@moinulmoin/eden 0.4.1 → 0.6.0

package/dist/eve-control-plane.js

@@ -11,6 +11,7 @@ import { EveCliError, } from "./eve.js";
 import { buildEveProjectSnapshot, createDockerEveProjectBuilder, revalidateEveProjectCandidateInputs, EvePackagingError, } from "./eve-packaging.js";
 import { buildEveRuntimeImage, discardEveRuntimeImage, revalidateEveRuntimeCandidate, validateEveHostRequirements, } from "./eve-runtime-image.js";
 import { EveRuntimeConfigError, prepareEveRuntimeInjection, redactEveRuntimeOutput, } from "./eve-runtime-config.js";
+import { createEveHostConfig, generateEveHostWorkerSource, parseEveScheduleCron, resolveStableWorkersDevOrigin, } from "@moinulmoin/eden-runtime-cloudflare";
 const execFileAsync = promisify(execFile);
 const require = createRequire(import.meta.url);
 const wranglerEntrypoint = require.resolve("wrangler");
@@ -290,7 +291,7 @@ function humanEveResultLines(result, startedAt, eveVersion) {
     if (result.ok) {
         if (result.command === "eve deploy") {
             const url = result.deployment?.stableWorkersDevOrigin;
-            lines.push("", `✓ deployed ${result.name} (${result.environment})` +
+            lines.push("", `✓ ${result.deployment?.operation === "update" ? "updated" : "deployed"} ${result.name} (${result.environment})` +
                 (eveVersion === undefined ? "" : ` · eve ${eveVersion}`));
             if (url !== undefined)
                 lines.push(url);
@@ -306,7 +307,7 @@ function humanEveResultLines(result, startedAt, eveVersion) {
         lines.push("", `✗ ${commandLabel} ${result.deployment.status}`, `  → ${result.deployment.status === "indeterminate"
             ? "The outcome is indeterminate; inspect the retained ownership evidence before retrying the same exact target."
             : result.deployment.status === "deployed"
-                ? "The deployment is live; only local runtime-image cleanup failed, so do not retry the deployment."
+                ? "The deployment is live; only image cleanup failed (local runtime image or the superseded registry tag), so do not retry the deployment."
                 : "The deployment failed before promotion; the exact target was not claimed."}`);
     }
     else if (firstFailure !== undefined) {
@@ -440,10 +441,13 @@ function exactContainerEntries(value, name) {
             typeof entry.name !== "string") {
             return undefined;
         }
-        const id = entry.id;
         const entryName = entry.name;
-        if (entryName === name)
-            entries.push({ id, name: entryName });
+        if (entryName === name) {
+            entries.push({
+                id: entry.id,
+                name: entryName,
+            });
+        }
     }
     if (entries.length === 0 && collection.length >= 100) {
         return undefined;
@@ -595,6 +599,9 @@ async function defaultCloudflareRead(request) {
             target: { state: "absent" },
         };
     }
+    const workerPresent = deploymentEntries.length > 0;
+    const containerPresent = (containerEntries?.length ?? 0) > 0;
+    const providerEvidence = await readProviderEvidence(request.name, accountId, workerPresent, containerPresent ? containerEntries?.[0] : undefined);
     return {
         accountAccess,
         containerAccess,
@@ -605,16 +612,175 @@ async function defaultCloudflareRead(request) {
             ? {}
             : { workersDevSubdomain }),
         target: {
-            state: "ambiguous",
-            message: "The exact target could not be proven absent or owned from the read-only Cloudflare inventory.",
-            remediation: "Resolve the exact Worker and Container ownership state before deployment; no target was claimed or changed.",
+            // The read-only inventory proves the exact target exists but cannot
+            // prove who created it; Eden's immutable deployment record resolves
+            // ownership next.
+            state: "unowned",
+            observed: { worker: workerPresent, container: containerPresent },
+            ...(providerEvidence === undefined ? {} : { providerEvidence }),
+            message: "The exact Worker or Container target already exists, and the read-only inventory cannot prove Eden owns it.",
+            remediation: "Deploy under a different --name or remove the conflicting Worker/Container yourself; Eden never adopts or replaces resources it cannot prove it created.",
+        },
+    };
+}
+/**
+ * Reads provider-backed facts about the live target: the Container
+ * application's identity from `wrangler containers list` plus `containers
+ * info` (scheduling policy and Durable Object namespace), and the
+ * `EDEN_EVE_DEPLOYMENT_ID` plain-text var plus the `EVE_CONTAINER` Durable
+ * Object namespace Eden stamps into every Worker it publishes (from the
+ * script settings API). All are provider state — a foreign Worker can forge
+ * `x-eden-*` response headers but cannot set vars or namespaces Eden
+ * recorded at publish time. The ownership proof is the Container
+ * application's Durable Object namespace matching the Worker's binding
+ * namespace.
+ */
+async function readProviderEvidence(workerName, accountId, workerPresent, containerEntry) {
+    const evidence = {
+        ...(containerEntry === undefined
+            ? {}
+            : { containerApplicationId: containerEntry.id }),
+    };
+    if (containerEntry !== undefined) {
+        const info = await readWranglerJson([
+            "containers",
+            "info",
+            containerEntry.id,
+            "--json",
+        ]);
+        if (!info.failed && typeof info.value === "object" && info.value !== null) {
+            const infoRecord = info.value;
+            if (typeof infoRecord.scheduling_policy === "string") {
+                evidence.containerSchedulingPolicy = infoRecord.scheduling_policy;
+            }
+            const namespaceId = infoRecord.durable_objects?.namespace_id;
+            if (typeof namespaceId === "string") {
+                evidence.containerNamespaceId = namespaceId;
+            }
+        }
+    }
+    if (workerPresent && accountId !== undefined) {
+        const token = process.env.CLOUDFLARE_API_TOKEN ??
+            (await readWranglerOAuthToken());
+        if (token !== undefined) {
+            try {
+                const response = await fetch(`https://api.cloudflare.com/client/v4/accounts/${accountId}/workers/scripts/${encodeURIComponent(workerName)}/settings`, {
+                    headers: { authorization: `Bearer ${token}` },
+                    signal: AbortSignal.timeout(20_000),
+                });
+                if (response.ok) {
+                    evidence.settingsReadable = true;
+                    const parsed = (await response.json());
+                    const bindings = parsed.result?.bindings ?? [];
+                    const deploymentBinding = bindings.find((value) => value.type === "plain_text" &&
+                        value.name === "EDEN_EVE_DEPLOYMENT_ID");
+                    if (typeof deploymentBinding?.text === "string") {
+                        evidence.workerDeploymentId = deploymentBinding.text;
+                    }
+                    const containerBinding = bindings.find((value) => value.type === "durable_object_namespace" &&
+                        value.name === "EVE_CONTAINER");
+                    if (typeof containerBinding?.namespace_id === "string") {
+                        evidence.workerContainerNamespaceId = containerBinding.namespace_id;
+                    }
+                }
+                else if (response.status !== 404) {
+                    evidence.settingsReadable = false;
+                }
+            }
+            catch {
+                evidence.settingsReadable = false;
+            }
+        }
+    }
+    return evidence;
+}
+/**
+ * Resolves `unowned` reads against Eden's immutable deployment records AND
+ * the live remote target. The local record proves Eden once created the
+ * target; the remote Worker's stamped identity proves it is still the one
+ * Eden deployed — a same-name Worker recreated by something else after the
+ * target was destroyed (or a forged local record) must never be upgraded to
+ * `owned`.
+ */
+async function resolveEveTargetOwnership(request, result) {
+    if (result.target.state !== "unowned")
+        return result;
+    const record = await readEveDeploymentRecord(request.projectRoot, request.environment, request.name, result.accountId, request.projectId === "unknown-project" ? undefined : request.projectId);
+    if (record === undefined ||
+        record.identity.workerName !== request.name ||
+        record.identity.accountId !== result.accountId ||
+        (request.projectId !== "unknown-project" &&
+            record.identity.projectId !== undefined &&
+            record.identity.projectId !== request.projectId) ||
+        (result.target.observed?.container === true &&
+            record.identity.containerApplicationName !==
+                boundedResourceName(request.name, "container"))) {
+        return result;
+    }
+    // Remote proof must come from provider state. A foreign Worker can echo
+    // `x-eden-*` response headers, but it cannot plant the plain-text var Eden
+    // publishes into script settings or claim the Durable Object namespace the
+    // Worker's EVE_CONTAINER binding resolves to. The Worker is proven only by
+    // its own settings: unreadable settings fail closed.
+    const evidence = result.target.providerEvidence;
+    const recordedDeploymentIds = new Set(record.deploymentIds);
+    const workerProven = result.target.observed?.worker !== true ||
+        (evidence?.settingsReadable === true &&
+            evidence.workerDeploymentId !== undefined &&
+            recordedDeploymentIds.has(evidence.workerDeploymentId));
+    // The Container proof is the application running the durable_object
+    // scheduling policy with a namespace that matches the Worker binding's
+    // namespace; anything else fails closed.
+    const containerProven = result.target.observed?.container !== true ||
+        (evidence?.containerSchedulingPolicy === "durable_object" &&
+            evidence.containerNamespaceId !== undefined &&
+            evidence.workerContainerNamespaceId !== undefined &&
+            evidence.containerNamespaceId === evidence.workerContainerNamespaceId);
+    const remoteProven = evidence !== undefined && workerProven && containerProven;
+    if (!remoteProven) {
+        return {
+            ...result,
+            target: {
+                ...result.target,
+                message: "The exact Worker or Container target exists, and although a local Eden record matches, provider state cannot prove it is the one Eden deployed — the target may have been recreated outside Eden.",
+                remediation: "Inspect the Worker at its workers.dev origin and the recorded deployment history before redeploying; if it is not Eden's, deploy under a different --name or delete it yourself.",
+            },
+        };
+    }
+    const priorIdentity = {
+        workerName: record.identity.workerName,
+        containerApplicationName: record.identity.containerApplicationName,
+        stableContainerInstanceName: record.identity.stableContainerInstanceName,
+        accountId: record.identity.accountId,
+        environment: request.environment,
+        name: request.name,
+        ...(record.identity.projectId === undefined
+            ? {}
+            : { projectId: record.identity.projectId }),
+        ...(record.identity.generationId === undefined
+            ? {}
+            : { generationId: record.identity.generationId }),
+        ...(record.identity.containerImage === undefined
+            ? {}
+            : { containerImage: record.identity.containerImage }),
+    };
+    return {
+        ...result,
+        target: {
+            state: "owned",
+            identity: priorIdentity,
+            ...(result.target.observed === undefined
+                ? {}
+                : { observed: result.target.observed }),
+            message: "The immutable deployment record proves Eden owns the exact target; deploy proceeds as an in-place update.",
         },
     };
 }
 async function readEveCloudflareTarget(request, options) {
-    return options.cloudflareRead === undefined
-        ? defaultCloudflareRead(request)
-        : options.cloudflareRead(request);
+    const result = options.cloudflareRead === undefined
+        ? await defaultCloudflareRead(request)
+        : await options.cloudflareRead(request);
+    return resolveEveTargetOwnership(request, result);
 }
 async function resolvedCloudflareOrigin(result, workerName) {
     if (result.accountId === undefined ||
@@ -622,7 +788,6 @@ async function resolvedCloudflareOrigin(result, workerName) {
         return undefined;
     }
     try {
-        const { resolveStableWorkersDevOrigin } = await import("@moinulmoin/eden-runtime-cloudflare");
         const origin = resolveStableWorkersDevOrigin({
             workerName,
             workersDevSubdomain: result.workersDevSubdomain,
@@ -713,12 +878,12 @@ function cloudflareChecks(result) {
         ? undefined
         : "Use an authenticated read-only adapter with account and Container access; preflight never uploads, publishes, or changes remote state.";
     const target = result.target;
-    const targetPasses = target.state === "absent" ||
-        (target.state === "owned" && target.matchesCandidate === true);
+    const targetPasses = target.state === "absent" || target.state === "owned";
     const targetMessage = targetPasses
         ? target.state === "absent"
             ? "The exact target read is absent and is eligible without claiming ownership."
-            : "The exact target is already owned by this candidate identity; no ownership claim was attempted."
+            : target.message ??
+                "The exact target is provably Eden-owned; deploy proceeds as an in-place update."
         : target.message ??
             "The exact target read is unowned, mismatched, cross-environment, or ambiguous.";
     const targetRemediation = targetPasses
@@ -989,8 +1154,6 @@ function defaultPublicationRunner() {
             "--env",
             request.identity.environment,
             "--strict",
-            "--containers-rollout",
-            "immediate",
         ], dirname(request.wranglerConfigPath));
         if (result.exitCode !== 0) {
             return {
@@ -1062,6 +1225,10 @@ function responseIdentity(response, body) {
     read("workerName", "x-eden-eve-worker-name");
     read("containerApplicationName", "x-eden-eve-container-application");
     read("stableContainerInstanceName", "x-eden-eve-container-instance");
+    const started = response.headers.get("x-eden-eve-started-deployment");
+    if (started !== null) {
+        identity["startedDeploymentId"] = started;
+    }
     read("containerImage", "x-eden-eve-container-image");
     return identity;
 }
@@ -1105,9 +1272,20 @@ function defaultHealthRunner() {
                     body.state === "ready" ||
                     body.ready === true);
             if (ready) {
+                const observedIdentity = responseIdentity(response, body);
+                // A Worker activates before its image rollout completes; promotion
+                // must wait until the *served container* verifiably runs this
+                // generation's image (the host stamps the header only after
+                // inspecting the running instance).
+                if (observedIdentity.startedDeploymentId !== request.identity.deploymentId) {
+                    lastReason =
+                        "The served Container has not verifiably started this deployment's image yet; waiting for the rollout to land.";
+                    await wait();
+                    continue;
+                }
                 return {
                     status: "ready",
-                    identity: responseIdentity(response, body),
+                    identity: observedIdentity,
                 };
             }
             lastReason =
@@ -1161,8 +1339,13 @@ async function releaseEveTargetLock(lock) {
     await rm(lock.path, { force: true });
     return (await lstat(lock.path).catch(() => undefined)) === undefined;
 }
-async function promoteEveTargetPointer(deploymentRoot, targetKey, generationRoot) {
-    const targetRoot = join(deploymentRoot, "targets", targetKey);
+/**
+ * Atomically re-points the target's CURRENT symlink at a promoted immutable
+ * generation. The pointer key is `<environment>-<name>` — the same path
+ * `destroy` clears and the update ownership resolver reads.
+ */
+async function promoteEveTargetPointer(deploymentRoot, pointerKey, generationRoot) {
+    const targetRoot = join(deploymentRoot, "targets", pointerKey);
     const artifactBoundary = await realpath(dirname(deploymentRoot)).catch(() => undefined);
     const generationCanonical = await realpath(generationRoot).catch(() => undefined);
     if (artifactBoundary === undefined ||
@@ -1191,7 +1374,7 @@ async function promoteEveTargetPointer(deploymentRoot, targetKey, generationRoot
         throw new EveCliError({
             code: "EVE_DEPLOY_PROMOTION_FAILED",
             message: "The Eve target pointer directory could not be verified safely.",
-            source: targetKey,
+            source: pointerKey,
         });
     }
     const currentPath = join(targetRoot, "CURRENT");
@@ -1208,7 +1391,7 @@ async function promoteEveTargetPointer(deploymentRoot, targetKey, generationRoot
         throw new EveCliError({
             code: "EVE_DEPLOY_PROMOTION_FAILED",
             message: "The Eve target pointer did not resolve to the promoted generation.",
-            source: targetKey,
+            source: pointerKey,
         });
     }
     return currentPath;
@@ -1242,9 +1425,10 @@ async function writeEveIndeterminateEvidence(candidate, evidence, extra = {}) {
         flag: "wx",
     });
 }
-function deploymentMetadata(identity, targetKey, status) {
+function deploymentMetadata(identity, targetKey, status, operation, superseded) {
     return {
         status,
+        operation,
         targetKey,
         deploymentId: identity.deploymentId,
         workerName: identity.workerName,
@@ -1252,6 +1436,12 @@ function deploymentMetadata(identity, targetKey, status) {
         stableContainerInstanceName: identity.stableContainerInstanceName,
         stableWorkersDevOrigin: identity.stableWorkersDevOrigin,
         imageReference: identity.containerImage,
+        ...(superseded?.generationId === undefined
+            ? {}
+            : { supersededGenerationId: superseded.generationId }),
+        ...(superseded?.containerImage === undefined
+            ? {}
+            : { supersededImageReference: superseded.containerImage }),
         runtimeVariableNames: identity.runtimeVariableNames,
         evidenceRetained: true,
     };
@@ -1273,6 +1463,46 @@ async function runEveDeployment(request, options, collected) {
         collected.projectId === undefined) {
         throw deploymentFailure("EVE_DEPLOY_CHECKS_FAILED", "The inline Eve deploy checks did not return a complete immutable candidate.");
     }
+    const isUpdate = cloudflare.target.state === "owned";
+    const operation = isUpdate ? "update" : "create";
+    const prior = collected.priorDeployment;
+    if (isUpdate && prior === undefined) {
+        throw deploymentFailure("EVE_UPDATE_RECORD_UNAVAILABLE", "The exact target is provably Eden-owned, but its immutable deployment record is unreadable; refusing to update without the recorded Durable Object history.");
+    }
+    if (isUpdate && prior?.durableObjects === undefined) {
+        throw deploymentFailure("EVE_UPDATE_RECORD_UNAVAILABLE", "The prior deployment record does not carry a readable Durable Object history; refusing to update because replacing it could emit a divergent migration list.");
+    }
+    const priorIdentity = prior?.identity;
+    const priorDurableObjects = prior?.durableObjects;
+    const superseded = isUpdate
+        ? {
+            generationId: priorIdentity?.generationId,
+            containerImage: priorIdentity?.containerImage,
+        }
+        : undefined;
+    const resultWarnings = collected.result.warnings;
+    if (isUpdate) {
+        const world = collected.workflowWorld;
+        const durableWorld = world !== undefined &&
+            world !== "local" &&
+            world !== "@workflow/world-local";
+        if (durableWorld) {
+            resultWarnings.push({
+                id: "EVE_UPDATE_IN_FLIGHT",
+                message: "This update replaces the running Container; durable World runs in flight resume on the new code — Cloudflare has no deployment pinning, so keep step names and payload shapes backward compatible.",
+                remediation: "Let pending approvals and long runs settle before updating, or keep step names, queue names, and serialized payloads compatible across the change.",
+            });
+        }
+        if (prior?.worldCloudflare !==
+            (world === "@moinulmoin/eden-world-cloudflare")) {
+            resultWarnings.push({
+                id: "EVE_UPDATE_WORLD_SWITCH",
+                message: "The compiled Workflow World changed since the last deploy; existing sessions and pending approvals stay in the previous World and do not migrate to the new one.",
+                remediation: "Existing Durable Object data is preserved (classes and bindings are never removed), but runs started before this update remain where they were created.",
+            });
+        }
+        eveProgress(options, "update: Durable Object data is preserved; the running Container restarts on its next request to serve the new image");
+    }
     const accountId = cloudflare.accountId ??
         cloudflare.target.identity?.accountId;
     const workersDevSubdomain = cloudflare.workersDevSubdomain ??
@@ -1282,7 +1512,6 @@ async function runEveDeployment(request, options, collected) {
     }
     let stableWorkersDevOrigin;
     try {
-        const { resolveStableWorkersDevOrigin } = await import("@moinulmoin/eden-runtime-cloudflare");
         stableWorkersDevOrigin = resolveStableWorkersDevOrigin({
             workerName: request.name,
             workersDevSubdomain,
@@ -1399,31 +1628,39 @@ async function runEveDeployment(request, options, collected) {
             ? {}
             : { runtimeRevisionHandle: runtimeInjection.protectedHandle }),
     };
+    const baseConfigRequest = {
+        accountId,
+        workerName: identity.workerName,
+        containerApplicationName: identity.containerApplicationName,
+        containerClassName: "EveHostDurableContainer",
+        containerBindingName: "EVE_CONTAINER",
+        stableContainerInstanceName: identity.stableContainerInstanceName,
+        deploymentId: identity.deploymentId,
+        generationId: identity.generationId,
+        stableWorkersDevOrigin: identity.stableWorkersDevOrigin,
+        containerImage: identity.containerImage,
+        runtimeVariableNames: identity.runtimeVariableNames,
+        ...(identity.runtimeRevisionHandle === undefined
+            ? {}
+            : { runtimeRevisionHandle: identity.runtimeRevisionHandle }),
+        schedules: collected.schedules ?? [],
+        ...(collected.workflowWorld === undefined
+            ? {}
+            : { workflowWorld: collected.workflowWorld }),
+        // In-place updates carry the prior Durable Object bindings and
+        // migration history forward verbatim: classes are append-only and are
+        // never silently re-declared or removed.
+        ...(isUpdate && priorDurableObjects !== undefined
+            ? { durableObjects: priorDurableObjects }
+            : {}),
+        ...(process.env.EDEN_EVE_CONTAINER_SLEEP_AFTER === undefined
+            ? {}
+            : { containerSleepAfter: process.env.EDEN_EVE_CONTAINER_SLEEP_AFTER }),
+    };
     let hostConfig;
     try {
-        const { createEveHostConfig, } = await import("@moinulmoin/eden-runtime-cloudflare");
         hostConfig = createEveHostConfig({
-            accountId,
-            workerName: identity.workerName,
-            containerApplicationName: identity.containerApplicationName,
-            containerClassName: "EveHostContainer",
-            containerBindingName: "EVE_CONTAINER",
-            stableContainerInstanceName: identity.stableContainerInstanceName,
-            deploymentId: identity.deploymentId,
-            generationId: identity.generationId,
-            stableWorkersDevOrigin: identity.stableWorkersDevOrigin,
-            containerImage: identity.containerImage,
-            runtimeVariableNames: identity.runtimeVariableNames,
-            ...(identity.runtimeRevisionHandle === undefined
-                ? {}
-                : { runtimeRevisionHandle: identity.runtimeRevisionHandle }),
-            schedules: collected.schedules ?? [],
-            ...(collected.workflowWorld === undefined
-                ? {}
-                : { workflowWorld: collected.workflowWorld }),
-            ...(process.env.EDEN_EVE_CONTAINER_SLEEP_AFTER === undefined
-                ? {}
-                : { containerSleepAfter: process.env.EDEN_EVE_CONTAINER_SLEEP_AFTER }),
+            ...baseConfigRequest,
         });
     }
     catch (error) {
@@ -1431,7 +1668,6 @@ async function runEveDeployment(request, options, collected) {
             ? error.message
             : "The exact Eve Worker/Container host configuration was invalid.");
     }
-    const { generateEveHostWorkerSource } = await import("@moinulmoin/eden-runtime-cloudflare");
     const workerSource = generateEveHostWorkerSource({ config: hostConfig });
     const paths = await writeEveDeploymentArtifacts(candidate, hostConfig, workerSource);
     const publicationRequest = {
@@ -1441,14 +1677,27 @@ async function runEveDeployment(request, options, collected) {
         ...paths,
         ...(runtimeInjection === undefined ? {} : { runtimeInjection }),
     };
+    /** Publishes one wrangler config; returns its terminal result. */
+    const publishOne = async (request) => (options.publish ?? defaultPublicationRunner())(request);
     let publication;
+    const writeFailureRecord = async (status, evidence) => {
+        try {
+            await writeEveDeploymentRecord(candidate, identity, hostConfig, status, {
+                evidence,
+            });
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+    };
     try {
         eveProgress(options, "publishing Worker and Container application");
-        publication = await (options.publish ?? defaultPublicationRunner())(publicationRequest);
+        publication = await publishOne(publicationRequest);
     }
     catch {
-        await writeEveDeploymentRecord(candidate, identity, hostConfig, "indeterminate", { evidence: "publication-threw-before-terminal-result" });
-        const deployment = deploymentMetadata(identity, targetKey, "indeterminate");
+        await writeFailureRecord("indeterminate", "publication-threw-before-terminal-result");
+        const deployment = deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded);
         return {
             ...collected.result,
             ok: false,
@@ -1456,11 +1705,11 @@ async function runEveDeployment(request, options, collected) {
         };
     }
     if (publication.status === "indeterminate") {
-        await writeEveDeploymentRecord(candidate, identity, hostConfig, "indeterminate", { evidence: safeText(publication.reason) });
+        await writeFailureRecord("indeterminate", safeText(publication.reason));
         return {
             ...collected.result,
             ok: false,
-            deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+            deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
         };
     }
     if (publication.status === "failed" ||
@@ -1472,7 +1721,7 @@ async function runEveDeployment(request, options, collected) {
             return {
                 ...collected.result,
                 ok: false,
-                deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+                deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
             };
         }
         if (publication.status === "failed" &&
@@ -1483,7 +1732,7 @@ async function runEveDeployment(request, options, collected) {
             return {
                 ...collected.result,
                 ok: false,
-                deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+                deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
             };
         }
         if (publication.status === "failed" &&
@@ -1501,7 +1750,7 @@ async function runEveDeployment(request, options, collected) {
                 return {
                     ...collected.result,
                     ok: false,
-                    deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+                    deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
                 };
             }
         }
@@ -1513,7 +1762,7 @@ async function runEveDeployment(request, options, collected) {
         return {
             ...collected.result,
             ok: false,
-            deployment: deploymentMetadata(identity, targetKey, "failed"),
+            deployment: deploymentMetadata(identity, targetKey, "failed", operation, superseded),
         };
     }
     let health;
@@ -1529,7 +1778,7 @@ async function runEveDeployment(request, options, collected) {
         return {
             ...collected.result,
             ok: false,
-            deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+            deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
         };
     }
     if (health.status === "indeterminate") {
@@ -1537,7 +1786,7 @@ async function runEveDeployment(request, options, collected) {
         return {
             ...collected.result,
             ok: false,
-            deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+            deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
         };
     }
     const observedHealthIdentity = health.status === "ready"
@@ -1554,7 +1803,7 @@ async function runEveDeployment(request, options, collected) {
             return {
                 ...collected.result,
                 ok: false,
-                deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+                deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
             };
         }
         if (publication.createdByAttempt === true &&
@@ -1564,7 +1813,7 @@ async function runEveDeployment(request, options, collected) {
             return {
                 ...collected.result,
                 ok: false,
-                deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+                deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
             };
         }
         if (publication.createdByAttempt === true &&
@@ -1578,7 +1827,7 @@ async function runEveDeployment(request, options, collected) {
                 return {
                     ...collected.result,
                     ok: false,
-                    deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+                    deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
                 };
             }
         }
@@ -1590,7 +1839,7 @@ async function runEveDeployment(request, options, collected) {
         return {
             ...collected.result,
             ok: false,
-            deployment: deploymentMetadata(identity, targetKey, "failed"),
+            deployment: deploymentMetadata(identity, targetKey, "failed", operation, superseded),
         };
     }
     try {
@@ -1609,7 +1858,7 @@ async function runEveDeployment(request, options, collected) {
                 return {
                     ...collected.result,
                     ok: false,
-                    deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+                    deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
                 };
             }
             await writeEveDeploymentRecord(candidate, identity, hostConfig, "failed", {
@@ -1620,7 +1869,7 @@ async function runEveDeployment(request, options, collected) {
             return {
                 ...collected.result,
                 ok: false,
-                deployment: deploymentMetadata(identity, targetKey, "failed"),
+                deployment: deploymentMetadata(identity, targetKey, "failed", operation, superseded),
             };
         }
         await writeEveDeploymentRecord(candidate, identity, hostConfig, "indeterminate", {
@@ -1631,7 +1880,7 @@ async function runEveDeployment(request, options, collected) {
         return {
             ...collected.result,
             ok: false,
-            deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+            deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
         };
     }
     await writeEveDeploymentRecord(candidate, identity, hostConfig, "deployed", {
@@ -1641,8 +1890,34 @@ async function runEveDeployment(request, options, collected) {
             identity: "exact",
         },
     });
-    await promoteEveTargetPointer(join(request.projectRoot, ".eden", "eve-deploy"), targetKey, candidate.generationRoot);
+    await promoteEveTargetPointer(join(request.projectRoot, ".eden", "eve-deploy"), `${request.environment}-${request.name}`, candidate.generationRoot);
     await options.afterPromotion?.();
+    let supersededImageCleanup;
+    if (isUpdate) {
+        // The superseded generation's registry repository is generation-scoped
+        // and no longer referenced once CURRENT promotes this generation; only
+        // then is it safe to delete. Every tag in the repository goes with it —
+        // including the snapshot tags Cloudflare created under it.
+        const previousRepository = priorIdentity === undefined
+            ? undefined
+            : ownedRegistryRepository(priorIdentity, request.environment, request.name, accountId);
+        if (previousRepository !== undefined) {
+            eveProgress(options, `deleting superseded registry repository ${previousRepository}`);
+            let deleted = "indeterminate";
+            try {
+                deleted = await (options.deleteRegistryRepository ??
+                    defaultRegistryRepositoryDelete)({ repository: previousRepository });
+            }
+            catch {
+                deleted = "indeterminate";
+            }
+            supersededImageCleanup = deleted === "indeterminate"
+                ? check("VAL-LIFE-007", "failed", `The update is healthy and promoted, but the superseded registry repository ${previousRepository} could not be proven deleted.`, `Remove only the recorded repository's tags ${previousRepository}; do not retry or run broad registry cleanup.`)
+                : check("VAL-LIFE-007", "passed", deleted === "deleted"
+                    ? "The superseded generation's registry repository (all tags, including snapshots) was deleted after promotion."
+                    : "The superseded generation's registry repository was already absent.");
+        }
+    }
     let runtimeImageCleanup;
     if (runtimeEvidence.cleanup.imageRetained) {
         if (options.retainRuntimeImage === true) {
@@ -1666,13 +1941,18 @@ async function runEveDeployment(request, options, collected) {
                 : check("VAL-CROSS-004", "failed", "The remote deployment is healthy, but exact local runtime-image cleanup could not be verified.", `Remove only the recorded image ${imageDigest}; do not retry or run broad Docker cleanup.`);
         }
     }
+    const postPromotionChecks = [
+        ...(supersededImageCleanup === undefined ? [] : [supersededImageCleanup]),
+        ...(runtimeImageCleanup === undefined ? [] : [runtimeImageCleanup]),
+    ];
     return {
         ...collected.result,
-        ok: runtimeImageCleanup?.status !== "failed",
-        ...(runtimeImageCleanup === undefined
+        ok: runtimeImageCleanup?.status !== "failed" &&
+            supersededImageCleanup?.status !== "failed",
+        ...(postPromotionChecks.length === 0
             ? {}
-            : { checks: [...collected.result.checks, runtimeImageCleanup] }),
-        deployment: deploymentMetadata(identity, targetKey, "deployed"),
+            : { checks: [...collected.result.checks, ...postPromotionChecks] }),
+        deployment: deploymentMetadata(identity, targetKey, "deployed", operation, superseded),
     };
 }
 async function collectEvePreflight(request, options) {
@@ -1813,9 +2093,6 @@ async function collectEvePreflight(request, options) {
     }
     warnings.push(...(await collectEveWorldWarnings(candidate, undefined)));
     const schedules = await readCompiledSchedules(candidate);
-    // The runtime package is imported lazily so `eden` commands that never
-    // reach deploy checks stay fast; the module specifier is fixed.
-    const { parseEveScheduleCron } = await import("@moinulmoin/eden-runtime-cloudflare");
     const expressible = schedules.filter((schedule) => parseEveScheduleCron(schedule.cron) !== undefined);
     const unexpressible = schedules.filter((schedule) => parseEveScheduleCron(schedule.cron) === undefined);
     if (unexpressible.length > 0) {
@@ -1848,12 +2125,14 @@ async function collectEvePreflight(request, options) {
     }
     let cloudflare;
     let publicOrigin;
+    let priorDeployment;
     if (request.command === "deploy") {
         eveProgress(options, "checking Cloudflare access and exact target");
         try {
             cloudflare = await readEveCloudflareTarget({
                 projectId: packaging.project?.projectId ?? "unknown-project",
                 sourceDigest: candidate.sourceDigest,
+                projectRoot: request.projectRoot,
                 environment: request.environment,
                 name: request.name,
             }, options);
@@ -1875,6 +2154,17 @@ async function collectEvePreflight(request, options) {
             };
         }
         checks.push(...cloudflareChecks(cloudflare));
+        // An owned target also requires its immutable record so the update can
+        // carry the published Durable Object history forward append-only.
+        if (cloudflare.target.state === "owned") {
+            const record = await readEveDeploymentRecord(request.projectRoot, request.environment, request.name, cloudflare.accountId, packaging.project?.projectId === "unknown-project"
+                ? undefined
+                : packaging.project?.projectId);
+            priorDeployment = record ?? undefined;
+            if (record === undefined || record.durableObjects === undefined) {
+                checks.push(check("VAL-CLI-007-TARGET-CONFLICT", "failed", "The exact target is Eden-owned, but its immutable deployment record does not carry a readable Durable Object history.", "Re-run the last successful deploy generation or destroy the exact target; updating without the recorded migration history could diverge Durable Object declarations."));
+            }
+        }
         publicOrigin = await resolvedCloudflareOrigin(cloudflare, request.name);
         if (publicOrigin === undefined) {
             checks.push(check("VAL-HOST-006", "failed", "The authenticated Cloudflare read did not prove the exact workers.dev origin before Eve initialization.", "Return one authenticated account ID, one workers.dev subdomain, and the exact Worker-origin binding."));
@@ -2006,6 +2296,7 @@ async function collectEvePreflight(request, options) {
             cloudflare = await readEveCloudflareTarget({
                 projectId: packaging.project?.projectId ?? "unknown-project",
                 sourceDigest: candidate.sourceDigest,
+                projectRoot: request.projectRoot,
                 environment: request.environment,
                 name: request.name,
             }, options);
@@ -2049,6 +2340,7 @@ async function collectEvePreflight(request, options) {
         // reported as EVE_SCHEDULE_UNSUPPORTED and fire only while awake.
         schedules: expressible,
         cloudflare,
+        ...(priorDeployment === undefined ? {} : { priorDeployment }),
         ...(workflowWorld === undefined ? {} : { workflowWorld }),
     };
 }
@@ -2095,7 +2387,7 @@ export async function runEveControlPlane(request, options = {}) {
                     message: status === "indeterminate"
                         ? "The Eve deployment outcome is indeterminate; inspect the retained exact ownership evidence before retrying."
                         : status === "deployed"
-                            ? "The Eve deployment is healthy and promoted, but exact local runtime-image cleanup failed; do not retry the deployment."
+                            ? "The Eve deployment is healthy and promoted, but exact image cleanup failed; do not retry the deployment."
                             : "The Eve deployment failed before exact target promotion.",
                 });
             }
@@ -2223,6 +2515,161 @@ async function parseEveDestroyRecord(recordPath, environment, name) {
         identity: verified,
     };
 }
+/**
+ * Reads the immutable records for this target. The live identity comes from
+ * CURRENT first, then the newest `deployed` record, then the newest record
+ * of any status; the Durable Object history comes from the newest record
+ * that carries one, healthy or not, so a failed update's published tags are
+ * never dropped.
+ */
+async function readEveDeploymentRecord(projectRoot, environment, name, accountId, projectId) {
+    const targetsRoot = join(projectRoot, ".eden", "eve-deploy", "targets", `${environment}-${name}`);
+    const generationsRoot = join(projectRoot, ".eden", "eve-deploy", "generations");
+    const entries = await readdir(generationsRoot).catch(() => []);
+    const scanned = [];
+    const deploymentIds = new Set();
+    for (const entry of entries) {
+        const generationRoot = join(generationsRoot, entry);
+        const recordPath = join(generationRoot, "deployment.json");
+        const details = await lstat(recordPath).catch(() => undefined);
+        if (details === undefined || !details.isFile())
+            continue;
+        const parsed = await parseEveDeploymentRecord(recordPath, environment, name);
+        if (parsed !== undefined) {
+            // Only records for this account and (when known) this project may
+            // arbitrate ownership or supply migration history.
+            if ((accountId !== undefined && parsed.identity.accountId !== accountId) ||
+                (projectId !== undefined && parsed.identity.projectId !== projectId)) {
+                continue;
+            }
+            scanned.push({
+                record: parsed,
+                generationRoot,
+                modifiedAt: details.mtimeMs,
+            });
+            const deploymentId = parsed.deploymentId;
+            if (deploymentId !== undefined)
+                deploymentIds.add(deploymentId);
+        }
+    }
+    scanned.sort((left, right) => right.modifiedAt - left.modifiedAt);
+    const current = await lstat(join(targetsRoot, "CURRENT")).catch(() => undefined);
+    let live = scanned.find((entry) => entry.record.status === "deployed") ?? scanned[0];
+    if (current !== undefined && current.isSymbolicLink()) {
+        const generationRoot = await realpath(join(targetsRoot, "CURRENT")).catch(() => undefined);
+        if (generationRoot !== undefined) {
+            const pinned = scanned.find((entry) => entry.generationRoot === generationRoot);
+            if (pinned !== undefined) {
+                live = pinned;
+            }
+            else {
+                const parsed = await parseEveDeploymentRecord(join(generationRoot, "deployment.json"), environment, name);
+                if (parsed !== undefined &&
+                    !((accountId !== undefined &&
+                        parsed.identity.accountId !== accountId) ||
+                        (projectId !== undefined &&
+                            parsed.identity.projectId !== projectId))) {
+                    live = { record: parsed, generationRoot, modifiedAt: 0 };
+                }
+            }
+        }
+    }
+    if (live === undefined)
+        return undefined;
+    // Newest record carrying a usable DO history wins, regardless of its
+    // deployment outcome: a tag it published must never be replayed.
+    const historySource = scanned.find((entry) => entry.record.durableObjects !== undefined);
+    return {
+        recordPath: live.record.recordPath,
+        generationRoot: live.generationRoot,
+        identity: live.record.identity,
+        status: live.record.status,
+        deploymentIds: [...deploymentIds],
+        worldCloudflare: live.record.worldCloudflare,
+        durableObjects: historySource?.record.durableObjects,
+    };
+}
+async function parseEveDeploymentRecord(recordPath, environment, name) {
+    const base = await parseEveDestroyRecord(recordPath, environment, name);
+    if (base === undefined)
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(recordPath, "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return undefined;
+    const record = parsed;
+    const identityRaw = parsed.identity;
+    const deploymentId = typeof identityRaw === "object" &&
+        identityRaw !== null &&
+        typeof identityRaw
+            .deploymentId === "string"
+        ? identityRaw.deploymentId
+        : undefined;
+    const status = typeof record.status === "string" &&
+        ["deployed", "failed", "indeterminate"].includes(record.status)
+        ? record.status
+        : undefined;
+    const worker = typeof record.worker === "object" && record.worker !== null
+        ? record.worker
+        : undefined;
+    const rawBindings = worker !== undefined && "durable_objects" in worker &&
+        typeof worker.durable_objects === "object" &&
+        worker.durable_objects !== null &&
+        "bindings" in worker.durable_objects
+        ? worker.durable_objects.bindings
+        : undefined;
+    const rawMigrations = worker !== undefined && "migrations" in worker
+        ? worker.migrations
+        : undefined;
+    const rawVars = worker !== undefined && "vars" in worker &&
+        typeof worker.vars === "object" && worker.vars !== null
+        ? worker.vars
+        : undefined;
+    const bindings = [];
+    const migrations = [];
+    const durableObjectsValid = Array.isArray(rawBindings) &&
+        Array.isArray(rawMigrations);
+    const invalidHistory = () => ({
+        recordPath,
+        identity: base.identity,
+        status,
+        deploymentId,
+        worldCloudflare: rawVars?.EDEN_EVE_WORLD_CLOUDFLARE === true,
+        durableObjects: undefined,
+    });
+    if (durableObjectsValid) {
+        for (const binding of rawBindings) {
+            if (typeof binding !== "object" || binding === null ||
+                typeof binding.name !== "string" ||
+                typeof binding.class_name !== "string") {
+                return invalidHistory();
+            }
+            bindings.push(binding);
+        }
+        for (const migration of rawMigrations) {
+            if (typeof migration !== "object" || migration === null ||
+                typeof migration.tag !== "string" ||
+                !Array.isArray(migration.new_sqlite_classes) ||
+                (migration.new_sqlite_classes ?? []).some((className) => typeof className !== "string")) {
+                return invalidHistory();
+            }
+            migrations.push(migration);
+        }
+    }
+    return {
+        recordPath,
+        identity: base.identity,
+        status,
+        deploymentId,
+        worldCloudflare: rawVars?.EDEN_EVE_WORLD_CLOUDFLARE === true,
+        durableObjects: durableObjectsValid ? { bindings, migrations } : undefined,
+    };
+}
 async function defaultDestroyTargetRead(request) {
     const account = await readWranglerJson(["whoami", "--json"]);
     const deployments = await readWranglerJson([
@@ -2244,18 +2691,25 @@ async function defaultDestroyTargetRead(request) {
         (exactDeploymentEntries(deployments.value)?.length ?? 0) > 0;
     const entries = exactContainerEntries(containers.value, request.containerApplicationName);
     const firstContainer = entries === undefined ? undefined : entries[0];
-    const ownedImages = request.registryImages;
-    let registryImagesPresent;
-    if (ownedImages !== undefined && ownedImages.length > 0) {
+    const ownedRepositories = request.registryRepositories;
+    let registryTagsPresent;
+    if (ownedRepositories !== undefined && ownedRepositories.length > 0) {
         const images = await readWranglerJson([
             "containers",
             "images",
             "list",
             "--json",
         ]);
-        const present = registryImageNames(images.value);
-        if (!images.failed && present !== undefined) {
-            registryImagesPresent = ownedImages.filter((image) => present.has(image));
+        const tagsByRepository = registryTagsByRepository(images.value);
+        if (!images.failed && tagsByRepository !== undefined) {
+            const present = [];
+            for (const [repository, tags] of tagsByRepository) {
+                if (!ownedRepositories.includes(repository))
+                    continue;
+                for (const tag of tags)
+                    present.push(`${repository}:${tag}`);
+            }
+            registryTagsPresent = present;
         }
     }
     return {
@@ -2264,21 +2718,22 @@ async function defaultDestroyTargetRead(request) {
             ? {}
             : { containerApplicationId: firstContainer.id }),
         ...(accountId === undefined ? {} : { accountId }),
-        ...(registryImagesPresent === undefined
+        ...(registryTagsPresent === undefined
             ? {}
-            : { registryImagesPresent }),
+            : { registryTagsPresent }),
     };
 }
 /**
  * `wrangler containers images list --json` reports `[{name, tags}]` entries
- * with the account prefix already stripped from the repository name. The set
- * carries `repository:tag` refs for the owned tags Eden publishes.
+ * with the account prefix already stripped from the repository name. The map
+ * carries every tag per repository so owned-repository cleanup can delete
+ * snapshot tags alongside the pushed `candidate` tag.
  */
-function registryImageNames(value) {
+function registryTagsByRepository(value) {
     const collection = jsonCollection(value);
     if (collection === undefined)
         return undefined;
-    const names = new Set();
+    const tagsByRepository = new Map();
     for (const entry of collection) {
         if (typeof entry !== "object" || entry === null || !("name" in entry)) {
             return undefined;
@@ -2287,13 +2742,15 @@ function registryImageNames(value) {
         const tags = "tags" in entry ? entry.tags : undefined;
         if (typeof name !== "string" || !Array.isArray(tags))
             return undefined;
+        const validTags = [];
         for (const tag of tags) {
             if (typeof tag !== "string")
                 return undefined;
-            names.add(`${name}:${tag}`);
+            validTags.push(tag);
         }
+        tagsByRepository.set(name, validTags);
     }
-    return names;
+    return tagsByRepository;
 }
 async function defaultWorkerDelete(request) {
     const result = await runWranglerWithInput(["delete", "--name", request.name, "--force"], process.cwd(), "y\n");
@@ -2313,23 +2770,59 @@ async function defaultContainerDelete(request) {
     }
     return "indeterminate";
 }
-async function defaultRegistryImageDelete(request) {
-    const result = await runWranglerWithInput(["containers", "images", "delete", request.image, "--skip-confirmation"], process.cwd());
-    if (result.exitCode === 0)
-        return "deleted";
-    if (/(?:does not exist|not found|404)/iu.test(result.stderr)) {
+/**
+ * Deletes every tag in an owned registry repository — the `candidate` tag
+ * Eden pushed plus any `rootfs-snapshot-*`/`rootfs-set-*` tags container
+ * snapshots created under the source image repository. Deleting only
+ * `candidate` would leave snapshot storage behind, so each tag in the
+ * repository is deleted individually.
+ */
+async function defaultRegistryRepositoryDelete(request) {
+    const images = await readWranglerJson([
+        "containers",
+        "images",
+        "list",
+        "--json",
+    ]);
+    const collection = jsonCollection(images.value);
+    if (images.failed || collection === undefined)
+        return "indeterminate";
+    const entry = collection.find((candidate) => typeof candidate === "object" &&
+        candidate !== null &&
+        candidate.name === request.repository);
+    if (entry === undefined)
         return "absent";
+    const tags = entry.tags;
+    if (!Array.isArray(tags) || tags.some((tag) => typeof tag !== "string")) {
+        return "indeterminate";
     }
-    return "indeterminate";
+    let deletedAny = false;
+    for (const tag of tags) {
+        const result = await runWranglerWithInput([
+            "containers",
+            "images",
+            "delete",
+            `${request.repository}:${tag}`,
+            "--skip-confirmation",
+        ], process.cwd());
+        if (result.exitCode === 0) {
+            deletedAny = true;
+            continue;
+        }
+        if (!/(?:does not exist|not found|404)/iu.test(result.stderr)) {
+            return "indeterminate";
+        }
+    }
+    return deletedAny ? "deleted" : "absent";
 }
 /**
- * The exact `<repository>:${EVE_REGISTRY_IMAGE_TAG}` ref this generation's
- * deployment record proves Eden pushed, or undefined. Ownership holds only
- * when the recorded digest reference points at the repository derived from
- * the same identity that produced it; a digest-bearing reference to any other
- * repository was published outside Eden's push and is never owned here.
+ * The registry repository this generation's deployment record proves Eden
+ * pushed to, or undefined. Ownership holds only when the recorded digest
+ * reference points at the repository derived from the same identity that
+ * produced it; a digest-bearing reference to any other repository was
+ * published outside Eden's push and is never owned here.
  */
-function ownedRegistryImageRef(identity, environment, name, accountId) {
+function ownedRegistryRepository(identity, environment, name, accountId) {
     if (identity.projectId === undefined ||
         identity.generationId === undefined ||
         identity.containerImage === undefined ||
@@ -2342,14 +2835,14 @@ function ownedRegistryImageRef(identity, environment, name, accountId) {
         imageDigestFromReference(identity.containerImage) === undefined) {
         return undefined;
     }
-    return `${repository}:${EVE_REGISTRY_IMAGE_TAG}`;
+    return repository;
 }
 /**
- * The exact image ref an indeterminate deploy attempt provably pushed. The
- * retained attempt evidence names the target's repository; the account and
- * target key must match the verified destroy record.
+ * The registry repository an indeterminate deploy attempt provably pushed.
+ * The retained attempt evidence names the target's repository; the account
+ * and target key must match the verified destroy record.
  */
-async function attemptRegistryImageRef(attemptPath, accountId, targetKey) {
+async function attemptRegistryRepository(attemptPath, accountId, targetKey) {
     const raw = await readFile(attemptPath, "utf8").catch(() => undefined);
     if (raw === undefined)
         return undefined;
@@ -2369,7 +2862,7 @@ async function attemptRegistryImageRef(attemptPath, accountId, targetKey) {
         (!("targetKey" in parsed) || parsed.targetKey === targetKey) &&
         "accountId" in parsed &&
         parsed.accountId === accountId) {
-        return `${parsed.imageRepository}:${EVE_REGISTRY_IMAGE_TAG}`;
+        return parsed.imageRepository;
     }
     if ("imageReference" in parsed &&
         typeof parsed.imageReference === "string" &&
@@ -2379,39 +2872,40 @@ async function attemptRegistryImageRef(attemptPath, accountId, targetKey) {
         if (repository !== undefined &&
             repository.startsWith(expected) &&
             (!("targetKey" in parsed) || parsed.targetKey === targetKey)) {
-            return `${repository.slice(`registry.cloudflare.com/${accountId}/`.length)}:${EVE_REGISTRY_IMAGE_TAG}`;
+            return repository.slice(`registry.cloudflare.com/${accountId}/`.length);
         }
     }
     return undefined;
 }
 /**
- * Every registry image tag this exact target provably owns: the recorded
+ * Every registry repository this exact target provably owns: the recorded
  * digest references in matching deployment records plus the repository
  * evidence retained by indeterminate pushes. Never derived by prefix-matching
- * the registry; each ref is computed from the immutable generation records.
+ * the registry; each repository is computed from the immutable generation
+ * records.
  */
-async function collectEveDestroyRegistryImages(projectRoot, environment, name, record) {
+async function collectEveDestroyRegistryRepositories(projectRoot, environment, name, record) {
     const generationsRoot = join(projectRoot, ".eden", "eve-deploy", "generations");
     const entries = await readdir(generationsRoot).catch(() => []);
-    const images = new Set();
+    const repositories = new Set();
     const targetKey = record.projectId === undefined
         ? undefined
         : stableDeploymentKey(record.projectId, record.accountId, environment, name);
     for (const entry of entries) {
         const generationRoot = join(generationsRoot, entry);
         const parsed = await parseEveDestroyRecord(join(generationRoot, "deployment.json"), environment, name);
-        const deployedImage = parsed === undefined
+        const deployedRepository = parsed === undefined
             ? undefined
-            : ownedRegistryImageRef(parsed.identity, environment, name, record.accountId);
-        if (deployedImage !== undefined)
-            images.add(deployedImage);
+            : ownedRegistryRepository(parsed.identity, environment, name, record.accountId);
+        if (deployedRepository !== undefined)
+            repositories.add(deployedRepository);
         if (targetKey === undefined)
             continue;
-        const attemptImage = await attemptRegistryImageRef(join(generationRoot, "deployment-attempt.json"), record.accountId, targetKey);
-        if (attemptImage !== undefined)
-            images.add(attemptImage);
+        const attemptRepository = await attemptRegistryRepository(join(generationRoot, "deployment-attempt.json"), record.accountId, targetKey);
+        if (attemptRepository !== undefined)
+            repositories.add(attemptRepository);
     }
-    return [...images];
+    return [...repositories];
 }
 export async function runEveDestroy(request, options = {}) {
     const startedAt = Date.now();
@@ -2464,11 +2958,11 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
     }
     checks.push(check("VAL-LIFE-006-RECORD", "passed", "The immutable deployment record matched the exact target selectors."));
     eveProgress(options, "verifying the immutable ownership record");
-    const ownedRegistryImages = await collectEveDestroyRegistryImages(request.projectRoot, request.environment, request.name, record.identity);
+    const ownedRegistryRepositories = await collectEveDestroyRegistryRepositories(request.projectRoot, request.environment, request.name, record.identity);
     const readTarget = () => Promise.resolve(reader({
         workerName: expectedWorker,
         containerApplicationName: expectedContainer,
-        registryImages: ownedRegistryImages,
+        registryRepositories: ownedRegistryRepositories,
     }));
     const reader = options.destroyCloudflareRead ?? defaultDestroyTargetRead;
     eveProgress(options, "reading the exact remote inventory");
@@ -2478,9 +2972,9 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
     }
     if (!before.workerExists &&
         before.containerApplicationId === undefined &&
-        (ownedRegistryImages.length === 0 ||
-            (before.registryImagesPresent !== undefined &&
-                before.registryImagesPresent.length === 0))) {
+        (ownedRegistryRepositories.length === 0 ||
+            (before.registryTagsPresent !== undefined &&
+                before.registryTagsPresent.length === 0))) {
         emit({
             ok: true,
             status: "absent",
@@ -2537,17 +3031,22 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
             ? "The exact owned Container application was deleted."
             : "The exact Container application was already absent."));
     }
-    const imageDeletes = new Map();
-    if (ownedRegistryImages.length > 0) {
-        const deleteRegistryImage = options.deleteRegistryImage ?? defaultRegistryImageDelete;
-        const deletable = before.registryImagesPresent === undefined
-            ? ownedRegistryImages
-            : ownedRegistryImages.filter((image) => before.registryImagesPresent?.includes(image) === true);
+    const repositoryDeletes = new Map();
+    if (ownedRegistryRepositories.length > 0) {
+        const deleteRegistryRepository = options.deleteRegistryRepository ?? defaultRegistryRepositoryDelete;
+        // Every tag inside an owned repository is deleted (candidate plus
+        // snapshot tags). When the registry could not be enumerated, still
+        // attempt the exact owned repositories; absence verification below
+        // re-reads the registry when it becomes readable.
+        const presentRepositories = new Set((before.registryTagsPresent ?? []).map((ref) => ref.split(":")[0] ?? ""));
+        const deletable = before.registryTagsPresent === undefined
+            ? ownedRegistryRepositories
+            : ownedRegistryRepositories.filter((repository) => presentRepositories.has(repository));
         if (deletable.length > 0) {
-            eveProgress(options, `deleting ${deletable.length} registry image${deletable.length === 1 ? "" : "s"}`);
+            eveProgress(options, `deleting ${deletable.length} registry repositor${deletable.length === 1 ? "y" : "ies"}`);
         }
-        for (const image of deletable) {
-            imageDeletes.set(image, await deleteRegistryImage({ image }));
+        for (const repository of deletable) {
+            repositoryDeletes.set(repository, await deleteRegistryRepository({ repository }));
         }
     }
     eveProgress(options, "verifying the exact target is absent");
@@ -2565,15 +3064,16 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
         });
         fail("EVE_DESTROY_ABSENCE_UNPROVEN", "The exact target could not be proven absent after deletion.");
     }
-    const retainedImages = ownedRegistryImages.filter((image) => after.registryImagesPresent === undefined
-        ? imageDeletes.get(image) === "indeterminate"
-        : after.registryImagesPresent.includes(image));
-    if (ownedRegistryImages.length > 0) {
-        checks.push(retainedImages.length === 0
+    const presentTagsAfter = after.registryTagsPresent ?? [];
+    const retainedRepositories = ownedRegistryRepositories.filter((repository) => presentTagsAfter.some((ref) => ref.startsWith(`${repository}:`)) ||
+        (after.registryTagsPresent === undefined &&
+            repositoryDeletes.get(repository) === "indeterminate"));
+    if (ownedRegistryRepositories.length > 0) {
+        checks.push(retainedRepositories.length === 0
             ? check("VAL-LIFE-006-REGISTRY", "passed", "Every registry image tag recorded for this exact target was deleted or proven absent.")
-            : check("VAL-LIFE-006-REGISTRY", "failed", `The exact target's registry image(s) remain after destroy: ${retainedImages.join(", ")}.`, "Retry eden destroy with the same selectors, or remove only the listed image refs with wrangler containers images delete."));
+            : check("VAL-LIFE-006-REGISTRY", "failed", `The exact target's registry image tag(s) remain after destroy: ${retainedRepositories.join(", ")}.`, "Retry eden destroy with the same selectors, or remove only the listed repositories' tags with wrangler containers images delete."));
     }
-    if (retainedImages.length > 0) {
+    if (retainedRepositories.length > 0) {
         emit({
             ok: false,
             status: "failed",
@@ -2581,7 +3081,7 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
             name: request.name,
             checks,
         });
-        fail("EVE_DESTROY_IMAGES_RETAINED", `The exact Worker and Container are absent, but registry image(s) remain: ${retainedImages.join(", ")}.`);
+        fail("EVE_DESTROY_IMAGES_RETAINED", `The exact Worker and Container are absent, but registry image tag(s) remain in: ${retainedRepositories.join(", ")}.`);
     }
     checks.push(check("VAL-LIFE-006", "passed", "Exact absence was verified; clearing this target's CURRENT pointer only."));
     const currentPath = join(request.projectRoot, ".eden", "eve-deploy", "targets", `${request.environment}-${request.name}`, "CURRENT");