@devrouter/cli 0.6.2 → 0.6.4

package/dist/devrouter.js

@@ -843,6 +843,52 @@ function runManagedStopDocker(args, endpoint, timeoutMs = MANAGED_STOP_DOCKER_TI
   }
   return result.stdout;
 }
+function inspectAppReplacementInventory(endpoint) {
+  const list2 = () => {
+    const ids3 = parseDockerLines(
+      runManagedStopDocker(["ps", "--all", "--quiet", "--no-trunc"], endpoint)
+    ).sort();
+    if (ids3.length > 1024) throw new Error("App replacement daemon inventory exceeds its bound.");
+    ids3.forEach(assertFullContainerId);
+    assertUniqueContainerIds(ids3);
+    return ids3;
+  };
+  const ids2 = list2();
+  const template = '{"id":{{json .Id}},"name":{{json .Name}},"image":{{json .Image}},"namespaces":{"NetworkMode":{{json .HostConfig.NetworkMode}},"PidMode":{{json .HostConfig.PidMode}},"IpcMode":{{json .HostConfig.IpcMode}}},"mounts":{{json .Mounts}}}';
+  const containers2 = ids2.length ? parseDockerLines(
+    runManagedStopDocker(["inspect", "--format", template, ...ids2], endpoint)
+  ).map((line) => {
+    const c = JSON.parse(line);
+    if (!isRecord(c)) throw new Error("Invalid replacement container inventory.");
+    assertFullContainerId(c.id);
+    if (typeof c.name !== "string" || !/^\/[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(c.name) || typeof c.image !== "string" || !/^sha256:[a-f0-9]{64}$/.test(c.image) || !isRecord(c.namespaces) || !["NetworkMode", "PidMode", "IpcMode"].every(
+      (key) => typeof c.namespaces[key] === "string"
+    ) || !Array.isArray(c.mounts) || c.mounts.some(
+      (m) => !isRecord(m) || typeof m.Type !== "string" || typeof m.Source !== "string" || typeof m.Destination !== "string" || m.Type === "volume" && (typeof m.Name !== "string" || !m.Name)
+    ))
+      throw new Error("Incomplete app replacement inventory.");
+    return c;
+  }) : [];
+  if (JSON.stringify(ids2) !== JSON.stringify(containers2.map((c) => c.id).sort()) || JSON.stringify(ids2) !== JSON.stringify(list2()) || new Set(containers2.map((c) => c.name)).size !== containers2.length)
+    throw new Error("App replacement daemon inventory changed during inspection.");
+  return containers2;
+}
+function assertNoAppNamespaceConsumers(containers2, primaryId) {
+  const primary = containers2.find((c) => c.id === primaryId);
+  if (!primary) throw new Error("App replacement lost the exact primary container.");
+  for (const c of containers2)
+    for (const mode of Object.values(c.namespaces)) {
+      if (!mode.startsWith("container:")) continue;
+      const reference = mode.slice("container:".length).replace(/^\//, "");
+      const matches = containers2.filter(
+        (candidate) => candidate.name.slice(1) === reference || /^[a-f0-9]+$/.test(reference) && candidate.id.startsWith(reference)
+      );
+      if (matches.length !== 1 || c.id === primaryId || matches[0].id === primaryId)
+        throw new Error(
+          "App replacement refuses unresolved or primary-dependent network, PID or IPC namespaces."
+        );
+    }
+}
 function listManagedStopContainerIds(composeProject, endpoint) {
   const stdout = runManagedStopDocker(
     [
@@ -4898,7 +4944,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs8.default.read
   const config = parseRepoConfigSource(raw, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.6.2" : "0.0.0-dev";
+    const cliVersion = true ? "0.6.4" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -7170,8 +7216,57 @@ var init_reliability_contract = __esm({
 });
 
 // src/core/reliability-operation-store.ts
+function appReplacementPath(identity2) {
+  const directory = import_node_path16.default.join(DEVROUTER_HOME, "replacement-attempts");
+  if (import_node_fs13.default.existsSync(directory)) {
+    const stat = import_node_fs13.default.lstatSync(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0)
+      throw new Error("App replacement directory must be private and not symlinked.");
+  }
+  return import_node_path16.default.join(directory, `${identityKey(identity2)}.json`);
+}
+function readAppReplacementAttempt(identity2) {
+  const value = readBoundedPrivateJson(appReplacementPath(identity2), "App replacement attempt");
+  if (value === void 0) return void 0;
+  return validateAppReplacementAttempt(value, identity2);
+}
+function validateAppReplacementAttempt(value, identity2) {
+  const attempt = value;
+  keys(attempt, [
+    "version",
+    "identity",
+    "operationId",
+    "workerId",
+    "fence",
+    "stoppedFence",
+    "oldPrimaryId",
+    "preflightSha256",
+    "stage",
+    "newPrimaryId"
+  ]);
+  exactKeys(
+    attempt.identity,
+    ["repoPath", "workspace", "provider"],
+    "Invalid replacement identity."
+  );
+  identityKey(attempt.identity);
+  for (const fence of [attempt.fence, attempt.stoppedFence]) {
+    exactKeys(
+      fence,
+      ["environmentId", "intentRevision", "runtimeGeneration", "controllerEpoch"],
+      "Invalid replacement fence."
+    );
+    if (!isReliabilityId(fence.environmentId) || ![fence.intentRevision, fence.runtimeGeneration, fence.controllerEpoch].every(
+      isReliabilityCounter
+    ))
+      throw new Error("Invalid replacement fence.");
+  }
+  if (attempt.version !== 1 || !(0, import_node_util3.isDeepStrictEqual)(attempt.identity, identity2) || !isReliabilityId(attempt.operationId) || !isReliabilityId(attempt.workerId) || !/^[a-f0-9]{64}$/.test(attempt.oldPrimaryId) || !/^[a-f0-9]{64}$/.test(attempt.preflightSha256) || !["claimed", "dispatched", "replaced", "ready"].includes(attempt.stage) || attempt.fence.environmentId !== attempt.stoppedFence.environmentId || attempt.fence.runtimeGeneration !== attempt.stoppedFence.runtimeGeneration || attempt.fence.controllerEpoch !== attempt.stoppedFence.controllerEpoch || attempt.fence.intentRevision !== attempt.stoppedFence.intentRevision + 1 || attempt.newPrimaryId !== void 0 && (!/^[a-f0-9]{64}$/.test(attempt.newPrimaryId) || attempt.newPrimaryId === attempt.oldPrimaryId) || ["claimed", "dispatched"].includes(attempt.stage) && attempt.newPrimaryId !== void 0 || ["replaced", "ready"].includes(attempt.stage) && !attempt.newPrimaryId)
+    throw new Error("Invalid app replacement attempt.");
+  return attempt;
+}
 function installedCliVersion() {
-  return true ? "0.6.2" : "0.0.0-dev";
+  return true ? "0.6.4" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -7372,8 +7467,10 @@ function validate2(record6, identity2) {
     }
   }
   if (record6.writtenByVersion !== void 0 && compareCliVersions(record6.writtenByVersion, installedCliVersion()) > 0) {
-    throw new Error(
-      `Reliability record was last written by devrouter ${record6.writtenByVersion}, which is newer than the installed ${installedCliVersion()}; upgrade devrouter (devrouter upgrade) before running lifecycle commands.`
+    throw new ReliabilityJournalError(
+      "journal-writer-newer",
+      journalEntryLocation(import_node_path16.default.basename(reliabilityOperationPath(identity2))),
+      "Reliability record was written by a newer devrouter CLI; use a matching or newer CLI before retrying lifecycle commands. Preserve the journal."
     );
   }
   keys(record6.identity, ["repoPath", "workspace", "provider"]);
@@ -11722,6 +11819,11 @@ async function prepareDevsyAgent(options = {}) {
     return { ...preparedFromInspection(published), changed: true, transport };
   });
 }
+function requireReadyDevsyAgent(options = {}) {
+  const inspection = inspectDevsyAgent(options);
+  if (!isReadyInspection(inspection)) throw new DevsyAgentReadinessError(inspection);
+  return preparedFromInspection(inspection);
+}
 var import_node_child_process13, import_node_crypto13, import_node_fs21, import_node_path28, PINNED_DEVSY_AGENT_VERSION, SUPPORTED_DEVSY_MIN_VERSION, SUPPORTED_DEVSY_MAX_VERSION, SUPPORTED_DEVSY_RANGE, DEVSY_AGENT_SETUP_COMMAND, DEVSY_RELEASE_TAG_PREFIX, DEVSY_RELEASE_METADATA_BASE_URL, DEVSY_AGENT_ASSETS, DevsyAgentReadinessError, DEVSY_AGENT_CACHE_LOCK, DEVSY_AGENT_LOCK_WAIT_MS, DEVSY_AGENT_MANIFEST_FILE, DEVSY_AGENT_ASSET_NAMES, GITHUB_CLI_STDERR_TAIL_BYTES;
 var init_devsy_agent = __esm({
   "src/core/devsy-agent.ts"() {
@@ -11818,6 +11920,412 @@ var init_managed_compose_population = __esm({
   }
 });
 
+// src/core/managed-host-ports.ts
+function unavailableEntry(declaration, reason2) {
+  return { ...declaration, status: "unavailable", reason: reason2 };
+}
+function livePublishedBindings(containerId, target) {
+  const result = (0, import_node_child_process14.spawnSync)("docker", ["port", containerId, `${target}/tcp`], {
+    encoding: "utf-8",
+    timeout: PORT_LOOKUP_TIMEOUT_MS,
+    maxBuffer: PORT_LOOKUP_MAX_BUFFER,
+    ...networkDockerOptions()
+  });
+  if (result.error || result.status === null) return void 0;
+  if (result.status !== 0) return "";
+  return typeof result.stdout === "string" ? result.stdout : void 0;
+}
+function parseLoopbackBinding(output2) {
+  const lines = output2.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  if (lines.length === 0) return { reason: "not-published" };
+  if (lines.length > 1) return { reason: "ambiguous" };
+  const match = LOOPBACK_BINDING.exec(lines[0]);
+  if (!match) return { reason: "not-published" };
+  const port = Number(match[1]);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return { reason: "not-published" };
+  return { endpoint: { host: "127.0.0.1", port } };
+}
+function revalidateLiveOwner(containerId, input2, composeProject, composeFiles2, service) {
+  try {
+    const current = inspectWorkspaceContainers({ ids: [containerId] });
+    if (current.length !== 1 || current[0].id !== containerId) return "unavailable";
+    if (!hasExactComposeIdentity(current[0], {
+      repoPath: input2.repoPath,
+      service,
+      composeProject,
+      composeFiles: composeFiles2
+    })) {
+      return "unavailable";
+    }
+    return current[0].state.Running ? "available" : "not-running";
+  } catch {
+    return "unavailable";
+  }
+}
+function resolveManagedHostPorts(input2) {
+  const report = {};
+  const selectedServices = new Set(input2.selectedServices);
+  const selectedKeys = [];
+  for (const [key, declaration] of Object.entries(input2.declarations)) {
+    if (!selectedServices.has(declaration.service)) {
+      report[key] = { ...declaration, status: "inactive" };
+      continue;
+    }
+    selectedKeys.push(key);
+    report[key] = { ...declaration, status: "unavailable", reason: "unavailable" };
+  }
+  if (selectedKeys.length === 0) return report;
+  const composeProject = input2.composeProject;
+  const composeFiles2 = input2.composeFiles;
+  if (typeof composeProject !== "string" || composeProject.length === 0 || composeFiles2 === void 0 || composeFiles2.length === 0 || composeFiles2.some((file) => file.length === 0)) {
+    return report;
+  }
+  if (selectedKeys.some((key) => {
+    const target = input2.declarations[key].target;
+    return !Number.isInteger(target) || target < 1 || target > 65535;
+  })) {
+    return report;
+  }
+  const liveContainers = input2.containers === void 0;
+  let containers2 = input2.containers;
+  if (containers2 === void 0) {
+    try {
+      containers2 = inspectWorkspaceContainers({ composeProject });
+    } catch {
+      return report;
+    }
+  }
+  const publishedBindings = input2.publishedBindings ?? livePublishedBindings;
+  for (const key of selectedKeys) {
+    const declaration = input2.declarations[key];
+    let owners;
+    try {
+      owners = containers2.filter(
+        (container) => hasExactComposeIdentity(container, {
+          repoPath: input2.repoPath,
+          service: declaration.service,
+          composeProject,
+          composeFiles: composeFiles2
+        })
+      );
+    } catch {
+      report[key] = unavailableEntry(declaration, "unavailable");
+      continue;
+    }
+    if (owners.length === 0) {
+      report[key] = unavailableEntry(declaration, "not-found");
+      continue;
+    }
+    if (owners.length > 1) {
+      report[key] = unavailableEntry(declaration, "ambiguous");
+      continue;
+    }
+    const owner = owners[0];
+    if (!owner.state.Running) {
+      report[key] = unavailableEntry(declaration, "not-running");
+      continue;
+    }
+    let output2;
+    try {
+      output2 = publishedBindings(owner.id, declaration.target);
+    } catch {
+      output2 = void 0;
+    }
+    if (typeof output2 !== "string") {
+      report[key] = unavailableEntry(declaration, "unavailable");
+      continue;
+    }
+    const binding = parseLoopbackBinding(output2);
+    if (!binding.endpoint) {
+      report[key] = unavailableEntry(declaration, binding.reason ?? "unavailable");
+      continue;
+    }
+    if (liveContainers) {
+      const proof = revalidateLiveOwner(
+        owner.id,
+        input2,
+        composeProject,
+        composeFiles2,
+        declaration.service
+      );
+      if (proof !== "available") {
+        report[key] = unavailableEntry(declaration, proof);
+        continue;
+      }
+    }
+    report[key] = {
+      ...declaration,
+      status: "available",
+      endpoint: binding.endpoint
+    };
+  }
+  return report;
+}
+function managedHostPortDeclarationsIdentity(declarations) {
+  const keys2 = Object.keys(declarations).sort();
+  if (keys2.length === 0) return void 0;
+  const canonical = keys2.map((key) => [key, declarations[key].service, declarations[key].target]);
+  return (0, import_node_crypto14.createHash)("sha256").update(JSON.stringify(canonical)).digest("hex");
+}
+function assertManagedHostPortsAvailable(report) {
+  const unavailable = Object.entries(report).filter(([, entry]) => entry.status === "unavailable").map(([key]) => key).sort();
+  if (unavailable.length > 0) {
+    throw new Error(`Selected managed host ports are unavailable: ${unavailable.join(", ")}.`);
+  }
+}
+var import_node_child_process14, import_node_crypto14, PORT_LOOKUP_TIMEOUT_MS, PORT_LOOKUP_MAX_BUFFER, LOOPBACK_BINDING;
+var init_managed_host_ports = __esm({
+  "src/core/managed-host-ports.ts"() {
+    "use strict";
+    import_node_child_process14 = require("child_process");
+    import_node_crypto14 = require("crypto");
+    init_devpod_environment();
+    init_network_effect_scope();
+    PORT_LOOKUP_TIMEOUT_MS = 1e4;
+    PORT_LOOKUP_MAX_BUFFER = 64 * 1024;
+    LOOPBACK_BINDING = /^127\.0\.0\.1:(\d+)$/;
+  }
+});
+
+// src/core/managed-post-start.ts
+function readRegularFileBytes(filePath) {
+  if (!import_node_fs23.default.existsSync(filePath) || !import_node_fs23.default.lstatSync(filePath).isFile()) return void 0;
+  return import_node_fs23.default.readFileSync(filePath);
+}
+function readRegularFile(filePath) {
+  return readRegularFileBytes(filePath)?.toString("utf-8");
+}
+function adapterFingerprint(adapter) {
+  return (0, import_node_crypto15.createHash)("sha256").update(adapter).digest("hex");
+}
+function resolveManagedPostStartPlan(repoPath) {
+  const adapterPath = import_node_path30.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterBytes = readRegularFileBytes(adapterPath);
+  const adapterText = adapterBytes?.toString("utf-8");
+  const dockerfilePath = import_node_path30.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path30.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfile = readRegularFile(dockerfilePath) ?? "";
+  const devcontainer = readRegularFile(devcontainerPath) ?? "";
+  const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
+    (value) => value.includes("DEVROUTER_PROCESS_HELPER") || value.includes("devrouter-process")
+  );
+  if (adapterBytes === void 0) {
+    if (devrouterPattern) {
+      throw new Error(
+        "Devrouter lifecycle wiring is incomplete: add the managed post-start adapter or remove the stale devrouter-process references."
+      );
+    }
+    return { kind: "unmanaged" };
+  }
+  const adapter = adapterBytes.toString("utf-8");
+  if (!adapter.includes(MANAGED_MARKER)) {
+    if (devrouterPattern) {
+      throw new Error(
+        "Devrouter-looking post-start adapter is missing the 'devrouter:managed devcontainer' marker. Regenerate or migrate the devcontainer, then retry devrouter ensure."
+      );
+    }
+    return { kind: "unmanaged" };
+  }
+  assertManagedDevcontainerLifecycle(repoPath);
+  if (adapter.includes("DEVROUTER_PROCESS_HELPER")) {
+    return {
+      kind: "runtime",
+      adapterPath: MANAGED_ADAPTER_PATH,
+      adapterSha256: adapterFingerprint(adapterBytes),
+      adapterContents: adapterBytes
+    };
+  }
+  if (dockerfile.includes("devrouter-process") && devcontainer.includes("postStartCommand")) {
+    return { kind: "legacy" };
+  }
+  throw new Error(
+    "Managed post-start must use DEVROUTER_PROCESS_HELPER before removing the legacy image helper and postStartCommand. Regenerate or migrate the devcontainer, then retry devrouter ensure."
+  );
+}
+function assertSafeProcessName(name) {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(name)) {
+    throw new Error(`Managed process '${name}' is not a safe exact identifier.`);
+  }
+}
+function runManagedProcessAction(options) {
+  assertSafeProcessName(options.name);
+  const result = (0, import_node_child_process15.spawnSync)(
+    "docker",
+    [
+      "exec",
+      "--workdir",
+      options.container.workspacePath,
+      "--env",
+      `DEVROUTER_PROCESS_HELPER=${RUNTIME_HELPER_PATH}`,
+      options.container.id,
+      "bash",
+      "-c",
+      'exec "$DEVROUTER_PROCESS_HELPER" "$1" --name "$2"',
+      "devrouter-process",
+      options.action,
+      options.name
+    ],
+    {
+      encoding: "utf-8",
+      stdio: options.action === "status" ? ["ignore", "pipe", "pipe"] : ["ignore", 2, "inherit"],
+      ...networkDockerOptions()
+    }
+  );
+  if (options.action === "stop") {
+    if (result.status !== 0) {
+      throw new Error(`Could not stop managed process '${options.name}'.`);
+    }
+    return "stopped";
+  }
+  try {
+    const parsed = JSON.parse(result.stdout.trim());
+    if (parsed.status === "running" || parsed.status === "stopped" || parsed.status === "foreign" || parsed.status === "drifted") {
+      return parsed.status;
+    }
+  } catch {
+  }
+  return "drifted";
+}
+var import_node_child_process15, import_node_crypto15, import_node_fs23, import_node_path30, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH;
+var init_managed_post_start = __esm({
+  "src/core/managed-post-start.ts"() {
+    "use strict";
+    import_node_child_process15 = require("child_process");
+    import_node_crypto15 = require("crypto");
+    import_node_fs23 = __toESM(require("fs"));
+    import_node_path30 = __toESM(require("path"));
+    init_devcontainer_config();
+    init_managed_host_ports();
+    init_network_effect_scope();
+    MANAGED_MARKER = "devrouter:managed devcontainer";
+    MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
+    RUNTIME_HELPER_PATH = "/tmp/devrouter/bin/devrouter-process";
+  }
+});
+
+// src/core/network-provider-inspect.ts
+function object3(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Invalid provider evidence.");
+  return value;
+}
+function qualifyNetworkProviderDefinition(value, provider) {
+  const definition = object3(value);
+  const agent = object3(definition.agent);
+  const docker = object3(agent.docker);
+  const env = object3(docker.env);
+  const options = object3(definition.options);
+  const host = object3(options.DOCKER_HOST);
+  const dockerPath = object3(options.DOCKER_PATH);
+  const exec = object3(definition.exec);
+  const command = provider === "devsy" ? '"${DEVSY}" internal sh -c "${COMMAND}"' : '"${DEVPOD}" helper sh -c "${COMMAND}"';
+  const actualCommand = Array.isArray(exec.command) ? exec.command : [exec.command];
+  if (definition.name !== "docker" || ![true, "true"].includes(agent.local) || agent.driver !== void 0 && agent.driver !== "docker" && agent.driver !== "" || docker.path !== "${DOCKER_PATH}" || docker.builder !== "${DOCKER_BUILDER}" || ![false, "false"].includes(docker.install) || (provider === "devsy" ? docker.elevation !== "${DOCKER_ELEVATION}" : docker.elevation !== void 0 && docker.elevation !== "") || env.DOCKER_HOST !== "${DOCKER_HOST}" || Object.keys(env).some((key) => key !== "DOCKER_HOST") || host.global !== true || dockerPath.default !== "docker" || actualCommand.length !== 1 || typeof actualCommand[0] !== "string" || actualCommand[0].trim() !== command || Object.keys(exec).some((key) => key !== "command") || agent.path !== void 0 && agent.path !== "" || agent.downloadURL !== void 0 && agent.downloadURL !== "") {
+    throw new Error("Docker provider definition is not qualified for network allocation.");
+  }
+  return (0, import_node_crypto16.createHash)("sha256").update(JSON.stringify({ name: definition.name, agent, options, exec })).digest("hex");
+}
+function read(provider, args) {
+  const result = (0, import_node_child_process16.spawnSync)(provider, args, {
+    encoding: "utf8",
+    timeout: 5e3,
+    maxBuffer: 2 * 1024 * 1024
+  });
+  if (result.error || result.status !== 0)
+    throw new Error("Network provider evidence is unavailable.");
+  return result.stdout;
+}
+function inspectNetworkProviderBinding(input2) {
+  try {
+    const { provider, providerId, repoPath } = input2;
+    const contexts = JSON.parse(
+      read(provider, [
+        "context",
+        "list",
+        ...provider === "devsy" ? ["--result-format", "json"] : ["--output", "json"]
+      ])
+    );
+    if (!Array.isArray(contexts) || contexts.length > 128) throw new Error();
+    const selected = contexts.map(object3).filter(
+      (row) => input2.providerContext ? row.name === input2.providerContext : row.default === true
+    );
+    if (selected.length !== 1 || typeof selected[0].name !== "string") throw new Error();
+    const providerContext = selected[0].name;
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(providerContext)) throw new Error();
+    const contextArgs = ["--context", providerContext];
+    const version = read(provider, provider === "devsy" ? ["--version"] : ["version"]);
+    const parsedVersion = version.match(/\b(?:v)?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)\b/)?.[1];
+    if (provider === "devsy" ? !isSupportedDevsyVersion(parsedVersion) : parsedVersion !== "0.6.15")
+      throw new Error();
+    const definitions = object3(
+      JSON.parse(
+        read(
+          provider,
+          provider === "devsy" ? ["provider", "list", "--result-format", "json", ...contextArgs] : ["provider", "list", "--output", "json", ...contextArgs]
+        )
+      )
+    );
+    const entry = object3(definitions.docker);
+    const definitionSha256 = qualifyNetworkProviderDefinition(entry.config, provider);
+    const rows2 = JSON.parse(
+      read(
+        provider,
+        provider === "devsy" ? ["workspace", "list", "--result-format", "json", "--skip-pro", ...contextArgs] : ["list", "--output", "json", "--skip-pro", ...contextArgs]
+      )
+    );
+    if (!Array.isArray(rows2) || rows2.length > 4096) throw new Error();
+    const matching = rows2.map(object3).filter((row) => row.id === providerId || object3(row.source).localFolder === repoPath);
+    if (matching.length > 1) throw new Error();
+    const workspace = matching[0];
+    if (workspace && (workspace.id !== providerId || object3(workspace.source).localFolder !== repoPath))
+      throw new Error();
+    const workspaceProvider = workspace ? object3(workspace.provider) : void 0;
+    const state = object3(entry.state);
+    const settings = object3(state.options ?? {});
+    const stored = workspaceProvider ? object3(workspaceProvider.options ?? {}) : {};
+    const option = (key, localOnly = false) => {
+      const value = localOnly ? stored[key] : stored[key] ?? settings[key];
+      if (value === void 0) return null;
+      const text6 = object3(value).value;
+      if (typeof text6 !== "string") throw new Error();
+      return text6 || null;
+    };
+    if (workspaceProvider && workspaceProvider.name !== "docker") throw new Error();
+    if (option("DOCKER_ELEVATION") && option("DOCKER_ELEVATION") !== "none") throw new Error();
+    const endpoint = input2.endpoint ?? option("DOCKER_HOST");
+    if (!endpoint || !input2.endpoint && (process.env.DOCKER_CONTEXT || option("DOCKER_CONTEXT") || (option("DOCKER_PATH") ?? "docker") !== "docker" || !workspace && entry.default !== true))
+      throw new Error();
+    return {
+      provider,
+      providerContext,
+      providerId,
+      endpoint,
+      daemonId: inspectManagedStopDaemon(endpoint),
+      versionQualified: true,
+      definitionSha256,
+      providerName: "docker",
+      dockerPath: option("DOCKER_PATH") ?? "docker",
+      persistedEndpoint: workspace ? option("DOCKER_HOST", true) : null,
+      persistedContext: option("DOCKER_CONTEXT"),
+      registration: workspace ? "owned" : "absent"
+    };
+  } catch {
+    throw new Error(
+      "Network provider destination could not be qualified; no allocation is permitted."
+    );
+  }
+}
+var import_node_child_process16, import_node_crypto16;
+var init_network_provider_inspect = __esm({
+  "src/core/network-provider-inspect.ts"() {
+    "use strict";
+    import_node_child_process16 = require("child_process");
+    import_node_crypto16 = require("crypto");
+    init_devpod_environment();
+    init_devsy_agent();
+  }
+});
+
 // src/core/reliability-context.ts
 function claimLifecycleEffect() {
   claim?.();
@@ -11838,7 +12346,7 @@ function commandError(command, repoPath, stderr) {
   );
 }
 function resolveGitCommonDir(repoPath) {
-  const result = (0, import_node_child_process14.spawnSync)("git", ["-C", repoPath, "rev-parse", "--git-common-dir"], {
+  const result = (0, import_node_child_process17.spawnSync)("git", ["-C", repoPath, "rev-parse", "--git-common-dir"], {
     encoding: "utf-8",
     env: READ_ONLY_GIT_ENV
   });
@@ -11846,10 +12354,10 @@ function resolveGitCommonDir(repoPath) {
   if (result.status !== 0 || !output2) {
     throw commandError("Could not resolve the Git common directory", repoPath, result.stderr);
   }
-  return comparableWorkspacePath(import_node_path30.default.isAbsolute(output2) ? output2 : import_node_path30.default.resolve(repoPath, output2));
+  return comparableWorkspacePath(import_node_path31.default.isAbsolute(output2) ? output2 : import_node_path31.default.resolve(repoPath, output2));
 }
 function resolveGitTopLevel(repoPath) {
-  const result = (0, import_node_child_process14.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
+  const result = (0, import_node_child_process17.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
     encoding: "utf-8",
     env: READ_ONLY_GIT_ENV
   });
@@ -11860,7 +12368,7 @@ function resolveGitTopLevel(repoPath) {
   return comparableWorkspacePath(output2);
 }
 function listGitWorktrees(repoPath) {
-  const result = (0, import_node_child_process14.spawnSync)("git", ["-C", repoPath, "worktree", "list", "--porcelain"], {
+  const result = (0, import_node_child_process17.spawnSync)("git", ["-C", repoPath, "worktree", "list", "--porcelain"], {
     encoding: "utf-8",
     env: READ_ONLY_GIT_ENV
   });
@@ -11897,7 +12405,7 @@ function listGitWorktrees(repoPath) {
   return worktrees;
 }
 function ownershipDirectory(repoPath) {
-  return import_node_path30.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
+  return import_node_path31.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
 }
 function validateWorkspace(value, label2) {
   if (typeof value !== "string" || wsFromBranch(value) !== value) {
@@ -11925,7 +12433,7 @@ function validateRecord(value, expectedWorkspace) {
       `workspace ownership file '${expectedWorkspace}' contains identity '${workspace}'`
     );
   }
-  if (typeof candidate.worktreePath !== "string" || !import_node_path30.default.isAbsolute(candidate.worktreePath)) {
+  if (typeof candidate.worktreePath !== "string" || !import_node_path31.default.isAbsolute(candidate.worktreePath)) {
     throw new Error("invalid workspace ownership worktreePath");
   }
   if (candidate.branch !== null && typeof candidate.branch !== "string") {
@@ -11943,7 +12451,7 @@ function validateRecord(value, expectedWorkspace) {
   };
 }
 function recordPath(repoPath, workspace) {
-  return import_node_path30.default.join(
+  return import_node_path31.default.join(
     ownershipDirectory(repoPath),
     `${validateWorkspace(workspace, "workspace")}.json`
   );
@@ -11951,7 +12459,7 @@ function recordPath(repoPath, workspace) {
 function readRecordFile(filePath, expectedWorkspace) {
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs23.default.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(import_node_fs24.default.readFileSync(filePath, "utf-8"));
   } catch (error) {
     if (error instanceof SyntaxError) {
       throw new Error(`invalid workspace ownership JSON at '${filePath}'`);
@@ -11976,7 +12484,7 @@ function listWorkspaceOwnership(repoPath) {
 function listWorkspaceOwnershipInDirectory(directory) {
   let entries;
   try {
-    entries = import_node_fs23.default.readdirSync(directory, { withFileTypes: true });
+    entries = import_node_fs24.default.readdirSync(directory, { withFileTypes: true });
   } catch (error) {
     if (error.code === "ENOENT") return [];
     throw error;
@@ -11984,14 +12492,14 @@ function listWorkspaceOwnershipInDirectory(directory) {
   return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
     const workspace = entry.name.slice(0, -".json".length);
     validateWorkspace(workspace, "filename");
-    return readRecordFile(import_node_path30.default.join(directory, entry.name), workspace);
+    return readRecordFile(import_node_path31.default.join(directory, entry.name), workspace);
   });
 }
 function writeWorkspaceOwnershipInDirectory(directory, input2) {
   const workspace = validateWorkspace(input2.workspace, "workspace");
   const devpodId = validateWorkspace(input2.devpodId, "devpodId");
   const worktreePath = comparableWorkspacePath(input2.worktreePath);
-  const filePath = import_node_path30.default.join(directory, `${workspace}.json`);
+  const filePath = import_node_path31.default.join(directory, `${workspace}.json`);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const records = listWorkspaceOwnershipInDirectory(directory);
   const existing = records.find((record7) => record7.workspace === workspace);
@@ -12027,9 +12535,9 @@ function writeWorkspaceOwnershipInDirectory(directory, input2) {
   return record6;
 }
 function removeWorkspaceOwnershipInDirectory(directory, workspace) {
-  const filePath = import_node_path30.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
+  const filePath = import_node_path31.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
   try {
-    import_node_fs23.default.rmSync(filePath);
+    import_node_fs24.default.rmSync(filePath);
     return true;
   } catch (error) {
     if (error.code === "ENOENT") return false;
@@ -12040,7 +12548,7 @@ function sameOwnershipRecord(left, right) {
   return left.version === right.version && left.workspace === right.workspace && sameWorkspacePath(left.worktreePath, right.worktreePath) && left.branch === right.branch && left.devpodId === right.devpodId && left.createdAt === right.createdAt && left.updatedAt === right.updatedAt;
 }
 function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
-  const filePath = import_node_path30.default.join(
+  const filePath = import_node_path31.default.join(
     directory,
     `${validateWorkspace(expected.workspace, "workspace")}.json`
   );
@@ -12052,14 +12560,14 @@ function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
     throw error;
   }
   if (!sameOwnershipRecord(current, expected)) return "changed";
-  import_node_fs23.default.rmSync(filePath);
+  import_node_fs24.default.rmSync(filePath);
   return "removed";
 }
 function withWorkspaceOwnershipTransaction(repoPath, operation, options = {}) {
   const directory = ownershipDirectory(repoPath);
-  import_node_fs23.default.mkdirSync(directory, { recursive: true });
+  import_node_fs24.default.mkdirSync(directory, { recursive: true });
   return withFileLockSync(
-    import_node_path30.default.join(directory, ".lock"),
+    import_node_path31.default.join(directory, ".lock"),
     {
       activity: "workspace ownership transaction",
       target: `'${repoPath}'`,
@@ -12092,7 +12600,7 @@ function persistedWorkspaceOwners(repoPath, worktreePath) {
     try {
       workspace = readPersistedWorkspace(worktree.path);
     } catch (error) {
-      if (!import_node_fs23.default.existsSync(worktree.path)) continue;
+      if (!import_node_fs24.default.existsSync(worktree.path)) continue;
       throw error;
     }
     if (!workspace) continue;
@@ -12255,7 +12763,7 @@ function inspectWorkspaceOwnership(record6, worktrees, devpods) {
   if (worktree?.locked) {
     return { ownerStatus: "locked", devpodStatus, worktree };
   }
-  if ((!worktree || worktree.prunable) && import_node_fs23.default.existsSync(record6.worktreePath)) {
+  if ((!worktree || worktree.prunable) && import_node_fs24.default.existsSync(record6.worktreePath)) {
     return { ownerStatus: "conflict", devpodStatus, worktree };
   }
   if (!worktree || worktree.prunable) {
@@ -12279,20 +12787,20 @@ function listMissingWorkspaceOwnership(repoPath) {
     (record6) => inspectWorkspaceOwnership(record6, worktrees, void 0).ownerStatus === "missing"
   );
 }
-var import_node_child_process14, import_node_fs23, import_node_path30, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
+var import_node_child_process17, import_node_fs24, import_node_path31, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
 var init_workspace_ownership = __esm({
   "src/core/workspace-ownership.ts"() {
     "use strict";
-    import_node_child_process14 = require("child_process");
-    import_node_fs23 = __toESM(require("fs"));
-    import_node_path30 = __toESM(require("path"));
+    import_node_child_process17 = require("child_process");
+    import_node_fs24 = __toESM(require("fs"));
+    import_node_path31 = __toESM(require("path"));
     init_atomic_file();
     init_devpod_workspaces();
     init_file_lock();
     init_workspace();
     READ_ONLY_GIT_ENV = { ...process.env, GIT_OPTIONAL_LOCKS: "0" };
     OWNERSHIP_VERSION = 1;
-    OWNERSHIP_DIR = import_node_path30.default.join("devrouter", "workspaces");
+    OWNERSHIP_DIR = import_node_path31.default.join("devrouter", "workspaces");
   }
 });
 
@@ -12395,6 +12903,148 @@ function proveRetainedManagedStop(state) {
   }
   return result;
 }
+function replacementSourceDigest(state, plan) {
+  const git2 = (args) => {
+    const result = (0, import_node_child_process18.spawnSync)("git", ["-C", state.repoPath, ...args], {
+      encoding: "utf8",
+      timeout: 5e3,
+      maxBuffer: 1024 * 1024
+    });
+    if (result.status !== 0 || result.error)
+      throw new Error("Replacement cannot freeze the source checkout.");
+    return result.stdout;
+  };
+  if (git2(["status", "--porcelain", "--untracked-files=no"]).trim() || git2([
+    "ls-files",
+    "--others",
+    "--exclude-standard",
+    "--",
+    ".devcontainer",
+    ".devrouter.yml"
+  ]).trim())
+    throw new Error("Replacement requires committed, unchanged managed source and hooks.");
+  const adapter = resolveManagedPostStartPlan(state.repoPath);
+  if (adapter.kind !== "runtime")
+    throw new Error("Replacement requires a preserving managed adapter.");
+  const files = [
+    import_node_path32.default.join(state.repoPath, ".devrouter.yml"),
+    plan.sourcePath,
+    ...plan.composeFiles
+  ];
+  return (0, import_node_crypto17.createHash)("sha256").update(
+    JSON.stringify([
+      git2(["rev-parse", "HEAD"]).trim(),
+      adapter.adapterSha256,
+      ...files.map((file) => [
+        file,
+        (0, import_node_crypto17.createHash)("sha256").update(import_node_fs25.default.readFileSync(file)).digest("hex")
+      ])
+    ])
+  ).digest("hex");
+}
+function captureManagedAppReplacementProof(state) {
+  if (state.status !== "ready" || requireReadyDevsyAgent().version !== "1.24.0")
+    throw new Error("App replacement requires a successful retained generation and Devsy 1.24.0.");
+  const baseline = validateManagedStopBaseline(state.stopBaseline, state);
+  if (baseline.sourceContainer)
+    throw new Error("Replacement refuses a container-sourced provider.");
+  const runtime = loadRuntimeConfig(state.repoPath, state.workspace ?? "", state.profile);
+  if (!runtime.config.managedRuntime || runtime.config.managedRuntime.network)
+    throw new Error("Replacement requires manual managed Compose without network allocation.");
+  const plan = inspectManagedDevcontainerConfig({
+    repoPath: state.repoPath,
+    config: runtime.config,
+    profile: runtime.resolvedProfile,
+    linked: isLinkedWorktree(state.repoPath)
+  });
+  if (state.sourceConfigSha256 !== plan.sourceConfigSha256 || state.effectiveConfigSha256 !== plan.effectiveConfigSha256 || inspectManagedDevcontainerGeneratedConfig(plan).status !== "valid")
+    throw new Error("Replacement refuses changed or unavailable managed configuration.");
+  const containers2 = proveRetainedManagedStop(state);
+  if (!baseline.containers.some((c) => c.service !== baseline.primaryService))
+    throw new Error(
+      "App replacement requires a retained dependency to preserve released-client recovery proof."
+    );
+  if (containers2.some((c) => c.state.Running || !["created", "exited"].includes(c.state.Status)))
+    throw new Error("App replacement requires every retained container stopped.");
+  const workspace = state.workspace ? { token: state.workspace, gitCommonDir: resolveGitCommonDir(state.repoPath) } : void 0;
+  assertManagedContainerConfigUnchanged({ plan, containers: containers2, workspace });
+  const source = replacementSourceDigest(state, plan);
+  const evidence = inspectNetworkProviderBinding({
+    provider: "devsy",
+    providerId: state.devpodId,
+    repoPath: state.repoPath,
+    endpoint: baseline.endpoint,
+    providerContext: baseline.context
+  });
+  if (!evidence.versionQualified || evidence.registration !== "owned" || evidence.providerName !== "docker" || evidence.dockerPath !== "docker" || evidence.persistedContext !== null || evidence.persistedEndpoint !== null && evidence.persistedEndpoint !== baseline.endpoint || evidence.daemonId !== baseline.daemonId)
+    throw new Error("Replacement provider destination is unqualified or changed.");
+  const inventory = inspectAppReplacementInventory(baseline.endpoint);
+  const primaryId = baseline.containers.find((c) => c.service === baseline.primaryService)?.id;
+  if (!primaryId) throw new Error("Replacement has no exact retained primary.");
+  assertNoAppNamespaceConsumers(inventory, primaryId);
+  const primary = inventory.find((c) => c.id === primaryId);
+  const env = managedComposeEnvironment(workspace);
+  delete env.DOCKER_CONTEXT;
+  delete env.DOCKER_HOST;
+  const result = (0, import_node_child_process18.spawnSync)(
+    "docker",
+    [
+      "--host",
+      baseline.endpoint,
+      "compose",
+      "--project-name",
+      baseline.project,
+      "--project-directory",
+      plan.composeDirectory,
+      ...baseline.composeFiles.flatMap((f) => ["-f", f]),
+      "config",
+      "--format",
+      "json",
+      "--no-env-resolution"
+    ],
+    {
+      cwd: plan.composeDirectory,
+      env,
+      encoding: "utf8",
+      timeout: 15e3,
+      maxBuffer: 4 * 1024 * 1024
+    }
+  );
+  if (result.status !== 0 || result.error)
+    throw new Error("Replacement Compose evidence is unavailable.");
+  const model = JSON.parse(result.stdout);
+  const service = model?.services?.[plan.primaryService];
+  if (!service || !Array.isArray(service.volumes))
+    throw new Error("Replacement requires declared persistent mounts.");
+  for (const mount of primary.mounts) {
+    if (!["bind", "volume"].includes(mount.Type))
+      throw new Error("Replacement refuses unattributed primary mounts.");
+    if (mount.Type === "volume" && !service.volumes.some(
+      (v) => v.type === "volume" && v.source && v.target === mount.Destination && model.volumes?.[v.source]?.name === mount.Name
+    ))
+      throw new Error("Replacement refuses anonymous or undeclared primary volumes.");
+  }
+  const binding = {
+    provider: "devsy",
+    providerId: state.devpodId,
+    endpoint: baseline.endpoint,
+    daemonId: baseline.daemonId,
+    definitionSha256: evidence.definitionSha256,
+    providerContext: baseline.context
+  };
+  const digest5 = (0, import_node_crypto17.createHash)("sha256").update(
+    JSON.stringify({
+      state,
+      plan,
+      source,
+      binding,
+      primary,
+      population: containers2,
+      modelSha256: (0, import_node_crypto17.createHash)("sha256").update(result.stdout).digest("hex")
+    })
+  ).digest("hex");
+  return { state, plan, primary, binding, sourceSha256: source, digest: digest5 };
+}
 function absentRegistrationIdentity(state) {
   resetWorkspaceRuntimeCaches();
   if (resolveWorkspaceRuntimeOrDefault(state.repoPath) !== "devsy")
@@ -12592,22 +13242,29 @@ function managedStopRouteReferences(state) {
     (name) => ["http", "tcp"].map((protocol) => ({ repoPath: state.repoPath, name, protocol }))
   );
 }
-var import_node_os4, import_node_path31, import_node_util9;
+var import_node_child_process18, import_node_crypto17, import_node_fs25, import_node_os4, import_node_path32, import_node_util9;
 var init_managed_stop_recovery = __esm({
   "src/core/managed-stop-recovery.ts"() {
     "use strict";
+    import_node_child_process18 = require("child_process");
+    import_node_crypto17 = require("crypto");
+    import_node_fs25 = __toESM(require("fs"));
     import_node_os4 = __toESM(require("os"));
-    import_node_path31 = __toESM(require("path"));
+    import_node_path32 = __toESM(require("path"));
     import_node_util9 = require("util");
     init_devcontainer_profile();
     init_devpod_environment();
     init_devpod_registry();
+    init_devsy_agent();
     init_devsy_exec_proof();
     init_devsy_workspaces();
     init_managed_compose_population();
+    init_managed_post_start();
     init_managed_runtime_state();
     init_managed_stop_baseline();
+    init_network_provider_inspect();
     init_reliability_context();
+    init_repo_config();
     init_workspace();
     init_workspace_ownership();
     init_workspace_runtime();
@@ -12625,7 +13282,7 @@ async function getDockerodeConstructor() {
   return dockerodeConstructorPromise;
 }
 function runDockerContextCommand(args) {
-  const result = (0, import_node_child_process15.spawnSync)("docker", ["context", ...args], {
+  const result = (0, import_node_child_process19.spawnSync)("docker", ["context", ...args], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -12638,7 +13295,7 @@ function getCurrentDockerContext() {
   return runDockerContextCommand(["show"]);
 }
 function getDockerHostFromContext(context) {
-  const result = (0, import_node_child_process15.spawnSync)(
+  const result = (0, import_node_child_process19.spawnSync)(
     "docker",
     ["context", "inspect", context, "--format", "{{ .Endpoints.docker.Host }}"],
     { encoding: "utf-8" }
@@ -12705,11 +13362,11 @@ async function networkExists(name) {
     return false;
   }
 }
-var import_node_child_process15, dockerodeConstructorPromise;
+var import_node_child_process19, dockerodeConstructorPromise;
 var init_docker = __esm({
   "src/core/docker.ts"() {
     "use strict";
-    import_node_child_process15 = require("child_process");
+    import_node_child_process19 = require("child_process");
     init_network_effect_scope();
     dockerodeConstructorPromise = null;
   }
@@ -12717,7 +13374,7 @@ var init_docker = __esm({
 
 // src/core/tls.ts
 function runOrThrow(command, args) {
-  const result = (0, import_node_child_process16.spawnSync)(command, args, {
+  const result = (0, import_node_child_process20.spawnSync)(command, args, {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -12727,7 +13384,7 @@ function runOrThrow(command, args) {
   return result.stdout.trim();
 }
 function commandExists(command) {
-  const result = (0, import_node_child_process16.spawnSync)("sh", ["-c", `command -v ${command}`], { encoding: "utf-8" });
+  const result = (0, import_node_child_process20.spawnSync)("sh", ["-c", `command -v ${command}`], { encoding: "utf-8" });
   return result.status === 0;
 }
 function ensureMkcert() {
@@ -12745,8 +13402,8 @@ function tlsSetupCommand(repoPath) {
 }
 function getMkcertRootCAPath(options = {}) {
   ensureMkcert();
-  const rootCAPath = import_node_path32.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
-  if (!import_node_fs24.default.existsSync(rootCAPath)) {
+  const rootCAPath = import_node_path33.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
+  if (!import_node_fs26.default.existsSync(rootCAPath)) {
     throw new Error(
       `mkcert root CA was not found at '${rootCAPath}'. Run: ${tlsSetupCommand(options.repoPath)}`
     );
@@ -12779,7 +13436,7 @@ function parseDnsHostsFromSubjectAltName(subjectAltName) {
   return normalizeUniqueHosts(names);
 }
 function parseCertificateDnsHosts(pem) {
-  const certificate = new import_node_crypto14.X509Certificate(pem);
+  const certificate = new import_node_crypto18.X509Certificate(pem);
   const subjectAltName = certificate.subjectAltName ?? "";
   if (subjectAltName.length === 0) {
     return [];
@@ -12847,11 +13504,11 @@ function compactTLSCertificateHosts(hosts) {
   );
 }
 function readCurrentCertificateHosts(options = {}) {
-  if (!import_node_fs24.default.existsSync(CERT_FILE)) {
+  if (!import_node_fs26.default.existsSync(CERT_FILE)) {
     return [];
   }
   try {
-    const pem = import_node_fs24.default.readFileSync(CERT_FILE, "utf-8");
+    const pem = import_node_fs26.default.readFileSync(CERT_FILE, "utf-8");
     return parseCertificateDnsHosts(pem);
   } catch (error) {
     if (options.replaceMalformed) {
@@ -12979,20 +13636,20 @@ Run: ${tlsSetupCommand(options.repoPath)}`
     );
   }
 }
-var import_node_child_process16, import_node_crypto14, import_node_fs24, import_node_path32, DEFAULT_TLS_CERT_HOSTS, TLS_CERTIFICATE_LOCK_FILE, TLS_CERTIFICATE_LOCK_WAIT_MS, TLS_CERTIFICATE_WRITE_ATTEMPTS;
+var import_node_child_process20, import_node_crypto18, import_node_fs26, import_node_path33, DEFAULT_TLS_CERT_HOSTS, TLS_CERTIFICATE_LOCK_FILE, TLS_CERTIFICATE_LOCK_WAIT_MS, TLS_CERTIFICATE_WRITE_ATTEMPTS;
 var init_tls = __esm({
   "src/core/tls.ts"() {
     "use strict";
-    import_node_child_process16 = require("child_process");
-    import_node_crypto14 = require("crypto");
-    import_node_fs24 = __toESM(require("fs"));
-    import_node_path32 = __toESM(require("path"));
+    import_node_child_process20 = require("child_process");
+    import_node_crypto18 = require("crypto");
+    import_node_fs26 = __toESM(require("fs"));
+    import_node_path33 = __toESM(require("path"));
     init_docker();
     init_file_lock();
     init_host_routes();
     init_router();
     DEFAULT_TLS_CERT_HOSTS = ["localhost", "*.localhost"];
-    TLS_CERTIFICATE_LOCK_FILE = import_node_path32.default.join(DEVROUTER_HOME, "tls-certificate.lock");
+    TLS_CERTIFICATE_LOCK_FILE = import_node_path33.default.join(DEVROUTER_HOME, "tls-certificate.lock");
     TLS_CERTIFICATE_LOCK_WAIT_MS = 6e4;
     TLS_CERTIFICATE_WRITE_ATTEMPTS = 2;
   }
@@ -13078,7 +13735,7 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function inspectRouterApi(protocol) {
-  const result = (0, import_node_child_process17.spawnSync)(
+  const result = (0, import_node_child_process21.spawnSync)(
     "curl",
     [
       "--silent",
@@ -13185,7 +13842,7 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
     throw new Error(
       "Traefik routes did not reload; shared router restart is disabled for this operation."
     );
-  import_node_fs25.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs27.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     ROUTER_RELOAD_LOCK_FILE,
     {
@@ -13220,19 +13877,19 @@ function assertTraefikRoutesRemoved(routes) {
   const result = inspectExpectedRoutes(routes, "removed");
   if (!result.ok) throw new Error(`Workspace route cessation is not proven: ${result.details}`);
 }
-var import_node_child_process17, import_node_fs25, import_node_path33, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, ROUTER_API_REQUEST_TIMEOUT_SECONDS, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, ROUTER_API_PAGE_SIZE;
+var import_node_child_process21, import_node_fs27, import_node_path34, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, ROUTER_API_REQUEST_TIMEOUT_SECONDS, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, ROUTER_API_PAGE_SIZE;
 var init_traefik_route_health = __esm({
   "src/core/traefik-route-health.ts"() {
     "use strict";
-    import_node_child_process17 = require("child_process");
-    import_node_fs25 = __toESM(require("fs"));
-    import_node_path33 = __toESM(require("path"));
+    import_node_child_process21 = require("child_process");
+    import_node_fs27 = __toESM(require("fs"));
+    import_node_path34 = __toESM(require("path"));
     init_file_lock();
     init_host_routes();
     init_reliability_context();
     init_router();
     ROUTER_API_BASE = "http://127.0.0.1:8080/api";
-    ROUTER_RELOAD_LOCK_FILE = import_node_path33.default.join(DEVROUTER_HOME, "router-reload.lock");
+    ROUTER_RELOAD_LOCK_FILE = import_node_path34.default.join(DEVROUTER_HOME, "router-reload.lock");
     ROUTER_API_REQUEST_TIMEOUT_SECONDS = "2";
     DEFAULT_INITIAL_TIMEOUT_MS = 3e3;
     DEFAULT_RECOVERY_TIMEOUT_MS = 1e4;
@@ -13257,7 +13914,7 @@ function proveInitialManagedDevsyAbsence(repoPath, expectedId) {
   if (!isLinkedWorktree(repoPath)) return void 0;
   const workspace = resolveWorktreeWorkspace(repoPath);
   if (!workspace || readManagedRuntimeState(repoPath, workspace)) return void 0;
-  if (!import_node_fs26.default.existsSync(import_node_path34.default.join(repoPath, ".devrouter.yml"))) return void 0;
+  if (!import_node_fs28.default.existsSync(import_node_path35.default.join(repoPath, ".devrouter.yml"))) return void 0;
   const runtime = loadRuntimeConfig(repoPath, workspace);
   if (!runtime.config.managedRuntime) return void 0;
   const routes = proxyAppsFromConfig(runtime.config).flatMap(
@@ -13317,7 +13974,7 @@ function proveInitialManagedDevsyAbsence(repoPath, expectedId) {
   };
 }
 function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
-  if (!import_node_fs26.default.existsSync(import_node_path34.default.join(repoPath, ".devrouter.yml"))) return false;
+  if (!import_node_fs28.default.existsSync(import_node_path35.default.join(repoPath, ".devrouter.yml"))) return false;
   if (!loadRepoConfig(repoPath).managedRuntime) return false;
   const linked = isLinkedWorktree(repoPath);
   const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
@@ -13374,8 +14031,8 @@ function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
     profile: runtime.resolvedProfile,
     linked
   });
-  const providerRoot = import_node_path34.default.resolve(process.env.DEVSY_HOME || import_node_path34.default.join(import_node_os5.default.homedir(), ".devsy"));
-  const featureDirectory = import_node_path34.default.join(
+  const providerRoot = import_node_path35.default.resolve(process.env.DEVSY_HOME || import_node_path35.default.join(import_node_os5.default.homedir(), ".devsy"));
+  const featureDirectory = import_node_path35.default.join(
     providerRoot,
     "contexts",
     owner.context,
@@ -13497,7 +14154,7 @@ function restoreRecordedManagedDevcontainerConfig(repoPath) {
 }
 function recordedManagedDevcontainerRestorePlan(repoPath) {
   try {
-    if (!import_node_fs26.default.existsSync(import_node_path34.default.join(repoPath, ".devrouter.yml"))) return void 0;
+    if (!import_node_fs28.default.existsSync(import_node_path35.default.join(repoPath, ".devrouter.yml"))) return void 0;
     const linked = isLinkedWorktree(repoPath);
     const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
     const state = readManagedRuntimeState(repoPath, workspace);
@@ -13588,7 +14245,7 @@ function stopRetainedManagedDevsyWorkspace(options) {
       const owned = inspectWorkspaceContainers().filter(
         (container) => sameWorkspacePath(
           container.labels["com.docker.compose.project.working_dir"] ?? "",
-          import_node_path34.default.join(repoPath, ".devcontainer")
+          import_node_path35.default.join(repoPath, ".devcontainer")
         )
       );
       if (owned.length !== 0) {
@@ -13617,8 +14274,8 @@ function stopRetainedManagedDevsyWorkspace(options) {
   if (!context || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(context) || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(devsyId)) {
     throw new Error("Managed stop requires a valid exact Devsy context and workspace ID.");
   }
-  const devsyRoot = import_node_path34.default.resolve(process.env.DEVSY_HOME || import_node_path34.default.join(import_node_os5.default.homedir(), ".devsy"));
-  const featureDirectory = import_node_path34.default.join(
+  const devsyRoot = import_node_path35.default.resolve(process.env.DEVSY_HOME || import_node_path35.default.join(import_node_os5.default.homedir(), ".devsy"));
+  const featureDirectory = import_node_path35.default.join(
     devsyRoot,
     "contexts",
     context,
@@ -13722,13 +14379,13 @@ function stopRetainedManagedDevsyWorkspace(options) {
   if (providerFailed) throw providerError;
   return true;
 }
-var import_node_fs26, import_node_os5, import_node_path34, import_node_util10;
+var import_node_fs28, import_node_os5, import_node_path35, import_node_util10;
 var init_managed_devsy_stop = __esm({
   "src/core/managed-devsy-stop.ts"() {
     "use strict";
-    import_node_fs26 = __toESM(require("fs"));
+    import_node_fs28 = __toESM(require("fs"));
     import_node_os5 = __toESM(require("os"));
-    import_node_path34 = __toESM(require("path"));
+    import_node_path35 = __toESM(require("path"));
     import_node_util10 = require("util");
     init_devcontainer_profile();
     init_devpod_environment();
@@ -14290,7 +14947,7 @@ function hasControlCharacter2(value) {
 function readPolicyFile(filePath) {
   let initialStats;
   try {
-    initialStats = import_node_fs27.default.lstatSync(filePath);
+    initialStats = import_node_fs29.default.lstatSync(filePath);
   } catch (error) {
     if (isErrno(error, "ENOENT")) return { status: "absent" };
     return { status: "invalid", error: "network policy could not be read" };
@@ -14303,16 +14960,16 @@ function readPolicyFile(filePath) {
   }
   let fileDescriptor;
   try {
-    fileDescriptor = import_node_fs27.default.openSync(
+    fileDescriptor = import_node_fs29.default.openSync(
       filePath,
-      import_node_fs27.default.constants.O_RDONLY | import_node_fs27.default.constants.O_NONBLOCK | (import_node_fs27.default.constants.O_NOFOLLOW ?? 0)
+      import_node_fs29.default.constants.O_RDONLY | import_node_fs29.default.constants.O_NONBLOCK | (import_node_fs29.default.constants.O_NOFOLLOW ?? 0)
     );
   } catch (error) {
     if (isErrno(error, "ENOENT")) return { status: "absent" };
     return { status: "invalid", error: "network policy could not be read" };
   }
   try {
-    const openedStats = import_node_fs27.default.fstatSync(fileDescriptor);
+    const openedStats = import_node_fs29.default.fstatSync(fileDescriptor);
     if (!openedStats.isFile()) {
       return { status: "invalid", error: "network policy must be a regular file" };
     }
@@ -14325,12 +14982,12 @@ function readPolicyFile(filePath) {
     const buffer = Buffer.alloc(openedStats.size);
     let offset = 0;
     while (offset < buffer.length) {
-      const bytesRead = import_node_fs27.default.readSync(fileDescriptor, buffer, offset, buffer.length - offset, null);
+      const bytesRead = import_node_fs29.default.readSync(fileDescriptor, buffer, offset, buffer.length - offset, null);
       if (bytesRead === 0)
         return { status: "invalid", error: "network policy changed during read" };
       offset += bytesRead;
     }
-    const finalStats = import_node_fs27.default.fstatSync(fileDescriptor);
+    const finalStats = import_node_fs29.default.fstatSync(fileDescriptor);
     if (!finalStats.isFile() || finalStats.size !== openedStats.size) {
       return { status: "invalid", error: "network policy changed during read" };
     }
@@ -14339,7 +14996,7 @@ function readPolicyFile(filePath) {
     return { status: "invalid", error: "network policy could not be read" };
   } finally {
     try {
-      import_node_fs27.default.closeSync(fileDescriptor);
+      import_node_fs29.default.closeSync(fileDescriptor);
     } catch {
     }
   }
@@ -14356,16 +15013,16 @@ function assertDisjoint(cidrs, message) {
 function isErrno(error, code) {
   return typeof error === "object" && error !== null && "code" in error && error.code === code;
 }
-var import_node_fs27, import_node_path35, NETWORK_POLICY_VERSION, NETWORK_POLICY_FILE, DEFAULT_NETWORK_POLICY_ENDPOINT_RESERVE, NETWORK_POLICY_PREFIX_LENGTHS, MAX_NETWORK_POLICY_FILE_BYTES, MAX_NETWORK_POLICY_ARRAY_ENTRIES, MAX_NETWORK_POLICY_DAEMON_ID_LENGTH, NetworkPolicyValidationError, NETWORK_POLICY_KEYS, PRIVATE_IPV4_RANGES;
+var import_node_fs29, import_node_path36, NETWORK_POLICY_VERSION, NETWORK_POLICY_FILE, DEFAULT_NETWORK_POLICY_ENDPOINT_RESERVE, NETWORK_POLICY_PREFIX_LENGTHS, MAX_NETWORK_POLICY_FILE_BYTES, MAX_NETWORK_POLICY_ARRAY_ENTRIES, MAX_NETWORK_POLICY_DAEMON_ID_LENGTH, NetworkPolicyValidationError, NETWORK_POLICY_KEYS, PRIVATE_IPV4_RANGES;
 var init_network_policy = __esm({
   "src/core/network-policy.ts"() {
     "use strict";
-    import_node_fs27 = __toESM(require("fs"));
-    import_node_path35 = __toESM(require("path"));
+    import_node_fs29 = __toESM(require("fs"));
+    import_node_path36 = __toESM(require("path"));
     init_network_capacity();
     init_router();
     NETWORK_POLICY_VERSION = 1;
-    NETWORK_POLICY_FILE = import_node_path35.default.join(DEVROUTER_HOME, "network-policy.json");
+    NETWORK_POLICY_FILE = import_node_path36.default.join(DEVROUTER_HOME, "network-policy.json");
     DEFAULT_NETWORK_POLICY_ENDPOINT_RESERVE = 8;
     NETWORK_POLICY_PREFIX_LENGTHS = [24, 25, 26];
     MAX_NETWORK_POLICY_FILE_BYTES = 64 * 1024;
@@ -14466,27 +15123,27 @@ function assertExactKeys(value, keys2) {
 function readDocument(store) {
   let descriptor;
   try {
-    descriptor = import_node_fs28.default.openSync(
+    descriptor = import_node_fs30.default.openSync(
       store.filePath,
-      import_node_fs28.default.constants.O_RDONLY | import_node_fs28.default.constants.O_NONBLOCK | (import_node_fs28.default.constants.O_NOFOLLOW ?? 0)
+      import_node_fs30.default.constants.O_RDONLY | import_node_fs30.default.constants.O_NONBLOCK | (import_node_fs30.default.constants.O_NOFOLLOW ?? 0)
     );
   } catch (error) {
     if (isErrno2(error, "ENOENT")) return void 0;
     throw claimError("invalid-state", "network claim state could not be read");
   }
   try {
-    const stat = import_node_fs28.default.fstatSync(descriptor);
+    const stat = import_node_fs30.default.fstatSync(descriptor);
     if (!stat.isFile() || stat.size > NETWORK_CLAIMS_MAX_FILE_BYTES || (stat.mode & 63) !== 0) {
       throw claimError("invalid-state", "network claim state is not a bounded private file");
     }
     const buffer = Buffer.alloc(NETWORK_CLAIMS_MAX_FILE_BYTES + 1);
     let count = 0;
     while (count < buffer.length) {
-      const bytesRead = import_node_fs28.default.readSync(descriptor, buffer, count, buffer.length - count, null);
+      const bytesRead = import_node_fs30.default.readSync(descriptor, buffer, count, buffer.length - count, null);
       if (bytesRead === 0) break;
       count += bytesRead;
     }
-    const finalStat = import_node_fs28.default.fstatSync(descriptor);
+    const finalStat = import_node_fs30.default.fstatSync(descriptor);
     if (count > NETWORK_CLAIMS_MAX_FILE_BYTES || finalStat.size !== stat.size) {
       throw claimError("invalid-state", "network claim state changed during read");
     }
@@ -14498,7 +15155,7 @@ function readDocument(store) {
     }
     return validateDocument(parsed, store.daemonId);
   } finally {
-    import_node_fs28.default.closeSync(descriptor);
+    import_node_fs30.default.closeSync(descriptor);
   }
 }
 function validateDocument(value, daemonId) {
@@ -14565,21 +15222,21 @@ function createStore(daemonId, options) {
   return {
     root,
     daemonId,
-    filePath: import_node_path36.default.join(root, `${key}.json`),
-    lockPath: import_node_path36.default.join(root, `${key}.lock`),
+    filePath: import_node_path37.default.join(root, `${key}.json`),
+    lockPath: import_node_path37.default.join(root, `${key}.lock`),
     writeAtomic: options.writeAtomic ?? writeFileAtomically
   };
 }
 function validateRoot(root) {
-  if (typeof root !== "string" || !import_node_path36.default.isAbsolute(root) || root.includes("\0")) {
+  if (typeof root !== "string" || !import_node_path37.default.isAbsolute(root) || root.includes("\0")) {
     throw claimError("invalid-input", "network claim root is invalid");
   }
-  const resolved2 = import_node_path36.default.resolve(root);
+  const resolved2 = import_node_path37.default.resolve(root);
   if (resolved2 !== root) throw claimError("invalid-input", "network claim root is invalid");
   return resolved2;
 }
 function hashKey(value) {
-  return (0, import_node_crypto15.createHash)("sha256").update(value).digest("hex");
+  return (0, import_node_crypto19.createHash)("sha256").update(value).digest("hex");
 }
 function cloneFence(fence) {
   return { ...fence };
@@ -14602,20 +15259,20 @@ function isErrno2(error, code) {
 function claimError(code, message) {
   return new NetworkClaimError(code, message);
 }
-var import_node_crypto15, import_node_fs28, import_node_path36, NETWORK_CLAIMS_VERSION, NETWORK_CLAIMS_ROOT, NETWORK_CLAIMS_MAX_RECORDS, NETWORK_CLAIMS_MAX_FILE_BYTES, NetworkClaimError, CLAIM_CORE_KEYS, CLAIM_KEYS, FENCE_KEYS, DOCUMENT_KEYS, MAX_CLAIM_TEXT, MAX_ENDPOINT_TEXT;
+var import_node_crypto19, import_node_fs30, import_node_path37, NETWORK_CLAIMS_VERSION, NETWORK_CLAIMS_ROOT, NETWORK_CLAIMS_MAX_RECORDS, NETWORK_CLAIMS_MAX_FILE_BYTES, NetworkClaimError, CLAIM_CORE_KEYS, CLAIM_KEYS, FENCE_KEYS, DOCUMENT_KEYS, MAX_CLAIM_TEXT, MAX_ENDPOINT_TEXT;
 var init_network_claims = __esm({
   "src/core/network-claims.ts"() {
     "use strict";
-    import_node_crypto15 = require("crypto");
-    import_node_fs28 = __toESM(require("fs"));
-    import_node_path36 = __toESM(require("path"));
+    import_node_crypto19 = require("crypto");
+    import_node_fs30 = __toESM(require("fs"));
+    import_node_path37 = __toESM(require("path"));
     init_atomic_file();
     init_file_lock();
     init_network_capacity();
     init_network_policy();
     init_router();
     NETWORK_CLAIMS_VERSION = 1;
-    NETWORK_CLAIMS_ROOT = import_node_path36.default.join(DEVROUTER_HOME, "networks");
+    NETWORK_CLAIMS_ROOT = import_node_path37.default.join(DEVROUTER_HOME, "networks");
     NETWORK_CLAIMS_MAX_RECORDS = 256;
     NETWORK_CLAIMS_MAX_FILE_BYTES = 512 * 1024;
     NetworkClaimError = class extends Error {
@@ -14657,14 +15314,14 @@ var init_network_claims = __esm({
 
 // src/core/network-claim-lookup.ts
 function networkOwnerKey(repoPath) {
-  if (!import_node_path37.default.isAbsolute(repoPath) || import_node_path37.default.resolve(repoPath) !== repoPath)
+  if (!import_node_path38.default.isAbsolute(repoPath) || import_node_path38.default.resolve(repoPath) !== repoPath)
     throw new Error("Invalid network owner path.");
-  return (0, import_node_crypto16.createHash)("sha256").update(repoPath).digest("hex");
+  return (0, import_node_crypto20.createHash)("sha256").update(repoPath).digest("hex");
 }
 function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   let names;
   try {
-    names = import_node_fs29.default.readdirSync(root);
+    names = import_node_fs31.default.readdirSync(root);
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw new Error("Network claims cannot be inspected; repair is required.");
@@ -14673,21 +15330,21 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   if (files.length > 128) throw new Error("Network daemon inventory exceeds its bound.");
   let found;
   for (const file of files) {
-    const full = import_node_path37.default.join(root, file);
-    const stat = import_node_fs29.default.lstatSync(full);
+    const full = import_node_path38.default.join(root, file);
+    const stat = import_node_fs31.default.lstatSync(full);
     if (!stat.isFile() || stat.size > NETWORK_CLAIMS_MAX_FILE_BYTES)
       throw new Error("Invalid retained network claim file.");
     let value;
-    const descriptor = import_node_fs29.default.openSync(
+    const descriptor = import_node_fs31.default.openSync(
       full,
-      import_node_fs29.default.constants.O_RDONLY | import_node_fs29.default.constants.O_NONBLOCK | import_node_fs29.default.constants.O_NOFOLLOW
+      import_node_fs31.default.constants.O_RDONLY | import_node_fs31.default.constants.O_NONBLOCK | import_node_fs31.default.constants.O_NOFOLLOW
     );
     try {
-      if (!import_node_fs29.default.fstatSync(descriptor).isFile()) throw new Error();
+      if (!import_node_fs31.default.fstatSync(descriptor).isFile()) throw new Error();
       const bytes2 = Buffer.alloc(NETWORK_CLAIMS_MAX_FILE_BYTES + 1);
       let size = 0;
       while (size < bytes2.length) {
-        const count = import_node_fs29.default.readSync(descriptor, bytes2, size, bytes2.length - size, null);
+        const count = import_node_fs31.default.readSync(descriptor, bytes2, size, bytes2.length - size, null);
         if (!count) break;
         size += count;
       }
@@ -14697,9 +15354,9 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
     } catch {
       throw new Error("Retained network claim could not be read safely.");
     } finally {
-      import_node_fs29.default.closeSync(descriptor);
+      import_node_fs31.default.closeSync(descriptor);
     }
-    if (typeof value.daemonId !== "string" || `${(0, import_node_crypto16.createHash)("sha256").update(value.daemonId).digest("hex")}.json` !== file)
+    if (typeof value.daemonId !== "string" || `${(0, import_node_crypto20.createHash)("sha256").update(value.daemonId).digest("hex")}.json` !== file)
       throw new Error("Retained network daemon identity is invalid.");
     const claim2 = readNetworkClaim({
       daemonId: value.daemonId,
@@ -14713,140 +15370,17 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   }
   return found;
 }
-var import_node_crypto16, import_node_fs29, import_node_path37;
+var import_node_crypto20, import_node_fs31, import_node_path38;
 var init_network_claim_lookup = __esm({
   "src/core/network-claim-lookup.ts"() {
     "use strict";
-    import_node_crypto16 = require("crypto");
-    import_node_fs29 = __toESM(require("fs"));
-    import_node_path37 = __toESM(require("path"));
+    import_node_crypto20 = require("crypto");
+    import_node_fs31 = __toESM(require("fs"));
+    import_node_path38 = __toESM(require("path"));
     init_network_claims();
   }
 });
 
-// src/core/network-provider-inspect.ts
-function object3(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    throw new Error("Invalid provider evidence.");
-  return value;
-}
-function qualifyNetworkProviderDefinition(value, provider) {
-  const definition = object3(value);
-  const agent = object3(definition.agent);
-  const docker = object3(agent.docker);
-  const env = object3(docker.env);
-  const options = object3(definition.options);
-  const host = object3(options.DOCKER_HOST);
-  const dockerPath = object3(options.DOCKER_PATH);
-  const exec = object3(definition.exec);
-  const command = provider === "devsy" ? '"${DEVSY}" internal sh -c "${COMMAND}"' : '"${DEVPOD}" helper sh -c "${COMMAND}"';
-  const actualCommand = Array.isArray(exec.command) ? exec.command : [exec.command];
-  if (definition.name !== "docker" || ![true, "true"].includes(agent.local) || agent.driver !== void 0 && agent.driver !== "docker" && agent.driver !== "" || docker.path !== "${DOCKER_PATH}" || docker.builder !== "${DOCKER_BUILDER}" || ![false, "false"].includes(docker.install) || (provider === "devsy" ? docker.elevation !== "${DOCKER_ELEVATION}" : docker.elevation !== void 0 && docker.elevation !== "") || env.DOCKER_HOST !== "${DOCKER_HOST}" || Object.keys(env).some((key) => key !== "DOCKER_HOST") || host.global !== true || dockerPath.default !== "docker" || actualCommand.length !== 1 || typeof actualCommand[0] !== "string" || actualCommand[0].trim() !== command || Object.keys(exec).some((key) => key !== "command") || agent.path !== void 0 && agent.path !== "" || agent.downloadURL !== void 0 && agent.downloadURL !== "") {
-    throw new Error("Docker provider definition is not qualified for network allocation.");
-  }
-  return (0, import_node_crypto17.createHash)("sha256").update(JSON.stringify({ name: definition.name, agent, options, exec })).digest("hex");
-}
-function read(provider, args) {
-  const result = (0, import_node_child_process18.spawnSync)(provider, args, {
-    encoding: "utf8",
-    timeout: 5e3,
-    maxBuffer: 2 * 1024 * 1024
-  });
-  if (result.error || result.status !== 0)
-    throw new Error("Network provider evidence is unavailable.");
-  return result.stdout;
-}
-function inspectNetworkProviderBinding(input2) {
-  try {
-    const { provider, providerId, repoPath } = input2;
-    const contexts = JSON.parse(
-      read(provider, [
-        "context",
-        "list",
-        ...provider === "devsy" ? ["--result-format", "json"] : ["--output", "json"]
-      ])
-    );
-    if (!Array.isArray(contexts) || contexts.length > 128) throw new Error();
-    const selected = contexts.map(object3).filter(
-      (row) => input2.providerContext ? row.name === input2.providerContext : row.default === true
-    );
-    if (selected.length !== 1 || typeof selected[0].name !== "string") throw new Error();
-    const providerContext = selected[0].name;
-    if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(providerContext)) throw new Error();
-    const contextArgs = ["--context", providerContext];
-    const version = read(provider, provider === "devsy" ? ["--version"] : ["version"]);
-    const parsedVersion = version.match(/\b(?:v)?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)\b/)?.[1];
-    if (provider === "devsy" ? !isSupportedDevsyVersion(parsedVersion) : parsedVersion !== "0.6.15")
-      throw new Error();
-    const definitions = object3(
-      JSON.parse(
-        read(
-          provider,
-          provider === "devsy" ? ["provider", "list", "--result-format", "json", ...contextArgs] : ["provider", "list", "--output", "json", ...contextArgs]
-        )
-      )
-    );
-    const entry = object3(definitions.docker);
-    const definitionSha256 = qualifyNetworkProviderDefinition(entry.config, provider);
-    const rows2 = JSON.parse(
-      read(
-        provider,
-        provider === "devsy" ? ["workspace", "list", "--result-format", "json", "--skip-pro", ...contextArgs] : ["list", "--output", "json", "--skip-pro", ...contextArgs]
-      )
-    );
-    if (!Array.isArray(rows2) || rows2.length > 4096) throw new Error();
-    const matching = rows2.map(object3).filter((row) => row.id === providerId || object3(row.source).localFolder === repoPath);
-    if (matching.length > 1) throw new Error();
-    const workspace = matching[0];
-    if (workspace && (workspace.id !== providerId || object3(workspace.source).localFolder !== repoPath))
-      throw new Error();
-    const workspaceProvider = workspace ? object3(workspace.provider) : void 0;
-    const state = object3(entry.state);
-    const settings = object3(state.options ?? {});
-    const stored = workspaceProvider ? object3(workspaceProvider.options ?? {}) : {};
-    const option = (key, localOnly = false) => {
-      const value = localOnly ? stored[key] : stored[key] ?? settings[key];
-      if (value === void 0) return null;
-      const text6 = object3(value).value;
-      if (typeof text6 !== "string") throw new Error();
-      return text6 || null;
-    };
-    if (workspaceProvider && workspaceProvider.name !== "docker") throw new Error();
-    if (option("DOCKER_ELEVATION") && option("DOCKER_ELEVATION") !== "none") throw new Error();
-    const endpoint = input2.endpoint ?? option("DOCKER_HOST");
-    if (!endpoint || !input2.endpoint && (process.env.DOCKER_CONTEXT || option("DOCKER_CONTEXT") || (option("DOCKER_PATH") ?? "docker") !== "docker" || !workspace && entry.default !== true))
-      throw new Error();
-    return {
-      provider,
-      providerContext,
-      providerId,
-      endpoint,
-      daemonId: inspectManagedStopDaemon(endpoint),
-      versionQualified: true,
-      definitionSha256,
-      providerName: "docker",
-      dockerPath: option("DOCKER_PATH") ?? "docker",
-      persistedEndpoint: workspace ? option("DOCKER_HOST", true) : null,
-      persistedContext: option("DOCKER_CONTEXT"),
-      registration: workspace ? "owned" : "absent"
-    };
-  } catch {
-    throw new Error(
-      "Network provider destination could not be qualified; no allocation is permitted."
-    );
-  }
-}
-var import_node_child_process18, import_node_crypto17;
-var init_network_provider_inspect = __esm({
-  "src/core/network-provider-inspect.ts"() {
-    "use strict";
-    import_node_child_process18 = require("child_process");
-    import_node_crypto17 = require("crypto");
-    init_devpod_environment();
-    init_devsy_agent();
-  }
-});
-
 // src/core/network-provider-effect.ts
 function networkProviderEffectOptions(provider, providerId, repoPath) {
   const claim2 = findOwnedNetworkClaim(repoPath);
@@ -14880,7 +15414,7 @@ var init_network_provider_effect = __esm({
 
 // src/core/devsy-mutation.ts
 function withMutationLock(activity, target, operation) {
-  import_node_fs30.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs32.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVSY_MUTATION_LOCK_FILE,
     {
@@ -14900,7 +15434,7 @@ function runDevsyAction(action2, devsyId, force = false, repoPath) {
   const args = action2 === "delete" ? ["delete", devsyId, ...force ? ["--force"] : [], "--ignore-not-found"] : ["stop", devsyId];
   claimLifecycleEffect();
   const binding = repoPath ? networkProviderEffectOptions("devsy", devsyId, repoPath) : { args: [] };
-  const result = (0, import_node_child_process19.spawnSync)("devsy", ["workspace", ...args, ...binding.args], {
+  const result = (0, import_node_child_process22.spawnSync)("devsy", ["workspace", ...args, ...binding.args], {
     encoding: "utf-8",
     ...binding.env ? { env: binding.env } : {}
   });
@@ -14917,7 +15451,7 @@ function inspectExactOwnership(devsyId, worktreePath) {
 }
 function checkoutVanished(worktreePath) {
   try {
-    import_node_fs30.default.lstatSync(worktreePath);
+    import_node_fs32.default.lstatSync(worktreePath);
     return false;
   } catch (error) {
     return error.code === "ENOENT";
@@ -14987,13 +15521,13 @@ function stopOwnedDevsyWorkspace(devsyId, worktreePath) {
 function deleteOwnedDevsyWorkspace(devsyId, worktreePath) {
   return mutateOwnedDevsyWorkspace("delete", devsyId, worktreePath);
 }
-var import_node_child_process19, import_node_fs30, import_node_path38, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS;
+var import_node_child_process22, import_node_fs32, import_node_path39, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS;
 var init_devsy_mutation = __esm({
   "src/core/devsy-mutation.ts"() {
     "use strict";
-    import_node_child_process19 = require("child_process");
-    import_node_fs30 = __toESM(require("fs"));
-    import_node_path38 = __toESM(require("path"));
+    import_node_child_process22 = require("child_process");
+    import_node_fs32 = __toESM(require("fs"));
+    import_node_path39 = __toESM(require("path"));
     init_devsy_agent();
     init_devsy_workspaces();
     init_file_lock();
@@ -15002,7 +15536,7 @@ var init_devsy_mutation = __esm({
     init_network_provider_effect();
     init_reliability_context();
     init_router();
-    DEVSY_MUTATION_LOCK_FILE = import_node_path38.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
+    DEVSY_MUTATION_LOCK_FILE = import_node_path39.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
     DEVSY_MUTATION_WAIT_MS = 18e5;
   }
 });
@@ -15079,15 +15613,15 @@ function assertFreshBootstrapRequest(identity2, options) {
     throw new Error("Fresh bootstrap refuses a retained runtime or provider registration.");
   qualifiedContext(readDevcontainerConfig(identity2.repoPath).source);
 }
-var import_node_child_process20, import_node_crypto18, import_node_fs31, import_node_os6, import_node_path39, import_node_util11, import_yaml4;
+var import_node_child_process23, import_node_crypto21, import_node_fs33, import_node_os6, import_node_path40, import_node_util11, import_yaml4;
 var init_managed_fresh_bootstrap = __esm({
   "src/core/managed-fresh-bootstrap.ts"() {
     "use strict";
-    import_node_child_process20 = require("child_process");
-    import_node_crypto18 = require("crypto");
-    import_node_fs31 = __toESM(require("fs"));
+    import_node_child_process23 = require("child_process");
+    import_node_crypto21 = require("crypto");
+    import_node_fs33 = __toESM(require("fs"));
     import_node_os6 = __toESM(require("os"));
-    import_node_path39 = __toESM(require("path"));
+    import_node_path40 = __toESM(require("path"));
     import_node_util11 = require("util");
     import_yaml4 = __toESM(require("yaml"));
     init_devcontainer_config();
@@ -15108,289 +15642,6 @@ var init_managed_fresh_bootstrap = __esm({
   }
 });
 
-// src/core/managed-host-ports.ts
-function unavailableEntry(declaration, reason2) {
-  return { ...declaration, status: "unavailable", reason: reason2 };
-}
-function livePublishedBindings(containerId, target) {
-  const result = (0, import_node_child_process21.spawnSync)("docker", ["port", containerId, `${target}/tcp`], {
-    encoding: "utf-8",
-    timeout: PORT_LOOKUP_TIMEOUT_MS,
-    maxBuffer: PORT_LOOKUP_MAX_BUFFER,
-    ...networkDockerOptions()
-  });
-  if (result.error || result.status === null) return void 0;
-  if (result.status !== 0) return "";
-  return typeof result.stdout === "string" ? result.stdout : void 0;
-}
-function parseLoopbackBinding(output2) {
-  const lines = output2.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
-  if (lines.length === 0) return { reason: "not-published" };
-  if (lines.length > 1) return { reason: "ambiguous" };
-  const match = LOOPBACK_BINDING.exec(lines[0]);
-  if (!match) return { reason: "not-published" };
-  const port = Number(match[1]);
-  if (!Number.isInteger(port) || port < 1 || port > 65535) return { reason: "not-published" };
-  return { endpoint: { host: "127.0.0.1", port } };
-}
-function revalidateLiveOwner(containerId, input2, composeProject, composeFiles2, service) {
-  try {
-    const current = inspectWorkspaceContainers({ ids: [containerId] });
-    if (current.length !== 1 || current[0].id !== containerId) return "unavailable";
-    if (!hasExactComposeIdentity(current[0], {
-      repoPath: input2.repoPath,
-      service,
-      composeProject,
-      composeFiles: composeFiles2
-    })) {
-      return "unavailable";
-    }
-    return current[0].state.Running ? "available" : "not-running";
-  } catch {
-    return "unavailable";
-  }
-}
-function resolveManagedHostPorts(input2) {
-  const report = {};
-  const selectedServices = new Set(input2.selectedServices);
-  const selectedKeys = [];
-  for (const [key, declaration] of Object.entries(input2.declarations)) {
-    if (!selectedServices.has(declaration.service)) {
-      report[key] = { ...declaration, status: "inactive" };
-      continue;
-    }
-    selectedKeys.push(key);
-    report[key] = { ...declaration, status: "unavailable", reason: "unavailable" };
-  }
-  if (selectedKeys.length === 0) return report;
-  const composeProject = input2.composeProject;
-  const composeFiles2 = input2.composeFiles;
-  if (typeof composeProject !== "string" || composeProject.length === 0 || composeFiles2 === void 0 || composeFiles2.length === 0 || composeFiles2.some((file) => file.length === 0)) {
-    return report;
-  }
-  if (selectedKeys.some((key) => {
-    const target = input2.declarations[key].target;
-    return !Number.isInteger(target) || target < 1 || target > 65535;
-  })) {
-    return report;
-  }
-  const liveContainers = input2.containers === void 0;
-  let containers2 = input2.containers;
-  if (containers2 === void 0) {
-    try {
-      containers2 = inspectWorkspaceContainers({ composeProject });
-    } catch {
-      return report;
-    }
-  }
-  const publishedBindings = input2.publishedBindings ?? livePublishedBindings;
-  for (const key of selectedKeys) {
-    const declaration = input2.declarations[key];
-    let owners;
-    try {
-      owners = containers2.filter(
-        (container) => hasExactComposeIdentity(container, {
-          repoPath: input2.repoPath,
-          service: declaration.service,
-          composeProject,
-          composeFiles: composeFiles2
-        })
-      );
-    } catch {
-      report[key] = unavailableEntry(declaration, "unavailable");
-      continue;
-    }
-    if (owners.length === 0) {
-      report[key] = unavailableEntry(declaration, "not-found");
-      continue;
-    }
-    if (owners.length > 1) {
-      report[key] = unavailableEntry(declaration, "ambiguous");
-      continue;
-    }
-    const owner = owners[0];
-    if (!owner.state.Running) {
-      report[key] = unavailableEntry(declaration, "not-running");
-      continue;
-    }
-    let output2;
-    try {
-      output2 = publishedBindings(owner.id, declaration.target);
-    } catch {
-      output2 = void 0;
-    }
-    if (typeof output2 !== "string") {
-      report[key] = unavailableEntry(declaration, "unavailable");
-      continue;
-    }
-    const binding = parseLoopbackBinding(output2);
-    if (!binding.endpoint) {
-      report[key] = unavailableEntry(declaration, binding.reason ?? "unavailable");
-      continue;
-    }
-    if (liveContainers) {
-      const proof = revalidateLiveOwner(
-        owner.id,
-        input2,
-        composeProject,
-        composeFiles2,
-        declaration.service
-      );
-      if (proof !== "available") {
-        report[key] = unavailableEntry(declaration, proof);
-        continue;
-      }
-    }
-    report[key] = {
-      ...declaration,
-      status: "available",
-      endpoint: binding.endpoint
-    };
-  }
-  return report;
-}
-function managedHostPortDeclarationsIdentity(declarations) {
-  const keys2 = Object.keys(declarations).sort();
-  if (keys2.length === 0) return void 0;
-  const canonical = keys2.map((key) => [key, declarations[key].service, declarations[key].target]);
-  return (0, import_node_crypto19.createHash)("sha256").update(JSON.stringify(canonical)).digest("hex");
-}
-function assertManagedHostPortsAvailable(report) {
-  const unavailable = Object.entries(report).filter(([, entry]) => entry.status === "unavailable").map(([key]) => key).sort();
-  if (unavailable.length > 0) {
-    throw new Error(`Selected managed host ports are unavailable: ${unavailable.join(", ")}.`);
-  }
-}
-var import_node_child_process21, import_node_crypto19, PORT_LOOKUP_TIMEOUT_MS, PORT_LOOKUP_MAX_BUFFER, LOOPBACK_BINDING;
-var init_managed_host_ports = __esm({
-  "src/core/managed-host-ports.ts"() {
-    "use strict";
-    import_node_child_process21 = require("child_process");
-    import_node_crypto19 = require("crypto");
-    init_devpod_environment();
-    init_network_effect_scope();
-    PORT_LOOKUP_TIMEOUT_MS = 1e4;
-    PORT_LOOKUP_MAX_BUFFER = 64 * 1024;
-    LOOPBACK_BINDING = /^127\.0\.0\.1:(\d+)$/;
-  }
-});
-
-// src/core/managed-post-start.ts
-function readRegularFileBytes(filePath) {
-  if (!import_node_fs32.default.existsSync(filePath) || !import_node_fs32.default.lstatSync(filePath).isFile()) return void 0;
-  return import_node_fs32.default.readFileSync(filePath);
-}
-function readRegularFile(filePath) {
-  return readRegularFileBytes(filePath)?.toString("utf-8");
-}
-function adapterFingerprint(adapter) {
-  return (0, import_node_crypto20.createHash)("sha256").update(adapter).digest("hex");
-}
-function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path40.default.join(repoPath, MANAGED_ADAPTER_PATH);
-  const adapterBytes = readRegularFileBytes(adapterPath);
-  const adapterText = adapterBytes?.toString("utf-8");
-  const dockerfilePath = import_node_path40.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path40.default.join(repoPath, ".devcontainer", "devcontainer.json");
-  const dockerfile = readRegularFile(dockerfilePath) ?? "";
-  const devcontainer = readRegularFile(devcontainerPath) ?? "";
-  const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
-    (value) => value.includes("DEVROUTER_PROCESS_HELPER") || value.includes("devrouter-process")
-  );
-  if (adapterBytes === void 0) {
-    if (devrouterPattern) {
-      throw new Error(
-        "Devrouter lifecycle wiring is incomplete: add the managed post-start adapter or remove the stale devrouter-process references."
-      );
-    }
-    return { kind: "unmanaged" };
-  }
-  const adapter = adapterBytes.toString("utf-8");
-  if (!adapter.includes(MANAGED_MARKER)) {
-    if (devrouterPattern) {
-      throw new Error(
-        "Devrouter-looking post-start adapter is missing the 'devrouter:managed devcontainer' marker. Regenerate or migrate the devcontainer, then retry devrouter ensure."
-      );
-    }
-    return { kind: "unmanaged" };
-  }
-  assertManagedDevcontainerLifecycle(repoPath);
-  if (adapter.includes("DEVROUTER_PROCESS_HELPER")) {
-    return {
-      kind: "runtime",
-      adapterPath: MANAGED_ADAPTER_PATH,
-      adapterSha256: adapterFingerprint(adapterBytes),
-      adapterContents: adapterBytes
-    };
-  }
-  if (dockerfile.includes("devrouter-process") && devcontainer.includes("postStartCommand")) {
-    return { kind: "legacy" };
-  }
-  throw new Error(
-    "Managed post-start must use DEVROUTER_PROCESS_HELPER before removing the legacy image helper and postStartCommand. Regenerate or migrate the devcontainer, then retry devrouter ensure."
-  );
-}
-function assertSafeProcessName(name) {
-  if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(name)) {
-    throw new Error(`Managed process '${name}' is not a safe exact identifier.`);
-  }
-}
-function runManagedProcessAction(options) {
-  assertSafeProcessName(options.name);
-  const result = (0, import_node_child_process22.spawnSync)(
-    "docker",
-    [
-      "exec",
-      "--workdir",
-      options.container.workspacePath,
-      "--env",
-      `DEVROUTER_PROCESS_HELPER=${RUNTIME_HELPER_PATH}`,
-      options.container.id,
-      "bash",
-      "-c",
-      'exec "$DEVROUTER_PROCESS_HELPER" "$1" --name "$2"',
-      "devrouter-process",
-      options.action,
-      options.name
-    ],
-    {
-      encoding: "utf-8",
-      stdio: options.action === "status" ? ["ignore", "pipe", "pipe"] : ["ignore", 2, "inherit"],
-      ...networkDockerOptions()
-    }
-  );
-  if (options.action === "stop") {
-    if (result.status !== 0) {
-      throw new Error(`Could not stop managed process '${options.name}'.`);
-    }
-    return "stopped";
-  }
-  try {
-    const parsed = JSON.parse(result.stdout.trim());
-    if (parsed.status === "running" || parsed.status === "stopped" || parsed.status === "foreign" || parsed.status === "drifted") {
-      return parsed.status;
-    }
-  } catch {
-  }
-  return "drifted";
-}
-var import_node_child_process22, import_node_crypto20, import_node_fs32, import_node_path40, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH;
-var init_managed_post_start = __esm({
-  "src/core/managed-post-start.ts"() {
-    "use strict";
-    import_node_child_process22 = require("child_process");
-    import_node_crypto20 = require("crypto");
-    import_node_fs32 = __toESM(require("fs"));
-    import_node_path40 = __toESM(require("path"));
-    init_devcontainer_config();
-    init_managed_host_ports();
-    init_network_effect_scope();
-    MANAGED_MARKER = "devrouter:managed devcontainer";
-    MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
-    RUNTIME_HELPER_PATH = "/tmp/devrouter/bin/devrouter-process";
-  }
-});
-
 // src/core/recovery-budget.ts
 function recoverySelectors(input2) {
   const declared = new Set(input2.services);
@@ -16247,14 +16498,14 @@ var init_reliability_model = __esm({
 
 // src/core/lifecycle-diagnostics.ts
 function privateDirectory(directory) {
-  const stat = import_node_fs33.default.lstatSync(directory);
+  const stat = import_node_fs34.default.lstatSync(directory);
   return stat.isDirectory() && stat.uid === process.getuid?.() && (stat.mode & 63) === 0;
 }
 function lifecycleDiagnosticsPath(identity2) {
   return import_node_path41.default.join(
     DEVROUTER_HOME,
     "lifecycle-diagnostics",
-    `${(0, import_node_crypto21.createHash)("sha256").update(identity2.repoPath).digest("hex")}.json`
+    `${(0, import_node_crypto22.createHash)("sha256").update(identity2.repoPath).digest("hex")}.json`
   );
 }
 function readReceipt(identity2) {
@@ -16262,15 +16513,15 @@ function readReceipt(identity2) {
   try {
     const file = lifecycleDiagnosticsPath(identity2);
     if (!privateDirectory(import_node_path41.default.dirname(file))) return void 0;
-    descriptor = import_node_fs33.default.openSync(
+    descriptor = import_node_fs34.default.openSync(
       file,
-      import_node_fs33.default.constants.O_RDONLY | import_node_fs33.default.constants.O_NOFOLLOW | import_node_fs33.default.constants.O_NONBLOCK
+      import_node_fs34.default.constants.O_RDONLY | import_node_fs34.default.constants.O_NOFOLLOW | import_node_fs34.default.constants.O_NONBLOCK
     );
-    const stat = import_node_fs33.default.fstatSync(descriptor);
+    const stat = import_node_fs34.default.fstatSync(descriptor);
     if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0 || stat.size > MAX_RECEIPT_BYTES)
       return void 0;
     const buffer = Buffer.alloc(MAX_RECEIPT_BYTES + 1);
-    const size = import_node_fs33.default.readSync(descriptor, buffer, 0, buffer.length, 0);
+    const size = import_node_fs34.default.readSync(descriptor, buffer, 0, buffer.length, 0);
     if (size > MAX_RECEIPT_BYTES) return void 0;
     const receipt = JSON.parse(buffer.subarray(0, size).toString("utf8"));
     const timestamp = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
@@ -16287,7 +16538,7 @@ function readReceipt(identity2) {
   } catch {
     return void 0;
   } finally {
-    if (descriptor !== void 0) import_node_fs33.default.closeSync(descriptor);
+    if (descriptor !== void 0) import_node_fs34.default.closeSync(descriptor);
   }
 }
 function readLifecycleDiagnostics(identity2, now = Date.now()) {
@@ -16325,12 +16576,12 @@ function readLifecycleDiagnostics(identity2, now = Date.now()) {
     return void 0;
   }
 }
-var import_node_crypto21, import_node_fs33, import_node_path41, import_node_util12, MAX_TAIL_BYTES, MAX_RECEIPT_BYTES, PACKAGE_TASK, LifecycleDiagnosticRecorder;
+var import_node_crypto22, import_node_fs34, import_node_path41, import_node_util12, MAX_TAIL_BYTES, MAX_RECEIPT_BYTES, PACKAGE_TASK, LifecycleDiagnosticRecorder;
 var init_lifecycle_diagnostics = __esm({
   "src/core/lifecycle-diagnostics.ts"() {
     "use strict";
-    import_node_crypto21 = require("crypto");
-    import_node_fs33 = __toESM(require("fs"));
+    import_node_crypto22 = require("crypto");
+    import_node_fs34 = __toESM(require("fs"));
     import_node_path41 = __toESM(require("path"));
     import_node_util12 = require("util");
     init_atomic_file();
@@ -16426,7 +16677,7 @@ var init_lifecycle_diagnostics = __esm({
           this.receipt.output = chunks;
           this.receipt.updatedAtMs = Date.now();
           const file = lifecycleDiagnosticsPath(this.request.identity);
-          import_node_fs33.default.mkdirSync(import_node_path41.default.dirname(file), { recursive: true, mode: 448 });
+          import_node_fs34.default.mkdirSync(import_node_path41.default.dirname(file), { recursive: true, mode: 448 });
           if (!privateDirectory(import_node_path41.default.dirname(file))) return;
           writeFileAtomically(file, `${JSON.stringify(this.receipt)}
 `);
@@ -16460,11 +16711,11 @@ function workerGroupAbsent(pid) {
   if (process.platform !== "linux") return false;
   let observedZombie = false;
   try {
-    for (const entry of import_node_fs34.default.readdirSync("/proc")) {
+    for (const entry of import_node_fs35.default.readdirSync("/proc")) {
       if (!/^\d+$/.test(entry)) continue;
       let stat;
       try {
-        stat = import_node_fs34.default.readFileSync(`/proc/${entry}/stat`, "utf8");
+        stat = import_node_fs35.default.readFileSync(`/proc/${entry}/stat`, "utf8");
       } catch (error) {
         if (error.code === "ENOENT") continue;
         return false;
@@ -16496,9 +16747,9 @@ async function runLifecycleWorker(request2, supervision, beforeAdmission) {
   if (process.platform === "win32")
     throw new Error("Lifecycle workers require POSIX process-group ownership.");
   const workerPath = import_node_path42.default.join(__dirname, "devrouter-lifecycle-worker.js");
-  if (!import_node_fs34.default.existsSync(workerPath))
+  if (!import_node_fs35.default.existsSync(workerPath))
     throw new Error("The packaged lifecycle worker is missing; rebuild the CLI.");
-  const child = (0, import_node_child_process23.fork)(workerPath, [], {
+  const child = (0, import_node_child_process24.fork)(workerPath, [], {
     detached: true,
     stdio: supervision ? ["ignore", "pipe", "pipe", "ipc"] : request2.kind === "ensure" ? ["inherit", "pipe", "pipe", "ipc"] : ["inherit", "inherit", "inherit", "ipc"],
     execArgv: []
@@ -16787,15 +17038,15 @@ async function runLifecycleWorker(request2, supervision, beforeAdmission) {
   }
 }
 function newLifecycleIds() {
-  return { requestId: (0, import_node_crypto22.randomUUID)(), operationId: (0, import_node_crypto22.randomUUID)(), workerId: (0, import_node_crypto22.randomUUID)() };
+  return { requestId: (0, import_node_crypto23.randomUUID)(), operationId: (0, import_node_crypto23.randomUUID)(), workerId: (0, import_node_crypto23.randomUUID)() };
 }
-var import_node_child_process23, import_node_crypto22, import_node_fs34, import_node_path42, OUTPUT_BUFFER_LIMIT, DEFAULT_OUTPUT_PAGE_BYTES, LifecycleOutput, LifecycleWorkerAdmissionBusyError;
+var import_node_child_process24, import_node_crypto23, import_node_fs35, import_node_path42, OUTPUT_BUFFER_LIMIT, DEFAULT_OUTPUT_PAGE_BYTES, LifecycleOutput, LifecycleWorkerAdmissionBusyError;
 var init_reliability_worker = __esm({
   "src/core/reliability-worker.ts"() {
     "use strict";
-    import_node_child_process23 = require("child_process");
-    import_node_crypto22 = require("crypto");
-    import_node_fs34 = __toESM(require("fs"));
+    import_node_child_process24 = require("child_process");
+    import_node_crypto23 = require("crypto");
+    import_node_fs35 = __toESM(require("fs"));
     import_node_path42 = __toESM(require("path"));
     init_file_lock();
     init_lifecycle_diagnostics();
@@ -16915,7 +17166,7 @@ var init_reliability_worker = __esm({
 
 // src/core/devpod-mutation.ts
 function withMutationLock2(activity, target, operation) {
-  import_node_fs35.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs36.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
     {
@@ -16935,7 +17186,7 @@ function runDevpodAction(action2, devpodId, force = false, repoPath) {
   const args = action2 === "delete" ? [action2, devpodId, ...force ? ["--force"] : [], "--ignore-not-found"] : [action2, devpodId];
   claimLifecycleEffect();
   const binding = repoPath ? networkProviderEffectOptions("devpod", devpodId, repoPath) : { args: [] };
-  const result = (0, import_node_child_process24.spawnSync)("devpod", [...args, ...binding.args], {
+  const result = (0, import_node_child_process25.spawnSync)("devpod", [...args, ...binding.args], {
     encoding: "utf-8",
     ...binding.env ? { env: binding.env } : {}
   });
@@ -17005,12 +17256,12 @@ function deleteOwnedDevpodWorkspace(devpodId, worktreePath) {
   resetWorkspaceRuntimeCaches();
   return result;
 }
-var import_node_child_process24, import_node_fs35, import_node_path43, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS;
+var import_node_child_process25, import_node_fs36, import_node_path43, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS;
 var init_devpod_mutation = __esm({
   "src/core/devpod-mutation.ts"() {
     "use strict";
-    import_node_child_process24 = require("child_process");
-    import_node_fs35 = __toESM(require("fs"));
+    import_node_child_process25 = require("child_process");
+    import_node_fs36 = __toESM(require("fs"));
     import_node_path43 = __toESM(require("path"));
     init_devpod_workspaces();
     init_devsy_mutation();
@@ -17121,7 +17372,7 @@ function hostPortBindingsConflict(desired, holder) {
   (desired.hostIp === null || holder.hostIp === null || desired.hostIp === holder.hostIp);
 }
 function runDocker(args) {
-  const result = (0, import_node_child_process25.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process26.spawnSync)("docker", args, {
     ...networkDockerOptions(),
     encoding: "utf-8",
     timeout: DOCKER_TIMEOUT_MS,
@@ -17191,7 +17442,7 @@ function listHolderSnapshots() {
 }
 function renderManagedComposeModel(plan, workspace) {
   const fileArgs = plan.composeFiles.flatMap((file) => ["-f", file]);
-  const result = (0, import_node_child_process25.spawnSync)(
+  const result = (0, import_node_child_process26.spawnSync)(
     "docker",
     [
       "compose",
@@ -17284,11 +17535,11 @@ function detectHostPortClaimConflicts(options) {
   }
   return conflicts;
 }
-var import_node_child_process25, import_node_path44, COMPOSE_RENDER_TIMEOUT_MS, COMPOSE_RENDER_MAX_BUFFER, DOCKER_TIMEOUT_MS, DOCKER_MAX_BUFFER, MAX_DESIRED_HOST_PORTS, MAX_RUNNING_HOLDERS, HOST_PORT_INSPECT_TEMPLATE;
+var import_node_child_process26, import_node_path44, COMPOSE_RENDER_TIMEOUT_MS, COMPOSE_RENDER_MAX_BUFFER, DOCKER_TIMEOUT_MS, DOCKER_MAX_BUFFER, MAX_DESIRED_HOST_PORTS, MAX_RUNNING_HOLDERS, HOST_PORT_INSPECT_TEMPLATE;
 var init_host_port_claims = __esm({
   "src/core/host-port-claims.ts"() {
     "use strict";
-    import_node_child_process25 = require("child_process");
+    import_node_child_process26 = require("child_process");
     import_node_path44 = __toESM(require("path"));
     init_devcontainer_profile();
     init_network_effect_scope();
@@ -17331,7 +17582,7 @@ function probeHttpRoute(host, options = {}) {
     args.push("--cacert", CERT_FILE);
   }
   args.push(url);
-  const result = (0, import_node_child_process26.spawnSync)("curl", args, { encoding: "utf-8" });
+  const result = (0, import_node_child_process27.spawnSync)("curl", args, { encoding: "utf-8" });
   const stdout = result.stdout?.trim() ?? "";
   const status = /^\d{3}$/.test(stdout) ? Number(stdout) : void 0;
   const ok = result.status === 0 && status !== void 0 && status >= 100 && status < 500;
@@ -17366,7 +17617,7 @@ function probeHttpReadinessSync(host, readiness, maxTimeSeconds, repoPath) {
   }
   let result;
   try {
-    result = (0, import_node_child_process26.spawnSync)("curl", args, {
+    result = (0, import_node_child_process27.spawnSync)("curl", args, {
       encoding: "utf-8",
       maxBuffer: CONTRACT_MAX_BUFFER,
       timeout: Math.ceil(parentTimeoutMs)
@@ -17448,11 +17699,11 @@ function transportFailure() {
     classification: "transport"
   };
 }
-var import_node_child_process26, DEFAULT_MAX_TIME_SECONDS, CONTROLLER_CURL_MAX_TIME_SECONDS, PARENT_TIMEOUT_PADDING_MS, CONTRACT_MAX_BUFFER, MIME_TOKEN_RE2;
+var import_node_child_process27, DEFAULT_MAX_TIME_SECONDS, CONTROLLER_CURL_MAX_TIME_SECONDS, PARENT_TIMEOUT_PADDING_MS, CONTRACT_MAX_BUFFER, MIME_TOKEN_RE2;
 var init_http_route_probe = __esm({
   "src/core/http-route-probe.ts"() {
     "use strict";
-    import_node_child_process26 = require("child_process");
+    import_node_child_process27 = require("child_process");
     init_router();
     init_tls();
     DEFAULT_MAX_TIME_SECONDS = 5;
@@ -17464,12 +17715,12 @@ var init_http_route_probe = __esm({
 });
 
 // src/core/managed-host-preparation.ts
-var import_node_child_process27, import_node_fs36;
+var import_node_child_process28, import_node_fs37;
 var init_managed_host_preparation = __esm({
   "src/core/managed-host-preparation.ts"() {
     "use strict";
-    import_node_child_process27 = require("child_process");
-    import_node_fs36 = __toESM(require("fs"));
+    import_node_child_process28 = require("child_process");
+    import_node_fs37 = __toESM(require("fs"));
     init_repo_config();
   }
 });
@@ -17594,7 +17845,7 @@ function classifyManagedMountNesting(configured, effectiveDestinations, containe
   };
 }
 function readContainerMountinfo(containerId, options) {
-  const result = (0, import_node_child_process28.spawnSync)("docker", ["exec", containerId, "cat", "/proc/self/mountinfo"], {
+  const result = (0, import_node_child_process29.spawnSync)("docker", ["exec", containerId, "cat", "/proc/self/mountinfo"], {
     encoding: "utf-8",
     timeout: options.timeoutMs ?? 5e3,
     stdio: ["ignore", "pipe", "pipe"],
@@ -17609,11 +17860,11 @@ function observeManagedMountNesting(container, options = {}) {
   const effective = destinations.some((_destination, index) => isNestedIndex(destinations, index)) ? readContainerMountinfo(container.id, options) : null;
   return classifyManagedMountNesting(container.mounts, effective, container.id);
 }
-var import_node_child_process28, NESTED_MOUNT_REASON, UNREADABLE_MOUNT_REASON;
+var import_node_child_process29, NESTED_MOUNT_REASON, UNREADABLE_MOUNT_REASON;
 var init_managed_mount_nesting = __esm({
   "src/core/managed-mount-nesting.ts"() {
     "use strict";
-    import_node_child_process28 = require("child_process");
+    import_node_child_process29 = require("child_process");
     init_network_effect_scope();
     NESTED_MOUNT_REASON = "no configured mount is nested inside another configured mount";
     UNREADABLE_MOUNT_REASON = "the container's own mount table could not be read";
@@ -17631,7 +17882,11 @@ function reliabilityRecovery(reason2, repoPath, variant) {
   switch (reason2) {
     case "stop-incomplete":
     case "operation-unknown":
-      return [`Run: devrouter stop ${checkout}`, `Run: devrouter ensure ${checkout} --repair`];
+      return [
+        `Run: devrouter stop ${checkout}`,
+        "Verify the repository startup hooks preserve retained data and startup is authorized before continuing.",
+        `Run: devrouter ensure ${checkout}${variantOption}`
+      ];
     case "start-refused":
       return [
         `Run: devrouter doctor --repo ${checkout} to read the refused fixed host-port claim and its holder`,
@@ -18171,7 +18426,7 @@ function readDocker(endpoint, args, timeoutMs) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process29.spawnSync)("docker", ["--host", endpoint, ...args], {
+  const result = (0, import_node_child_process30.spawnSync)("docker", ["--host", endpoint, ...args], {
     env,
     encoding: "utf-8",
     timeout: timeoutMs,
@@ -18333,11 +18588,11 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
   }
   return result;
 }
-var import_node_child_process29, NetworkInventoryError, MAX_IDS, MAX_OUTPUT_BYTES, FULL_ID, NETWORK_TEMPLATE, CONTAINER_TEMPLATE;
+var import_node_child_process30, NetworkInventoryError, MAX_IDS, MAX_OUTPUT_BYTES, FULL_ID, NETWORK_TEMPLATE, CONTAINER_TEMPLATE;
 var init_network_inventory = __esm({
   "src/core/network-inventory.ts"() {
     "use strict";
-    import_node_child_process29 = require("child_process");
+    import_node_child_process30 = require("child_process");
     init_devpod_environment();
     NetworkInventoryError = class extends Error {
     };
@@ -18665,26 +18920,26 @@ function hasLocalDockerNetworkNamespace(endpoint, procRoot = "/proc") {
   try {
     if (!endpoint.startsWith("unix:///")) return false;
     const socket = endpoint.slice("unix://".length);
-    const table = import_node_fs37.default.readFileSync(import_node_path45.default.join(procRoot, "net/unix"), "utf8");
+    const table = import_node_fs38.default.readFileSync(import_node_path45.default.join(procRoot, "net/unix"), "utf8");
     if (Buffer.byteLength(table) > 1024 * 1024) return false;
     const rows2 = table.split("\n").map((line) => line.trim().split(/\s+/)).filter((row) => row[7] === socket && row[3] === "00010000");
     if (rows2.length !== 1 || !/^\d+$/.test(rows2[0][6])) return false;
     const inode = `socket:[${rows2[0][6]}]`;
-    const ownNamespace = import_node_fs37.default.readlinkSync(import_node_path45.default.join(procRoot, "self/ns/net"));
-    const pids = import_node_fs37.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
+    const ownNamespace = import_node_fs38.default.readlinkSync(import_node_path45.default.join(procRoot, "self/ns/net"));
+    const pids = import_node_fs38.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
     if (pids.length > 4096) return false;
     for (const pid of pids) {
       if (Date.now() > deadline) return false;
       try {
         const root = import_node_path45.default.join(procRoot, pid);
-        if (import_node_path45.default.basename(import_node_fs37.default.readlinkSync(import_node_path45.default.join(root, "exe"))) !== "dockerd") continue;
-        if (import_node_fs37.default.readlinkSync(import_node_path45.default.join(root, "ns/net")) !== ownNamespace) continue;
-        const descriptors = import_node_fs37.default.readdirSync(import_node_path45.default.join(root, "fd"));
+        if (import_node_path45.default.basename(import_node_fs38.default.readlinkSync(import_node_path45.default.join(root, "exe"))) !== "dockerd") continue;
+        if (import_node_fs38.default.readlinkSync(import_node_path45.default.join(root, "ns/net")) !== ownNamespace) continue;
+        const descriptors = import_node_fs38.default.readdirSync(import_node_path45.default.join(root, "fd"));
         if (descriptors.length > 4096) continue;
         if (descriptors.some((fd) => {
           if (Date.now() > deadline) return false;
           try {
-            return import_node_fs37.default.readlinkSync(import_node_path45.default.join(root, "fd", fd)) === inode;
+            return import_node_fs38.default.readlinkSync(import_node_path45.default.join(root, "fd", fd)) === inode;
           } catch {
             return false;
           }
@@ -18698,11 +18953,11 @@ function hasLocalDockerNetworkNamespace(endpoint, procRoot = "/proc") {
   }
   return false;
 }
-var import_node_fs37, import_node_path45;
+var import_node_fs38, import_node_path45;
 var init_network_local_daemon = __esm({
   "src/core/network-local-daemon.ts"() {
     "use strict";
-    import_node_fs37 = __toESM(require("fs"));
+    import_node_fs38 = __toESM(require("fs"));
     import_node_path45 = __toESM(require("path"));
   }
 });
@@ -18731,7 +18986,7 @@ function parseLinuxNetworkRoutes(output2) {
 function collectNetworkRoutes(options) {
   if ((options.platform ?? process.platform) !== "linux" || !hasLocalDockerNetworkNamespace(options.endpoint))
     return { status: "unknown", routes: [] };
-  const result = (0, import_node_child_process30.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
+  const result = (0, import_node_child_process31.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
     encoding: "utf8",
     timeout: 5e3,
     maxBuffer: 1024 * 1024
@@ -18739,11 +18994,11 @@ function collectNetworkRoutes(options) {
   if (result.error || result.status !== 0) return { status: "unknown", routes: [] };
   return parseLinuxNetworkRoutes(result.stdout);
 }
-var import_node_child_process30, import_node_net3;
+var import_node_child_process31, import_node_net3;
 var init_network_routes = __esm({
   "src/core/network-routes.ts"() {
     "use strict";
-    import_node_child_process30 = require("child_process");
+    import_node_child_process31 = require("child_process");
     import_node_net3 = require("net");
     init_network_capacity();
     init_network_local_daemon();
@@ -18911,11 +19166,11 @@ function extendDockerComposeFile(nativeConfig, overlayPath) {
   const config = { ...nativeConfig, dockerComposeFile };
   return { status: "ready", config, reasons: [] };
 }
-var import_node_crypto23;
+var import_node_crypto24;
 var init_network_compose = __esm({
   "src/core/network-compose.ts"() {
     "use strict";
-    import_node_crypto23 = require("crypto");
+    import_node_crypto24 = require("crypto");
   }
 });
 
@@ -18924,7 +19179,7 @@ function prepareNetworkComposeFiles(plan, subnet) {
   const overlay = deriveComposeNetworkOverlay(subnet);
   if (overlay.status !== "ready" || !overlay.overlay) throw new Error("Network subnet is invalid.");
   const overlayPath = import_node_path46.default.join(plan.composeDirectory, OVERLAY);
-  const ignored = (0, import_node_child_process31.spawnSync)("git", [
+  const ignored = (0, import_node_child_process32.spawnSync)("git", [
     "-C",
     plan.composeDirectory,
     "check-ignore",
@@ -18938,9 +19193,9 @@ function prepareNetworkComposeFiles(plan, subnet) {
   const bytes2 = `${MARKER}
 ${import_yaml5.default.stringify(overlay.overlay)}`;
   const assertOwnership = () => {
-    if (!import_node_fs38.default.existsSync(overlayPath)) return;
-    const stat = import_node_fs38.default.lstatSync(overlayPath);
-    if (!stat.isFile() || stat.size > MAX_BYTES3 || import_node_fs38.default.readFileSync(overlayPath, "utf8") !== bytes2)
+    if (!import_node_fs39.default.existsSync(overlayPath)) return;
+    const stat = import_node_fs39.default.lstatSync(overlayPath);
+    if (!stat.isFile() || stat.size > MAX_BYTES3 || import_node_fs39.default.readFileSync(overlayPath, "utf8") !== bytes2)
       throw new Error("Retained network overlay changed; repair is required.");
   };
   assertOwnership();
@@ -18954,7 +19209,7 @@ ${JSON.stringify(extended.config, null, 2)}
     ...plan,
     contents,
     composeFiles: [...plan.composeFiles, overlayPath],
-    effectiveConfigSha256: (0, import_node_crypto24.createHash)("sha256").update(contents).digest("hex")
+    effectiveConfigSha256: (0, import_node_crypto25.createHash)("sha256").update(contents).digest("hex")
   };
   return {
     plan: result,
@@ -18964,13 +19219,13 @@ ${JSON.stringify(extended.config, null, 2)}
     }
   };
 }
-var import_node_child_process31, import_node_crypto24, import_node_fs38, import_node_path46, import_yaml5, OVERLAY, MARKER, MAX_BYTES3;
+var import_node_child_process32, import_node_crypto25, import_node_fs39, import_node_path46, import_yaml5, OVERLAY, MARKER, MAX_BYTES3;
 var init_network_compose_files = __esm({
   "src/core/network-compose-files.ts"() {
     "use strict";
-    import_node_child_process31 = require("child_process");
-    import_node_crypto24 = require("crypto");
-    import_node_fs38 = __toESM(require("fs"));
+    import_node_child_process32 = require("child_process");
+    import_node_crypto25 = require("crypto");
+    import_node_fs39 = __toESM(require("fs"));
     import_node_path46 = __toESM(require("path"));
     import_yaml5 = __toESM(require("yaml"));
     init_atomic_file();
@@ -18983,11 +19238,11 @@ var init_network_compose_files = __esm({
 });
 
 // src/core/network-connected-route.ts
-var import_node_child_process32;
+var import_node_child_process33;
 var init_network_connected_route = __esm({
   "src/core/network-connected-route.ts"() {
     "use strict";
-    import_node_child_process32 = require("child_process");
+    import_node_child_process33 = require("child_process");
     init_network_capacity();
   }
 });
@@ -19003,11 +19258,11 @@ var init_network_lifecycle = __esm({
 });
 
 // src/core/network-managed.ts
-var import_node_crypto25;
+var import_node_crypto26;
 var init_network_managed = __esm({
   "src/core/network-managed.ts"() {
     "use strict";
-    import_node_crypto25 = require("crypto");
+    import_node_crypto26 = require("crypto");
     init_devpod_environment();
     init_network_capacity();
     init_network_claim_lookup();
@@ -19077,12 +19332,12 @@ function resolveLinkedTarget(repoPath) {
     gitCommonDir: resolveGitCommonDir(repoPath)
   };
 }
-var import_node_child_process33, import_node_fs39, import_node_path47;
+var import_node_child_process34, import_node_fs40, import_node_path47;
 var init_workspace_ensure = __esm({
   "src/core/workspace-ensure.ts"() {
     "use strict";
-    import_node_child_process33 = require("child_process");
-    import_node_fs39 = __toESM(require("fs"));
+    import_node_child_process34 = require("child_process");
+    import_node_fs40 = __toESM(require("fs"));
     import_node_path47 = __toESM(require("path"));
     init_devcontainer_profile();
     init_devpod_environment();
@@ -19106,6 +19361,7 @@ var init_workspace_ensure = __esm({
     init_network_managed();
     init_network_recovery();
     init_reliability_lifecycle();
+    init_reliability_operation_store();
     init_repo_config();
     init_route_publication();
     init_router();
@@ -19195,6 +19451,29 @@ function preflightRuntimeVariant(repoPath, options) {
   }
   return variant;
 }
+function preflightAppReplacement(identity2, options) {
+  if (!options.replaceApp) return void 0;
+  if (identity2.provider !== "devsy" || options.repair || options.initializeNew)
+    throw new Error("--replace-app requires managed Devsy without --repair or --initialize-new.");
+  const record6 = readReliabilityOperation(identity2);
+  if (record6?.version !== 1 || record6.enrollment || record6.capacity || capacityPolicyTargets(identity2.repoPath) || record6.state.executionPolicy !== "manual" || record6.worker || record6.state.desired !== "stopped-by-user" || record6.state.phase === "stopping" || !record6.state.stopProof.workloadsStopped || !record6.state.stopProof.routesRemoved || record6.state.operation && !record6.state.operation.drained || findOwnedNetworkClaim(identity2.repoPath) || readAppReplacementAttempt(identity2))
+    throw new Error(
+      "App replacement requires a proved manual canonical stop without an earlier replacement attempt, enrollment or network allocation."
+    );
+  const state = readManagedRuntimeState(identity2.repoPath, identity2.workspace ?? void 0);
+  if (!state || options.profile !== void 0 && options.profile !== state.profile || (options.variant ?? "default") !== (state.variant ?? "default") || listHostRouteState().some((r) => sameWorkspacePath(r.repoPath, identity2.repoPath)))
+    throw new Error(
+      "App replacement requires the retained profile, variant and zero checkout routes."
+    );
+  const proof = withMutationLock(
+    "Prove stopped app replacement",
+    identity2.repoPath,
+    () => captureManagedAppReplacementProof(state)
+  );
+  if (!(0, import_node_util13.isDeepStrictEqual)(readReliabilityOperation(identity2), record6))
+    throw new Error("Stopped replacement generation changed during preflight.");
+  return { stoppedFence: reliabilityFence(record6.state), preflightSha256: proof.digest };
+}
 function prepareManagedLifecycleOperation(input2) {
   if (input2.kind === "exec" ? !Array.isArray(input2.command) || input2.command.length === 0 || input2.command.some((arg) => typeof arg !== "string" || arg.includes("\0")) : input2.command !== void 0)
     throw new Error("Invalid managed operation command.");
@@ -19616,6 +19895,9 @@ async function superviseLifecycle(kind, repoPath, options = {}, command, hooks =
     provider: resolveWorkspaceRuntimeOrDefault(repoPath)
   };
   const ids2 = newLifecycleIds();
+  if (options.replaceApp && kind !== "ensure")
+    throw new Error("App replacement is an ensure intent.");
+  const replacement = preflightAppReplacement(identity2, options);
   const copiedOptions = { ...options };
   if (kind === "ensure") assertFreshBootstrapRequest(identity2, options);
   const copiedCommand = command ? [...command] : void 0;
@@ -19741,6 +20023,7 @@ async function superviseLifecycle(kind, repoPath, options = {}, command, hooks =
             ...ids2,
             fence: { ...expectedFence },
             options: copiedOptions,
+            ...replacement ? { replacement } : {},
             ...copiedCommand ? { command: copiedCommand } : {},
             ...retainedExecProof ? { retainedExecProof } : {},
             admission: {
@@ -19901,7 +20184,7 @@ async function superviseThroughController(input2) {
   try {
     const bind = () => observeControllerBinding(directory, {
       path: input2.repoPath,
-      session: (0, import_node_crypto26.randomUUID)(),
+      session: (0, import_node_crypto27.randomUUID)(),
       profile: input2.profile ?? "full",
       // The protocol requires at least one readiness selector, and every
       // supervised operation depends on runtime readiness; "runtime" is the
@@ -20057,11 +20340,11 @@ function bindLifecycleCapacity(request2, binding, directory = import_node_path48
       stepRecord(record6, { ...request2.fence, type: "admission", result: "admitted" });
   });
 }
-var import_node_crypto26, import_node_path48, import_node_util13, activeWorker, lockHeld, BUSY_LIFECYCLE_WAIT_MS, BUSY_LIFECYCLE_POLL_MS, CAPACITY_CLIENT_WAIT_MS, BUSY_LIFECYCLE_PROGRESS_MS;
+var import_node_crypto27, import_node_path48, import_node_util13, activeWorker, lockHeld, BUSY_LIFECYCLE_WAIT_MS, BUSY_LIFECYCLE_POLL_MS, CAPACITY_CLIENT_WAIT_MS, BUSY_LIFECYCLE_PROGRESS_MS;
 var init_reliability_lifecycle = __esm({
   "src/core/reliability-lifecycle.ts"() {
     "use strict";
-    import_node_crypto26 = require("crypto");
+    import_node_crypto27 = require("crypto");
     import_node_path48 = __toESM(require("path"));
     import_node_util13 = require("util");
     init_capacity_accounting();
@@ -20083,6 +20366,7 @@ var init_reliability_lifecycle = __esm({
     init_managed_post_start();
     init_managed_runtime_state();
     init_managed_stop_recovery();
+    init_network_claim_lookup();
     init_recovery_budget();
     init_reliability_context();
     init_reliability_contract();
@@ -20444,7 +20728,7 @@ var init_capacity_startup_witness = __esm({
 function readHostWakeEpoch(platform = process.platform) {
   if (platform !== "darwin") return void 0;
   try {
-    const result = (0, import_node_child_process34.spawnSync)("/usr/sbin/sysctl", ["-n", "kern.wake_abs_time"], {
+    const result = (0, import_node_child_process35.spawnSync)("/usr/sbin/sysctl", ["-n", "kern.wake_abs_time"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       timeout: 250,
@@ -20459,11 +20743,11 @@ function readHostWakeEpoch(platform = process.platform) {
     return null;
   }
 }
-var import_node_child_process34;
+var import_node_child_process35;
 var init_host_wake = __esm({
   "src/core/host-wake.ts"() {
     "use strict";
-    import_node_child_process34 = require("child_process");
+    import_node_child_process35 = require("child_process");
   }
 });
 
@@ -20689,7 +20973,7 @@ function createCapacityController(options) {
     controller,
     policyRevision: policy.revision
   });
-  const payloadKey = (0, import_node_crypto27.randomBytes)(32);
+  const payloadKey = (0, import_node_crypto28.randomBytes)(32);
   const acceptedPayloads = /* @__PURE__ */ new Map();
   const settlePreparations = () => {
     if (lifetime.signal.aborted) return;
@@ -20853,7 +21137,7 @@ function createCapacityController(options) {
           {
             ...charge,
             operationId: prepared.operationId,
-            reservationId: (0, import_node_crypto27.randomUUID)(),
+            reservationId: (0, import_node_crypto28.randomUUID)(),
             policyRevision: target.current.revision
           },
           {
@@ -20957,7 +21241,7 @@ function createCapacityController(options) {
           throw error;
         }
       }
-      const signature = (0, import_node_crypto27.createHmac)("sha256", payloadKey).update(
+      const signature = (0, import_node_crypto28.createHmac)("sha256", payloadKey).update(
         JSON.stringify({
           repoPath: identity2.repoPath,
           profile: environment.profile,
@@ -20978,7 +21262,7 @@ function createCapacityController(options) {
             {
               ...charge,
               operationId: prepared.operationId,
-              reservationId: (0, import_node_crypto27.randomUUID)(),
+              reservationId: (0, import_node_crypto28.randomUUID)(),
               policyRevision: current.revision
             },
             { estimates: resolved2.estimates, enrollment: resolved2.enrollment, pool }
@@ -21113,7 +21397,7 @@ function createCapacityController(options) {
           // the budget module then falls back to the conservative wall duration.
           activeElapsedMs: null,
           profile: environment.profile,
-          incidentId: `incident-${(0, import_node_crypto27.randomUUID)()}`
+          incidentId: `incident-${(0, import_node_crypto28.randomUUID)()}`
         });
       } catch {
         return;
@@ -21131,7 +21415,7 @@ function createCapacityController(options) {
           {
             ...charge,
             operationId: prepared.operationId,
-            reservationId: (0, import_node_crypto27.randomUUID)(),
+            reservationId: (0, import_node_crypto28.randomUUID)(),
             policyRevision: current.revision
           },
           { estimates: resolved2.estimates, enrollment: resolved2.enrollment, pool }
@@ -21151,11 +21435,11 @@ function createCapacityController(options) {
     }
   };
 }
-var import_node_crypto27, import_node_path49, import_node_util15;
+var import_node_crypto28, import_node_path49, import_node_util15;
 var init_capacity_controller = __esm({
   "src/core/capacity-controller.ts"() {
     "use strict";
-    import_node_crypto27 = require("crypto");
+    import_node_crypto28 = require("crypto");
     import_node_path49 = __toESM(require("path"));
     import_node_util15 = require("util");
     init_capacity_accounting();
@@ -21253,7 +21537,7 @@ printf '%s %s %s\n' "$pid" "$birth" "$fingerprint"
 
 // src/core/controller-observation.ts
 function digest2(value) {
-  return (0, import_node_crypto28.createHash)("sha256").update(JSON.stringify(value)).digest("hex");
+  return (0, import_node_crypto29.createHash)("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function readRoutes() {
   return readHostRouteStateReadOnly((file) => readControllerEvidence(file, 1048576));
@@ -21337,7 +21621,7 @@ function createControllerObservationCollector(resolve, fingerprint) {
       () => persisted.contents[3]
     );
     const source = parseDevcontainerConfig(persisted.contents[4], sourcePath);
-    if (!state || state.devpodId !== environment.providerId || state.profile !== environment.profile || typeof source.service !== "string" || !source.service || (0, import_node_crypto28.createHash)("sha256").update(persisted.contents[4]).digest("hex") !== state.sourceConfigSha256 || (0, import_node_crypto28.createHash)("sha256").update(persisted.contents[5]).digest("hex") !== state.effectiveConfigSha256)
+    if (!state || state.devpodId !== environment.providerId || state.profile !== environment.profile || typeof source.service !== "string" || !source.service || (0, import_node_crypto29.createHash)("sha256").update(persisted.contents[4]).digest("hex") !== state.sourceConfigSha256 || (0, import_node_crypto29.createHash)("sha256").update(persisted.contents[5]).digest("hex") !== state.effectiveConfigSha256)
       throw new ControllerObservationBindingChanged("Observation retained configuration changed.");
     const identity2 = {
       repoPath: environment.repoPath,
@@ -21512,11 +21796,11 @@ function createControllerObservationCollector(resolve, fingerprint) {
     };
   };
 }
-var import_node_crypto28, import_node_path50, OBSERVATION_INSPECT_TEMPLATE;
+var import_node_crypto29, import_node_path50, OBSERVATION_INSPECT_TEMPLATE;
 var init_controller_observation = __esm({
   "src/core/controller-observation.ts"() {
     "use strict";
-    import_node_crypto28 = require("crypto");
+    import_node_crypto29 = require("crypto");
     import_node_path50 = __toESM(require("path"));
     init_controller_binding();
     init_controller_monitor();
@@ -21541,11 +21825,11 @@ var init_controller_observation = __esm({
 });
 
 // src/core/controller-sessions.ts
-var import_node_crypto29, import_node_util16, ControllerSessions;
+var import_node_crypto30, import_node_util16, ControllerSessions;
 var init_controller_sessions = __esm({
   "src/core/controller-sessions.ts"() {
     "use strict";
-    import_node_crypto29 = require("crypto");
+    import_node_crypto30 = require("crypto");
     import_node_util16 = require("util");
     ControllerSessions = class {
       constructor(store, readWakeEpoch = () => void 0) {
@@ -21739,7 +22023,7 @@ var init_controller_sessions = __esm({
         const session = {
           id: id5,
           environmentId: environment.id,
-          generation: (0, import_node_crypto29.randomUUID)(),
+          generation: (0, import_node_crypto30.randomUUID)(),
           requirements: required,
           renewedAtMs: wall,
           parkingConsent: "protected",
@@ -21767,7 +22051,7 @@ var init_controller_sessions = __esm({
         const session = {
           id: previous.session,
           environmentId: environment.id,
-          generation: (0, import_node_crypto29.randomUUID)(),
+          generation: (0, import_node_crypto30.randomUUID)(),
           requirements: required,
           renewedAtMs: wall,
           parkingConsent: "protected",
@@ -21932,21 +22216,21 @@ function privateDirectory2(directory) {
   for (const part of absolute2.slice(current.length).split(import_node_path51.default.sep)) {
     current = import_node_path51.default.join(current, part);
     try {
-      const stat2 = import_node_fs40.default.lstatSync(current);
+      const stat2 = import_node_fs41.default.lstatSync(current);
       if (!stat2.isDirectory() || stat2.isSymbolicLink())
         throw new Error("Unsafe controller directory.");
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
-      import_node_fs40.default.mkdirSync(current, { mode: 448 });
+      import_node_fs41.default.mkdirSync(current, { mode: 448 });
     }
   }
-  const stat = import_node_fs40.default.lstatSync(absolute2);
+  const stat = import_node_fs41.default.lstatSync(absolute2);
   if (stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0)
     throw new Error("Controller directory is not private.");
 }
 function validateOwnedFile(file, socket) {
   try {
-    const stat = import_node_fs40.default.lstatSync(file);
+    const stat = import_node_fs41.default.lstatSync(file);
     if (stat.uid !== process.getuid?.() || (socket ? !stat.isSocket() : !stat.isFile()) || (stat.mode & 63) !== 0)
       throw new Error("Unsafe controller artifact.");
     return true;
@@ -21971,7 +22255,7 @@ async function runController(options) {
   privateDirectory2(options.directory);
   const lockPath = import_node_path51.default.join(options.directory, "owner.lock");
   try {
-    const stat = import_node_fs40.default.lstatSync(lockPath);
+    const stat = import_node_fs41.default.lstatSync(lockPath);
     if (!stat.isFile() || stat.uid !== process.getuid?.())
       throw new Error("Unsafe controller owner lock.");
   } catch (error) {
@@ -21982,7 +22266,7 @@ async function runController(options) {
   await withFileLock(lockPath, { activity: "controller ownership", waitMs: 0 }, async () => {
     const staleSocket = validateOwnedFile(socketPath, true);
     const sessions = new ControllerSessions(store, options.wakeEpoch ?? readHostWakeEpoch);
-    if (staleSocket) import_node_fs40.default.unlinkSync(socketPath);
+    if (staleSocket) import_node_fs41.default.unlinkSync(socketPath);
     const incarnation = sessions.read();
     const { resolve, collect } = options.createBindings?.(store.bindingFingerprint()) ?? {
       resolve: options.resolve,
@@ -22528,7 +22812,7 @@ async function runController(options) {
           resolve2();
         });
       });
-      import_node_fs40.default.chmodSync(socketPath, 384);
+      import_node_fs41.default.chmodSync(socketPath, 384);
       await new Promise((resolve2) => {
         finish = resolve2;
         options.signal.addEventListener("abort", shutdown, { once: true });
@@ -22547,11 +22831,11 @@ async function runController(options) {
     }
   });
 }
-var import_node_fs40, import_node_net4, import_node_path51, FRAME_BYTES;
+var import_node_fs41, import_node_net4, import_node_path51, FRAME_BYTES;
 var init_controller_server = __esm({
   "src/core/controller-server.ts"() {
     "use strict";
-    import_node_fs40 = __toESM(require("fs"));
+    import_node_fs41 = __toESM(require("fs"));
     import_node_net4 = __toESM(require("net"));
     import_node_path51 = __toESM(require("path"));
     init_controller_monitor();
@@ -22838,27 +23122,27 @@ function replaceDevrouterSection(content) {
 }
 function writeRepoFile(repoPath, relPath, content) {
   const absolutePath = (0, import_node_path54.join)(repoPath, relPath);
-  (0, import_node_fs41.mkdirSync)((0, import_node_path54.dirname)(absolutePath), { recursive: true });
-  (0, import_node_fs41.writeFileSync)(absolutePath, content, "utf-8");
+  (0, import_node_fs42.mkdirSync)((0, import_node_path54.dirname)(absolutePath), { recursive: true });
+  (0, import_node_fs42.writeFileSync)(absolutePath, content, "utf-8");
   return absolutePath;
 }
 function ensureAgentsMdSection(repoPath) {
   const filePath = (0, import_node_path54.join)(repoPath, AGENTS_MD);
-  if ((0, import_node_fs41.existsSync)(filePath)) {
-    const content = (0, import_node_fs41.readFileSync)(filePath, "utf-8");
+  if ((0, import_node_fs42.existsSync)(filePath)) {
+    const content = (0, import_node_fs42.readFileSync)(filePath, "utf-8");
     if (content.includes(DEVROUTER_SENTINEL)) {
       const updated = replaceDevrouterSection(content);
       if (updated === void 0 || updated === content) return { path: filePath, written: false };
-      (0, import_node_fs41.writeFileSync)(filePath, updated, "utf-8");
+      (0, import_node_fs42.writeFileSync)(filePath, updated, "utf-8");
       return { path: filePath, written: true };
     }
-    (0, import_node_fs41.writeFileSync)(filePath, `${content.trimEnd()}
+    (0, import_node_fs42.writeFileSync)(filePath, `${content.trimEnd()}
 
 ${buildDevrouterSection()}
 `, "utf-8");
     return { path: filePath, written: true };
   }
-  (0, import_node_fs41.writeFileSync)(filePath, `# AGENTS.md
+  (0, import_node_fs42.writeFileSync)(filePath, `# AGENTS.md
 
 ${buildDevrouterSection()}
 `, "utf-8");
@@ -22868,11 +23152,11 @@ function ensureSkillFile(repoPath) {
   const filePath = writeRepoFile(repoPath, DEVROUTER_SKILL_REL_PATH, DEVROUTER_SKILL_CONTENT);
   return { path: filePath, written: true };
 }
-var import_node_fs41, import_node_path54, DEVROUTER_SENTINEL, DEVROUTER_END_SENTINEL, LEGACY_DEVROUTER_SECTION_END, AGENTS_MD, DEVROUTER_SKILL_REL_PATH, DEVROUTER_SKILL_CONTENT;
+var import_node_fs42, import_node_path54, DEVROUTER_SENTINEL, DEVROUTER_END_SENTINEL, LEGACY_DEVROUTER_SECTION_END, AGENTS_MD, DEVROUTER_SKILL_REL_PATH, DEVROUTER_SKILL_CONTENT;
 var init_agents_md = __esm({
   "src/core/agents-md.ts"() {
     "use strict";
-    import_node_fs41 = require("fs");
+    import_node_fs42 = require("fs");
     import_node_path54 = require("path");
     DEVROUTER_SENTINEL = "<!-- devrouter -->";
     DEVROUTER_END_SENTINEL = "<!-- /devrouter -->";
@@ -23495,7 +23779,9 @@ function buildOnboardingPrompt(options = {}) {
     "- Managed process reuse fingerprints command argv, workspace identity, and the exact adapter snapshot. Variant and current host-port identity always compose with an explicit --fingerprint. If a non-secret runtime value also affects reuse, set `DEVROUTER_PROCESS_FINGERPRINT_ENV` to its comma-separated environment names; secret-like names are rejected and raw values are never persisted.",
     "- Managed adapters may use devrouter-process ensure --prepare-command <command> for synchronous dependency preparation under the process lock before app launch. Unchanged owned processes skip preparation; it participates in default fingerprints and must not daemonize or detach.",
     "- Host-generated Compose inputs may use managedRuntime.devcontainer.prepareCommand as literal argv. Ensure runs it once from the checkout root before Compose inspection, with a 60-second bound and no implicit shell. Keep .devrouter.yml unchanged. Diagnostics never run it; changed warm mounts require separate verification.",
-    "- Explicit first initialization: managedRuntime.devcontainer.freshBootstrap declares literal command argv, dataVolumes and optional sharedCaches keys. ensure <new-checkout> --initialize-new requires qualified Devsy 1.19.0, new local data volumes and repository-owned database identity/emptiness checks. A durable attempt prevents replay after failure, unknown completion, cancellation, stop, replacement or settlement. Ordinary hooks must preserve data. Consult docs/DEVCONTAINER.md for context and mount prerequisites; never clear the attempt fence or infer reset authority.",
+    "- Explicit retained replacement: after canonical stop, ensure <checkout> --replace-app replaces only the proved primary writable layer. It requires manual Devsy 1.24.0, committed unchanged managed source, qualified preserving hooks, a retained dependency and named storage. Anonymous mounts, namespace consumers, allocated networks and capacity enrollment refuse. One durable attempt survives cancellation, stop and rollover; never clear it or retry through a raw provider. Proved stop/stop --repair retains data. This does not apply changed Compose overlays.",
+    "- Lifecycle journal compatibility: older CLIs refuse records written by a newer release, including stop and global enumeration. Never edit a writer stamp or durable receipt to bypass refusal.",
+    "- Explicit first initialization: managedRuntime.devcontainer.freshBootstrap declares literal command argv, dataVolumes and optional sharedCaches keys. ensure <new-checkout> --initialize-new requires qualified Devsy 1.19.0 or 1.24.0, new local data volumes and repository-owned database identity/emptiness checks. A durable attempt prevents replay after failure, unknown completion, cancellation, stop, replacement or settlement. Ordinary hooks must preserve data. Consult docs/DEVCONTAINER.md for context and mount prerequisites; never clear the attempt fence or infer reset authority.",
     "- Managed Devsy startup on supported local Unix Docker endpoints captures exact stop ownership before application readiness. With that baseline, canonical stop tolerates changed or missing repository configuration and preserves containers and volumes. Older records without a baseline retain configuration-dependent stop; installing a new CLI does not establish historical ownership. Invalid or changed ownership never falls back. Do not replay destructive bootstrap hooks to obtain a baseline.",
     "- Owner status is `present`, `missing`, `locked`, or `conflict`. Dirty or locked full down fails before side effects. `workspace gc` is a dry run; only `--yes` deletes exact eligible missing resources and records, never Git worktrees, branches, or prune state.",
     "- `devrouter workspace cleanup --repo . --inactive-for 30d --check-merged --json` is report-only and never mutates the workspace runtime, routes, ownership, Git, Docker, applications, worktrees, or branches. It reports ownership, workspace runtime registration, runtime state (`running|stopped|busy|not-found|absent|unknown`), checkout, advisory activity, route, and integration evidence. Local DevPod/Devsy list/status checks always run; `--check-merged` alone enables read-only origin and matching GitHub/GitLab checks. Treat `not-found` as stale runtime after Docker pruning; busy, unavailable, or conflicting evidence suppresses destructive suggestions. Explicit `gc`/`down` can remove exact stale registration only after expected-ID `NotFound` proof and ownership revalidation. Runtime `lastUsed` remains advisory.",
@@ -23665,7 +23951,7 @@ var init_ai_prompt = __esm({
         purpose: "Write/update devrouter section in the repo's AGENTS.md and install the devrouter skill."
       },
       {
-        command: "devrouter ensure [path] [--profile <name>] [--variant <name>] [--repair | --initialize-new] [--open] [--json]",
+        command: "devrouter ensure [path] [--profile <name>] [--variant <name>] [--repair | --initialize-new | --replace-app] [--open] [--json]",
         purpose: "Canonical startup and proof for an exact primary or linked checkout; atomically publishes routes after readiness."
       },
       {
@@ -24383,11 +24669,11 @@ function extractCurrentVersionFromRepoConfig(repoPath) {
   };
 }
 function readPromptDirectory(promptDirPath) {
-  if (!import_node_fs42.default.existsSync(promptDirPath)) {
+  if (!import_node_fs43.default.existsSync(promptDirPath)) {
     throw new Error(`Missing ${UPGRADE_PROMPTS_DIR} directory at ${promptDirPath}.`);
   }
   const releases = [];
-  const files = import_node_fs42.default.readdirSync(promptDirPath, { withFileTypes: true });
+  const files = import_node_fs43.default.readdirSync(promptDirPath, { withFileTypes: true });
   for (const file of files) {
     if (!file.isFile() || !file.name.endsWith(".md")) {
       continue;
@@ -24398,7 +24684,7 @@ function readPromptDirectory(promptDirPath) {
     }
     const version = normalizeVersion(basename);
     const promptPath = import_node_path55.default.join(promptDirPath, file.name);
-    const prompt = import_node_fs42.default.readFileSync(promptPath, "utf-8").trim();
+    const prompt = import_node_fs43.default.readFileSync(promptPath, "utf-8").trim();
     releases.push({ version, prompt, promptPath });
   }
   const deduped = /* @__PURE__ */ new Map();
@@ -24423,7 +24709,7 @@ function resolvePromptDirectory(explicitPath) {
   }
   const entryFile = process.argv[1] ? import_node_path55.default.resolve(process.argv[1]) : __filename;
   const entryDir = import_node_path55.default.dirname(entryFile);
-  const resolvedEntryDir = import_node_fs42.default.existsSync(entryFile) ? import_node_path55.default.dirname(import_node_fs42.default.realpathSync(entryFile)) : entryDir;
+  const resolvedEntryDir = import_node_fs43.default.existsSync(entryFile) ? import_node_path55.default.dirname(import_node_fs43.default.realpathSync(entryFile)) : entryDir;
   const candidates = [
     import_node_path55.default.resolve(resolvedEntryDir, "..", UPGRADE_PROMPTS_DIR),
     import_node_path55.default.resolve(entryDir, "..", UPGRADE_PROMPTS_DIR),
@@ -24431,7 +24717,7 @@ function resolvePromptDirectory(explicitPath) {
     import_node_path55.default.resolve(__dirname, "..", "..", UPGRADE_PROMPTS_DIR),
     import_node_path55.default.resolve(process.cwd(), UPGRADE_PROMPTS_DIR)
   ];
-  const existing = candidates.find((candidate) => import_node_fs42.default.existsSync(candidate));
+  const existing = candidates.find((candidate) => import_node_fs43.default.existsSync(candidate));
   return existing ?? candidates[0];
 }
 function loadUpgradeCatalog(options = {}) {
@@ -24447,11 +24733,11 @@ function loadUpgradeCatalog(options = {}) {
     releases
   };
 }
-var import_node_fs42, import_node_path55, SEMVER_RE, UPGRADE_PROMPTS_DIR;
+var import_node_fs43, import_node_path55, SEMVER_RE, UPGRADE_PROMPTS_DIR;
 var init_upgrade = __esm({
   "src/core/upgrade.ts"() {
     "use strict";
-    import_node_fs42 = __toESM(require("fs"));
+    import_node_fs43 = __toESM(require("fs"));
     import_node_path55 = __toESM(require("path"));
     init_repo_config();
     SEMVER_RE = /^v?(\d+)\.(\d+)\.(\d+)$/;
@@ -24605,7 +24891,7 @@ function isLoopbackHost(host) {
   return host === "127.0.0.1" || host === "localhost" || host === "host.docker.internal";
 }
 function inspectCompose(composeFile, _workspace) {
-  if (!import_node_fs43.default.existsSync(composeFile)) {
+  if (!import_node_fs44.default.existsSync(composeFile)) {
     return {
       aliases: [],
       publishedPorts: [],
@@ -24614,7 +24900,7 @@ function inspectCompose(composeFile, _workspace) {
     };
   }
   try {
-    const raw = import_node_fs43.default.readFileSync(composeFile, "utf-8");
+    const raw = import_node_fs44.default.readFileSync(composeFile, "utf-8");
     const parsed = import_yaml6.default.parse(raw);
     const root = asRecord(parsed);
     const services = asRecord(root?.services);
@@ -24712,7 +24998,7 @@ function buildHostPortClaimsCheck(repoPath, workspace) {
 }
 function buildDevcontainerChecks(repoPath, config, workspace) {
   const devcontainerDir = import_node_path56.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs43.default.existsSync(devcontainerDir)) {
+  if (!import_node_fs44.default.existsSync(devcontainerDir)) {
     return [];
   }
   const compose = inspectCompose(import_node_path56.default.join(devcontainerDir, "docker-compose.yml"), workspace);
@@ -24743,8 +25029,8 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
     suggestion: compose.parseError || compose.publishedPorts.length > 0 ? "Remove published ports and route services through devnet aliases with devrouter proxy apps." : void 0
   });
   const dockerfilePath = import_node_path56.default.join(devcontainerDir, "Dockerfile");
-  const dockerfileExists = import_node_fs43.default.existsSync(dockerfilePath);
-  const dockerfile = dockerfileExists ? import_node_fs43.default.readFileSync(dockerfilePath, "utf-8") : "";
+  const dockerfileExists = import_node_fs44.default.existsSync(dockerfilePath);
+  const dockerfile = dockerfileExists ? import_node_fs44.default.readFileSync(dockerfilePath, "utf-8") : "";
   const devrouterArtifacts = ["@devrouter/cli", "devrouter-process"].filter(
     (artifact) => dockerfile.includes(artifact)
   );
@@ -24802,11 +25088,11 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
   });
   return checks;
 }
-var import_node_fs43, import_node_path56, import_yaml6;
+var import_node_fs44, import_node_path56, import_yaml6;
 var init_devcontainer_diagnostics = __esm({
   "src/core/devcontainer-diagnostics.ts"() {
     "use strict";
-    import_node_fs43 = __toESM(require("fs"));
+    import_node_fs44 = __toESM(require("fs"));
     import_node_path56 = __toESM(require("path"));
     import_yaml6 = __toESM(require("yaml"));
     init_devcontainer_profile();
@@ -24903,11 +25189,11 @@ function reconcileRouteRunConflict(repoPath, app) {
     }
   }
 }
-var import_node_fs44;
+var import_node_fs45;
 var init_route_state = __esm({
   "src/core/route-state.ts"() {
     "use strict";
-    import_node_fs44 = __toESM(require("fs"));
+    import_node_fs45 = __toESM(require("fs"));
     init_host_routes();
     init_workspace();
   }
@@ -25082,7 +25368,7 @@ function toRepoStatus(repoPath) {
   const resolvedRepoPath = resolveRepoPath(repoPath);
   const configPath = getRepoConfigPath(resolvedRepoPath);
   const explicitRepo = typeof repoPath === "string" && repoPath.trim().length > 0;
-  const configExists = import_node_fs45.default.existsSync(configPath);
+  const configExists = import_node_fs46.default.existsSync(configPath);
   if (!explicitRepo && !configExists) {
     return void 0;
   }
@@ -25235,11 +25521,11 @@ async function collectRouterStatus(repoPath) {
     }
   };
 }
-var import_node_fs45;
+var import_node_fs46;
 var init_status = __esm({
   "src/core/status.ts"() {
     "use strict";
-    import_node_fs45 = __toESM(require("fs"));
+    import_node_fs46 = __toESM(require("fs"));
     init_docker();
     init_managed_runtime_state();
     init_managed_runtime_status();
@@ -25301,14 +25587,14 @@ ${env}
 function readInstalledIdleFor(plistPath) {
   let contents;
   try {
-    contents = import_node_fs46.default.readFileSync(plistPath, "utf-8");
+    contents = import_node_fs47.default.readFileSync(plistPath, "utf-8");
   } catch {
     return void 0;
   }
   return /<string>--idle-for<\/string>\s*<string>([^<]+)<\/string>/.exec(contents)?.[1] ?? "unknown";
 }
 function locateTool(name) {
-  const result = (0, import_node_child_process35.spawnSync)("/bin/sh", ["-c", `command -v ${name}`], { encoding: "utf-8" });
+  const result = (0, import_node_child_process36.spawnSync)("/bin/sh", ["-c", `command -v ${name}`], { encoding: "utf-8" });
   const found = result.status === 0 ? result.stdout.trim() : "";
   return found.startsWith("/") ? found : void 0;
 }
@@ -25334,9 +25620,9 @@ function installIdleSweep(input2) {
     throw new Error("The idle sweep uses launchd and is only available on macOS.");
   const paths = input2.paths ?? idleSweepPaths();
   const launchctl = input2.launchctl ?? defaultLaunchctl;
-  const entryPath = input2.entryPath ?? import_node_fs46.default.realpathSync(process.argv[1]);
-  import_node_fs46.default.mkdirSync(paths.directory, { recursive: true, mode: 448 });
-  import_node_fs46.default.mkdirSync(import_node_path57.default.dirname(paths.plist), { recursive: true });
+  const entryPath = input2.entryPath ?? import_node_fs47.default.realpathSync(process.argv[1]);
+  import_node_fs47.default.mkdirSync(paths.directory, { recursive: true, mode: 448 });
+  import_node_fs47.default.mkdirSync(import_node_path57.default.dirname(paths.plist), { recursive: true });
   const contents = renderIdleSweepPlist({
     nodePath: process.execPath,
     entryPath,
@@ -25345,7 +25631,7 @@ function installIdleSweep(input2) {
     logPath: paths.log
   });
   launchctl(["bootout", `${launchDomain()}/${IDLE_SWEEP_LABEL}`]);
-  import_node_fs46.default.writeFileSync(paths.plist, contents, { mode: 420 });
+  import_node_fs47.default.writeFileSync(paths.plist, contents, { mode: 420 });
   const loaded = launchctl(["bootstrap", launchDomain(), paths.plist]);
   if (loaded.status !== 0)
     throw new Error(
@@ -25355,9 +25641,9 @@ function installIdleSweep(input2) {
 }
 function removeIdleSweep(input2 = {}) {
   const paths = input2.paths ?? idleSweepPaths();
-  if (!import_node_fs46.default.existsSync(paths.plist)) return false;
+  if (!import_node_fs47.default.existsSync(paths.plist)) return false;
   (input2.launchctl ?? defaultLaunchctl)(["bootout", `${launchDomain()}/${IDLE_SWEEP_LABEL}`]);
-  import_node_fs46.default.rmSync(paths.plist, { force: true });
+  import_node_fs47.default.rmSync(paths.plist, { force: true });
   return true;
 }
 function summarizeSweep(idleFor, stops, error) {
@@ -25372,13 +25658,13 @@ function summarizeSweep(idleFor, stops, error) {
   };
 }
 function writeLastSweep(record6, paths = idleSweepPaths()) {
-  import_node_fs46.default.mkdirSync(paths.directory, { recursive: true, mode: 448 });
-  import_node_fs46.default.writeFileSync(paths.lastSweep, `${JSON.stringify(record6, null, 2)}
+  import_node_fs47.default.mkdirSync(paths.directory, { recursive: true, mode: 448 });
+  import_node_fs47.default.writeFileSync(paths.lastSweep, `${JSON.stringify(record6, null, 2)}
 `, { mode: 384 });
 }
 function readLastSweep(paths) {
   try {
-    return JSON.parse(import_node_fs46.default.readFileSync(paths.lastSweep, "utf-8"));
+    return JSON.parse(import_node_fs47.default.readFileSync(paths.lastSweep, "utf-8"));
   } catch {
     return void 0;
   }
@@ -25423,12 +25709,12 @@ function idleSweepCheck(paths = idleSweepPaths(), nowMs = Date.now()) {
     ...stale || last.failed > 0 ? { suggestion: `Inspect: ${paths.log}` } : {}
   };
 }
-var import_node_child_process35, import_node_fs46, import_node_os7, import_node_path57, IDLE_SWEEP_LABEL, SWEEP_INTERVAL_SECONDS, SYSTEM_PATH, defaultLaunchctl;
+var import_node_child_process36, import_node_fs47, import_node_os7, import_node_path57, IDLE_SWEEP_LABEL, SWEEP_INTERVAL_SECONDS, SYSTEM_PATH, defaultLaunchctl;
 var init_idle_sweep = __esm({
   "src/core/idle-sweep.ts"() {
     "use strict";
-    import_node_child_process35 = require("child_process");
-    import_node_fs46 = __toESM(require("fs"));
+    import_node_child_process36 = require("child_process");
+    import_node_fs47 = __toESM(require("fs"));
     import_node_os7 = __toESM(require("os"));
     import_node_path57 = __toESM(require("path"));
     init_router();
@@ -25436,7 +25722,7 @@ var init_idle_sweep = __esm({
     SWEEP_INTERVAL_SECONDS = 300;
     SYSTEM_PATH = ["/usr/bin", "/bin", "/usr/sbin", "/sbin"];
     defaultLaunchctl = (args) => {
-      const result = (0, import_node_child_process35.spawnSync)("launchctl", args, { encoding: "utf-8" });
+      const result = (0, import_node_child_process36.spawnSync)("launchctl", args, { encoding: "utf-8" });
       return { status: result.status, stderr: result.stderr || result.error?.message || "" };
     };
   }
@@ -25450,7 +25736,7 @@ function outputFromResult(result) {
   return output2.length > 0 ? output2 : void 0;
 }
 function runTool(command, args = []) {
-  const result = (0, import_node_child_process36.spawnSync)(command, args, {
+  const result = (0, import_node_child_process37.spawnSync)(command, args, {
     encoding: "utf-8"
   });
   if (result.error) {
@@ -25508,11 +25794,11 @@ function parseMinimumNodeMajor(value) {
 }
 function readPackageJson(repoPath) {
   const packagePath = import_node_path58.default.join(repoPath, "package.json");
-  if (!import_node_fs47.default.existsSync(packagePath)) {
+  if (!import_node_fs48.default.existsSync(packagePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs47.default.readFileSync(packagePath, "utf-8"));
+    return JSON.parse(import_node_fs48.default.readFileSync(packagePath, "utf-8"));
   } catch {
     return void 0;
   }
@@ -25617,17 +25903,17 @@ function realpathOrUndefined(value) {
     return void 0;
   }
   try {
-    return import_node_fs47.default.realpathSync(value);
+    return import_node_fs48.default.realpathSync(value);
   } catch {
     return void 0;
   }
 }
 function isExecutableFile(filePath) {
   try {
-    if (!import_node_fs47.default.statSync(filePath).isFile()) {
+    if (!import_node_fs48.default.statSync(filePath).isFile()) {
       return false;
     }
-    import_node_fs47.default.accessSync(filePath, import_node_fs47.default.constants.X_OK);
+    import_node_fs48.default.accessSync(filePath, import_node_fs48.default.constants.X_OK);
     return true;
   } catch {
     return false;
@@ -25641,7 +25927,7 @@ function displayPath(filePath) {
   return `~${filePath.slice(home.length)}`;
 }
 function probeInstalledCliVersion(executable) {
-  const result = (0, import_node_child_process36.spawnSync)(executable, ["-V"], {
+  const result = (0, import_node_child_process37.spawnSync)(executable, ["-V"], {
     encoding: "utf-8",
     timeout: CLI_PATH_PROBE_TIMEOUT_MS
   });
@@ -25652,7 +25938,7 @@ function probeInstalledCliVersion(executable) {
 }
 function buildCliPathCheck(options = {}) {
   const id5 = "global.cli-path";
-  const runningVersion = options.runningVersion ?? (true ? "0.6.2" : "0.0.0-dev");
+  const runningVersion = options.runningVersion ?? (true ? "0.6.4" : "0.0.0-dev");
   if (runningVersion === "0.0.0-dev") {
     return {
       id: id5,
@@ -25826,12 +26112,12 @@ function buildGlobalToolChecksWithoutTelemetry(repoPath) {
   checks.push(nodeToolchainCheck(repoPath));
   return checks;
 }
-var import_node_child_process36, import_node_fs47, import_node_path58, DEVSY_DISABLE_TELEMETRY, CLI_PATH_PROBE_TIMEOUT_MS, INSTALLED_CLI_VERSION_RE;
+var import_node_child_process37, import_node_fs48, import_node_path58, DEVSY_DISABLE_TELEMETRY, CLI_PATH_PROBE_TIMEOUT_MS, INSTALLED_CLI_VERSION_RE;
 var init_tool_diagnostics = __esm({
   "src/core/tool-diagnostics.ts"() {
     "use strict";
-    import_node_child_process36 = require("child_process");
-    import_node_fs47 = __toESM(require("fs"));
+    import_node_child_process37 = require("child_process");
+    import_node_fs48 = __toESM(require("fs"));
     import_node_path58 = __toESM(require("path"));
     init_devsy_agent();
     init_idle_sweep();
@@ -26182,11 +26468,11 @@ function inspectPostgresCredentials(repoPath, config) {
         parseErrors.push(`${app.name}: ${composeFile} (${message})`);
         continue;
       }
-      if (!import_node_fs48.default.existsSync(absolutePath)) {
+      if (!import_node_fs49.default.existsSync(absolutePath)) {
         continue;
       }
       try {
-        const raw = import_node_fs48.default.readFileSync(absolutePath, "utf-8");
+        const raw = import_node_fs49.default.readFileSync(absolutePath, "utf-8");
         const parsed = import_yaml7.default.parse(raw);
         const root = asRecord2(parsed);
         const services = asRecord2(root?.services);
@@ -26550,7 +26836,7 @@ async function buildDoctorReport(options = {}) {
           suggestion: `Remedy ${expansionNotice.remedy.code}: set a named default profile other than '${expansionNotice.profile}'${remedyCandidates}.`
         });
       }
-      const cliVersion = true ? "0.6.2" : "0.0.0-dev";
+      const cliVersion = true ? "0.6.4" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       const installedKnown = cliVersion !== "0.0.0-dev";
       const versionComparison = installedKnown && configVersion ? compareSemver(configVersion, cliVersion) : void 0;
@@ -26588,7 +26874,7 @@ async function buildDoctorReport(options = {}) {
           filePath,
           absolutePath: import_node_path60.default.resolve(repo.path, filePath)
         }))
-      ).filter((entry) => !import_node_fs48.default.existsSync(entry.absolutePath));
+      ).filter((entry) => !import_node_fs49.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.compose-files",
         level: missingComposeFiles.length === 0 ? "ok" : "error",
@@ -26632,7 +26918,7 @@ async function buildDoctorReport(options = {}) {
         app: app.name,
         cwd: app.hostRun.cwd,
         absolutePath: import_node_path60.default.resolve(repo.path, app.hostRun.cwd)
-      })).filter((entry) => !import_node_fs48.default.existsSync(entry.absolutePath));
+      })).filter((entry) => !import_node_fs49.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.host-cwd",
         level: missingHostCwds.length === 0 ? "ok" : "error",
@@ -26776,11 +27062,11 @@ async function buildDoctorReport(options = {}) {
     nextSteps
   };
 }
-var import_node_fs48, import_node_path60, import_yaml7, POSTGRES_DEFAULTS, CAPACITY_RECOVERY_BY_CAUSE;
+var import_node_fs49, import_node_path60, import_yaml7, POSTGRES_DEFAULTS, CAPACITY_RECOVERY_BY_CAUSE;
 var init_doctor = __esm({
   "src/core/doctor.ts"() {
     "use strict";
-    import_node_fs48 = __toESM(require("fs"));
+    import_node_fs49 = __toESM(require("fs"));
     import_node_path60 = __toESM(require("path"));
     import_yaml7 = __toESM(require("yaml"));
     init_capacity_store();
@@ -26810,6 +27096,7 @@ var init_doctor = __esm({
       "journal-directory-unsafe": "Restore private ownership and mode 0700 on the reliability journal directory, then retry.",
       "journal-directory-unreadable": "Restore read access to the reliability journal directory, then retry.",
       "journal-invalid": "Preserve the named journal entry and restore verified history before retrying admission.",
+      "journal-writer-newer": "Use the devrouter CLI that wrote the named journal or a newer version before retrying admission; preserve the journal.",
       "journal-unreadable": "Preserve the named journal entry and restore verified history before retrying admission.",
       "journal-entry-unsafe": "Restore private ownership, mode 0600 and a bounded size on the named journal entry, then retry."
     };
@@ -27177,12 +27464,12 @@ function parseSsPortListeners(stdout, port) {
   return listeners;
 }
 function findPortListeners(port) {
-  const result = (0, import_node_child_process37.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
+  const result = (0, import_node_child_process38.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process37.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process38.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsPortListeners(ssResult.stdout, port);
       }
@@ -27211,11 +27498,11 @@ function findPortListeners(port) {
     };
   });
 }
-var import_node_child_process37;
+var import_node_child_process38;
 var init_ports = __esm({
   "src/util/ports.ts"() {
     "use strict";
-    import_node_child_process37 = require("child_process");
+    import_node_child_process38 = require("child_process");
   }
 });
 
@@ -27302,6 +27589,7 @@ async function runEnsureCommand(options) {
     profile: options.profile,
     ...options.repair ? { repair: true } : {},
     ...options.initializeNew ? { initializeNew: true } : {},
+    ...options.replaceApp ? { replaceApp: true } : {},
     ...options.variant !== void 0 ? { variant: options.variant } : {}
   };
   const result = await superviseLifecycle(
@@ -27549,7 +27837,7 @@ function buildHostEnvReport(input2) {
   };
 }
 function listDevcontainerContainers(repoPath) {
-  const listed = (0, import_node_child_process38.spawnSync)(
+  const listed = (0, import_node_child_process39.spawnSync)(
     "docker",
     [
       "ps",
@@ -27570,7 +27858,7 @@ function listDevcontainerContainers(repoPath) {
   }
 }
 function dockerPortBindings(containerId, port) {
-  const result = (0, import_node_child_process38.spawnSync)("docker", ["port", containerId, `${port}/tcp`], {
+  const result = (0, import_node_child_process39.spawnSync)("docker", ["port", containerId, `${port}/tcp`], {
     encoding: "utf-8",
     ...networkDockerOptions()
   });
@@ -27685,11 +27973,11 @@ function hostEnvVariables(report, processEnv) {
   }
   return variables;
 }
-var import_node_child_process38, import_node_path61, LOOPBACK_UPSTREAM_HOSTS, ROUTED_TCP_PARAMS;
+var import_node_child_process39, import_node_path61, LOOPBACK_UPSTREAM_HOSTS, ROUTED_TCP_PARAMS;
 var init_host_env = __esm({
   "src/core/host-env.ts"() {
     "use strict";
-    import_node_child_process38 = require("child_process");
+    import_node_child_process39 = require("child_process");
     import_node_path61 = __toESM(require("path"));
     init_devcontainer_profile();
     init_devpod_environment();
@@ -27787,7 +28075,7 @@ function hostCommandEnvironment(report, processEnv) {
 }
 function runHostCommand(command, env) {
   return new Promise((resolve) => {
-    const child = (0, import_node_child_process39.spawn)(command[0], command.slice(1), { env, stdio: "inherit" });
+    const child = (0, import_node_child_process40.spawn)(command[0], command.slice(1), { env, stdio: "inherit" });
     const forward = (signal) => () => child.kill(signal);
     const handlers = [
       ["SIGINT", forward("SIGINT")],
@@ -27827,11 +28115,11 @@ async function runEnvCommand(invocation) {
   }
   process.stdout.write(formatEnvReport(report));
 }
-var import_node_child_process39, import_node_os8, HOST_PORT_ENV_PREFIX;
+var import_node_child_process40, import_node_os8, HOST_PORT_ENV_PREFIX;
 var init_env = __esm({
   "src/commands/env.ts"() {
     "use strict";
-    import_node_child_process39 = require("child_process");
+    import_node_child_process40 = require("child_process");
     import_node_os8 = require("os");
     init_host_env();
     init_managed_host_ports();
@@ -27881,7 +28169,7 @@ var init_status2 = __esm({
 
 // src/core/harness-continuation.ts
 function harnessContinuationPath(repoRoot) {
-  const key = (0, import_node_crypto30.createHash)("sha256").update(comparableWorkspacePath(repoRoot)).digest("hex");
+  const key = (0, import_node_crypto31.createHash)("sha256").update(comparableWorkspacePath(repoRoot)).digest("hex");
   return import_node_path62.default.join(DEVROUTER_HOME, "harness", `${key}.json`);
 }
 function counter4(value) {
@@ -27895,7 +28183,7 @@ function validEntry(value) {
 function readLedgerSync(file, nowMs) {
   let stat;
   try {
-    stat = import_node_fs49.default.lstatSync(file);
+    stat = import_node_fs50.default.lstatSync(file);
   } catch {
     return [];
   }
@@ -27903,7 +28191,7 @@ function readLedgerSync(file, nowMs) {
   if (stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0) return [];
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs49.default.readFileSync(file, "utf-8"));
+    parsed = JSON.parse(import_node_fs50.default.readFileSync(file, "utf-8"));
   } catch {
     return [];
   }
@@ -27923,7 +28211,7 @@ function claimHarnessContinuation(repoRoot, claim2) {
   const nowMs = claim2.nowMs ?? Date.now();
   try {
     const file = harnessContinuationPath(repoRoot);
-    import_node_fs49.default.mkdirSync(import_node_path62.default.dirname(file), { recursive: true, mode: 448 });
+    import_node_fs50.default.mkdirSync(import_node_path62.default.dirname(file), { recursive: true, mode: 448 });
     return withFileLockSync(
       `${file}.lock`,
       { activity: "harness continuation claim", waitMs: HARNESS_CONTINUATION_LOCK_WAIT_MS },
@@ -27955,7 +28243,7 @@ function settleHarnessContinuation(repoRoot, toolUseId, settlement) {
   const nowMs = settlement.nowMs ?? Date.now();
   try {
     const file = harnessContinuationPath(repoRoot);
-    import_node_fs49.default.mkdirSync(import_node_path62.default.dirname(file), { recursive: true, mode: 448 });
+    import_node_fs50.default.mkdirSync(import_node_path62.default.dirname(file), { recursive: true, mode: 448 });
     withFileLockSync(
       `${file}.lock`,
       { activity: "harness continuation settlement", waitMs: HARNESS_CONTINUATION_LOCK_WAIT_MS },
@@ -27979,12 +28267,12 @@ function settleHarnessContinuation(repoRoot, toolUseId, settlement) {
   } catch {
   }
 }
-var import_node_crypto30, import_node_fs49, import_node_path62, HARNESS_CONTINUATION_MAX_ENTRIES, HARNESS_CONTINUATION_TTL_MS, HARNESS_CONTINUATION_LOCK_WAIT_MS, MAX_LEDGER_BYTES, MAX_TOOL_USE_ID_LENGTH, MAX_PHASE_LENGTH;
+var import_node_crypto31, import_node_fs50, import_node_path62, HARNESS_CONTINUATION_MAX_ENTRIES, HARNESS_CONTINUATION_TTL_MS, HARNESS_CONTINUATION_LOCK_WAIT_MS, MAX_LEDGER_BYTES, MAX_TOOL_USE_ID_LENGTH, MAX_PHASE_LENGTH;
 var init_harness_continuation = __esm({
   "src/core/harness-continuation.ts"() {
     "use strict";
-    import_node_crypto30 = require("crypto");
-    import_node_fs49 = __toESM(require("fs"));
+    import_node_crypto31 = require("crypto");
+    import_node_fs50 = __toESM(require("fs"));
     import_node_path62 = __toESM(require("path"));
     init_atomic_file();
     init_file_lock();
@@ -28006,7 +28294,7 @@ function isTransitionalHarnessPhase(phase) {
 function findHarnessGateRepoRoot(cwd) {
   let current = import_node_path63.default.resolve(cwd);
   for (let depth = 0; depth < REPO_ROOT_MAX_DEPTH; depth += 1) {
-    if (import_node_fs50.default.existsSync(import_node_path63.default.join(current, ".devrouter.yml"))) {
+    if (import_node_fs51.default.existsSync(import_node_path63.default.join(current, ".devrouter.yml"))) {
       return current;
     }
     const parent = import_node_path63.default.dirname(current);
@@ -28101,11 +28389,11 @@ function parseHarnessGateBudget(value) {
   }
   return Math.min(Math.trunc(parsed), HARNESS_GATE_MAX_BUDGET_MS);
 }
-var import_node_fs50, import_node_path63, HARNESS_GATE_DEFAULT_BUDGET_MS, HARNESS_GATE_MAX_BUDGET_MS, HARNESS_GATE_POLL_INTERVAL_MS, TRANSITIONAL_PHASES, REPO_ROOT_MAX_DEPTH;
+var import_node_fs51, import_node_path63, HARNESS_GATE_DEFAULT_BUDGET_MS, HARNESS_GATE_MAX_BUDGET_MS, HARNESS_GATE_POLL_INTERVAL_MS, TRANSITIONAL_PHASES, REPO_ROOT_MAX_DEPTH;
 var init_harness_gate = __esm({
   "src/core/harness-gate.ts"() {
     "use strict";
-    import_node_fs50 = __toESM(require("fs"));
+    import_node_fs51 = __toESM(require("fs"));
     import_node_path63 = __toESM(require("path"));
     init_reliability_operation_store();
     init_workspace();
@@ -28365,7 +28653,7 @@ async function runHarnessCommand(method, options, repoPath, dependencies = {}) {
   }
   const budgetMs = parseHarnessGateBudget(options.waitBudgetMs);
   const toolUseId = typeof payload.tool_use_id === "string" && payload.tool_use_id.length > 0 && payload.tool_use_id.length <= MAX_TOOL_USE_ID_LENGTH2 ? payload.tool_use_id : void 0;
-  const payloadSha256 = (0, import_node_crypto31.createHash)("sha256").update(JSON.stringify(toolInput)).digest("hex");
+  const payloadSha256 = (0, import_node_crypto32.createHash)("sha256").update(JSON.stringify(toolInput)).digest("hex");
   const claim2 = dependencies.claim ?? ((root, input2) => {
     const outcome = claimHarnessContinuation(root, input2);
     if (outcome.kind === "claimed") {
@@ -28473,11 +28761,11 @@ async function runHarnessCommand(method, options, repoPath, dependencies = {}) {
 `
   );
 }
-var import_node_crypto31, MAX_HOOK_PAYLOAD_BYTES, STDIN_TIMEOUT_MS, MAX_TOOL_USE_ID_LENGTH2, DEVROUTER_EXECUTABLES, LAUNCHER_WORDS, LAUNCHER_SUBCOMMANDS, COMMAND_WORD_LIMIT;
+var import_node_crypto32, MAX_HOOK_PAYLOAD_BYTES, STDIN_TIMEOUT_MS, MAX_TOOL_USE_ID_LENGTH2, DEVROUTER_EXECUTABLES, LAUNCHER_WORDS, LAUNCHER_SUBCOMMANDS, COMMAND_WORD_LIMIT;
 var init_harness = __esm({
   "src/commands/harness.ts"() {
     "use strict";
-    import_node_crypto31 = require("crypto");
+    import_node_crypto32 = require("crypto");
     init_harness_continuation();
     init_harness_gate();
     MAX_HOOK_PAYLOAD_BYTES = 256 * 1024;
@@ -28593,7 +28881,7 @@ async function runOpenCommand(name) {
     );
     return;
   }
-  const result = (0, import_node_child_process40.spawnSync)("open", [url], { encoding: "utf-8" });
+  const result = (0, import_node_child_process41.spawnSync)("open", [url], { encoding: "utf-8" });
   if (result.status !== 0) {
     const details = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     throw new Error(`Unable to open '${url}': ${details || "unknown error"}`);
@@ -28601,11 +28889,11 @@ async function runOpenCommand(name) {
   process.stdout.write(`Opened ${url}
 `);
 }
-var import_node_child_process40;
+var import_node_child_process41;
 var init_open = __esm({
   "src/commands/open.ts"() {
     "use strict";
-    import_node_child_process40 = require("child_process");
+    import_node_child_process41 = require("child_process");
     init_docker();
     init_host_routes();
     init_repo_config();
@@ -28649,7 +28937,7 @@ async function runLogsCommand(options) {
   const args = ["logs", "--tail", tail, ROUTER_CONTAINER_NAME];
   if (options.follow) {
     args.splice(1, 0, "-f");
-    const child = (0, import_node_child_process41.spawn)("docker", args, { stdio: "inherit" });
+    const child = (0, import_node_child_process42.spawn)("docker", args, { stdio: "inherit" });
     const onSignal = () => {
       child.kill("SIGTERM");
     };
@@ -28663,17 +28951,17 @@ async function runLogsCommand(options) {
       });
     });
   } else {
-    const result = (0, import_node_child_process41.spawnSync)("docker", args, { stdio: "inherit" });
+    const result = (0, import_node_child_process42.spawnSync)("docker", args, { stdio: "inherit" });
     if (result.status !== 0) {
       throw new Error("Failed to retrieve router logs.");
     }
   }
 }
-var import_node_child_process41;
+var import_node_child_process42;
 var init_logs = __esm({
   "src/commands/logs.ts"() {
     "use strict";
-    import_node_child_process41 = require("child_process");
+    import_node_child_process42 = require("child_process");
     init_docker();
     init_lifecycle_diagnostics();
     init_router();
@@ -28717,11 +29005,11 @@ function asRecord3(value) {
   return value;
 }
 function readJson(filePath) {
-  if (!import_node_fs51.default.existsSync(filePath)) {
+  if (!import_node_fs52.default.existsSync(filePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs51.default.readFileSync(filePath, "utf-8"));
+    return JSON.parse(import_node_fs52.default.readFileSync(filePath, "utf-8"));
   } catch {
     return void 0;
   }
@@ -28768,7 +29056,7 @@ function inspectPackageManager(repoPath, pkg) {
     ["bun.lock", "bun"]
   ];
   for (const [fileName, name] of lockfiles) {
-    if (import_node_fs51.default.existsSync(import_node_path64.default.join(repoPath, fileName))) {
+    if (import_node_fs52.default.existsSync(import_node_path64.default.join(repoPath, fileName))) {
       return { name, source: fileName };
     }
   }
@@ -28784,8 +29072,8 @@ function inspectNode(repoPath, pkg) {
     return { version: engines.node, source: "package.json:engines.node" };
   }
   const nvmrc = import_node_path64.default.join(repoPath, ".nvmrc");
-  if (import_node_fs51.default.existsSync(nvmrc)) {
-    const version = import_node_fs51.default.readFileSync(nvmrc, "utf-8").trim();
+  if (import_node_fs52.default.existsSync(nvmrc)) {
+    const version = import_node_fs52.default.readFileSync(nvmrc, "utf-8").trim();
     return { version, source: ".nvmrc" };
   }
   return void 0;
@@ -28864,7 +29152,7 @@ function composeFiles(repoPath) {
     ...configuredComposeFiles(repoPath)
   ];
   return Array.from(new Set(candidates)).filter(
-    (fileName) => import_node_fs51.default.existsSync(import_node_path64.default.join(repoPath, fileName))
+    (fileName) => import_node_fs52.default.existsSync(import_node_path64.default.join(repoPath, fileName))
   );
 }
 function stringArray2(value) {
@@ -28902,7 +29190,7 @@ function inspectServices(repoPath) {
   const services = [];
   for (const fileName of composeFiles(repoPath)) {
     try {
-      const parsed = import_yaml8.default.parse(import_node_fs51.default.readFileSync(import_node_path64.default.join(repoPath, fileName), "utf-8"));
+      const parsed = import_yaml8.default.parse(import_node_fs52.default.readFileSync(import_node_path64.default.join(repoPath, fileName), "utf-8"));
       const serviceMap = asRecord3(asRecord3(parsed)?.services);
       for (const [name, value] of Object.entries(serviceMap ?? {})) {
         const service = asRecord3(value);
@@ -28937,8 +29225,8 @@ function inspectServices(repoPath) {
   return services;
 }
 function inspectEnvFiles(repoPath) {
-  const files = import_node_fs51.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
-    const content = import_node_fs51.default.readFileSync(import_node_path64.default.join(repoPath, fileName), "utf-8");
+  const files = import_node_fs52.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
+    const content = import_node_fs52.default.readFileSync(import_node_path64.default.join(repoPath, fileName), "utf-8");
     const names = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=")[0]?.trim()).filter((name) => Boolean(name)).sort();
     return { path: fileName, names };
   });
@@ -28953,17 +29241,17 @@ function inspectEnvFiles(repoPath) {
 }
 function inspectDevcontainer(repoPath) {
   const dir = import_node_path64.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs51.default.existsSync(dir)) {
+  if (!import_node_fs52.default.existsSync(dir)) {
     return { exists: false, files: [] };
   }
   return {
     exists: true,
-    files: import_node_fs51.default.readdirSync(dir).filter((fileName) => import_node_fs51.default.statSync(import_node_path64.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
+    files: import_node_fs52.default.readdirSync(dir).filter((fileName) => import_node_fs52.default.statSync(import_node_path64.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
   };
 }
 function inspectDevrouter(repoPath) {
   const configPath = getRepoConfigPath(repoPath);
-  if (!import_node_fs51.default.existsSync(configPath)) {
+  if (!import_node_fs52.default.existsSync(configPath)) {
     return {
       exists: false,
       configPath,
@@ -29007,15 +29295,15 @@ function inspectAgentGuidance(repoPath) {
     ["AGENTS.md", "agents"],
     ["CLAUDE.md", "claude"]
   ]) {
-    if (import_node_fs51.default.existsSync(import_node_path64.default.join(repoPath, fileName))) {
+    if (import_node_fs52.default.existsSync(import_node_path64.default.join(repoPath, fileName))) {
       results.push({ path: fileName, kind });
     }
   }
   const skillsDir = import_node_path64.default.join(repoPath, ".agents", "skills");
-  if (import_node_fs51.default.existsSync(skillsDir)) {
-    for (const name of import_node_fs51.default.readdirSync(skillsDir).sort()) {
+  if (import_node_fs52.default.existsSync(skillsDir)) {
+    for (const name of import_node_fs52.default.readdirSync(skillsDir).sort()) {
       const skillPath = import_node_path64.default.join(skillsDir, name, "SKILL.md");
-      if (import_node_fs51.default.existsSync(skillPath)) {
+      if (import_node_fs52.default.existsSync(skillPath)) {
         results.push({ path: relative(repoPath, skillPath), kind: "skill" });
       }
     }
@@ -29077,11 +29365,11 @@ function inspectRepo(options = {}) {
     issues: buildIssues(reportWithoutIssues)
   };
 }
-var import_node_fs51, import_node_path64, import_yaml8;
+var import_node_fs52, import_node_path64, import_yaml8;
 var init_repo_inspect = __esm({
   "src/core/repo-inspect.ts"() {
     "use strict";
-    import_node_fs51 = __toESM(require("fs"));
+    import_node_fs52 = __toESM(require("fs"));
     import_node_path64 = __toESM(require("path"));
     import_yaml8 = __toESM(require("yaml"));
     init_repo_config();
@@ -29187,7 +29475,7 @@ function requiredFileChecks(repoPath) {
     ".devcontainer/docker-compose.yml",
     ".devrouter.yml"
   ];
-  const missing = required.filter((fileName) => !import_node_fs52.default.existsSync(import_node_path65.default.join(repoPath, fileName)));
+  const missing = required.filter((fileName) => !import_node_fs53.default.existsSync(import_node_path65.default.join(repoPath, fileName)));
   return {
     id: "repo.devcontainer.verify-files",
     level: missing.length === 0 ? "ok" : "error",
@@ -29412,11 +29700,11 @@ async function verifyDevcontainer(options = {}) {
     nextSteps: collectNextSteps3(checks)
   };
 }
-var import_node_fs52, import_node_path65;
+var import_node_fs53, import_node_path65;
 var init_devcontainer_verify = __esm({
   "src/core/devcontainer-verify.ts"() {
     "use strict";
-    import_node_fs52 = __toESM(require("fs"));
+    import_node_fs53 = __toESM(require("fs"));
     import_node_path65 = __toESM(require("path"));
     init_capabilities();
     init_doctor();
@@ -29760,7 +30048,7 @@ function plannedFiles(repoPath, version) {
 }
 function classifyFile(repoPath, file) {
   const absolutePath = import_node_path66.default.join(repoPath, file.relativePath);
-  if (!import_node_fs53.default.existsSync(absolutePath)) {
+  if (!import_node_fs54.default.existsSync(absolutePath)) {
     return {
       path: file.relativePath,
       action: "create",
@@ -29768,7 +30056,7 @@ function classifyFile(repoPath, file) {
       bytes: Buffer.byteLength(file.content)
     };
   }
-  const current = import_node_fs53.default.readFileSync(absolutePath, "utf-8");
+  const current = import_node_fs54.default.readFileSync(absolutePath, "utf-8");
   if (!current.includes(MANAGED_MARKER2)) {
     return {
       path: file.relativePath,
@@ -29826,10 +30114,10 @@ function buildPlan(repoPath, dryRun, version) {
 }
 function writeFile(repoPath, file) {
   const absolutePath = import_node_path66.default.join(repoPath, file.relativePath);
-  import_node_fs53.default.mkdirSync(import_node_path66.default.dirname(absolutePath), { recursive: true });
-  import_node_fs53.default.writeFileSync(absolutePath, file.content, "utf-8");
+  import_node_fs54.default.mkdirSync(import_node_path66.default.dirname(absolutePath), { recursive: true });
+  import_node_fs54.default.writeFileSync(absolutePath, file.content, "utf-8");
   if (file.executable) {
-    import_node_fs53.default.chmodSync(absolutePath, 493);
+    import_node_fs54.default.chmodSync(absolutePath, 493);
   }
 }
 function writeDevcontainer(options = {}) {
@@ -29867,11 +30155,11 @@ function writeDevcontainer(options = {}) {
     nextSteps: postWriteNextSteps(repoPath)
   };
 }
-var import_node_fs53, import_node_path66, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
+var import_node_fs54, import_node_path66, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
 var init_devcontainer_write = __esm({
   "src/core/devcontainer-write.ts"() {
     "use strict";
-    import_node_fs53 = __toESM(require("fs"));
+    import_node_fs54 = __toESM(require("fs"));
     import_node_path66 = __toESM(require("path"));
     init_repo_config();
     init_repo_inspect();
@@ -30212,7 +30500,7 @@ function loadContract(repoPath, contractPath) {
   const absolutePath = assertPathWithinRepo(contractPath, repoPath, "Profile plan contract");
   let metadata;
   try {
-    metadata = import_node_fs54.default.lstatSync(absolutePath);
+    metadata = import_node_fs55.default.lstatSync(absolutePath);
   } catch (error) {
     fail3(`could not inspect profile plan contract '${contractPath}': ${error.message}`);
   }
@@ -30222,10 +30510,10 @@ function loadContract(repoPath, contractPath) {
   if (metadata.size > MAX_CONTRACT_BYTES) {
     fail3(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
-  const realRepo = import_node_fs54.default.realpathSync(repoPath);
-  const realContract = import_node_fs54.default.realpathSync(absolutePath);
+  const realRepo = import_node_fs55.default.realpathSync(repoPath);
+  const realContract = import_node_fs55.default.realpathSync(absolutePath);
   assertPathWithinRepo(realContract, realRepo, "Profile plan contract");
-  const source = import_node_fs54.default.readFileSync(absolutePath, "utf-8");
+  const source = import_node_fs55.default.readFileSync(absolutePath, "utf-8");
   if (Buffer.byteLength(source, "utf-8") > MAX_CONTRACT_BYTES) {
     fail3(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
@@ -30245,11 +30533,11 @@ function resolveProfilePlan(options) {
     contractPath: loaded.contractPath
   });
 }
-var import_node_fs54, import_node_path67, import_yaml9, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
+var import_node_fs55, import_node_path67, import_yaml9, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
 var init_profile_plan = __esm({
   "src/core/profile-plan.ts"() {
     "use strict";
-    import_node_fs54 = __toESM(require("fs"));
+    import_node_fs55 = __toESM(require("fs"));
     import_node_path67 = __toESM(require("path"));
     import_yaml9 = require("yaml");
     init_paths();
@@ -30723,7 +31011,7 @@ function loadPreviewManifest(repoPath) {
   const manifestPath = assertPathWithinRepo(MANIFEST_FILE_NAME, resolvedRepo, "Preview manifest");
   let metadata;
   try {
-    metadata = import_node_fs55.default.lstatSync(manifestPath);
+    metadata = import_node_fs56.default.lstatSync(manifestPath);
   } catch (error) {
     fail4(`could not inspect preview manifest '${MANIFEST_FILE_NAME}': ${error.message}`);
   }
@@ -30733,24 +31021,24 @@ function loadPreviewManifest(repoPath) {
   if (metadata.size > MAX_MANIFEST_BYTES) {
     fail4(`preview manifest exceeds the ${MAX_MANIFEST_BYTES}-byte limit.`);
   }
-  const realRepo = import_node_fs55.default.realpathSync(resolvedRepo);
-  const realManifest = import_node_fs55.default.realpathSync(manifestPath);
+  const realRepo = import_node_fs56.default.realpathSync(resolvedRepo);
+  const realManifest = import_node_fs56.default.realpathSync(manifestPath);
   assertPathWithinRepo(realManifest, realRepo, "Preview manifest");
-  const source = import_node_fs55.default.readFileSync(manifestPath, "utf-8");
+  const source = import_node_fs56.default.readFileSync(manifestPath, "utf-8");
   if (Buffer.byteLength(source, "utf-8") > MAX_MANIFEST_BYTES) {
     fail4(`preview manifest exceeds the ${MAX_MANIFEST_BYTES}-byte limit.`);
   }
   return {
     manifest: parsePreviewManifest(source),
-    digest: (0, import_node_crypto32.createHash)("sha256").update(source, "utf-8").digest("hex")
+    digest: (0, import_node_crypto33.createHash)("sha256").update(source, "utf-8").digest("hex")
   };
 }
-var import_node_crypto32, import_node_fs55, import_node_path69, import_yaml10, MANIFEST_FILE_NAME, MAX_MANIFEST_BYTES, MAX_COLLECTION_ENTRIES, MAX_BINDING_VALUES2, MAX_COMMAND_ARGS, MAX_LITERAL_LENGTH2, MAX_REPO_PATH_LENGTH, NAME_RE, IMAGE_REFERENCE_RE;
+var import_node_crypto33, import_node_fs56, import_node_path69, import_yaml10, MANIFEST_FILE_NAME, MAX_MANIFEST_BYTES, MAX_COLLECTION_ENTRIES, MAX_BINDING_VALUES2, MAX_COMMAND_ARGS, MAX_LITERAL_LENGTH2, MAX_REPO_PATH_LENGTH, NAME_RE, IMAGE_REFERENCE_RE;
 var init_manifest = __esm({
   "src/core/preview/manifest.ts"() {
     "use strict";
-    import_node_crypto32 = require("crypto");
-    import_node_fs55 = __toESM(require("fs"));
+    import_node_crypto33 = require("crypto");
+    import_node_fs56 = __toESM(require("fs"));
     import_node_path69 = __toESM(require("path"));
     import_yaml10 = require("yaml");
     init_paths();
@@ -31894,7 +32182,7 @@ var init_state = __esm({
 function previewIdentityKey(identity2) {
   if (!/^[a-z0-9.-]+$/.test(identity2.forgeHost) || identity2.forgeHost.length > 253 || !/^[A-Za-z0-9_-]{1,128}$/.test(identity2.projectId) || !Number.isSafeInteger(identity2.change) || identity2.change < 1)
     throw new Error("Invalid immutable preview identity.");
-  return (0, import_node_crypto33.createHash)("sha256").update(JSON.stringify([identity2.forgeHost, identity2.projectId, identity2.change])).digest("hex");
+  return (0, import_node_crypto34.createHash)("sha256").update(JSON.stringify([identity2.forgeHost, identity2.projectId, identity2.change])).digest("hex");
 }
 function costs(pool) {
   return Object.values(pool.sessions).reduce((total, entry) => total + entry.reservedCents, 0);
@@ -31950,11 +32238,11 @@ function sessionReady(entry, now, expiresAt) {
     ...expiresAt === void 0 ? {} : { expiresAt }
   });
 }
-var import_node_crypto33, PreviewAdmissionSuperseded, PreviewEngine;
+var import_node_crypto34, PreviewAdmissionSuperseded, PreviewEngine;
 var init_engine = __esm({
   "src/core/preview/engine.ts"() {
     "use strict";
-    import_node_crypto33 = require("crypto");
+    import_node_crypto34 = require("crypto");
     init_command();
     init_lifecycle();
     init_state();
@@ -32088,7 +32376,7 @@ var init_engine = __esm({
             } else {
               if (current && current.session.status !== "stopped" && current.session.status !== "expired")
                 throw new Error("Previous generation cleanup is incomplete.");
-              const generation = (0, import_node_crypto33.createHash)("sha256").update(receipt).digest("hex").slice(0, 24);
+              const generation = (0, import_node_crypto34.createHash)("sha256").update(receipt).digest("hex").slice(0, 24);
               pool2.sessions[id5] = {
                 identity: input2.identity,
                 session: createPreviewSession({
@@ -32744,11 +33032,11 @@ function decodeInbox(raw) {
   }
   return structuredClone(row);
 }
-var import_node_crypto34, PreviewController;
+var import_node_crypto35, PreviewController;
 var init_controller2 = __esm({
   "src/core/preview/controller.ts"() {
     "use strict";
-    import_node_crypto34 = require("crypto");
+    import_node_crypto35 = require("crypto");
     init_command();
     init_engine();
     init_status3();
@@ -32955,7 +33243,7 @@ Command refused: ${inbox.refusal}. Post a new command when the condition is reso
 Available profiles: ${this.options.aliases.map((alias) => `\`${alias}\``).join(", ")}.` : ""}
 
 ${marker}`;
-        const fingerprint = (0, import_node_crypto34.createHash)("sha256").update(body).digest("hex"), now = this.options.now();
+        const fingerprint = (0, import_node_crypto35.createHash)("sha256").update(body).digest("hex"), now = this.options.now();
         if (inbox.status?.bodyDigest === fingerprint) {
           if (inbox.needsStatus) await this.update(change, (row) => ({ ...row, needsStatus: false }));
           return;
@@ -32966,7 +33254,7 @@ ${marker}`;
         let commentId = inbox.status?.commentId;
         if (!commentId) commentId = await this.options.forge.findStatus(change, marker) ?? void 0;
         let create = false;
-        const intentId = (0, import_node_crypto34.randomUUID)();
+        const intentId = (0, import_node_crypto35.randomUUID)();
         if (!inbox.status)
           inbox = await this.update(change, (row) => {
             create = !row.status;
@@ -33716,7 +34004,7 @@ function canonicalizeImageConfiguration(configuration) {
   return JSON.stringify(normalizeConfiguration(configuration, "image configuration"));
 }
 function imageConfigurationDigest(configuration) {
-  return `sha256:${(0, import_node_crypto35.createHash)("sha256").update(canonicalizeImageConfiguration(configuration), "utf-8").digest("hex")}`;
+  return `sha256:${(0, import_node_crypto36.createHash)("sha256").update(canonicalizeImageConfiguration(configuration), "utf-8").digest("hex")}`;
 }
 function targetKey(target, configurationDigest) {
   return `${target}\0${configurationDigest}`;
@@ -33971,11 +34259,11 @@ function resolvePreviewImages(plan, prepared, expectedProducer, value) {
     images: Object.fromEntries(resourceReceipts)
   };
 }
-var import_node_crypto35, MAX_COLLECTION_ENTRIES2, MAX_CONFIGURATION_ENTRIES, MAX_CONFIGURATION_KEY_LENGTH, MAX_CONFIGURATION_VALUE_BYTES, MAX_IDENTIFIER_LENGTH, NAME_RE2, REVISION_RE2, DIGEST_RE, IMAGE_COMPONENT_RE, RECEIPT_FIELDS;
+var import_node_crypto36, MAX_COLLECTION_ENTRIES2, MAX_CONFIGURATION_ENTRIES, MAX_CONFIGURATION_KEY_LENGTH, MAX_CONFIGURATION_VALUE_BYTES, MAX_IDENTIFIER_LENGTH, NAME_RE2, REVISION_RE2, DIGEST_RE, IMAGE_COMPONENT_RE, RECEIPT_FIELDS;
 var init_images = __esm({
   "src/core/preview/images.ts"() {
     "use strict";
-    import_node_crypto35 = require("crypto");
+    import_node_crypto36 = require("crypto");
     MAX_COLLECTION_ENTRIES2 = 256;
     MAX_CONFIGURATION_ENTRIES = 128;
     MAX_CONFIGURATION_KEY_LENGTH = 128;
@@ -34009,8 +34297,8 @@ function commandImageBackend(options) {
     throw new Error("Invalid installed image resolver command.");
   const verify = () => {
     for (const file of options.files) {
-      const stat = import_node_fs56.default.lstatSync(file.path);
-      if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024 || (0, import_node_crypto36.createHash)("sha256").update(import_node_fs56.default.readFileSync(file.path)).digest("hex") !== file.sha256)
+      const stat = import_node_fs57.default.lstatSync(file.path);
+      if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024 || (0, import_node_crypto37.createHash)("sha256").update(import_node_fs57.default.readFileSync(file.path)).digest("hex") !== file.sha256)
         throw new Error("Installed image resolver fingerprint differs.");
     }
   };
@@ -34022,7 +34310,7 @@ function commandImageBackend(options) {
         platform: options.platform,
         configurations: options.context(entry)
       });
-      const correlation = (0, import_node_crypto36.createHash)("sha256").update(
+      const correlation = (0, import_node_crypto37.createHash)("sha256").update(
         JSON.stringify([
           entry.identity,
           entry.session.generation,
@@ -34046,7 +34334,7 @@ function commandImageBackend(options) {
         });
         if (Buffer.byteLength(input2) > 1024 * 1024)
           throw new Error("Image request exceeds its bound.");
-        const result = (0, import_node_child_process42.spawnSync)(options.command[0], options.command.slice(1), {
+        const result = (0, import_node_child_process43.spawnSync)(options.command[0], options.command.slice(1), {
           shell: false,
           cwd: options.cwd,
           encoding: "utf8",
@@ -34084,13 +34372,13 @@ function commandImageBackend(options) {
     }
   };
 }
-var import_node_child_process42, import_node_crypto36, import_node_fs56;
+var import_node_child_process43, import_node_crypto37, import_node_fs57;
 var init_image_command = __esm({
   "src/core/preview/image-command.ts"() {
     "use strict";
-    import_node_child_process42 = require("child_process");
-    import_node_crypto36 = require("crypto");
-    import_node_fs56 = __toESM(require("fs"));
+    import_node_child_process43 = require("child_process");
+    import_node_crypto37 = require("crypto");
+    import_node_fs57 = __toESM(require("fs"));
     init_images();
     init_state();
   }
@@ -34783,9 +35071,9 @@ function compileNorthflankGraph(entry, policy, phase, owned = {
     const resource = resources.get(id5);
     if (!resource?.ports?.some((item) => item.name === port && item.public))
       throw new Error("Northflank origin binding requires a selected public port.");
-    return `https://${prefix}--${id5.slice(0, 16)}-${port}-${(0, import_node_crypto37.createHash)("sha256").update(id5).digest("hex").slice(0, 6)}.${policy.baseDomain}`;
+    return `https://${prefix}--${id5.slice(0, 16)}-${port}-${(0, import_node_crypto38.createHash)("sha256").update(id5).digest("hex").slice(0, 6)}.${policy.baseDomain}`;
   };
-  const resourceName = (id5) => `${northflankAllocationPrefix(policy, entry.session.generation)}${(0, import_node_crypto37.createHash)("sha256").update(id5).digest("hex").slice(0, 10)}`;
+  const resourceName = (id5) => `${northflankAllocationPrefix(policy, entry.session.generation)}${(0, import_node_crypto38.createHash)("sha256").update(id5).digest("hex").slice(0, 10)}`;
   const suffix = (value) => {
     if (value === void 0) return "";
     if (typeof value !== "string" || value.length > 1024 || !value.startsWith("/") || value.startsWith("//") || value.includes("\\") || new RegExp("\\s|\\p{Cc}", "u").test(value))
@@ -35212,7 +35500,7 @@ function compileNorthflankGraph(entry, policy, phase, owned = {
       ]
     }
   };
-  const digest5 = (0, import_node_crypto37.createHash)("sha256").update(JSON.stringify({ spec, runtimeSecrets })).digest("hex");
+  const digest5 = (0, import_node_crypto38.createHash)("sha256").update(JSON.stringify({ spec, runtimeSecrets })).digest("hex");
   return {
     spec,
     digest: digest5,
@@ -35223,11 +35511,11 @@ function compileNorthflankGraph(entry, policy, phase, owned = {
     publicBuildEnvironment
   };
 }
-var import_node_crypto37, import_node_net5, ALLOCATION_PLAN, DATABASE_NAME, SOURCE_NAME, MAX_SOURCE_NAMES, MAX_OUTPUTS, MAX_SECRET_GROUPS, MAX_OUTPUT_ARGUMENTS, MAX_OUTPUT_ARGUMENT_BYTES, MAX_OUTPUT_COMMAND_BYTES, MAX_OUTPUT_BYTES2, MAX_PATTERN_BYTES, boundedStorage;
+var import_node_crypto38, import_node_net5, ALLOCATION_PLAN, DATABASE_NAME, SOURCE_NAME, MAX_SOURCE_NAMES, MAX_OUTPUTS, MAX_SECRET_GROUPS, MAX_OUTPUT_ARGUMENTS, MAX_OUTPUT_ARGUMENT_BYTES, MAX_OUTPUT_COMMAND_BYTES, MAX_OUTPUT_BYTES2, MAX_PATTERN_BYTES, boundedStorage;
 var init_northflank_graph = __esm({
   "src/core/preview/providers/northflank-graph.ts"() {
     "use strict";
-    import_node_crypto37 = require("crypto");
+    import_node_crypto38 = require("crypto");
     import_node_net5 = require("net");
     ALLOCATION_PLAN = /^[a-zA-Z0-9-]{3,100}$/;
     DATABASE_NAME = /^[a-z][a-z0-9_]{0,62}$/;
@@ -35331,7 +35619,7 @@ function specDigest(value) {
   return digest3(definition(value));
 }
 function digest3(value) {
-  return (0, import_node_crypto38.createHash)("sha256").update(JSON.stringify(value)).digest("hex");
+  return (0, import_node_crypto39.createHash)("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function bindings(owned) {
   return {
@@ -35356,11 +35644,11 @@ function outputNames(graph) {
     )
   ].sort();
 }
-var import_node_crypto38, resourceKinds, NorthflankOwnershipStore, northflankQualificationKeys, NorthflankFailure, NorthflankFenced, NorthflankPreviewProvider, nativeKinds, emptySpec;
+var import_node_crypto39, resourceKinds, NorthflankOwnershipStore, northflankQualificationKeys, NorthflankFailure, NorthflankFenced, NorthflankPreviewProvider, nativeKinds, emptySpec;
 var init_northflank = __esm({
   "src/core/preview/providers/northflank.ts"() {
     "use strict";
-    import_node_crypto38 = require("crypto");
+    import_node_crypto39 = require("crypto");
     init_command();
     init_state();
     init_northflank_api();
@@ -35993,7 +36281,7 @@ var init_northflank = __esm({
                   const settings = this.options.graph.generated?.[name];
                   if (!settings)
                     throw new NorthflankFailure("Northflank generated value is undeclared.");
-                  value = (0, import_node_crypto38.randomBytes)(settings.bytes).toString(settings.encoding);
+                  value = (0, import_node_crypto39.randomBytes)(settings.bytes).toString(settings.encoding);
                 }
                 if (kind === "output" && value === void 0)
                   throw new NorthflankFailure("Northflank output has no verified recipient.");
@@ -36496,10 +36784,10 @@ __export(installation_exports, {
   loadPreviewInstallation: () => loadPreviewInstallation
 });
 function readFile(file) {
-  const stat = import_node_fs57.default.lstatSync(file);
+  const stat = import_node_fs58.default.lstatSync(file);
   if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024)
     throw new Error("Preview control files must be regular files of at most 1 MiB.");
-  return import_node_fs57.default.readFileSync(file, "utf8");
+  return import_node_fs58.default.readFileSync(file, "utf8");
 }
 function text5(value, pattern) {
   if (typeof value !== "string" || !pattern.test(value))
@@ -36512,7 +36800,7 @@ function integer2(value, min, max) {
   return value;
 }
 function loadPreviewInstallation(filename, options = {}) {
-  const root = import_node_path70.default.dirname(import_node_fs57.default.realpathSync(filename));
+  const root = import_node_path70.default.dirname(import_node_fs58.default.realpathSync(filename));
   const raw = object5(JSON.parse(readFile(filename)), [
     "version",
     "installationId",
@@ -36595,7 +36883,7 @@ function loadPreviewInstallation(filename, options = {}) {
     const control = (input3) => {
       const ref2 = object5(input3, ["file", "sha256"]);
       const filename2 = text5(ref2.file, /^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[^\\\0]+$/);
-      const file = import_node_fs57.default.realpathSync(import_node_path70.default.join(root, filename2));
+      const file = import_node_fs58.default.realpathSync(import_node_path70.default.join(root, filename2));
       if (!file.startsWith(`${root}${import_node_path70.default.sep}`))
         throw new Error("Preview control file escapes installation directory.");
       const source = readFile(file), expected = text5(ref2.sha256, /^[a-f0-9]{64}$/);
@@ -36658,7 +36946,7 @@ function loadPreviewInstallation(filename, options = {}) {
         return credential(secrets[ref2])();
       },
       accept: async (entry, urls) => {
-        const result = (0, import_node_child_process43.spawnSync)(command[0], command.slice(1), {
+        const result = (0, import_node_child_process44.spawnSync)(command[0], command.slice(1), {
           cwd: root,
           shell: false,
           timeout: 3e4,
@@ -36720,7 +37008,7 @@ function loadPreviewInstallation(filename, options = {}) {
       const item = object5(input3, ["file", "sha256"]);
       const verified = control(input3);
       return {
-        path: import_node_fs57.default.realpathSync(import_node_path70.default.join(root, item.file)),
+        path: import_node_fs58.default.realpathSync(import_node_path70.default.join(root, item.file)),
         sha256: verified.digest
       };
     }) : [];
@@ -36835,7 +37123,7 @@ function loadPreviewInstallation(filename, options = {}) {
       }
     },
     now,
-    workerId: (0, import_node_crypto39.randomUUID)(),
+    workerId: (0, import_node_crypto40.randomUUID)(),
     policy: {
       installationId,
       maxActive,
@@ -36951,13 +37239,13 @@ async function initializePreviewInstallation(installationId, store) {
   await store.compareAndSwap(witnessKey, null, { installationId });
   await store.compareAndSwap(poolKey, null, createPreviewPool(installationId));
 }
-var import_node_child_process43, import_node_crypto39, import_node_fs57, import_node_path70, MAX_COMMAND_AGE_MS, digest4, envName;
+var import_node_child_process44, import_node_crypto40, import_node_fs58, import_node_path70, MAX_COMMAND_AGE_MS, digest4, envName;
 var init_installation = __esm({
   "src/core/preview/installation.ts"() {
     "use strict";
-    import_node_child_process43 = require("child_process");
-    import_node_crypto39 = require("crypto");
-    import_node_fs57 = __toESM(require("fs"));
+    import_node_child_process44 = require("child_process");
+    import_node_crypto40 = require("crypto");
+    import_node_fs58 = __toESM(require("fs"));
     import_node_path70 = __toESM(require("path"));
     init_repo_config();
     init_command();
@@ -36975,7 +37263,7 @@ var init_installation = __esm({
     init_state();
     init_azure_blob();
     MAX_COMMAND_AGE_MS = 15 * 6e4;
-    digest4 = (source) => (0, import_node_crypto39.createHash)("sha256").update(source).digest("hex");
+    digest4 = (source) => (0, import_node_crypto40.createHash)("sha256").update(source).digest("hex");
     envName = (value) => {
       if (typeof value !== "string" || !/^DEVROUTER_PREVIEW_[A-Z0-9_]+$/.test(value))
         throw new Error("Preview credential references require scoped environment names.");
@@ -36994,14 +37282,14 @@ __export(preview_exports, {
 function readSource(repoPath, filename) {
   if (import_node_path71.default.isAbsolute(filename))
     throw new Error("Preview source path must be repository-relative.");
-  const root = import_node_fs58.default.realpathSync(repoPath);
+  const root = import_node_fs59.default.realpathSync(repoPath);
   const file = assertPathWithinRepo(filename, root, "preview source");
-  const stat = import_node_fs58.default.lstatSync(file);
+  const stat = import_node_fs59.default.lstatSync(file);
   if (stat.isSymbolicLink() || !stat.isFile() || stat.size > 1024 * 1024) {
     throw new Error("Preview source must be a regular file of at most 1 MiB.");
   }
-  assertPathWithinRepo(import_node_fs58.default.realpathSync(file), root, "preview source");
-  return JSON.parse(import_node_fs58.default.readFileSync(file, "utf8"));
+  assertPathWithinRepo(import_node_fs59.default.realpathSync(file), root, "preview source");
+  return JSON.parse(import_node_fs59.default.readFileSync(file, "utf8"));
 }
 async function runPreviewPlanCommand(options) {
   const repoPath = resolveRepoPath(options.repo);
@@ -37016,13 +37304,13 @@ async function runPreviewPlanCommand(options) {
 `);
     return;
   }
-  const localConfig = import_node_fs58.default.readFileSync(import_node_path71.default.join(repoPath, ".devrouter.yml"), "utf8");
+  const localConfig = import_node_fs59.default.readFileSync(import_node_path71.default.join(repoPath, ".devrouter.yml"), "utf8");
   const report = buildPreviewPlan({
     repoPath,
     config: loadRepoConfig(repoPath, () => localConfig),
     manifest,
     manifestDigest: digest5,
-    localConfigDigest: (0, import_node_crypto40.createHash)("sha256").update(localConfig).digest("hex"),
+    localConfigDigest: (0, import_node_crypto41.createHash)("sha256").update(localConfig).digest("hex"),
     ...options.alias === void 0 ? {} : { aliases: options.alias.split(",") },
     ...options.source === void 0 ? {} : { source: readSource(repoPath, options.source) }
   });
@@ -37041,7 +37329,7 @@ async function runPreviewPlanCommand(options) {
   }
 }
 async function runPreviewInitCommand(options) {
-  const repoPath = import_node_fs58.default.realpathSync(resolveRepoPath(options.repo));
+  const repoPath = import_node_fs59.default.realpathSync(resolveRepoPath(options.repo));
   if (options.integration === "gitlab") return renderGitLabPreviewIntegration(repoPath, options);
   if (options.integration) return renderPreviewIntegration(repoPath, options);
   loadRepoConfig(repoPath);
@@ -37067,7 +37355,7 @@ async function runPreviewInitCommand(options) {
   const content = (0, import_yaml12.stringify)(manifest);
   if (options.write) {
     const file = import_node_path71.default.join(repoPath, ".devrouter.preview.yml");
-    import_node_fs58.default.writeFileSync(file, content, { flag: "wx", mode: 384 });
+    import_node_fs59.default.writeFileSync(file, content, { flag: "wx", mode: 384 });
   }
   if (options.json) {
     printJSON({
@@ -37135,9 +37423,9 @@ function previewAsset(name) {
     import_node_path71.default.resolve(__dirname, "..", "assets", "preview", name),
     import_node_path71.default.resolve(__dirname, "..", "..", "assets", "preview", name)
   ];
-  const file = candidates.find((file2) => import_node_fs58.default.existsSync(file2));
+  const file = candidates.find((file2) => import_node_fs59.default.existsSync(file2));
   if (!file) throw new Error("Installed preview integration asset is missing.");
-  return import_node_fs58.default.readFileSync(file, "utf8");
+  return import_node_fs59.default.readFileSync(file, "utf8");
 }
 function renderPreviewAsset(name, replacements) {
   return previewAsset(name).replace(/__([A-Z_]+)__/g, (_match, key) => {
@@ -37172,9 +37460,9 @@ async function renderPreviewIntegration(repoPath, options) {
   const filename = `.github/workflows/devrouter-preview${options.sweeper ? "-sweep" : ""}.yml`;
   if (options.write) {
     const file = assertPathWithinRepo(filename, repoPath, "preview workflow");
-    import_node_fs58.default.mkdirSync(import_node_path71.default.dirname(file), { recursive: true });
-    assertPathWithinRepo(import_node_fs58.default.realpathSync(import_node_path71.default.dirname(file)), repoPath, "preview workflow parent");
-    import_node_fs58.default.writeFileSync(file, content, { flag: "wx", mode: 384 });
+    import_node_fs59.default.mkdirSync(import_node_path71.default.dirname(file), { recursive: true });
+    assertPathWithinRepo(import_node_fs59.default.realpathSync(import_node_path71.default.dirname(file)), repoPath, "preview workflow parent");
+    import_node_fs59.default.writeFileSync(file, content, { flag: "wx", mode: 384 });
   }
   if (options.json)
     printJSON({
@@ -37192,7 +37480,7 @@ async function renderGitLabPreviewIntegration(repoPath, options) {
     throw new Error(
       "GitLab integration requires reviewed --controller-ref and --controller-image digest."
     );
-  const integrity = `sha256-${(0, import_node_crypto40.createHash)("sha256").update(previewAsset("gitlab-template.yml")).digest("base64")}`;
+  const integrity = `sha256-${(0, import_node_crypto41.createHash)("sha256").update(previewAsset("gitlab-template.yml")).digest("base64")}`;
   const replacements = {
     CONTROLLER_REF: String(options.controllerRef),
     CONTROLLER_IMAGE: String(options.controllerImage),
@@ -37201,7 +37489,7 @@ async function renderGitLabPreviewIntegration(repoPath, options) {
   const content = renderPreviewAsset("gitlab.yml", replacements);
   const filename = ".gitlab-ci.yml";
   if (options.write)
-    import_node_fs58.default.writeFileSync(assertPathWithinRepo(filename, repoPath, "GitLab preview caller"), content, {
+    import_node_fs59.default.writeFileSync(assertPathWithinRepo(filename, repoPath, "GitLab preview caller"), content, {
       flag: "wx",
       mode: 384
     });
@@ -37216,12 +37504,12 @@ async function renderGitLabPreviewIntegration(repoPath, options) {
     });
   else process.stdout.write(content);
 }
-var import_node_crypto40, import_node_fs58, import_node_path71, import_yaml12;
+var import_node_crypto41, import_node_fs59, import_node_path71, import_yaml12;
 var init_preview = __esm({
   "src/commands/preview.ts"() {
     "use strict";
-    import_node_crypto40 = require("crypto");
-    import_node_fs58 = __toESM(require("fs"));
+    import_node_crypto41 = require("crypto");
+    import_node_fs59 = __toESM(require("fs"));
     import_node_path71 = __toESM(require("path"));
     import_yaml12 = require("yaml");
     init_output();
@@ -37514,7 +37802,7 @@ function sanitizeRouterId(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function repoHash(repoPath) {
-  return (0, import_node_crypto41.createHash)("sha1").update(import_node_path72.default.resolve(repoPath)).digest("hex").slice(0, 12);
+  return (0, import_node_crypto42.createHash)("sha1").update(import_node_path72.default.resolve(repoPath)).digest("hex").slice(0, 12);
 }
 function asDockerApp(app) {
   return app.runtime === "docker";
@@ -37594,10 +37882,10 @@ function prepareDockerOverlay(repoPath, appName, apps, publishTcpPorts = false)
     throw new Error("No docker apps selected to prepare compose overlay.");
   }
   const cachePath = import_node_path72.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
-  import_node_fs59.default.mkdirSync(cachePath, { recursive: true });
+  import_node_fs60.default.mkdirSync(cachePath, { recursive: true });
   const overlayPath = import_node_path72.default.join(cachePath, "compose.devrouter.yml");
   const overlayDocument = buildOverlayDocument(dockerApps, publishTcpPorts);
-  import_node_fs59.default.writeFileSync(overlayPath, import_yaml13.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
+  import_node_fs60.default.writeFileSync(overlayPath, import_yaml13.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
   return {
     overlayPath,
     composeFiles: ensureComposeFiles(dockerApps),
@@ -37611,7 +37899,7 @@ function runDockerComposeUp(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved2);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "up", "-d", "--wait", ...services];
-  const result = (0, import_node_child_process44.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process45.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -37639,7 +37927,7 @@ function queryRunningComposeServices(repoPath, composeFiles2, overlayPath, servi
     "--services",
     ...services
   ];
-  const result = (0, import_node_child_process44.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process45.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -37665,7 +37953,7 @@ function runDockerComposeStop(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved2);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "stop", ...services];
-  const result = (0, import_node_child_process44.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process45.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -37691,7 +37979,7 @@ function runDockerComposeLogs(repoPath, composeFiles2, overlayPath, services, ta
     String(tail),
     ...services
   ];
-  (0, import_node_child_process44.spawnSync)("docker", args, {
+  (0, import_node_child_process45.spawnSync)("docker", args, {
     stdio: "inherit",
     cwd: repoPath
   });
@@ -37703,7 +37991,7 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
     fileArgs.push("-f", resolved2);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "port", service, String(internalPort)];
-  const result = (0, import_node_child_process44.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process45.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -37717,13 +38005,13 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process44, import_node_crypto41, import_node_fs59, import_node_path72, import_yaml13;
+var import_node_child_process45, import_node_crypto42, import_node_fs60, import_node_path72, import_yaml13;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
-    import_node_child_process44 = require("child_process");
-    import_node_crypto41 = require("crypto");
-    import_node_fs59 = __toESM(require("fs"));
+    import_node_child_process45 = require("child_process");
+    import_node_crypto42 = require("crypto");
+    import_node_fs60 = __toESM(require("fs"));
     import_node_path72 = __toESM(require("path"));
     import_yaml13 = __toESM(require("yaml"));
     init_docker_error_guidance();
@@ -37814,7 +38102,7 @@ function isProcessRunning(pid) {
   }
 }
 function readProcessTree(rootPid) {
-  const result = (0, import_node_child_process45.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
+  const result = (0, import_node_child_process46.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
   if (result.status !== 0) {
     return [rootPid];
   }
@@ -37925,12 +38213,12 @@ function detectListeningPorts(pids) {
   if (pids.length === 0) {
     return [];
   }
-  const result = (0, import_node_child_process45.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
+  const result = (0, import_node_child_process46.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process45.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process46.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsListeningPorts(ssResult.stdout, new Set(pids));
       }
@@ -37989,7 +38277,7 @@ async function runHostApp(repoPath, app, extraEnv = {}, secretManager, env, work
     app.hostRun.command,
     true
   ) : app.hostRun.command;
-  const child = (0, import_node_child_process45.spawn)(spawnCommand, {
+  const child = (0, import_node_child_process46.spawn)(spawnCommand, {
     cwd: commandCwd,
     stdio: "inherit",
     shell: true,
@@ -38357,7 +38645,7 @@ async function execWithAppEnv(options) {
           options.command[0],
           true
         );
-        child = (0, import_node_child_process45.spawn)(wrapped, {
+        child = (0, import_node_child_process46.spawn)(wrapped, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: true,
@@ -38371,7 +38659,7 @@ async function execWithAppEnv(options) {
           false
         );
         const [cmd, ...wrappedArgs] = wrapped;
-        child = (0, import_node_child_process45.spawn)(cmd, wrappedArgs, {
+        child = (0, import_node_child_process46.spawn)(cmd, wrappedArgs, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: false,
@@ -38379,7 +38667,7 @@ async function execWithAppEnv(options) {
         });
       }
     } else if (options.shell) {
-      child = (0, import_node_child_process45.spawn)(options.command[0], {
+      child = (0, import_node_child_process46.spawn)(options.command[0], {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: true,
@@ -38387,7 +38675,7 @@ async function execWithAppEnv(options) {
       });
     } else {
       const [command, ...args] = options.command;
-      child = (0, import_node_child_process45.spawn)(command, args, {
+      child = (0, import_node_child_process46.spawn)(command, args, {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: false,
@@ -38408,11 +38696,11 @@ async function execWithAppEnv(options) {
     deps.stopDeps();
   }
 }
-var import_node_child_process45, import_node_net6, import_node_process, import_promises, POLL_INTERVAL_MS, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
+var import_node_child_process46, import_node_net6, import_node_process, import_promises, POLL_INTERVAL_MS, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
 var init_app_run = __esm({
   "src/core/app-run.ts"() {
     "use strict";
-    import_node_child_process45 = require("child_process");
+    import_node_child_process46 = require("child_process");
     import_node_net6 = __toESM(require("net"));
     import_node_process = require("process");
     import_promises = require("readline/promises");
@@ -38558,7 +38846,7 @@ function canonicalJson(value) {
 `;
 }
 function sha256Hex(raw) {
-  return (0, import_node_crypto42.createHash)("sha256").update(raw).digest("hex");
+  return (0, import_node_crypto43.createHash)("sha256").update(raw).digest("hex");
 }
 function candidateId(candidate) {
   const identity2 = {
@@ -38726,7 +39014,7 @@ function validateManifest(value) {
   return root;
 }
 function readManifest(file) {
-  const raw = import_node_fs60.default.readFileSync(file);
+  const raw = import_node_fs61.default.readFileSync(file);
   let parsed;
   try {
     parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(raw));
@@ -38765,7 +39053,7 @@ function selectManifest(file, expectedSha256, ids2) {
   return canonicalJson(subset);
 }
 function gitLine(cwd, args) {
-  const result = (0, import_node_child_process46.spawnSync)("git", ["-C", cwd, ...args], {
+  const result = (0, import_node_child_process47.spawnSync)("git", ["-C", cwd, ...args], {
     encoding: "utf-8",
     env: { ...process.env, GIT_OPTIONAL_LOCKS: "0", LC_ALL: "C" }
   });
@@ -38773,7 +39061,7 @@ function gitLine(cwd, args) {
   return result.status === 0 && !result.error && output2 ? output2 : void 0;
 }
 function readWorktreeIdentity(worktreePath) {
-  if (!import_node_fs60.default.existsSync(worktreePath)) return void 0;
+  if (!import_node_fs61.default.existsSync(worktreePath)) return void 0;
   const real = comparableWorkspacePath(worktreePath);
   const commonDir = gitLine(real, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
   const gitDir = gitLine(real, ["rev-parse", "--path-format=absolute", "--git-dir"]);
@@ -38799,7 +39087,7 @@ function unmanagedActivityEpoch(worktreePath, gitDir) {
     worktreePath
   ]) {
     try {
-      const seconds = Math.floor(import_node_fs60.default.statSync(file).mtimeMs / 1e3);
+      const seconds = Math.floor(import_node_fs61.default.statSync(file).mtimeMs / 1e3);
       latest = latest === void 0 ? seconds : Math.max(latest, seconds);
     } catch {
     }
@@ -38858,7 +39146,7 @@ function receiptPath(commonDir, manifestSha256, id5) {
 function matchingReceipt(candidate, manifestSha256) {
   try {
     const receipt = JSON.parse(
-      import_node_fs60.default.readFileSync(receiptPath(candidate.commonDir, manifestSha256, candidate.id), "utf-8")
+      import_node_fs61.default.readFileSync(receiptPath(candidate.commonDir, manifestSha256, candidate.id), "utf-8")
     );
     return receipt.kind === RECEIPT_KIND && receipt.schemaVersion === SCHEMA_VERSION && receipt.manifestSha256 === manifestSha256 && receipt.candidateId === candidate.id && receipt.path === candidate.path && receipt.head === candidate.head;
   } catch {
@@ -38867,7 +39155,7 @@ function matchingReceipt(candidate, manifestSha256) {
 }
 function writeReceipt(candidate, manifestSha256, steps, nowEpoch) {
   const file = receiptPath(candidate.commonDir, manifestSha256, candidate.id);
-  import_node_fs60.default.mkdirSync(import_node_path73.default.dirname(file), { recursive: true });
+  import_node_fs61.default.mkdirSync(import_node_path73.default.dirname(file), { recursive: true });
   writeFileAtomically(
     file,
     canonicalJson({
@@ -38885,7 +39173,7 @@ function writeReceipt(candidate, manifestSha256, steps, nowEpoch) {
   );
 }
 function runVetoCommand(command, worktreePath) {
-  const result = (0, import_node_child_process46.spawnSync)(command, [worktreePath], {
+  const result = (0, import_node_child_process47.spawnSync)(command, [worktreePath], {
     stdio: ["ignore", "ignore", "inherit"],
     timeout: VETO_TIMEOUT_MS
   });
@@ -38900,7 +39188,7 @@ function runVetoCommand(command, worktreePath) {
 function assertVetoCommand(command) {
   if (!import_node_path73.default.isAbsolute(command)) throw new Error("--veto-command must be an absolute path");
   try {
-    import_node_fs60.default.accessSync(command, import_node_fs60.default.constants.X_OK);
+    import_node_fs61.default.accessSync(command, import_node_fs61.default.constants.X_OK);
   } catch {
     throw new Error(`--veto-command '${command}' is missing or not executable`);
   }
@@ -38926,7 +39214,7 @@ function preflightManifestApply(options, action2, nowEpoch) {
   return { manifest, manifestSha256, now };
 }
 function deleteBranchIfUnmoved(candidate, steps) {
-  const exists2 = (0, import_node_child_process46.spawnSync)(
+  const exists2 = (0, import_node_child_process47.spawnSync)(
     "git",
     ["-C", candidate.repo, "show-ref", "--verify", "--quiet", candidate.branchRef],
     { encoding: "utf-8" }
@@ -38935,7 +39223,7 @@ function deleteBranchIfUnmoved(candidate, steps) {
   if (exists2.status !== 0) {
     throw new Error(`cannot read branch ${candidate.branch}: ${(exists2.stderr ?? "").trim()}`);
   }
-  const result = (0, import_node_child_process46.spawnSync)(
+  const result = (0, import_node_child_process47.spawnSync)(
     "git",
     ["-C", candidate.repo, "update-ref", "-d", candidate.branchRef, candidate.head],
     { encoding: "utf-8" }
@@ -38944,7 +39232,7 @@ function deleteBranchIfUnmoved(candidate, steps) {
     return `branch ${candidate.branch} no longer points at the approved HEAD; it was kept for review`;
   }
   steps.push("branch-deleted");
-  (0, import_node_child_process46.spawnSync)(
+  (0, import_node_child_process47.spawnSync)(
     "git",
     ["-C", candidate.repo, "config", "--remove-section", `branch.${candidate.branch}`],
     { encoding: "utf-8" }
@@ -38982,7 +39270,7 @@ async function applyReclaimManifest(options, dependencies) {
       outcome.status = "not-attempted";
       continue;
     }
-    if (!import_node_fs60.default.existsSync(candidate.path) && matchingReceipt(candidate, manifestSha256)) {
+    if (!import_node_fs61.default.existsSync(candidate.path) && matchingReceipt(candidate, manifestSha256)) {
       outcome.status = "already-done";
       continue;
     }
@@ -39051,13 +39339,13 @@ async function applyReclaimManifest(options, dependencies) {
   }
   return { manifestSha256, dryRun: !options.yes, targets, stoppedEarly };
 }
-var import_node_child_process46, import_node_crypto42, import_node_fs60, import_node_path73, MANIFEST_KIND, LEGACY_MANIFEST_KIND, RECEIPT_KIND, SCHEMA_VERSION, HEX_SHA, HEX_ID, VETO_TIMEOUT_MS, FUTURE_TOLERANCE_SECONDS, ROOT_KEYS, SESSION_ROOT_KEYS, LEGACY_ROOT_KEYS, CANDIDATE_KEYS, SESSION_CANDIDATE_KEYS, OPTIONAL_CANDIDATE_KEYS, ReclaimSkip;
+var import_node_child_process47, import_node_crypto43, import_node_fs61, import_node_path73, MANIFEST_KIND, LEGACY_MANIFEST_KIND, RECEIPT_KIND, SCHEMA_VERSION, HEX_SHA, HEX_ID, VETO_TIMEOUT_MS, FUTURE_TOLERANCE_SECONDS, ROOT_KEYS, SESSION_ROOT_KEYS, LEGACY_ROOT_KEYS, CANDIDATE_KEYS, SESSION_CANDIDATE_KEYS, OPTIONAL_CANDIDATE_KEYS, ReclaimSkip;
 var init_worktree_reclaim = __esm({
   "src/core/worktree-reclaim.ts"() {
     "use strict";
-    import_node_child_process46 = require("child_process");
-    import_node_crypto42 = require("crypto");
-    import_node_fs60 = __toESM(require("fs"));
+    import_node_child_process47 = require("child_process");
+    import_node_crypto43 = require("crypto");
+    import_node_fs61 = __toESM(require("fs"));
     import_node_path73 = __toESM(require("path"));
     init_atomic_file();
     init_workspace();
@@ -39322,14 +39610,14 @@ function readLeftoverContext(repoPath) {
     registriesReadable: snapshots.unavailable.length === 0,
     realpath: (file) => {
       try {
-        return import_node_fs61.default.realpathSync.native(file);
+        return import_node_fs62.default.realpathSync.native(file);
       } catch {
         return void 0;
       }
     },
     exists: (file) => {
       try {
-        import_node_fs61.default.lstatSync(file);
+        import_node_fs62.default.lstatSync(file);
         return true;
       } catch (error) {
         return error.code !== "ENOENT";
@@ -39453,7 +39741,7 @@ function validateLeftoverManifest(value) {
   return root;
 }
 function readLeftoverManifest(file) {
-  const raw = import_node_fs61.default.readFileSync(file);
+  const raw = import_node_fs62.default.readFileSync(file);
   let parsed;
   try {
     parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(raw));
@@ -39467,7 +39755,7 @@ function readLeftoverManifest(file) {
   return { raw, manifest };
 }
 function gitCommonDir(repo) {
-  const result = (0, import_node_child_process47.spawnSync)(
+  const result = (0, import_node_child_process48.spawnSync)(
     "git",
     ["-C", repo, "rev-parse", "--path-format=absolute", "--git-common-dir"],
     { encoding: "utf-8" }
@@ -39639,7 +39927,7 @@ function leftoverReceiptPath(commonDir, manifestSha256, id5) {
 }
 function writeLeftoverReceipt(commonDir, manifestSha256, candidate, steps, nowEpoch) {
   const file = leftoverReceiptPath(commonDir, manifestSha256, candidate.id);
-  import_node_fs61.default.mkdirSync(import_node_path74.default.dirname(file), { recursive: true });
+  import_node_fs62.default.mkdirSync(import_node_path74.default.dirname(file), { recursive: true });
   writeFileAtomically(
     file,
     canonicalJson({
@@ -39655,12 +39943,12 @@ function writeLeftoverReceipt(commonDir, manifestSha256, candidate, steps, nowEp
     })
   );
 }
-var import_node_child_process47, import_node_fs61, import_node_path74, LEFTOVER_MANIFEST_KIND, LEFTOVER_RECEIPT_KIND, SCHEMA_VERSION2, MAX_DOCKER_OBJECTS, FUTURE_TOLERANCE_SECONDS2, PROJECT_LABEL, WORKING_DIR_LABEL, PROVIDER_LABEL, STOPPED_STATES, HEX_ID2, DockerListingBoundError, defaultDockerRunner, LeftoverSkip, defaultWithLocks;
+var import_node_child_process48, import_node_fs62, import_node_path74, LEFTOVER_MANIFEST_KIND, LEFTOVER_RECEIPT_KIND, SCHEMA_VERSION2, MAX_DOCKER_OBJECTS, FUTURE_TOLERANCE_SECONDS2, PROJECT_LABEL, WORKING_DIR_LABEL, PROVIDER_LABEL, STOPPED_STATES, HEX_ID2, DockerListingBoundError, defaultDockerRunner, LeftoverSkip, defaultWithLocks;
 var init_docker_leftovers = __esm({
   "src/core/docker-leftovers.ts"() {
     "use strict";
-    import_node_child_process47 = require("child_process");
-    import_node_fs61 = __toESM(require("fs"));
+    import_node_child_process48 = require("child_process");
+    import_node_fs62 = __toESM(require("fs"));
     import_node_path74 = __toESM(require("path"));
     init_atomic_file();
     init_devpod_mutation();
@@ -39682,7 +39970,7 @@ var init_docker_leftovers = __esm({
     DockerListingBoundError = class extends Error {
     };
     defaultDockerRunner = (args) => {
-      const result = (0, import_node_child_process47.spawnSync)("docker", args, {
+      const result = (0, import_node_child_process48.spawnSync)("docker", args, {
         encoding: "utf-8",
         timeout: 6e4,
         maxBuffer: 256 * 1024 * 1024
@@ -39713,13 +40001,13 @@ function measureWorktreeConsumption(worktreePath, options) {
   const startedAt = Date.now();
   let rootStat;
   try {
-    rootStat = import_node_fs62.default.lstatSync(worktreePath);
+    rootStat = import_node_fs63.default.lstatSync(worktreePath);
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
   let rootEntries;
   try {
-    rootEntries = import_node_fs62.default.readdirSync(worktreePath, { withFileTypes: true });
+    rootEntries = import_node_fs63.default.readdirSync(worktreePath, { withFileTypes: true });
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
@@ -39748,7 +40036,7 @@ function measureWorktreeConsumption(worktreePath, options) {
       const entryPath = import_node_path75.default.join(dirPath, entry.name);
       let entryStat;
       try {
-        entryStat = import_node_fs62.default.lstatSync(entryPath);
+        entryStat = import_node_fs63.default.lstatSync(entryPath);
       } catch (error) {
         if (error?.code === "ENOENT") continue;
         unreadableReason = describeIncompleteWalk(error);
@@ -39758,7 +40046,7 @@ function measureWorktreeConsumption(worktreePath, options) {
       if (!entryStat.isDirectory()) continue;
       let childEntries;
       try {
-        childEntries = import_node_fs62.default.readdirSync(entryPath, { withFileTypes: true });
+        childEntries = import_node_fs63.default.readdirSync(entryPath, { withFileTypes: true });
       } catch (error) {
         unreadableReason = describeIncompleteWalk(error);
         break;
@@ -39822,11 +40110,11 @@ function describeError(error, worktreePath) {
   }
   return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
 }
-var import_node_fs62, import_node_path75, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var import_node_fs63, import_node_path75, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
 var init_workspace_consumption = __esm({
   "src/core/workspace-consumption.ts"() {
     "use strict";
-    import_node_fs62 = __toESM(require("fs"));
+    import_node_fs63 = __toESM(require("fs"));
     import_node_path75 = __toESM(require("path"));
     init_devpod_environment();
     DEFAULT_DEADLINE_MS = 1e4;
@@ -39913,7 +40201,7 @@ function evaluateWorkspaceActivity(evidence, cutoff) {
 }
 function readGitSnapshot(worktree, commandRunner) {
   const comparablePath = comparableWorkspacePath(worktree.path);
-  if (worktree.prunable || !import_node_fs63.default.existsSync(comparablePath)) {
+  if (worktree.prunable || !import_node_fs64.default.existsSync(comparablePath)) {
     return { worktree, checkout: "missing", head: null, committerDate: null };
   }
   const head = gitOutput(comparablePath, ["rev-parse", "--verify", "HEAD"], commandRunner);
@@ -40545,7 +40833,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
     dependencies.listForge ?? ((identity2) => listForgeChanges(identity2))
   );
   const sources = (dependencies.readRuntimeSources ?? readRuntimeSources)(repoPath);
-  const disposable = import_node_fs63.default.existsSync(import_node_path76.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees?.disposable ?? [] : [];
+  const disposable = import_node_fs64.default.existsSync(import_node_path76.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees?.disposable ?? [] : [];
   const [primary, ...linked] = worktrees;
   const safetyFor = (worktree, worktreePath, evidence) => toSafety(
     classify({
@@ -40553,7 +40841,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
       branch: worktree?.branch,
       primary: primary !== void 0 && sameWorkspacePath(primary.path, worktreePath),
       locked: worktree?.locked ?? false,
-      missing: !worktree || worktree.prunable || !import_node_fs63.default.existsSync(worktreePath),
+      missing: !worktree || worktree.prunable || !import_node_fs64.default.existsSync(worktreePath),
       runtimeEvidence: evidence,
       forge,
       extraDisposablePatterns: disposable
@@ -40614,7 +40902,7 @@ function readPathEvidence(repoPath, worktreePath, inactiveFor, dependencies) {
   }
   const sources = (dependencies.readRuntimeSources ?? readRuntimeSources)(repoPath);
   const cutoffEpoch = Math.floor(Date.now() / 1e3) - parseInactiveFor(inactiveFor).seconds;
-  const gitDir = (0, import_node_child_process48.spawnSync)(
+  const gitDir = (0, import_node_child_process49.spawnSync)(
     "git",
     ["-C", worktreePath, "rev-parse", "--path-format=absolute", "--git-dir"],
     { encoding: "utf-8", env: READ_ONLY_GIT_ENV2 }
@@ -40634,7 +40922,7 @@ function classifyExactPath(repoPath, worktreePath, evidence, forge, extraDisposa
     branch: worktree?.branch,
     primary: worktrees[0] !== void 0 && sameWorkspacePath(worktrees[0].path, worktreePath),
     locked: worktree?.locked ?? false,
-    missing: !worktree || worktree.prunable || !import_node_fs63.default.existsSync(worktreePath),
+    missing: !worktree || worktree.prunable || !import_node_fs64.default.existsSync(worktreePath),
     runtimeEvidence: evidence.runtimeEvidence,
     forge,
     extraDisposablePatterns
@@ -40660,7 +40948,7 @@ function prepareReclaimVerdicts(repo, inactiveFor, dependencies = {}) {
     dependencies.listForge ?? ((identity2) => listForgeChanges(identity2))
   );
   const forge = evidence.status === "not-checked" ? { status: "unavailable", reason: "forge not checked" } : evidence;
-  const disposable = import_node_fs63.default.existsSync(import_node_path76.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees?.disposable ?? [] : [];
+  const disposable = import_node_fs64.default.existsSync(import_node_path76.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees?.disposable ?? [] : [];
   const paths = evidenceCache(
     (worktreePath) => readPathEvidence(repoPath, worktreePath, inactiveFor, dependencies)
   );
@@ -40679,7 +40967,7 @@ function prepareReclaimVerdicts(repo, inactiveFor, dependencies = {}) {
 }
 function prepareTrimChecks(repo, inactiveFor, dependencies = {}) {
   const repoPath = resolveRepoPath(repo);
-  const configured = import_node_fs63.default.existsSync(import_node_path76.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees : void 0;
+  const configured = import_node_fs64.default.existsSync(import_node_path76.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees : void 0;
   const patterns = configured?.trim ?? [];
   const paths = evidenceCache(
     (worktreePath) => readPathEvidence(repoPath, worktreePath, inactiveFor, dependencies)
@@ -40704,12 +40992,12 @@ function prepareTrimChecks(repo, inactiveFor, dependencies = {}) {
     isActive: (worktreePath) => paths.last(worktreePath).active
   };
 }
-var import_node_child_process48, import_node_fs63, import_node_path76, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var import_node_child_process49, import_node_fs64, import_node_path76, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
 var init_workspace_cleanup = __esm({
   "src/core/workspace-cleanup.ts"() {
     "use strict";
-    import_node_child_process48 = require("child_process");
-    import_node_fs63 = __toESM(require("fs"));
+    import_node_child_process49 = require("child_process");
+    import_node_fs64 = __toESM(require("fs"));
     import_node_path76 = __toESM(require("path"));
     init_devpod_workspaces();
     init_docker_leftovers();
@@ -40733,7 +41021,7 @@ var init_workspace_cleanup = __esm({
     ];
     defaultCommandRunner = (command, args, input2) => {
       const environment = command === "git" ? READ_ONLY_GIT_ENV2 : { ...process.env, LC_ALL: "C" };
-      const result = (0, import_node_child_process48.spawnSync)(command, args, {
+      const result = (0, import_node_child_process49.spawnSync)(command, args, {
         encoding: "utf-8",
         env: environment,
         ...input2 === void 0 ? {} : { input: input2 }
@@ -40858,7 +41146,7 @@ function journalVetoes(record6) {
 }
 function readTraefikWindow(cutoffMs) {
   const since = String(Math.floor(cutoffMs / 1e3));
-  const run = (args, maxBuffer) => (0, import_node_child_process49.spawnSync)("docker", ["logs", "--timestamps", ...args, ROUTER_CONTAINER_NAME], {
+  const run = (args, maxBuffer) => (0, import_node_child_process50.spawnSync)("docker", ["logs", "--timestamps", ...args, ROUTER_CONTAINER_NAME], {
     encoding: "utf-8",
     maxBuffer,
     ...networkDockerOptions()
@@ -41027,12 +41315,12 @@ function setIdlePin(repoPath, pinned) {
     }
   );
 }
-var import_node_child_process49, import_node_fs64, import_node_path77, DEFAULT_IDLE_FOR, ACTIVITY_FILES, IdleStopSkipped, defaultDependencies;
+var import_node_child_process50, import_node_fs65, import_node_path77, DEFAULT_IDLE_FOR, ACTIVITY_FILES, IdleStopSkipped, defaultDependencies;
 var init_workspace_idle = __esm({
   "src/core/workspace-idle.ts"() {
     "use strict";
-    import_node_child_process49 = require("child_process");
-    import_node_fs64 = __toESM(require("fs"));
+    import_node_child_process50 = require("child_process");
+    import_node_fs65 = __toESM(require("fs"));
     import_node_path77 = __toESM(require("path"));
     init_devpod_environment();
     init_devpod_workspaces();
@@ -41054,7 +41342,7 @@ var init_workspace_idle = __esm({
       readJournals: () => listReliabilityOperations(),
       journalModifiedMs: (record6) => {
         try {
-          return import_node_fs64.default.statSync(reliabilityOperationPath(record6.identity)).mtimeMs;
+          return import_node_fs65.default.statSync(reliabilityOperationPath(record6.identity)).mtimeMs;
         } catch {
           return void 0;
         }
@@ -41062,7 +41350,7 @@ var init_workspace_idle = __esm({
       registryPaths: () => listMergedRuntimeWorkspaces().map((workspace) => workspace.source.localFolder),
       inspectContainers: () => inspectWorkspaceContainers(),
       statActivity: (containerId) => {
-        const result = (0, import_node_child_process49.spawnSync)(
+        const result = (0, import_node_child_process50.spawnSync)(
           "docker",
           ["exec", containerId, "stat", "-c", "%Y", ...ACTIVITY_FILES],
           {
@@ -41077,7 +41365,7 @@ var init_workspace_idle = __esm({
         };
       },
       readTraefik: readTraefikWindow,
-      isConfiguredCheckout: (repoPath) => import_node_fs64.default.existsSync(import_node_path77.default.join(repoPath, ".devrouter.yml")),
+      isConfiguredCheckout: (repoPath) => import_node_fs65.default.existsSync(import_node_path77.default.join(repoPath, ".devrouter.yml")),
       gitCommonDir: (repoPath) => {
         try {
           return resolveGitCommonDir(repoPath);
@@ -41171,7 +41459,7 @@ function defaultWorktreePath(mainRepo, ws) {
   return import_node_path78.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
-  const ignored = (0, import_node_child_process50.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
+  const ignored = (0, import_node_child_process51.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
     encoding: "utf-8"
   });
   if (ignored.status !== 0) {
@@ -41293,7 +41581,7 @@ function assertFullDownPreflight(mainRepo, target) {
   if (sameWorkspacePath(target.worktreePath, mainRepo)) {
     throw new Error("Refusing to remove the primary Git checkout.");
   }
-  if (!target.worktree || target.worktree.prunable || !import_node_fs65.default.existsSync(target.worktreePath)) return;
+  if (!target.worktree || target.worktree.prunable || !import_node_fs66.default.existsSync(target.worktreePath)) return;
   if (target.worktree.locked) {
     throw new Error(
       `Worktree '${target.worktreePath}' is locked; unlock it before workspace down.`
@@ -41325,7 +41613,7 @@ async function workspaceUp(branch, opts = {}) {
       (candidate) => defaultWorktreePath(mainRepo, candidate)
     );
     const generatedPath = candidatePaths.find(
-      (candidate) => !import_node_fs65.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
+      (candidate) => !import_node_fs66.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
     );
     const selectedPath = opts.path ? import_node_path78.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
     if (!selectedPath) {
@@ -41336,7 +41624,7 @@ async function workspaceUp(branch, opts = {}) {
         `Branch '${branch}' already uses worktree '${existingBranch.path}', not '${selectedPath}'.`
       );
     }
-    if (import_node_fs65.default.existsSync(selectedPath)) {
+    if (import_node_fs66.default.existsSync(selectedPath)) {
       const registered = worktrees.find(
         (worktree) => sameWorkspacePath(worktree.path, selectedPath)
       );
@@ -41355,11 +41643,11 @@ async function workspaceUp(branch, opts = {}) {
       return selectedPath;
     }
     if (!opts.path) assertDefaultWorktreeRootIgnored(mainRepo);
-    const add2 = (0, import_node_child_process50.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
+    const add2 = (0, import_node_child_process51.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
       encoding: "utf-8"
     });
     if (add2.status !== 0) {
-      const addNew = (0, import_node_child_process50.spawnSync)(
+      const addNew = (0, import_node_child_process51.spawnSync)(
         "git",
         ["-C", mainRepo, "worktree", "add", "-b", branch, selectedPath],
         { encoding: "utf-8" }
@@ -41499,8 +41787,8 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     const result = await mutateWorkspaceRuntime("delete", resolved2, worktrees, opts.quiet);
     if (removeWorktree) {
-      if (resolved2.worktree && !resolved2.worktree.prunable && import_node_fs65.default.existsSync(resolved2.worktreePath)) {
-        const rm = (0, import_node_child_process50.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved2.worktreePath], {
+      if (resolved2.worktree && !resolved2.worktree.prunable && import_node_fs66.default.existsSync(resolved2.worktreePath)) {
+        const rm = (0, import_node_child_process51.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved2.worktreePath], {
           encoding: "utf-8"
         });
         if (rm.status !== 0) {
@@ -41518,7 +41806,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     return result;
   };
-  return resolved2.worktree && !resolved2.worktree.prunable && import_node_fs65.default.existsSync(resolved2.worktreePath) ? withLifecycleOperationLock(resolved2.worktreePath, operation) : operation();
+  return resolved2.worktree && !resolved2.worktree.prunable && import_node_fs66.default.existsSync(resolved2.worktreePath) ? withLifecycleOperationLock(resolved2.worktreePath, operation) : operation();
 }
 async function reclaimWorktreeExactPath(mainRepo, worktreePath, verify, afterRemove, steps) {
   await withLifecycleOperationLock(worktreePath, async () => {
@@ -41544,7 +41832,7 @@ async function reclaimWorktreeExactPath(mainRepo, worktreePath, verify, afterRem
       );
       steps.push("runtime-deleted");
     }
-    const rm = (0, import_node_child_process50.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", worktreePath], {
+    const rm = (0, import_node_child_process51.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", worktreePath], {
       encoding: "utf-8"
     });
     if (rm.status !== 0) {
@@ -41565,12 +41853,12 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process50, import_node_fs65, import_node_path78, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
+var import_node_child_process51, import_node_fs66, import_node_path78, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
-    import_node_child_process50 = require("child_process");
-    import_node_fs65 = __toESM(require("fs"));
+    import_node_child_process51 = require("child_process");
+    import_node_fs66 = __toESM(require("fs"));
     import_node_path78 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
@@ -41590,7 +41878,7 @@ var init_workspace_lifecycle = __esm({
 
 // src/core/worktree-trim.ts
 function listIgnoredPaths(worktreePath) {
-  const result = (0, import_node_child_process51.spawnSync)(
+  const result = (0, import_node_child_process52.spawnSync)(
     "git",
     [
       "-C",
@@ -41679,14 +41967,14 @@ function isInside(parent, child) {
 }
 function exists(file) {
   try {
-    import_node_fs66.default.lstatSync(file);
+    import_node_fs67.default.lstatSync(file);
     return true;
   } catch {
     return false;
   }
 }
 function hasTrackedFiles(worktreePath, relative2) {
-  const result = (0, import_node_child_process51.spawnSync)(
+  const result = (0, import_node_child_process52.spawnSync)(
     "git",
     ["-C", worktreePath, "--literal-pathspecs", "ls-files", "-z", "--", relative2],
     { encoding: "utf-8", env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" } }
@@ -41697,7 +41985,7 @@ function trimOnePath(candidate, relative2, patterns, steps) {
   const target = import_node_path79.default.join(candidate.path, relative2);
   let stat;
   try {
-    stat = import_node_fs66.default.lstatSync(target);
+    stat = import_node_fs67.default.lstatSync(target);
   } catch (error) {
     if (error.code === "ENOENT") {
       steps.push(`gone:${relative2}`);
@@ -41709,7 +41997,7 @@ function trimOnePath(candidate, relative2, patterns, steps) {
     steps.push(`skipped-symlink:${relative2}`);
     return;
   }
-  if (!isInside(import_node_fs66.default.realpathSync.native(candidate.path), import_node_fs66.default.realpathSync.native(target))) {
+  if (!isInside(import_node_fs67.default.realpathSync.native(candidate.path), import_node_fs67.default.realpathSync.native(target))) {
     steps.push(`skipped-outside:${relative2}`);
     return;
   }
@@ -41722,7 +42010,7 @@ function trimOnePath(candidate, relative2, patterns, steps) {
     return;
   }
   try {
-    import_node_fs66.default.rmSync(target, { recursive: true, force: true });
+    import_node_fs67.default.rmSync(target, { recursive: true, force: true });
   } catch (error) {
     steps.push(`partial:${relative2}`);
     throw error;
@@ -41823,12 +42111,12 @@ async function applyTrimManifest(options, dependencies) {
   }
   return { manifestSha256, dryRun: !options.yes, targets, stoppedEarly };
 }
-var import_node_child_process51, import_node_fs66, import_node_path79;
+var import_node_child_process52, import_node_fs67, import_node_path79;
 var init_worktree_trim = __esm({
   "src/core/worktree-trim.ts"() {
     "use strict";
-    import_node_child_process51 = require("child_process");
-    import_node_fs66 = __toESM(require("fs"));
+    import_node_child_process52 = require("child_process");
+    import_node_fs67 = __toESM(require("fs"));
     import_node_path79 = __toESM(require("path"));
     init_reliability_lifecycle();
     init_worktree_reclaim();
@@ -41897,7 +42185,7 @@ function runWorkspaceLsCommand(options) {
 }
 function writeManifestOutput(manifest, output2) {
   if (output2) {
-    import_node_fs67.default.writeFileSync(output2, manifest, { flag: "wx" });
+    import_node_fs68.default.writeFileSync(output2, manifest, { flag: "wx" });
     process.stdout.write(`${sha256Hex(manifest)}  ${output2}
 `);
   } else {
@@ -41927,7 +42215,7 @@ function runWorkspaceCleanupCommand(options) {
       throw new Error("--manifest requires --all-worktrees and --check-merged.");
     }
     const createdAtEpoch = Math.floor(Date.now() / 1e3);
-    const worktrees = import_node_fs67.default.existsSync(import_node_path80.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees : void 0;
+    const worktrees = import_node_fs68.default.existsSync(import_node_path80.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees : void 0;
     const manifest = action2 === "trim" ? buildTrimManifest(
       report,
       { trim: worktrees?.trim ?? [], disposable: worktrees?.disposable },
@@ -41965,7 +42253,7 @@ async function runWorkspaceIdleCommand(options) {
   if (options.stop) {
     const paths = idleSweepPaths();
     if (!process.stderr.isTTY) muteLifecycleProgressHeartbeat();
-    import_node_fs67.default.mkdirSync(paths.directory, { recursive: true, mode: 448 });
+    import_node_fs68.default.mkdirSync(paths.directory, { recursive: true, mode: 448 });
     const result = await withFileLock(paths.lock, { activity: "idle sweep" }, async () => {
       try {
         const swept = await stopIdleEnvironments(
@@ -42067,7 +42355,7 @@ async function runWorkspaceJournalSettleCommand(options) {
 function runWorkspaceManifestHashCommand(file) {
   let leftover = false;
   try {
-    leftover = isLeftoverManifest(JSON.parse(import_node_fs67.default.readFileSync(file, "utf-8")));
+    leftover = isLeftoverManifest(JSON.parse(import_node_fs68.default.readFileSync(file, "utf-8")));
   } catch {
   }
   const { raw } = leftover ? readLeftoverManifest(file) : readManifest(file);
@@ -42164,11 +42452,11 @@ async function runWorkspaceTrimCommand(options) {
     process.exitCode = 1;
   }
 }
-var import_node_fs67, import_node_path80;
+var import_node_fs68, import_node_path80;
 var init_workspace2 = __esm({
   "src/commands/workspace.ts"() {
     "use strict";
-    import_node_fs67 = __toESM(require("fs"));
+    import_node_fs68 = __toESM(require("fs"));
     import_node_path80 = __toESM(require("path"));
     init_docker_leftovers();
     init_file_lock();
@@ -42227,7 +42515,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.6.2" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.6.4" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {
@@ -42321,7 +42609,7 @@ program.command("up").description("Ensure devnet and start shared Traefik (reser
     await runUpCommand2();
   })
 );
-program.command("ensure").description("Start and prove a primary or linked checkout's environment and routes").argument("[path]", "Git checkout path (defaults to current directory)").option("--profile <name>", "Start only this profile's apps/dependencies from .devrouter.yml").option("--variant <name>", "Select a declared managed runtime variant").option("--repair", "Repair a degraded managed runtime from its recorded profile").option("--initialize-new", "Initialize one fresh disposable managed environment explicitly").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
+program.command("ensure").description("Start and prove a primary or linked checkout's environment and routes").argument("[path]", "Git checkout path (defaults to current directory)").option("--profile <name>", "Start only this profile's apps/dependencies from .devrouter.yml").option("--variant <name>", "Select a declared managed runtime variant").option("--repair", "Repair a degraded managed runtime from its recorded profile").option("--initialize-new", "Initialize one fresh disposable managed environment explicitly").option("--replace-app", "Replace one proved stopped managed app; discard its writable layer").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
   withErrorHandling(async (repoPath, _options, command) => {
     const options = command.opts();
     const { runEnsureCommand: runEnsureCommand2 } = await Promise.resolve().then(() => (init_ensure(), ensure_exports));
@@ -42331,6 +42619,7 @@ program.command("ensure").description("Start and prove a primary or linked check
       variant: options.variant,
       repair: options.repair,
       initializeNew: options.initializeNew,
+      replaceApp: options.replaceApp,
       open: Boolean(options.open),
       json: Boolean(options.json)
     });
@@ -42595,7 +42884,7 @@ workspaceCommand2.command("up").description(
 );
 workspaceCommand2.command("ensure").description(
   "Start and prove a primary or linked checkout's workspace runtime, upstreams, and routes"
-).argument("[path]", "Git checkout path (defaults to current directory)").option("--profile <name>", "Start only this profile's apps/dependencies from .devrouter.yml").option("--variant <name>", "Select a declared managed runtime variant").option("--repair", "Repair a degraded managed runtime from its recorded profile").option("--initialize-new", "Initialize one fresh disposable managed environment explicitly").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
+).argument("[path]", "Git checkout path (defaults to current directory)").option("--profile <name>", "Start only this profile's apps/dependencies from .devrouter.yml").option("--variant <name>", "Select a declared managed runtime variant").option("--repair", "Repair a degraded managed runtime from its recorded profile").option("--initialize-new", "Initialize one fresh disposable managed environment explicitly").option("--replace-app", "Replace one proved stopped managed app; discard its writable layer").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
   withErrorHandling(
     async (worktreePath, _options, command) => {
       const options = command.opts();
@@ -42606,6 +42895,7 @@ workspaceCommand2.command("ensure").description(
         variant: options.variant,
         repair: options.repair,
         initializeNew: options.initializeNew,
+        replaceApp: options.replaceApp,
         open: Boolean(options.open),
         json: Boolean(options.json)
       });