crypto32.createHash)("sha256").update(JSON.stringify([identity2.forgeHost, identity2.projectId, identity2.change])).digest("hex");
+  return (0, import_node_crypto33.createHash)("sha256").update(JSON.stringify([identity2.forgeHost, identity2.projectId, identity2.change])).digest("hex");
 }
 function costs(pool) {
   return Object.values(pool.sessions).reduce((total, entry) => total + entry.reservedCents, 0);
@@ -31788,11 +31954,11 @@ function sessionReady(entry, now, expiresAt) {
     ...expiresAt === void 0 ? {} : { expiresAt }
   });
 }
-var import_node_crypto32, PreviewAdmissionSuperseded, PreviewEngine;
+var import_node_crypto33, PreviewAdmissionSuperseded, PreviewEngine;
 var init_engine = __esm({
   "src/core/preview/engine.ts"() {
     "use strict";
-    import_node_crypto32 = require("crypto");
+    import_node_crypto33 = require("crypto");
     init_command();
     init_lifecycle();
     init_state();
@@ -31926,7 +32092,7 @@ var init_engine = __esm({
             } else {
               if (current && current.session.status !== "stopped" && current.session.status !== "expired")
                 throw new Error("Previous generation cleanup is incomplete.");
-              const generation = (0, import_node_crypto32.createHash)("sha256").update(receipt).digest("hex").slice(0, 24);
+              const generation = (0, import_node_crypto33.createHash)("sha256").update(receipt).digest("hex").slice(0, 24);
               pool2.sessions[id5] = {
                 identity: input2.identity,
                 session: createPreviewSession({
@@ -32459,10 +32625,10 @@ var init_status3 = __esm({
           throw new Error("Forge requires a trusted HTTPS API base.");
       }
       base;
-      async request(method, path79, body, maxBytes) {
-        if (!path79 || path79.startsWith("/") || path79.split("?")[0].split("/").some((part) => [".", ".."].includes(decodeURIComponent(part))) || path79.includes("\\") || path79.includes("#"))
+      async request(method, path80, body, maxBytes) {
+        if (!path80 || path80.startsWith("/") || path80.split("?")[0].split("/").some((part) => [".", ".."].includes(decodeURIComponent(part))) || path80.includes("\\") || path80.includes("#"))
           throw new Error("Invalid forge API path.");
-        const url = new URL(path79, this.base);
+        const url = new URL(path80, this.base);
         if (url.origin !== this.base.origin || !url.pathname.startsWith(this.base.pathname))
           throw new Error("Forge request escaped its configured API.");
         let token;
@@ -32502,13 +32668,13 @@ var init_status3 = __esm({
           throw new Error("Preview forge response is unreadable or exceeds its bound.");
         }
       }
-      async pages(path79, options = {}) {
+      async pages(path80, options = {}) {
         const rows2 = [];
         for (let page = 1; page <= 100; page++) {
-          const separator = path79.includes("?") ? "&" : "?";
+          const separator = path80.includes("?") ? "&" : "?";
           const result = await this.request(
             "GET",
-            `${path79}${separator}per_page=100&page=${page}`,
+            `${path80}${separator}per_page=100&page=${page}`,
             void 0,
             options.maxBytes
           );
@@ -32534,14 +32700,14 @@ var init_status3 = __esm({
 
 // src/core/preview/controller.ts
 function decodeInbox(raw) {
-  const row = object4(
+  const row = object5(
     raw,
     ["schemaVersion", "identity", "scannedThrough", "closedThrough", "processed"],
     ["status", "selection", "needsStatus", "refusal"]
   );
   if (row.schemaVersion !== 1 || Buffer.byteLength(JSON.stringify(raw)) > 128 * 1024)
     throw new Error("Invalid preview inbox.");
-  const identity2 = object4(row.identity, ["forgeHost", "projectId", "change"]);
+  const identity2 = object5(row.identity, ["forgeHost", "projectId", "change"]);
   previewIdentityKey(identity2);
   for (const key of ["scannedThrough", "closedThrough"])
     if (!Number.isSafeInteger(row[key]) || row[key] < 0)
@@ -32550,7 +32716,7 @@ function decodeInbox(raw) {
     throw new Error("Preview inbox exceeds its command bound.");
   const ids2 = /* @__PURE__ */ new Set();
   for (const item of row.processed) {
-    const receipt = object4(item, ["id", "at"]);
+    const receipt = object5(item, ["id", "at"]);
     forgeId(receipt.id);
     if (ids2.has(receipt.id) || !Number.isSafeInteger(receipt.at) || receipt.at < 0)
       throw new Error("Invalid preview inbox receipt.");
@@ -32565,7 +32731,7 @@ function decodeInbox(raw) {
   if (row.refusal !== void 0 && !previewRefusalReasons.includes(row.refusal))
     throw new Error("Invalid preview refusal outcome.");
   if (row.status) {
-    const status = object4(
+    const status = object5(
       row.status,
       ["intentAt"],
       ["commentId", "bodyDigest", "publishedAt", "intentId"]
@@ -32582,11 +32748,11 @@ function decodeInbox(raw) {
   }
   return structuredClone(row);
 }
-var import_node_crypto33, PreviewController;
+var import_node_crypto34, PreviewController;
 var init_controller2 = __esm({
   "src/core/preview/controller.ts"() {
     "use strict";
-    import_node_crypto33 = require("crypto");
+    import_node_crypto34 = require("crypto");
     init_command();
     init_engine();
     init_status3();
@@ -32793,7 +32959,7 @@ Command refused: ${inbox.refusal}. Post a new command when the condition is reso
 Available profiles: ${this.options.aliases.map((alias) => `\`${alias}\``).join(", ")}.` : ""}
 
 ${marker}`;
-        const fingerprint = (0, import_node_crypto33.createHash)("sha256").update(body).digest("hex"), now = this.options.now();
+        const fingerprint = (0, import_node_crypto34.createHash)("sha256").update(body).digest("hex"), now = this.options.now();
         if (inbox.status?.bodyDigest === fingerprint) {
           if (inbox.needsStatus) await this.update(change, (row) => ({ ...row, needsStatus: false }));
           return;
@@ -32804,7 +32970,7 @@ ${marker}`;
         let commentId = inbox.status?.commentId;
         if (!commentId) commentId = await this.options.forge.findStatus(change, marker) ?? void 0;
         let create = false;
-        const intentId = (0, import_node_crypto33.randomUUID)();
+        const intentId = (0, import_node_crypto34.randomUUID)();
         if (!inbox.status)
           inbox = await this.update(change, (row) => {
             create = !row.status;
@@ -33140,11 +33306,11 @@ var init_github = __esm({
           throw new Error("Preview status has no ownership marker.");
         if (Buffer.byteLength(body) > 32 * 1024) throw new Error("Preview status exceeds its bound.");
         if (previousId) {
-          const path79 = `${this.repo}/issues/comments/${forgeId(previousId)}`;
-          const comment = forgeObject((await this.http.request("GET", path79)).data);
+          const path80 = `${this.repo}/issues/comments/${forgeId(previousId)}`;
+          const comment = forgeObject((await this.http.request("GET", path80)).data);
           if (forgeId(forgeObject(comment.user).id) !== this.options.botId || typeof comment.body !== "string" || !comment.body.startsWith(PREVIEW_STATUS_MARKER) || comment.issue_url !== `${this.issues}${forgeId(change)}`)
             throw new Error("Preview status comment ownership differs.");
-          await this.http.request("PATCH", path79, { body });
+          await this.http.request("PATCH", path80, { body });
           return previousId;
         }
         const created = forgeObject(
@@ -33320,11 +33486,11 @@ var init_gitlab = __esm({
           const row = forgeObject(raw);
           if (row.collapsed !== false || row.too_large !== false || ["new_file", "deleted_file", "renamed_file"].some((key) => typeof row[key] !== "boolean"))
             throw new Error("GitLab file diff is incomplete.");
-          const path79 = assertRepoRelativePath(row.new_path, "GitLab changed file"), oldPath = assertRepoRelativePath(row.old_path, "GitLab old file");
-          if (row.renamed_file) return { status: "R", path: path79, oldPath };
+          const path80 = assertRepoRelativePath(row.new_path, "GitLab changed file"), oldPath = assertRepoRelativePath(row.old_path, "GitLab old file");
+          if (row.renamed_file) return { status: "R", path: path80, oldPath };
           return {
             status: row.new_file ? "A" : row.deleted_file ? "D" : row.a_mode !== row.b_mode ? "T" : "M",
-            path: path79
+            path: path80
           };
         });
         const current = await this.merge(change);
@@ -33554,7 +33720,7 @@ function canonicalizeImageConfiguration(configuration) {
   return JSON.stringify(normalizeConfiguration(configuration, "image configuration"));
 }
 function imageConfigurationDigest(configuration) {
-  return `sha256:${(0, import_node_crypto34.createHash)("sha256").update(canonicalizeImageConfiguration(configuration), "utf-8").digest("hex")}`;
+  return `sha256:${(0, import_node_crypto35.createHash)("sha256").update(canonicalizeImageConfiguration(configuration), "utf-8").digest("hex")}`;
 }
 function targetKey(target, configurationDigest) {
   return `${target}\0${configurationDigest}`;
@@ -33809,11 +33975,11 @@ function resolvePreviewImages(plan, prepared, expectedProducer, value) {
     images: Object.fromEntries(resourceReceipts)
   };
 }
-var import_node_crypto34, MAX_COLLECTION_ENTRIES2, MAX_CONFIGURATION_ENTRIES, MAX_CONFIGURATION_KEY_LENGTH, MAX_CONFIGURATION_VALUE_BYTES, MAX_IDENTIFIER_LENGTH, NAME_RE2, REVISION_RE2, DIGEST_RE, IMAGE_COMPONENT_RE, RECEIPT_FIELDS;
+var import_node_crypto35, MAX_COLLECTION_ENTRIES2, MAX_CONFIGURATION_ENTRIES, MAX_CONFIGURATION_KEY_LENGTH, MAX_CONFIGURATION_VALUE_BYTES, MAX_IDENTIFIER_LENGTH, NAME_RE2, REVISION_RE2, DIGEST_RE, IMAGE_COMPONENT_RE, RECEIPT_FIELDS;
 var init_images = __esm({
   "src/core/preview/images.ts"() {
     "use strict";
-    import_node_crypto34 = require("crypto");
+    import_node_crypto35 = require("crypto");
     MAX_COLLECTION_ENTRIES2 = 256;
     MAX_CONFIGURATION_ENTRIES = 128;
     MAX_CONFIGURATION_KEY_LENGTH = 128;
@@ -33847,8 +34013,8 @@ function commandImageBackend(options) {
     throw new Error("Invalid installed image resolver command.");
   const verify = () => {
     for (const file of options.files) {
-      const stat = import_node_fs55.default.lstatSync(file.path);
-      if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024 || (0, import_node_crypto35.createHash)("sha256").update(import_node_fs55.default.readFileSync(file.path)).digest("hex") !== file.sha256)
+      const stat = import_node_fs56.default.lstatSync(file.path);
+      if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024 || (0, import_node_crypto36.createHash)("sha256").update(import_node_fs56.default.readFileSync(file.path)).digest("hex") !== file.sha256)
         throw new Error("Installed image resolver fingerprint differs.");
     }
   };
@@ -33860,7 +34026,7 @@ function commandImageBackend(options) {
         platform: options.platform,
         configurations: options.context(entry)
       });
-      const correlation = (0, import_node_crypto35.createHash)("sha256").update(
+      const correlation = (0, import_node_crypto36.createHash)("sha256").update(
         JSON.stringify([
           entry.identity,
           entry.session.generation,
@@ -33884,7 +34050,7 @@ function commandImageBackend(options) {
         });
         if (Buffer.byteLength(input2) > 1024 * 1024)
           throw new Error("Image request exceeds its bound.");
-        const result = (0, import_node_child_process41.spawnSync)(options.command[0], options.command.slice(1), {
+        const result = (0, import_node_child_process42.spawnSync)(options.command[0], options.command.slice(1), {
           shell: false,
           cwd: options.cwd,
           encoding: "utf8",
@@ -33897,7 +34063,7 @@ function commandImageBackend(options) {
           throw new Error("Installed image resolver failed; output suppressed.");
         return JSON.parse(result.stdout);
       };
-      const resolved2 = object4(invoke("resolve"), ["receipts"], ["pending"]);
+      const resolved2 = object5(invoke("resolve"), ["receipts"], ["pending"]);
       const outcome = resolvePreviewImages(entry.plan, prepared, options.producer, {
         receipts: resolved2.receipts
       });
@@ -33922,13 +34088,13 @@ function commandImageBackend(options) {
     }
   };
 }
-var import_node_child_process41, import_node_crypto35, import_node_fs55;
+var import_node_child_process42, import_node_crypto36, import_node_fs56;
 var init_image_command = __esm({
   "src/core/preview/image-command.ts"() {
     "use strict";
-    import_node_child_process41 = require("child_process");
-    import_node_crypto35 = require("crypto");
-    import_node_fs55 = __toESM(require("fs"));
+    import_node_child_process42 = require("child_process");
+    import_node_crypto36 = require("crypto");
+    import_node_fs56 = __toESM(require("fs"));
     init_images();
     init_state();
   }
@@ -34621,9 +34787,9 @@ function compileNorthflankGraph(entry, policy, phase, owned = {
     const resource = resources.get(id5);
     if (!resource?.ports?.some((item) => item.name === port && item.public))
       throw new Error("Northflank origin binding requires a selected public port.");
-    return `https://${prefix}--${id5.slice(0, 16)}-${port}-${(0, import_node_crypto36.createHash)("sha256").update(id5).digest("hex").slice(0, 6)}.${policy.baseDomain}`;
+    return `https://${prefix}--${id5.slice(0, 16)}-${port}-${(0, import_node_crypto37.createHash)("sha256").update(id5).digest("hex").slice(0, 6)}.${policy.baseDomain}`;
   };
-  const resourceName = (id5) => `${northflankAllocationPrefix(policy, entry.session.generation)}${(0, import_node_crypto36.createHash)("sha256").update(id5).digest("hex").slice(0, 10)}`;
+  const resourceName = (id5) => `${northflankAllocationPrefix(policy, entry.session.generation)}${(0, import_node_crypto37.createHash)("sha256").update(id5).digest("hex").slice(0, 10)}`;
   const suffix = (value) => {
     if (value === void 0) return "";
     if (typeof value !== "string" || value.length > 1024 || !value.startsWith("/") || value.startsWith("//") || value.includes("\\") || new RegExp("\\s|\\p{Cc}", "u").test(value))
@@ -35050,7 +35216,7 @@ function compileNorthflankGraph(entry, policy, phase, owned = {
       ]
     }
   };
-  const digest5 = (0, import_node_crypto36.createHash)("sha256").update(JSON.stringify({ spec, runtimeSecrets })).digest("hex");
+  const digest5 = (0, import_node_crypto37.createHash)("sha256").update(JSON.stringify({ spec, runtimeSecrets })).digest("hex");
   return {
     spec,
     digest: digest5,
@@ -35061,11 +35227,11 @@ function compileNorthflankGraph(entry, policy, phase, owned = {
     publicBuildEnvironment
   };
 }
-var import_node_crypto36, import_node_net5, ALLOCATION_PLAN, DATABASE_NAME, SOURCE_NAME, MAX_SOURCE_NAMES, MAX_OUTPUTS, MAX_SECRET_GROUPS, MAX_OUTPUT_ARGUMENTS, MAX_OUTPUT_ARGUMENT_BYTES, MAX_OUTPUT_COMMAND_BYTES, MAX_OUTPUT_BYTES2, MAX_PATTERN_BYTES, boundedStorage;
+var import_node_crypto37, import_node_net5, ALLOCATION_PLAN, DATABASE_NAME, SOURCE_NAME, MAX_SOURCE_NAMES, MAX_OUTPUTS, MAX_SECRET_GROUPS, MAX_OUTPUT_ARGUMENTS, MAX_OUTPUT_ARGUMENT_BYTES, MAX_OUTPUT_COMMAND_BYTES, MAX_OUTPUT_BYTES2, MAX_PATTERN_BYTES, boundedStorage;
 var init_northflank_graph = __esm({
   "src/core/preview/providers/northflank-graph.ts"() {
     "use strict";
-    import_node_crypto36 = require("crypto");
+    import_node_crypto37 = require("crypto");
     import_node_net5 = require("net");
     ALLOCATION_PLAN = /^[a-zA-Z0-9-]{3,100}$/;
     DATABASE_NAME = /^[a-z][a-z0-9_]{0,62}$/;
@@ -35090,7 +35256,7 @@ function identifier(value) {
 function decodeNorthflankOwnership(value) {
   if (Buffer.byteLength(JSON.stringify(value) ?? "") > 128 * 1024)
     throw new Error("Northflank ownership exceeds its bound.");
-  const row = object4(
+  const row = object5(
     value,
     ["schemaVersion", "generation", "policyDigest", "resources", "absent"],
     [
@@ -35119,7 +35285,7 @@ function decodeNorthflankOwnership(value) {
   )))
     throw new Error("Invalid Northflank completed-job metadata.");
   if (row.apiWait !== void 0) {
-    const wait = object4(row.apiWait, ["until", "exhausted"]);
+    const wait = object5(row.apiWait, ["until", "exhausted"]);
     if (!Number.isSafeInteger(wait.until) || wait.until < 1 || typeof wait.exhausted !== "boolean")
       throw new Error("Invalid Northflank API wait metadata.");
   }
@@ -35128,7 +35294,7 @@ function decodeNorthflankOwnership(value) {
   const references = /* @__PURE__ */ new Set();
   const ids2 = /* @__PURE__ */ new Set();
   for (const raw of row.resources) {
-    const resource = object4(raw, ["reference", "kind", "id", "name"], ["uid"]);
+    const resource = object5(raw, ["reference", "kind", "id", "name"], ["uid"]);
     identifier(resource.id);
     identifier(resource.reference);
     identifier(resource.name);
@@ -35169,7 +35335,7 @@ function specDigest(value) {
   return digest3(definition(value));
 }
 function digest3(value) {
-  return (0, import_node_crypto37.createHash)("sha256").update(JSON.stringify(value)).digest("hex");
+  return (0, import_node_crypto38.createHash)("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function bindings(owned) {
   return {
@@ -35194,11 +35360,11 @@ function outputNames(graph) {
     )
   ].sort();
 }
-var import_node_crypto37, resourceKinds, NorthflankOwnershipStore, northflankQualificationKeys, NorthflankFailure, NorthflankFenced, NorthflankPreviewProvider, nativeKinds, emptySpec;
+var import_node_crypto38, resourceKinds, NorthflankOwnershipStore, northflankQualificationKeys, NorthflankFailure, NorthflankFenced, NorthflankPreviewProvider, nativeKinds, emptySpec;
 var init_northflank = __esm({
   "src/core/preview/providers/northflank.ts"() {
     "use strict";
-    import_node_crypto37 = require("crypto");
+    import_node_crypto38 = require("crypto");
     init_command();
     init_state();
     init_northflank_api();
@@ -35831,7 +35997,7 @@ var init_northflank = __esm({
                   const settings = this.options.graph.generated?.[name];
                   if (!settings)
                     throw new NorthflankFailure("Northflank generated value is undeclared.");
-                  value = (0, import_node_crypto37.randomBytes)(settings.bytes).toString(settings.encoding);
+                  value = (0, import_node_crypto38.randomBytes)(settings.bytes).toString(settings.encoding);
                 }
                 if (kind === "output" && value === void 0)
                   throw new NorthflankFailure("Northflank output has no verified recipient.");
@@ -35908,10 +36074,10 @@ var init_northflank = __esm({
         for (const step of steps.filter((item) => item.name.endsWith("-run"))) {
           if (!owned.blueprintId) return this.receipt(owned);
           const operation = `${step.name.slice(0, -4)}-${digest3(effect2.id).slice(0, 20)}`;
-          const path79 = ["preview-blueprints", owned.blueprintId];
-          const id5 = step.ref ?? await this.findRun(path79, operation);
+          const path80 = ["preview-blueprints", owned.blueprintId];
+          const id5 = step.ref ?? await this.findRun(path80, operation);
           if (!id5) return this.receipt(owned);
-          const result = await this.options.api.request("GET", [...path79, "runs", id5]);
+          const result = await this.options.api.request("GET", [...path80, "runs", id5]);
           if (!result) return this.receipt(owned);
           const run = data(result);
           if (!run.concluded || specDigest(run.spec) !== step.fingerprint || northflankRecord(run.arguments).devrouterOperation !== operation || run.environmentId !== (owned.previewId ?? `preview-${entry.session.generation}`))
@@ -35934,11 +36100,11 @@ var init_northflank = __esm({
           }
         };
       }
-      async findRun(path79, operation) {
+      async findRun(path80, operation) {
         let match;
-        for (const summary of await this.options.api.list([...path79, "runs"], "runs")) {
+        for (const summary of await this.options.api.list([...path80, "runs"], "runs")) {
           const id5 = northflankIdentifier(summary.id);
-          const candidate = data(await this.options.api.request("GET", [...path79, "runs", id5]));
+          const candidate = data(await this.options.api.request("GET", [...path80, "runs", id5]));
           if (northflankRecord(candidate.arguments ?? {}).devrouterOperation !== operation) continue;
           if (match) throw new NorthflankFailure("Ambiguous Northflank run outcome.");
           match = id5;
@@ -35947,13 +36113,13 @@ var init_northflank = __esm({
       }
       async run(entry, effect2, gate, owned, stage, spec) {
         const api = this.options.api;
-        const path79 = ["preview-blueprints", northflankIdentifier(owned.blueprintId)];
+        const path80 = ["preview-blueprints", northflankIdentifier(owned.blueprintId)];
         let fingerprint = specDigest(spec);
         const operation = `${stage}-${digest3(effect2.id).slice(0, 20)}`;
         const recorded = (await gate.read()).find((step2) => step2.name === `${stage}-run`);
         if (!recorded) {
           if (await begin(gate, `${stage}-spec`, "once", fingerprint) === "write") {
-            await api.request("POST", path79, {
+            await api.request("POST", path80, {
               name: this.name(entry),
               apiVersion: "v1.2",
               spec,
@@ -35962,14 +36128,14 @@ var init_northflank = __esm({
             });
             await gate.record(`${stage}-spec`, "accepted");
           }
-          const detail = data(await api.request("GET", path79));
+          const detail = data(await api.request("GET", path80));
           if (specDigest(detail.spec) !== fingerprint)
             throw new NorthflankFailure("Northflank blueprint specification drifted.");
           await gate.record(`${stage}-spec`, "accepted");
           if (await begin(gate, `${stage}-run`, "once", fingerprint) === "write") {
             try {
               const run2 = data(
-                await api.request("POST", [...path79, "runs"], {
+                await api.request("POST", [...path80, "runs"], {
                   name: owned.previewId ?? `preview-${entry.session.generation}`,
                   arguments: { devrouterOperation: operation }
                 })
@@ -35990,15 +36156,15 @@ var init_northflank = __esm({
         if (!step) return null;
         let id5 = step.ref;
         if (!id5) {
-          id5 = await this.findRun(path79, operation);
+          id5 = await this.findRun(path80, operation);
           if (!id5) return null;
           await gate.record(`${stage}-run`, "accepted", id5);
         }
-        const run = data(await api.request("GET", [...path79, "runs", id5]));
+        const run = data(await api.request("GET", [...path80, "runs", id5]));
         if (specDigest(run.spec) !== fingerprint || northflankRecord(run.arguments).devrouterOperation !== operation || run.environmentId !== (owned.previewId ?? `preview-${entry.session.generation}`))
           throw new NorthflankFailure("Northflank executed an unexpected specification or operation.");
         if (owned.previewId) {
-          const previews = await api.list([...path79, "previews"], "previewEnvironments");
+          const previews = await api.list([...path80, "previews"], "previewEnvironments");
           if (previews.length !== 1 || previews[0].id !== owned.previewId)
             throw new NorthflankFailure("Northflank run changed the generation environment.");
         }
@@ -36073,33 +36239,33 @@ var init_northflank = __esm({
           const candidates = await this.namedBlueprints(entry);
           return this.receipt(owned, candidates.length === 0);
         }
-        const path79 = ["preview-blueprints", owned.blueprintId];
-        const blueprint = await this.options.api.request("GET", path79);
+        const path80 = ["preview-blueprints", owned.blueprintId];
+        const blueprint = await this.options.api.request("GET", path80);
         if (!blueprint && !owned.blueprintObserved && !owned.blueprintRejected)
           return this.receipt(owned);
         if (blueprint) {
           if (!owned.blueprintObserved)
             owned = await store.update((current) => ({ ...current, blueprintObserved: true }));
-          const runs = await this.options.api.list([...path79, "runs"], "runs");
+          const runs = await this.options.api.list([...path80, "runs"], "runs");
           for (const run of runs.filter((row) => row.concluded !== true)) {
             const id5 = northflankIdentifier(run.id);
             const step = `abort-${digest3(id5).slice(0, 12)}`;
             if (await begin(gate, step, "convergent") === "write") {
-              await this.options.api.request("POST", [...path79, "runs", id5, "abort"]);
+              await this.options.api.request("POST", [...path80, "runs", id5, "abort"]);
               await gate.record(step, "accepted", id5);
             }
           }
           if (effect2.kind === "cancel") return this.receipt(owned, true);
-          const previews = await this.options.api.list([...path79, "previews"], "previewEnvironments");
+          const previews = await this.options.api.list([...path80, "previews"], "previewEnvironments");
           for (const preview of previews) {
             const id5 = northflankIdentifier(preview.id);
             const step = `delete-${digest3(id5).slice(0, 12)}`;
             if (await begin(gate, step, "convergent") === "write") {
-              await this.options.api.request("DELETE", [...path79, "previews", id5]);
+              await this.options.api.request("DELETE", [...path80, "previews", id5]);
               await gate.record(step, "accepted", id5);
             }
           }
-          if ((await this.options.api.list([...path79, "previews"], "previewEnvironments")).length)
+          if ((await this.options.api.list([...path80, "previews"], "previewEnvironments")).length)
             return this.receipt(owned);
           let cleanedDomains = 0;
           for (const resource of owned.resources.filter((item) => item.kind === "domains")) {
@@ -36112,7 +36278,7 @@ var init_northflank = __esm({
             }
           }
           if (await begin(gate, "delete-blueprint", "convergent") === "write") {
-            await this.options.api.request("DELETE", path79);
+            await this.options.api.request("DELETE", path80);
             await gate.record("delete-blueprint", "accepted");
           }
         }
@@ -36334,10 +36500,10 @@ __export(installation_exports, {
   loadPreviewInstallation: () => loadPreviewInstallation
 });
 function readFile(file) {
-  const stat = import_node_fs56.default.lstatSync(file);
+  const stat = import_node_fs57.default.lstatSync(file);
   if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024)
     throw new Error("Preview control files must be regular files of at most 1 MiB.");
-  return import_node_fs56.default.readFileSync(file, "utf8");
+  return import_node_fs57.default.readFileSync(file, "utf8");
 }
 function text5(value, pattern) {
   if (typeof value !== "string" || !pattern.test(value))
@@ -36350,8 +36516,8 @@ function integer2(value, min, max) {
   return value;
 }
 function loadPreviewInstallation(filename, options = {}) {
-  const root = import_node_path69.default.dirname(import_node_fs56.default.realpathSync(filename));
-  const raw = object4(JSON.parse(readFile(filename)), [
+  const root = import_node_path70.default.dirname(import_node_fs57.default.realpathSync(filename));
+  const raw = object5(JSON.parse(readFile(filename)), [
     "version",
     "installationId",
     "state",
@@ -36386,10 +36552,10 @@ function loadPreviewInstallation(filename, options = {}) {
       return value;
     };
   };
-  const statePolicy = object4(raw.state, ["containerUrl"], ["tokenEnv", "federated"]);
+  const statePolicy = object5(raw.state, ["containerUrl"], ["tokenEnv", "federated"]);
   if (statePolicy.tokenEnv === void 0 === (statePolicy.federated === void 0))
     throw new Error("Preview state requires exactly one installed authentication method.");
-  const federated = statePolicy.federated === void 0 ? void 0 : object4(statePolicy.federated, ["tenantIdEnv", "clientIdEnv", "assertionEnv"]);
+  const federated = statePolicy.federated === void 0 ? void 0 : object5(statePolicy.federated, ["tenantIdEnv", "clientIdEnv", "assertionEnv"]);
   const accessToken = federated ? azureFederatedPreviewToken({
     tenantId: credential(federated.tenantIdEnv),
     clientId: credential(federated.clientIdEnv),
@@ -36405,13 +36571,13 @@ function loadPreviewInstallation(filename, options = {}) {
   if (!Array.isArray(raw.projects) || raw.projects.length < 1 || raw.projects.length > 16)
     throw new Error("Preview installation requires 1-16 registered projects.");
   const projects = raw.projects.map((input2) => {
-    const row = object4(
+    const row = object5(
       input2,
       ["key", "forge", "config", "manifest", "northflank", "hourlyCents", "acceptance"],
       ["images"]
     );
     const key = text5(row.key, /^[a-z][a-z0-9-]{0,62}$/);
-    const forgePolicy = object4(
+    const forgePolicy = object5(
       row.forge,
       ["kind", "host", "apiUrl", "repository", "projectId", "botId", "tokenEnv"],
       ["controllerProjectId"]
@@ -36431,10 +36597,10 @@ function loadPreviewInstallation(filename, options = {}) {
       fetch: options.fetch
     });
     const control = (input3) => {
-      const ref2 = object4(input3, ["file", "sha256"]);
+      const ref2 = object5(input3, ["file", "sha256"]);
       const filename2 = text5(ref2.file, /^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[^\\\0]+$/);
-      const file = import_node_fs56.default.realpathSync(import_node_path69.default.join(root, filename2));
-      if (!file.startsWith(`${root}${import_node_path69.default.sep}`))
+      const file = import_node_fs57.default.realpathSync(import_node_path70.default.join(root, filename2));
+      if (!file.startsWith(`${root}${import_node_path70.default.sep}`))
         throw new Error("Preview control file escapes installation directory.");
       const source = readFile(file), expected = text5(ref2.sha256, /^[a-f0-9]{64}$/);
       if (digest4(source) !== expected)
@@ -36442,7 +36608,7 @@ function loadPreviewInstallation(filename, options = {}) {
       return { source, digest: expected };
     };
     const local = control(row.config), remote = control(row.manifest), config = parseRepoConfigSource(local.source, ".devrouter.yml"), manifest = parsePreviewManifest(remote.source);
-    const northflank = object4(row.northflank, [
+    const northflank = object5(row.northflank, [
       "projectId",
       "tokenEnv",
       "graph",
@@ -36450,7 +36616,7 @@ function loadPreviewInstallation(filename, options = {}) {
       "runtimeSecrets"
     ]);
     const graph = northflank.graph;
-    const qualifications = object4(
+    const qualifications = object5(
       northflank.qualification,
       [...northflankQualificationKeys],
       ["outputExec"]
@@ -36470,7 +36636,7 @@ function loadPreviewInstallation(filename, options = {}) {
     for (const id5 of Object.keys(manifest.resources)) integer2(rates[id5], 1, 1e5);
     if (Object.keys(rates).some((id5) => !manifest.resources[id5]))
       throw new Error("Preview cost names an unknown resource.");
-    const acceptance = object4(row.acceptance, ["command", "environment"]);
+    const acceptance = object5(row.acceptance, ["command", "environment"]);
     if (!Array.isArray(acceptance.command) || acceptance.command.length < 1 || acceptance.command.length > 32 || acceptance.command.some(
       (arg) => typeof arg !== "string" || !arg || arg.length > 4096 || arg.includes("\0")
     ))
@@ -36496,7 +36662,7 @@ function loadPreviewInstallation(filename, options = {}) {
         return credential(secrets[ref2])();
       },
       accept: async (entry, urls) => {
-        const result = (0, import_node_child_process42.spawnSync)(command[0], command.slice(1), {
+        const result = (0, import_node_child_process43.spawnSync)(command[0], command.slice(1), {
           cwd: root,
           shell: false,
           timeout: 3e4,
@@ -36514,7 +36680,7 @@ function loadPreviewInstallation(filename, options = {}) {
         });
         if (result.error || result.status !== 0) return false;
         try {
-          const proof = object4(JSON.parse(result.stdout), [
+          const proof = object5(JSON.parse(result.stdout), [
             "generation",
             "revision",
             "urls",
@@ -36537,7 +36703,7 @@ function loadPreviewInstallation(filename, options = {}) {
       source,
       ...aliases2?.length ? { aliases: aliases2 } : {}
     });
-    const imagePolicy = row.images === void 0 ? void 0 : object4(row.images, [
+    const imagePolicy = row.images === void 0 ? void 0 : object5(row.images, [
       "platform",
       "platformQualified",
       "producer",
@@ -36551,14 +36717,14 @@ function loadPreviewInstallation(filename, options = {}) {
     if (!Array.isArray(imageEnvironment) || imageEnvironment.length > 32)
       throw new Error("Invalid image resolver environment.");
     const imageEnvNames = imageEnvironment.map(envName);
-    const producer = imagePolicy ? object4(imagePolicy.producer, ["repository", "workflow", "controlRevision"]) : void 0;
+    const producer = imagePolicy ? object5(imagePolicy.producer, ["repository", "workflow", "controlRevision"]) : void 0;
     if (imagePolicy && (!Array.isArray(imagePolicy.files) || imagePolicy.files.length > 32))
       throw new Error("Invalid reviewed image resolver files.");
     const imageFiles = imagePolicy ? imagePolicy.files.map((input3) => {
-      const item = object4(input3, ["file", "sha256"]);
+      const item = object5(input3, ["file", "sha256"]);
       const verified = control(input3);
       return {
-        path: import_node_fs56.default.realpathSync(import_node_path69.default.join(root, item.file)),
+        path: import_node_fs57.default.realpathSync(import_node_path70.default.join(root, item.file)),
         sha256: verified.digest
       };
     }) : [];
@@ -36673,7 +36839,7 @@ function loadPreviewInstallation(filename, options = {}) {
       }
     },
     now,
-    workerId: (0, import_node_crypto38.randomUUID)(),
+    workerId: (0, import_node_crypto39.randomUUID)(),
     policy: {
       installationId,
       maxActive,
@@ -36780,7 +36946,7 @@ function loadPreviewInstallation(filename, options = {}) {
 }
 async function initializePreviewInstallation(installationId, store) {
   const poolKey = `installations/${installationId}/pool`, witnessKey = `installations/${installationId}/initialized`;
-  if (await store.read(witnessKey, (raw) => object4(raw, ["installationId"])))
+  if (await store.read(witnessKey, (raw) => object5(raw, ["installationId"])))
     throw new Error(
       "Preview installation is already initialized; missing state requires operator recovery."
     );
@@ -36789,14 +36955,14 @@ async function initializePreviewInstallation(installationId, store) {
   await store.compareAndSwap(witnessKey, null, { installationId });
   await store.compareAndSwap(poolKey, null, createPreviewPool(installationId));
 }
-var import_node_child_process42, import_node_crypto38, import_node_fs56, import_node_path69, MAX_COMMAND_AGE_MS, digest4, envName;
+var import_node_child_process43, import_node_crypto39, import_node_fs57, import_node_path70, MAX_COMMAND_AGE_MS, digest4, envName;
 var init_installation = __esm({
   "src/core/preview/installation.ts"() {
     "use strict";
-    import_node_child_process42 = require("child_process");
-    import_node_crypto38 = require("crypto");
-    import_node_fs56 = __toESM(require("fs"));
-    import_node_path69 = __toESM(require("path"));
+    import_node_child_process43 = require("child_process");
+    import_node_crypto39 = require("crypto");
+    import_node_fs57 = __toESM(require("fs"));
+    import_node_path70 = __toESM(require("path"));
     init_repo_config();
     init_command();
     init_controller2();
@@ -36813,7 +36979,7 @@ var init_installation = __esm({
     init_state();
     init_azure_blob();
     MAX_COMMAND_AGE_MS = 15 * 6e4;
-    digest4 = (source) => (0, import_node_crypto38.createHash)("sha256").update(source).digest("hex");
+    digest4 = (source) => (0, import_node_crypto39.createHash)("sha256").update(source).digest("hex");
     envName = (value) => {
       if (typeof value !== "string" || !/^DEVROUTER_PREVIEW_[A-Z0-9_]+$/.test(value))
         throw new Error("Preview credential references require scoped environment names.");
@@ -36830,16 +36996,16 @@ __export(preview_exports, {
   runPreviewPlanCommand: () => runPreviewPlanCommand
 });
 function readSource(repoPath, filename) {
-  if (import_node_path70.default.isAbsolute(filename))
+  if (import_node_path71.default.isAbsolute(filename))
     throw new Error("Preview source path must be repository-relative.");
-  const root = import_node_fs57.default.realpathSync(repoPath);
+  const root = import_node_fs58.default.realpathSync(repoPath);
   const file = assertPathWithinRepo(filename, root, "preview source");
-  const stat = import_node_fs57.default.lstatSync(file);
+  const stat = import_node_fs58.default.lstatSync(file);
   if (stat.isSymbolicLink() || !stat.isFile() || stat.size > 1024 * 1024) {
     throw new Error("Preview source must be a regular file of at most 1 MiB.");
   }
-  assertPathWithinRepo(import_node_fs57.default.realpathSync(file), root, "preview source");
-  return JSON.parse(import_node_fs57.default.readFileSync(file, "utf8"));
+  assertPathWithinRepo(import_node_fs58.default.realpathSync(file), root, "preview source");
+  return JSON.parse(import_node_fs58.default.readFileSync(file, "utf8"));
 }
 async function runPreviewPlanCommand(options) {
   const repoPath = resolveRepoPath(options.repo);
@@ -36854,13 +37020,13 @@ async function runPreviewPlanCommand(options) {
 `);
     return;
   }
-  const localConfig = import_node_fs57.default.readFileSync(import_node_path70.default.join(repoPath, ".devrouter.yml"), "utf8");
+  const localConfig = import_node_fs58.default.readFileSync(import_node_path71.default.join(repoPath, ".devrouter.yml"), "utf8");
   const report = buildPreviewPlan({
     repoPath,
     config: loadRepoConfig(repoPath, () => localConfig),
     manifest,
     manifestDigest: digest5,
-    localConfigDigest: (0, import_node_crypto39.createHash)("sha256").update(localConfig).digest("hex"),
+    localConfigDigest: (0, import_node_crypto40.createHash)("sha256").update(localConfig).digest("hex"),
     ...options.alias === void 0 ? {} : { aliases: options.alias.split(",") },
     ...options.source === void 0 ? {} : { source: readSource(repoPath, options.source) }
   });
@@ -36879,7 +37045,7 @@ async function runPreviewPlanCommand(options) {
   }
 }
 async function runPreviewInitCommand(options) {
-  const repoPath = import_node_fs57.default.realpathSync(resolveRepoPath(options.repo));
+  const repoPath = import_node_fs58.default.realpathSync(resolveRepoPath(options.repo));
   if (options.integration === "gitlab") return renderGitLabPreviewIntegration(repoPath, options);
   if (options.integration) return renderPreviewIntegration(repoPath, options);
   loadRepoConfig(repoPath);
@@ -36902,10 +37068,10 @@ async function runPreviewInitCommand(options) {
       allowedUnions: []
     }
   };
-  const content = (0, import_yaml11.stringify)(manifest);
+  const content = (0, import_yaml12.stringify)(manifest);
   if (options.write) {
-    const file = import_node_path70.default.join(repoPath, ".devrouter.preview.yml");
-    import_node_fs57.default.writeFileSync(file, content, { flag: "wx", mode: 384 });
+    const file = import_node_path71.default.join(repoPath, ".devrouter.preview.yml");
+    import_node_fs58.default.writeFileSync(file, content, { flag: "wx", mode: 384 });
   }
   if (options.json) {
     printJSON({
@@ -36970,12 +37136,12 @@ async function runPreviewInstallationCommand(action2, options) {
 }
 function previewAsset(name) {
   const candidates = [
-    import_node_path70.default.resolve(__dirname, "..", "assets", "preview", name),
-    import_node_path70.default.resolve(__dirname, "..", "..", "assets", "preview", name)
+    import_node_path71.default.resolve(__dirname, "..", "assets", "preview", name),
+    import_node_path71.default.resolve(__dirname, "..", "..", "assets", "preview", name)
   ];
-  const file = candidates.find((file2) => import_node_fs57.default.existsSync(file2));
+  const file = candidates.find((file2) => import_node_fs58.default.existsSync(file2));
   if (!file) throw new Error("Installed preview integration asset is missing.");
-  return import_node_fs57.default.readFileSync(file, "utf8");
+  return import_node_fs58.default.readFileSync(file, "utf8");
 }
 function renderPreviewAsset(name, replacements) {
   return previewAsset(name).replace(/__([A-Z_]+)__/g, (_match, key) => {
@@ -37010,9 +37176,9 @@ async function renderPreviewIntegration(repoPath, options) {
   const filename = `.github/workflows/devrouter-preview${options.sweeper ? "-sweep" : ""}.yml`;
   if (options.write) {
     const file = assertPathWithinRepo(filename, repoPath, "preview workflow");
-    import_node_fs57.default.mkdirSync(import_node_path70.default.dirname(file), { recursive: true });
-    assertPathWithinRepo(import_node_fs57.default.realpathSync(import_node_path70.default.dirname(file)), repoPath, "preview workflow parent");
-    import_node_fs57.default.writeFileSync(file, content, { flag: "wx", mode: 384 });
+    import_node_fs58.default.mkdirSync(import_node_path71.default.dirname(file), { recursive: true });
+    assertPathWithinRepo(import_node_fs58.default.realpathSync(import_node_path71.default.dirname(file)), repoPath, "preview workflow parent");
+    import_node_fs58.default.writeFileSync(file, content, { flag: "wx", mode: 384 });
   }
   if (options.json)
     printJSON({
@@ -37030,7 +37196,7 @@ async function renderGitLabPreviewIntegration(repoPath, options) {
     throw new Error(
       "GitLab integration requires reviewed --controller-ref and --controller-image digest."
     );
-  const integrity = `sha256-${(0, import_node_crypto39.createHash)("sha256").update(previewAsset("gitlab-template.yml")).digest("base64")}`;
+  const integrity = `sha256-${(0, import_node_crypto40.createHash)("sha256").update(previewAsset("gitlab-template.yml")).digest("base64")}`;
   const replacements = {
     CONTROLLER_REF: String(options.controllerRef),
     CONTROLLER_IMAGE: String(options.controllerImage),
@@ -37039,7 +37205,7 @@ async function renderGitLabPreviewIntegration(repoPath, options) {
   const content = renderPreviewAsset("gitlab.yml", replacements);
   const filename = ".gitlab-ci.yml";
   if (options.write)
-    import_node_fs57.default.writeFileSync(assertPathWithinRepo(filename, repoPath, "GitLab preview caller"), content, {
+    import_node_fs58.default.writeFileSync(assertPathWithinRepo(filename, repoPath, "GitLab preview caller"), content, {
       flag: "wx",
       mode: 384
     });
@@ -37054,14 +37220,14 @@ async function renderGitLabPreviewIntegration(repoPath, options) {
     });
   else process.stdout.write(content);
 }
-var import_node_crypto39, import_node_fs57, import_node_path70, import_yaml11;
+var import_node_crypto40, import_node_fs58, import_node_path71, import_yaml12;
 var init_preview = __esm({
   "src/commands/preview.ts"() {
     "use strict";
-    import_node_crypto39 = require("crypto");
-    import_node_fs57 = __toESM(require("fs"));
-    import_node_path70 = __toESM(require("path"));
-    import_yaml11 = require("yaml");
+    import_node_crypto40 = require("crypto");
+    import_node_fs58 = __toESM(require("fs"));
+    import_node_path71 = __toESM(require("path"));
+    import_yaml12 = require("yaml");
     init_output();
     init_paths();
     init_manifest();
@@ -37352,7 +37518,7 @@ function sanitizeRouterId(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function repoHash(repoPath) {
-  return (0, import_node_crypto40.createHash)("sha1").update(import_node_path71.default.resolve(repoPath)).digest("hex").slice(0, 12);
+  return (0, import_node_crypto41.createHash)("sha1").update(import_node_path72.default.resolve(repoPath)).digest("hex").slice(0, 12);
 }
 function asDockerApp(app) {
   return app.runtime === "docker";
@@ -37431,11 +37597,11 @@ function prepareDockerOverlay(repoPath, appName, apps, publishTcpPorts = false)
   if (dockerApps.length === 0) {
     throw new Error("No docker apps selected to prepare compose overlay.");
   }
-  const cachePath = import_node_path71.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
-  import_node_fs58.default.mkdirSync(cachePath, { recursive: true });
-  const overlayPath = import_node_path71.default.join(cachePath, "compose.devrouter.yml");
+  const cachePath = import_node_path72.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
+  import_node_fs59.default.mkdirSync(cachePath, { recursive: true });
+  const overlayPath = import_node_path72.default.join(cachePath, "compose.devrouter.yml");
   const overlayDocument = buildOverlayDocument(dockerApps, publishTcpPorts);
-  import_node_fs58.default.writeFileSync(overlayPath, import_yaml12.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
+  import_node_fs59.default.writeFileSync(overlayPath, import_yaml13.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
   return {
     overlayPath,
     composeFiles: ensureComposeFiles(dockerApps),
@@ -37449,7 +37615,7 @@ function runDockerComposeUp(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved2);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "up", "-d", "--wait", ...services];
-  const result = (0, import_node_child_process43.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process44.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -37477,7 +37643,7 @@ function queryRunningComposeServices(repoPath, composeFiles2, overlayPath, servi
     "--services",
     ...services
   ];
-  const result = (0, import_node_child_process43.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process44.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -37503,7 +37669,7 @@ function runDockerComposeStop(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved2);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "stop", ...services];
-  const result = (0, import_node_child_process43.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process44.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -37529,7 +37695,7 @@ function runDockerComposeLogs(repoPath, composeFiles2, overlayPath, services, ta
     String(tail),
     ...services
   ];
-  (0, import_node_child_process43.spawnSync)("docker", args, {
+  (0, import_node_child_process44.spawnSync)("docker", args, {
     stdio: "inherit",
     cwd: repoPath
   });
@@ -37541,7 +37707,7 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
     fileArgs.push("-f", resolved2);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "port", service, String(internalPort)];
-  const result = (0, import_node_child_process43.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process44.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -37555,15 +37721,15 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process43, import_node_crypto40, import_node_fs58, import_node_path71, import_yaml12;
+var import_node_child_process44, import_node_crypto41, import_node_fs59, import_node_path72, import_yaml13;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
-    import_node_child_process43 = require("child_process");
-    import_node_crypto40 = require("crypto");
-    import_node_fs58 = __toESM(require("fs"));
-    import_node_path71 = __toESM(require("path"));
-    import_yaml12 = __toESM(require("yaml"));
+    import_node_child_process44 = require("child_process");
+    import_node_crypto41 = require("crypto");
+    import_node_fs59 = __toESM(require("fs"));
+    import_node_path72 = __toESM(require("path"));
+    import_yaml13 = __toESM(require("yaml"));
     init_docker_error_guidance();
     init_paths();
     init_router();
@@ -37652,7 +37818,7 @@ function isProcessRunning(pid) {
   }
 }
 function readProcessTree(rootPid) {
-  const result = (0, import_node_child_process44.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
+  const result = (0, import_node_child_process45.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
   if (result.status !== 0) {
     return [rootPid];
   }
@@ -37763,12 +37929,12 @@ function detectListeningPorts(pids) {
   if (pids.length === 0) {
     return [];
   }
-  const result = (0, import_node_child_process44.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
+  const result = (0, import_node_child_process45.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process44.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process45.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsListeningPorts(ssResult.stdout, new Set(pids));
       }
@@ -37827,7 +37993,7 @@ async function runHostApp(repoPath, app, extraEnv = {}, secretManager, env, work
     app.hostRun.command,
     true
   ) : app.hostRun.command;
-  const child = (0, import_node_child_process44.spawn)(spawnCommand, {
+  const child = (0, import_node_child_process45.spawn)(spawnCommand, {
     cwd: commandCwd,
     stdio: "inherit",
     shell: true,
@@ -38195,7 +38361,7 @@ async function execWithAppEnv(options) {
           options.command[0],
           true
         );
-        child = (0, import_node_child_process44.spawn)(wrapped, {
+        child = (0, import_node_child_process45.spawn)(wrapped, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: true,
@@ -38209,7 +38375,7 @@ async function execWithAppEnv(options) {
           false
         );
         const [cmd, ...wrappedArgs] = wrapped;
-        child = (0, import_node_child_process44.spawn)(cmd, wrappedArgs, {
+        child = (0, import_node_child_process45.spawn)(cmd, wrappedArgs, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: false,
@@ -38217,7 +38383,7 @@ async function execWithAppEnv(options) {
         });
       }
     } else if (options.shell) {
-      child = (0, import_node_child_process44.spawn)(options.command[0], {
+      child = (0, import_node_child_process45.spawn)(options.command[0], {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: true,
@@ -38225,7 +38391,7 @@ async function execWithAppEnv(options) {
       });
     } else {
       const [command, ...args] = options.command;
-      child = (0, import_node_child_process44.spawn)(command, args, {
+      child = (0, import_node_child_process45.spawn)(command, args, {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: false,
@@ -38246,11 +38412,11 @@ async function execWithAppEnv(options) {
     deps.stopDeps();
   }
 }
-var import_node_child_process44, import_node_net6, import_node_process, import_promises, POLL_INTERVAL_MS, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
+var import_node_child_process45, import_node_net6, import_node_process, import_promises, POLL_INTERVAL_MS, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
 var init_app_run = __esm({
   "src/core/app-run.ts"() {
     "use strict";
-    import_node_child_process44 = require("child_process");
+    import_node_child_process45 = require("child_process");
     import_node_net6 = __toESM(require("net"));
     import_node_process = require("process");
     import_promises = require("readline/promises");
@@ -38396,7 +38562,7 @@ function canonicalJson(value) {
 `;
 }
 function sha256Hex(raw) {
-  return (0, import_node_crypto41.createHash)("sha256").update(raw).digest("hex");
+  return (0, import_node_crypto42.createHash)("sha256").update(raw).digest("hex");
 }
 function candidateId(candidate) {
   const identity2 = {
@@ -38458,7 +38624,7 @@ function validateCandidate(value, index, action2, legacy) {
     }
   }
   for (const key of ["repo", "path", "commonDir", "gitDir"]) {
-    if (!import_node_path72.default.isAbsolute(candidate[key])) {
+    if (!import_node_path73.default.isAbsolute(candidate[key])) {
       throw new Error(`${label2}.${key} must be an absolute path`);
     }
   }
@@ -38564,7 +38730,7 @@ function validateManifest(value) {
   return root;
 }
 function readManifest(file) {
-  const raw = import_node_fs59.default.readFileSync(file);
+  const raw = import_node_fs60.default.readFileSync(file);
   let parsed;
   try {
     parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(raw));
@@ -38603,7 +38769,7 @@ function selectManifest(file, expectedSha256, ids2) {
   return canonicalJson(subset);
 }
 function gitLine(cwd, args) {
-  const result = (0, import_node_child_process45.spawnSync)("git", ["-C", cwd, ...args], {
+  const result = (0, import_node_child_process46.spawnSync)("git", ["-C", cwd, ...args], {
     encoding: "utf-8",
     env: { ...process.env, GIT_OPTIONAL_LOCKS: "0", LC_ALL: "C" }
   });
@@ -38611,7 +38777,7 @@ function gitLine(cwd, args) {
   return result.status === 0 && !result.error && output2 ? output2 : void 0;
 }
 function readWorktreeIdentity(worktreePath) {
-  if (!import_node_fs59.default.existsSync(worktreePath)) return void 0;
+  if (!import_node_fs60.default.existsSync(worktreePath)) return void 0;
   const real = comparableWorkspacePath(worktreePath);
   const commonDir = gitLine(real, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
   const gitDir = gitLine(real, ["rev-parse", "--path-format=absolute", "--git-dir"]);
@@ -38631,13 +38797,13 @@ function identityMismatch(expected, actual) {
 function unmanagedActivityEpoch(worktreePath, gitDir) {
   let latest;
   for (const file of [
-    import_node_path72.default.join(gitDir, "index"),
-    import_node_path72.default.join(gitDir, "HEAD"),
-    import_node_path72.default.join(gitDir, "logs", "HEAD"),
+    import_node_path73.default.join(gitDir, "index"),
+    import_node_path73.default.join(gitDir, "HEAD"),
+    import_node_path73.default.join(gitDir, "logs", "HEAD"),
     worktreePath
   ]) {
     try {
-      const seconds = Math.floor(import_node_fs59.default.statSync(file).mtimeMs / 1e3);
+      const seconds = Math.floor(import_node_fs60.default.statSync(file).mtimeMs / 1e3);
       latest = latest === void 0 ? seconds : Math.max(latest, seconds);
     } catch {
     }
@@ -38691,12 +38857,12 @@ function buildReclaimManifest(report, createdAtEpoch) {
   return canonicalJson(manifest);
 }
 function receiptPath(commonDir, manifestSha256, id5) {
-  return import_node_path72.default.join(commonDir, "worktree-reclaim", "receipts", manifestSha256, `${id5}.json`);
+  return import_node_path73.default.join(commonDir, "worktree-reclaim", "receipts", manifestSha256, `${id5}.json`);
 }
 function matchingReceipt(candidate, manifestSha256) {
   try {
     const receipt = JSON.parse(
-      import_node_fs59.default.readFileSync(receiptPath(candidate.commonDir, manifestSha256, candidate.id), "utf-8")
+      import_node_fs60.default.readFileSync(receiptPath(candidate.commonDir, manifestSha256, candidate.id), "utf-8")
     );
     return receipt.kind === RECEIPT_KIND && receipt.schemaVersion === SCHEMA_VERSION && receipt.manifestSha256 === manifestSha256 && receipt.candidateId === candidate.id && receipt.path === candidate.path && receipt.head === candidate.head;
   } catch {
@@ -38705,7 +38871,7 @@ function matchingReceipt(candidate, manifestSha256) {
 }
 function writeReceipt(candidate, manifestSha256, steps, nowEpoch) {
   const file = receiptPath(candidate.commonDir, manifestSha256, candidate.id);
-  import_node_fs59.default.mkdirSync(import_node_path72.default.dirname(file), { recursive: true });
+  import_node_fs60.default.mkdirSync(import_node_path73.default.dirname(file), { recursive: true });
   writeFileAtomically(
     file,
     canonicalJson({
@@ -38723,7 +38889,7 @@ function writeReceipt(candidate, manifestSha256, steps, nowEpoch) {
   );
 }
 function runVetoCommand(command, worktreePath) {
-  const result = (0, import_node_child_process45.spawnSync)(command, [worktreePath], {
+  const result = (0, import_node_child_process46.spawnSync)(command, [worktreePath], {
     stdio: ["ignore", "ignore", "inherit"],
     timeout: VETO_TIMEOUT_MS
   });
@@ -38736,9 +38902,9 @@ function runVetoCommand(command, worktreePath) {
   return result.status === 0 && !result.error && result.signal === null;
 }
 function assertVetoCommand(command) {
-  if (!import_node_path72.default.isAbsolute(command)) throw new Error("--veto-command must be an absolute path");
+  if (!import_node_path73.default.isAbsolute(command)) throw new Error("--veto-command must be an absolute path");
   try {
-    import_node_fs59.default.accessSync(command, import_node_fs59.default.constants.X_OK);
+    import_node_fs60.default.accessSync(command, import_node_fs60.default.constants.X_OK);
   } catch {
     throw new Error(`--veto-command '${command}' is missing or not executable`);
   }
@@ -38764,7 +38930,7 @@ function preflightManifestApply(options, action2, nowEpoch) {
   return { manifest, manifestSha256, now };
 }
 function deleteBranchIfUnmoved(candidate, steps) {
-  const exists2 = (0, import_node_child_process45.spawnSync)(
+  const exists2 = (0, import_node_child_process46.spawnSync)(
     "git",
     ["-C", candidate.repo, "show-ref", "--verify", "--quiet", candidate.branchRef],
     { encoding: "utf-8" }
@@ -38773,7 +38939,7 @@ function deleteBranchIfUnmoved(candidate, steps) {
   if (exists2.status !== 0) {
     throw new Error(`cannot read branch ${candidate.branch}: ${(exists2.stderr ?? "").trim()}`);
   }
-  const result = (0, import_node_child_process45.spawnSync)(
+  const result = (0, import_node_child_process46.spawnSync)(
     "git",
     ["-C", candidate.repo, "update-ref", "-d", candidate.branchRef, candidate.head],
     { encoding: "utf-8" }
@@ -38782,7 +38948,7 @@ function deleteBranchIfUnmoved(candidate, steps) {
     return `branch ${candidate.branch} no longer points at the approved HEAD; it was kept for review`;
   }
   steps.push("branch-deleted");
-  (0, import_node_child_process45.spawnSync)(
+  (0, import_node_child_process46.spawnSync)(
     "git",
     ["-C", candidate.repo, "config", "--remove-section", `branch.${candidate.branch}`],
     { encoding: "utf-8" }
@@ -38820,7 +38986,7 @@ async function applyReclaimManifest(options, dependencies) {
       outcome.status = "not-attempted";
       continue;
     }
-    if (!import_node_fs59.default.existsSync(candidate.path) && matchingReceipt(candidate, manifestSha256)) {
+    if (!import_node_fs60.default.existsSync(candidate.path) && matchingReceipt(candidate, manifestSha256)) {
       outcome.status = "already-done";
       continue;
     }
@@ -38889,14 +39055,14 @@ async function applyReclaimManifest(options, dependencies) {
   }
   return { manifestSha256, dryRun: !options.yes, targets, stoppedEarly };
 }
-var import_node_child_process45, import_node_crypto41, import_node_fs59, import_node_path72, MANIFEST_KIND, LEGACY_MANIFEST_KIND, RECEIPT_KIND, SCHEMA_VERSION, HEX_SHA, HEX_ID, VETO_TIMEOUT_MS, FUTURE_TOLERANCE_SECONDS, ROOT_KEYS, SESSION_ROOT_KEYS, LEGACY_ROOT_KEYS, CANDIDATE_KEYS, SESSION_CANDIDATE_KEYS, OPTIONAL_CANDIDATE_KEYS, ReclaimSkip;
+var import_node_child_process46, import_node_crypto42, import_node_fs60, import_node_path73, MANIFEST_KIND, LEGACY_MANIFEST_KIND, RECEIPT_KIND, SCHEMA_VERSION, HEX_SHA, HEX_ID, VETO_TIMEOUT_MS, FUTURE_TOLERANCE_SECONDS, ROOT_KEYS, SESSION_ROOT_KEYS, LEGACY_ROOT_KEYS, CANDIDATE_KEYS, SESSION_CANDIDATE_KEYS, OPTIONAL_CANDIDATE_KEYS, ReclaimSkip;
 var init_worktree_reclaim = __esm({
   "src/core/worktree-reclaim.ts"() {
     "use strict";
-    import_node_child_process45 = require("child_process");
-    import_node_crypto41 = require("crypto");
-    import_node_fs59 = __toESM(require("fs"));
-    import_node_path72 = __toESM(require("path"));
+    import_node_child_process46 = require("child_process");
+    import_node_crypto42 = require("crypto");
+    import_node_fs60 = __toESM(require("fs"));
+    import_node_path73 = __toESM(require("path"));
     init_atomic_file();
     init_workspace();
     MANIFEST_KIND = "worktree-reclaim-manifest";
@@ -39016,8 +39182,8 @@ function checkoutOf(workingDir) {
   return workingDir.replace(/\/+$/, "").replace(/\/\.devcontainer$/, "");
 }
 function isInsideOrEqual(parent, child) {
-  const relative2 = import_node_path73.default.relative(parent, child);
-  return relative2 === "" || !relative2.startsWith("..") && !import_node_path73.default.isAbsolute(relative2);
+  const relative2 = import_node_path74.default.relative(parent, child);
+  return relative2 === "" || !relative2.startsWith("..") && !import_node_path74.default.isAbsolute(relative2);
 }
 function isAnonymousVolume(volume) {
   return /^[0-9a-f]{64}$/.test(volume.name) && !volume.labels[PROJECT_LABEL];
@@ -39029,9 +39195,9 @@ function vanishedInsideTrees(checkout, context) {
     (prefix) => checkout !== prefix && isInsideOrEqual(prefix, checkout)
   );
   if (!lexical || context.exists(checkout)) return "out-of-scope";
-  let ancestor = import_node_path73.default.dirname(checkout);
+  let ancestor = import_node_path74.default.dirname(checkout);
   while (!context.exists(ancestor)) {
-    const parent = import_node_path73.default.dirname(ancestor);
+    const parent = import_node_path74.default.dirname(ancestor);
     if (parent === ancestor) return "out-of-scope";
     ancestor = parent;
   }
@@ -39039,16 +39205,16 @@ function vanishedInsideTrees(checkout, context) {
   if (ancestorReal === void 0 || !isInsideOrEqual(treesReal, ancestorReal)) {
     return "out-of-scope";
   }
-  for (let current = ancestor; ; current = import_node_path73.default.dirname(current)) {
+  for (let current = ancestor; ; current = import_node_path74.default.dirname(current)) {
     const real = context.realpath(current);
     if (real === void 0 || real === treesReal || !isInsideOrEqual(treesReal, real)) break;
-    if (context.exists(import_node_path73.default.join(current, ".git"))) return "inside-worktree";
+    if (context.exists(import_node_path74.default.join(current, ".git"))) return "inside-worktree";
   }
   return "vanished";
 }
 function resolved(file, context) {
   const real = context.realpath(file);
-  return real && real !== import_node_path73.default.resolve(file) ? [import_node_path73.default.resolve(file), real] : [import_node_path73.default.resolve(file)];
+  return real && real !== import_node_path74.default.resolve(file) ? [import_node_path74.default.resolve(file), real] : [import_node_path74.default.resolve(file)];
 }
 function relation(entry, checkout, context) {
   const entries = resolved(entry, context);
@@ -39153,21 +39319,21 @@ function readLeftoverContext(repoPath) {
   resetWorkspaceRuntimeCaches();
   const snapshots = getWorkspaceRegistrySnapshots();
   return {
-    treesPath: import_node_path73.default.join(repoPath, "trees"),
+    treesPath: import_node_path74.default.join(repoPath, "trees"),
     worktreePaths: listGitWorktrees(repoPath).map((worktree) => worktree.path),
     ownershipPaths: listWorkspaceOwnership(repoPath).map((record6) => record6.worktreePath),
     providerPaths: listMergedRuntimeWorkspaces().map((workspace) => workspace.source.localFolder),
     registriesReadable: snapshots.unavailable.length === 0,
     realpath: (file) => {
       try {
-        return import_node_fs60.default.realpathSync.native(file);
+        return import_node_fs61.default.realpathSync.native(file);
       } catch {
         return void 0;
       }
     },
     exists: (file) => {
       try {
-        import_node_fs60.default.lstatSync(file);
+        import_node_fs61.default.lstatSync(file);
         return true;
       } catch (error) {
         return error.code !== "ENOENT";
@@ -39231,7 +39397,7 @@ function validateLeftoverManifest(value) {
     throw new Error(`manifest schemaVersion must be ${SCHEMA_VERSION2}`);
   }
   requireString(root.repo, "manifest repo");
-  if (!import_node_path73.default.isAbsolute(root.repo)) throw new Error("manifest repo must be an absolute path");
+  if (!import_node_path74.default.isAbsolute(root.repo)) throw new Error("manifest repo must be an absolute path");
   requireString(root.daemonId, "manifest daemonId");
   if (!Number.isInteger(root.createdAtEpoch) || root.createdAtEpoch < 0) {
     throw new Error("manifest createdAtEpoch must be a non-negative integer");
@@ -39253,7 +39419,7 @@ function validateLeftoverManifest(value) {
     );
     requireString(candidate.project, `${label2}.project`);
     requireString(candidate.checkout, `${label2}.checkout`);
-    if (!import_node_path73.default.isAbsolute(candidate.checkout)) {
+    if (!import_node_path74.default.isAbsolute(candidate.checkout)) {
       throw new Error(`${label2}.checkout must be an absolute path`);
     }
     const members = [
@@ -39291,7 +39457,7 @@ function validateLeftoverManifest(value) {
   return root;
 }
 function readLeftoverManifest(file) {
-  const raw = import_node_fs60.default.readFileSync(file);
+  const raw = import_node_fs61.default.readFileSync(file);
   let parsed;
   try {
     parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(raw));
@@ -39305,7 +39471,7 @@ function readLeftoverManifest(file) {
   return { raw, manifest };
 }
 function gitCommonDir(repo) {
-  const result = (0, import_node_child_process46.spawnSync)(
+  const result = (0, import_node_child_process47.spawnSync)(
     "git",
     ["-C", repo, "rev-parse", "--path-format=absolute", "--git-common-dir"],
     { encoding: "utf-8" }
@@ -39334,7 +39500,7 @@ function currentRemovals(candidate, inventory, context) {
       throw new LeftoverSkip("changed", "the checkout folder exists again");
     }
     const mounted = new Set(inventory.containers.flatMap((container) => container.volumes));
-    const ours = (object5) => object5.labels[PROJECT_LABEL] === candidate.project && object5.name.startsWith(`${candidate.project}_`);
+    const ours = (object6) => object6.labels[PROJECT_LABEL] === candidate.project && object6.name.startsWith(`${candidate.project}_`);
     current = {
       project: candidate.project,
       checkout: candidate.checkout,
@@ -39473,11 +39639,11 @@ function applyLeftoverManifest(options, dependencies = {}) {
   return { manifestSha256, dryRun: !options.yes, targets };
 }
 function leftoverReceiptPath(commonDir, manifestSha256, id5) {
-  return import_node_path73.default.join(commonDir, "devrouter-leftovers", "receipts", manifestSha256, `${id5}.json`);
+  return import_node_path74.default.join(commonDir, "devrouter-leftovers", "receipts", manifestSha256, `${id5}.json`);
 }
 function writeLeftoverReceipt(commonDir, manifestSha256, candidate, steps, nowEpoch) {
   const file = leftoverReceiptPath(commonDir, manifestSha256, candidate.id);
-  import_node_fs60.default.mkdirSync(import_node_path73.default.dirname(file), { recursive: true });
+  import_node_fs61.default.mkdirSync(import_node_path74.default.dirname(file), { recursive: true });
   writeFileAtomically(
     file,
     canonicalJson({
@@ -39493,13 +39659,13 @@ function writeLeftoverReceipt(commonDir, manifestSha256, candidate, steps, nowEp
     })
   );
 }
-var import_node_child_process46, import_node_fs60, import_node_path73, LEFTOVER_MANIFEST_KIND, LEFTOVER_RECEIPT_KIND, SCHEMA_VERSION2, MAX_DOCKER_OBJECTS, FUTURE_TOLERANCE_SECONDS2, PROJECT_LABEL, WORKING_DIR_LABEL, PROVIDER_LABEL, STOPPED_STATES, HEX_ID2, DockerListingBoundError, defaultDockerRunner, LeftoverSkip, defaultWithLocks;
+var import_node_child_process47, import_node_fs61, import_node_path74, LEFTOVER_MANIFEST_KIND, LEFTOVER_RECEIPT_KIND, SCHEMA_VERSION2, MAX_DOCKER_OBJECTS, FUTURE_TOLERANCE_SECONDS2, PROJECT_LABEL, WORKING_DIR_LABEL, PROVIDER_LABEL, STOPPED_STATES, HEX_ID2, DockerListingBoundError, defaultDockerRunner, LeftoverSkip, defaultWithLocks;
 var init_docker_leftovers = __esm({
   "src/core/docker-leftovers.ts"() {
     "use strict";
-    import_node_child_process46 = require("child_process");
-    import_node_fs60 = __toESM(require("fs"));
-    import_node_path73 = __toESM(require("path"));
+    import_node_child_process47 = require("child_process");
+    import_node_fs61 = __toESM(require("fs"));
+    import_node_path74 = __toESM(require("path"));
     init_atomic_file();
     init_devpod_mutation();
     init_devpod_workspaces();
@@ -39520,7 +39686,7 @@ var init_docker_leftovers = __esm({
     DockerListingBoundError = class extends Error {
     };
     defaultDockerRunner = (args) => {
-      const result = (0, import_node_child_process46.spawnSync)("docker", args, {
+      const result = (0, import_node_child_process47.spawnSync)("docker", args, {
         encoding: "utf-8",
         timeout: 6e4,
         maxBuffer: 256 * 1024 * 1024
@@ -39551,13 +39717,13 @@ function measureWorktreeConsumption(worktreePath, options) {
   const startedAt = Date.now();
   let rootStat;
   try {
-    rootStat = import_node_fs61.default.lstatSync(worktreePath);
+    rootStat = import_node_fs62.default.lstatSync(worktreePath);
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
   let rootEntries;
   try {
-    rootEntries = import_node_fs61.default.readdirSync(worktreePath, { withFileTypes: true });
+    rootEntries = import_node_fs62.default.readdirSync(worktreePath, { withFileTypes: true });
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
@@ -39583,10 +39749,10 @@ function measureWorktreeConsumption(worktreePath, options) {
         timedOut = true;
         break;
       }
-      const entryPath = import_node_path74.default.join(dirPath, entry.name);
+      const entryPath = import_node_path75.default.join(dirPath, entry.name);
       let entryStat;
       try {
-        entryStat = import_node_fs61.default.lstatSync(entryPath);
+        entryStat = import_node_fs62.default.lstatSync(entryPath);
       } catch (error) {
         if (error?.code === "ENOENT") continue;
         unreadableReason = describeIncompleteWalk(error);
@@ -39596,7 +39762,7 @@ function measureWorktreeConsumption(worktreePath, options) {
       if (!entryStat.isDirectory()) continue;
       let childEntries;
       try {
-        childEntries = import_node_fs61.default.readdirSync(entryPath, { withFileTypes: true });
+        childEntries = import_node_fs62.default.readdirSync(entryPath, { withFileTypes: true });
       } catch (error) {
         unreadableReason = describeIncompleteWalk(error);
         break;
@@ -39660,12 +39826,12 @@ function describeError(error, worktreePath) {
   }
   return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
 }
-var import_node_fs61, import_node_path74, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var import_node_fs62, import_node_path75, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
 var init_workspace_consumption = __esm({
   "src/core/workspace-consumption.ts"() {
     "use strict";
-    import_node_fs61 = __toESM(require("fs"));
-    import_node_path74 = __toESM(require("path"));
+    import_node_fs62 = __toESM(require("fs"));
+    import_node_path75 = __toESM(require("path"));
     init_devpod_environment();
     DEFAULT_DEADLINE_MS = 1e4;
     BLOCK_SIZE_BYTES = 512;
@@ -39751,7 +39917,7 @@ function evaluateWorkspaceActivity(evidence, cutoff) {
 }
 function readGitSnapshot(worktree, commandRunner) {
   const comparablePath = comparableWorkspacePath(worktree.path);
-  if (worktree.prunable || !import_node_fs62.default.existsSync(comparablePath)) {
+  if (worktree.prunable || !import_node_fs63.default.existsSync(comparablePath)) {
     return { worktree, checkout: "missing", head: null, committerDate: null };
   }
   const head = gitOutput(comparablePath, ["rev-parse", "--verify", "HEAD"], commandRunner);
@@ -40324,7 +40490,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
       containers2 = measureContainersFn(worktreePaths);
     } catch (error) {
       const reason2 = `container measurement failed: ${describeCause(error)}`;
-      containers2 = new Map(worktreePaths.map((path79) => [path79, unknownContainers(reason2)]));
+      containers2 = new Map(worktreePaths.map((path80) => [path80, unknownContainers(reason2)]));
     }
   }
   const rows2 = records.map((record6) => {
@@ -40383,7 +40549,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
     dependencies.listForge ?? ((identity2) => listForgeChanges(identity2))
   );
   const sources = (dependencies.readRuntimeSources ?? readRuntimeSources)(repoPath);
-  const disposable = import_node_fs62.default.existsSync(import_node_path75.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees?.disposable ?? [] : [];
+  const disposable = import_node_fs63.default.existsSync(import_node_path76.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees?.disposable ?? [] : [];
   const [primary, ...linked] = worktrees;
   const safetyFor = (worktree, worktreePath, evidence) => toSafety(
     classify({
@@ -40391,7 +40557,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
       branch: worktree?.branch,
       primary: primary !== void 0 && sameWorkspacePath(primary.path, worktreePath),
       locked: worktree?.locked ?? false,
-      missing: !worktree || worktree.prunable || !import_node_fs62.default.existsSync(worktreePath),
+      missing: !worktree || worktree.prunable || !import_node_fs63.default.existsSync(worktreePath),
       runtimeEvidence: evidence,
       forge,
       extraDisposablePatterns: disposable
@@ -40452,7 +40618,7 @@ function readPathEvidence(repoPath, worktreePath, inactiveFor, dependencies) {
   }
   const sources = (dependencies.readRuntimeSources ?? readRuntimeSources)(repoPath);
   const cutoffEpoch = Math.floor(Date.now() / 1e3) - parseInactiveFor(inactiveFor).seconds;
-  const gitDir = (0, import_node_child_process47.spawnSync)(
+  const gitDir = (0, import_node_child_process48.spawnSync)(
     "git",
     ["-C", worktreePath, "rev-parse", "--path-format=absolute", "--git-dir"],
     { encoding: "utf-8", env: READ_ONLY_GIT_ENV2 }
@@ -40472,7 +40638,7 @@ function classifyExactPath(repoPath, worktreePath, evidence, forge, extraDisposa
     branch: worktree?.branch,
     primary: worktrees[0] !== void 0 && sameWorkspacePath(worktrees[0].path, worktreePath),
     locked: worktree?.locked ?? false,
-    missing: !worktree || worktree.prunable || !import_node_fs62.default.existsSync(worktreePath),
+    missing: !worktree || worktree.prunable || !import_node_fs63.default.existsSync(worktreePath),
     runtimeEvidence: evidence.runtimeEvidence,
     forge,
     extraDisposablePatterns
@@ -40498,7 +40664,7 @@ function prepareReclaimVerdicts(repo, inactiveFor, dependencies = {}) {
     dependencies.listForge ?? ((identity2) => listForgeChanges(identity2))
   );
   const forge = evidence.status === "not-checked" ? { status: "unavailable", reason: "forge not checked" } : evidence;
-  const disposable = import_node_fs62.default.existsSync(import_node_path75.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees?.disposable ?? [] : [];
+  const disposable = import_node_fs63.default.existsSync(import_node_path76.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees?.disposable ?? [] : [];
   const paths = evidenceCache(
     (worktreePath) => readPathEvidence(repoPath, worktreePath, inactiveFor, dependencies)
   );
@@ -40517,7 +40683,7 @@ function prepareReclaimVerdicts(repo, inactiveFor, dependencies = {}) {
 }
 function prepareTrimChecks(repo, inactiveFor, dependencies = {}) {
   const repoPath = resolveRepoPath(repo);
-  const configured = import_node_fs62.default.existsSync(import_node_path75.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees : void 0;
+  const configured = import_node_fs63.default.existsSync(import_node_path76.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees : void 0;
   const patterns = configured?.trim ?? [];
   const paths = evidenceCache(
     (worktreePath) => readPathEvidence(repoPath, worktreePath, inactiveFor, dependencies)
@@ -40542,13 +40708,13 @@ function prepareTrimChecks(repo, inactiveFor, dependencies = {}) {
     isActive: (worktreePath) => paths.last(worktreePath).active
   };
 }
-var import_node_child_process47, import_node_fs62, import_node_path75, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var import_node_child_process48, import_node_fs63, import_node_path76, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
 var init_workspace_cleanup = __esm({
   "src/core/workspace-cleanup.ts"() {
     "use strict";
-    import_node_child_process47 = require("child_process");
-    import_node_fs62 = __toESM(require("fs"));
-    import_node_path75 = __toESM(require("path"));
+    import_node_child_process48 = require("child_process");
+    import_node_fs63 = __toESM(require("fs"));
+    import_node_path76 = __toESM(require("path"));
     init_devpod_workspaces();
     init_docker_leftovers();
     init_duration();
@@ -40571,7 +40737,7 @@ var init_workspace_cleanup = __esm({
     ];
     defaultCommandRunner = (command, args, input2) => {
       const environment = command === "git" ? READ_ONLY_GIT_ENV2 : { ...process.env, LC_ALL: "C" };
-      const result = (0, import_node_child_process47.spawnSync)(command, args, {
+      const result = (0, import_node_child_process48.spawnSync)(command, args, {
         encoding: "utf-8",
         env: environment,
         ...input2 === void 0 ? {} : { input: input2 }
@@ -40696,7 +40862,7 @@ function journalVetoes(record6) {
 }
 function readTraefikWindow(cutoffMs) {
   const since = String(Math.floor(cutoffMs / 1e3));
-  const run = (args, maxBuffer) => (0, import_node_child_process48.spawnSync)("docker", ["logs", "--timestamps", ...args, ROUTER_CONTAINER_NAME], {
+  const run = (args, maxBuffer) => (0, import_node_child_process49.spawnSync)("docker", ["logs", "--timestamps", ...args, ROUTER_CONTAINER_NAME], {
     encoding: "utf-8",
     maxBuffer,
     ...networkDockerOptions()
@@ -40865,13 +41031,13 @@ function setIdlePin(repoPath, pinned) {
     }
   );
 }
-var import_node_child_process48, import_node_fs63, import_node_path76, DEFAULT_IDLE_FOR, ACTIVITY_FILES, IdleStopSkipped, defaultDependencies;
+var import_node_child_process49, import_node_fs64, import_node_path77, DEFAULT_IDLE_FOR, ACTIVITY_FILES, IdleStopSkipped, defaultDependencies;
 var init_workspace_idle = __esm({
   "src/core/workspace-idle.ts"() {
     "use strict";
-    import_node_child_process48 = require("child_process");
-    import_node_fs63 = __toESM(require("fs"));
-    import_node_path76 = __toESM(require("path"));
+    import_node_child_process49 = require("child_process");
+    import_node_fs64 = __toESM(require("fs"));
+    import_node_path77 = __toESM(require("path"));
     init_devpod_environment();
     init_devpod_workspaces();
     init_duration();
@@ -40892,7 +41058,7 @@ var init_workspace_idle = __esm({
       readJournals: () => listReliabilityOperations(),
       journalModifiedMs: (record6) => {
         try {
-          return import_node_fs63.default.statSync(reliabilityOperationPath(record6.identity)).mtimeMs;
+          return import_node_fs64.default.statSync(reliabilityOperationPath(record6.identity)).mtimeMs;
         } catch {
           return void 0;
         }
@@ -40900,7 +41066,7 @@ var init_workspace_idle = __esm({
       registryPaths: () => listMergedRuntimeWorkspaces().map((workspace) => workspace.source.localFolder),
       inspectContainers: () => inspectWorkspaceContainers(),
       statActivity: (containerId) => {
-        const result = (0, import_node_child_process48.spawnSync)(
+        const result = (0, import_node_child_process49.spawnSync)(
           "docker",
           ["exec", containerId, "stat", "-c", "%Y", ...ACTIVITY_FILES],
           {
@@ -40915,7 +41081,7 @@ var init_workspace_idle = __esm({
         };
       },
       readTraefik: readTraefikWindow,
-      isConfiguredCheckout: (repoPath) => import_node_fs63.default.existsSync(import_node_path76.default.join(repoPath, ".devrouter.yml")),
+      isConfiguredCheckout: (repoPath) => import_node_fs64.default.existsSync(import_node_path77.default.join(repoPath, ".devrouter.yml")),
       gitCommonDir: (repoPath) => {
         try {
           return resolveGitCommonDir(repoPath);
@@ -41006,20 +41172,20 @@ function warnMissingWorkspaceOwnership(repoPath) {
   );
 }
 function defaultWorktreePath(mainRepo, ws) {
-  return import_node_path77.default.join(mainRepo, "trees", ws);
+  return import_node_path78.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
-  const ignored = (0, import_node_child_process49.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
+  const ignored = (0, import_node_child_process50.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
     encoding: "utf-8"
   });
   if (ignored.status !== 0) {
     throw new Error(
-      `Default worktree root '${import_node_path77.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path77.default.join(mainRepo, ".gitignore")}' or use --path.`
+      `Default worktree root '${import_node_path78.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path78.default.join(mainRepo, ".gitignore")}' or use --path.`
     );
   }
 }
 function legacyDefaultWorktreePath(mainRepo, ws) {
-  return import_node_path77.default.join(import_node_path77.default.dirname(mainRepo), `${import_node_path77.default.basename(mainRepo)}-${ws}`);
+  return import_node_path78.default.join(import_node_path78.default.dirname(mainRepo), `${import_node_path78.default.basename(mainRepo)}-${ws}`);
 }
 function teardownFallbackPath(mainRepo, workspace) {
   const candidates = [
@@ -41131,7 +41297,7 @@ function assertFullDownPreflight(mainRepo, target) {
   if (sameWorkspacePath(target.worktreePath, mainRepo)) {
     throw new Error("Refusing to remove the primary Git checkout.");
   }
-  if (!target.worktree || target.worktree.prunable || !import_node_fs64.default.existsSync(target.worktreePath)) return;
+  if (!target.worktree || target.worktree.prunable || !import_node_fs65.default.existsSync(target.worktreePath)) return;
   if (target.worktree.locked) {
     throw new Error(
       `Worktree '${target.worktreePath}' is locked; unlock it before workspace down.`
@@ -41163,9 +41329,9 @@ async function workspaceUp(branch, opts = {}) {
       (candidate) => defaultWorktreePath(mainRepo, candidate)
     );
     const generatedPath = candidatePaths.find(
-      (candidate) => !import_node_fs64.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
+      (candidate) => !import_node_fs65.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
     );
-    const selectedPath = opts.path ? import_node_path77.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
+    const selectedPath = opts.path ? import_node_path78.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
     if (!selectedPath) {
       throw new Error(`Could not allocate a collision-safe worktree path for branch '${branch}'.`);
     }
@@ -41174,7 +41340,7 @@ async function workspaceUp(branch, opts = {}) {
         `Branch '${branch}' already uses worktree '${existingBranch.path}', not '${selectedPath}'.`
       );
     }
-    if (import_node_fs64.default.existsSync(selectedPath)) {
+    if (import_node_fs65.default.existsSync(selectedPath)) {
       const registered = worktrees.find(
         (worktree) => sameWorkspacePath(worktree.path, selectedPath)
       );
@@ -41193,11 +41359,11 @@ async function workspaceUp(branch, opts = {}) {
       return selectedPath;
     }
     if (!opts.path) assertDefaultWorktreeRootIgnored(mainRepo);
-    const add2 = (0, import_node_child_process49.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
+    const add2 = (0, import_node_child_process50.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
       encoding: "utf-8"
     });
     if (add2.status !== 0) {
-      const addNew = (0, import_node_child_process49.spawnSync)(
+      const addNew = (0, import_node_child_process50.spawnSync)(
         "git",
         ["-C", mainRepo, "worktree", "add", "-b", branch, selectedPath],
         { encoding: "utf-8" }
@@ -41337,8 +41503,8 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     const result = await mutateWorkspaceRuntime("delete", resolved2, worktrees, opts.quiet);
     if (removeWorktree) {
-      if (resolved2.worktree && !resolved2.worktree.prunable && import_node_fs64.default.existsSync(resolved2.worktreePath)) {
-        const rm = (0, import_node_child_process49.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved2.worktreePath], {
+      if (resolved2.worktree && !resolved2.worktree.prunable && import_node_fs65.default.existsSync(resolved2.worktreePath)) {
+        const rm = (0, import_node_child_process50.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved2.worktreePath], {
           encoding: "utf-8"
         });
         if (rm.status !== 0) {
@@ -41356,7 +41522,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     return result;
   };
-  return resolved2.worktree && !resolved2.worktree.prunable && import_node_fs64.default.existsSync(resolved2.worktreePath) ? withLifecycleOperationLock(resolved2.worktreePath, operation) : operation();
+  return resolved2.worktree && !resolved2.worktree.prunable && import_node_fs65.default.existsSync(resolved2.worktreePath) ? withLifecycleOperationLock(resolved2.worktreePath, operation) : operation();
 }
 async function reclaimWorktreeExactPath(mainRepo, worktreePath, verify, afterRemove, steps) {
   await withLifecycleOperationLock(worktreePath, async () => {
@@ -41382,7 +41548,7 @@ async function reclaimWorktreeExactPath(mainRepo, worktreePath, verify, afterRem
       );
       steps.push("runtime-deleted");
     }
-    const rm = (0, import_node_child_process49.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", worktreePath], {
+    const rm = (0, import_node_child_process50.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", worktreePath], {
       encoding: "utf-8"
     });
     if (rm.status !== 0) {
@@ -41403,13 +41569,13 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process49, import_node_fs64, import_node_path77, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
+var import_node_child_process50, import_node_fs65, import_node_path78, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
-    import_node_child_process49 = require("child_process");
-    import_node_fs64 = __toESM(require("fs"));
-    import_node_path77 = __toESM(require("path"));
+    import_node_child_process50 = require("child_process");
+    import_node_fs65 = __toESM(require("fs"));
+    import_node_path78 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_devsy_mutation();
@@ -41428,7 +41594,7 @@ var init_workspace_lifecycle = __esm({
 
 // src/core/worktree-trim.ts
 function listIgnoredPaths(worktreePath) {
-  const result = (0, import_node_child_process50.spawnSync)(
+  const result = (0, import_node_child_process51.spawnSync)(
     "git",
     [
       "-C",
@@ -41512,19 +41678,19 @@ function buildTrimManifest(report, patterns, createdAtEpoch) {
   return canonicalJson(manifest);
 }
 function isInside(parent, child) {
-  const relative2 = import_node_path78.default.relative(parent, child);
-  return relative2 !== "" && !relative2.startsWith("..") && !import_node_path78.default.isAbsolute(relative2);
+  const relative2 = import_node_path79.default.relative(parent, child);
+  return relative2 !== "" && !relative2.startsWith("..") && !import_node_path79.default.isAbsolute(relative2);
 }
 function exists(file) {
   try {
-    import_node_fs65.default.lstatSync(file);
+    import_node_fs66.default.lstatSync(file);
     return true;
   } catch {
     return false;
   }
 }
 function hasTrackedFiles(worktreePath, relative2) {
-  const result = (0, import_node_child_process50.spawnSync)(
+  const result = (0, import_node_child_process51.spawnSync)(
     "git",
     ["-C", worktreePath, "--literal-pathspecs", "ls-files", "-z", "--", relative2],
     { encoding: "utf-8", env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" } }
@@ -41532,10 +41698,10 @@ function hasTrackedFiles(worktreePath, relative2) {
   return result.status !== 0 || Boolean(result.error) || result.stdout.length > 0;
 }
 function trimOnePath(candidate, relative2, patterns, steps) {
-  const target = import_node_path78.default.join(candidate.path, relative2);
+  const target = import_node_path79.default.join(candidate.path, relative2);
   let stat;
   try {
-    stat = import_node_fs65.default.lstatSync(target);
+    stat = import_node_fs66.default.lstatSync(target);
   } catch (error) {
     if (error.code === "ENOENT") {
       steps.push(`gone:${relative2}`);
@@ -41547,7 +41713,7 @@ function trimOnePath(candidate, relative2, patterns, steps) {
     steps.push(`skipped-symlink:${relative2}`);
     return;
   }
-  if (!isInside(import_node_fs65.default.realpathSync.native(candidate.path), import_node_fs65.default.realpathSync.native(target))) {
+  if (!isInside(import_node_fs66.default.realpathSync.native(candidate.path), import_node_fs66.default.realpathSync.native(target))) {
     steps.push(`skipped-outside:${relative2}`);
     return;
   }
@@ -41560,7 +41726,7 @@ function trimOnePath(candidate, relative2, patterns, steps) {
     return;
   }
   try {
-    import_node_fs65.default.rmSync(target, { recursive: true, force: true });
+    import_node_fs66.default.rmSync(target, { recursive: true, force: true });
   } catch (error) {
     steps.push(`partial:${relative2}`);
     throw error;
@@ -41600,7 +41766,7 @@ async function applyTrimManifest(options, dependencies) {
       continue;
     }
     const listed = candidate.paths ?? [];
-    if (listed.every((relative2) => !exists(import_node_path78.default.join(candidate.path, relative2))) && matchingReceipt(candidate, manifestSha256)) {
+    if (listed.every((relative2) => !exists(import_node_path79.default.join(candidate.path, relative2))) && matchingReceipt(candidate, manifestSha256)) {
       outcome.status = "already-done";
       continue;
     }
@@ -41624,7 +41790,7 @@ async function applyTrimManifest(options, dependencies) {
       if (!options.yes) {
         verify();
         outcome.status = "would-trim";
-        const present = listed.filter((relative2) => exists(import_node_path78.default.join(candidate.path, relative2)));
+        const present = listed.filter((relative2) => exists(import_node_path79.default.join(candidate.path, relative2)));
         outcome.reason = present.length ? `would remove: ${present.join(", ")}` : "nothing present";
         continue;
       }
@@ -41661,13 +41827,13 @@ async function applyTrimManifest(options, dependencies) {
   }
   return { manifestSha256, dryRun: !options.yes, targets, stoppedEarly };
 }
-var import_node_child_process50, import_node_fs65, import_node_path78;
+var import_node_child_process51, import_node_fs66, import_node_path79;
 var init_worktree_trim = __esm({
   "src/core/worktree-trim.ts"() {
     "use strict";
-    import_node_child_process50 = require("child_process");
-    import_node_fs65 = __toESM(require("fs"));
-    import_node_path78 = __toESM(require("path"));
+    import_node_child_process51 = require("child_process");
+    import_node_fs66 = __toESM(require("fs"));
+    import_node_path79 = __toESM(require("path"));
     init_reliability_lifecycle();
     init_worktree_reclaim();
     init_worktree_safety();
@@ -41735,7 +41901,7 @@ function runWorkspaceLsCommand(options) {
 }
 function writeManifestOutput(manifest, output2) {
   if (output2) {
-    import_node_fs66.default.writeFileSync(output2, manifest, { flag: "wx" });
+    import_node_fs67.default.writeFileSync(output2, manifest, { flag: "wx" });
     process.stdout.write(`${sha256Hex(manifest)}  ${output2}
 `);
   } else {
@@ -41765,7 +41931,7 @@ function runWorkspaceCleanupCommand(options) {
       throw new Error("--manifest requires --all-worktrees and --check-merged.");
     }
     const createdAtEpoch = Math.floor(Date.now() / 1e3);
-    const worktrees = import_node_fs66.default.existsSync(import_node_path79.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees : void 0;
+    const worktrees = import_node_fs67.default.existsSync(import_node_path80.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees : void 0;
     const manifest = action2 === "trim" ? buildTrimManifest(
       report,
       { trim: worktrees?.trim ?? [], disposable: worktrees?.disposable },
@@ -41803,7 +41969,7 @@ async function runWorkspaceIdleCommand(options) {
   if (options.stop) {
     const paths = idleSweepPaths();
     if (!process.stderr.isTTY) muteLifecycleProgressHeartbeat();
-    import_node_fs66.default.mkdirSync(paths.directory, { recursive: true, mode: 448 });
+    import_node_fs67.default.mkdirSync(paths.directory, { recursive: true, mode: 448 });
     const result = await withFileLock(paths.lock, { activity: "idle sweep" }, async () => {
       try {
         const swept = await stopIdleEnvironments(
@@ -41905,7 +42071,7 @@ async function runWorkspaceJournalSettleCommand(options) {
 function runWorkspaceManifestHashCommand(file) {
   let leftover = false;
   try {
-    leftover = isLeftoverManifest(JSON.parse(import_node_fs66.default.readFileSync(file, "utf-8")));
+    leftover = isLeftoverManifest(JSON.parse(import_node_fs67.default.readFileSync(file, "utf-8")));
   } catch {
   }
   const { raw } = leftover ? readLeftoverManifest(file) : readManifest(file);
@@ -42002,12 +42168,12 @@ async function runWorkspaceTrimCommand(options) {
     process.exitCode = 1;
   }
 }
-var import_node_fs66, import_node_path79;
+var import_node_fs67, import_node_path80;
 var init_workspace2 = __esm({
   "src/commands/workspace.ts"() {
     "use strict";
-    import_node_fs66 = __toESM(require("fs"));
-    import_node_path79 = __toESM(require("path"));
+    import_node_fs67 = __toESM(require("fs"));
+    import_node_path80 = __toESM(require("path"));
     init_docker_leftovers();
     init_file_lock();
     init_idle_sweep();
@@ -42065,7 +42231,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.6.1" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.6.3" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {
@@ -42159,7 +42325,7 @@ program.command("up").description("Ensure devnet and start shared Traefik (reser
     await runUpCommand2();
   })
 );
-program.command("ensure").description("Start and prove a primary or linked checkout's environment and routes").argument("[path]", "Git checkout path (defaults to current directory)").option("--profile <name>", "Start only this profile's apps/dependencies from .devrouter.yml").option("--variant <name>", "Select a declared managed runtime variant").option("--repair", "Repair a degraded managed runtime from its recorded profile").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
+program.command("ensure").description("Start and prove a primary or linked checkout's environment and routes").argument("[path]", "Git checkout path (defaults to current directory)").option("--profile <name>", "Start only this profile's apps/dependencies from .devrouter.yml").option("--variant <name>", "Select a declared managed runtime variant").option("--repair", "Repair a degraded managed runtime from its recorded profile").option("--initialize-new", "Initialize one fresh disposable managed environment explicitly").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
   withErrorHandling(async (repoPath, _options, command) => {
     const options = command.opts();
     const { runEnsureCommand: runEnsureCommand2 } = await Promise.resolve().then(() => (init_ensure(), ensure_exports));
@@ -42168,6 +42334,7 @@ program.command("ensure").description("Start and prove a primary or linked check
       profile: options.profile,
       variant: options.variant,
       repair: options.repair,
+      initializeNew: options.initializeNew,
       open: Boolean(options.open),
       json: Boolean(options.json)
     });
@@ -42432,7 +42599,7 @@ workspaceCommand2.command("up").description(
 );
 workspaceCommand2.command("ensure").description(
   "Start and prove a primary or linked checkout's workspace runtime, upstreams, and routes"
-).argument("[path]", "Git checkout path (defaults to current directory)").option("--profile <name>", "Start only this profile's apps/dependencies from .devrouter.yml").option("--variant <name>", "Select a declared managed runtime variant").option("--repair", "Repair a degraded managed runtime from its recorded profile").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
+).argument("[path]", "Git checkout path (defaults to current directory)").option("--profile <name>", "Start only this profile's apps/dependencies from .devrouter.yml").option("--variant <name>", "Select a declared managed runtime variant").option("--repair", "Repair a degraded managed runtime from its recorded profile").option("--initialize-new", "Initialize one fresh disposable managed environment explicitly").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
   withErrorHandling(
     async (worktreePath, _options, command) => {
       const options = command.opts();
@@ -42442,6 +42609,7 @@ workspaceCommand2.command("ensure").description(
         profile: options.profile,
         variant: options.variant,
         repair: options.repair,
+        initializeNew: options.initializeNew,
         open: Boolean(options.open),
         json: Boolean(options.json)
       });
@@ -42588,10 +42756,10 @@ workspaceCommand2.command("down").description("Delete a workspace's runtime and
 workspaceCommand2.command("journal").description("Inspect and recover workspace lifecycle journals").command("settle").description(
   "Settle an interrupted lifecycle operation as unobservable so ensure and stop can proceed"
 ).argument("[path]", "Checkout path (defaults to current directory)").option("--json", "Output JSON").action(
-  withErrorHandling(async (path79, _options, command) => {
+  withErrorHandling(async (path80, _options, command) => {
     const options = command.opts();
     const { runWorkspaceJournalSettleCommand: runWorkspaceJournalSettleCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));
-    await runWorkspaceJournalSettleCommand2({ ...path79 ? { path: path79 } : {}, ...options });
+    await runWorkspaceJournalSettleCommand2({ ...path80 ? { path: path80 } : {}, ...options });
   })
 );
 function parseVersionRequest(argv) {