@molecule/api-code-sandbox-flyio 1.3.5 → 1.3.8

package/dist/provider.js

@@ -6,16 +6,16 @@
  *
  * @module
  */
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { promisify } from 'node:util';
 import { gzip } from 'node:zlib';
 import { getLogger } from '@molecule/api-bond';
 import { t } from '@molecule/api-i18n';
-import { FlyApiClient, FlyApiError, normalizeApiUrl } from './api.js';
+import { FlyApiClient, FlyApiError, normalizeApiUrl, retryDelayMs, } from './api.js';
 import { buildEgressProbeCommand, DEFAULT_EGRESS_POLICY_NAME, DEFAULT_EGRESS_PROBE_TARGETS, describePublicReach, extractPolicyId, extractPolicyPorts, parseEgressAllowedPorts, parseEgressProbeTargets, verdictForProbeExit, } from './egress.js';
 import { execCommand, toExecResult } from './exec.js';
 import { assertPrivateRoutesForEnv, decodePrivateRoutes, DEFAULT_PRIVATE_IP_TYPE, encodePrivateRoutes, flycastHost, mergeEgressPorts, parsePrivateServices, PRIVATE_ROUTES_METADATA_SUFFIX, } from './flycast.js';
-import { appNameForProject, mapMachineState, parseSandboxId, toSandboxId } from './ids.js';
+import { appNameForProject, appNameNamespace, mapMachineState, parseSandboxId, toSandboxId, } from './ids.js';
 import { createTemplateStore, MAX_PRESIGN_EXPIRY_SECONDS } from './storage.js';
 import * as templates from './templates.js';
 import { shellQuote } from './utilities.js';
@@ -102,6 +102,8 @@ const DEFAULT_PREVIEW_PORT = 5173;
 const WORKSPACE_PATH = '/workspace';
 /** Default volume size in GB when `SandboxConfig.resources.diskMB` is unset. */
 const DEFAULT_VOLUME_GB = 10;
+/** Exact-identity reads allowed after an ambiguous create before its outcome is declared unknown. */
+const CREATE_RECONCILE_ATTEMPTS = 3;
 /** Page size for the org-wide Machine listing. */
 const LIST_PAGE_SIZE = 200;
 /** Hard cap on pages fetched while listing, so a bad cursor cannot loop forever. */
@@ -204,13 +206,13 @@ const MACHINE_CREATE_ATTEMPTS = 6;
  * means no Machine was created — unlike a 5xx/timeout, where one might have
  * been. 412 is safe for the same reason: "volume already claimed by machine
  * <id>" refuses the create. It is what the create answers in the seconds after
- * {@link FlyioSandboxProvider.destroyStaleMachines} removed the Machine that
- * held the volume — Fly releases the claim asynchronously, and an immediate
- * create lost a production deploy to it (2026-10-14; the identical retry a
+ * an explicit destroy released the Machine that held the volume — Fly releases
+ * the claim asynchronously, and an immediate create lost a production deploy
+ * to it (2026-10-14; the identical retry a
  * minute later succeeded). Only these two are added on top of the client's
  * default retryable set; neither retry can double-create.
  */
-const MACHINE_CREATE_RETRY_STATUSES = [404, 412];
+const MACHINE_CREATE_RETRY_STATUSES = [400, 404, 412];
 /**
  * What Fly answers when it reached the exec endpoint but the connection to the
  * Machine's exec agent died before the command ran: `412 {"error":
@@ -300,6 +302,16 @@ const PROBE_EXEC_HEADROOM_SECONDS = 10;
  */
 class FlyioSandboxProvider {
     name = 'flyio';
+    /**
+     * Machines this provider runs live until destroyed and each app is reachable
+     * at its own routable URL (`https://<app>.fly.dev`, plus the shared private
+     * network for the platform's front) — the two things a long-lived hosting
+     * role needs, which is why this provider is selectable for it.
+     */
+    hostingCapabilities = {
+        longLived: true,
+        routable: true,
+    };
     /**
      * The idle policy a sandbox gets when its own create does not name one — this
      * provider's configured `autostop` (`FLY_PRODUCTION_AUTOSTOP` for production
@@ -359,8 +371,11 @@ class FlyioSandboxProvider {
      * Resolves the Fly region for Machines and volumes.
      * @returns The region code.
      */
-    region() {
-        return this.config.region ?? process.env.FLY_REGION ?? DEFAULT_REGION;
+    region(createRegion) {
+        // FLY_REGION is the API Machine's own location on Fly, not a tenant
+        // placement decision. Only provider configuration or this create's recorded
+        // region may choose where new project resources live.
+        return createRegion ?? this.config.region ?? DEFAULT_REGION;
     }
     /**
      * Whether each project gets its own Fly app on its own custom 6PN network.
@@ -470,10 +485,51 @@ class FlyioSandboxProvider {
      * `<app>.internal` already resolves and Flycast would add nothing.
      * @returns The declared services, or `undefined` when none are configured.
      */
-    privateServices() {
+    privateServices(createRegion) {
         if (!this.appPerProject())
             return undefined;
-        return (this.config.privateServices ?? parsePrivateServices(process.env.FLY_SANDBOX_PRIVATE_SERVICES));
+        const fallback = this.config.privateServices ?? parsePrivateServices(process.env.FLY_SANDBOX_PRIVATE_SERVICES);
+        if (!createRegion || createRegion === DEFAULT_REGION)
+            return fallback;
+        const suffix = createRegion.replace(/-/g, '_').toUpperCase();
+        const variable = `FLY_SANDBOX_PRIVATE_SERVICES_${suffix}`;
+        const regional = this.config.privateServicesByRegion?.[createRegion] ??
+            parsePrivateServices(process.env[variable]);
+        if (!regional && fallback?.length) {
+            throw new Error(`No Fly private services are configured for create region "${createRegion}"; ` +
+                `set ${variable} (or config.privateServicesByRegion.${createRegion}). ` +
+                "Refusing to reuse another region's tenant route.");
+        }
+        return regional ?? fallback;
+    }
+    /** Fence and cancel every provisioning mutation at its owning attempt. */
+    async requestForAttempt(attempt, path, options) {
+        if (attempt.signal.aborted)
+            throw attempt.signal.reason;
+        await this.config.createAttemptJournal?.assertGeneration(attempt.attemptId, attempt.generation);
+        if (attempt.signal.aborted)
+            throw attempt.signal.reason;
+        const result = await this.client.request(path, { ...options, signal: attempt.signal });
+        // A response can arrive after ownership was lost. The write may remain
+        // unresolved, but a superseded worker must not journal/adopt its outcome.
+        if (attempt.signal.aborted)
+            throw attempt.signal.reason;
+        await this.config.createAttemptJournal?.assertGeneration(attempt.attemptId, attempt.generation);
+        return result;
+    }
+    /** Authorize a DELETE from the committed retired row on its live lock session. */
+    async deleteRetired(intent, generation, path, signal) {
+        const journal = this.config.createAttemptJournal;
+        if (!journal)
+            throw new Error('Retired deletion requires its durable create-attempt journal');
+        await journal.authorizeDestruction(intent.attemptId, generation);
+        return this.requestForDestruction(path, { method: 'DELETE', nullOn: [404] }, signal);
+    }
+    /** The sole request dispatch for retirement and settlement, always lock-fenced. */
+    async requestForDestruction(path, options, signal) {
+        if (signal.aborted)
+            throw signal.reason;
+        return this.client.request(path, { ...options, signal });
     }
     /**
      * Idempotently ensures the Fly app exists, creating it on its own custom 6PN
@@ -495,27 +551,52 @@ class FlyioSandboxProvider {
      * @returns `routes`: target app name → allocated private address, for
      *   recording in the Machine's metadata (empty when no private services are
      *   declared); `allocated`: the subset of `routes` this call created, which
-     *   the caller releases when the boot fails and the app is NOT discarded
-     *   (an app that pre-existed is kept, and with it the addresses it already
-     *   held — only this call's own allocations are safe to take back).
+     *   the caller releases when the boot fails. The app itself always survives:
+     *   another create can adopt it by name while this call is still failing.
      */
     async ensureApp(app, options = {}) {
         const existing = await this.client.request(`/apps/${app}`, { nullOn: [404] });
         let createdHere = false;
+        if (existing && options.requireCreated) {
+            return { routes: {}, allocated: {}, created: false };
+        }
         if (!existing) {
             const body = { name: app, org_slug: this.orgSlug() };
             const network = this.networkFor(app);
             if (network)
                 body.network = network;
             let created = true;
+            const attempt = options.attempt;
+            const journal = this.config.createAttemptJournal;
+            if (attempt && journal) {
+                // Persist who is attempting the create BEFORE Fly can accept it. The
+                // separate accepted bit below prevents a pending/unknown POST from
+                // becoming deletion authority after a crash or reconciliation error.
+                await journal.recordAppProvenance(attempt.attemptId, attempt.generation, 'pending');
+            }
             try {
-                await this.client.request(`/apps`, { method: 'POST', body });
+                if (attempt) {
+                    await this.requestForAttempt(attempt, `/apps`, { method: 'POST', body });
+                }
+                else {
+                    await this.client.request(`/apps`, { method: 'POST', body });
+                }
+                // Accepted POST provenance is established before later policy/route
+                // steps can fail, so diagnostic cleanup can still retire its own app.
+                if (options.ownership)
+                    options.ownership.created = true;
+                if (attempt && journal) {
+                    await journal.recordAppProvenance(attempt.attemptId, attempt.generation, 'created');
+                }
                 logger.info('Created Fly sandbox app', { app, network: body.network });
             }
             catch (error) {
                 // 409/422 means another concurrent boot created the same app first, which
                 // is exactly the outcome we wanted. Anything else is a real failure.
                 if (error instanceof FlyApiError && (error.status === 409 || error.status === 422)) {
+                    if (attempt && journal) {
+                        await journal.recordAppProvenance(attempt.attemptId, attempt.generation, 'adopted');
+                    }
                     logger.debug('Fly sandbox app already exists', { app });
                     created = false;
                 }
@@ -525,45 +606,18 @@ class FlyioSandboxProvider {
             }
             createdHere = created;
         }
-        try {
-            if (createdHere && this.config.assignSharedIpv4)
-                await this.assignSharedIpv4(app);
-            await this.applyEgressPolicy(app);
-            if (options.privateRoutes === false)
-                return { routes: {}, allocated: {}, created: createdHere };
-            return {
-                ...(await this.ensurePrivateRoutes(app, Boolean(existing))),
-                created: createdHere,
-            };
+        if (options.requireCreated && !createdHere) {
+            return { routes: {}, allocated: {}, created: false };
         }
-        catch (error) {
-            if (createdHere)
-                await this.discardCreatedApp(app, {});
-            throw error;
+        if (createdHere && this.config.assignSharedIpv4) {
+            await this.assignSharedIpv4(app, options.attempt);
         }
-    }
-    /**
-     * Deletes an app THIS call created, after a later step of the same create
-     * failed. Without it every failed create leaves an app behind with its
-     * addresses and volume: on 2026-09-28, 34 empty `mol-prod-*` apps had piled
-     * up in production, one per deploy that hit the organization's Machine limit
-     * (`POST /machines` → 422) after its app was already made. An app that
-     * existed before the call is never touched — it may hold a working Machine.
-     * @param app - The app this call created.
-     * @param privateRoutes - Flycast addresses already allocated for it.
-     */
-    async discardCreatedApp(app, privateRoutes) {
-        try {
-            await this.client.request(`/apps/${app}`, { method: 'DELETE', nullOn: [404] });
-            logger.info('Deleted a Fly sandbox app whose create failed', { app });
+        await this.applyEgressPolicy(app, options.attempt, options.createRegion);
+        if (options.privateRoutes === false) {
+            return { routes: {}, allocated: {}, created: createdHere };
         }
-        catch (error) {
-            logger.error('Failed to delete a Fly sandbox app after its create failed — it leaks', {
-                app,
-                error,
-            });
-        }
-        await this.releasePrivateRoutes(privateRoutes);
+        const routes = await this.ensurePrivateRoutes(app, Boolean(existing), options.attempt, options.createRegion);
+        return { ...routes, created: createdHere };
     }
     /**
      * Allocates a Flycast private address on every declared service app, INTO this
@@ -594,37 +648,42 @@ class FlyioSandboxProvider {
      *   the only addresses safe to release when the boot fails after allocation,
      *   since the recorded ones belong to Machines an earlier boot may still run.
      */
-    async ensurePrivateRoutes(app, appExisted) {
-        const services = this.privateServices();
+    async ensurePrivateRoutes(app, appExisted, attempt, createRegion) {
+        const services = this.privateServices(createRegion);
         const network = this.networkFor(app);
         if (!services?.length || !network)
             return { routes: {}, allocated: {} };
         const routes = appExisted ? await this.recordedPrivateRoutes(app) : {};
         // The addresses THIS call allocated, tracked apart from `routes` so a
-        // failure part-way down the next list can release exactly them. The caller's
-        // failure path can only discard the APP (`discardCreatedApp(app, {})`), and
-        // these addresses live on OTHER apps — so without this, an address already
-        // allocated for an earlier service stays behind on its target app, inside a
-        // 6PN whose app is gone, and Fly's listing does not report which network an
-        // address belongs to: nothing could ever find it there to release it.
+        // failure part-way down the next list can release exactly them. These
+        // addresses live on OTHER apps, so deleting this project's app would not
+        // release them; Fly's listing also cannot reconstruct their target network.
         const allocated = {};
-        try {
-            for (const service of services) {
-                if (routes[service.app])
-                    continue;
-                const ip = await this.allocatePrivateAddress(service, network);
-                if (ip) {
-                    routes[service.app] = ip;
-                    allocated[service.app] = ip;
-                }
+        for (const service of services) {
+            if (routes[service.app])
+                continue;
+            if (attempt && this.config.createAttemptJournal) {
+                await this.config.createAttemptJournal.recordAddress(attempt.attemptId, {
+                    targetApp: service.app,
+                    network,
+                    owned: false,
+                    resolved: false,
+                });
+            }
+            const ip = await this.allocatePrivateAddress(service, network, attempt);
+            if (attempt && this.config.createAttemptJournal) {
+                await this.config.createAttemptJournal.recordAddress(attempt.attemptId, {
+                    targetApp: service.app,
+                    network,
+                    ...(ip ? { ip } : {}),
+                    owned: Boolean(ip),
+                    resolved: true,
+                });
+            }
+            if (ip) {
+                routes[service.app] = ip;
+                allocated[service.app] = ip;
             }
-        }
-        catch (error) {
-            // Only what this call allocated. An address recorded by an EARLIER boot
-            // (`appExisted`) is left alone: the app survived this failure and may
-            // still hold a Machine reaching through that route.
-            await this.releasePrivateRoutes(allocated);
-            throw error;
         }
         return { routes, allocated };
     }
@@ -657,50 +716,26 @@ class FlyioSandboxProvider {
         return {};
     }
     /**
-     * Destroys any Machine already in this project's app before a fresh create.
-     *
-     * A create that fails after the Machine exists — a mid-scaffold error, a
-     * retried queue job — leaves a Machine holding the app's single-attach volume.
-     * The next create's `POST /machines` then fails with `412 volume already
-     * claimed by machine <id>`, and the project can never recover on its own. The
-     * app is one-per-project and holds exactly one sandbox, so any managed Machine
-     * still here is a stale partial: destroy it (force covers running/suspended) to
-     * free the volume and make create idempotent per project.
-     * @param app - The Fly app name.
+     * Read and normalize Fly's assignment list once for allocation and settlement.
+     * Current Fly returns `{ips: [...]}` and a network object; the older array /
+     * `ip_assignments` shapes remain readable for compatibility with saved clients.
      */
-    async destroyStaleMachines(app) {
-        const managedKey = `${this.metadataPrefix}.managed`;
-        let machines;
-        try {
-            machines = await this.client.request(`/apps/${app}/machines`, {
-                nullOn: [404],
-            });
-        }
-        catch (error) {
-            // A listing we cannot read is not proof the app is empty. A hidden Machine
-            // would fail the create with 412 regardless, so surface it and fall
-            // through rather than pretend the app is clean.
-            logger.warn('Could not list Machines before create; a stale Machine may still hold the volume', { app, error });
-            return;
-        }
-        for (const machine of Array.isArray(machines) ? machines : []) {
-            if (machine.config?.metadata?.[managedKey] !== 'true')
-                continue;
-            try {
-                await this.client.request(`/apps/${app}/machines/${machine.id}?force=true`, {
-                    method: 'DELETE',
-                    nullOn: [404],
-                });
-                logger.info('Destroyed a stale Machine before re-creating the sandbox', {
-                    app,
-                    machineId: machine.id,
-                });
-            }
-            catch (error) {
-                logger.warn('Failed to destroy a stale Machine before create; create may fail with ' +
-                    '412 volume already claimed', { app, machineId: machine.id, error });
+    async listPrivateAssignments(app, signal) {
+        const listed = signal
+            ? await this.requestForDestruction(`/apps/${app}/ip_assignments`, {}, signal)
+            : await this.client.request(`/apps/${app}/ip_assignments`);
+        const assignments = Array.isArray(listed) ? listed : (listed?.ips ?? listed?.ip_assignments);
+        if (!assignments)
+            return null;
+        return assignments.map((assignment) => {
+            if (typeof assignment.network === 'string')
+                return assignment;
+            const network = assignment.network;
+            if (!network || network.org_slug !== this.orgSlug()) {
+                return { ...assignment, network: undefined };
             }
-        }
+            return { ...assignment, network: network.name ?? '' };
+        });
     }
     /**
      * Allocates ONE Flycast private address on a target app, for this project's
@@ -718,7 +753,7 @@ class FlyioSandboxProvider {
      *   address — an allocation this provider can neither verify nor release later
      *   is untracked state, and the boot is the last moment it can be reported.
      */
-    async allocatePrivateAddress(service, network) {
+    async allocatePrivateAddress(service, network, attempt) {
         let assignment;
         try {
             // NO org_slug here. The ip_assignments endpoint derives the org from the
@@ -727,25 +762,28 @@ class FlyioSandboxProvider {
             // slug that app creation REQUIRES is refused here; omitting it returns 200
             // and allocates the address). app creation still sends org_slug — the two
             // endpoints genuinely differ.
-            assignment = await this.client.request(`/apps/${service.app}/ip_assignments`, {
+            const request = {
                 method: 'POST',
                 body: {
                     type: this.config.privateIpAssignmentType ?? DEFAULT_PRIVATE_IP_TYPE,
                     network,
                 },
-            });
+            };
+            assignment = attempt
+                ? await this.requestForAttempt(attempt, `/apps/${service.app}/ip_assignments`, request)
+                : await this.client.request(`/apps/${service.app}/ip_assignments`, request);
         }
         catch (error) {
-            // A conflict means an address for this (app, network) pair is already
-            // there — from a boot that crashed between allocating and recording. The
-            // ROUTE is what the sandbox needs and it exists, so this is not a boot
-            // failure; it is an address this provider can no longer release, because
-            // Fly's listing does not report which network an address belongs to.
+            // A conflict can be the duplicate response to an accepted write whose
+            // first response was lost. Resolve it by target app AND network, then the
+            // caller journals the concrete IP for adoption or later release.
             if (error instanceof FlyApiError && (error.status === 409 || error.status === 422)) {
-                logger.warn('A Fly private address for this project’s network already exists on the target app — ' +
-                    'the route works, but this one cannot be released on destroy. Reconcile with ' +
-                    '`fly ips list --app <target>`.', { target: service.app, network, status: error.status });
-                return undefined;
+                const assignments = await this.listPrivateAssignments(service.app, attempt?.signal);
+                const existing = assignments?.find((candidate) => candidate.network === network);
+                if (existing?.ip)
+                    return existing.ip;
+                throw new Error(`Fly rejected a private-address allocation for "${service.app}" on "${network}", ` +
+                    'but no matching assignment could be resolved', { cause: error });
             }
             throw new Error(t('codeSandbox.flyio.error.privateRouteFailed', { app: service.app, network }, {
                 defaultValue: `Could not allocate a Flycast private address on Fly app "${service.app}" for ` +
@@ -771,28 +809,42 @@ class FlyioSandboxProvider {
         });
         return assignment.ip;
     }
+    /** Validate the exact IP's current network; metadata alone is not DELETE authority. */
+    async privateRouteMatchesNetwork(target, ip, network, signal) {
+        if (!network)
+            return false;
+        const assignments = await this.listPrivateAssignments(target, signal);
+        return Boolean(assignments?.some((candidate) => candidate.ip === ip && candidate.network === network));
+    }
     /**
-     * Releases the Flycast addresses a project's sandbox recorded.
-     *
-     * Best-effort: the sandbox is being destroyed either way, and an address left
-     * behind is a reconciliation item (`fly ips list --app <target>`) rather than
-     * a failed teardown. It routes into a 6PN that no longer has any app in it.
-     * @param routes - Target app name → private address, from Machine metadata.
+     * Releases only Flycast addresses independently validated for this network.
+     * Metadata identifies candidates; it never authorizes a cross-network DELETE.
      */
-    async releasePrivateRoutes(routes) {
+    async releasePrivateRoutes(routes, signal, network) {
+        let released = true;
         for (const [target, ip] of Object.entries(routes)) {
             try {
-                await this.client.request(`/apps/${target}/ip_assignments/${encodeURIComponent(ip)}`, {
-                    method: 'DELETE',
-                    nullOn: [404],
-                });
+                if (!(await this.privateRouteMatchesNetwork(target, ip, network, signal))) {
+                    released = false;
+                    logger.warn('Kept a Fly private (Flycast) address with unvalidated network ownership', {
+                        target,
+                        ip,
+                        network,
+                    });
+                    continue;
+                }
+                await this.requestForDestruction(`/apps/${target}/ip_assignments/${encodeURIComponent(ip)}`, { method: 'DELETE', nullOn: [404] }, signal);
                 logger.debug('Released a Fly private (Flycast) address', { target, ip });
             }
             catch (error) {
+                if (signal.aborted)
+                    throw signal.reason;
+                released = false;
                 logger.warn('Failed to release a Fly private (Flycast) address — it will keep pointing at a 6PN ' +
                     'with no apps in it until it is reconciled with `fly ips list`', { target, ip, error });
             }
         }
+        return released;
     }
     /**
      * Resolves the ports the egress network policy allows, or `undefined` when no
@@ -811,8 +863,8 @@ class FlyioSandboxProvider {
      *   about a rule with no ports, so accepting `[]` would ship a security
      *   control whose behaviour is a guess.
      */
-    egressAllowedPorts() {
-        return mergeEgressPorts(this.configuredEgressPorts(), this.privateServices());
+    egressAllowedPorts(createRegion) {
+        return mergeEgressPorts(this.configuredEgressPorts(), this.privateServices(createRegion));
     }
     /**
      * Resolves ONLY the ports the operator configured, before the declared private
@@ -845,8 +897,8 @@ class FlyioSandboxProvider {
      * @param app - The Fly app name.
      * @returns Nothing; resolves once the policy is in place (or none was configured).
      */
-    async applyEgressPolicy(app) {
-        const ports = this.egressAllowedPorts();
+    async applyEgressPolicy(app, attempt, createRegion) {
+        const ports = this.egressAllowedPorts(createRegion);
         if (!ports)
             return;
         const name = this.config.egressPolicyName ?? DEFAULT_EGRESS_POLICY_NAME;
@@ -878,7 +930,18 @@ class FlyioSandboxProvider {
             selector: { all: true },
             rules: [{ action: 'allow', direction: 'egress', ports }],
         };
-        await this.client.request(`/apps/${app}/network_policies`, { method: 'POST', body: policy });
+        if (attempt) {
+            await this.requestForAttempt(attempt, `/apps/${app}/network_policies`, {
+                method: 'POST',
+                body: policy,
+            });
+        }
+        else {
+            await this.client.request(`/apps/${app}/network_policies`, {
+                method: 'POST',
+                body: policy,
+            });
+        }
         logger.info('Applied Fly egress network policy', {
             app,
             name,
@@ -956,7 +1019,7 @@ class FlyioSandboxProvider {
      * rather than failing the boot.
      * @param app - The Fly app name.
      */
-    async assignSharedIpv4(app) {
+    async assignSharedIpv4(app, attempt) {
         try {
             // ONLY `type` — verified against the live API 2026-08-09. Both `region`
             // ("region selection is not supported for this IP type", 400) and
@@ -964,37 +1027,51 @@ class FlyioSandboxProvider {
             // sandbox app WITHOUT a public IP, so its preview URL never routed and the
             // IDE hung on "Loading preview…" forever. The org derives from the app and
             // a shared v4 is global (no region).
-            await this.client.request(`/apps/${app}/ip_assignments`, {
+            const request = {
                 method: 'POST',
-                body: {
-                    type: this.config.ipAssignmentType ?? 'shared_v4',
-                },
-            });
+                body: { type: this.config.ipAssignmentType ?? 'shared_v4' },
+            };
+            if (attempt)
+                await this.requestForAttempt(attempt, `/apps/${app}/ip_assignments`, request);
+            else
+                await this.client.request(`/apps/${app}/ip_assignments`, request);
         }
         catch (error) {
+            if (attempt?.signal.aborted)
+                throw attempt.signal.reason;
+            if (attempt) {
+                await this.config.createAttemptJournal?.assertGeneration(attempt.attemptId, attempt.generation);
+            }
             logger.warn('Failed to assign a shared IPv4 to the Fly sandbox app — the public preview URL will ' +
                 'not resolve until an address is allocated', { app, error });
         }
     }
     /**
-     * Sanitizes a caller-supplied volume name into a valid Fly volume name.
-     *
-     * Fly requires `[a-z0-9_]` (lowercase only) and at most 30 characters — it
-     * rejects anything else with `400 "name only allows lowercase alphanumeric
-     * characters and underscores with at most 30 characters"`. Callers pass names
-     * like `mol-<uuid>` (40 chars, hyphens): lowercase, map every other character
-     * to `_`, and when the result is too long, keep a readable prefix plus a
-     * deterministic hash suffix so the name stays stable (`findVolume` re-derives
-     * the same name on the idempotent path) and unique.
-     * @param name - The caller's volume name.
-     * @returns A sanitized Fly volume name, `[a-z0-9_]` and <= 30 chars.
+     * Return the readable, sanitized identity shared by attempts for one caller label.
+     * @param name - The caller's volume label.
+     * @returns The `[a-z0-9_]` stem used by {@link volumeName}.
      */
-    volumeName(name) {
+    volumeNameStem(name) {
+        const sanitized = name.toLowerCase().replace(/[^a-z0-9_]/g, '_');
+        return `${sanitized.slice(0, 17)}_`;
+    }
+    /**
+     * Give one create attempt a unique Fly volume name (Fly permits duplicate names).
+     * @param name - The caller's volume label.
+     * @param attemptId - The Machine create attempt's identity.
+     * @returns A sanitized name of at most 30 characters, including the full attempt's digest.
+     */
+    volumeName(name, attemptId) {
+        const digest = createHash('sha256').update(`${name}\0${attemptId}`).digest('hex').slice(0, 12);
+        return `${this.volumeNameStem(name)}${digest}`;
+    }
+    /** The stable pre-attempt name under which durable workspaces were created. */
+    workspaceVolumeName(name) {
         const sanitized = name.toLowerCase().replace(/[^a-z0-9_]/g, '_');
         if (sanitized.length <= 30)
             return sanitized;
-        const hash = createHash('sha256').update(name).digest('hex').slice(0, 12);
-        return `${sanitized.slice(0, 17)}_${hash}`;
+        const digest = createHash('sha256').update(name).digest('hex').slice(0, 12);
+        return `${sanitized.slice(0, 17)}_${digest}`;
     }
     /**
      * Idempotently ensures a volume exists in the app and returns its id.
@@ -1004,28 +1081,138 @@ class FlyioSandboxProvider {
      * size are all known — rather than through the core's optional
      * `createVolume(name)`; see the module `@remarks`.
      * @param app - The Fly app name.
-     * @param name - The caller's volume name.
+     * @param flyName - This create attempt's unique, already-sanitized volume name.
      * @param sizeGB - Size to create the volume with, in whole GB.
-     * @returns The Fly volume id.
+     * @param compute - The exact guest sent with the Machine create.
+     * @returns The Fly volume id and whether this call created the volume.
      */
-    async ensureVolume(app, name, sizeGB) {
-        const flyName = this.volumeName(name);
-        const existing = await this.findVolume(app, flyName);
-        if (existing)
-            return existing.id;
-        const created = await this.client.request(`/apps/${app}/volumes`, {
+    async ensureVolume(app, projectId, name, attempt, sizeGB, compute, region) {
+        const journal = this.config.createAttemptJournal;
+        const bound = await journal?.findWorkspace(projectId, name);
+        if (bound?.id) {
+            const volumes = await this.client.request(`/apps/${app}/volumes`, {
+                signal: attempt.signal,
+            });
+            const existing = (volumes ?? []).find((volume) => volume.id === bound.id && volume.state !== 'destroyed' && volume.state !== 'destroying');
+            if (!existing) {
+                throw new Error(`Durable workspace volume "${bound.id}" cannot be read; refusing to replace it`);
+            }
+            await journal?.recordVolume(attempt.attemptId, {
+                ...bound,
+                id: existing.id,
+                logicalName: name,
+                workspace: true,
+                resolved: true,
+                createdByAttemptId: undefined,
+                adoptedByAttemptId: attempt.attemptId,
+            });
+            return { id: existing.id, name: bound.name, workspace: true };
+        }
+        // Pre-attempt releases used a deterministic name. Adopt that legacy volume
+        // by ID once; all later recreation uses the durable binding above.
+        const durableName = this.workspaceVolumeName(name);
+        const existing = await this.findVolume(app, durableName, attempt.signal);
+        if (existing) {
+            await journal?.recordVolume(attempt.attemptId, {
+                id: existing.id,
+                name: durableName,
+                logicalName: name,
+                workspace: true,
+                resolved: true,
+                adoptedByAttemptId: attempt.attemptId,
+            });
+            return { id: existing.id, name: durableName, workspace: true };
+        }
+        const attemptName = this.volumeName(name, attempt.attemptId);
+        await journal?.recordVolume(attempt.attemptId, {
+            name: attemptName,
+            logicalName: name,
+            workspace: true,
+            resolved: false,
+            createdByAttemptId: attempt.attemptId,
+        });
+        try {
+            const created = await this.createFreshVolume(app, attemptName, attempt, sizeGB, compute, region);
+            await journal?.recordVolume(attempt.attemptId, {
+                id: created.id,
+                name: attemptName,
+                logicalName: name,
+                workspace: false,
+                resolved: true,
+                createdByAttemptId: created.accepted ? attempt.attemptId : undefined,
+                adoptedByAttemptId: created.accepted ? undefined : attempt.attemptId,
+            });
+            return { id: created.id, name: attemptName, workspace: false };
+        }
+        catch (error) {
+            if (error instanceof FlyApiError &&
+                error.method.toUpperCase() === 'POST' &&
+                error.path === `/apps/${app}/volumes` &&
+                error.status >= 400 &&
+                error.status < 500 &&
+                ![409, 422].includes(error.status)) {
+                // A conflict/validation response can describe a write whose earlier
+                // response was lost, so those outcomes stay unresolved. The 429 replay
+                // contract treats rate-limit rejection as definite; other non-conflict
+                // 4xx responses reject this unique attempt name before creating it.
+                await journal?.recordVolume(attempt.attemptId, {
+                    name: attemptName,
+                    logicalName: name,
+                    workspace: false,
+                    resolved: true,
+                });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Creates a volume with the expected Machine's guest as its placement hint.
+     * A 429 is safe to replay directly. After a transport failure or 5xx, bounded
+     * lookups reconcile the attempt's unique name; if it stays invisible the create
+     * fails rather than replaying an ambiguous POST that could duplicate the volume.
+     * @param app - The Fly app name.
+     * @param flyName - This create attempt's unique, already-sanitized volume name.
+     * @param sizeGB - Size to create the volume with, in whole GB.
+     * @param compute - The exact guest sent with the Machine create.
+     * @returns The new Fly volume id.
+     */
+    async createFreshVolume(app, flyName, attempt, sizeGB, compute, region) {
+        let adopted = false;
+        const created = await this.requestForAttempt(attempt, `/apps/${app}/volumes`, {
             method: 'POST',
             body: {
                 name: flyName,
-                region: this.region(),
+                region,
                 size_gb: sizeGB,
                 encrypted: true,
+                compute,
+            },
+            reconcile: async (error) => {
+                // A 429 is Fly's confirmation that this request was rejected. Every
+                // other retryable outcome is ambiguous: never replay it until a few
+                // name lookups have had a chance to find the volume Fly may have made.
+                if (error.status !== 0 && error.status < 500)
+                    return undefined;
+                for (let lookup = 1; lookup <= CREATE_RECONCILE_ATTEMPTS; lookup++) {
+                    const existing = await this.findVolume(app, flyName, attempt.signal);
+                    if (existing) {
+                        adopted = true;
+                        return existing;
+                    }
+                    if (lookup < CREATE_RECONCILE_ATTEMPTS) {
+                        await this.client.sleep(retryDelayMs(lookup));
+                    }
+                }
+                // Fly permits duplicate volume names. Negative reads therefore cannot
+                // authorize another POST: stop with the outcome unknown and let the
+                // owning app's durable reconciler reclaim anything the write made.
+                throw new Error(`Fly volume create "${flyName}" has an unknown outcome; refusing to replay it`, { cause: error });
             },
         });
         if (!created?.id) {
             throw new Error(t('codeSandbox.flyio.error.volumeCreateFailed', { name: flyName }, { defaultValue: `Fly volume "${flyName}" was created but the API returned no id.` }));
         }
-        return created.id;
+        return { id: created.id, accepted: !adopted };
     }
     /**
      * Finds a volume in an app by name, ignoring ones already being destroyed.
@@ -1033,9 +1220,10 @@ class FlyioSandboxProvider {
      * @param flyName - The sanitized Fly volume name.
      * @returns The matching volume, or `null`.
      */
-    async findVolume(app, flyName) {
+    async findVolume(app, flyName, signal) {
         const volumes = await this.client.request(`/apps/${app}/volumes`, {
             nullOn: [404],
+            signal,
         });
         if (!Array.isArray(volumes))
             return null;
@@ -1063,7 +1251,21 @@ class FlyioSandboxProvider {
      * @param config - Project id, image, env, volume name, template, labels and resource limits.
      * @returns A `Sandbox` bound to the new Machine.
      */
-    async create(config) {
+    /**
+     * Return the collision-free app name for a complete caller/project identity.
+     * @param projectId - The complete project or per-deploy identity.
+     * @returns The DNS-safe, at-most-63-character app name.
+     */
+    appNameForProject(projectId) {
+        return appNameForProject(this.appPrefix(), projectId);
+    }
+    /**
+     * Create, reconcile and boot one uniquely identified Fly Machine attempt.
+     * Automatic cleanup deletes only a volume or exact Machine ID with this attempt's accepted-create provenance. Apps always remain KEEP for deliberate retirement; adopted, inherited, listed, older-writer and ambiguous resources are also KEPT.
+     * @param config - The sandbox image, project, storage and resource configuration.
+     * @returns The running sandbox.
+     */
+    async create(config, signal = new AbortController().signal) {
         // Resolved BEFORE anything is provisioned, so a bad template id costs no app,
         // no volume and no Machine.
         let manifest = null;
@@ -1083,49 +1285,60 @@ class FlyioSandboxProvider {
         // is checked too — the host is unroutable however the value arrives, and
         // that env is exactly where a control plane puts the values it refuses to
         // leave in a Machine config.
-        assertPrivateRoutesForEnv({ ...config.env, ...config.selfDeliveredEnv }, this.privateServices());
+        const createRegion = this.region(config.region);
+        assertPrivateRoutesForEnv({ ...config.env, ...config.selfDeliveredEnv }, this.privateServices(createRegion));
         const app = this.resolveApp(config.projectId);
-        const { routes: privateRoutes, allocated, created } = await this.ensureApp(app);
+        const createAttemptId = randomUUID();
+        const journal = this.config.createAttemptJournal;
+        // The SQL journal stays closed until pre-journal/provenance-ignoring writers
+        // have drained. No durable row or Fly resource is created while it is closed.
+        await journal?.assertCreateAllowed();
+        await journal?.begin({
+            attemptId: createAttemptId,
+            projectId: config.projectId,
+            ownerProjectId: String(config.labels?.['molecule.production'] ?? config.projectId),
+            appName: app,
+        });
+        const attempt = { attemptId: createAttemptId, generation: 1, signal };
         try {
-            return await this.createInApp(app, privateRoutes, config, manifest);
+            const { routes: privateRoutes } = await this.ensureApp(app, {
+                attempt,
+                createRegion,
+            });
+            const sandbox = await this.createInApp(app, privateRoutes, config, manifest, attempt);
+            if (signal.aborted)
+                throw signal.reason;
+            await journal?.assertGeneration(attempt.attemptId, attempt.generation);
+            await journal?.markState(createAttemptId, 'serving', sandbox.id);
+            return sandbox;
         }
         catch (error) {
-            if (created && this.appPerProject()) {
-                // The whole app goes, addresses included — discardCreatedApp releases
-                // every route it was handed (a created app holds only this call's).
-                await this.discardCreatedApp(app, privateRoutes);
-            }
-            else {
-                // The app SURVIVES this failure (it pre-existed, or it is the shared
-                // app), so the addresses this call allocated would otherwise stay
-                // behind on their target apps with nothing recording them: the
-                // Machine that would have carried the metadata was never created, and
-                // Fly's listing cannot say which network an address belongs to. Take
-                // back exactly this call's own allocations — never the routes an
-                // earlier boot recorded, whose Machines may still be running.
-                await this.releasePrivateRoutes(allocated);
-            }
+            // Create has NO deletion path. The durable attempt is settled by the
+            // separate reconciler after this failure (or after its abandonment window).
+            await journal?.markState(createAttemptId, 'failed').catch((journalError) => {
+                logger.warn('Could not mark a Fly create attempt failed', {
+                    app,
+                    createAttemptId,
+                    error: journalError,
+                });
+            });
             throw error;
         }
     }
     /**
-     * The part of {@link create} that runs once the app exists: clear stale
-     * Machines, provision the volume, create the Machine and wait for it.
+     * The part of {@link create} that provisions the volume, creates the Machine and waits for it.
      * @param app - The app.
      * @param privateRoutes - Flycast addresses allocated for the app.
      * @param config - The sandbox config.
      * @param manifest - The template manifest, when creating from a template.
      * @returns The running sandbox.
      */
-    async createInApp(app, privateRoutes, config, manifest) {
-        // Clear any stale Machine from a prior failed/partial create before
-        // provisioning — otherwise it still holds the app's single-attach volume and
-        // `POST /machines` fails with `412 volume already claimed`. Makes create
-        // idempotent so a retried queue job (or a user re-clicking Start) recovers.
-        await this.destroyStaleMachines(app);
+    async createInApp(app, privateRoutes, config, manifest, attempt) {
+        const createAttemptId = attempt.attemptId;
         const metadata = {
             [`${this.metadataPrefix}.projectId`]: config.projectId,
             [`${this.metadataPrefix}.managed`]: 'true',
+            [`${this.metadataPrefix}.createAttempt`]: createAttemptId,
             // Recorded so `destroy()` can release exactly the addresses this project
             // allocated. Fly's IP listing does not report which network an address
             // belongs to, so nothing else can reconstruct this.
@@ -1171,34 +1384,112 @@ class FlyioSandboxProvider {
         // the image's idle command and serving nothing.
         if (config.command?.length)
             machineConfig.init = { exec: [...config.command] };
-        if (config.volumeName) {
-            metadata[`${this.metadataPrefix}.volumeName`] = config.volumeName;
-            const sizeGB = config.resources?.diskMB
+        const volumeName = config.volumeName;
+        if (volumeName) {
+            metadata[`${this.metadataPrefix}.volumeName`] = volumeName;
+            const volumeSizeGB = config.resources?.diskMB
                 ? Math.max(1, Math.ceil(config.resources.diskMB / 1024))
                 : (this.config.defaultVolumeGB ?? DEFAULT_VOLUME_GB);
-            const volumeId = await this.ensureVolume(app, config.volumeName, sizeGB);
+            const volume = await this.ensureVolume(app, config.projectId, volumeName, attempt, volumeSizeGB, machineConfig.guest ?? {}, this.region(config.region));
             // The caller may scope the volume to a subtree (e.g. /workspace/<appDir>)
             // so regenerable tooling (node_modules) stays on the fast image-backed
             // rootfs and only durable state pays the volume's small-file IO cost.
-            machineConfig.mounts = [{ volume: volumeId, path: config.volumeMountPath ?? WORKSPACE_PATH }];
+            machineConfig.mounts = [{ volume: volume.id, path: config.volumeMountPath ?? WORKSPACE_PATH }];
         }
         const service = this.previewService(config.idleAction);
         if (service)
             machineConfig.services = [service];
-        const machine = await this.client.request(`/apps/${app}/machines`, {
-            method: 'POST',
-            body: { region: this.region(), config: machineConfig },
-            // A just-created app propagates to the Machines API asynchronously, so this
-            // POST can 404 "app not found" for a few seconds. Retry the 404 (safe: no
-            // Machine is created when the app is not found) across the client's backoff.
-            attempts: MACHINE_CREATE_ATTEMPTS,
-            retryStatuses: MACHINE_CREATE_RETRY_STATUSES,
-        });
+        // The POST intent must survive a crash before dispatch. A NULL outcome on
+        // an older row is unknown too; only a new not-started/rejected row proves
+        // that no accepted Machine identity can be hidden by a later empty list.
+        await this.config.createAttemptJournal?.recordMachineCreateOutcome(createAttemptId, attempt.generation, 'pending');
+        let machine;
+        let machineCreateResponseLost = false;
+        try {
+            machine = await this.requestForAttempt(attempt, `/apps/${app}/machines`, {
+                method: 'POST',
+                body: {
+                    name: createAttemptId,
+                    region: this.region(config.region),
+                    config: machineConfig,
+                },
+                // A just-created app propagates to the Machines API asynchronously, so this
+                // POST can 404 "app not found" for a few seconds. Retry the 404 (safe: no
+                // Machine is created when the app is not found) across the client's backoff.
+                attempts: MACHINE_CREATE_ATTEMPTS,
+                retryStatuses: MACHINE_CREATE_RETRY_STATUSES,
+                // A 412 is transient only for the specific released-volume-claim lag.
+                // Placement capacity must reach the caller's bounded retry at once,
+                // with the volume preserved; every other 412 remains a real rejection.
+                retryWhen: (error) => {
+                    if (error.status === 400)
+                        return /volume not found/i.test(error.body);
+                    if (error.status !== 412)
+                        return true;
+                    return (/volume already claimed by machine/i.test(error.body) ||
+                        /volume_placement_capacity/i.test(error.body));
+                },
+                reconcile: async (error) => {
+                    // Rate limiting and explicit precondition rejections did not create a
+                    // Machine, so their normal bounded replay is safe. A transport/5xx
+                    // result is ambiguous: reconcile ONLY this attempt's recorded identity
+                    // and never issue another create when the reads cannot find it.
+                    if (error.status === 429 || (error.status >= 400 && error.status < 500)) {
+                        return undefined;
+                    }
+                    // A Machine recovered by listing after a lost response is adoption
+                    // evidence, not an accepted POST response and never delete authority.
+                    machineCreateResponseLost = true;
+                    await this.config.createAttemptJournal?.recordMachineCreateOutcome(createAttemptId, attempt.generation, 'unknown');
+                    for (let lookup = 1; lookup <= CREATE_RECONCILE_ATTEMPTS; lookup++) {
+                        const machines = await this.client.request(`/apps/${app}/machines`, {
+                            nullOn: [404],
+                            signal: attempt.signal,
+                        });
+                        const existing = (machines ?? []).find((candidate) => candidate.name === createAttemptId ||
+                            candidate.config?.metadata?.[`${this.metadataPrefix}.createAttempt`] ===
+                                createAttemptId);
+                        if (existing) {
+                            await this.config.createAttemptJournal?.recordMachineObservation(createAttemptId, attempt.generation, existing.id);
+                            return existing;
+                        }
+                        if (lookup < CREATE_RECONCILE_ATTEMPTS) {
+                            await this.client.sleep(retryDelayMs(lookup));
+                        }
+                    }
+                    throw new Error(`Fly Machine create "${createAttemptId}" in app "${app}" has an unknown outcome; refusing to replay it`, { cause: error });
+                },
+            });
+        }
+        catch (error) {
+            if (attempt.signal.aborted)
+                throw attempt.signal.reason;
+            if (error instanceof FlyApiError &&
+                error.method.toUpperCase() === 'POST' &&
+                error.path === `/apps/${app}/machines` &&
+                error.status >= 400 &&
+                error.status < 500) {
+                try {
+                    await this.config.createAttemptJournal?.markMachineCreateFailed(createAttemptId, attempt.generation);
+                }
+                catch (journalError) {
+                    logger.warn('Could not record a definitive Fly Machine-create rejection', {
+                        app,
+                        createAttemptId,
+                        error: journalError,
+                    });
+                }
+            }
+            throw error;
+        }
         if (!machine?.id) {
             throw new Error(t('codeSandbox.flyio.error.createFailed', { app }, { defaultValue: `Fly Machine creation in app "${app}" returned no Machine id.` }));
         }
+        if (!machineCreateResponseLost) {
+            await this.config.createAttemptJournal?.recordMachineProvenance(createAttemptId, attempt.generation, machine.id);
+        }
         if (manifest && config.templateId) {
-            await this.restoreTemplate(app, machine.id, config.templateId, manifest);
+            await this.restoreTemplate(app, machine.id, config.templateId, manifest, attempt);
             // The restore waited for `started` and ran a command in it, so the state
             // read back from the creation response is stale by definition.
             return this.buildSandbox(app, machine.id, 'running');
@@ -1209,35 +1500,7 @@ class FlyioSandboxProvider {
         // `412 failed_precondition: machine not running` until the Machine is up.
         // Wait for `started` here so `create` always hands back a live sandbox, as
         // the JSDoc promises — the template path already does this via restore.
-        try {
-            await this.waitForStarted(app, machine.id);
-        }
-        catch (error) {
-            // The boot failed after the Machine existed. This call created it and
-            // handed it to NOBODY — the caller got a rejection, not a handle — so
-            // leaving it behind strands state nothing else ever cleans up: a Machine
-            // that reached `started` bills compute until it is reaped, and one that
-            // did not keeps the app's single-attach volume claimed (the next
-            // create's stale-Machine sweep only runs if this project is retried).
-            // The created-app failure path below cannot do this either: it deletes
-            // the APP, and `discardCreatedApp` deliberately has no Machine-delete
-            // step — an app delete that runs under a live Machine either fails or
-            // hides the Machine. Destroy the Machine first (the same order
-            // `restoreTemplate`'s failure path and `destroy()` use), then rethrow
-            // the boot failure. Best-effort: the boot failure is what the caller
-            // must see; a failed cleanup is logged like every other cleanup here.
-            try {
-                await this.client.request(`/apps/${app}/machines/${machine.id}?force=true`, {
-                    method: 'DELETE',
-                    nullOn: [404],
-                });
-            }
-            catch (cleanupError) {
-                logger.warn('Failed to destroy the Fly Machine whose boot did not reach started — it will keep ' +
-                    'billing (and holding its volume) until it is reaped', { app, machineId: machine.id, error: cleanupError });
-            }
-            throw error;
-        }
+        await this.waitForStarted(app, machine.id, attempt);
         return this.buildSandbox(app, machine.id, 'running');
     }
     /**
@@ -1476,8 +1739,10 @@ class FlyioSandboxProvider {
                     'TRUNCATED, so some sandboxes would be missing from the result.',
             }));
         }
-        const prefix = `${this.appPrefix()}-`;
-        const owned = apps.map((app) => app.name).filter((name) => name?.startsWith(prefix));
+        const namespace = appNameNamespace(this.appPrefix());
+        const owned = apps
+            .map((app) => app.name)
+            .filter((name) => namespace.searchPrefixes.some((prefix) => name?.startsWith(prefix)));
         if (owned.length > FIND_MAX_APPS) {
             throw new Error(t('codeSandbox.flyio.error.findTooManyApps', { count: String(owned.length), max: String(FIND_MAX_APPS) }, {
                 defaultValue: `Refusing to enumerate ${owned.length} Fly sandbox apps (cap ${FIND_MAX_APPS}): ` +
@@ -1487,6 +1752,834 @@ class FlyioSandboxProvider {
         }
         return owned;
     }
+    /** Read an existing app's live state; a list 404 after the app read is an error, not absence. */
+    async readAttemptAppState(app, signal) {
+        const [machines, volumes] = await Promise.all([
+            this.requestForDestruction(`/apps/${app}/machines`, { nullOn: [404] }, signal),
+            this.requestForDestruction(`/apps/${app}/volumes`, { nullOn: [404] }, signal),
+        ]);
+        if (Array.isArray(machines) && Array.isArray(volumes)) {
+            return {
+                appGone: false,
+                machines,
+                volumes: volumes.filter((volume) => volume.state !== 'destroyed' && volume.state !== 'destroying'),
+            };
+        }
+        // A Machines/Volumes-list 404 is not proof that a newly-created app is
+        // gone. Confirm the app itself; if it exists, the list read was transient
+        // and responsibility must remain durable.
+        const existing = await this.requestForDestruction(`/apps/${app}`, { nullOn: [404] }, signal);
+        if (existing)
+            throw new Error(`Fly app "${app}" exists but its live-state listing failed`);
+        return { appGone: true, machines: [], volumes: [] };
+    }
+    /** Prove a definitively rejected Machine create has no live consumer before retiring it. */
+    async assertFailedMachineSweepable(intent, signal) {
+        if ((intent.appCreatedByAttemptId === intent.attemptId && intent.appCreateResolved !== true) ||
+            intent.volumes.some((volume) => volume.resolved !== true) ||
+            intent.addresses.some((address) => !address.resolved)) {
+            throw new Error(`Fly create attempt "${intent.attemptId}" still has unresolved ownership`);
+        }
+        const live = await this.readAttemptAppState(intent.appName, signal);
+        if (signal.aborted)
+            throw signal.reason;
+        // Siblings matter only through an actual resource reference below, or at
+        // the later app-deletion boundary. Their mere existence must not strand a
+        // detached, proven-created volume in a shared app.
+        if (live.appGone)
+            return;
+        if (this.appPerProject() && live.machines.length) {
+            throw new Error(`Fly app "${intent.appName}" still has Machines; failed-create sweep is KEEP`);
+        }
+        const volumeIds = new Set(intent.volumes.map((volume) => volume.id).filter((id) => Boolean(id)));
+        for (const machine of live.machines) {
+            if (machine.config?.mounts?.some((mount) => mount.volume && volumeIds.has(mount.volume))) {
+                throw new Error(`Fly Machine "${machine.id}" still references a failed-create volume; sweep is KEEP`);
+            }
+        }
+        for (const volume of live.volumes) {
+            if (volumeIds.has(volume.id) && volume.attached_machine_id) {
+                throw new Error(`Fly volume "${volume.id}" is still attached to "${volume.attached_machine_id}"; sweep is KEEP`);
+            }
+        }
+    }
+    /** Exact durable Machine identity; unlike accepted provenance, sandboxId may be observational. */
+    recordedMachineId(intent) {
+        if (intent.machineId)
+            return intent.machineId;
+        const prefix = `${intent.appName}:`;
+        if (!intent.sandboxId?.startsWith(prefix))
+            return undefined;
+        return intent.sandboxId.slice(prefix.length) || undefined;
+    }
+    /** True when no exact durable Machine ID can settle a possibly-dispatched POST. */
+    hasUnresolvedMachineIdentity(intent) {
+        if (this.recordedMachineId(intent))
+            return false;
+        const legacyUnknown = intent.machineCreateOutcome === undefined &&
+            intent.machineCreateFailed !== true &&
+            !intent.machineId &&
+            !intent.sandboxId &&
+            !intent.machineAdopted;
+        return (legacyUnknown ||
+            intent.machineCreateOutcome === 'pending' ||
+            intent.machineCreateOutcome === 'unknown' ||
+            intent.machineCreateOutcome === 'accepted' ||
+            Boolean(intent.machineId || intent.sandboxId || intent.machineAdopted));
+    }
+    /**
+     * The sole forgetting guard. A listing is never an absence proof: every
+     * durable Machine/volume ID needs this pass's authorized DELETE success/404
+     * or its own exact GET 404. Unresolved identities remain visible as KEEP.
+     */
+    async assertAuthoritativeForget(intent, signal, settled, app) {
+        // A successful non-forced app DELETE (or exact app 404) is authoritative
+        // for every resource contained by that app. External addresses still need
+        // their own settled records below.
+        const containerSettled = app.settled;
+        const machineId = this.recordedMachineId(intent);
+        if (!containerSettled && this.hasUnresolvedMachineIdentity(intent)) {
+            throw new Error(`Fly Machine identity for attempt "${intent.attemptId}" is unresolved; forgetting is KEEP`);
+        }
+        if (!containerSettled && machineId && !settled.machineIds.has(machineId)) {
+            const machine = await this.requestForDestruction(`/apps/${intent.appName}/machines/${machineId}`, { nullOn: [404] }, signal);
+            if (machine) {
+                throw new Error(`Fly Machine "${machineId}" for attempt "${intent.attemptId}" still exists; forgetting is KEEP`);
+            }
+        }
+        for (const volume of containerSettled ? [] : intent.volumes) {
+            if (volume.resolved !== true) {
+                throw new Error(`Fly volume "${volume.id ?? volume.name}" for attempt "${intent.attemptId}" is unresolved; forgetting is KEEP`);
+            }
+            if (!volume.id || settled.volumeIds.has(volume.id))
+                continue;
+            const live = await this.requestForDestruction(`/apps/${intent.appName}/volumes/${volume.id}`, { nullOn: [404] }, signal);
+            if (live) {
+                throw new Error(`Fly volume "${volume.id}" for attempt "${intent.attemptId}" still exists; forgetting is KEEP`);
+            }
+        }
+        if (intent.addresses.some((address) => !address.resolved || address.owned)) {
+            throw new Error(`Fly addresses for attempt "${intent.attemptId}" are not settled; KEEP`);
+        }
+        if (app.required && !app.settled) {
+            throw new Error(`Fly app "${intent.appName}" has no authoritative absence result; KEEP`);
+        }
+    }
+    /**
+     * The ONE automatic deletion/settlement function. Its four invariants are:
+     * (a) it runs only under the owning attempt's lifecycle lock, and re-reads the
+     * durable record and Fly live state inside that lock before EVERY delete;
+     * (b) automatic deletion additionally requires this attempt's accepted-POST
+     * provenance and exact resource ID; adoption is never deletion authority;
+     * (c) unknown outcomes and transient absence retain responsibility. The one
+     * forgetting boundary below requires an authoritative exact-ID result for
+     * every resource: an exact GET 404, or an authorized DELETE success/404. A
+     * listing, empty listing, NULL ID or "no recorded resources" proves no
+     * absence; an unresolved identity keeps the row and reports KEEP. Durable
+     * addresses are released before app deletion/forgetting; and (d) cancellation
+     * plus the attempt's current generation fences every Fly mutation. A stale,
+     * serving or unreadable attempt therefore cannot delete anything or be forgotten.
+     */
+    async settleCreateAttempt(snapshot, signal, generation, options = {}) {
+        const automatic = options.automatic ?? false;
+        const retire = options.retire ?? false;
+        const failedMachineSweep = options.failedMachineSweep ?? false;
+        const deleteApp = options.deleteApp ?? true;
+        const forget = options.forget ?? true;
+        const appRequired = deleteApp && this.appPerProject();
+        // Automatic reconciliation never deletes an app: a container DELETE can
+        // cascade into any sibling's retained or not-yet-resolved user resources.
+        // An existing app remains a durable KEEP for deliberate retirement.
+        const mayDeleteApp = appRequired && !automatic;
+        const journal = this.config.createAttemptJournal;
+        if (!journal)
+            throw new Error('A durable create-attempt journal is required for settlement');
+        const fresh = async () => {
+            if (signal.aborted)
+                throw signal.reason;
+            await journal.assertGeneration(snapshot.attemptId, generation);
+            const current = await journal.get(snapshot.attemptId);
+            if (signal.aborted)
+                throw signal.reason;
+            if (!current || (current.generation ?? 1) !== generation) {
+                throw new Error(`Fly create attempt "${snapshot.attemptId}" was superseded`);
+            }
+            if (current.state !== 'failed' && current.state !== 'abandoned') {
+                throw new Error(`Fly create attempt "${snapshot.attemptId}" is no longer settleable`);
+            }
+            if ((options.expectedAppName && current.appName !== options.expectedAppName) ||
+                (options.expectedMachineId && this.recordedMachineId(current) !== options.expectedMachineId)) {
+                throw new Error(`Fly create attempt "${snapshot.attemptId}" changed outside the caller-validated scope`);
+            }
+            return current;
+        };
+        const ownMachine = (machines, intent) => {
+            // Once an exact ID is durable, a same-name Machine is potentially a
+            // replacement and must never inherit that identity. machineId may be an
+            // observation; only machineCreatedByAttemptId grants automatic authority.
+            const recordedId = this.recordedMachineId(intent);
+            if (recordedId)
+                return machines.find((machine) => machine.id === recordedId);
+            if (options.recordedResourcesOnly)
+                return undefined;
+            const direct = machines.find((machine) => machine.name === intent.attemptId ||
+                machine.config?.metadata?.[`${this.metadataPrefix}.createAttempt`] === intent.attemptId);
+            if (direct || !intent.attemptId.startsWith('legacy:') || !intent.sandboxId)
+                return direct;
+            const prefix = `${intent.appName}:`;
+            if (!intent.sandboxId.startsWith(prefix))
+                return undefined;
+            const sandboxMachineId = intent.sandboxId.slice(prefix.length);
+            return machines.find((machine) => machine.id === sandboxMachineId);
+        };
+        const adoptLegacyResources = async (machine) => {
+            if (!intent.attemptId.startsWith('legacy:'))
+                return;
+            const metadata = machine.config?.metadata ?? {};
+            const logicalName = metadata[`${this.metadataPrefix}.volumeName`];
+            for (const mount of machine.config?.mounts ?? []) {
+                if (!mount.volume || intent.volumes.some((volume) => volume.id === mount.volume))
+                    continue;
+                const listed = live.volumes.find((volume) => volume.id === mount.volume);
+                await journal.recordVolume(intent.attemptId, {
+                    id: mount.volume,
+                    name: listed?.name ?? mount.volume,
+                    ...(logicalName ? { logicalName } : {}),
+                    workspace: false,
+                    resolved: true,
+                    adoptedByAttemptId: intent.attemptId,
+                });
+            }
+            const routes = decodePrivateRoutes(metadata[`${this.metadataPrefix}.${PRIVATE_ROUTES_METADATA_SUFFIX}`]);
+            const network = this.networkFor(intent.appName);
+            for (const [targetApp, ip] of Object.entries(routes)) {
+                // A durable exact binding for the intended network is authoritative.
+                // Otherwise validate the IP independently; copied metadata is only a hint.
+                if (intent.addresses.some((address) => address.targetApp === targetApp &&
+                    address.network === network &&
+                    address.ip === ip &&
+                    address.resolved)) {
+                    continue;
+                }
+                const validated = await this.privateRouteMatchesNetwork(targetApp, ip, network, signal);
+                await journal.recordAddress(intent.attemptId, {
+                    targetApp,
+                    network: network ?? intent.appName,
+                    ip,
+                    owned: validated,
+                    resolved: validated,
+                });
+            }
+        };
+        const assertObservedMachineUnreferenced = async (intent, machineId) => {
+            if (intent.machineCreatedByAttemptId === intent.attemptId)
+                return;
+            const siblings = await journal.forApp(intent.appName);
+            if (signal.aborted)
+                throw signal.reason;
+            const conflict = siblings.find((candidate) => candidate.attemptId !== intent.attemptId &&
+                candidate.state !== 'abandoned' &&
+                this.recordedMachineId(candidate) === machineId);
+            if (conflict) {
+                throw new Error(`Fly Machine "${machineId}" is still referenced by ${conflict.state} attempt "${conflict.attemptId}"; observed retirement is KEEP`);
+            }
+        };
+        const activeStates = [
+            'creating',
+            'starting',
+            'started',
+            'restarting',
+            'updating',
+            'replacing',
+            'migrated',
+        ];
+        const hasActiveSibling = async (intent) => {
+            if (signal.aborted)
+                throw signal.reason;
+            const siblings = await journal.forApp(intent.appName);
+            if (signal.aborted)
+                throw signal.reason;
+            return siblings.some((candidate) => {
+                if (candidate.attemptId === intent.attemptId)
+                    return false;
+                if (candidate.state === 'serving')
+                    return true;
+                // Every expired sibling in this set is independently reclaimable and
+                // will be retired under its own lock in this pass. The current app lock
+                // fences it now; treating the stale row as live deadlocks both rows.
+                return (candidate.state === 'creating' && !options.expiredCreatingIds?.has(candidate.attemptId));
+            });
+        };
+        const readRecordedMachine = async (current) => {
+            const id = this.recordedMachineId(current);
+            if (!id)
+                return undefined;
+            return this.requestForDestruction(`/apps/${current.appName}/machines/${id}`, { nullOn: [404] }, signal);
+        };
+        const releasedMachineIds = new Set();
+        let intent = await fresh();
+        let live = await this.readAttemptAppState(intent.appName, signal);
+        const observed = ownMachine(options.observedMachines ?? [], intent);
+        if (observed) {
+            // destroyApp read this metadata before waiting for the attempt lock. Save
+            // that observation now; a later list omission cannot erase ownership.
+            intent = await fresh();
+            await adoptLegacyResources(observed);
+            intent = await fresh();
+        }
+        // A list omission cannot erase a durable ID. Read that exact resource;
+        // 403/5xx keeps the row, 404 is authoritative, and a live result follows
+        // the same state/provenance checks as a listed Machine.
+        const machine = ownMachine(live.machines, intent) ??
+            (!forget || mayDeleteApp ? undefined : ((await readRecordedMachine(intent)) ?? undefined));
+        if (machine && !this.recordedMachineId(intent)) {
+            // A name/metadata match recovers an exact identity as observation only.
+            // It deliberately does not gain automatic deletion provenance.
+            await journal.recordMachineObservation(intent.attemptId, generation, machine.id);
+            intent = await fresh();
+        }
+        if (automatic &&
+            machine &&
+            (intent.machineCreatedByAttemptId !== intent.attemptId || intent.machineId !== machine.id)) {
+            throw new Error(`Fly Machine "${machine.id}" for attempt "${intent.attemptId}" has no matching accepted-POST provenance; KEEP`);
+        }
+        if (failedMachineSweep && machine) {
+            throw new Error(`Fly Machine "${machine.id}" appeared during failed-create sweep; KEEP`);
+        }
+        if (!retire &&
+            machine &&
+            (activeStates.includes(machine.state ?? 'created') ||
+                intent.volumes.some((volume) => volume.workspace))) {
+            return false;
+        }
+        if (machine) {
+            // Re-read immediately before the destructive decision, not from the lock-wait snapshot.
+            intent = await fresh();
+            live = await this.readAttemptAppState(intent.appName, signal);
+            const current = ownMachine(live.machines, intent) ??
+                (!forget || mayDeleteApp ? undefined : ((await readRecordedMachine(intent)) ?? undefined));
+            if (failedMachineSweep && current) {
+                throw new Error(`Fly Machine "${current.id}" appeared during failed-create sweep; KEEP`);
+            }
+            if (!retire &&
+                current &&
+                (activeStates.includes(current.state ?? 'created') ||
+                    intent.volumes.some((volume) => volume.workspace))) {
+                return false;
+            }
+            if (automatic &&
+                current &&
+                (intent.machineCreatedByAttemptId !== intent.attemptId || intent.machineId !== current.id)) {
+                throw new Error(`Fly Machine "${current.id}" for attempt "${intent.attemptId}" lost accepted-POST provenance before deletion; KEEP`);
+            }
+            if (current) {
+                // Migration 1793275400000 recorded only the synthetic attempt and
+                // sandbox ID. The owned Machine's mounts/routes rebuild the exact-ID
+                // responsibilities before its metadata disappears on deletion.
+                await adoptLegacyResources(current);
+                intent = await fresh();
+                // Observation is not ownership. Recheck every other durable reference
+                // on this same app lock immediately before the irreversible request.
+                await assertObservedMachineUnreferenced(intent, current.id);
+                await this.deleteRetired(intent, generation, `/apps/${intent.appName}/machines/${current.id}?force=true`, signal);
+                releasedMachineIds.add(current.id);
+            }
+        }
+        const releasedVolumeIds = new Set();
+        for (const recorded of intent.volumes) {
+            intent = await fresh();
+            let volumeIntent = intent.volumes.find((candidate) => candidate.name === recorded.name || candidate.id === recorded.id);
+            if (!volumeIntent || (volumeIntent.resolved === true && !volumeIntent.id))
+                continue;
+            live = await this.readAttemptAppState(intent.appName, signal);
+            if (live.appGone)
+                continue;
+            if (options.recordedResourcesOnly && !volumeIntent.id) {
+                throw new Error(`Fly volume "${volumeIntent.name}" for attempt "${intent.attemptId}" has no exact durable ID; refusing discovery during explicit retirement`);
+            }
+            if (!volumeIntent.id) {
+                const matches = live.volumes.filter((candidate) => candidate.name === volumeIntent?.name);
+                if (matches.length > 1) {
+                    throw new Error(`Fly volume create "${volumeIntent.name}" has ambiguous matches; an explicit ID is required`);
+                }
+                const discovered = matches[0];
+                if (!discovered) {
+                    throw new Error(`Fly volume create "${volumeIntent.name}" remains unresolved`);
+                }
+                // A unique name match is an observation only. Persist its exact ID for
+                // deliberate retirement, never accepted-POST/automatic-delete authority.
+                await journal.recordVolume(intent.attemptId, {
+                    ...volumeIntent,
+                    id: discovered.id,
+                    resolved: true,
+                    createdByAttemptId: undefined,
+                    adoptedByAttemptId: intent.attemptId,
+                });
+                intent = await fresh();
+                volumeIntent = intent.volumes.find((candidate) => candidate.id === discovered.id);
+            }
+            if (automatic &&
+                volumeIntent &&
+                (volumeIntent.createdByAttemptId !== intent.attemptId || volumeIntent.resolved !== true)) {
+                throw new Error(`Fly volume "${volumeIntent.id ?? volumeIntent.name}" for attempt "${intent.attemptId}" has no matching accepted-POST provenance; KEEP`);
+            }
+            if (!volumeIntent?.id || (!retire && volumeIntent.workspace))
+                continue;
+            // ID, attachment, workspace flag and ownership are all re-read under the lock.
+            intent = await fresh();
+            volumeIntent = intent.volumes.find((candidate) => candidate.id === volumeIntent?.id);
+            live = await this.readAttemptAppState(intent.appName, signal);
+            const volume = live.volumes.find((candidate) => candidate.id === volumeIntent?.id);
+            if (failedMachineSweep && volumeIntent?.id) {
+                const referencing = live.machines.find((machine) => machine.config?.mounts?.some((mount) => mount.volume === volumeIntent?.id));
+                if (referencing || volume?.attached_machine_id) {
+                    throw new Error(`Fly volume "${volumeIntent.id}" gained a Machine reference during sweep; KEEP`);
+                }
+            }
+            if (automatic &&
+                volumeIntent &&
+                (volumeIntent.createdByAttemptId !== intent.attemptId || volumeIntent.resolved !== true)) {
+                throw new Error(`Fly volume "${volumeIntent.id ?? volumeIntent.name}" for attempt "${intent.attemptId}" lost accepted-POST provenance before deletion; KEEP`);
+            }
+            if (!volumeIntent?.id || (!retire && volumeIntent.workspace) || volume?.attached_machine_id) {
+                continue;
+            }
+            // A list omission is not deletion. The durable exact ID is sufficient
+            // capability for an idempotent DELETE; success/404, never the list,
+            // authorizes forgetting it. Fly still rejects a really attached volume.
+            const volumeId = volumeIntent.id;
+            await this.deleteRetired(intent, generation, `/apps/${intent.appName}/volumes/${volumeId}`, signal);
+            releasedVolumeIds.add(volumeId);
+        }
+        intent = await fresh();
+        live = await this.readAttemptAppState(intent.appName, signal);
+        if (intent.addresses.length &&
+            (live.machines.some((candidate) => candidate.id !== machine?.id) ||
+                (await hasActiveSibling(intent)))) {
+            return false;
+        }
+        for (const recorded of intent.addresses) {
+            intent = await fresh();
+            let address = intent.addresses.find((candidate) => candidate.targetApp === recorded.targetApp && candidate.network === recorded.network);
+            if (!address || (address.resolved && !address.owned))
+                continue;
+            if (options.recordedResourcesOnly && (!address.owned || !address.ip)) {
+                throw new Error(`Fly address for attempt "${intent.attemptId}" on "${address.targetApp}" has no exact owned IP; refusing discovery during explicit retirement`);
+            }
+            if (!address.resolved) {
+                // Only an unresolved create needs discovery. A known owned IP is its
+                // own DELETE capability, even when the target app no longer exists.
+                const assignments = await this.listPrivateAssignments(address.targetApp, signal);
+                if (!assignments) {
+                    throw new Error(`Could not resolve Fly addresses on "${address.targetApp}"`);
+                }
+                const assignment = assignments.find((candidate) => candidate.network === address?.network);
+                if (!assignment?.ip) {
+                    throw new Error(`Fly address allocation for attempt "${intent.attemptId}" is unresolved`);
+                }
+                await journal.recordAddress(intent.attemptId, {
+                    ...address,
+                    ip: assignment.ip,
+                    owned: true,
+                    resolved: true,
+                });
+                intent = await fresh();
+                address = intent.addresses.find((candidate) => candidate.targetApp === recorded.targetApp && candidate.network === recorded.network);
+            }
+            if (!address?.owned)
+                continue;
+            if (!address.ip)
+                throw new Error(`Owned Fly address for "${intent.attemptId}" has no IP`);
+            // The durable exact IP, not list presence, is the release capability.
+            // A retry after a lost successful DELETE gets 404 and completes below.
+            intent = await fresh();
+            address = intent.addresses.find((candidate) => candidate.targetApp === recorded.targetApp && candidate.network === recorded.network);
+            if (!address?.owned)
+                continue;
+            if (!address.ip)
+                throw new Error(`Owned Fly address for "${intent.attemptId}" has no IP`);
+            await this.deleteRetired(intent, generation, `/apps/${address.targetApp}/ip_assignments/${encodeURIComponent(address.ip)}`, signal);
+            await journal.recordAddress(intent.attemptId, {
+                ...address,
+                owned: false,
+                resolved: true,
+            });
+        }
+        intent = await fresh();
+        live = await this.readAttemptAppState(intent.appName, signal);
+        const ownedVolumesRemain = intent.volumes.some((volume) => {
+            if (volume.resolved === true && !volume.id)
+                return false;
+            if (live.appGone)
+                return false;
+            if (volume.id)
+                return !releasedVolumeIds.has(volume.id);
+            return live.volumes.some((candidate) => candidate.name === volume.name);
+        });
+        // Exact app 404 proves absence of every contained resource, including an
+        // unresolved volume. External addresses still settle independently below.
+        const unsettledVolume = !live.appGone && intent.volumes.some((volume) => volume.resolved !== true);
+        if (failedMachineSweep && this.appPerProject() && live.machines.length) {
+            throw new Error(`Fly app "${intent.appName}" gained a Machine during sweep; KEEP`);
+        }
+        if (failedMachineSweep && deleteApp && this.appPerProject() && live.volumes.length) {
+            throw new Error(`Fly app "${intent.appName}" is not empty; failed-create sweep is KEEP`);
+        }
+        const listedMachine = ownMachine(live.machines, intent);
+        if (unsettledVolume ||
+            ownedVolumesRemain ||
+            (listedMachine && !releasedMachineIds.has(listedMachine.id))) {
+            return false;
+        }
+        if (intent.addresses.some((address) => !address.resolved || address.owned))
+            return false;
+        if (mayDeleteApp && !live.appGone && (await hasActiveSibling(intent))) {
+            return false;
+        }
+        let appSettled = live.appGone;
+        if (mayDeleteApp && !live.appGone) {
+            // Deliberate retirement alone may delete a container. Addresses above are
+            // settled first; provenance and every Machine are re-read under the lock.
+            intent = await fresh();
+            live = await this.readAttemptAppState(intent.appName, signal);
+            if (failedMachineSweep && (live.machines.length || live.volumes.length)) {
+                throw new Error(`Fly app "${intent.appName}" is not empty before app deletion; KEEP`);
+            }
+            if (automatic &&
+                (intent.appCreatedByAttemptId !== intent.attemptId || intent.appCreateResolved !== true)) {
+                throw new Error(`Fly app "${intent.appName}" for attempt "${intent.attemptId}" has no matching accepted-POST provenance; KEEP`);
+            }
+            if (live.machines.length || ((automatic || !retire) && live.volumes.length))
+                return false;
+            await this.deleteRetired(intent, generation, `/apps/${intent.appName}`, signal);
+            appSettled = true;
+        }
+        if (automatic && appRequired && !appSettled && !this.hasUnresolvedMachineIdentity(intent)) {
+            return false;
+        }
+        if (!forget)
+            return false;
+        intent = await fresh();
+        await this.assertAuthoritativeForget(intent, signal, { machineIds: releasedMachineIds, volumeIds: releasedVolumeIds }, { required: appRequired, settled: appSettled });
+        await journal.forget(intent.attemptId, generation);
+        return true;
+    }
+    /** Lock and settle each eligible attempt independently; there is no lock-free mode. */
+    async reconcileCreateAttempts(options = {}) {
+        const journal = this.config.createAttemptJournal;
+        if (!journal)
+            return { deleted: 0, failed: 0 };
+        const now = options.now ?? Date.now();
+        const timeoutMs = options.createTimeoutMs ?? 15 * 60_000;
+        const cutoff = new Date(now - timeoutMs);
+        const intents = (await journal.reclaimable(cutoff)).filter((intent) => !options.attemptId || intent.attemptId === options.attemptId);
+        const expiredCreatingIds = new Set(intents.filter((intent) => intent.state === 'creating').map((intent) => intent.attemptId));
+        const summary = { deleted: 0, failed: 0 };
+        for (const intent of intents) {
+            try {
+                if (!journal.withLock)
+                    throw new Error('Attempt settlement requires its lifecycle lock');
+                const forgotten = await journal.withLock(intent, async (signal, generation) => {
+                    // Selection happened before the lock wait. Re-read state and expiry;
+                    // only failed/expired attempts may be retired by this automatic pass.
+                    const current = await journal.get(intent.attemptId);
+                    if (!current)
+                        return false;
+                    if (current.state === 'serving')
+                        return false;
+                    if (current.state === 'creating') {
+                        const expired = (await journal.reclaimable(cutoff)).some((candidate) => candidate.attemptId === intent.attemptId);
+                        if (!expired)
+                            return false;
+                    }
+                    if (signal.aborted)
+                        throw signal.reason;
+                    const failedMachineSweep = current.machineCreateFailed === true;
+                    if (failedMachineSweep)
+                        await this.assertFailedMachineSweepable(current, signal);
+                    if (current.state === 'failed' || current.state === 'creating') {
+                        await journal.retire(current.attemptId, generation);
+                    }
+                    if (signal.aborted)
+                        throw signal.reason;
+                    const settled = await this.settleCreateAttempt(current, signal, generation, {
+                        automatic: true,
+                        retire: failedMachineSweep,
+                        failedMachineSweep,
+                        expiredCreatingIds,
+                    });
+                    if (failedMachineSweep && !settled) {
+                        throw new Error(`Fly failed-create sweep for "${current.attemptId}" remains incomplete`);
+                    }
+                    return settled;
+                });
+                if (forgotten)
+                    summary.deleted++;
+            }
+            catch (error) {
+                // A state transition back to creating/serving is a safe skip, not a cleanup failure.
+                if (!/no longer settleable/.test(error instanceof Error ? error.message : '')) {
+                    summary.failed++;
+                    logger.warn('Could not reconcile a Fly create attempt; retaining its durable intent', {
+                        attemptId: intent.attemptId,
+                        app: intent.appName,
+                        error,
+                    });
+                }
+            }
+        }
+        return summary;
+    }
+    /** Re-read and abandon only while the attempt's current lifecycle lock is live. */
+    async retireCreateAttempt(snapshot, outerSignal, options) {
+        const journal = this.config.createAttemptJournal;
+        if (!journal?.withLock)
+            throw new Error('Attempt settlement requires its lifecycle lock');
+        return journal.withLock(snapshot, async (lockSignal, generation) => {
+            const signal = AbortSignal.any([outerSignal, lockSignal]);
+            if (signal.aborted)
+                throw signal.reason;
+            const current = await journal.get(snapshot.attemptId);
+            if (signal.aborted)
+                throw signal.reason;
+            if (!current)
+                return false;
+            if ((options.expectedAppName && current.appName !== options.expectedAppName) ||
+                (options.expectedMachineId && this.recordedMachineId(current) !== options.expectedMachineId)) {
+                throw new Error(`Fly create attempt "${snapshot.attemptId}" changed outside the caller-validated scope`);
+            }
+            if (current.state !== 'abandoned') {
+                if (signal.aborted)
+                    throw signal.reason;
+                await journal.retire(current.attemptId, generation);
+                if (signal.aborted)
+                    throw signal.reason;
+            }
+            return this.settleCreateAttempt(current, signal, generation, {
+                retire: true,
+                ...options,
+            });
+        });
+    }
+    /** Journal a pre-journal Machine before its first destructive request. */
+    async journalLegacyMachine(app, machine, fallbackProjectId) {
+        const journal = this.config.createAttemptJournal;
+        if (!journal)
+            throw new Error('Legacy Machine adoption requires its durable journal');
+        const metadata = machine.config?.metadata ?? {};
+        let projectId = metadata[`${this.metadataPrefix}.projectId`] ?? fallbackProjectId;
+        if (!projectId && this.appPerProject()) {
+            const prefix = `${this.appPrefix()}-`;
+            const candidate = app.startsWith(prefix) ? app.slice(prefix.length) : '';
+            if (candidate && appNameForProject(this.appPrefix(), candidate) === app) {
+                projectId = candidate;
+            }
+        }
+        if (!projectId) {
+            throw new Error(`Refusing to destroy legacy Machine "${machine.id}" without its project identity`);
+        }
+        const sandboxId = `${app}:${machine.id}`;
+        const attemptId = `legacy:${sandboxId}`;
+        const existing = await journal.get(attemptId);
+        if (existing) {
+            await journal.markMachineAdopted(attemptId);
+            if (existing.sandboxId) {
+                const adopted = await journal.get(attemptId);
+                if (!adopted)
+                    throw new Error(`Could not persist legacy ownership for "${sandboxId}"`);
+                return adopted;
+            }
+            await journal.markState(attemptId, existing.state === 'creating' ? 'serving' : existing.state, sandboxId);
+            const repaired = await journal.get(attemptId);
+            if (!repaired?.sandboxId) {
+                throw new Error(`Could not repair legacy ownership for "${sandboxId}"`);
+            }
+            return repaired;
+        }
+        await journal.begin({
+            attemptId,
+            projectId,
+            ownerProjectId: metadata['molecule.production'] ?? projectId,
+            appName: app,
+            state: 'serving',
+            sandboxId,
+            machineAdopted: true,
+        });
+        const adopted = await journal.get(attemptId);
+        if (!adopted)
+            throw new Error(`Could not persist legacy ownership for "${sandboxId}"`);
+        return adopted;
+    }
+    /** Journal an exclusively owned empty app rather than treating absence as DELETE authority. */
+    async journalLegacyApp(app, projectId) {
+        const journal = this.config.createAttemptJournal;
+        if (!journal)
+            throw new Error('Legacy app adoption requires its durable journal');
+        const attemptId = `legacy:${app}:app`;
+        const existing = await journal.get(attemptId);
+        if (existing)
+            return existing;
+        await journal.begin({ attemptId, projectId, appName: app });
+        await journal.markState(attemptId, 'serving');
+        const adopted = await journal.get(attemptId);
+        if (!adopted)
+            throw new Error(`Could not persist legacy ownership for app "${app}"`);
+        return adopted;
+    }
+    /**
+     * Explicitly destroy an exclusively owned app and its workspace storage.
+     * Recorded external addresses are released before any intent may be forgotten.
+     */
+    async destroyApp(projectId, expectedAppName, signal) {
+        if (!signal)
+            throw new Error('Fly app destruction requires its lifecycle lock signal');
+        if (!this.appPerProject()) {
+            throw new Error('Refusing to delete a shared Fly app as though a caller exclusively owned it');
+        }
+        const app = appNameForProject(this.appPrefix(), projectId);
+        if (expectedAppName !== undefined && expectedAppName !== app) {
+            throw new Error(`Refusing to delete Fly app "${expectedAppName}": its durable identity resolves to "${app}"`);
+        }
+        const listed = await this.requestForDestruction(`/apps/${app}/machines`, { nullOn: [404] }, signal);
+        const machines = Array.isArray(listed) ? listed : [];
+        const routes = {};
+        const attemptIds = new Set();
+        const metadataHints = [];
+        for (const machine of machines) {
+            Object.assign(routes, decodePrivateRoutes(machine.config?.metadata?.[`${this.metadataPrefix}.${PRIVATE_ROUTES_METADATA_SUFFIX}`]));
+            const attemptId = machine.config?.metadata?.[`${this.metadataPrefix}.createAttempt`];
+            if (attemptId) {
+                attemptIds.add(attemptId);
+                metadataHints.push({ attemptId, machineId: machine.id });
+            }
+        }
+        const journal = this.config.createAttemptJournal;
+        if (journal) {
+            const durable = new Map();
+            const expectedMachineIds = new Map();
+            const journaled = await journal.forApp(app);
+            if (signal.aborted)
+                throw signal.reason;
+            for (const intent of journaled)
+                durable.set(intent.attemptId, intent);
+            for (const hint of metadataHints) {
+                const intent = await journal.get(hint.attemptId);
+                if (signal.aborted)
+                    throw signal.reason;
+                // Metadata is only a hint. Both the requested app and this listed
+                // Machine's exact durable identity must match before selection.
+                if (intent?.appName === app && this.recordedMachineId(intent) === hint.machineId) {
+                    durable.set(intent.attemptId, intent);
+                    expectedMachineIds.set(intent.attemptId, hint.machineId);
+                }
+                else if (intent) {
+                    throw new Error(`Refusing copied createAttempt metadata for Machine "${hint.machineId}" in app "${app}"`);
+                }
+            }
+            for (const machine of machines) {
+                const createAttemptId = machine.config?.metadata?.[`${this.metadataPrefix}.createAttempt`];
+                const known = [...durable.values()].some((intent) => intent.appName === app &&
+                    ((intent.attemptId === createAttemptId &&
+                        this.recordedMachineId(intent) === machine.id) ||
+                        intent.sandboxId === `${app}:${machine.id}`));
+                if (known)
+                    continue;
+                const adopted = await this.journalLegacyMachine(app, machine, projectId);
+                durable.set(adopted.attemptId, adopted);
+            }
+            if (!durable.size) {
+                const adopted = await this.journalLegacyApp(app, projectId);
+                durable.set(adopted.attemptId, adopted);
+            }
+            if (durable.size && !journal.withLock) {
+                throw new Error(`Refusing to retire Fly app "${app}" without its lifecycle lock`);
+            }
+            if (durable.size && journal.withLock) {
+                // Pass one settles every durable address and retires Machines without
+                // deleting the app. No app deletion can bypass another attempt's failed
+                // address release. Pass two deletes the app and forgets settled intents.
+                for (const deleteApp of [false, true]) {
+                    for (const snapshot of durable.values()) {
+                        const current = await journal.get(snapshot.attemptId);
+                        if (signal.aborted)
+                            throw signal.reason;
+                        if (!current)
+                            continue;
+                        await this.retireCreateAttempt(current, signal, {
+                            deleteApp,
+                            forget: deleteApp,
+                            observedMachines: machines,
+                            expectedAppName: app,
+                            expectedMachineId: expectedMachineIds.get(current.attemptId),
+                        });
+                    }
+                }
+                const retained = (await Promise.all([...durable.keys()].map(async (attemptId) => journal.get(attemptId)))).some(Boolean);
+                if (signal.aborted)
+                    throw signal.reason;
+                if (retained)
+                    throw new Error(`Fly app "${app}" retirement has not fully settled`);
+                return;
+            }
+        }
+        // Legacy unjournaled apps retain explicit destruction. Never force an app
+        // through a Machine that has no committed retired row: explicitly delete
+        // each observed Machine, release its routes, then re-list before app DELETE.
+        for (const machine of machines) {
+            await this.requestForDestruction(`/apps/${app}/machines/${machine.id}?force=true`, { method: 'DELETE', nullOn: [404] }, signal);
+        }
+        for (const [targetApp, ip] of Object.entries(routes)) {
+            if (!(await this.privateRouteMatchesNetwork(targetApp, ip, this.networkFor(app), signal))) {
+                logger.warn('Kept a Fly private (Flycast) address with unvalidated network ownership', {
+                    targetApp,
+                    ip,
+                    app,
+                });
+                continue;
+            }
+            await this.requestForDestruction(`/apps/${targetApp}/ip_assignments/${encodeURIComponent(ip)}`, { method: 'DELETE', nullOn: [404] }, signal);
+        }
+        const remaining = await this.readAttemptAppState(app, signal);
+        if (remaining.machines.length) {
+            throw new Error(`Refusing to delete Fly app "${app}" while a Machine remains`);
+        }
+        if (!remaining.appGone) {
+            await this.requestForDestruction(`/apps/${app}`, { method: 'DELETE', nullOn: [404] }, signal);
+        }
+        for (const attemptId of attemptIds) {
+            if (signal.aborted)
+                throw signal.reason;
+            await journal?.forget(attemptId);
+        }
+    }
+    /**
+     * Deliberately retire one named shared-app attempt using only exact durable
+     * resource IDs. Unlike legacy destroy(), this never infers ownership from a
+     * Machine name, metadata, sandboxId, a volume name, or an address listing.
+     */
+    async destroyAttempt(attemptId, signal) {
+        if (!signal)
+            throw new Error('Fly attempt destruction requires its lifecycle lock signal');
+        if (this.appPerProject()) {
+            throw new Error('Use explicit per-project app destruction for a per-project Fly attempt');
+        }
+        const journal = this.config.createAttemptJournal;
+        if (!journal)
+            throw new Error('Fly attempt destruction requires its durable journal');
+        const snapshot = await journal.get(attemptId);
+        if (signal.aborted)
+            throw signal.reason;
+        if (!snapshot)
+            return;
+        const forgotten = await this.retireCreateAttempt(snapshot, signal, {
+            deleteApp: false,
+            forget: true,
+            recordedResourcesOnly: true,
+        });
+        if (!forgotten) {
+            throw new Error(`Could not complete exact-resource cleanup for attempt "${attemptId}"; its intent was retained`);
+        }
+    }
     /**
      * Destroys a sandbox.
      *
@@ -1504,15 +2597,19 @@ class FlyioSandboxProvider {
      * other than a 404 (which counts as already gone), naming the failed step and
      * HTTP status, so the caller can retry instead of forgetting a billed app.
      */
-    async destroy(id) {
+    async destroy(id, signal) {
+        if (!signal)
+            throw new Error('Fly destruction requires its lifecycle lock signal');
         const { app, machineId } = parseSandboxId(id);
         let volumeIds = [];
         let privateRoutes = {};
+        let createAttemptId;
+        let observedMachine = null;
         try {
-            const machine = await this.client.request(`/apps/${app}/machines/${machineId}`, {
-                nullOn: [404],
-            });
+            const machine = await this.requestForDestruction(`/apps/${app}/machines/${machineId}`, { nullOn: [404] }, signal);
+            observedMachine = machine;
             privateRoutes = decodePrivateRoutes(machine?.config?.metadata?.[`${this.metadataPrefix}.${PRIVATE_ROUTES_METADATA_SUFFIX}`]);
+            createAttemptId = machine?.config?.metadata?.[`${this.metadataPrefix}.createAttempt`];
             if (!this.appPerProject()) {
                 volumeIds = (machine?.config?.mounts ?? [])
                     .map((mount) => mount.volume)
@@ -1520,19 +2617,60 @@ class FlyioSandboxProvider {
             }
         }
         catch (error) {
+            if (signal.aborted)
+                throw signal.reason;
             // Best-effort metadata gathering; the Machine may already be gone.
             // Destruction proceeds either way — but say so, because an unread
             // metadata block means the private addresses below are NOT released.
             logger.warn('Could not read the Fly Machine before destroy — its volumes and any private (Flycast) ' +
                 'addresses it recorded will not be cleaned up', { id, error });
         }
+        const journal = this.config.createAttemptJournal;
+        if (journal) {
+            const durable = await journal.forApp(app);
+            if (signal.aborted)
+                throw signal.reason;
+            // Metadata is only a lookup hint. It selects an attempt when its durable
+            // exact Machine identity also names the caller's ID; copied metadata must
+            // never redirect retirement to a different Machine's attempt.
+            let intent = durable.find((candidate) => candidate.attemptId === createAttemptId &&
+                this.recordedMachineId(candidate) === machineId) ?? durable.find((candidate) => candidate.sandboxId === id);
+            if (!intent && observedMachine) {
+                intent = await this.journalLegacyMachine(app, observedMachine);
+            }
+            if (intent) {
+                const current = await journal.get(intent.attemptId);
+                if (signal.aborted)
+                    throw signal.reason;
+                if (!current)
+                    throw new Error(`Fly create attempt "${intent.attemptId}" disappeared`);
+                const durableMachineId = this.recordedMachineId(current);
+                if (durableMachineId !== machineId) {
+                    throw new Error(`Refusing to retire attempt "${current.attemptId}": caller named Machine "${machineId}" but durable identity is "${durableMachineId ?? 'unresolved'}"`);
+                }
+                const forgotten = await this.retireCreateAttempt(current, signal, {
+                    deleteApp: this.appPerProject(),
+                    forget: true,
+                    observedMachines: observedMachine ? [observedMachine] : [],
+                    expectedAppName: app,
+                    expectedMachineId: machineId,
+                });
+                if (!forgotten) {
+                    throw new Error(`Could not complete every cleanup step for "${id}"; its intent was retained`);
+                }
+                return;
+            }
+            if (durable.length) {
+                throw new Error(`Refusing to destroy "${id}" without its durable ownership record; ${durable.length} other attempt(s) remain`);
+            }
+            throw new Error(`Refusing to destroy "${id}" before its legacy ownership can be journaled`);
+        }
         try {
-            await this.client.request(`/apps/${app}/machines/${machineId}?force=true`, {
-                method: 'DELETE',
-                nullOn: [404],
-            });
+            await this.requestForDestruction(`/apps/${app}/machines/${machineId}?force=true`, { method: 'DELETE', nullOn: [404] }, signal);
         }
         catch (error) {
+            if (signal.aborted)
+                throw signal.reason;
             // The app delete is not attempted: removing the app under a Machine that
             // is still alive would hide it. The private addresses are left for the
             // retry, which re-reads them from the Machine's metadata.
@@ -1542,7 +2680,13 @@ class FlyioSandboxProvider {
         if (this.appPerProject()) {
             let appError;
             try {
-                await this.client.request(`/apps/${app}`, { method: 'DELETE', nullOn: [404] });
+                const remaining = await this.readAttemptAppState(app, signal);
+                if (remaining.machines.length) {
+                    throw new Error(`Refusing to delete Fly app "${app}" while a Machine remains`);
+                }
+                if (!remaining.appGone) {
+                    await this.requestForDestruction(`/apps/${app}`, { method: 'DELETE', nullOn: [404] }, signal);
+                }
             }
             catch (error) {
                 appError = error;
@@ -1553,24 +2697,41 @@ class FlyioSandboxProvider {
             }
             // Released even when the app delete failed: the Machine is gone, so a
             // retry could no longer read these addresses from its metadata.
-            await this.releasePrivateRoutes(privateRoutes);
+            const routesReleased = await this.releasePrivateRoutes(privateRoutes, signal, this.networkFor(app));
             if (appError !== undefined) {
                 throw new Error(describeDestroyFailure('app delete', id, appError), { cause: appError });
             }
+            if (!routesReleased && createAttemptId && this.config.createAttemptJournal) {
+                throw new Error(`Could not release every external Flycast address for "${id}"`);
+            }
+            if (signal.aborted)
+                throw signal.reason;
+            if (createAttemptId)
+                await this.config.createAttemptJournal?.forget(createAttemptId);
             return;
         }
+        let cleanupFailed = false;
         for (const volumeId of volumeIds) {
             try {
-                await this.client.request(`/apps/${app}/volumes/${volumeId}`, {
-                    method: 'DELETE',
-                    nullOn: [404],
-                });
+                await this.requestForDestruction(`/apps/${app}/volumes/${volumeId}`, { method: 'DELETE', nullOn: [404] }, signal);
             }
             catch (error) {
+                if (signal.aborted)
+                    throw signal.reason;
+                cleanupFailed = true;
                 logger.warn('Failed to remove Fly volume', { app, volumeId, error });
             }
         }
-        await this.releasePrivateRoutes(privateRoutes);
+        cleanupFailed =
+            !(await this.releasePrivateRoutes(privateRoutes, signal, this.networkFor(app))) ||
+                cleanupFailed;
+        if (cleanupFailed && createAttemptId && this.config.createAttemptJournal) {
+            throw new Error(`Could not complete every cleanup step for "${id}"; its intent was retained`);
+        }
+        if (signal.aborted)
+            throw signal.reason;
+        if (createAttemptId)
+            await this.config.createAttemptJournal?.forget(createAttemptId);
     }
     // ---------------------------------------------------------------------------
     // Templates
@@ -1649,19 +2810,15 @@ class FlyioSandboxProvider {
         return templates.removeTemplate(this.templateContext(), templateId);
     }
     /**
-     * Restores a template into a freshly-created Machine.
-     *
-     * A failure here DESTROYS the Machine. The alternative is to hand back a
-     * sandbox that started cleanly and whose filesystem is not the one that was
-     * asked for — the same silent-wrong-contents failure that makes a missing
-     * template a hard error rather than a fallback to the base image.
+     * Restores a template into a freshly-created Machine. A failure is journaled
+     * by create and settled by the reconciler, never by an inline delete.
      * @param app - The Fly app name.
      * @param machineId - The Fly Machine id.
      * @param templateId - The caller's template identifier.
      * @param manifest - The CONTROL-PLANE manifest, whose `capturePaths` bound what is extracted.
-     * @throws {Error} When the restore fails; the Machine is destroyed first.
+     * @throws {Error} When the restore fails.
      */
-    async restoreTemplate(app, machineId, templateId, manifest) {
+    async restoreTemplate(app, machineId, templateId, manifest, owner) {
         const ctx = this.templateContext();
         const store = templates.requireStore(ctx);
         const leaseId = `${machineId}-${Date.now().toString(36)}`.replace(/[^A-Za-z0-9_.-]/g, '_');
@@ -1669,10 +2826,10 @@ class FlyioSandboxProvider {
         try {
             // The restore runs through exec, so the Machine has to be up. `create`
             // launches it but returns as soon as Fly accepts the request.
-            await this.waitForStarted(app, machineId);
+            await this.waitForStarted(app, machineId, owner);
             lease = await templates.acquireRestoreLease(ctx, templateId, leaseId);
             const url = await store.presignGet(templates.archiveKey(store, templateId), ctx.presignExpirySeconds);
-            const result = await ctx.exec(app, machineId, templates.buildRestoreCommand(manifest.capturePaths, url), ctx.transferTimeoutMs);
+            const result = await execCommand(this.rawExec(app, machineId, owner), templates.buildRestoreCommand(manifest.capturePaths, url), { cwd: '/', timeout: ctx.transferTimeoutMs }, '/');
             if (result.exitCode !== 0) {
                 throw new Error(t('codeSandbox.flyio.error.templateRestoreFailed', { templateId, exitCode: String(result.exitCode) }, {
                     defaultValue: `Restoring template "${templateId}" into Fly Machine ${machineId} failed ` +
@@ -1680,19 +2837,6 @@ class FlyioSandboxProvider {
                 }));
             }
         }
-        catch (error) {
-            try {
-                await this.client.request(`/apps/${app}/machines/${machineId}?force=true`, {
-                    method: 'DELETE',
-                    nullOn: [404],
-                });
-            }
-            catch (cleanupError) {
-                logger.warn('Failed to destroy the Fly Machine whose template restore failed — it will keep ' +
-                    'billing until it is reaped', { app, machineId, error: cleanupError });
-            }
-            throw error;
-        }
         finally {
             if (lease)
                 await templates.releaseRestoreLease(ctx, lease);
@@ -1758,15 +2902,32 @@ class FlyioSandboxProvider {
             : DEFAULT_PROBE_TIMEOUT_MS;
         let app = null;
         let machineId = null;
+        let ownsProbeApp = false;
         let policyPorts;
         try {
             policyPorts = this.egressAllowedPorts();
-            app = this.resolveApp(this.probeProjectId());
-            // The SAME policy a real sandbox gets (private-service ports included, so
-            // the probe observes the real posture), but NO Flycast allocation: this
-            // app is deleted seconds from now, and allocating would leave one
-            // unreleasable address per probe on every target app — every 15 minutes.
-            await this.ensureApp(app, { privateRoutes: false });
+            // A random name collision is an adoption, never DELETE authority. Retry
+            // fresh names in per-project mode; shared mode keeps its designated app.
+            for (let attempt = 0; attempt < 5; attempt++) {
+                app = this.resolveApp(this.probeProjectId());
+                const ownership = { created: false };
+                // The SAME policy a real sandbox gets (private-service ports included),
+                // but NO Flycast allocation. Accepted app-create ownership is captured
+                // before any later policy/Machine step can fail.
+                await this.ensureApp(app, {
+                    privateRoutes: false,
+                    requireCreated: this.appPerProject(),
+                    ownership,
+                });
+                ownsProbeApp = ownership.created;
+                if (!this.appPerProject() || ownsProbeApp)
+                    break;
+            }
+            if (this.appPerProject() && !ownsProbeApp) {
+                throw new Error('Could not allocate a fresh Fly egress probe app name');
+            }
+            if (!app)
+                throw new Error('Could not resolve a Fly egress probe app');
             machineId = await this.createProbeMachine(app);
             await this.waitForStarted(app, machineId);
             const seconds = Math.min(MAX_WAIT_SECONDS, Math.max(1, Math.ceil(timeoutMs / 1000) + PROBE_EXEC_HEADROOM_SECONDS));
@@ -1794,7 +2955,7 @@ class FlyioSandboxProvider {
             };
         }
         finally {
-            await this.destroyProbe(app, machineId);
+            await this.destroyProbe(app, machineId, ownsProbeApp);
         }
     }
     /**
@@ -1855,15 +3016,17 @@ class FlyioSandboxProvider {
         return machine.id;
     }
     /**
-     * Removes the probe Machine and, in per-project mode, its throwaway app.
+     * Removes the accepted probe Machine and, in per-project mode, only an app
+     * whose create POST this probe itself had accepted. Adopted/unknown apps KEEP.
      *
      * Best-effort by design: a cleanup failure must not turn a completed
      * observation into an error, and `auto_destroy` plus the bounded init sleep
      * already reap the Machine on their own.
      * @param app - The probe app, or `null` when it was never resolved.
-     * @param machineId - The probe Machine id, or `null` when it was never created.
+     * @param machineId - The accepted probe Machine id, or `null` when none was created.
+     * @param appCreated - Accepted app-create provenance for this exact probe.
      */
-    async destroyProbe(app, machineId) {
+    async destroyProbe(app, machineId, appCreated) {
         if (!app)
             return;
         if (machineId) {
@@ -1877,8 +3040,8 @@ class FlyioSandboxProvider {
                 logger.warn('Failed to remove the Fly egress probe Machine', { app, machineId, error });
             }
         }
-        // Never in shared-app mode: that app holds real sandboxes.
-        if (!this.appPerProject())
+        // Never in shared-app mode, nor for a colliding/adopted/unknown app.
+        if (!this.appPerProject() || !appCreated)
             return;
         try {
             await this.client.request(`/apps/${app}`, { method: 'DELETE', nullOn: [404] });
@@ -1940,12 +3103,13 @@ class FlyioSandboxProvider {
      * @param machineId - The Fly Machine id.
      * @returns A transport callback for {@link execCommand}.
      */
-    rawExec(app, machineId) {
+    rawExec(app, machineId, owner) {
         return async (command, timeoutSeconds) => {
             const deadline = Date.now() + EXEC_PRECONDITION_BUDGET_MS;
             for (let attempt = 1;; attempt++) {
                 try {
-                    const response = await this.client.request(`/apps/${app}/machines/${machineId}/exec`, {
+                    const path = `/apps/${app}/machines/${machineId}/exec`;
+                    const request = {
                         method: 'POST',
                         body: { command, timeout: timeoutSeconds },
                         // The API's own timeout bounds the command; allow the HTTP request a
@@ -1955,7 +3119,10 @@ class FlyioSandboxProvider {
                         // exec burst importFiles issues) is Fly API inconsistency under load,
                         // not a real absence — retry it alongside the default 429/5xx.
                         retryStatuses: [404],
-                    });
+                    };
+                    const response = owner
+                        ? await this.requestForAttempt(owner, path, request)
+                        : await this.client.request(path, request);
                     return response ?? {};
                 }
                 catch (error) {
@@ -2101,7 +3268,7 @@ class FlyioSandboxProvider {
      * @param machineId - The Fly Machine id.
      * @throws {Error} When the Machine has not started within the budget.
      */
-    async waitForStarted(app, machineId) {
+    async waitForStarted(app, machineId, owner) {
         const totalSeconds = Math.max(1, this.config.startTimeoutSeconds ?? DEFAULT_START_TIMEOUT_SECONDS);
         const deadline = Date.now() + totalSeconds * 1000;
         let lastState;
@@ -2111,24 +3278,45 @@ class FlyioSandboxProvider {
         // enough: a host that does not have the image cached (every first boot
         // after an image push) pulls it first, which alone can exceed 60 s.
         for (;;) {
+            if (owner) {
+                await this.config.createAttemptJournal?.assertGeneration(owner.attemptId, owner.generation);
+                if (owner.signal.aborted)
+                    throw owner.signal.reason;
+            }
             const remaining = Math.ceil((deadline - Date.now()) / 1000);
             const seconds = Math.max(1, Math.min(remaining, MAX_WAIT_SECONDS));
             try {
                 await this.client.request(`/apps/${app}/machines/${machineId}/wait?state=started&timeout=${seconds}`, 
                 // One attempt: a retry would re-block for the whole round, and the
                 // state re-read below decides whether another round is warranted.
-                { attempts: 1, timeoutMs: (seconds + 15) * 1000 });
+                { attempts: 1, timeoutMs: (seconds + 15) * 1000, signal: owner?.signal });
+                if (owner) {
+                    await this.config.createAttemptJournal?.assertGeneration(owner.attemptId, owner.generation);
+                    if (owner.signal.aborted)
+                        throw owner.signal.reason;
+                }
                 return;
             }
             catch (error) {
+                if (owner?.signal.aborted)
+                    throw owner.signal.reason;
                 lastError = error;
                 // The wait endpoint returning an error is not itself proof the Machine
                 // failed — re-read the authoritative state before deciding.
                 const machine = await this.client
-                    .request(`/apps/${app}/machines/${machineId}`, { nullOn: [404] })
+                    .request(`/apps/${app}/machines/${machineId}`, {
+                    nullOn: [404],
+                    signal: owner?.signal,
+                })
                     .catch(() => null);
-                if (machine?.state === 'started')
+                if (machine?.state === 'started') {
+                    if (owner) {
+                        await this.config.createAttemptJournal?.assertGeneration(owner.attemptId, owner.generation);
+                        if (owner.signal.aborted)
+                            throw owner.signal.reason;
+                    }
                     return;
+                }
                 lastState = machine?.state;
                 // Another round is useful only while the Machine is still on its way
                 // up (`created` = provisioning/image pull, `starting` = boot). Any