@moondeck/station 0.0.1 → 1.0.0

package/scripts/agent/task-up.sh

@@ -0,0 +1,3761 @@
+#!/usr/bin/env bash
+# task-up <taskId> — bring up the task stack end-to-end (ADR-022).
+#
+# The "standard image" model: every host runs one prebuilt image,
+# `moondeck-standard:dev`. A task selects 0..N projects (0 = empty workspace /
+# scratchpad). Each selected project contributes a git worktree under the
+# task's workspace, plus a union of preview ports and env keys.
+#
+# Steps:
+#   1. Read task (-> branch) + the task's selected projects.
+#   2. Acquire lock; mark status=starting.
+#   3. Per project: ensure a bare mirror, fetch, add a worktree on the task
+#      branch, seed .tool-versions when missing.
+#   4. Generate .uai/docker-compose.yml in bash (and a derived .uai/Dockerfile
+#      when any project declares `extra`).
+#   5. Build the derived image when needed, then materialize every runtime and
+#      package-manager default needed by the selected projects through the
+#      exact image the task will run.
+#   6. docker compose -p task-<id> up -d (without rebuilding).
+#   7. docker cp AI auth into the container, then docker exec uai-init.
+#   8. Discover code-server + preview ports; mark status=running; unlock.
+#
+# The AIs are NOT started here — the chat orchestrator drives them and
+# delivers the task's initial prompt once the task is running.
+
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=_common.sh
+. "$SCRIPT_DIR/_common.sh"
+
+[ "$#" -eq 1 ] || emit_err "BAD_ARGS" "usage: task-up <taskId>" "args"
+
+task_id="$1"
+UAI_TASK_ID="$task_id"
+setup_err_trap
+
+# Pinned constants (all clusters must agree — see ADR-022).
+STANDARD_IMAGE="moondeck-standard:dev"
+ASDF_VOLUME="moondeck-asdf-data"
+# Keep in sync with lib/standard-image.ts. Apple tasks execute the env
+# forwarder from the shared volume's read-only lower mount, never from the
+# node-writable overlay at /opt/asdf-data.
+STANDARD_DEFAULT_NODE_VERSION="22.11.0"
+TASK_NPM_PREFIX="/home/node/.local/share/uai-npm"
+TASK_NPM_CACHE="/home/node/.cache/uai-npm"
+# Host-proved shims and system controls always win. A task-global package with
+# a new command name remains discoverable at the final path component, while a
+# package named node/claude/git/sh cannot intercept managed or agent startup.
+TASK_RUNTIME_PATH="/opt/asdf-data/shims:/opt/asdf/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$TASK_NPM_PREFIX/bin"
+# ADR-053: host-wide Playwright browser cache (Chromium downloads once).
+PW_VOLUME="uai-playwright"
+# ADR-106: on the Apple runtime the cache is a host DIRECTORY instead. Apple
+# block volumes allow exactly ONE writable attachment, and session start
+# writes browsers from inside every task — a shared writable volume let the
+# first task exclude every later `container run` (live 2026-08-17). Virtiofs
+# directory shares carry no exclusivity, like /workspace itself.
+PW_BROWSERS_DIR="$UAI_WORKSPACE_ROOT/pw-browsers"
+DERIVED_IMAGE="moondeck-task-${task_id}"
+# ADR-118 (apple only): the pnpm store rides a task-private block volume. On
+# virtiofs every store file pins a host fd for the VM's lifetime — one
+# monorepo install held ~130k host descriptors and two tasks exhausted the
+# system file table (live 2026-08-25). A block volume costs one fd total.
+# One volume per task, never shared: block volumes allow exactly ONE
+# writable attachment, and the store was per-task on the old path anyway.
+TASK_STORE_VOLUME=$(apple_store_volume_for_task "$task_id")
+TASK_STORE_MOUNT="/opt/uai/store"
+TASK_STORE_DIR="$TASK_STORE_MOUNT/pnpm"
+
+# ADR-106: runtime selection is shared with task-down/task-status via
+# _common.sh; `docker` keeps the historical Compose path byte-for-byte, while
+# `apple-container` drives the bundled Apple CLI directly (no Compose, no
+# published ports — tasks are reached at their vmnet IP).
+validate_task_runtime_selection
+# Per-container VM sizing (Apple runtime only; Docker tasks share the daemon
+# VM). Overridable for constrained hosts; ADR-106 picked these defaults for a
+# dev task with language servers + builds.
+APPLE_TASK_MEMORY="${UAI_APPLE_TASK_MEMORY:-8192M}"
+APPLE_TASK_CPUS="${UAI_APPLE_TASK_CPUS:-4}"
+
+# ADR-153 makes the task's project-env delivery mode explicit. A loader task's
+# stdin is exactly one base64-encoded task-generation forwarder secret; it is
+# never put in argv, the environment, or a file. A legacy baked task retains
+# the old JSON-object stdin contract until its container is recreated.
+UAI_PROJECT_ENV_MODE=${UAI_PROJECT_ENV_MODE:-baked}
+case "$UAI_PROJECT_ENV_MODE" in
+  baked | loader) ;;
+  *)
+    emit_err "BAD_ARGS" \
+      "task project env mode must be baked or loader" \
+      "read task environment mode"
+    ;;
+esac
+
+task_stdin_payload=$(cat)
+task_gateway_secret_b64=""
+if [ "$UAI_PROJECT_ENV_MODE" = "loader" ]; then
+  task_gateway_secret_b64=$task_stdin_payload
+  project_env_json='{}'
+  # A 32-byte value has one canonical standard-base64 shape. Validate that
+  # shape here without decoding it into a shell variable (which cannot carry
+  # NUL); the only decode happens later, directly into the forwarder's stdin.
+  if [[ ! "$task_gateway_secret_b64" =~ ^[A-Za-z0-9+/]{43}=$ ]]; then
+    emit_err "BAD_ARGS" \
+      "loader task gateway secret must decode to exactly 32 bytes" \
+      "read task gateway secret"
+  fi
+else
+  project_env_json=$task_stdin_payload
+  [ -n "$project_env_json" ] || project_env_json='{}'
+  if ! printf '%s' "$project_env_json" | jq -e 'type == "object"' >/dev/null 2>&1; then
+    emit_err "BAD_ARGS" "task environment payload must be a JSON object" "read task environment"
+  fi
+  project_env_json=$(printf '%s' "$project_env_json" | jq -c '.')
+fi
+unset task_stdin_payload
+
+# -----------------------------------------------------------------------------
+# Paths (mirror host-agent/lib/env.ts).
+# -----------------------------------------------------------------------------
+
+task_dir="$UAI_WORKSPACE_ROOT/tasks/$task_id"
+task_workspace="$task_dir/workspace"
+# The HOST control tree. Deliberately not bind-mounted: the container sees only
+# $task_workspace. Anything an agent must reach belongs under $task_workspace/.moondeck.
+task_uai_dir="$task_dir/.uai"
+projects_root="$UAI_WORKSPACE_ROOT/projects"
+compose_project=$(compose_project_for_task "$task_id")
+app_container=$(app_container_for_task "$task_id")
+[ "$TASK_RUNTIME_MODE" != "apple-container" ] \
+  || app_container=$(apple_app_container_for_task "$task_id")
+
+reject_unsafe_host_directory() {
+  local path="$1" label="$2"
+  if [ -L "$path" ] || { [ -e "$path" ] && [ ! -d "$path" ]; }; then
+    emit_err "WORKTREE_FAILED" \
+      "Moondeck refused $label because it is not a trusted directory: $path" \
+      "validate task workspace paths"
+  fi
+}
+
+reject_unsafe_runtime_manifest() {
+  local path="$1" project_slug="$2" project_id="$3"
+  if [ -L "$path" ]; then
+    emit_err "WORKTREE_FAILED" \
+      "Moondeck refused a symbolic-link .tool-versions for $project_slug" \
+      "validate task worktree ($project_id)"
+  fi
+  # Never open an untrusted special file: `-f` is a metadata-only check, so a
+  # FIFO/socket/device cannot block the host while it validates a resumed
+  # container-writable workspace.
+  if [ -e "$path" ] && [ ! -f "$path" ]; then
+    emit_err "WORKTREE_FAILED" \
+      "Moondeck refused a non-regular .tool-versions for $project_slug" \
+      "validate task worktree ($project_id)"
+  fi
+}
+
+reject_workspace_runtime_shadow() {
+  local path="$task_workspace/.tool-versions"
+  # The workspace root is not a project. Any entry here would shadow the
+  # image defaults for a no-manifest project (and even a scratchpad command),
+  # while the trusted materializer proves only the selected project paths.
+  # Metadata-only predicates keep FIFO/device/socket cases nonblocking.
+  if [ -L "$path" ] || [ -e "$path" ]; then
+    emit_err "WORKTREE_FAILED" \
+      "Moondeck refused a workspace-root .tool-versions because it could override the runtimes proved for this task" \
+      "validate task workspace runtime authority"
+  fi
+}
+
+# The first check of a task-up used to be the refusal above. A fresh task
+# never trips it (the workspace is empty), but a RESUMED one can: the
+# workspace persists across an idle park, agents' shells start in /workspace,
+# and `asdf local nodejs 22` from there writes exactly this file — after
+# which the task could never wake again without someone deleting the file on
+# the host (client runner, 2026-09-14). The entry is the task's own
+# container-writable content, so move it aside instead: a rename is
+# metadata-only (never opens a FIFO/device/socket), the runtime proof is
+# unchanged because nothing is left at the root, and the content survives
+# under .moondeck/refused/ where the agent can re-pin it in a project. The
+# post-materialization recheck below keeps refusing — by then the root must
+# be empty by construction, so an entry there is a bug, not a user file.
+quarantine_workspace_runtime_shadow() {
+  local path="$task_workspace/.tool-versions" aside_dir aside attempt note
+  if [ -L "$path" ] || [ -e "$path" ]; then
+    aside_dir="$task_workspace/.moondeck/refused"
+    reject_unsafe_host_directory "$task_workspace/.moondeck" "the task control directory"
+    reject_unsafe_host_directory "$aside_dir" "the refused-files directory"
+    mkdir -p "$aside_dir"
+    # Never onto an entry the task left there: mv moves into a directory, or
+    # one a link leads to, outside the workspace (#cb3j0z). The task's
+    # container is gone, so nothing races these checks.
+    aside="$aside_dir/tool-versions.$(date +%s)"
+    attempt=0
+    while [ -L "$aside" ] || [ -e "$aside" ]; do
+      attempt=$((attempt + 1))
+      aside="$aside_dir/tool-versions.$(date +%s).$attempt"
+    done
+    if ! mv -f "$path" "$aside" 2>/dev/null || [ -L "$path" ] || [ -e "$path" ]; then
+      reject_workspace_runtime_shadow
+    fi
+    # Nor written through a link or special file in the note's place: that
+    # is removed first (rm never follows a link), and the note is written
+    # only to nothing or a regular file.
+    note="$aside_dir/README.txt"
+    if [ -L "$note" ] || { [ -e "$note" ] && [ ! -f "$note" ]; }; then
+      rm -f "$note" 2>/dev/null || true
+    fi
+    if [ ! -L "$note" ] && { [ ! -e "$note" ] || [ -f "$note" ]; }; then
+      cat > "$note" <<'NOTE'
+Moondeck moved a /workspace/.tool-versions aside before starting this task.
+
+A .tool-versions at the workspace root is outside the runtime proof and would
+override the runtimes proved for every project in the task, so the host refuses
+to start a container while one exists. The file is kept here, untouched, under
+its original content. Pin runtimes in a project's own .tool-versions instead
+(/workspace/<project>/.tool-versions), which the materializer proves.
+NOTE
+    fi
+    log "moved a workspace-root .tool-versions aside to ${aside#"$task_workspace"/} (it would override the runtimes proved for this task; pin per project instead)"
+  fi
+}
+
+mapped_host_port() {
+  local container="$1" container_port="$2"
+  docker port "$container" "$container_port" 2>/dev/null \
+    | awk -F: 'NR==1 {print $NF}' \
+    | tr -d '[:space:]' \
+    || true
+}
+
+# A failed Docker call cannot be followed by an unbounded health probe: the
+# same stuck socket would defeat the operation's own watchdog. This portable
+# Bash 3.2 wrapper gives `docker info` 15 seconds, writes completion before its
+# exact wrapper PID disappears, and reaps every helper on success or timeout.
+docker_daemon_reachable_bounded() {
+  local probe_dir wrapper_pid watchdog_pid probe_rc=0 watchdog_sleep_pid
+
+  probe_dir=$(mktemp -d "$task_uai_dir/.docker-info-watchdog.XXXXXX")
+  (
+    runtime_probe_pid=""
+    finish_runtime_probe() {
+      local wrapper_rc=$?
+      trap - EXIT
+      : > "$probe_dir/completed"
+      exit "$wrapper_rc"
+    }
+    terminate_runtime_probe() {
+      local signal_rc="$1"
+      trap - TERM INT
+      if [ -n "$runtime_probe_pid" ]; then
+        kill -TERM "$runtime_probe_pid" >/dev/null 2>&1 || true
+        sleep 2
+        kill -KILL "$runtime_probe_pid" >/dev/null 2>&1 || true
+        wait "$runtime_probe_pid" 2>/dev/null || true
+      fi
+      exit "$signal_rc"
+    }
+    trap finish_runtime_probe EXIT
+    trap 'terminate_runtime_probe 143' TERM
+    trap 'terminate_runtime_probe 130' INT
+    if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+      "$CONTAINER_CLI" system status >/dev/null 2>&1 &
+    else
+      docker info --format '{{.ServerVersion}}' >/dev/null 2>&1 &
+    fi
+    runtime_probe_pid=$!
+    if wait "$runtime_probe_pid"; then exit 0; else exit $?; fi
+  ) &
+  wrapper_pid=$!
+
+  (
+    watchdog_sleep_pid=""
+    cancel_probe_watchdog() {
+      trap - TERM INT
+      if [ -n "$watchdog_sleep_pid" ]; then
+        kill -TERM "$watchdog_sleep_pid" >/dev/null 2>&1 || true
+        wait "$watchdog_sleep_pid" 2>/dev/null || true
+      fi
+      exit 0
+    }
+    trap cancel_probe_watchdog TERM INT
+    sleep 15 &
+    watchdog_sleep_pid=$!
+    if ! wait "$watchdog_sleep_pid"; then exit 0; fi
+    watchdog_sleep_pid=""
+    if [ ! -f "$probe_dir/completed" ] \
+       && kill -0 "$wrapper_pid" >/dev/null 2>&1; then
+      : > "$probe_dir/timed-out"
+      kill -TERM "$wrapper_pid" >/dev/null 2>&1 || true
+      sleep 5 &
+      watchdog_sleep_pid=$!
+      wait "$watchdog_sleep_pid" 2>/dev/null || true
+      watchdog_sleep_pid=""
+      if [ ! -f "$probe_dir/completed" ]; then
+        kill -KILL "$wrapper_pid" >/dev/null 2>&1 || true
+      fi
+    fi
+  ) &
+  watchdog_pid=$!
+
+  if wait "$wrapper_pid"; then probe_rc=0; else probe_rc=$?; fi
+  kill -TERM "$watchdog_pid" >/dev/null 2>&1 || true
+  wait "$watchdog_pid" 2>/dev/null || true
+  [ ! -f "$probe_dir/timed-out" ] || probe_rc=124
+  rm -f "$probe_dir/completed" "$probe_dir/timed-out"
+  rmdir "$probe_dir" 2>/dev/null || true
+  return "$probe_rc"
+}
+
+# A Docker-dependent step can fail for its own, degradable reason (for example,
+# uai-init exits nonzero while the container remains healthy) or because the
+# daemon disappeared after TypeScript admitted task-up. Only the latter is
+# retryable host infrastructure state. Re-probe before translating a failed
+# Docker step into an operation-specific error or warning so task-up never
+# publishes status=running against an unknown backend.
+require_docker_after_failed_step() {
+  local step_label="$1" runtime_name="Docker"
+  [ "$TASK_RUNTIME_MODE" != "apple-container" ] \
+    || runtime_name="the Apple container runtime"
+  if ! docker_daemon_reachable_bounded; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "The container runtime stopped responding during task startup. Retry after $runtime_name is running again." \
+      "$step_label"
+  fi
+}
+
+# Stop an app that failed a post-create authority proof and verify it is no
+# longer running before any credential, dependency, editor, or agent work can
+# begin. Preserve the container/worktree for diagnosis; a retry recreates the
+# container from Uai's current Compose contract.
+quarantine_untrusted_app_container() {
+  local authority_running=""
+  if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+    # `container stop` is idempotent; proven absence quarantines as well as a
+    # stopped state does. An inspect that fails WITHOUT naming this container
+    # as not-found proves nothing and must not read as stopped.
+    if ! crt stop --time 30 "$app_container" >/dev/null 2>&1; then
+      require_docker_after_failed_step "quarantine untrusted task container"
+    fi
+    apple_quarantine_proven=""
+    quarantine_state=$(crt inspect "$app_container" 2>/dev/null \
+      | jq -r '.[0].status.state // empty' 2>/dev/null) || quarantine_state=""
+    if [ -n "$quarantine_state" ] && [ "$quarantine_state" != "running" ]; then
+      apple_quarantine_proven=1
+    elif [ -z "$quarantine_state" ] \
+      && apple_container_proven_absent "$app_container"; then
+      apple_quarantine_proven=1
+    fi
+    if [ -z "$apple_quarantine_proven" ]; then
+      crt stop --signal KILL "$app_container" >/dev/null 2>&1 || true
+      quarantine_state=$(crt inspect "$app_container" 2>/dev/null \
+        | jq -r '.[0].status.state // empty' 2>/dev/null) || quarantine_state=""
+      if [ -n "$quarantine_state" ] && [ "$quarantine_state" != "running" ]; then
+        apple_quarantine_proven=1
+      elif [ -z "$quarantine_state" ] \
+        && apple_container_proven_absent "$app_container"; then
+        apple_quarantine_proven=1
+      fi
+    fi
+    [ -n "$apple_quarantine_proven" ]
+    return
+  fi
+  if ! docker stop --time 30 "$app_container" >/dev/null 2>&1; then
+    require_docker_after_failed_step "quarantine untrusted task container"
+  fi
+  authority_running=$(docker ps -q --filter "name=^/${app_container}$") \
+    || require_docker_after_failed_step "verify task-container quarantine"
+  if [ -n "$authority_running" ]; then
+    docker kill "$app_container" >/dev/null 2>&1 || true
+    authority_running=$(docker ps -q --filter "name=^/${app_container}$") \
+      || require_docker_after_failed_step "verify task-container quarantine"
+  fi
+  [ -z "$authority_running" ]
+}
+
+# Run the maintenance container under two independent deadlines. The inner GNU
+# timeout bounds the actual writer (including the shared-volume lock wait); the
+# host watchdog is slightly looser and covers a Docker CLI that hangs before it
+# creates or starts the container. Bash 3.2 has no `wait -n` or `timeout`, so
+# keep and reap both exact child PIDs explicitly.
+run_runtime_materializer() {
+  local runtime_image="$1" wrapper_pid watchdog_pid materialization_rc=0
+  local watchdog_dir watchdog_sleep_pid
+
+  watchdog_dir=$(mktemp -d "$task_uai_dir/.runtime-materializer-watchdog.XXXXXX")
+
+  # The completion marker is written from the wrapper's EXIT trap before its
+  # PID can disappear. The watchdog consults it before every signal, closing
+  # the wait/reap/PID-reuse race around a just-finished Docker client.
+  (
+    runtime_docker_pid=""
+    finish_runtime_wrapper() {
+      local wrapper_rc=$?
+      trap - EXIT
+      : > "$watchdog_dir/completed"
+      exit "$wrapper_rc"
+    }
+    terminate_runtime_wrapper() {
+      local signal_rc="$1"
+      trap - TERM INT
+      if [ -n "$runtime_docker_pid" ]; then
+        # Do not reap before the grace period: the exact child PID therefore
+        # cannot be reused between TERM and KILL.
+        kill -TERM "$runtime_docker_pid" >/dev/null 2>&1 || true
+        sleep 10
+        kill -KILL "$runtime_docker_pid" >/dev/null 2>&1 || true
+        wait "$runtime_docker_pid" 2>/dev/null || true
+      fi
+      exit "$signal_rc"
+    }
+    trap finish_runtime_wrapper EXIT
+    trap 'terminate_runtime_wrapper 143' TERM
+    trap 'terminate_runtime_wrapper 130' INT
+
+    # ADR-108: on the Apple runtime this function is never called —
+    # materialization runs inside the app container against its in-guest
+    # overlay. This maintenance-container path is Docker-only.
+    docker run --rm --user node --group-add "$task_container_gid" \
+        --workdir /workspace \
+        -v "$task_workspace:/workspace:ro" \
+        -v "$ASDF_VOLUME:/opt/asdf-data:rw" \
+        -v "$RUNTIME_MATERIALIZER_SOURCE:/usr/local/bin/uai-materialize-runtimes:ro" \
+        -v "$COREPACK_VERSION_SOURCE:/usr/local/share/uai/corepack-version:ro" \
+        -v "$runtime_projects_file:/run/uai/runtime-projects:ro" \
+        --env LD_PRELOAD= \
+        --env LD_AUDIT= \
+        --env LD_LIBRARY_PATH= \
+        --env BASH_ENV= \
+        --env ENV= \
+        --entrypoint /usr/bin/env \
+        "$runtime_image" \
+        -i \
+        HOME=/home/node \
+        ASDF_DIR=/opt/asdf \
+        ASDF_DATA_DIR=/opt/asdf-data \
+        PATH=/opt/asdf-data/shims:/opt/asdf/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
+        /usr/bin/timeout --signal=TERM --kill-after=10s 600s \
+        /usr/local/bin/uai-materialize-runtimes >&2 &
+    runtime_docker_pid=$!
+    if wait "$runtime_docker_pid"; then
+      exit 0
+    else
+      exit $?
+    fi
+  ) &
+  wrapper_pid=$!
+
+  (
+    watchdog_sleep_pid=""
+    cancel_runtime_watchdog() {
+      trap - TERM INT
+      if [ -n "$watchdog_sleep_pid" ]; then
+        kill -TERM "$watchdog_sleep_pid" >/dev/null 2>&1 || true
+        wait "$watchdog_sleep_pid" 2>/dev/null || true
+      fi
+      exit 0
+    }
+    trap cancel_runtime_watchdog TERM INT
+
+    sleep 620 &
+    watchdog_sleep_pid=$!
+    if ! wait "$watchdog_sleep_pid"; then
+      exit 0
+    fi
+    watchdog_sleep_pid=""
+
+    if [ ! -f "$watchdog_dir/completed" ] \
+       && kill -0 "$wrapper_pid" >/dev/null 2>&1; then
+      : > "$watchdog_dir/timed-out"
+      kill -TERM "$wrapper_pid" >/dev/null 2>&1 || true
+      # The wrapper gives its exact Docker child 10 seconds before KILL. This
+      # slightly looser guard is only a backstop for a wedged signal handler.
+      sleep 15 &
+      watchdog_sleep_pid=$!
+      wait "$watchdog_sleep_pid" 2>/dev/null || true
+      watchdog_sleep_pid=""
+      if [ ! -f "$watchdog_dir/completed" ]; then
+        kill -KILL "$wrapper_pid" >/dev/null 2>&1 || true
+      fi
+    fi
+  ) &
+  watchdog_pid=$!
+
+  cancel_runtime_materializer() {
+    local signal_rc="$1"
+    trap - TERM INT
+    if [ ! -f "$watchdog_dir/completed" ]; then
+      kill -TERM "$wrapper_pid" >/dev/null 2>&1 || true
+    fi
+    kill -TERM "$watchdog_pid" >/dev/null 2>&1 || true
+    wait "$watchdog_pid" 2>/dev/null || true
+    wait "$wrapper_pid" 2>/dev/null || true
+    rm -f "$watchdog_dir/completed" "$watchdog_dir/timed-out"
+    rmdir "$watchdog_dir" 2>/dev/null || true
+    exit "$signal_rc"
+  }
+  trap 'cancel_runtime_materializer 143' TERM
+  trap 'cancel_runtime_materializer 130' INT
+
+  if wait "$wrapper_pid"; then
+    materialization_rc=0
+  else
+    materialization_rc=$?
+  fi
+  kill -TERM "$watchdog_pid" >/dev/null 2>&1 || true
+  wait "$watchdog_pid" 2>/dev/null || true
+
+  trap - TERM INT
+  if [ -f "$watchdog_dir/timed-out" ]; then
+    materialization_rc=124
+  fi
+  rm -f "$watchdog_dir/completed" "$watchdog_dir/timed-out"
+  rmdir "$watchdog_dir" 2>/dev/null || true
+  return "$materialization_rc"
+}
+
+# -----------------------------------------------------------------------------
+# 1. Read rows.
+# -----------------------------------------------------------------------------
+
+step "TASK_NOT_FOUND" "read task row"
+task_json=$(db_get_task "$task_id")
+[ "$(jq 'length' <<<"$task_json")" -ge 1 ] \
+  || emit_err "TASK_NOT_FOUND" "no such task: $task_id" "read task row"
+
+task_branch=$(jq -r '.[0].branch' <<<"$task_json")
+UAI_RETRY_STATUS=$(jq -r '.[0].status // ""' <<<"$task_json")
+
+# The standard container runs as node:node (1000:1000), while Docker Desktop
+# hosts commonly run as 501:20 and Linux hosts may use another uid/gid. Share
+# only this task's writable trees through the host's effective group. A root
+# host is the exception: never add the unprivileged container user to gid 0;
+# root can chgrp the task trees directly to node's gid instead.
+task_container_gid=$(id -g)
+if [ "$(id -u)" = "0" ]; then
+  task_container_gid=1000
+elif [ "$task_container_gid" = "0" ]; then
+  task_container_gid=""
+  for candidate_gid in $(id -G); do
+    if [ "$candidate_gid" != "0" ]; then
+      task_container_gid="$candidate_gid"
+      break
+    fi
+  done
+fi
+case "$task_container_gid" in
+  ''|*[!0-9]*)
+    emit_err "WORKTREE_FAILED" \
+      "Moondeck could not resolve a safe host group for the task container" \
+      "resolve task container filesystem group"
+    ;;
+esac
+
+step "PROJECT_NOT_FOUND" "read task projects"
+projects_json=$(db_get_projects_for_task "$task_id")
+project_count=$(jq 'length' <<<"$projects_json")
+if ! jq -e '
+  map(.slug) as $slugs
+  | all($slugs[];
+      type == "string"
+      and test("^[a-z0-9-]{1,64}$"))
+    and (($slugs | unique | length) == ($slugs | length))
+' <<<"$projects_json" >/dev/null; then
+  emit_err "WORKTREE_FAILED" \
+    "Moondeck refused an unsafe or duplicate project workspace slug" \
+    "validate task projects"
+fi
+runtime_project_slugs=$(jq -r '.[].slug' <<<"$projects_json")
+
+# -----------------------------------------------------------------------------
+# 2. Lock + status=starting.
+# -----------------------------------------------------------------------------
+
+step "LOCKED" "acquire task lock"
+lock_task "$task_id"
+
+step "DB_UPDATE_FAILED" "mark task starting"
+db_update_task "$task_id" \
+  "status='starting'" \
+  "started_at=(unixepoch()*1000)" \
+  "code_server_port=NULL" \
+  "preview_ports='[]'" \
+  "worktree_path='$(sql_escape "$task_dir")'" \
+  "compose_project='$(sql_escape "$compose_project")'"
+
+# `.uai` is not container-mounted, but validate these host-owned parents before
+# using the previous compose file. The workspace itself is checked after the
+# old container is removed so it cannot race the check.
+reject_unsafe_host_directory "$task_dir" "the task storage root"
+reject_unsafe_host_directory "$task_uai_dir" "the task runtime directory"
+
+# A previous task container can write both its workspace and its task-private
+# Git repository. Remove it before the host parses either repository on resume.
+# This also cuts off legacy containers that still have the old shared
+# `repo.git` bind mount before we inspect their worktree layout below.
+step "COMPOSE_DOWN_FAILED" "remove prior task containers"
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  # Selection fencing guarantees an apple-mode host has no Docker task rows,
+  # so the only possible prior container is this task's fixed name. `inspect`
+  # exiting nonzero afterwards is the absence proof.
+  crt stop --time 10 "$app_container" >/dev/null 2>&1 || true
+  crt delete --force "$app_container" >/dev/null 2>&1 || true
+  if crt inspect "$app_container" >/dev/null 2>&1; then
+    emit_err "COMPOSE_DOWN_FAILED" \
+      "the previous task container is still present; Moondeck will not let the host access its writable Git repository until that container is removed" \
+      "remove prior task containers"
+  fi
+  if ! apple_container_proven_absent "$app_container"; then
+    emit_err "COMPOSE_DOWN_FAILED" \
+      "could not verify removal of the previous task container" \
+      "remove prior task containers"
+  fi
+else
+  uai_require_compose_plugin
+  if [ -f "$task_uai_dir/docker-compose.yml" ]; then
+    docker compose -p "$compose_project" -f "$task_uai_dir/docker-compose.yml" \
+      down --remove-orphans >/dev/null 2>&1 || true
+  else
+    docker compose -p "$compose_project" down --remove-orphans \
+      >/dev/null 2>&1 || true
+  fi
+  prior_containers=""
+  if ! prior_containers=$(docker ps -aq \
+    --filter "label=com.docker.compose.project=$compose_project"); then
+    emit_err "COMPOSE_DOWN_FAILED" \
+      "could not verify removal of the previous task container" \
+      "remove prior task containers"
+  fi
+  if [ -n "$prior_containers" ]; then
+    emit_err "COMPOSE_DOWN_FAILED" \
+      "the previous task container is still running or stopped; Moondeck will not let the host access its writable Git repository until that container is removed" \
+      "remove prior task containers"
+  fi
+fi
+reject_unsafe_host_directory "$task_workspace" "the task workspace"
+mkdir -p "$task_workspace"
+quarantine_workspace_runtime_shadow
+
+# Git resolves symlinked ancestors when it writes a linked worktree's absolute
+# `.git` pointer. Keep the configured (lexical) task paths as Uai's stable host
+# paths, but also remember their physical aliases for validation and bind-mount
+# destinations. The task root itself was rejected above if it was a symlink;
+# `pwd -P` therefore resolves only trusted ancestors such as a migrated
+# UAI_WORKSPACE_ROOT (`~/.uai-host-app/workspace -> ~/.uai`).
+step "WORKTREE_FAILED" "resolve task workspace paths"
+if ! task_dir_physical=$(cd "$task_dir" && pwd -P) \
+  || [ -z "$task_dir_physical" ]; then
+  emit_err "WORKTREE_FAILED" \
+    "Moondeck could not resolve the task workspace's physical host path" \
+    "resolve task workspace paths"
+fi
+task_workspace_physical="$task_dir_physical/workspace"
+task_uai_dir_physical="$task_dir_physical/.uai"
+
+# -----------------------------------------------------------------------------
+# 3. Bare mirrors + worktrees, one per selected project.
+# -----------------------------------------------------------------------------
+
+# ADR-154 §12: a task on cloud credentials tells the runner where it is
+# with an event file in this private directory (event-clone-done, then
+# event-runtime-ready), and finds the runner's answer to runtime-ready there
+# too. Never on stderr, which a subprocess shares; the path is unset here so
+# no process task-up starts inherits it; nothing blocks.
+uai_handshake_dir="${UAI_TASK_HANDSHAKE_DIR:-}"
+unset UAI_TASK_HANDSHAKE_DIR
+# A task on cloud credentials: every host Git operation runs with nothing of
+# the runner's own (no home, so no .netrc, ~/.gitconfig or ~/.ssh/config),
+# by exactly the route its lease names, and never falls back to another.
+uai_leased_git=0
+if [ -n "$uai_handshake_dir" ]; then
+  uai_leased_git=1
+fi
+# ADR-154 §6: no default slot. A task on cloud credentials gets none of the
+# runner owner's own engine sign-ins: not their tokens in its env (the
+# runner strips them from ours), not their config directories in its home.
+uai_on_cloud_credentials=$uai_leased_git
+
+# Prepare the optional SSH identity. Connected users fetch over HTTPS with
+# their per-host GitHub credential; SSH is used for Git transport only when the
+# task owner has not connected GitHub. `IdentitiesOnly=yes` +
+# `IdentityAgent=none` keep that fallback from silently selecting a different
+# personal key or blocking on an agent approval prompt.
+#
+# ADR-029: use only the TASK CREATOR's per-user key (written to
+# $UAI_TASK_IDENTITY_DIR by the orchestrator) so clone + push run as them. A
+# task must never borrow the operator's shared identity: that would authorize
+# one user as a different principal.
+#
+# ADR-154 §12: a task on cloud credentials gets no key file. The runner
+# holds the owner's key in its own memory behind a private agent socket for
+# exactly as long as this clone ($UAI_TASK_SSH_AUTH_SOCK, with the public
+# key naming the identity); ssh asks that agent and nothing else.
+if [ -n "${UAI_TASK_IDENTITY_DIR:-}" ] && [ -f "${UAI_TASK_IDENTITY_DIR}/id_ed25519" ]; then
+  uai_identity_key="$UAI_TASK_IDENTITY_DIR/id_ed25519"
+  log "git over SSH using the task creator's per-user key"
+else
+  uai_identity_key=""
+fi
+uai_task_ssh_auth_sock="${UAI_TASK_SSH_AUTH_SOCK:-}"
+uai_task_ssh_public_key="${UAI_TASK_SSH_PUBLIC_KEY:-}"
+unset UAI_TASK_SSH_AUTH_SOCK UAI_TASK_SSH_PUBLIC_KEY
+uai_has_ssh_identity=0
+uai_leased_ssh=0
+uai_known_hosts="$UAI_DATA_DIR/identity/known_hosts"
+if [ -n "$uai_identity_key" ] && [ -f "$uai_identity_key" ]; then
+  uai_has_ssh_identity=1
+  GIT_SSH_COMMAND="ssh -i $uai_identity_key -o IdentitiesOnly=yes -o IdentityAgent=none -o BatchMode=yes -o StrictHostKeyChecking=accept-new"
+  [ -f "$uai_known_hosts" ] && GIT_SSH_COMMAND="$GIT_SSH_COMMAND -o UserKnownHostsFile=$uai_known_hosts"
+  export GIT_SSH_COMMAND
+  log "git over SSH using $uai_identity_key (1Password agent bypassed)"
+elif [ -n "$uai_task_ssh_auth_sock" ] && [ -S "$uai_task_ssh_auth_sock" ] && [ -f "$uai_task_ssh_public_key" ]; then
+  uai_has_ssh_identity=1
+  uai_leased_ssh=1
+  GIT_SSH_COMMAND="ssh -F /dev/null -i $uai_task_ssh_public_key -o IdentitiesOnly=yes -o IdentityAgent=$uai_task_ssh_auth_sock -o BatchMode=yes -o StrictHostKeyChecking=accept-new"
+  [ -f "$uai_known_hosts" ] && GIT_SSH_COMMAND="$GIT_SSH_COMMAND -o UserKnownHostsFile=$uai_known_hosts"
+  export GIT_SSH_COMMAND
+  log "git over SSH using the task owner's key, held in the station's memory"
+else
+  log "no SSH identity for the task owner — SSH transport fallback unavailable"
+fi
+
+# Only a non-secret path reaches this script. The task owner's token lives in
+# a private per-task `git credential-cache` daemon, or, for a task on cloud
+# credentials (ADR-154 §12), in the runner's own memory behind the helper
+# $UAI_GITHUB_CREDENTIAL_HELPER asks for exactly as long as this clone. It is
+# never placed in the environment, argv, remote URL, mirror config, Compose,
+# or logs. Only the daemon's token is installed in the container below; a
+# task on cloud credentials has its GitHub configuration written by the
+# runner, which records it for cleanup.
+github_credential_socket="${UAI_GITHUB_CREDENTIAL_SOCKET:-}"
+github_credential_helper="${UAI_GITHUB_CREDENTIAL_HELPER:-}"
+unset UAI_GITHUB_CREDENTIAL_SOCKET UAI_GITHUB_CREDENTIAL_HELPER
+if [ -n "$github_credential_helper" ]; then
+  github_git_helper="$github_credential_helper"
+elif [ -n "$github_credential_socket" ]; then
+  github_git_helper="cache --socket=$github_credential_socket"
+else
+  github_git_helper=""
+fi
+if [ -n "$github_git_helper" ]; then
+  uai_git_transport="https"
+else
+  # Refined after each GitHub fetch below: select SSH only when it was the
+  # mode that actually worked. A present-but-unregistered key must not turn a
+  # successfully anonymous public clone into broken SSH inside the container.
+  uai_git_transport="anonymous"
+fi
+uai_used_ssh_transport=0
+
+# ADR-154 §12: a task on cloud credentials runs every host Git operation in an
+# environment rebuilt from an allowlist (env -i), never the runner process's
+# own: an ambient GIT_CONFIG_COUNT and its numbered pairs, GIT_EXEC_PATH, an
+# askpass or an agent socket could otherwise redirect or answer its route.
+# What passes is what finds git and ssh and reaches the network (the PATH, the
+# temporary directory, proxies, the CA bundle), never a credential, a
+# configuration or a route.
+uai_git_passthrough=()
+if [ "$uai_leased_git" = "1" ]; then
+  for uai_git_name in PATH TMPDIR http_proxy https_proxy all_proxy no_proxy \
+    HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY SSL_CERT_FILE SSL_CERT_DIR; do
+    if [ -n "${!uai_git_name:-}" ]; then
+      uai_git_passthrough+=("$uai_git_name=${!uai_git_name}")
+    fi
+  done
+fi
+
+# Runs git with the NAME=VALUE assignments before `--`, then `git "$@"`: for a
+# task on cloud credentials in those, the allowlist and no home alone;
+# otherwise on top of this process's environment, which the wrappers below
+# narrow themselves.
+uai_git() {
+  local uai_assign=()
+  while [ "$#" -gt 0 ] && [ "$1" != "--" ]; do
+    uai_assign+=("$1")
+    shift
+  done
+  shift
+  if [ "$uai_leased_git" = "1" ]; then
+    env -i ${uai_git_passthrough[@]+"${uai_git_passthrough[@]}"} \
+      HOME=/nonexistent XDG_CONFIG_HOME=/nonexistent LC_ALL=C \
+      GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1 \
+      ${uai_assign[@]+"${uai_assign[@]}"} git "$@"
+  else
+    env ${uai_assign[@]+"${uai_assign[@]}"} git "$@"
+  fi
+}
+
+# ADR-154 §12: a task on cloud credentials that GitHub refused says which of
+# its owner's credentials was refused (the lease's GitHub sign-in or SSH key)
+# and where to fix that: Uai's Settings, never this host.
+emit_leased_github_denial() {
+  case "$1" in
+    token)
+      emit_err "GITHUB_TOKEN_ACCESS_DENIED" \
+        "GitHub denied the task owner's GitHub sign-in access to $2. Confirm that the Moondeck GitHub App is installed on the owning account or organization, this repository is included in its grant, and the owner can read it. Then start the task again." \
+        "$3"
+      ;;
+    ssh)
+      emit_err "GITHUB_SSH_ACCESS_DENIED" \
+        "GitHub denied the task owner's SSH key access to $2. Register that key with an account that can read the repository (and authorize it for SAML SSO when required), or connect GitHub in Settings. Then start the task again." \
+        "$3"
+      ;;
+    *)
+      emit_err "GITHUB_CONNECTION_REQUIRED" \
+        "The task owner has neither a GitHub sign-in nor an SSH key in Moondeck that can read $2. Connect GitHub in Settings, then start the task again." \
+        "$3"
+      ;;
+  esac
+}
+
+git_with_github_credential() (
+  unset GIT_ASKPASS SSH_ASKPASS SSH_AUTH_SOCK GIT_CONFIG \
+    GIT_CONFIG_PARAMETERS GIT_TRACE GIT_TRACE2 GIT_TRACE_CURL \
+    GIT_TRACE_PACKET GIT_TRACE_REDACT
+  export LC_ALL=C GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
+  # If a container ever poisoned a shared mirror's URL config, fail closed
+  # instead of silently switching this operation to an SSH principal.
+  uai_git GIT_SSH_COMMAND=/bin/false GIT_TERMINAL_PROMPT=0 -- \
+    -c core.hooksPath=/dev/null \
+    -c core.fsmonitor=false \
+    -c http.extraHeader= \
+    -c http.sslVerify=true \
+    -c credential.helper= \
+    -c "credential.helper=$github_git_helper" \
+    "$@"
+)
+
+# Command-scoped rewrite: the shared origin remains canonical HTTPS while this
+# one task uses its SSH fallback identity.
+git_with_github_ssh() (
+  unset GIT_ASKPASS SSH_ASKPASS SSH_AUTH_SOCK GIT_CONFIG \
+    GIT_CONFIG_PARAMETERS GIT_TRACE GIT_TRACE2 GIT_TRACE_CURL \
+    GIT_TRACE_PACKET GIT_TRACE_REDACT
+  export LC_ALL=C GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
+  # The SSH command chosen above: the task owner's identity, nothing else.
+  uai_git "GIT_SSH_COMMAND=${GIT_SSH_COMMAND:-/bin/false}" GIT_TERMINAL_PROMPT=0 -- \
+    -c core.hooksPath=/dev/null \
+    -c core.fsmonitor=false \
+    -c 'url.git@github.com:.insteadOf=https://github.com/' \
+    "$@"
+)
+
+# Clear every ambient credential helper so a public fallback cannot borrow the
+# host operator's GitHub identity.
+git_anonymous_https() (
+  unset GIT_ASKPASS SSH_ASKPASS SSH_AUTH_SOCK GIT_CONFIG \
+    GIT_CONFIG_PARAMETERS GIT_TRACE GIT_TRACE2 GIT_TRACE_CURL \
+    GIT_TRACE_PACKET GIT_TRACE_REDACT
+  export LC_ALL=C GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
+  uai_git GIT_SSH_COMMAND=/bin/false GIT_TERMINAL_PROMPT=0 -- \
+    -c core.hooksPath=/dev/null \
+    -c core.fsmonitor=false \
+    -c http.extraHeader= \
+    -c http.sslVerify=true \
+    -c credential.helper= \
+    "$@"
+)
+
+# Host-only Git control plane. New task containers see only their self-contained
+# private repo; the shared mirror is a setup-time fetch cache and is never
+# mounted. Before every host operation we still rebuild its config from trusted
+# project data and discard hooks, both to heal legacy tasks and to fail closed
+# after a crash.
+git_host_control() (
+  unset GIT_ASKPASS SSH_ASKPASS SSH_AUTH_SOCK GIT_CONFIG \
+    GIT_CONFIG_PARAMETERS GIT_TRACE GIT_TRACE2 GIT_TRACE_CURL \
+    GIT_TRACE_PACKET GIT_TRACE_REDACT GIT_CONFIG_COUNT \
+    GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 GIT_CONFIG_KEY_1 GIT_CONFIG_VALUE_1
+  export LC_ALL=C GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
+  # This helper is for local repository bookkeeping and public/local remotes.
+  # It must never inherit the operator's SSH agent or credential helper. Every
+  # authenticated GitHub fetch goes through one of the explicit helpers above.
+  uai_git GIT_CONFIG_COUNT=3 \
+    GIT_CONFIG_KEY_0=core.hooksPath GIT_CONFIG_VALUE_0=/dev/null \
+    GIT_CONFIG_KEY_1=core.fsmonitor GIT_CONFIG_VALUE_1=false \
+    GIT_CONFIG_KEY_2=advice.defaultBranchName GIT_CONFIG_VALUE_2=false \
+    GIT_SSH_COMMAND=/bin/false GIT_TERMINAL_PROMPT=0 -- \
+    -c credential.helper= \
+    "$@"
+)
+
+# ADR-153 §4: record, once, the base a project's task worktree starts from, in
+# the host control tree the container never sees, before anything in the task
+# runs. The runner reads that commit's .env.schema from the host cache; a
+# resume keeps the first record and never consults the worktree, which the
+# task can rewrite. "oid <commit>" or "empty" (a branchless repository).
+record_env_schema_base() {
+  local project_id="$1" base="$2" dir="$task_uai_dir/env-schemas" tmp
+  [ -e "$dir/$project_id.base" ] && return 0
+  mkdir -p "$dir" || return 1
+  chmod 700 "$dir" || return 1
+  tmp=$(mktemp "$dir/.base.XXXXXX") || return 1
+  if ! printf '%s\n' "$base" > "$tmp" || ! mv -f "$tmp" "$dir/$project_id.base"; then
+    rm -f "$tmp"
+    return 1
+  fi
+}
+
+assert_bare_repo_tree_safe() {
+  local repo="$1" code="$2" label="$3" bad_entry=""
+  if [ -L "$repo" ] || [ ! -d "$repo" ]; then
+    emit_err "$code" \
+      "Moondeck refused the $label because its repository root is missing or is a symbolic link: $repo" \
+      "validate $label"
+  fi
+  # Git should only ever create regular files and directories in these control
+  # trees. Reject links, FIFOs, sockets, and devices before any Git process can
+  # follow or block on a container-created entry.
+  if ! bad_entry=$(find "$repo" ! -type f ! -type d -print -quit 2>/dev/null); then
+    emit_err "$code" \
+      "Moondeck could not validate the $label before host Git access" \
+      "validate $label"
+  fi
+  if [ -n "$bad_entry" ]; then
+    emit_err "$code" \
+      "Moondeck refused the $label because it contains an unsafe non-file entry at $bad_entry. The task container has been removed; inspect or recreate the task before retrying." \
+      "validate $label"
+  fi
+}
+
+# Make a host-created task tree writable by the container's uid-1000 node user
+# without making it world-writable or changing ownership away from the host.
+# `find` deliberately does not follow repository symlinks. Setgid directories
+# keep Git-created descendants in the shared group; core.sharedRepository
+# below makes Git's own files group-writable as well.
+set_task_entry_container_access() {
+  local entry="$1"
+  chgrp "$task_container_gid" "$entry" || return 1
+  if [ -d "$entry" ]; then
+    chmod ug+rwx,g+s "$entry" || return 1
+  else
+    chmod ug+rw "$entry" || return 1
+  fi
+}
+
+share_task_entry_with_container() {
+  local entry="$1" label="$2"
+  if ! set_task_entry_container_access "$entry"; then
+    emit_err "WORKTREE_FAILED" \
+      "Moondeck could not share the $label with the task container" \
+      "set task filesystem permissions"
+  fi
+}
+
+share_task_tree_with_container() {
+  local root="$1" label="$2" entry entry_list failed_entry=""
+  [ -d "$root" ] || return 0
+
+  entry_list=$(mktemp "/tmp/uai-task-tree.XXXXXX")
+  if ! find "$root" \( -type d -o -type f \) -print0 > "$entry_list"; then
+    rm -f "$entry_list"
+    emit_err "WORKTREE_FAILED" \
+      "Moondeck could not enumerate the complete $label before sharing it with the task container" \
+      "enumerate task filesystem"
+  fi
+  while IFS= read -r -d '' entry; do
+    if ! set_task_entry_container_access "$entry"; then
+      failed_entry="$entry"
+      break
+    fi
+  done < "$entry_list"
+  rm -f "$entry_list"
+  if [ -n "$failed_entry" ]; then
+    emit_err "WORKTREE_FAILED" \
+      "Moondeck could not share the complete $label with the task container" \
+      "set task filesystem permissions"
+  fi
+}
+
+sanitize_mirror_control_plane() {
+  local mirror="$1" origin="$2" config_tmp
+  assert_bare_repo_tree_safe "$mirror" "FETCH_FAILED" "host repository cache"
+  # Stage outside the bare repo so a predictable in-repo temporary path cannot
+  # be redirected even if a previous host operation crashed midway.
+  config_tmp=$(mktemp "$(dirname "$mirror")/.uai-config.XXXXXX")
+  git_host_control config --file "$config_tmp" core.repositoryformatversion 0
+  git_host_control config --file "$config_tmp" core.filemode true
+  git_host_control config --file "$config_tmp" core.bare true
+  git_host_control config --file "$config_tmp" remote.origin.url "$origin"
+  git_host_control config --file "$config_tmp" remote.origin.fetch \
+    '+refs/heads/*:refs/remotes/origin/*'
+  git_host_control config --file "$config_tmp" remote.pushDefault origin
+  git_host_control config --file "$config_tmp" push.autoSetupRemote true
+  mv -f "$config_tmp" "$mirror/config"
+  rm -rf "$mirror/hooks"
+  mkdir -p "$mirror/hooks"
+}
+
+sanitize_task_repo_control_plane() {
+  local repo="$1" origin="$2" branch="$3" bare="${4:-true}" config_tmp
+  local branch_remote="origin" branch_merge="refs/heads/$branch" candidate
+  assert_bare_repo_tree_safe "$repo" "WORKTREE_FAILED" \
+    "task-private repository"
+
+  # Preserve only the current branch's safe upstream from the container-
+  # writable config. Includes are disabled, the remote must remain `origin`,
+  # and the merge target must be a valid heads ref. Everything executable or
+  # host-sensitive (hooks, includes, helpers, fsmonitor) is rebuilt below.
+  if [ -f "$repo/config" ]; then
+    candidate=$(git_host_control config --no-includes --file "$repo/config" \
+      --get "branch.$branch.remote" 2>/dev/null || true)
+    [ "$candidate" = "origin" ] && branch_remote="$candidate"
+    candidate=$(git_host_control config --no-includes --file "$repo/config" \
+      --get "branch.$branch.merge" 2>/dev/null || true)
+    case "$candidate" in
+      refs/heads/*)
+        if git_host_control check-ref-format "$candidate" >/dev/null 2>&1; then
+          branch_merge="$candidate"
+        fi
+        ;;
+    esac
+  fi
+
+  config_tmp=$(mktemp "$(dirname "$repo")/.uai-task-config.XXXXXX")
+  git_host_control config --file "$config_tmp" core.repositoryformatversion 0
+  git_host_control config --file "$config_tmp" core.filemode true
+  git_host_control config --file "$config_tmp" core.bare "$bare"
+  git_host_control config --file "$config_tmp" core.sharedRepository group
+  git_host_control config --file "$config_tmp" remote.origin.url "$origin"
+  git_host_control config --file "$config_tmp" remote.origin.fetch \
+    '+refs/heads/*:refs/remotes/origin/*'
+  git_host_control config --file "$config_tmp" remote.pushDefault origin
+  git_host_control config --file "$config_tmp" push.autoSetupRemote true
+  git_host_control config --file "$config_tmp" \
+    "branch.$branch.remote" "$branch_remote"
+  git_host_control config --file "$config_tmp" \
+    "branch.$branch.merge" "$branch_merge"
+  mv -f "$config_tmp" "$repo/config"
+  rm -rf "$repo/hooks"
+  mkdir -p "$repo/hooks"
+  # mktemp is intentionally 0600. Once its trusted contents are atomically in
+  # place, grant only the selected task group access; this must run on every
+  # resume even after the one-time tree migration marker exists.
+  share_task_entry_with_container "$repo/config" \
+    "task-private Git config"
+  share_task_entry_with_container "$repo/hooks" \
+    "task-private Git hooks directory"
+}
+
+# ADR-062 shared files: two host-resident roots mounted into the container
+# when the task's mode isn't "off". Created here so Docker doesn't create
+# them root-owned at mount time. Mode defaults to ro; org mount only when
+# the cloud sent an org id (older clouds won't).
+shared_files_mode=$(jq -r '.[0].shared_files // "ro"' <<<"$task_json")
+shared_owner_org=$(jq -r '.[0].owner_org_id // ""' <<<"$task_json")
+shared_owner_user=$(jq -r '.[0].owner_user_id // ""' <<<"$task_json")
+# Colons break docker's src:dst:mode bind syntax, and personal org ids are
+# "personal:<userId>" — map ":" to "_". MUST match sharedDirName() in
+# host-agent/lib/shared-files.ts.
+shared_owner_org=$(printf '%s' "$shared_owner_org" | tr ':' '_')
+shared_owner_user=$(printf '%s' "$shared_owner_user" | tr ':' '_')
+shared_root="$UAI_WORKSPACE_ROOT/shared"
+# The workspace's own .moondeck is the only one the container can read (/workspace/.moondeck):
+# the CLI, the chat log and the attachments agents are told to write screenshots
+# into all live here. Create it unconditionally — it used to be made only when
+# shared files were on, and `attachments` was made in the unmounted control tree,
+# so every first browser_take_screenshot hit ENOENT (first seen 2026-08-24).
+reject_unsafe_host_directory "$task_workspace/.moondeck" \
+  "the task workspace marker directory"
+mkdir -p "$task_workspace/.moondeck/attachments"
+if [ "$shared_files_mode" != "off" ]; then
+  [ -n "$shared_owner_org" ] && mkdir -p "$shared_root/orgs/$shared_owner_org"
+  [ -n "$shared_owner_user" ] && mkdir -p "$shared_root/users/$shared_owner_user"
+  # Marker for the preamble: only containers that actually carry the mounts
+  # get the "## Shared files" briefing (pre-feature containers don't).
+  # Never written through a link or special file the task left in its place
+  # (#cb3j0z): that is removed first (rm never follows a link), and nothing
+  # is written where anything remains. The task's container is gone, so
+  # nothing races this.
+  files_mounted="$task_workspace/.moondeck/files-mounted"
+  if [ -L "$files_mounted" ] || { [ -e "$files_mounted" ] && [ ! -f "$files_mounted" ]; }; then
+    rm -f "$files_mounted" 2>/dev/null || true
+  fi
+  [ -L "$files_mounted" ] || [ -e "$files_mounted" ] || : > "$files_mounted"
+fi
+
+# Iterate using jq -c so each project is a single JSON object per line.
+# Bash 3.2 friendly: a while-read loop rather than mapfile/readarray.
+while IFS= read -r project_obj; do
+  [ -n "$project_obj" ] || continue
+
+  project_id=$(jq -r '.id' <<<"$project_obj")
+  project_slug=$(jq -r '.slug' <<<"$project_obj")
+  case "$project_slug" in
+    ''|.|..|*/*|*\\*)
+      emit_err "WORKTREE_FAILED" \
+        "Moondeck refused an invalid project workspace component: $project_slug" \
+        "validate task worktree ($project_id)"
+      ;;
+  esac
+  acquire_project_lock "$projects_root" "$project_id"
+  repo_url_input=$(jq -r '.repo_url' <<<"$project_obj")
+  repo_is_github=0
+  if is_github_hosted_url "$repo_url_input"; then
+    repo_is_github=1
+  fi
+  # The mirror is fetched HERE, before the task container exists. GitHub URLs
+  # stay canonical HTTPS: a connected user's private credential socket
+  # authenticates them; users without a connection get the SSH fallback. The
+  # token never becomes part of this shared mirror or its remote URL.
+  repo_url=$(normalize_github_repo_url "$repo_url_input")
+  github_https_url=$(github_https_repo_url "$repo_url")
+  if [ "$repo_is_github" = "1" ] && [ -z "$github_https_url" ]; then
+    emit_err "CLONE_FAILED" \
+      "Moondeck refused the malformed GitHub repository URL '$repo_url_input'. Use https://github.com/OWNER/REPOSITORY.git and retry." \
+      "validate GitHub repository URL ($project_id)"
+  fi
+  tool_versions=$(jq -r '.tool_versions // ""' <<<"$project_obj")
+
+  # `repo.git` was historically bind-mounted RW into every task container.
+  # Never reuse it as trusted host input: running legacy tasks can still hold
+  # that old bind mount. The new cache path has never entered a container.
+  mirror_dir="$projects_root/$project_id/host-cache.git"
+  task_repo_dir="$task_uai_dir/repos/$project_id.git"
+  task_repo_dir_physical="$task_uai_dir_physical/repos/$project_id.git"
+  worktree_target="$task_workspace/$project_slug"
+  reject_unsafe_host_directory "$worktree_target" \
+    "the project worktree for $project_slug"
+  # Check before remote/cache Git: a dangling symlink makes `-e` false and the
+  # later seed write would otherwise follow it outside the workspace.
+  reject_unsafe_runtime_manifest "$worktree_target/.tool-versions" \
+    "$project_slug" "$project_id"
+  worktree_exists=0
+  standalone_worktree=0
+  if [ -e "$worktree_target/.git" ] || [ -L "$worktree_target/.git" ]; then
+    worktree_exists=1
+    if [ -L "$worktree_target/.git" ]; then
+      emit_err "WORKTREE_FAILED" \
+        "Moondeck refused to resume $project_slug because its .git path is a symbolic link. The previous container was removed; inspect or recreate the task before retrying." \
+        "validate task worktree ($project_id)"
+    elif [ -d "$worktree_target/.git" ]; then
+      # Empty remotes use a standalone repository inside the workspace.
+      standalone_worktree=1
+      assert_bare_repo_tree_safe "$worktree_target/.git" "WORKTREE_FAILED" \
+        "standalone task repository"
+    elif [ -f "$worktree_target/.git" ]; then
+      gitdir_lines=$(awk 'END { print NR }' "$worktree_target/.git")
+      gitdir_value=$(sed -n 's/^gitdir: //p' "$worktree_target/.git")
+      case "$gitdir_value" in
+        "$task_repo_dir"/worktrees/*)
+          gitdir_leaf=${gitdir_value#"$task_repo_dir"/worktrees/}
+          ;;
+        "$task_repo_dir_physical"/worktrees/*)
+          gitdir_leaf=${gitdir_value#"$task_repo_dir_physical"/worktrees/}
+          ;;
+        *)
+          emit_err "WORKTREE_FAILED" \
+            "This task uses Moondeck's legacy shared Git layout. Its container has been removed so it can no longer write the shared mirror. Preserve any uncommitted changes from $worktree_target, then recreate the task to migrate safely." \
+            "legacy task repository requires recreation ($project_id)"
+          ;;
+      esac
+      case "$gitdir_leaf" in
+        ''|.|..|*/*)
+          emit_err "WORKTREE_FAILED" \
+            "Moondeck refused an invalid task Git metadata path for $project_slug" \
+            "validate task worktree ($project_id)"
+          ;;
+      esac
+      if [ "$gitdir_lines" != "1" ] || [ ! -d "$gitdir_value" ] \
+         || [ -L "$gitdir_value" ]; then
+        emit_err "WORKTREE_FAILED" \
+          "Moondeck refused invalid or missing task Git metadata for $project_slug. The previous container was removed; inspect or recreate the task before retrying." \
+          "validate task worktree ($project_id)"
+      fi
+      assert_bare_repo_tree_safe "$task_repo_dir" "WORKTREE_FAILED" \
+        "task-private repository"
+    else
+      emit_err "WORKTREE_FAILED" \
+        "Moondeck refused an unsupported .git entry for $project_slug" \
+        "validate task worktree ($project_id)"
+    fi
+  fi
+
+  # Ensure the bare mirror exists with **remote-tracking refs**. Plain
+  # `git clone --bare` copies upstream heads straight into refs/heads/*
+  # and never populates refs/remotes/origin/*, so `worktree add ...
+  # origin/<defaultBranch>` would fail with "invalid reference". Init +
+  # remote + standard refspec + fetch gives a proper bare repo whose
+  # origin/* refs match the remote tip.
+  needs_initial_fetch=0
+  if [ ! -d "$mirror_dir" ]; then
+    step "CLONE_FAILED" "bare-clone ($project_id)"
+    mkdir -p "$(dirname "$mirror_dir")"
+    git_host_control init --bare "$mirror_dir" >/dev/null
+    needs_initial_fetch=1
+  fi
+
+  # Replace all container-writable/legacy config before host Git reads the
+  # mirror. This also heals SSH origins to the canonical credential-free URL.
+  sanitize_mirror_control_plane "$mirror_dir" "$repo_url"
+
+  github_fetch_mode=""
+
+  if [ "$needs_initial_fetch" = "1" ]; then
+    # First fetch on a brand-new mirror — required. Bail and clean up so
+    # the next attempt starts fresh rather than re-using a half-init.
+    fetch_err=""
+    fetch_failed=0
+    if [ -n "$github_https_url" ] && [ -n "$github_git_helper" ]; then
+      github_fetch_mode="token"
+      if ! fetch_err=$(git_with_github_credential \
+        -C "$mirror_dir" fetch origin 2>&1); then
+        fetch_failed=1
+      fi
+    elif [ -n "$github_https_url" ]; then
+      if [ "$uai_has_ssh_identity" = "1" ]; then
+        github_fetch_mode="ssh"
+        if ! fetch_err=$(git_with_github_ssh \
+          -C "$mirror_dir" fetch origin 2>&1); then
+          fetch_failed=1
+          # github.com requires an authenticated SSH handshake even for public
+          # repositories. Preserve the no-credential public-repo path, except
+          # for a key a task's lease names: its route fails closed.
+          if [ "$uai_leased_ssh" != "1" ] && git_anonymous_https -C "$mirror_dir" fetch origin \
+            >/dev/null 2>&1; then
+            github_fetch_mode="anonymous"
+            fetch_failed=0
+            fetch_err=""
+          fi
+        fi
+      else
+        github_fetch_mode="none"
+        if ! fetch_err=$(git_anonymous_https \
+          -C "$mirror_dir" fetch origin 2>&1); then
+          fetch_failed=1
+        else
+          github_fetch_mode="anonymous"
+        fi
+      fi
+    elif ! fetch_err=$(git_host_control -C "$mirror_dir" fetch origin 2>&1); then
+      fetch_failed=1
+    fi
+
+    if [ "$fetch_failed" = "1" ]; then
+      [ -n "$fetch_err" ] || fetch_err="git fetch failed without details"
+      rm -rf "$mirror_dir"
+      # GitHub deliberately uses the same 404 for a missing private repository
+      # and a credential that cannot see it. Name the credential path Uai
+      # actually chose so the recovery action is truthful.
+      case "$fetch_err" in
+        *"Repository not found"*|*"repository not found"*|\
+*"Permission denied"*|*"access rights"*|*"could not read Username"*|\
+*"Authentication failed"*|*"Invalid username or password"*|*"HTTP 401"*|\
+*"HTTP 403"*|*"HTTP 404"*|*"requested URL returned error: 401"*|\
+*"requested URL returned error: 403"*|*"requested URL returned error: 404"*)
+          if [ "$uai_leased_git" = "1" ]; then
+            emit_leased_github_denial "$github_fetch_mode" "$repo_url" "bare-clone ($project_id)"
+          fi
+          if [ "$github_fetch_mode" = "token" ]; then
+            emit_err "GITHUB_TOKEN_ACCESS_DENIED" \
+              "GitHub denied the connected user's access to $repo_url. Confirm that the Moondeck GitHub App is installed on the owning account or organization, this repository is included in its grant, and the connected user can write to it. Then retry the task." \
+              "bare-clone ($project_id)"
+          elif [ "$github_fetch_mode" = "ssh" ]; then
+            emit_err "GITHUB_SSH_ACCESS_DENIED" \
+              "GitHub is not connected on this host, so Moondeck tried its SSH fallback for $repo_url, but GitHub denied that key. Connect GitHub on this host, or register its public SSH key with an account that can read the repository (and authorize it for SAML SSO when required)." \
+              "bare-clone ($project_id)"
+          elif [ "$github_fetch_mode" = "none" ]; then
+            emit_err "GITHUB_CONNECTION_REQUIRED" \
+              "This host has neither a GitHub connection nor an SSH fallback key that can read $repo_url. Connect GitHub on this host, or configure its optional SSH key, then retry the task." \
+              "bare-clone ($project_id)"
+          else
+            case "$repo_url" in
+              git@*|ssh://*)
+                emit_err "CLONE_FAILED" \
+                  "The git server denied this host's SSH key access to $repo_url. Confirm the repository exists and add that host's public key to an account that can read it." \
+                  "bare-clone ($project_id)"
+                ;;
+              *)
+                emit_err "CLONE_FAILED" \
+                  "Access to $repo_url was denied. Configure the matching credential on this host, then retry the task." \
+                  "bare-clone ($project_id)"
+                ;;
+            esac
+          fi
+          ;;
+        *)
+          emit_err "CLONE_FAILED" \
+            "initial fetch from $repo_url failed: $fetch_err" \
+            "bare-clone ($project_id)"
+          ;;
+      esac
+    fi
+  else
+    # Existing mirror — refresh best-effort. Offline / network blips should not
+    # destroy a task that already has cached refs, but never switch principals.
+    step "FETCH_FAILED" "git fetch origin ($project_id)"
+    fetch_ok=0
+    fetch_err=""
+    if [ -n "$github_https_url" ] && [ -n "$github_git_helper" ]; then
+      github_fetch_mode="token"
+      if fetch_err=$(git_with_github_credential \
+        -C "$mirror_dir" fetch origin 2>&1); then
+        fetch_ok=1
+      fi
+    elif [ -n "$github_https_url" ]; then
+      if [ "$uai_has_ssh_identity" = "1" ]; then
+        github_fetch_mode="ssh"
+        if fetch_err=$(git_with_github_ssh \
+          -C "$mirror_dir" fetch origin 2>&1); then
+          fetch_ok=1
+        fi
+      else
+        github_fetch_mode="none"
+      fi
+      # A key a task's lease names never falls back to another principal.
+      if [ "$fetch_ok" != "1" ] && [ "$uai_leased_ssh" != "1" ]; then
+        anonymous_err=""
+        if anonymous_err=$(git_anonymous_https \
+          -C "$mirror_dir" fetch origin 2>&1); then
+          github_fetch_mode="anonymous"
+          fetch_ok=1
+          fetch_err=""
+        elif [ "$github_fetch_mode" = "none" ]; then
+          fetch_err="$anonymous_err"
+        fi
+      fi
+    elif fetch_err=$(git_host_control -C "$mirror_dir" fetch origin 2>&1); then
+      fetch_ok=1
+    fi
+    if [ "$fetch_ok" != "1" ]; then
+      case "$fetch_err" in
+        *"Repository not found"*|*"repository not found"*|\
+*"Permission denied"*|*"access rights"*|*"could not read Username"*|\
+*"Authentication failed"*|*"Invalid username or password"*|*"HTTP 401"*|\
+*"HTTP 403"*|*"HTTP 404"*|*"requested URL returned error: 401"*|\
+*"requested URL returned error: 403"*|*"requested URL returned error: 404"*)
+          if [ "$uai_leased_git" = "1" ]; then
+            emit_leased_github_denial "$github_fetch_mode" "$repo_url" "git fetch origin ($project_id)"
+          fi
+          case "$github_fetch_mode" in
+            token)
+              emit_err "GITHUB_TOKEN_ACCESS_DENIED" \
+                "GitHub denied the connected user's access to $repo_url. Confirm that the Moondeck GitHub App grant still includes this repository and the connected user can write to it, then retry the task." \
+                "git fetch origin ($project_id)"
+              ;;
+            ssh)
+              emit_err "GITHUB_SSH_ACCESS_DENIED" \
+                "GitHub is not connected on this host, and it denied the SSH fallback for $repo_url. Connect GitHub or fix this host's SSH key access, then retry the task." \
+                "git fetch origin ($project_id)"
+              ;;
+            none)
+              emit_err "GITHUB_CONNECTION_REQUIRED" \
+                "This host has neither a GitHub connection nor an SSH fallback key that can read $repo_url. Connect GitHub on this host, or configure its optional SSH key, then retry the task." \
+                "git fetch origin ($project_id)"
+              ;;
+            *)
+              emit_err "FETCH_FAILED" \
+                "The configured credential no longer has access to $repo_url. Restore access, then retry the task." \
+                "git fetch origin ($project_id)"
+              ;;
+          esac
+          ;;
+        *)
+          if [ "$worktree_exists" = "1" ]; then
+            # Resume is the only safe stale-cache case: this same task already
+            # owns the checkout. A new task/user must prove current access
+            # before any shared cached code is materialized into its workspace.
+            log "warning: git fetch failed for $project_id ($repo_url); resuming this task's existing worktree with cached refs"
+          else
+            emit_err "FETCH_FAILED" \
+              "could not verify the task creator's current access to $repo_url: ${fetch_err:-git fetch failed}. Retry when the remote is reachable." \
+              "git fetch origin ($project_id)"
+          fi
+          ;;
+      esac
+    fi
+  fi
+
+  if [ "$github_fetch_mode" = "ssh" ]; then
+    if [ "$needs_initial_fetch" = "1" ] && [ "$fetch_failed" = "0" ]; then
+      uai_used_ssh_transport=1
+    elif [ "$needs_initial_fetch" != "1" ] && [ "$fetch_ok" = "1" ]; then
+      uai_used_ssh_transport=1
+    fi
+  fi
+
+  # Resolve the remote default branch with the same task credential
+  # (best-effort) — fall back to main.
+  case "$github_fetch_mode" in
+    token)
+      git_with_github_credential -C "$mirror_dir" remote set-head origin -a \
+        >/dev/null 2>&1 || true
+      ;;
+    ssh)
+      git_with_github_ssh -C "$mirror_dir" remote set-head origin -a \
+        >/dev/null 2>&1 || true
+      ;;
+    anonymous)
+      git_anonymous_https -C "$mirror_dir" remote set-head origin -a \
+        >/dev/null 2>&1 || true
+      ;;
+    none)
+      git_anonymous_https -C "$mirror_dir" remote set-head origin -a \
+        >/dev/null 2>&1 || true
+      ;;
+    *)
+      git_host_control -C "$mirror_dir" remote set-head origin -a >/dev/null 2>&1 || true
+      ;;
+  esac
+  project_default=$(git_host_control -C "$mirror_dir" symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null \
+    | sed 's#^origin/##' || true)
+  [ -n "$project_default" ] || project_default="main"
+
+  # Each linked worktree gets its own writable Git control plane (config,
+  # hooks, refs, metadata, and objects). It borrows the host-only cache only
+  # while being prepared, then repacks every reachable object locally and
+  # removes the alternate before the container starts.
+  worktree_repo_dir="$task_repo_dir"
+  if [ "$standalone_worktree" = "1" ]; then
+    worktree_repo_dir="$worktree_target/.git"
+    sanitize_task_repo_control_plane "$worktree_repo_dir" "$repo_url" \
+      "$task_branch" false
+  else
+    if [ ! -d "$task_repo_dir" ]; then
+      mkdir -p "$(dirname "$task_repo_dir")"
+      git_host_control init --bare "$task_repo_dir" >/dev/null
+    fi
+    sanitize_task_repo_control_plane "$task_repo_dir" "$repo_url" \
+      "$task_branch" true
+    rm -rf "$task_repo_dir/objects/info"
+    mkdir -p "$task_repo_dir/objects/info"
+    printf '%s\n' "$mirror_dir/objects" \
+      > "$task_repo_dir/objects/info/alternates"
+    # Copy only refs/objects from the trusted host mirror. The task repo's
+    # remote remains canonical GitHub HTTPS from the sanitizer above.
+    if ! git_host_control -C "$task_repo_dir" fetch "$mirror_dir" \
+      '+refs/remotes/origin/*:refs/remotes/origin/*' >/dev/null 2>&1; then
+      emit_err "WORKTREE_FAILED" \
+        "could not copy the fetched refs into the task repository for $repo_url" \
+        "copy task repository refs ($project_id)"
+    fi
+    if ! git_host_control -C "$task_repo_dir" repack -a -d >/dev/null; then
+      emit_err "WORKTREE_FAILED" \
+        "could not make the task repository self-contained for $repo_url" \
+        "copy task repository objects ($project_id)"
+    fi
+    rm -f "$task_repo_dir/objects/info/alternates"
+  fi
+
+  mkdir -p "$(dirname "$worktree_target")"
+  if [ -e "$worktree_target/.git" ]; then
+    # Resume (ADR-028): the task worktree survived the stop — reuse it as-is
+    # (a linked worktree's .git is a FILE, hence -e). Re-running `git
+    # worktree add` would refuse ("already exists" / branch exists) and
+    # errored EVERY resume of a worktree-preserving stop within seconds
+    # (found live 2026-07-21). The task branch and any uncommitted work are
+    # exactly what the user expects back.
+    log "worktree for $project_slug already present — resuming with it"
+    if [ "$standalone_worktree" != "1" ]; then
+      # Repair only after the task-private repository and its gitdir pointer
+      # have passed the host boundary checks above.
+      git_host_control -C "$worktree_repo_dir" worktree repair \
+        "$worktree_target" 2>/dev/null || true
+    fi
+  elif [ -n "$task_branch" ] && [ "$task_branch" != "null" ] \
+       && [ "$task_branch" != "$project_default" ] \
+       && ! git_host_control -C "$worktree_repo_dir" rev-parse --verify --quiet \
+            "refs/heads/$task_branch" >/dev/null 2>&1 \
+       && git_host_control -C "$worktree_repo_dir" rev-parse --verify --quiet \
+            "refs/remotes/origin/$task_branch^{commit}" >/dev/null 2>&1; then
+    # The worktree is gone but the task's branch is on the remote (a lost
+    # task directory, 2026-10-20: Resume rebuilt from the base, putting the
+    # agents on the wrong code with the pushed commits out of sight). The
+    # fetch above is fresh — a missing worktree makes a failed fetch fatal —
+    # so continue from the pushed branch, never the base.
+    step "WORKTREE_FAILED" "git worktree add from origin/$task_branch ($project_id)"
+    log "worktree for $project_slug missing — restoring it from origin/$task_branch"
+    # The base this task branched from, as nearly as the remote can tell:
+    # where the task branch leaves the default branch.
+    env_schema_oid=$(git_host_control -C "$mirror_dir" merge-base \
+      "refs/remotes/origin/$task_branch" "refs/remotes/origin/$project_default" \
+      2>/dev/null || true)
+    if [ -n "$env_schema_oid" ]; then
+      record_env_schema_base "$project_id" "oid $env_schema_oid" \
+        || log "warning: could not record the .env.schema base for $project_id; its keys without a binding are withheld"
+    fi
+    # --no-track: the sanitizer above already wrote this branch's upstream.
+    if ! git_host_control -C "$worktree_repo_dir" worktree add --no-track \
+      "$worktree_target" -b "$task_branch" "refs/remotes/origin/$task_branch"; then
+      emit_err "WORKTREE_FAILED" \
+        "could not restore the task worktree from origin/$task_branch for $repo_url" \
+        "git worktree add from origin/$task_branch ($project_id)"
+    fi
+  elif git_host_control -C "$worktree_repo_dir" rev-parse --verify --quiet \
+       "refs/remotes/origin/$project_default" >/dev/null 2>&1; then
+    # Normal case: branch the task worktree off origin/<defaultBranch>.
+    # Only when the remote has no branch of this task's yet.
+    step "WORKTREE_FAILED" "git worktree add ($project_id)"
+    # The same commit the task repository just copied, read where the task
+    # never writes: the host cache, under this project's lock.
+    env_schema_oid=$(git_host_control -C "$mirror_dir" rev-parse --verify --quiet \
+      "refs/remotes/origin/$project_default^{commit}" 2>/dev/null || true)
+    if [ -n "$env_schema_oid" ]; then
+      record_env_schema_base "$project_id" "oid $env_schema_oid" \
+        || log "warning: could not record the .env.schema base for $project_id; its keys without a binding are withheld"
+    fi
+    if ! git_host_control -C "$worktree_repo_dir" worktree add "$worktree_target" \
+      -b "$task_branch" "origin/$project_default"; then
+      emit_err "WORKTREE_FAILED" \
+        "could not create the task worktree for $repo_url" \
+        "git worktree add ($project_id)"
+    fi
+  else
+    # Empty / branchless remote — there's no origin/<default> to branch from.
+    # Don't fail the whole task over it (the old behaviour: "invalid reference"
+    # -> WORKTREE_FAILED -> respawn loop). Start an empty, git-initialised
+    # workspace so the task still comes up and a first commit can populate the
+    # repo. Leave a note (git-excluded so it isn't accidentally committed).
+    step "WORKTREE_FAILED" "init empty workspace ($project_id)"
+    log "warning: $repo_url has no '$project_default' branch (empty repo?); starting an empty workspace for $project_slug"
+    # Only a cache with no ref at all proves the repository empty. A missing
+    # default branch alone (say, a default that could not be resolved) is
+    # recorded as nothing, so its keys without a binding are withheld rather
+    # than read as declaring nothing.
+    if env_schema_refs=$(git_host_control -C "$mirror_dir" for-each-ref --count=1 2>/dev/null) \
+       && [ -z "$env_schema_refs" ]; then
+      record_env_schema_base "$project_id" "empty" \
+        || log "warning: could not record the .env.schema base for $project_id; its keys without a binding are withheld"
+    fi
+    rm -rf "$worktree_target"
+    mkdir -p "$worktree_target"
+    git_host_control -C "$worktree_target" init -q -b "$project_default" 2>/dev/null \
+      || { git_host_control -C "$worktree_target" init -q \
+           && git_host_control -C "$worktree_target" symbolic-ref HEAD "refs/heads/$project_default"; }
+    git_host_control -C "$worktree_target" remote add origin "$repo_url" 2>/dev/null || true
+    sanitize_task_repo_control_plane "$worktree_target/.git" "$repo_url" \
+      "$project_default" false
+    printf '%s\n' \
+      "# Empty repository" \
+      "" \
+      "\`$repo_url\` has no commits yet, so Moondeck started an empty workspace on" \
+      "branch \`$project_default\`. Make your first commit and run:" \
+      "" \
+      "    git push -u origin $project_default" \
+      "" \
+      "to initialise the repository." \
+      > "$worktree_target/UAI_EMPTY_REPO.md"
+    mkdir -p "$worktree_target/.git/info" 2>/dev/null || true
+    printf '%s\n' "/UAI_EMPTY_REPO.md" \
+      >> "$worktree_target/.git/info/exclude" 2>/dev/null || true
+  fi
+
+  # Tool-version seeding: only when the worktree has no checked-in
+  # .tool-versions AND the project declares one. Never overwrite a file
+  # the repo already ships.
+  reject_unsafe_runtime_manifest "$worktree_target/.tool-versions" \
+    "$project_slug" "$project_id"
+  if [ ! -e "$worktree_target/.tool-versions" ] \
+     && [ -n "$tool_versions" ] && [ "$tool_versions" != "null" ]; then
+    printf '%s\n' "$tool_versions" > "$worktree_target/.tool-versions"
+  fi
+  if [ -d "$worktree_target/.git" ] && [ ! -L "$worktree_target/.git" ]; then
+    share_task_tree_with_container "$worktree_target/.git" \
+      "standalone task Git repository"
+  fi
+
+  release_project_lock
+done < <(jq -c '.[]' <<<"$projects_json")
+
+# Every host Git operation is over: a task on cloud credentials stops being
+# served its owner's GitHub token and SSH key now.
+if [ -n "$uai_handshake_dir" ]; then
+  : > "$uai_handshake_dir/event-clone-done"
+fi
+
+# Git and the checked-out files were created by the host. Reconcile their
+# group/modes only after every host Git operation and before Compose exposes
+# them to uid 1000. The host-only marker avoids recursively walking a large
+# workspace (for example node_modules) on every resume, while its gid payload
+# forces a fresh pass if the task moves to a differently-grouped host. This
+# first pass self-heals 0.9.2 task repos whose mktemp config was mode 0600 on a
+# uid-501 macOS host. The sanitizer above repairs its rewritten control files
+# on every later resume.
+step "WORKTREE_FAILED" "share task files with container"
+mkdir -p "$task_uai_dir"
+# The shared group may be a broad host group (for example macOS `staff`). Keep
+# its writable leaves behind host-only parents; Docker bind-mounts the exact
+# workspace/repository roots, so node does not need host-path traversal here.
+chmod 700 "$task_dir" "$task_uai_dir"
+filesystem_group_marker="$task_uai_dir/container-filesystem-group-v1"
+marked_container_gid=""
+if [ -L "$filesystem_group_marker" ]; then
+  emit_err "WORKTREE_FAILED" \
+    "Moondeck refused a symbolic-link task filesystem marker" \
+    "share task files with container"
+elif [ -f "$filesystem_group_marker" ]; then
+  marked_container_gid=$(cat "$filesystem_group_marker" 2>/dev/null || true)
+elif [ -e "$filesystem_group_marker" ]; then
+  emit_err "WORKTREE_FAILED" \
+    "Moondeck refused a non-file task filesystem marker" \
+    "share task files with container"
+fi
+if [ "$marked_container_gid" != "$task_container_gid" ]; then
+  share_task_tree_with_container "$task_workspace" "task workspace"
+  filesystem_group_marker_tmp=$(mktemp \
+    "$task_uai_dir/.container-filesystem-group.XXXXXX")
+  printf '%s\n' "$task_container_gid" > "$filesystem_group_marker_tmp"
+  chmod 600 "$filesystem_group_marker_tmp"
+  mv -f "$filesystem_group_marker_tmp" "$filesystem_group_marker"
+else
+  # A container may have changed a mount root's mode. These two O(1) repairs
+  # keep entry into the already-normalized trees reliable without walking them.
+  share_task_entry_with_container "$task_workspace" "task workspace root"
+fi
+# Task repos are repacked, so this tree stays small; normalize it every time.
+# Unlike the workspace pass, this covers Git metadata created during the host
+# refresh and any loose objects/locks written by the prior container.
+share_task_tree_with_container "$task_uai_dir/repos" \
+  "task-private Git repositories"
+
+if [ -z "$github_git_helper" ] && [ "$uai_used_ssh_transport" = "1" ]; then
+  uai_git_transport="ssh"
+fi
+
+# -----------------------------------------------------------------------------
+# 4. Generate .uai/docker-compose.yml (bash). Union preview ports + env keys
+#    across the selected projects; one app service. Derived Dockerfile only
+#    when a project declares `extra`.
+# -----------------------------------------------------------------------------
+
+step "RENDER_FAILED" "generate compose"
+
+mkdir -p "$task_uai_dir"
+
+STANDARD_CONTAINER_DIR="${UAI_STANDARD_CONTAINER_ASSETS_DIR:-$SCRIPT_DIR/../../images/standard/container}"
+if ! STANDARD_CONTAINER_DIR=$(cd "$STANDARD_CONTAINER_DIR" && pwd -P); then
+  emit_err "CONTAINER_INIT_FAILED" \
+    "The station's packaged container asset directory is missing. Repair or update the station installation, then retry." \
+    "resolve packaged container assets"
+fi
+UAI_INIT_SOURCE="$STANDARD_CONTAINER_DIR/uai-init"
+RUNTIME_MATERIALIZER_SOURCE="$STANDARD_CONTAINER_DIR/uai-materialize-runtimes"
+COREPACK_VERSION_SOURCE="$STANDARD_CONTAINER_DIR/corepack-version"
+ENV_HOOK_SOURCE="$SCRIPT_DIR/env-hook.sh"
+UAI_ENV_EXEC_SOURCE="$SCRIPT_DIR/uai-env-exec.sh"
+# The `moondeck` command (Moondeck plan §5 row 7): this task's agent CLI on
+# PATH, mounted read-only at /usr/local/bin/moondeck. There is no `uai` one.
+MOONDECK_CLI_SOURCE="$SCRIPT_DIR/moondeck-cli.sh"
+if [ -L "$MOONDECK_CLI_SOURCE" ] || [ ! -f "$MOONDECK_CLI_SOURCE" ] \
+   || [ ! -r "$MOONDECK_CLI_SOURCE" ]; then
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Moondeck's packaged agent command is missing or unsafe. Repair or update the station installation, then retry." \
+    "resolve packaged container assets"
+fi
+TASK_FORWARDER_SOURCE="$STANDARD_CONTAINER_DIR/uai-task-forwarder.mjs"
+if [ -L "$UAI_INIT_SOURCE" ] || [ ! -f "$UAI_INIT_SOURCE" ] \
+   || [ ! -x "$UAI_INIT_SOURCE" ]; then
+  emit_err "CONTAINER_INIT_FAILED" \
+    "The station's packaged task initializer is missing or unsafe. Repair or update the station installation, then retry." \
+    "resolve packaged container assets"
+fi
+if [ "$UAI_PROJECT_ENV_MODE" = "loader" ]; then
+  for loader_asset in \
+    "$ENV_HOOK_SOURCE" \
+    "$UAI_ENV_EXEC_SOURCE" \
+    "$TASK_FORWARDER_SOURCE"
+  do
+    if [ -L "$loader_asset" ] || [ ! -f "$loader_asset" ] \
+       || [ ! -r "$loader_asset" ]; then
+      emit_err "CONTAINER_INIT_FAILED" \
+        "The station's packaged task env loader is missing or unsafe. Repair or update the station installation, then retry." \
+        "resolve packaged env loader assets"
+    fi
+  done
+fi
+if [ "$project_count" -gt 0 ]; then
+  if [ -L "$RUNTIME_MATERIALIZER_SOURCE" ] \
+     || [ ! -f "$RUNTIME_MATERIALIZER_SOURCE" ] \
+     || [ ! -x "$RUNTIME_MATERIALIZER_SOURCE" ]; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "The station's packaged runtime materializer is missing or unsafe. Repair or update the station installation, then retry." \
+      "resolve packaged container assets"
+  fi
+  if [ -L "$COREPACK_VERSION_SOURCE" ] \
+     || [ ! -f "$COREPACK_VERSION_SOURCE" ] \
+     || [ ! -r "$COREPACK_VERSION_SOURCE" ]; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "The station's packaged Corepack version pin is missing or unsafe. Repair or update the station installation, then retry." \
+      "resolve packaged container assets"
+  fi
+fi
+
+# Containers bind these assets for their whole life, but the packaged
+# sources live in the VERSIONED runtime tree and the updater keeps only
+# current+previous — a container surviving two updates found its mounts
+# pointing at deleted files (uai-init exec 127, recovery wedged the host in
+# "checking"; live 2026-08-26). Copy the assets into the task's own control
+# tree and mount THOSE: asset lifetime becomes task lifetime, and a Resume
+# refreshes the copies to the current version. Atomic rename so a resumed
+# container can never observe a half-written initializer.
+task_assets_dir="$task_uai_dir/assets"
+mkdir -p "$task_assets_dir"
+copy_task_asset() {
+  copy_src="$1"
+  copy_name="$2"
+  copy_mode="$3"
+  copy_tmp=$(mktemp "$task_assets_dir/.$copy_name.XXXXXX") || return 1
+  cp "$copy_src" "$copy_tmp" || { rm -f "$copy_tmp"; return 1; }
+  chmod "$copy_mode" "$copy_tmp" || { rm -f "$copy_tmp"; return 1; }
+  mv -f "$copy_tmp" "$task_assets_dir/$copy_name"
+}
+if ! copy_task_asset "$UAI_INIT_SOURCE" uai-init 0755; then
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Moondeck could not stage the task initializer into this task's control tree. Check disk space and permissions under the station's data directory, then retry." \
+    "stage task container assets"
+fi
+UAI_INIT_SOURCE="$task_assets_dir/uai-init"
+if ! copy_task_asset "$MOONDECK_CLI_SOURCE" moondeck 0555; then
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Moondeck could not stage the agent command into this task's control tree. Check disk space and permissions under the Moondeck data directory, then retry." \
+    "stage task container assets"
+fi
+MOONDECK_CLI_SOURCE="$task_assets_dir/moondeck"
+if [ "$UAI_PROJECT_ENV_MODE" = "loader" ]; then
+  if ! copy_task_asset "$ENV_HOOK_SOURCE" env-hook.sh 0555 \
+     || ! copy_task_asset "$UAI_ENV_EXEC_SOURCE" uai-env-exec 0555 \
+     || ! copy_task_asset "$TASK_FORWARDER_SOURCE" uai-task-forwarder.mjs 0444; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck could not stage the task env loader into this task's control tree. Check disk space and permissions under the station's data directory, then retry." \
+      "stage task env loader assets"
+  fi
+  ENV_HOOK_SOURCE="$task_assets_dir/env-hook.sh"
+  UAI_ENV_EXEC_SOURCE="$task_assets_dir/uai-env-exec"
+  TASK_FORWARDER_SOURCE="$task_assets_dir/uai-task-forwarder.mjs"
+fi
+if [ -f "$RUNTIME_MATERIALIZER_SOURCE" ]; then
+  if ! copy_task_asset "$RUNTIME_MATERIALIZER_SOURCE" uai-materialize-runtimes 0755; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck could not stage the runtime materializer into this task's control tree. Check disk space and permissions under the station's data directory, then retry." \
+      "stage task container assets"
+  fi
+  RUNTIME_MATERIALIZER_SOURCE="$task_assets_dir/uai-materialize-runtimes"
+fi
+if [ -f "$COREPACK_VERSION_SOURCE" ]; then
+  if ! copy_task_asset "$COREPACK_VERSION_SOURCE" corepack-version 0644; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck could not stage the Corepack version pin into this task's control tree. Check disk space and permissions under the station's data directory, then retry." \
+      "stage task container assets"
+  fi
+  COREPACK_VERSION_SOURCE="$task_assets_dir/corepack-version"
+fi
+
+# The host-authored allowlist is the single project-set authority shared by
+# pre-start runtime proof and task-local dependency installation. It lives in
+# the container-unmounted .uai control tree and is exposed only as this one
+# read-only file. Atomic replacement keeps resumptions from observing a
+# partially written list.
+runtime_projects_file="$task_uai_dir/runtime-projects"
+runtime_projects_tmp=$(mktemp "$task_uai_dir/.runtime-projects.XXXXXX")
+if [ -n "$runtime_project_slugs" ]; then
+  printf '%s\n' "$runtime_project_slugs" > "$runtime_projects_tmp"
+else
+  : > "$runtime_projects_tmp"
+fi
+chmod 0644 "$runtime_projects_tmp"
+mv -f "$runtime_projects_tmp" "$runtime_projects_file"
+
+# Union of preview ports across projects, de-duped by containerPort
+# (first-in-position wins the name). Validated: name non-empty, 1..65535.
+union_preview_ports_json=$(jq -c '
+  [
+    .[]
+    | (.preview_ports // "[]") as $raw
+    | (if ($raw | type) == "string" then (try ($raw | fromjson) catch [])
+       elif ($raw | type) == "array" then $raw
+       else [] end)
+    | .[]?
+    | {
+        name: (.name // ""),
+        containerPort: (((.containerPort // 0) | tonumber?) // 0)
+      }
+    | select(.name != "" and .containerPort > 0 and .containerPort <= 65535)
+  ]
+  | reduce .[] as $p ({seen: [], out: []};
+      if (.seen | index($p.containerPort)) then .
+      else {seen: (.seen + [$p.containerPort]), out: (.out + [$p])} end)
+  | .out
+' <<<"$projects_json")
+
+# Union of declared env keys across projects (env JSON is an array of
+# {key,...} objects per ADR-015). De-duped, first occurrence wins.
+union_env_keys_json=$(jq -c '
+  [
+    .[]
+    | (.env // "[]") as $raw
+    | (if ($raw | type) == "string" then (try ($raw | fromjson) catch [])
+       elif ($raw | type) == "array" then $raw
+       else [] end)
+    | .[]?
+    | (.key // "")
+    | select(. != "")
+  ]
+  | reduce .[] as $k ([]; if (index($k)) then . else . + [$k] end)
+' <<<"$projects_json")
+
+# Concatenated `extra` RUN snippets across projects (in position order).
+extra_block=$(jq -r '
+  [ .[] | (.extra // "") | select(. != "" and . != "null") ]
+  | join("\n")
+' <<<"$projects_json")
+
+has_derived=0
+if [ -n "$extra_block" ]; then
+  has_derived=1
+fi
+
+# One fail-closed authority for names projects must never control, whether the
+# value arrived as an ordinary declared env key or as a preview urlEnv literal.
+# UAI_EDITOR_THEME is the sole preview exception below: it is computed by the
+# cloud from the task palette, not sourced from a project.
+is_reserved_task_env_name() {
+  case "$1" in
+    GH_TOKEN | GITHUB_TOKEN | GH_CONFIG_DIR | GH_HOST | \
+    GIT_CONFIG* | GIT_DIR | GIT_WORK_TREE | GIT_COMMON_DIR | \
+    GIT_OBJECT_DIRECTORY | GIT_ALTERNATE_OBJECT_DIRECTORIES | \
+    GIT_INDEX_FILE | GIT_EXEC_PATH | GIT_ASKPASS | SSH_ASKPASS | \
+    GIT_SSH | GIT_SSH_COMMAND | HOME | XDG_CONFIG_HOME | XDG_DATA_HOME | \
+    XDG_CACHE_HOME | \
+    PATH | SHELL | LD_PRELOAD | LD_AUDIT | LD_LIBRARY_PATH | NODE_OPTIONS | \
+    NODE_PATH | SHELLOPTS | BASHOPTS | PS4 | BASH_ENV | ENV | \
+    __UAI_ENV_* | __CURSOR_SANDBOX_ENV_RESTORE | GROK_LOGIN_ENV | \
+    NODE_EXTRA_CA_CERTS | SSL_CERT_FILE | REQUESTS_CA_BUNDLE | \
+    [Aa][Ss][Dd][Ff]_* | [Cc][Oo][Rr][Ee][Pp][Aa][Cc][Kk]_* | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Pp][Rr][Ee][Ff][Ii][Xx] | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Cc][Aa][Cc][Hh][Ee] | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Ll][Oo][Gg][Ss][_-][Dd][Ii][Rr] | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Uu][Mm][Aa][Ss][Kk] | UAI_* | \
+    CLAUDE_CODE_OAUTH_TOKEN | \
+    ANTHROPIC_API_KEY | ANTHROPIC_AUTH_TOKEN | XAI_API_KEY | CURSOR_API_KEY | \
+    PLAYWRIGHT_BROWSERS_PATH)
+      return 0
+      ;;
+  esac
+  return 1
+}
+
+# A baked task's project env, as both runtimes receive it (Docker's Compose
+# override, Apple's env file): values JSON on stdin; $1 the declared keys
+# (JSON array), $2 the preview URL env (JSON object). Declared env names
+# only, minus every name is_reserved_task_env_name reserves (the one
+# authority, never a second list) and the preview URL names.
+filter_baked_project_env() {
+  local declared="$1" preview="$2" values reserved='[]' key
+  values=$(cat)
+  while IFS= read -r key; do
+    if is_reserved_task_env_name "$key"; then
+      reserved=$(jq -c --arg key "$key" '. + [$key]' <<<"$reserved")
+    fi
+  done < <(printf '%s' "$values" | jq -r 'keys[] | select(test("^[A-Za-z_][A-Za-z0-9_]*$"))')
+  printf '%s' "$values" | jq -c \
+    --argjson declared "$declared" \
+    --argjson preview "$preview" \
+    --argjson reserved "$reserved" '
+    with_entries(.key as $key | select($declared | index($key)))
+    | with_entries(select(.key | test("^[A-Za-z_][A-Za-z0-9_]*$")))
+    | delpaths($reserved | map([.]))
+    | delpaths($preview | keys | map([.]))
+    '
+}
+
+# Names that the loader owns are non-secret metadata. Mount the exact launch
+# set read-only so uai-init can remove even the empty clears inherited from a
+# derived image before it starts code-server. The editor daemon itself never
+# loads project env; each terminal shell fetches independently.
+managed_env_keys_file="$task_uai_dir/managed-env-keys"
+managed_env_keys_tmp=$(mktemp "$task_uai_dir/.managed-env-keys.XXXXXX")
+# macOS still ships Bash 3.2, which has indexed arrays but no associative
+# arrays. Names are validated before this delimiter set is consulted, so `|`
+# cannot collide with an env name.
+managed_env_seen='|'
+{
+  while IFS= read -r managed_name; do
+    [[ "$managed_name" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || continue
+    is_reserved_task_env_name "$managed_name" && continue
+    case "$managed_env_seen" in *"|$managed_name|"*) continue ;; esac
+    managed_env_seen="${managed_env_seen}${managed_name}|"
+    printf '%s\n' "$managed_name"
+  done < <(jq -r '.[]' <<<"$union_env_keys_json")
+  preview_env_raw=$(jq -r '.[0].preview_env // "{}"' <<<"$task_json")
+  while IFS= read -r managed_name; do
+    [[ "$managed_name" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || continue
+    if [ "$managed_name" != "UAI_EDITOR_THEME" ] \
+       && is_reserved_task_env_name "$managed_name"; then
+      continue
+    fi
+    case "$managed_env_seen" in *"|$managed_name|"*) continue ;; esac
+    managed_env_seen="${managed_env_seen}${managed_name}|"
+    printf '%s\n' "$managed_name"
+  done < <(jq -r 'keys[]?' <<<"$preview_env_raw")
+} > "$managed_env_keys_tmp"
+chmod 0444 "$managed_env_keys_tmp"
+mv -f "$managed_env_keys_tmp" "$managed_env_keys_file"
+
+# Write the compose file. No top-level name: (the -p flag sets the project),
+# no container_name:. Env values live host-side (ADR-015): we emit only
+# pass-through references `${KEY:-}`.
+{
+  printf 'services:\n'
+  printf '  app:\n'
+  # The station's mark on everything of this task's stack (Moondeck plan §4):
+  # the frozen @runuai/host labels nothing of a Compose stack, so a `task-*`
+  # project without it is the old host's (uninstall-legacy removes those).
+  printf '    labels:\n'
+  printf '      io.moondeck.task: "%s"\n' "$task_id"
+  if [ "$has_derived" = "1" ]; then
+    printf '    build:\n'
+    printf '      context: .\n'
+    printf '      dockerfile: Dockerfile\n'
+    printf '    image: %s\n' "$DERIVED_IMAGE"
+  else
+    printf '    image: %s\n' "$STANDARD_IMAGE"
+    # Never pull: the standard image is built LOCALLY by the host, not hosted
+    # on any registry. Without this, an absent image makes compose attempt a
+    # doomed registry pull ("pull access denied for uai-standard") instead of
+    # failing clearly (live 2026-07-22, a fresh host mid standard-image build).
+    printf '    pull_policy: never\n'
+  fi
+  printf '    init: true\n'
+  # Keep the host MCP gateway reachable through Docker's ordinary
+  # host-gateway address. (The Apple runtime has no extra_hosts equivalent
+  # and none is rendered for it; its gateway route is the vmnet gateway IP.)
+  printf '    extra_hosts:\n'
+  printf '      - "host.docker.internal:host-gateway"\n'
+  # Give node the one host group that owns this task's bind-mounted files.
+  # Numeric group_add works even when the group has a different name (or no
+  # name) in the image. Root hosts use node's existing gid 1000 above.
+  printf '    group_add:\n'
+  printf '      - "%s"\n' "$task_container_gid"
+  printf '    working_dir: /workspace\n'
+  printf '    volumes:\n'
+  printf '      - "%s:/workspace"\n' "$task_workspace"
+  # Identical-host-path binds keep each linked worktree's absolute gitdir
+  # pointer valid in-container (ADR-014). Only the self-contained task-private
+  # repository is mounted; the host cache never enters a container. Legacy
+  # worktrees fail closed before Compose rendering and must be recreated.
+  printf '      - "%s:%s"\n' "$task_workspace" "$task_workspace"
+  if [ "$task_workspace_physical" != "$task_workspace" ]; then
+    # Git canonicalizes a symlinked workspace root in both directions: the
+    # worktree's `.git` points at the physical repository, and the repository's
+    # worktree metadata points back at the physical workspace. Mount the same
+    # already-approved workspace at that alias without exposing its `.uai`
+    # sibling or any broader host directory.
+    printf '      - "%s:%s"\n' \
+      "$task_workspace" "$task_workspace_physical"
+  fi
+  while IFS= read -r vol_obj; do
+    [ -n "$vol_obj" ] || continue
+    vol_pid=$(jq -r '.id' <<<"$vol_obj")
+    printf '      - "%s/repos/%s.git:%s/repos/%s.git"\n' \
+      "$task_uai_dir" "$vol_pid" "$task_uai_dir" "$vol_pid"
+    if [ "$task_uai_dir_physical" != "$task_uai_dir" ]; then
+      printf '      - "%s/repos/%s.git:%s/repos/%s.git"\n' \
+        "$task_uai_dir" "$vol_pid" "$task_uai_dir_physical" "$vol_pid"
+    fi
+  done < <(jq -c '.[]' <<<"$projects_json")
+  printf '      - "%s:/usr/local/bin/uai-init:ro"\n' "$UAI_INIT_SOURCE"
+  printf '      - "%s:/usr/local/bin/moondeck:ro"\n' "$MOONDECK_CLI_SOURCE"
+  if [ "$UAI_PROJECT_ENV_MODE" = "loader" ]; then
+    printf '      - "%s:/usr/local/share/uai/env-hook.sh:ro"\n' \
+      "$ENV_HOOK_SOURCE"
+    printf '      - "%s:/usr/local/bin/uai-env-exec:ro"\n' \
+      "$UAI_ENV_EXEC_SOURCE"
+    printf '      - "%s:/usr/local/share/uai/uai-task-forwarder.mjs:ro"\n' \
+      "$TASK_FORWARDER_SOURCE"
+  fi
+  printf '      - "%s:/run/uai/runtime-projects:ro"\n' \
+    "$runtime_projects_file"
+  printf '      - "%s:/run/uai/managed-env-keys:ro"\n' \
+    "$managed_env_keys_file"
+  # Task processes consume only the exact runtimes/package managers proved by
+  # pre-start maintenance. `:ro` is explicit because Docker's omitted default
+  # is read-write and a legacy Compose file must never look equivalent.
+  printf '      - "%s:/opt/asdf-data:ro"\n' "$ASDF_VOLUME"
+  # ADR-053: host-wide Playwright browser cache. Always mounted (harmless
+  # when browser testing is off); Chromium downloads once per HOST.
+  printf '      - "%s:/opt/pw-browsers"\n' "$PW_VOLUME"
+  # ADR-062 shared files (org + personal) at /workspace/files/{org,me};
+  # ro/rw fixed here for the container's lifetime.
+  if [ "$shared_files_mode" != "off" ]; then
+    shared_suffix=""
+    [ "$shared_files_mode" = "ro" ] && shared_suffix=":ro"
+    if [ -n "$shared_owner_org" ]; then
+      printf '      - "%s/orgs/%s:/workspace/files/org%s"\n' \
+        "$shared_root" "$shared_owner_org" "$shared_suffix"
+    fi
+    if [ -n "$shared_owner_user" ]; then
+      printf '      - "%s/users/%s:/workspace/files/me%s"\n' \
+        "$shared_root" "$shared_owner_user" "$shared_suffix"
+    fi
+  fi
+  printf '    ports:\n'
+  # code-server (the Editor tunnel) is the only auto-published port. Preview
+  # ports are NOT published at task-up (ADR-043 Stage 2: opt-in previews) —
+  # each preview the user enables is reached lazily through a per-(task,preview)
+  # sidecar attached to the compose network, so nothing is exposed by default.
+  printf '      - "127.0.0.1::8080"\n'
+  printf '    environment:\n'
+  # Non-secret transport marker for uai-init. The actual GitHub token is
+  # injected later into gh's private config and never enters Compose.
+  printf '      UAI_GIT_TRANSPORT: "%s"\n' "$uai_git_transport"
+  # Uai owns GitHub auth inside the task container. Keep gh's config outside
+  # the bind-mounted workspace and independent of project-defined XDG/HOME
+  # values so its credential helper always resolves the connected user.
+  printf '      GH_CONFIG_DIR: "/home/node/.config/gh"\n'
+  # Runtime selection/cache authority is host-owned. These values override
+  # both project-declared keys and a derived image's ENV so uai-init cannot be
+  # redirected into an unproved runtime or a different shared-cache writer.
+  printf '      PATH: "%s"\n' "$TASK_RUNTIME_PATH"
+  printf '      HOME: "/home/node"\n'
+  printf '      XDG_CONFIG_HOME: "/home/node/.config"\n'
+  printf '      XDG_DATA_HOME: "/home/node/.local/share"\n'
+  printf '      XDG_CACHE_HOME: "/home/node/.cache"\n'
+  printf '      ASDF_DIR: "/opt/asdf"\n'
+  printf '      ASDF_DATA_DIR: "/opt/asdf-data"\n'
+  printf '      ASDF_CONFIG_FILE: "/dev/null"\n'
+  printf '      ASDF_DEFAULT_TOOL_VERSIONS_FILENAME: ".tool-versions"\n'
+  printf '      ASDF_NODEJS_VERSION: ""\n'
+  printf '      ASDF_PYTHON_VERSION: ""\n'
+  printf '      ASDF_GOLANG_VERSION: ""\n'
+  printf '      ASDF_RUBY_VERSION: ""\n'
+  printf '      ASDF_RUST_VERSION: ""\n'
+  printf '      ASDF_SKIP_RESHIM: "1"\n'
+  printf '      COREPACK_HOME: "/opt/asdf-data/corepack"\n'
+  printf '      COREPACK_DEFAULT_TO_LATEST: "0"\n'
+  printf '      COREPACK_ENV_FILE: "0"\n'
+  printf '      COREPACK_NPM_REGISTRY: "https://registry.npmjs.org"\n'
+  printf '      COREPACK_ENABLE_NETWORK: "0"\n'
+  printf '      COREPACK_ENABLE_AUTO_PIN: "0"\n'
+  printf '      COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"\n'
+  printf '      COREPACK_ENABLE_PROJECT_SPEC: "1"\n'
+  printf '      COREPACK_ENABLE_STRICT: "1"\n'
+  printf '      COREPACK_ENABLE_UNSAFE_CUSTOM_URLS: "0"\n'
+  printf '      COREPACK_INTEGRITY_CHECK: "1"\n'
+  # npm injects lowercase config names into lifecycle scripts, so pin both
+  # cases. These task-private paths are never part of the shared asdf volume.
+  printf '      NPM_CONFIG_PREFIX: "%s"\n' "$TASK_NPM_PREFIX"
+  printf '      npm_config_prefix: "%s"\n' "$TASK_NPM_PREFIX"
+  printf '      NPM_CONFIG_CACHE: "%s"\n' "$TASK_NPM_CACHE"
+  printf '      npm_config_cache: "%s"\n' "$TASK_NPM_CACHE"
+  printf '      NPM_CONFIG_LOGS_DIR: "%s/_logs"\n' "$TASK_NPM_CACHE"
+  printf '      npm_config_logs_dir: "%s/_logs"\n' "$TASK_NPM_CACHE"
+  printf '      NPM_CONFIG_UMASK: "0002"\n'
+  printf '      npm_config_umask: "0002"\n'
+  printf '      UAI_WORKSPACE: "/workspace"\n'
+  printf '      UAI_RUNTIME_PROJECTS: "/run/uai/runtime-projects"\n'
+  printf '      UAI_ENV_MODE: "%s"\n' "$UAI_PROJECT_ENV_MODE"
+  printf '      UAI_ENV_HOOK: "0"\n'
+  printf '      SHELL: "/usr/bin/zsh"\n'
+  printf '      LD_PRELOAD: ""\n'
+  printf '      LD_AUDIT: ""\n'
+  printf '      LD_LIBRARY_PATH: ""\n'
+  printf '      NODE_OPTIONS: ""\n'
+  printf '      NODE_PATH: ""\n'
+  # SHELLOPTS/BASHOPTS are deliberately ABSENT, never empty: bash exports its
+  # live options into any child when these names were present in its startup
+  # environment, so an "empty clear" let set -euo scripts stamp nounset into
+  # code-server and break every asdf shim in the Editor terminal (found live
+  # 2026-08-16, on BOTH engines; the reserved-name filter still strips any
+  # project-declared value).
+  printf '      PS4: ""\n'
+  printf '      BASH_ENV: ""\n'
+  printf '      ENV: ""\n'
+  # Host-resident Claude auth (ADR-021). Headless `claude --print` no longer
+  # uses the interactive subscription/keychain path, so it needs a token from
+  # `claude setup-token`. Interpolated from the host-agent env at up-time, so
+  # the literal token is never written to the compose file on disk. Putting it
+  # in the container env (rather than the host's ~/.claude mount, which broke
+  # with EROFS on session-env writes) means both the orchestrator's headless
+  # claude and the code-server terminal's interactive claude authenticate.
+  if [ "$uai_on_cloud_credentials" != "1" ]; then
+    printf '      %s: "${%s:-}"\n' \
+      "CLAUDE_CODE_OAUTH_TOKEN" "CLAUDE_CODE_OAUTH_TOKEN"
+    # Pasted engine API keys (ADR-070) ride the same at-up interpolation, so the
+    # terminal CLIs authenticate like the adapters' exec-time env forwarding.
+    printf '      %s: "${%s:-}"\n' "ANTHROPIC_API_KEY" "ANTHROPIC_API_KEY"
+    printf '      %s: "${%s:-}"\n' "ANTHROPIC_AUTH_TOKEN" "ANTHROPIC_AUTH_TOKEN"
+    printf '      %s: "${%s:-}"\n' "XAI_API_KEY" "XAI_API_KEY"
+  fi
+  # ADR-053: point Playwright at the shared browser cache volume.
+  printf '      PLAYWRIGHT_BROWSERS_PATH: "/opt/pw-browsers"\n'
+  # No GH_TOKEN/GITHUB_TOKEN in the container env (ADR-027). `gh` prefers such
+  # an env var over its stored credentials, which blocks the per-user
+  # `gh auth login --with-token` the host runs (and would re-attribute every PR
+  # to the env token — breaking multi-user). The host's GitHub token reaches
+  # `gh` through its config file instead (lib/github-tokens.ts), and gh serves
+  # as Git's HTTPS credential helper. SSH remains a disconnected-user fallback.
+  # Projects may declare managed names, so skip them here rather than trust
+  # callers. They are also removed from the in-memory Compose override below.
+  #
+  # UAI_EDITOR_THEME is reserved in BOTH places for the case that is easy to
+  # miss: a task whose stored palette is null, on a project that happens to
+  # declare that name. The cloud sends no theme, so the `preview_env` entry
+  # that normally shadows a declared key is absent too — and without these two
+  # lines a project would get to pick what the Editor pane looks like. Reserved,
+  # the name is not emitted at all and uai-init seeds the image's own default.
+  #
+  # Project values never enter the host environment. Emit an explicit empty
+  # default for every declared key; the stdin-only Compose override supplies
+  # decrypted values at `compose up` time.
+  while IFS= read -r ekey; do
+    [ -n "$ekey" ] || continue
+    is_reserved_task_env_name "$ekey" && continue
+    printf '      %s: ""\n' "$ekey"
+  done < <(jq -r '.[]' <<<"$union_env_keys_json")
+  # Cloud-computed env (ADR-025): a JSON object {VAR: value} on the task row.
+  # A legacy baked task writes the literals as before. A loader task emits only
+  # empty clears (to defeat a derived image's ENV); the loopback endpoint is
+  # the sole source of the current values. Two producers, both cloud-side:
+  #   - PUBLIC preview URLs under operator-chosen names (EXPO_PACKAGER_PROXY_URL
+  #     and friends), one per preview port that set `urlEnv`;
+  #   - UAI_EDITOR_THEME (ADR-091), the Editor pane's colour theme as a VS Code
+  #     theme LABEL ("Quiet Light"), already resolved from the palette the
+  #     creating browser snapshotted. The host never maps a Uai palette id.
+  # UAI_EDITOR_THEME is absent for every task created before it shipped and for
+  # any created outside a browser; uai-init then seeds the image's own default,
+  # so the column staying null is a supported state, not a value to fill in.
+  preview_env_raw=$(jq -r '.[0].preview_env // "{}"' <<<"$task_json")
+  while IFS= read -r pe_entry; do
+    [ -n "$pe_entry" ] || continue
+    pe_key=$(jq -r '.key' <<<"$pe_entry")
+    pe_val=$(jq -r '.value' <<<"$pe_entry")
+    [ -n "$pe_key" ] || continue
+    if [ "$pe_key" != "UAI_EDITOR_THEME" ] \
+       && is_reserved_task_env_name "$pe_key"; then
+      continue
+    fi
+    if [ "$UAI_PROJECT_ENV_MODE" = "loader" ]; then
+      printf '      %s: ""\n' "$pe_key"
+    else
+      printf '      %s: "%s"\n' "$pe_key" "$pe_val"
+    fi
+  done < <(jq -c 'to_entries[]?' <<<"$preview_env_raw")
+  printf 'networks:\n'
+  printf '  default:\n'
+  printf '    labels:\n'
+  printf '      io.moondeck.task: "%s"\n' "$task_id"
+  printf 'volumes:\n'
+  printf '  %s:\n' "$ASDF_VOLUME"
+  printf '    external: true\n'
+  printf '  %s:\n' "$PW_VOLUME"
+  printf '    external: true\n'
+} > "$task_uai_dir/docker-compose.yml"
+
+if [ "$has_derived" = "1" ]; then
+  # Run `extra` as root so apt/system installs work (the standard image ends
+  # as USER node), then drop back to node for the running container.
+  {
+    printf 'FROM %s\n' "$STANDARD_IMAGE"
+    printf 'USER root\n'
+    printf '%s\n' "$extra_block"
+    printf 'USER node\n'
+  } > "$task_uai_dir/Dockerfile"
+fi
+
+# -----------------------------------------------------------------------------
+# 5. Build (when derived) + pre-materialize project runtimes.
+# -----------------------------------------------------------------------------
+
+# The shared asdf cache volume is host-wide and declared external — make
+# sure it exists before compose references it. Idempotent under Docker; the
+# Apple CLI errors on an existing name, so tolerate creation and then demand
+# the volume actually exists.
+crt volume create "$ASDF_VOLUME" >/dev/null 2>&1 || true
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  # Browsers ride a host directory here, never a block volume — see
+  # PW_BROWSERS_DIR above for why.
+  if ! /bin/mkdir -p "$PW_BROWSERS_DIR"; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck could not create the shared Playwright browsers directory $PW_BROWSERS_DIR." \
+      "create shared volumes"
+  fi
+  if ! crt volume inspect "$ASDF_VOLUME" >/dev/null 2>&1; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck could not create the shared $ASDF_VOLUME volume on the Apple container runtime. Retry after the runtime is healthy." \
+      "create shared volumes"
+  fi
+  # ADR-118: create or adopt this task's private store volume. Adoption
+  # requires the same exact-identity + ownership-label proof as container
+  # destruction: exactly one record, whose id is the requested name,
+  # carrying io.moondeck.task=<this task>. A volume merely OCCUPYING the
+  # reserved name is not this task's store and must never be mounted into
+  # it — foreign bytes at the package store are an integrity boundary.
+  step "CONTAINER_INIT_FAILED" "create task store volume"
+  if store_volume_json=$(crt volume inspect "$TASK_STORE_VOLUME" 2>/dev/null); then
+    store_volume_ok=$(printf '%s' "$store_volume_json" \
+      | jq -r --arg name "$TASK_STORE_VOLUME" --arg tid "$task_id" '
+          if (type == "array" and length == 1
+              and (.[0] | type == "object")
+              and .[0].id == $name
+              and ((.[0].configuration.labels["io.moondeck.task"] // "") == $tid))
+          then "ok" else "mismatch" end' 2>/dev/null) \
+      || store_volume_ok="mismatch"
+    if [ "$store_volume_ok" != "ok" ]; then
+      emit_err "CONTAINER_INIT_FAILED" \
+        "A volume named $TASK_STORE_VOLUME exists but could not be proven as this task's own (exact identity + ownership label); Moondeck will not attach a store volume it cannot prove it owns. Remove or rename it, then retry." \
+        "create task store volume"
+    fi
+  else
+    if ! crt volume create --label "io.moondeck.task=$task_id" \
+      "$TASK_STORE_VOLUME" >/dev/null 2>&1; then
+      emit_err "CONTAINER_INIT_FAILED" \
+        "Moondeck could not create this task's store volume $TASK_STORE_VOLUME on the Apple container runtime. Retry after the runtime is healthy." \
+        "create task store volume"
+    fi
+  fi
+else
+  crt volume create "$PW_VOLUME" >/dev/null 2>&1 || true
+fi
+
+# The standard base image is built by the host (ensureStandardImage), never
+# pulled from a registry — and derived tasks FROM it too. If it's absent (the
+# host started before Docker was ready, or the build failed) compose would try
+# a doomed registry pull; fail with an actionable message instead (the host
+# also (re)builds it on demand before task-up — this is the belt-and-suspenders
+# check for a still-in-progress or failed build). Live 2026-07-22.
+if ! crt image inspect "$STANDARD_IMAGE" >/dev/null 2>&1; then
+  emit_err "STANDARD_IMAGE_MISSING" \
+    "the host base image $STANDARD_IMAGE is not built yet — the host builds it at startup (a few minutes on first run, and after Docker Desktop finishes starting). Wait for the host log line 'built standard image', or restart the host, then retry. If it keeps failing the host log shows the build error (often Docker Desktop low on memory/disk)." \
+    "check standard image"
+fi
+
+# A derived task must materialize through the exact filesystem it will run:
+# project `extra` may add runtime build dependencies. Split build from up so a
+# failed materialization can never start the task container, and so a later up
+# cannot silently rebuild a different image after the proof succeeds.
+runtime_image="$STANDARD_IMAGE"
+if [ "$has_derived" = "1" ]; then
+  if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+    step "COMPOSE_UP_FAILED" "build derived task image"
+    if ! "$CONTAINER_CLI" build -t "$DERIVED_IMAGE" \
+      -f "$task_uai_dir/Dockerfile" "$task_uai_dir" >&2; then
+      require_docker_after_failed_step "build derived task image"
+      emit_err "COMPOSE_UP_FAILED" \
+        "Moondeck could not build this task's derived image. Check the project's extra setup commands, then retry." \
+        "build derived task image"
+    fi
+  else
+    step "COMPOSE_UP_FAILED" "docker compose build app"
+    if ! docker compose -p "$compose_project" \
+      -f "$task_uai_dir/docker-compose.yml" build app >&2; then
+      require_docker_after_failed_step "docker compose build app"
+      emit_err "COMPOSE_UP_FAILED" \
+        "Moondeck could not build this task's derived image. Check the project's extra setup commands, then retry." \
+        "docker compose build app"
+    fi
+  fi
+  runtime_image="$DERIVED_IMAGE"
+fi
+
+# Resolve the mutable service tag once and use only its immutable local image
+# ID for both maintenance and app creation. The on-disk Compose file keeps its
+# tag so task-down can still identify/remove a derived image, but no concurrent
+# rebuild can swap code between runtime proof and execution.
+step "CONTAINER_INIT_FAILED" "resolve task image identity"
+runtime_image_id=""
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  # One snapshot supplies identity, environment, and entrypoint together, so
+  # every image-authority decision below describes the same bytes. The Apple
+  # CLI cannot run an image by its 64-hex id, so the id is re-checked against
+  # the tag after the container is created instead of run directly.
+  apple_image_snapshot=""
+  if ! apple_image_snapshot=$("$CONTAINER_CLI" image inspect \
+    "$runtime_image" 2>/dev/null); then
+    require_docker_after_failed_step "resolve task image identity"
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck could not resolve the exact local image for this task. Retry after the host image is available." \
+      "resolve task image identity"
+  fi
+  runtime_image_id=$(printf '%s\n' "$apple_image_snapshot" \
+    | jq -r '.[0].id // empty' 2>/dev/null) || runtime_image_id=""
+  if ! printf '%s\n' "$runtime_image_id" \
+    | grep -Eq '^[0-9a-f]{64}$'; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "The Apple container runtime returned an invalid image identity for $runtime_image; Moondeck refused to start an unpinned task container." \
+      "resolve task image identity"
+  fi
+  # Without a --entrypoint override flag, an image-declared ENTRYPOINT would
+  # prefix every argv this script passes (including the materializer's
+  # `env -i`). Refuse such an image before anything executes from it.
+  if ! printf '%s\n' "$apple_image_snapshot" | jq -e '
+    (.[0].variants | type == "array" and length == 1)
+    and ((.[0].variants[0].config.config.Entrypoint // []) | length == 0)
+  ' >/dev/null 2>&1; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck refused this task image because it declares an ENTRYPOINT or multiple platform variants, which the Apple container runtime cannot safely override. Remove the ENTRYPOINT from the project's extra setup, then retry." \
+      "resolve task image identity"
+  fi
+else
+  if ! runtime_image_id=$(docker image inspect --format '{{.Id}}' \
+    "$runtime_image" 2>/dev/null); then
+    require_docker_after_failed_step "resolve task image identity"
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck could not resolve the exact local image for this task. Retry after the host image is available." \
+      "resolve task image identity"
+  fi
+  if ! printf '%s\n' "$runtime_image_id" \
+    | grep -Eq '^sha256:[0-9a-f]{64}$'; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Docker returned an invalid image identity for $runtime_image; Moondeck refused to start an unpinned task container." \
+      "resolve task image identity"
+  fi
+fi
+
+# Docker keeps image Config.Env entries whose names differ only by case from
+# later `docker exec -e` overrides. npm treats those spellings
+# case-insensitively and, depending on environment order, a mixed-case value
+# can beat both canonical values. Reject such an image before maintenance or
+# app creation; ordinary registry/auth npm config remains allowed, while the
+# four path/permission authorities must use one of the two spellings Uai can
+# deterministically replace.
+step "CONTAINER_INIT_FAILED" "verify task image npm authority"
+runtime_image_env_json=""
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  # From the same snapshot the identity pin came from — the single variant
+  # was already proven above.
+  runtime_image_env_json=$(printf '%s\n' "$apple_image_snapshot" \
+    | jq -c '.[0].variants[0].config.config.Env // []' 2>/dev/null) \
+    || runtime_image_env_json=""
+  if [ -z "$runtime_image_env_json" ]; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck could not inspect this task image's npm environment authority. Retry after the Apple container runtime is stable." \
+      "verify task image npm authority"
+  fi
+elif ! runtime_image_env_json=$(docker image inspect \
+  --format '{{json .Config.Env}}' "$runtime_image_id" 2>/dev/null); then
+  require_docker_after_failed_step "verify task image npm authority"
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Moondeck could not inspect this task image's npm environment authority. Retry after Docker is stable." \
+    "verify task image npm authority"
+fi
+if ! printf '%s\n' "$runtime_image_env_json" | jq -e '
+  def is_owned_npm_config($owned):
+    ascii_downcase as $folded
+    | ($folded | startswith("npm_config_"))
+      and (($owned | index($folded[11:] | gsub("_"; "-"))) != null);
+  (. // []) as $env
+  | [
+      "NPM_CONFIG_PREFIX", "npm_config_prefix",
+      "NPM_CONFIG_CACHE", "npm_config_cache",
+      "NPM_CONFIG_LOGS_DIR", "npm_config_logs_dir",
+      "NPM_CONFIG_UMASK", "npm_config_umask"
+    ] as $canonical
+  | [
+      "prefix", "cache", "logs-dir", "umask"
+    ] as $owned
+  | ($env | type == "array")
+    and all($env[]; type == "string")
+    and all($env[];
+      (split("=")[0]) as $key
+      | (($key | is_owned_npm_config($owned)) | not)
+        or (($canonical | index($key)) != null)
+    )
+' >/dev/null 2>&1; then
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Moondeck refused this task image because a mixed-case npm prefix/cache/log setting could redirect global package writes. Remove that image ENV setting (unrelated registry/auth settings remain supported) and retry." \
+    "verify task image npm authority"
+fi
+
+# Runtime installation is a host-maintenance phase, not task-container init.
+# Give the one-shot container only the immutable workspace view and the
+# explicitly writable host-wide asdf volume. Run it for every selected-project
+# task: projects without .tool-versions still use the image's proven root
+# defaults and may request a Corepack-managed package manager. A true
+# zero-project scratchpad has nothing to prepare and remains the only skip.
+# GNU timeout lives in the Debian standard image (and therefore every derived
+# image); it bounds the shared lock wait plus all installs and positive
+# verification without leaving an orphaned volume writer when the cloud's
+# 15-minute RPC deadline expires.
+if [ "$project_count" -gt 0 ]; then
+  step "CONTAINER_INIT_FAILED" "materialize task runtimes"
+  materialization_rc=0
+  if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+    # ADR-108: the shared volume is never written on the task path. Apple
+    # materialization runs INSIDE the app container after the in-guest
+    # overlay is established (section 6a below) — a missing toolchain
+    # installs into the task's own upper layer with zero shared-volume
+    # coordination, at any task count.
+    log "apple runtime materialization runs in-container after the overlay is established"
+  else
+    run_runtime_materializer "$runtime_image_id" || materialization_rc=$?
+  fi
+  if [ "$materialization_rc" -ne 0 ]; then
+    require_docker_after_failed_step "materialize task runtimes"
+    case "$materialization_rc" in
+      124|137)
+        emit_err "CONTAINER_INIT_FAILED" \
+          "Runtime materialization did not finish inside the station's 10-minute startup budget. Retry the task: Moondeck will re-check every required runtime and package manager before it starts any task container, and will not trust a partial cache." \
+          "materialize task runtimes"
+        ;;
+      *)
+        emit_err "CONTAINER_INIT_FAILED" \
+          "Moondeck could not install and verify every runtime and package manager needed by this task. Check the project's .tool-versions and packageManager entries and the host's network and disk availability, then retry." \
+          "materialize task runtimes"
+        ;;
+    esac
+  fi
+else
+  log "zero-project scratchpad — skipping runtime materialization"
+fi
+
+# -----------------------------------------------------------------------------
+# 6. Compose up.
+# -----------------------------------------------------------------------------
+
+step "COMPOSE_UP_FAILED" "start task container"
+# Limit the supplied values to keys the selected projects actually declare,
+# then remove Uai-managed names and preview URL names. Both runtimes consume
+# the same filtered object: Docker merges it as a Compose stdin override, and
+# the Apple path serializes it into a transient env-file below. JSON is valid
+# YAML, so Compose can merge this secret-bearing override directly from stdin
+# without a temporary env/YAML file and without exporting any value to host
+# commands.
+preview_env_raw=$(jq -r '.[0].preview_env // "{}"' <<<"$task_json")
+filtered_project_env='{}'
+if [ "$UAI_PROJECT_ENV_MODE" = "baked" ]; then
+  filtered_project_env=$(printf '%s' "$project_env_json" \
+    | filter_baked_project_env "$union_env_keys_json" "$preview_env_raw")
+fi
+compose_env_override=""
+if [ "$TASK_RUNTIME_MODE" = "docker" ]; then
+  compose_env_override=$(printf '%s\n' "$filtered_project_env" | jq -c \
+    --arg image "$runtime_image_id" \
+    '{services:{app:{environment:.,image:$image,pull_policy:"never"}}}')
+fi
+
+# Detect a tag replacement that completed during materialization and fail with
+# a clear retry instead of starting a task under a stale generation. The
+# immutable stdin override below also closes the remaining recheck→up window.
+step "CONTAINER_INIT_FAILED" "verify task image identity"
+current_runtime_image_id=""
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  if ! current_runtime_image_id=$("$CONTAINER_CLI" image inspect \
+    "$runtime_image" 2>/dev/null | jq -r '.[0].id // empty' 2>/dev/null); then
+    require_docker_after_failed_step "verify task image identity"
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck could not re-check this task's image after runtime materialization. Retry after the Apple container runtime is stable." \
+      "verify task image identity"
+  fi
+elif ! current_runtime_image_id=$(docker image inspect --format '{{.Id}}' \
+  "$runtime_image" 2>/dev/null); then
+  require_docker_after_failed_step "verify task image identity"
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Moondeck could not re-check this task's image after runtime materialization. Retry after Docker is stable." \
+    "verify task image identity"
+fi
+if [ "$current_runtime_image_id" != "$runtime_image_id" ]; then
+  emit_err "CONTAINER_INIT_FAILED" \
+    "This task's image changed while Moondeck was materializing runtimes. Retry so the new image receives a complete runtime proof before any task container starts." \
+    "verify task image identity"
+fi
+reject_workspace_runtime_shadow
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  step "COMPOSE_UP_FAILED" "start task container"
+  # The Apple CLI takes environment through an env-file whose values are read
+  # verbatim from the first `=` to the newline. A value containing a newline
+  # cannot survive that framing — refuse it rather than truncate a secret.
+  if ! printf '%s\n' "$filtered_project_env" | jq -e \
+    'to_entries | all(.value | type == "string" and (test("[\r\n]") | not))' \
+    >/dev/null 2>&1; then
+    emit_err "COMPOSE_UP_FAILED" \
+      "A project environment value contains a newline, which the Apple container runtime cannot pass through its env-file. Store the value single-line (for example base64) or run this task on a Docker host." \
+      "start task container"
+  fi
+  task_env_file=$(mktemp "$task_uai_dir/.task-env.XXXXXX")
+  chmod 0600 "$task_env_file"
+  {
+    # Mirrors the Compose service environment exactly (see the rendered
+    # docker-compose.yml for the rationale on each block). Later lines win in
+    # both dialects, so ordering here preserves the Compose precedence:
+    # static authority, engine tokens, declared project values, preview env.
+    printf 'UAI_GIT_TRANSPORT=%s\n' "$uai_git_transport"
+    printf 'GH_CONFIG_DIR=/home/node/.config/gh\n'
+    printf 'PATH=%s\n' "$TASK_RUNTIME_PATH"
+    printf 'HOME=/home/node\n'
+    printf 'XDG_CONFIG_HOME=/home/node/.config\n'
+    printf 'XDG_DATA_HOME=/home/node/.local/share\n'
+    printf 'XDG_CACHE_HOME=/home/node/.cache\n'
+    printf 'ASDF_DIR=/opt/asdf\n'
+    printf 'ASDF_DATA_DIR=/opt/asdf-data\n'
+    printf 'ASDF_CONFIG_FILE=/dev/null\n'
+    printf 'ASDF_DEFAULT_TOOL_VERSIONS_FILENAME=.tool-versions\n'
+    printf 'ASDF_NODEJS_VERSION=\n'
+    printf 'ASDF_PYTHON_VERSION=\n'
+    printf 'ASDF_GOLANG_VERSION=\n'
+    printf 'ASDF_RUBY_VERSION=\n'
+    printf 'ASDF_RUST_VERSION=\n'
+    printf 'ASDF_SKIP_RESHIM=1\n'
+    printf 'COREPACK_HOME=/opt/asdf-data/corepack\n'
+    printf 'COREPACK_DEFAULT_TO_LATEST=0\n'
+    printf 'COREPACK_ENV_FILE=0\n'
+    printf 'COREPACK_NPM_REGISTRY=https://registry.npmjs.org\n'
+    printf 'COREPACK_ENABLE_NETWORK=0\n'
+    printf 'COREPACK_ENABLE_AUTO_PIN=0\n'
+    printf 'COREPACK_ENABLE_DOWNLOAD_PROMPT=0\n'
+    printf 'COREPACK_ENABLE_PROJECT_SPEC=1\n'
+    printf 'COREPACK_ENABLE_STRICT=1\n'
+    printf 'COREPACK_ENABLE_UNSAFE_CUSTOM_URLS=0\n'
+    printf 'COREPACK_INTEGRITY_CHECK=1\n'
+    printf 'NPM_CONFIG_PREFIX=%s\n' "$TASK_NPM_PREFIX"
+    printf 'npm_config_prefix=%s\n' "$TASK_NPM_PREFIX"
+    printf 'NPM_CONFIG_CACHE=%s\n' "$TASK_NPM_CACHE"
+    printf 'npm_config_cache=%s\n' "$TASK_NPM_CACHE"
+    printf 'NPM_CONFIG_LOGS_DIR=%s/_logs\n' "$TASK_NPM_CACHE"
+    printf 'npm_config_logs_dir=%s/_logs\n' "$TASK_NPM_CACHE"
+    printf 'NPM_CONFIG_UMASK=0002\n'
+    printf 'npm_config_umask=0002\n'
+    # ADR-118: pnpm's store must live on the task's block volume, never on
+    # the virtiofs workspace (pnpm's same-filesystem fallback would drop it
+    # at the workspace root). Env beats a project .npmrc, so repos need no
+    # config. Cross-filesystem hard links are impossible; pnpm's
+    # package-import-method=auto falls back to copying, which is correct.
+    printf 'NPM_CONFIG_STORE_DIR=%s\n' "$TASK_STORE_DIR"
+    printf 'npm_config_store_dir=%s\n' "$TASK_STORE_DIR"
+    printf 'UAI_WORKSPACE=/workspace\n'
+    printf 'UAI_RUNTIME_PROJECTS=/run/uai/runtime-projects\n'
+    printf 'UAI_ENV_MODE=%s\n' "$UAI_PROJECT_ENV_MODE"
+    printf 'UAI_ENV_HOOK=0\n'
+    printf 'SHELL=/usr/bin/zsh\n'
+    printf 'LD_PRELOAD=\n'
+    printf 'LD_AUDIT=\n'
+    printf 'LD_LIBRARY_PATH=\n'
+    printf 'NODE_OPTIONS=\n'
+    printf 'NODE_PATH=\n'
+    printf 'PS4=\n'
+    printf 'BASH_ENV=\n'
+    printf 'ENV=\n'
+    if [ "$uai_on_cloud_credentials" != "1" ]; then
+      printf 'CLAUDE_CODE_OAUTH_TOKEN=%s\n' "${CLAUDE_CODE_OAUTH_TOKEN:-}"
+      printf 'ANTHROPIC_API_KEY=%s\n' "${ANTHROPIC_API_KEY:-}"
+      printf 'ANTHROPIC_AUTH_TOKEN=%s\n' "${ANTHROPIC_AUTH_TOKEN:-}"
+      printf 'XAI_API_KEY=%s\n' "${XAI_API_KEY:-}"
+    fi
+    printf 'PLAYWRIGHT_BROWSERS_PATH=/opt/pw-browsers\n'
+    if [ "$UAI_PROJECT_ENV_MODE" = "loader" ]; then
+      while IFS= read -r ekey; do
+        [ -n "$ekey" ] || continue
+        is_reserved_task_env_name "$ekey" && continue
+        printf '%s=\n' "$ekey"
+      done < <(jq -r '.[]' <<<"$union_env_keys_json")
+    else
+      printf '%s\n' "$filtered_project_env" \
+        | jq -r 'to_entries[] | "\(.key)=\(.value)"'
+    fi
+    while IFS= read -r pe_entry; do
+      [ -n "$pe_entry" ] || continue
+      pe_key=$(jq -r '.key' <<<"$pe_entry")
+      pe_val=$(jq -r '.value' <<<"$pe_entry")
+      [ -n "$pe_key" ] || continue
+      if [ "$pe_key" != "UAI_EDITOR_THEME" ] \
+         && is_reserved_task_env_name "$pe_key"; then
+        continue
+      fi
+      if [ "$UAI_PROJECT_ENV_MODE" = "loader" ]; then
+        printf '%s=\n' "$pe_key"
+      else
+        printf '%s=%s\n' "$pe_key" "$pe_val"
+      fi
+    done < <(jq -c 'to_entries[]?' <<<"$preview_env_raw")
+  } > "$task_env_file"
+  # The mount set matches the rendered Compose file's app service one-for-one
+  # (minus host-gateway and group_add, which have no Apple equivalent and are
+  # not needed — ownership maps transparently across the VM boundary).
+  apple_run_args=(
+    -v "$task_workspace:/workspace"
+    -v "$task_workspace:$task_workspace"
+  )
+  if [ "$task_workspace_physical" != "$task_workspace" ]; then
+    apple_run_args+=( -v "$task_workspace:$task_workspace_physical" )
+  fi
+  while IFS= read -r vol_obj; do
+    [ -n "$vol_obj" ] || continue
+    vol_pid=$(jq -r '.id' <<<"$vol_obj")
+    apple_run_args+=(
+      -v "$task_uai_dir/repos/$vol_pid.git:$task_uai_dir/repos/$vol_pid.git"
+    )
+    if [ "$task_uai_dir_physical" != "$task_uai_dir" ]; then
+      apple_run_args+=(
+        -v "$task_uai_dir/repos/$vol_pid.git:$task_uai_dir_physical/repos/$vol_pid.git"
+      )
+    fi
+  done < <(jq -c '.[]' <<<"$projects_json")
+  apple_run_args+=(
+    -v "$UAI_INIT_SOURCE:/usr/local/bin/uai-init:ro"
+    -v "$MOONDECK_CLI_SOURCE:/usr/local/bin/moondeck:ro"
+    -v "$runtime_projects_file:/run/uai/runtime-projects:ro"
+    -v "$managed_env_keys_file:/run/uai/managed-env-keys:ro"
+    # ADR-108: the shared volume attaches READ-ONLY at a staging path and an
+    # in-guest overlay presents it writable at /opt/asdf-data (upper = the
+    # task's own layer). The shared volume is never written on the task path,
+    # so any number of tasks coexist and first-time installs need no window.
+    -v "$ASDF_VOLUME:/run/uai/asdf-lower:ro"
+    # In-container materialization (post-overlay) uses the packaged current
+    # materializer + Corepack pin, exactly like the retired maintenance
+    # container did.
+    -v "$RUNTIME_MATERIALIZER_SOURCE:/usr/local/bin/uai-materialize-runtimes:ro"
+    -v "$COREPACK_VERSION_SOURCE:/usr/local/share/uai/corepack-version:ro"
+    -v "$PW_BROWSERS_DIR:/opt/pw-browsers"
+    # ADR-118: task-private store volume, writable — created and
+    # ownership-proven above; single-attach by runtime construction.
+    -v "$TASK_STORE_VOLUME:$TASK_STORE_MOUNT"
+  )
+  if [ "$UAI_PROJECT_ENV_MODE" = "loader" ]; then
+    apple_run_args+=(
+      -v "$ENV_HOOK_SOURCE:/usr/local/share/uai/env-hook.sh:ro"
+      -v "$UAI_ENV_EXEC_SOURCE:/usr/local/bin/uai-env-exec:ro"
+      -v "$TASK_FORWARDER_SOURCE:/usr/local/share/uai/uai-task-forwarder.mjs:ro"
+    )
+  fi
+  if [ "$shared_files_mode" != "off" ]; then
+    shared_suffix=""
+    [ "$shared_files_mode" = "ro" ] && shared_suffix=":ro"
+    if [ -n "$shared_owner_org" ]; then
+      apple_run_args+=(
+        -v "$shared_root/orgs/$shared_owner_org:/workspace/files/org$shared_suffix"
+      )
+    fi
+    if [ -n "$shared_owner_user" ]; then
+      apple_run_args+=(
+        -v "$shared_root/users/$shared_owner_user:/workspace/files/me$shared_suffix"
+      )
+    fi
+  fi
+  apple_up_rc=0
+  # CAP_SYS_ADMIN: required for the ADR-108 in-guest overlay mount.
+  # CAP_NET_ADMIN: the ADR-153 secrets proxy's NAT chain, set by the runner's
+  # root execs (node has no sudo). Both are confined by the VM boundary: the
+  # guest kernel is the task's own, so they grant nothing on the host.
+  "$CONTAINER_CLI" run -d --init \
+    --name "$app_container" \
+    -l "io.moondeck.task=$task_id" \
+    --cap-add CAP_SYS_ADMIN \
+    --cap-add CAP_NET_ADMIN \
+    --workdir /workspace \
+    --memory "$APPLE_TASK_MEMORY" \
+    --cpus "$APPLE_TASK_CPUS" \
+    --env-file "$task_env_file" \
+    "${apple_run_args[@]}" \
+    "$runtime_image" >/dev/null || apple_up_rc=$?
+  rm -f "$task_env_file"
+  if [ "$apple_up_rc" -ne 0 ]; then
+    require_docker_after_failed_step "start task container"
+    emit_err "COMPOSE_UP_FAILED" \
+      "Moondeck could not start this task's container on the Apple container runtime. Retry the task." \
+      "start task container"
+  fi
+  # The runtime cannot start a container by immutable image id, so prove the
+  # tag still resolves to the pinned bytes now that the container exists. A
+  # concurrent retag loses either way: before create, the recheck above; here,
+  # the container is quarantined before credentials are installed.
+  apple_post_up_image_id=$("$CONTAINER_CLI" image inspect "$runtime_image" \
+    2>/dev/null | jq -r '.[0].id // empty' 2>/dev/null) \
+    || apple_post_up_image_id=""
+  if [ "$apple_post_up_image_id" != "$runtime_image_id" ]; then
+    if ! quarantine_untrusted_app_container; then
+      emit_err "CONTAINER_INIT_FAILED" \
+        "This task's image changed while its container was being created, and Moondeck could not prove the container stopped. Stop it manually before retrying." \
+        "verify task image identity"
+    fi
+    emit_err "CONTAINER_INIT_FAILED" \
+      "This task's image changed while its container was being created. Retry so the new image receives a complete runtime proof first." \
+      "verify task image identity"
+  fi
+else
+  step "COMPOSE_UP_FAILED" "docker compose up -d"
+  compose_up_error=""
+  # Keep the diagnostic in memory only, but bound it: a broken plugin or
+  # daemon must not make task-up retain an arbitrarily large stderr stream.
+  # Docker's allocation error is emitted at the end of Compose's failure.
+  if ! compose_up_error=$(printf '%s\n' "$compose_env_override" \
+    | docker compose -p "$compose_project" \
+      -f "$task_uai_dir/docker-compose.yml" -f - up -d --no-build \
+      2>&1 >/dev/null | tail -c 65536); then
+    [ -z "$compose_up_error" ] || printf '%s\n' "$compose_up_error" >&2
+    require_docker_after_failed_step "docker compose up -d"
+    if printf '%s\n' "$compose_up_error" \
+      | grep -Fq 'all predefined address pools have been fully subnetted'; then
+      emit_err "COMPOSE_UP_FAILED" \
+        "Docker has no subnet left for this task. Moondeck already reclaimed every empty task network it could prove safe. Close an unused stopped/error task, or enlarge Docker's non-overlapping default address pools and restart Docker, then press Resume." \
+        "docker compose up -d"
+    fi
+    emit_err "COMPOSE_UP_FAILED" \
+      "Moondeck could not start this task's Docker Compose stack. Fix the Docker error above, then press Resume." \
+      "docker compose up -d"
+  fi
+  unset compose_up_error
+fi
+
+# Rendered YAML is not runtime evidence: Compose could reuse unexpected state,
+# or a compatibility bug could silently drop `:ro`. Inspect the exact created
+# app before it receives credentials. There must be one named volume at this
+# destination, with Docker itself reporting the mount read-only, and the same
+# shared volume must not be exposed again at any other destination.
+step "CONTAINER_INIT_FAILED" "verify task runtime isolation"
+app_mounts_json=""
+apple_app_snapshot=""
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  # One container snapshot backs both the mount and environment proofs, so
+  # they describe the same observed state.
+  apple_app_snapshot=$(crt inspect "$app_container" 2>/dev/null) \
+    || apple_app_snapshot=""
+  app_mounts_json=$(printf '%s\n' "$apple_app_snapshot" \
+    | jq -c '.[0].configuration.mounts // empty' 2>/dev/null) \
+    || app_mounts_json=""
+fi
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ] \
+   && [ -z "$app_mounts_json" ]; then
+  require_docker_after_failed_step "inspect task runtime isolation"
+  if ! quarantine_untrusted_app_container; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck could not inspect or stop the task container before credentials were installed. Stop it manually before retrying." \
+      "verify task runtime isolation"
+  fi
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Moondeck could not inspect the task container's shared runtime mount. Retry to recreate it safely." \
+    "verify task runtime isolation"
+elif [ "$TASK_RUNTIME_MODE" = "docker" ] \
+  && ! app_mounts_json=$(docker inspect --format '{{json .Mounts}}' \
+  "$app_container" 2>/dev/null); then
+  require_docker_after_failed_step "inspect task runtime isolation"
+  if ! quarantine_untrusted_app_container; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck could not inspect or stop the task container before credentials were installed. Stop it manually before retrying." \
+      "verify task runtime isolation"
+  fi
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Moondeck could not inspect the task container's shared runtime mount. Retry to recreate it safely." \
+    "verify task runtime isolation"
+fi
+app_config_env_json=""
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  app_config_env_json=$(printf '%s\n' "$apple_app_snapshot" \
+    | jq -c '.[0].configuration.initProcess.environment // empty' \
+    2>/dev/null) || app_config_env_json=""
+fi
+if { [ "$TASK_RUNTIME_MODE" = "apple-container" ] \
+     && [ -z "$app_config_env_json" ]; } \
+   || { [ "$TASK_RUNTIME_MODE" = "docker" ] \
+     && ! app_config_env_json=$(docker inspect \
+       --format '{{json .Config.Env}}' "$app_container" 2>/dev/null); }; then
+  require_docker_after_failed_step "inspect task runtime environment"
+  if ! quarantine_untrusted_app_container; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck could not inspect or stop the task container before credentials were installed. Stop it manually before retrying." \
+      "verify task runtime isolation"
+  fi
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Moondeck could not inspect the task container's runtime environment. Retry to recreate it safely." \
+    "verify task runtime isolation"
+fi
+# The two runtimes report mounts in different shapes; each filter asserts the
+# same contract — exactly one /opt/asdf-data mount, it is the shared
+# moondeck-asdf-data volume, the runtime itself reports it read-only, and that
+# volume appears at no other destination.
+mounts_proof_filter='
+  [ .[] | select(.Destination == "/opt/asdf-data") ] as $runtime
+  | [ .[] | select(.Name? == "moondeck-asdf-data") ] as $shared
+  | ($runtime | length) == 1
+    and ($shared | length) == 1
+    and $runtime[0].Type == "volume"
+    and $runtime[0].Name == "moondeck-asdf-data"
+    and $runtime[0].RW == false
+'
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  # ADR-108: the shared volume attaches READ-ONLY at the overlay staging
+  # path, appears nowhere else, and /opt/asdf-data is NOT a host mount at
+  # all — the writable view there is the in-guest overlay, proven from
+  # inside the guest right after this (host inspect cannot see guest
+  # mounts).
+  mounts_proof_filter='
+    [ .[] | select(.destination == "/run/uai/asdf-lower") ] as $runtime
+    | [ .[] | select((.type.volume.name? // "") == "moondeck-asdf-data") ] as $shared
+    | [ .[] | select(.destination == $store_mount) ] as $store
+    | [ .[] | select((.type.volume.name? // "") == $store_volume) ] as $store_vol
+    | ($runtime | length) == 1
+      and ($shared | length) == 1
+      and (($runtime[0].type.volume.name? // "") == "moondeck-asdf-data")
+      and ((($runtime[0].options // []) | index("ro")) != null)
+      and ((($runtime[0].options // []) | index("rw")) == null)
+      and (([ .[] | select(.destination == "/opt/asdf-data") ] | length) == 0)
+      # ADR-118: the task-private store volume attaches WRITABLE at exactly
+      # its one mount point, and no other volume occupies that path.
+      and ($store | length) == 1
+      and ($store_vol | length) == 1
+      and (($store[0].type.volume.name? // "") == $store_volume)
+      and ((($store[0].options // []) | index("ro")) == null)
+  '
+fi
+if ! printf '%s\n' "$app_mounts_json" \
+  | jq -e \
+    --arg store_mount "$TASK_STORE_MOUNT" \
+    --arg store_volume "$TASK_STORE_VOLUME" \
+    "$mounts_proof_filter" >/dev/null 2>&1; then
+  if ! quarantine_untrusted_app_container; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck found an unsafe shared runtime mount and could not prove the task container stopped. Stop it manually before retrying." \
+      "verify task runtime isolation"
+  fi
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Moondeck stopped this task because its shared runtime cache was not the exact read-only moondeck-asdf-data volume. Retry to recreate the container safely." \
+    "verify task runtime isolation"
+fi
+# ADR-118: the store authority exists only on the apple path (Docker tasks
+# keep pnpm's default resolution); an empty $store keeps the historical
+# docker proof byte-for-byte.
+env_proof_store_dir=""
+[ "$TASK_RUNTIME_MODE" != "apple-container" ] \
+  || env_proof_store_dir="$TASK_STORE_DIR"
+if ! printf '%s\n' "$app_config_env_json" | jq -e \
+  --arg path "$TASK_RUNTIME_PATH" \
+  --arg prefix "$TASK_NPM_PREFIX" \
+  --arg cache "$TASK_NPM_CACHE" \
+  --arg store "$env_proof_store_dir" '
+  def is_owned_npm_config($owned):
+    ascii_downcase as $folded
+    | ($folded | startswith("npm_config_"))
+      and (($owned | index($folded[11:] | gsub("_"; "-"))) != null);
+  (. // []) as $env
+  | ([
+      "NPM_CONFIG_PREFIX=\($prefix)",
+      "npm_config_prefix=\($prefix)",
+      "NPM_CONFIG_CACHE=\($cache)",
+      "npm_config_cache=\($cache)",
+      "NPM_CONFIG_LOGS_DIR=\($cache)/_logs",
+      "npm_config_logs_dir=\($cache)/_logs",
+      "NPM_CONFIG_UMASK=0002",
+      "npm_config_umask=0002"
+    ]
+    + (if $store != "" then [
+        "NPM_CONFIG_STORE_DIR=\($store)",
+        "npm_config_store_dir=\($store)"
+      ] else [] end)) as $required
+  | ([
+      "prefix", "cache", "logs-dir", "umask"
+    ]
+    + (if $store != "" then ["store-dir"] else [] end)) as $owned
+  | ($env | type == "array")
+    and all($env[]; type == "string")
+    and all($required[];
+      . as $required_value
+      | ([ $env[] | select(. == $required_value) ] | length) == 1
+    )
+    and ([
+      $env[]
+      | split("=")[0]
+      | select(is_owned_npm_config($owned))
+    ] | length) == ($required | length)
+    and ([ $env[] | select(. == "PATH=\($path)") ] | length) == 1
+    and ([ $env[] | select(. == "ASDF_DATA_DIR=/opt/asdf-data") ] | length) == 1
+    and ([ $env[] | select(. == "ASDF_SKIP_RESHIM=1") ] | length) == 1
+    and ([ $env[] | select(. == "COREPACK_HOME=/opt/asdf-data/corepack") ] | length) == 1
+    and ([ $env[] | select(. == "COREPACK_ENABLE_NETWORK=0") ] | length) == 1
+' >/dev/null 2>&1; then
+  if ! quarantine_untrusted_app_container; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck found an unsafe task runtime environment and could not prove the container stopped. Stop it manually before retrying." \
+      "verify task runtime isolation"
+  fi
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Moondeck stopped this task because its runtime/npm environment did not match the fixed private-prefix and read-only-cache authority. Retry to recreate the container safely." \
+    "verify task runtime isolation"
+fi
+
+# -----------------------------------------------------------------------------
+# 6a. ADR-108 (apple only): establish the in-guest runtime overlay, then
+#     materialize runtimes INSIDE the container. The shared volume is never
+#     written on the task path: the read-only lower proved above merges under
+#     a task-private upper layer, so a missing toolchain installs into this
+#     task's own layer with zero shared-volume coordination. Both steps run
+#     before any credential, editor, or agent work; a failure quarantines the
+#     container exactly like the isolation proofs above.
+# -----------------------------------------------------------------------------
+
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  step "CONTAINER_INIT_FAILED" "establish task runtime overlay"
+  overlay_rc=0
+  "$CONTAINER_CLI" exec -u root "$app_container" /bin/sh -c '
+    set -e
+    /bin/mkdir -p /var/lib/uai/asdf-upper /var/lib/uai/asdf-work /opt/asdf-data
+    # The merged root inherits the UPPER directory'"'"'s metadata; without this
+    # the node user cannot write the merged view at all (live 2026-08-18).
+    /bin/chown node:node /var/lib/uai/asdf-upper
+    if ! /bin/grep -q "^overlay /opt/asdf-data overlay " /proc/mounts; then
+      /bin/mount -t overlay overlay \
+        -o lowerdir=/run/uai/asdf-lower,upperdir=/var/lib/uai/asdf-upper,workdir=/var/lib/uai/asdf-work \
+        /opt/asdf-data
+    fi
+    # Prove the exact shape from the guest mount table, not from trust —
+    # token-exact (comma-delimited; substring matching accepted
+    # lowerdir=/run/uai/asdf-lower-evil), exactly ONE effective mount at the
+    # merged path and at the lower, a read-only lower, and a real node-owned
+    # upper directory.
+    overlay_lines=$(/bin/grep -c "^overlay /opt/asdf-data overlay " /proc/mounts || true)
+    [ "$overlay_lines" = "1" ] || { echo "expected exactly one /opt/asdf-data overlay, found $overlay_lines" >&2; exit 1; }
+    any_lines=$(/bin/grep -c " /opt/asdf-data " /proc/mounts || true)
+    [ "$any_lines" = "1" ] || { echo "unexpected extra mounts at /opt/asdf-data" >&2; exit 1; }
+    opts=$(/bin/grep "^overlay /opt/asdf-data overlay " /proc/mounts | /usr/bin/cut -d" " -f4)
+    case ",$opts," in *",lowerdir=/run/uai/asdf-lower,"*) ;; *) echo "overlay lower is foreign" >&2; exit 1 ;; esac
+    case ",$opts," in *",upperdir=/var/lib/uai/asdf-upper,"*) ;; *) echo "overlay upper is foreign" >&2; exit 1 ;; esac
+    case ",$opts," in *",workdir=/var/lib/uai/asdf-work,"*) ;; *) echo "overlay workdir is foreign" >&2; exit 1 ;; esac
+    case ",$opts," in *",ro,"*) echo "overlay is unexpectedly read-only" >&2; exit 1 ;; esac
+    lower_lines=$(/bin/grep -c " /run/uai/asdf-lower " /proc/mounts || true)
+    [ "$lower_lines" = "1" ] || { echo "expected exactly one lower attachment, found $lower_lines" >&2; exit 1; }
+    lopts=$(/bin/grep " /run/uai/asdf-lower " /proc/mounts | /usr/bin/cut -d" " -f4)
+    case ",$lopts," in *",ro,"*) ;; *) echo "lower attachment is not read-only" >&2; exit 1 ;; esac
+    [ ! -L /var/lib/uai/asdf-upper ] || { echo "upper is a symlink" >&2; exit 1; }
+    [ -d /var/lib/uai/asdf-upper ] || { echo "upper is not a directory" >&2; exit 1; }
+    [ "$(/usr/bin/stat -c %U /var/lib/uai/asdf-upper)" = "node" ] || { echo "upper is not node-owned" >&2; exit 1; }
+    /usr/bin/test -d /opt/asdf-data/plugins
+    # ADR-118: the store volume is a fresh ext4 with a root-owned root; hand
+    # the pnpm store dir to node and prove the attachment from the guest
+    # mount table — exactly one writable mount at the store path.
+    store_lines=$(/bin/grep -c " /opt/uai/store " /proc/mounts || true)
+    [ "$store_lines" = "1" ] || { echo "expected exactly one /opt/uai/store mount, found $store_lines" >&2; exit 1; }
+    sopts=$(/bin/grep " /opt/uai/store " /proc/mounts | /usr/bin/cut -d" " -f4)
+    case ",$sopts," in *",ro,"*) echo "store volume is unexpectedly read-only" >&2; exit 1 ;; esac
+    /bin/mkdir -p /opt/uai/store/pnpm
+    /bin/chown node:node /opt/uai/store /opt/uai/store/pnpm
+    [ "$(/usr/bin/stat -c %U /opt/uai/store/pnpm)" = "node" ] || { echo "store dir is not node-owned" >&2; exit 1; }
+  ' >/dev/null || overlay_rc=$?
+  if [ "$overlay_rc" -ne 0 ]; then
+    require_docker_after_failed_step "establish task runtime overlay"
+    if ! quarantine_untrusted_app_container; then
+      emit_err "CONTAINER_INIT_FAILED" \
+        "Moondeck could not establish this task's runtime overlay, and could not prove the container stopped. Stop it manually before retrying." \
+        "establish task runtime overlay"
+    fi
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck could not establish this task's runtime overlay on the Apple container runtime. Retry the task." \
+      "establish task runtime overlay"
+  fi
+
+  if [ "$project_count" -gt 0 ]; then
+    step "CONTAINER_INIT_FAILED" "materialize task runtimes in container"
+    materialization_rc=0
+    "$CONTAINER_CLI" exec -u node -w /workspace "$app_container" \
+      /usr/bin/env -i \
+      HOME=/home/node \
+      ASDF_DIR=/opt/asdf \
+      ASDF_DATA_DIR=/opt/asdf-data \
+      PATH=/opt/asdf-data/shims:/opt/asdf/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
+      /usr/bin/timeout --signal=TERM --kill-after=10s 600s \
+      /usr/local/bin/uai-materialize-runtimes >&2 || materialization_rc=$?
+    if [ "$materialization_rc" -ne 0 ]; then
+      require_docker_after_failed_step "materialize task runtimes in container"
+      if ! quarantine_untrusted_app_container; then
+        emit_err "CONTAINER_INIT_FAILED" \
+          "Runtime materialization failed and Moondeck could not prove the task container stopped. Stop it manually before retrying." \
+          "materialize task runtimes in container"
+      fi
+      case "$materialization_rc" in
+        124|137)
+          emit_err "CONTAINER_INIT_FAILED" \
+            "Runtime materialization did not finish inside the station's 10-minute startup budget. Retry the task: Moondeck re-checks every required runtime and package manager before agents start." \
+            "materialize task runtimes in container"
+          ;;
+        *)
+          emit_err "CONTAINER_INIT_FAILED" \
+            "Moondeck could not install and verify every runtime and package manager needed by this task. Check the project's .tool-versions and packageManager entries and the host's network availability, then retry." \
+            "materialize task runtimes in container"
+          ;;
+      esac
+    fi
+  fi
+fi
+
+# -----------------------------------------------------------------------------
+# 7. Container init — copy AI creds in, install deps, launch code-server.
+# -----------------------------------------------------------------------------
+
+step "CONTAINER_INIT_FAILED" "uai-init (deps + code-server)"
+
+# `docker exec` inherits the project environment from Compose. Override loader
+# and config variables before the first executable starts, then use `env -i`
+# plus absolute command paths so a project value cannot redirect this managed
+# credential operation to workspace code or another config directory.
+managed_gh_config_dir="/home/node/.config/gh"
+managed_exec_env=(
+  -e "HOME=/home/node"
+  -e "GH_CONFIG_DIR=$managed_gh_config_dir"
+  -e "PATH=/usr/bin:/bin"
+  -e "XDG_CONFIG_HOME="
+  -e "XDG_DATA_HOME="
+  -e "XDG_CACHE_HOME="
+  -e "ASDF_DIR=/opt/asdf"
+  -e "ASDF_DATA_DIR=/opt/asdf-data"
+  -e "ASDF_CONFIG_FILE=/dev/null"
+  -e "ASDF_DEFAULT_TOOL_VERSIONS_FILENAME=.tool-versions"
+  -e "ASDF_NODEJS_VERSION="
+  -e "ASDF_PYTHON_VERSION="
+  -e "ASDF_GOLANG_VERSION="
+  -e "ASDF_RUBY_VERSION="
+  -e "ASDF_RUST_VERSION="
+  -e "ASDF_SKIP_RESHIM=1"
+  -e "COREPACK_HOME=/opt/asdf-data/corepack"
+  -e "COREPACK_DEFAULT_TO_LATEST=0"
+  -e "COREPACK_ENV_FILE=0"
+  -e "COREPACK_NPM_REGISTRY=https://registry.npmjs.org"
+  -e "COREPACK_ENABLE_NETWORK=0"
+  -e "COREPACK_ENABLE_AUTO_PIN=0"
+  -e "COREPACK_ENABLE_DOWNLOAD_PROMPT=0"
+  -e "COREPACK_ENABLE_PROJECT_SPEC=1"
+  -e "COREPACK_ENABLE_STRICT=1"
+  -e "COREPACK_ENABLE_UNSAFE_CUSTOM_URLS=0"
+  -e "COREPACK_INTEGRITY_CHECK=1"
+  -e "NPM_CONFIG_PREFIX=$TASK_NPM_PREFIX"
+  -e "npm_config_prefix=$TASK_NPM_PREFIX"
+  -e "NPM_CONFIG_CACHE=$TASK_NPM_CACHE"
+  -e "npm_config_cache=$TASK_NPM_CACHE"
+  -e "NPM_CONFIG_LOGS_DIR=$TASK_NPM_CACHE/_logs"
+  -e "npm_config_logs_dir=$TASK_NPM_CACHE/_logs"
+  -e "NPM_CONFIG_UMASK=0002"
+  -e "npm_config_umask=0002"
+  -e "LD_PRELOAD="
+  -e "LD_AUDIT="
+  -e "LD_LIBRARY_PATH="
+  -e "DYLD_INSERT_LIBRARIES="
+  -e "DYLD_LIBRARY_PATH="
+  -e "UAI_ENV_HOOK=0"
+  -e "BASH_ENV="
+  -e "ENV="
+  -e "GIT_CONFIG="
+  -e "GIT_CONFIG_GLOBAL="
+  -e "GIT_CONFIG_SYSTEM="
+  -e "GIT_CONFIG_NOSYSTEM="
+  -e "GIT_CONFIG_COUNT=0"
+  -e "GIT_EXEC_PATH="
+  -e "GIT_SSH="
+  -e "GIT_SSH_COMMAND="
+  -e "GIT_ASKPASS="
+  -e "SSH_ASKPASS="
+  -e "GH_TOKEN="
+  -e "GITHUB_TOKEN="
+)
+managed_clean_env=(
+  /usr/bin/env -i
+  "HOME=/home/node"
+  "GH_CONFIG_DIR=$managed_gh_config_dir"
+  "PATH=/usr/bin:/bin"
+)
+
+# Runtime-bearing task initialization gets the same fixed environment as
+# Compose and agent launches. Unlike the root/control array above, this path
+# includes task-private global packages last so unique tools are usable while
+# they remain unable to shadow shared shims or system controls.
+task_runtime_exec_env=(
+  -e "HOME=/home/node"
+  -e "PATH=$TASK_RUNTIME_PATH"
+  -e "XDG_CONFIG_HOME=/home/node/.config"
+  -e "XDG_DATA_HOME=/home/node/.local/share"
+  -e "XDG_CACHE_HOME=/home/node/.cache"
+  -e "ASDF_DIR=/opt/asdf"
+  -e "ASDF_DATA_DIR=/opt/asdf-data"
+  -e "ASDF_CONFIG_FILE=/dev/null"
+  -e "ASDF_DEFAULT_TOOL_VERSIONS_FILENAME=.tool-versions"
+  -e "ASDF_NODEJS_VERSION="
+  -e "ASDF_PYTHON_VERSION="
+  -e "ASDF_GOLANG_VERSION="
+  -e "ASDF_RUBY_VERSION="
+  -e "ASDF_RUST_VERSION="
+  -e "ASDF_SKIP_RESHIM=1"
+  -e "COREPACK_HOME=/opt/asdf-data/corepack"
+  -e "COREPACK_DEFAULT_TO_LATEST=0"
+  -e "COREPACK_ENV_FILE=0"
+  -e "COREPACK_NPM_REGISTRY=https://registry.npmjs.org"
+  -e "COREPACK_ENABLE_NETWORK=0"
+  -e "COREPACK_ENABLE_AUTO_PIN=0"
+  -e "COREPACK_ENABLE_DOWNLOAD_PROMPT=0"
+  -e "COREPACK_ENABLE_PROJECT_SPEC=1"
+  -e "COREPACK_ENABLE_STRICT=1"
+  -e "COREPACK_ENABLE_UNSAFE_CUSTOM_URLS=0"
+  -e "COREPACK_INTEGRITY_CHECK=1"
+  -e "NPM_CONFIG_PREFIX=$TASK_NPM_PREFIX"
+  -e "npm_config_prefix=$TASK_NPM_PREFIX"
+  -e "NPM_CONFIG_CACHE=$TASK_NPM_CACHE"
+  -e "npm_config_cache=$TASK_NPM_CACHE"
+  -e "NPM_CONFIG_LOGS_DIR=$TASK_NPM_CACHE/_logs"
+  -e "npm_config_logs_dir=$TASK_NPM_CACHE/_logs"
+  -e "NPM_CONFIG_UMASK=0002"
+  -e "npm_config_umask=0002"
+  -e "LD_PRELOAD="
+  -e "LD_AUDIT="
+  -e "LD_LIBRARY_PATH="
+  -e "NODE_OPTIONS="
+  -e "NODE_PATH="
+  -e "PS4="
+  -e "UAI_ENV_MODE=$UAI_PROJECT_ENV_MODE"
+  -e "UAI_ENV_HOOK=0"
+  -e "SHELL=/usr/bin/zsh"
+  -e "BASH_ENV="
+  -e "ENV="
+)
+editor_theme=$(jq -r '.UAI_EDITOR_THEME // empty' <<<"$preview_env_raw")
+if [ -n "$editor_theme" ]; then
+  task_runtime_exec_env+=( -e "UAI_EDITOR_THEME=$editor_theme" )
+fi
+# ADR-118 (apple only): every runtime-bearing exec — uai-init's installs
+# above all — must aim pnpm at the task's block volume, exactly like the
+# container env-file. Docker execs keep the historical environment.
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  task_runtime_exec_env+=(
+    -e "NPM_CONFIG_STORE_DIR=$TASK_STORE_DIR"
+    -e "npm_config_store_dir=$TASK_STORE_DIR"
+  )
+fi
+
+# ADR-153 secrets proxy, first step: the CA bundle goes into the task's trust
+# store before anything else runs in it (the forwarder, uai-init, agents). The
+# runner wrote the bundle and its fixed install script to
+# UAI_SECRETS_PROXY_DIR (public material only); unset, the proxy is off and
+# nothing is installed. A failure leaves the task up without the proxy's
+# trust, and the runner withholds whatever would have needed it.
+secrets_proxy_trust=skipped
+secrets_proxy_pins=skipped
+secrets_proxy_dir=${UAI_SECRETS_PROXY_DIR:-}
+# Each outcome is also written back to the runner's directory the moment it
+# is known: uai-init's shells read the env before task-up returns, and the
+# runner gives the trust env only once the CA is really in place.
+secrets_proxy_report() {
+  [ -z "$secrets_proxy_dir" ] || printf '%s\n' "$2" > "$secrets_proxy_dir/$1" || true
+}
+if [ "$UAI_PROJECT_ENV_MODE" = "loader" ] && [ -n "$secrets_proxy_dir" ]; then
+  if [ -f "$secrets_proxy_dir/ca-install.sh" ] && [ -f "$secrets_proxy_dir/ca-bundle.pem" ] \
+     && crt exec -i -u root "${managed_exec_env[@]}" "$app_container" \
+          /bin/sh -c "$(cat "$secrets_proxy_dir/ca-install.sh")" \
+          < "$secrets_proxy_dir/ca-bundle.pem" >/dev/null; then
+    secrets_proxy_trust=installed
+  else
+    secrets_proxy_trust=failed
+    log "warning: could not install the secrets proxy CA in ${app_container}; its proxied keys stay withheld"
+  fi
+  secrets_proxy_report trust "$secrets_proxy_trust"
+fi
+
+# Loader tasks have two pieces of root-owned bootstrap inside the task:
+# immutable shell entry-point stubs, and a generation-authenticated loopback
+# forwarder. Maintenance commands above and below keep UAI_ENV_HOOK=0, so the
+# stubs cannot make runner-owned execs consume project configuration.
+if [ "$UAI_PROJECT_ENV_MODE" = "loader" ]; then
+  task_gateway_generation=${UAI_TASK_GATEWAY_GENERATION:-}
+  task_gateway_host=${UAI_TASK_GATEWAY_HOST:-}
+  task_gateway_port=${UAI_MCP_GATEWAY_PORT:-5877}
+  if [[ ! "$task_gateway_generation" =~ ^[A-Za-z0-9_-]{16,64}$ ]] \
+     || [[ ! "$task_gateway_host" =~ ^[A-Za-z0-9][A-Za-z0-9._:-]{0,254}$ ]] \
+     || [[ ! "$task_gateway_port" =~ ^[0-9]{1,5}$ ]] \
+     || [ "$task_gateway_port" -lt 1 ] \
+     || [ "$task_gateway_port" -gt 65535 ]; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck could not establish this task's authenticated env channel. Retry the task after updating the host." \
+      "validate task env gateway identity"
+  fi
+
+  # A heredoc nested inside `$(cat ...)` containing `case` arms is parsed as
+  # shell syntax by Bash 3.2 (the system Bash on macOS) and makes every task-up
+  # fail before it runs. `read -d ''` assigns the same literal without a
+  # command-substitution parser context.
+  env_stub_installer=''
+  IFS= read -r -d '' env_stub_installer <<'UAI_ENV_STUB_INSTALLER' || true
+set -eu
+ensure_block() {
+  file=$1
+  line=$2
+  case "$file" in
+    /etc/zsh/zshenv | /etc/zsh/zshrc | /etc/bash.bashrc | /etc/profile.d/uai-env.sh) ;;
+    *) exit 1 ;;
+  esac
+  [ ! -L "$file" ] || exit 1
+  [ ! -e "$file" ] || [ -f "$file" ] || exit 1
+  directory=${file%/*}
+  [ -d "$directory" ] && [ ! -L "$directory" ] || exit 1
+  temporary=$(/usr/bin/mktemp "$directory/.uai-env-stub.XXXXXX")
+  trap '/bin/rm -f -- "$temporary"' EXIT
+  if [ -f "$file" ]; then
+    /usr/bin/awk '
+      $0 == "# >>> uai env loader >>>" { skipping = 1; next }
+      $0 == "# <<< uai env loader <<<" { skipping = 0; next }
+      !skipping { print }
+    ' "$file" > "$temporary"
+  fi
+  {
+    printf '%s\n' '# >>> uai env loader >>>'
+    printf '%s\n' "$line"
+    printf '%s\n' '# <<< uai env loader <<<'
+  } >> "$temporary"
+  /bin/chown root:root "$temporary"
+  /bin/chmod 0644 "$temporary"
+  /bin/mv -f -- "$temporary" "$file"
+  trap - EXIT
+}
+
+ensure_block /etc/zsh/zshenv '[ "${UAI_ENV_HOOK-0}" != 1 ] || { . /usr/local/share/uai/env-hook.sh; __uai_env_sync; }'
+ensure_block /etc/zsh/zshrc '[ "${UAI_ENV_HOOK-0}" != 1 ] || { type __uai_env_install_zsh_preexec >/dev/null 2>&1 || . /usr/local/share/uai/env-hook.sh; __uai_env_install_zsh_preexec; }'
+ensure_block /etc/bash.bashrc '[ "${UAI_ENV_HOOK-0}" != 1 ] || { . /usr/local/share/uai/env-hook.sh; __uai_env_sync; __uai_env_install_bash_preexec; }'
+ensure_block /etc/profile.d/uai-env.sh '[ "${UAI_ENV_HOOK-0}" != 1 ] || { . /usr/local/share/uai/env-hook.sh; if [ -z "${BASH_EXECUTION_STRING-}" ] || [ -z "${BASH_ENV-}" ]; then __uai_env_sync; fi; }'
+UAI_ENV_STUB_INSTALLER
+  if ! crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+    /bin/bash -c "$env_stub_installer" >/dev/null; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck could not install the root-owned task env shell hooks. Retry the task; project env remains withheld until this succeeds." \
+      "install task env shell hooks"
+  fi
+
+  task_forwarder_node=/usr/local/bin/node
+  if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+    task_forwarder_node="/run/uai/asdf-lower/installs/nodejs/$STANDARD_DEFAULT_NODE_VERSION/bin/node"
+  fi
+
+  task_forwarder_launcher=''
+  IFS= read -r -d '' task_forwarder_launcher <<'UAI_TASK_FORWARDER_LAUNCHER' || true
+set -eu
+task_id=$1
+generation=$2
+gateway_host=$3
+gateway_port=$4
+node_path=$5
+case "$gateway_port" in ''|*[!0-9]*) exit 1 ;; esac
+[ "$gateway_port" -ge 1 ] && [ "$gateway_port" -le 65535 ] || exit 1
+case "$node_path" in
+  /usr/local/bin/node) ;;
+  /run/uai/asdf-lower/installs/nodejs/22.11.0/bin/node)
+    [ ! -L "$node_path" ] && [ -f "$node_path" ] && [ -x "$node_path" ] \
+      || exit 1
+    ;;
+  *) exit 1 ;;
+esac
+state_dir=/run/uai/task-forwarder
+pid_file=$state_dir/pid
+ready_file=$state_dir/ready
+error_file=$state_dir/error.log
+umask 077
+[ ! -L "$state_dir" ] || exit 1
+[ ! -e "$state_dir" ] || [ -d "$state_dir" ] || exit 1
+/usr/bin/install -d -o root -g root -m 0700 "$state_dir"
+
+if [ -f "$pid_file" ] && [ ! -L "$pid_file" ]; then
+  old_pid=$(/bin/cat "$pid_file" 2>/dev/null || true)
+  case "$old_pid" in ''|*[!0-9]*) old_pid= ;; esac
+  if [ -n "$old_pid" ] && /bin/kill -0 "$old_pid" 2>/dev/null; then
+    old_uid=$(/usr/bin/awk '/^Uid:/ { print $2; exit }' "/proc/$old_pid/status" 2>/dev/null || true)
+    old_args=$(/usr/bin/tr '\000' '\n' < "/proc/$old_pid/cmdline" 2>/dev/null || true)
+    # /run survives a Docker stop/start. Its recorded pid may have been
+    # reused by uai-init or another innocent process; treat that record as
+    # stale and never signal a process unless both uid and argv prove it is
+    # this task's prior forwarder.
+    if [ "$old_uid" = 65532 ] \
+       && printf '%s\n' "$old_args" | /bin/grep -Fxq '/usr/local/share/uai/uai-task-forwarder.mjs' \
+       && printf '%s\n' "$old_args" | /bin/grep -Fxq "$task_id"; then
+      /bin/kill -TERM "$old_pid"
+      attempts=0
+      while /bin/kill -0 "$old_pid" 2>/dev/null && [ "$attempts" -lt 50 ]; do
+        /bin/sleep 0.1
+        attempts=$((attempts + 1))
+      done
+      if /bin/kill -0 "$old_pid" 2>/dev/null; then
+        /bin/kill -KILL "$old_pid"
+      fi
+    fi
+  fi
+fi
+/bin/rm -f -- "$pid_file" "$ready_file" "$error_file"
+
+# Non-interactive Bash otherwise gives an asynchronous command /dev/null as
+# stdin. Preserve the docker/container exec pipe explicitly, then close the
+# extra descriptor in both parent and child after fd 0 has been duplicated.
+exec 3<&0
+/usr/bin/env -i PATH=/usr/bin:/bin \
+  /usr/bin/setsid \
+  /usr/bin/setpriv \
+    --reuid=65532 \
+    --regid=65532 \
+    --clear-groups \
+    --bounding-set=-all \
+    --inh-caps=-all \
+    --ambient-caps=-all \
+    --no-new-privs \
+  "$node_path" \
+    /usr/local/share/uai/uai-task-forwarder.mjs \
+    --task-id "$task_id" \
+    --generation "$generation" \
+    --gateway-host "$gateway_host" \
+    --gateway-port "$gateway_port" \
+    --listen-port 5877 \
+  <&3 3<&- >"$ready_file" 2>"$error_file" &
+forwarder_pid=$!
+exec 3<&-
+printf '%s\n' "$forwarder_pid" > "$pid_file"
+
+attempts=0
+while [ "$attempts" -lt 50 ]; do
+  /bin/kill -0 "$forwarder_pid" 2>/dev/null || exit 1
+  if [ -f "$ready_file" ] \
+     && [ "$(/bin/cat "$ready_file" 2>/dev/null || true)" = READY ]; then
+    exit 0
+  fi
+  /bin/sleep 0.1
+  attempts=$((attempts + 1))
+done
+exit 1
+UAI_TASK_FORWARDER_LAUNCHER
+
+  base64_decode_args=()
+  if printf '' | base64 --decode >/dev/null 2>&1; then
+    base64_decode_args=(--decode)
+  elif printf '' | base64 -D >/dev/null 2>&1; then
+    base64_decode_args=(-D)
+  else
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck could not decode the task env gateway credential on this host." \
+      "start task env forwarder"
+  fi
+  if ! printf '%s' "$task_gateway_secret_b64" \
+    | base64 "${base64_decode_args[@]}" \
+    | crt exec -i -u root "${managed_exec_env[@]}" "$app_container" \
+        /bin/bash -c "$task_forwarder_launcher" uai-task-forwarder \
+          "$task_id" "$task_gateway_generation" "$task_gateway_host" \
+          "$task_gateway_port" "$task_forwarder_node" \
+        >/dev/null; then
+    unset task_gateway_secret_b64
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck could not start the authenticated task env forwarder. Retry the task; project env remains withheld until this succeeds." \
+      "start task env forwarder"
+  fi
+  unset task_gateway_secret_b64
+fi
+
+# ADR-153 secrets proxy, second step, now that the forwarder listens: the NAT
+# chain that sends the pin address's :443 to the forwarder, and the names
+# pinned to it. In the runner's order (routing-order): the chain before the
+# names when pinning, the names first when there is nothing to pin, so a
+# failure part-way never leaves a name pointing at a pin with nothing behind
+# it. The NAT step needs NET_ADMIN. A Docker container does not have it: the
+# step is the one privileged exec Uai makes, and only that process gets it.
+# An Apple task's VM was started with it, so there a root exec has it (and
+# the CLI has no --privileged).
+secrets_proxy_chain() {
+  if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+    set -- crt exec -u root
+  else
+    set -- docker exec --privileged -u root
+  fi
+  "$@" "${managed_exec_env[@]}" "$app_container" \
+    /bin/sh -c "$(cat "$secrets_proxy_dir/chain.sh")" >/dev/null \
+    || { log "warning: could not redirect the secrets proxy's names in ${app_container}"; return 1; }
+}
+secrets_proxy_names() {
+  crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+    /bin/sh -c "$(cat "$secrets_proxy_dir/pins.sh")" >/dev/null \
+    || { log "warning: could not pin the secrets proxy's names in ${app_container}"; return 1; }
+}
+if [ "$secrets_proxy_trust" = "installed" ]; then
+  secrets_proxy_order=$(cat "$secrets_proxy_dir/routing-order" 2>/dev/null || true)
+  # A missing script would run as an empty, successful program.
+  if [ ! -f "$secrets_proxy_dir/pins.sh" ] || [ ! -f "$secrets_proxy_dir/chain.sh" ]; then
+    secrets_proxy_pins=failed
+    log "warning: the secrets proxy's pin scripts are missing for ${app_container}"
+  elif [ "$secrets_proxy_order" = "pin" ]; then
+    if secrets_proxy_chain && secrets_proxy_names; then secrets_proxy_pins=installed; else secrets_proxy_pins=failed; fi
+  elif [ "$secrets_proxy_order" = "unpin" ]; then
+    if secrets_proxy_names && secrets_proxy_chain; then secrets_proxy_pins=installed; else secrets_proxy_pins=failed; fi
+  else
+    secrets_proxy_pins=failed
+    log "warning: the secrets proxy's routing order is missing for ${app_container}"
+  fi
+  secrets_proxy_report pins "$secrets_proxy_pins"
+fi
+
+# OpenCode and code-server share ~/.local/share. OpenCode credentials are
+# copied as root below, so creating only its leaf with `mkdir -p` can leave the
+# shared parent root-owned (live 2026-08-04). Then node cannot create
+# code-server's User profile and the editor silently falls back to its light,
+# full-chrome defaults. Repair both explicitly on every start/resume; GNU
+# `install -d` also corrects an existing directory with the wrong owner.
+if ! crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+  /usr/bin/install -d -o node -g node -m 0755 \
+    /home/node/.local/share \
+    /home/node/.local/share/opencode >/dev/null; then
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Moondeck could not prepare the task's node-owned application data directory. Retry the task; the editor cannot load its settings until this succeeds." \
+    "prepare container application data"
+fi
+
+# Git rejects a repository owned by another uid even when its shared group is
+# writable. Trust only the selected worktrees in this task container—never `*`
+# and never the host cache. The task-private ~/.gitconfig makes these entries
+# local to this container, and the read-before-add keeps resumes idempotent.
+step "CONTAINER_INIT_FAILED" "trust task Git worktrees"
+container_safe_dirs=$(crt exec -u node "${managed_exec_env[@]}" \
+  "$app_container" "${managed_clean_env[@]}" /usr/bin/git config --global \
+  --get-all safe.directory 2>/dev/null || true)
+while IFS= read -r safe_project; do
+  [ -n "$safe_project" ] || continue
+  safe_project_id=$(jq -r '.id' <<<"$safe_project")
+  safe_project_slug=$(jq -r '.slug' <<<"$safe_project")
+  for safe_worktree in \
+    "/workspace/$safe_project_slug" \
+    "$task_workspace/$safe_project_slug" \
+    "$task_uai_dir/repos/$safe_project_id.git" \
+    "$task_workspace_physical/$safe_project_slug" \
+    "$task_uai_dir_physical/repos/$safe_project_id.git"; do
+    if ! printf '%s\n' "$container_safe_dirs" \
+      | grep -Fqx -- "$safe_worktree"; then
+      if ! crt exec -u node "${managed_exec_env[@]}" "$app_container" \
+        "${managed_clean_env[@]}" /usr/bin/git config --global --add \
+        safe.directory "$safe_worktree" >/dev/null; then
+        emit_err "CONTAINER_INIT_FAILED" \
+          "Moondeck could not mark $safe_worktree as this task's trusted Git path" \
+          "trust task Git worktrees"
+      fi
+      container_safe_dirs="${container_safe_dirs}"$'\n'"${safe_worktree}"
+    fi
+  done
+done < <(jq -c '.[]' <<<"$projects_json")
+
+# A running container is not sufficient proof that its linked worktrees are
+# usable. In particular, Git may have canonicalized a symlinked host workspace
+# root while Compose mounted only its lexical spelling. Verify the actual path
+# agents use before credentials, dependency installation, or status=running.
+step "CONTAINER_INIT_FAILED" "verify task Git worktrees"
+while IFS= read -r verify_project; do
+  [ -n "$verify_project" ] || continue
+  verify_project_slug=$(jq -r '.slug' <<<"$verify_project")
+  verify_is_worktree=""
+  if ! verify_is_worktree=$(crt exec -u node "${managed_exec_env[@]}" \
+    "$app_container" "${managed_clean_env[@]}" /usr/bin/git \
+    -C "/workspace/$verify_project_slug" rev-parse \
+    --is-inside-work-tree 2>/dev/null) \
+    || [ "$verify_is_worktree" != "true" ]; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck could not open $verify_project_slug as a Git worktree inside the task container. Retry the task after checking the host workspace path." \
+      "verify task Git worktree ($verify_project_slug)"
+  fi
+done < <(jq -c '.[]' <<<"$projects_json")
+
+# A failed/retried start can preserve a container that still holds a previous
+# account. Erase that Uai-managed state first for both connected and
+# disconnected starts; otherwise a no-credential resume could briefly reuse a
+# stale token before the asynchronous reconciler catches up.
+if ! crt exec -u node "${managed_exec_env[@]}" "$app_container" \
+  "${managed_clean_env[@]}" /bin/sh -c '
+    set -eu
+    /bin/rm -f "$GH_CONFIG_DIR/hosts.yml"
+    for key in \
+      credential.https://github.com.helper \
+      credential.https://gist.github.com.helper
+    do
+      /usr/bin/git config --file "$HOME/.gitconfig" --unset-all "$key" \
+        >/dev/null 2>&1 || true
+      if /usr/bin/git config --file "$HOME/.gitconfig" --get-all "$key" \
+        >/dev/null 2>&1; then
+        exit 1
+      fi
+    done
+    test ! -e "$GH_CONFIG_DIR/hosts.yml"
+  ' >/dev/null; then
+  require_docker_after_failed_step "clear container GitHub credential"
+  emit_err "GITHUB_AUTH_UNAVAILABLE" \
+    "Moondeck could not clear the previous managed GitHub credential from the task container. Retry the task before doing GitHub work." \
+    "clear container GitHub credential"
+fi
+
+# The task container must have the same connected GitHub principal BEFORE
+# uai-init runs package managers: private Git submodules/dependencies may be
+# fetched during install. Read the token back from the private cache and stream
+# only its password field directly into `gh auth login`; it never enters argv,
+# environment, a shell variable, Compose, or disk.
+if [ -n "$github_credential_socket" ]; then
+  if ! printf 'protocol=https\nhost=github.com\n\n' \
+    | git_with_github_credential credential fill \
+    | sed -n 's/^password=//p' \
+    | crt exec -i -u node "${managed_exec_env[@]}" "$app_container" \
+        "${managed_clean_env[@]}" /usr/bin/gh auth login --with-token \
+        --hostname github.com --git-protocol https >/dev/null; then
+    require_docker_after_failed_step "configure container GitHub credential"
+    emit_err "GITHUB_AUTH_UNAVAILABLE" \
+      "GitHub is connected on this host, but Moondeck could not install that credential in the task container. Retry the task; if it persists, reconnect GitHub on this host." \
+      "configure container GitHub credential"
+  fi
+  if ! crt exec -u node "${managed_exec_env[@]}" "$app_container" \
+    "${managed_clean_env[@]}" /usr/bin/gh auth setup-git \
+    --hostname github.com >/dev/null; then
+    require_docker_after_failed_step "configure container Git credential helper"
+    emit_err "GITHUB_AUTH_UNAVAILABLE" \
+      "GitHub is connected on this host, but Moondeck could not configure Git HTTPS in the task container. Retry the task; if it persists, reconnect GitHub on this host." \
+      "configure container Git credential helper"
+  fi
+fi
+
+# Copy `.claude.json` into the container instead of bind-mounting it.
+# Single-file bind mounts on Docker Desktop macOS are fragile — claude
+# CLI atomically rewrites the file on every start, which can invalidate
+# the bind mount and leave a stale dentry, after which claude refuses to
+# start. docker cp gives the container its own stable copy. Best-effort.
+if [ "$uai_on_cloud_credentials" != "1" ] && [ -f "$UAI_OWNER_HOME/.claude.json" ]; then
+  crt cp "$UAI_OWNER_HOME/.claude.json" \
+    "$app_container":/home/node/.claude.json >/dev/null 2>&1 \
+    || log "warning: crt cp of .claude.json failed; claude may need re-login"
+  crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+    /usr/bin/chown node:node /home/node/.claude.json >/dev/null 2>&1 || true
+fi
+
+# Copy Codex credentials/config into a task-private /home/node/.codex.
+# Do not mount the host ~/.codex writable: Codex stores live SQLite state
+# there, and concurrent host/container access can corrupt it.
+# Failures here are REAL errors (the container is running at task-up):
+# docker cp preserves the host uid/gid, so a skipped chown leaves 0600
+# files owned by e.g. macOS 501:20 that the container's node (1000:1000)
+# cannot read — Codex then dies at startup.
+if crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+    /usr/bin/mkdir -p /home/node/.codex >/dev/null; then
+  for codex_item in auth.json config.toml AGENTS.md version.json installation_id rules; do
+    [ "$uai_on_cloud_credentials" = "1" ] && continue
+    if [ -e "$UAI_OWNER_HOME/.codex/$codex_item" ]; then
+      # ADR-135: the task's copy must not carry the rotating refresh token —
+      # N copies racing to refresh it revoke the whole family. Replace it with
+      # the broker placeholder (the field must exist; codex refuses a missing
+      # one). The host is the only refresher and re-pushes on refresh.
+      if [ "$codex_item" = auth.json ] && command -v jq >/dev/null 2>&1; then
+        brokered_auth="$(mktemp "${TMPDIR:-/tmp}/uai-codex-auth.XXXXXX")"
+        if jq 'if (.tokens|type) == "object" and (.tokens.refresh_token|type) == "string" then .tokens.refresh_token = "uai-broker-managed-no-refresh" else . end' \
+            "$UAI_OWNER_HOME/.codex/auth.json" > "$brokered_auth" 2>/dev/null && [ -s "$brokered_auth" ]; then
+          crt cp "$brokered_auth" "$app_container":/home/node/.codex/auth.json >/dev/null \
+            || log "ERROR: crt cp of brokered .codex/auth.json failed; Codex in this task may not authenticate"
+          rm -f "$brokered_auth"
+          continue
+        fi
+        rm -f "$brokered_auth"
+        log "warning: could not broker .codex/auth.json; copying it verbatim"
+      fi
+      crt cp "$UAI_OWNER_HOME/.codex/$codex_item" \
+        "$app_container":/home/node/.codex/ >/dev/null \
+        || log "ERROR: crt cp of .codex/$codex_item failed; Codex in this task may not authenticate"
+    fi
+  done
+  crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+      /usr/bin/chown -R node:node /home/node/.codex >/dev/null \
+    || log "ERROR: chown of /home/node/.codex failed — 0600 credentials remain unreadable by node. Fix (docker mode; use the bundled container CLI on Apple hosts): docker exec -u root -e PATH=/usr/bin:/bin $app_container /usr/bin/chown -R node:node /home/node/.codex"
+else
+  log "ERROR: mkdir /home/node/.codex failed in $app_container; Codex credentials were not injected"
+fi
+
+# Copy Kimi Code subscription/config into a task-private /home/node/.kimi-code.
+# The Linux `kimi` binary is baked into the image; here we copy ONLY the
+# arch-independent config + credential (never the host's macOS bin/, nor live
+# session state) so the container's kimi runs on the operator's subscription.
+crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+  /usr/bin/mkdir -p /home/node/.kimi-code/credentials >/dev/null 2>&1 || true
+if [ "$uai_on_cloud_credentials" != "1" ] && [ -e "$UAI_OWNER_HOME/.kimi-code/config.toml" ]; then
+  crt cp "$UAI_OWNER_HOME/.kimi-code/config.toml" \
+    "$app_container":/home/node/.kimi-code/config.toml >/dev/null 2>&1 \
+    || log "warning: crt cp of .kimi-code/config.toml failed; kimi may need re-login"
+fi
+if [ "$uai_on_cloud_credentials" != "1" ] && [ -e "$UAI_OWNER_HOME/.kimi-code/device_id" ]; then
+  crt cp "$UAI_OWNER_HOME/.kimi-code/device_id" \
+    "$app_container":/home/node/.kimi-code/device_id >/dev/null 2>&1 || true
+fi
+if [ "$uai_on_cloud_credentials" != "1" ] && [ -e "$UAI_OWNER_HOME/.kimi-code/credentials/kimi-code.json" ]; then
+  crt cp "$UAI_OWNER_HOME/.kimi-code/credentials/kimi-code.json" \
+    "$app_container":/home/node/.kimi-code/credentials/kimi-code.json >/dev/null 2>&1 \
+    || log "warning: crt cp of .kimi-code credential failed; kimi may need re-login"
+fi
+crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+  /usr/bin/chown -R node:node /home/node/.kimi-code >/dev/null 2>&1 || true
+
+# Copy Grok subscription/config into a task-private /home/node/.grok. The Linux
+# `grok` binary is baked into the image; here we copy the arch-independent
+# auth + config. auth.json is an OIDC token: the task's copy gets the broker
+# placeholder in every entry's refresh_token (ADR-135) so it can never rotate
+# the family; the host is the only refresher.
+crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+  /usr/bin/mkdir -p /home/node/.grok >/dev/null 2>&1 || true
+for grok_item in auth.json config.toml models_cache.json agent_id; do
+  [ "$uai_on_cloud_credentials" = "1" ] && continue
+  if [ -e "$UAI_OWNER_HOME/.grok/$grok_item" ]; then
+    if [ "$grok_item" = auth.json ] && command -v jq >/dev/null 2>&1; then
+      brokered_auth="$(mktemp "${TMPDIR:-/tmp}/uai-grok-auth.XXXXXX")"
+      if jq 'with_entries(if (.value|type) == "object" and (.value.refresh_token|type) == "string" then .value.refresh_token = "uai-broker-managed-no-refresh" else . end)' \
+          "$UAI_OWNER_HOME/.grok/auth.json" > "$brokered_auth" 2>/dev/null && [ -s "$brokered_auth" ]; then
+        crt cp "$brokered_auth" "$app_container":/home/node/.grok/auth.json >/dev/null 2>&1 \
+          || log "warning: crt cp of brokered .grok/auth.json failed; grok may need re-login"
+        rm -f "$brokered_auth"
+        continue
+      fi
+      rm -f "$brokered_auth"
+      log "warning: could not broker .grok/auth.json; copying it verbatim"
+    fi
+    crt cp "$UAI_OWNER_HOME/.grok/$grok_item" \
+      "$app_container":/home/node/.grok/ >/dev/null 2>&1 \
+      || log "warning: crt cp of .grok/$grok_item failed; grok may need re-login"
+  fi
+done
+crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+  /usr/bin/chown -R node:node /home/node/.grok >/dev/null 2>&1 || true
+
+# Copy OpenCode provider auth into a task-private /home/node/.local/share/opencode
+# (ADR-077), same per-task-writable-copy pattern as Codex. The Linux `opencode`
+# binary is baked into the image; here we copy the arch-independent auth+config.
+# ADR-076 EXTRA accounts (isolated dirs) are copied later from the host-agent
+# (provisionEngineAccounts) since they live in the sealed DB, not on disk here.
+# The shared parent and this leaf were created with node ownership above.
+for oc_item in auth.json config.json; do
+  [ "$uai_on_cloud_credentials" = "1" ] && continue
+  if [ -e "$UAI_OWNER_HOME/.local/share/opencode/$oc_item" ]; then
+    crt cp "$UAI_OWNER_HOME/.local/share/opencode/$oc_item" \
+      "$app_container":/home/node/.local/share/opencode/ >/dev/null 2>&1 \
+      || log "warning: crt cp of opencode/$oc_item failed; opencode may need re-login"
+  fi
+done
+crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+  /usr/bin/chown -R node:node /home/node/.local/share/opencode >/dev/null 2>&1 || true
+
+# Copy the resolved SSH identity into the container for commit/tag signing and
+# as the no-GitHub-connection transport fallback. Connected users clone, fetch,
+# and push over HTTPS through their gh credential instead.
+# Best-effort: signing + the SSH fallback stay off if the identity is absent —
+# but every failure is LOGGED (a silent miss here reads as a GitHub
+# permissions problem hours later; live 2026-07-21). The channel-ensure path
+# (ensureTaskSshIdentity) re-asserts all of this on reconnects.
+if [ -f "$uai_identity_key" ]; then
+  crt exec -u root "${managed_exec_env[@]}" "$app_container" \
+    /usr/bin/mkdir -p /home/node/.ssh >/dev/null 2>&1 \
+    || log "warning: ssh setup: mkdir ~/.ssh failed in $app_container"
+  crt cp "$uai_identity_key" \
+    "$app_container":/home/node/.ssh/id_ed25519 >/dev/null 2>&1 \
+    || log "warning: ssh setup: key copy failed — signing and SSH fallback unavailable"
+  crt cp "${uai_identity_key}.pub" \
+    "$app_container":/home/node/.ssh/id_ed25519.pub >/dev/null 2>&1 \
+    || log "warning: ssh setup: pubkey copy failed (signing will be off)"
+  crt exec -u root "${managed_exec_env[@]}" "$app_container" /bin/sh -c \
+    '/usr/bin/chown -R node:node /home/node/.ssh && /usr/bin/chmod 700 /home/node/.ssh && /usr/bin/chmod 600 /home/node/.ssh/id_ed25519' \
+    >/dev/null 2>&1 \
+    || log "warning: ssh setup: chown/chmod failed — key may be unreadable by node"
+fi
+
+# uai-init (workspace deps + code-server) is re-runnable, and its death must
+# not error a task whose container is already up (graceful degradation): a
+# SIGKILLed exec session (observed live 2026-07-21, exit 137 with no timeout
+# anywhere on this path) used to fail the whole task over a step anyone can
+# re-run. Retry once, then come up DEGRADED with a warning the host surfaces
+# as a system note in the task feed.
+quarantine_runtime_authority_violation() {
+  quarantine_untrusted_app_container
+}
+
+# ADR-154 §12: the runner writes a task on cloud credentials its owner's
+# GitHub configuration and SSH key, recorded for cleanup, now: after the
+# managed-auth scrub, before uai-init installs anything that may need them.
+# task-up waits for its answer, bounded, and stops on anything but continue.
+if [ -n "$uai_handshake_dir" ]; then
+  : > "$uai_handshake_dir/event-runtime-ready"
+  uai_waited=0
+  while [ ! -f "$uai_handshake_dir/runtime-ready" ] && [ "$uai_waited" -lt 3000 ]; do
+    sleep 0.2
+    uai_waited=$((uai_waited + 1))
+  done
+  uai_runtime_ready=$(cat "$uai_handshake_dir/runtime-ready" 2>/dev/null || true)
+  if [ "$uai_runtime_ready" != "continue" ]; then
+    emit_err "CREDENTIALS_UNAVAILABLE" \
+      "Moondeck could not write the task's GitHub sign-in and SSH key into it. Start the task again." \
+      "write the task's credentials"
+  fi
+fi
+
+init_warning=""
+init_rc=0
+crt exec "${task_runtime_exec_env[@]}" "$app_container" \
+  /usr/local/bin/uai-init >/dev/null || init_rc=$?
+if [ "$init_rc" -ne 0 ]; then
+  require_docker_after_failed_step "uai-init (deps + code-server)"
+  if [ "$init_rc" -eq 78 ]; then
+    # Exit 78 is reserved for a host-authority violation, not an ordinary
+    # best-effort dependency failure. Keep the already-created app unavailable
+    # and prove it stopped before returning an actionable task-up failure.
+    if ! quarantine_runtime_authority_violation; then
+      emit_err "CONTAINER_INIT_FAILED" \
+        "A workspace runtime-authority violation was detected, and Moondeck could not prove the task container stopped. Stop it manually before retrying." \
+        "quarantine runtime-authority violation"
+    fi
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Moondeck stopped this task because its runtime isolation changed after startup (for example, a writable shared cache, an unsafe private npm path, or a workspace-root .tool-versions). Retry after removing the reported redirect; project runtime manifests belong only inside selected project directories." \
+      "uai-init runtime authority"
+  fi
+  log "warning: uai-init failed — retrying once"
+  sleep 2
+  init_rc=0
+  crt exec "${task_runtime_exec_env[@]}" "$app_container" \
+    /usr/local/bin/uai-init >/dev/null || init_rc=$?
+  if [ "$init_rc" -ne 0 ]; then
+    require_docker_after_failed_step "uai-init (deps + code-server)"
+    if [ "$init_rc" -eq 78 ]; then
+      if ! quarantine_runtime_authority_violation; then
+        emit_err "CONTAINER_INIT_FAILED" \
+          "A workspace runtime-authority violation was detected, and Moondeck could not prove the task container stopped. Stop it manually before retrying." \
+          "quarantine runtime-authority violation"
+      fi
+      emit_err "CONTAINER_INIT_FAILED" \
+        "Moondeck stopped this task because its runtime isolation changed after startup (for example, a writable shared cache, an unsafe private npm path, or a workspace-root .tool-versions). Retry after removing the reported redirect." \
+        "uai-init runtime authority"
+    fi
+    init_warning="Workspace init (deps + editor) failed twice — the task is up, but the editor and installed dependencies may be missing. Retry from a task terminal with: /usr/local/bin/uai-init"
+    log "warning: $init_warning"
+  fi
+fi
+
+# -----------------------------------------------------------------------------
+# 8. Discover code-server + preview ports, mark running, unlock.
+# -----------------------------------------------------------------------------
+
+# code-server: container exposes 8080; Docker auto-maps to a random host
+# port. Discover via `docker port`. Best-effort — if it fails the Editor
+# pane is just unavailable.
+code_server_port=""
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  # No ports are published on the Apple runtime: the container's vmnet IP is
+  # host-routable, so the Editor tunnel dials <container-ip>:8080 directly
+  # (resolved per-request from the provider's route inspection).
+  :
+else
+  code_server_port=$(mapped_host_port "$app_container" 8080)
+  if [ -z "$code_server_port" ]; then
+    require_docker_after_failed_step "discover code-server port"
+    log "warning: could not discover code-server port for ${app_container} (editor pane unavailable)"
+  fi
+fi
+
+# ADR-043 Stage 2: preview ports are no longer published at task-up, so there is
+# nothing to discover here. `preview_ports` stays empty and every enabled preview
+# is reached through its sidecar (started lazily on first access via the cloud
+# tunnel). `union_preview_ports_json` is still surfaced to the cloud (GET task
+# lists the declared/ad-hoc names the user can turn on).
+preview_ports_runtime_json="[]"
+
+step "DB_UPDATE_FAILED" "mark task running"
+cs_sql="code_server_port=NULL"
+if [ -n "$code_server_port" ]; then
+  cs_sql="code_server_port=${code_server_port}"
+fi
+db_update_task "$task_id" \
+  "status='running'" \
+  "$cs_sql" \
+  "preview_ports='$(sql_escape "$preview_ports_runtime_json")'"
+
+unlock_task "$task_id"
+
+emit_event "$task_id" "status_changed" "$(jq -nc '{from:"starting",to:"running"}')"
+
+# NOTE: `codeServerPort` is added only when discovered. Do NOT inline a
+# `select(.!="")` into the object literal — when it filters to empty, jq
+# collapses the *entire* object to empty and emit_ok then defaults to
+# `{}`, producing AGENT_BAD_OUTPUT. Add the key with object-merge instead.
+emit_ok "$(jq -nc \
+  --arg cp "$compose_project" \
+  --arg wp "$task_dir" \
+  --arg csport "${code_server_port:-}" \
+  --arg iw "${init_warning}" \
+  --arg spt "$secrets_proxy_trust" \
+  --arg spp "$secrets_proxy_pins" \
+  --argjson previewPorts "$preview_ports_runtime_json" \
+  '{composeProject:$cp,worktreePath:$wp}
+   + (if $csport == "" then {} else {codeServerPort:($csport|tonumber)} end)
+   + (if $iw == "" then {} else {initWarning:$iw} end)
+   + {previewPorts:$previewPorts, secretsProxyTrust:$spt, secretsProxyPins:$spp}')"