@mysten-incubation/devstack 0.1.0 → 0.2.0

package/dist/orchestrators/snapshot/restore.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"restore.mjs","names":["writePendingMarkerIo","removePendingMarkerIo"],"sources":["../../../src/orchestrators/snapshot/restore.ts"],"sourcesContent":["// Restore pipeline.\n//\n// Architecture § Snapshot lifecycle (restore half):\n//\n//   Identity guard (chain identity + plugin contributions)\n//       │   (refuse and stop if mismatch — nothing touched)\n//       ▼\n//   Stage atomic restore in tempdir\n//       │\n//       ▼\n//   Per plugin: expand tar to staging, load committed images\n//       │\n//       ▼\n//   Atomic swap into runtime dir, preserving live control files\n//       │\n//       ▼\n//   snapshot.restored event → next stack acquire picks it up\n//\n// Bracketed-atomic — Tension 9 decision: one outer atomic swap, not\n// per-phase idempotency.\n\nimport { mintRandomSuffix } from '../../substrate/runtime/random-suffix.ts';\n\nimport { Effect, Exit, FileSystem, Schema, Stream } from 'effect';\n\nimport type { ContainerRuntime, ImageRef } from '../../contracts/container-runtime.ts';\nimport {\n\tmakePendingMarkerDocument,\n\tpendingMarkerPath,\n\tRestorePendingMarkerIoError,\n\tremovePendingMarker as removePendingMarkerIo,\n\trewritePendingMarkerContainers,\n\twritePendingMarker as writePendingMarkerIo,\n\tRESTORE_PENDING_FILE_NAME,\n\tRestorePendingDocumentSchema,\n\tSNAPSHOT_RESTORE_PENDING_VERSION,\n\ttype RestorePendingContainer,\n\ttype RestorePendingDocument,\n} from './pending-marker.ts';\nimport {\n\tHostTreeTarError,\n\tuntarHostTree,\n\tvalidateHostTreeTarEntries,\n} from '../../substrate/runtime/host-tree-tar/index.ts';\nimport { decodeUnknown, parseJsonText } from '../../substrate/runtime/runtime-decode.ts';\nimport {\n\tContributionDocSchema,\n\tcontainerImagesBundlePath,\n\tcontributionPath,\n\tDEPLOY_CACHE_NAMESPACES,\n\tSnapshotLayout,\n\tSnapshotMetadataSchema,\n\ttype SnapshotId,\n\ttype CapturedContainer,\n\ttype IdentitySlice,\n\ttype SnapshotMetadata,\n\tisRestorableContainerImageName,\n\tisSafeSnapshotPathSegment,\n\tisSafeSnapshotRelativePath,\n\tparseSnapshotId,\n} from './descriptor.ts';\nimport { verifyArtifactIntegrity } from './integrity.ts';\nimport { makePhaseFailer } from './phase-error.ts';\nimport {\n\treadSnapshotStateDocument,\n\twriteSnapshotStateDocument,\n\ttype SnapshotStateDocumentError,\n} from './state-document.ts';\nimport {\n\tmergeContributions,\n\trunIdentityGuard,\n\trunRuntimeIdentityGuard,\n\ttype IdentityContribution,\n\ttype IdentityContributionConflictError,\n\ttype IdentityGuardError,\n\ttype SnapshotRuntimeIdentity,\n} from './identity-guard.ts';\nimport {\n\tstageAndSwap,\n\ttype StageAndSwapError,\n\ttype StageAndSwapPreservedPath,\n} from '../../substrate/runtime/stage-and-swap/index.ts';\nimport {\n\tCOMMAND_CHANNEL_COMMANDS_FILE_NAME,\n\tCOMMAND_CHANNEL_EVENTS_FILE_NAME,\n\truntimeControlLockPathForStackRoot,\n} from '../../substrate/runtime/cross-process/command-channel/index.ts';\nimport {\n\tImageBundleTagScanError,\n\treadImageBundleTags,\n\tverifyImageBundleTags,\n} from './image-bundle-tags.ts';\nimport { CACHE_DIR_NAME, SNAPSHOTS_DIR_NAME } from './wipe.ts';\n\n// -----------------------------------------------------------------------------\n// Errors\n// -----------------------------------------------------------------------------\n\n/** Tagged failure during a restore step. Phase discriminates the\n *  failing step so the user-facing message can point at it. */\nexport class RestorePhaseError extends Schema.TaggedErrorClass<RestorePhaseError>()(\n\t'SnapshotRestorePhaseError',\n\t{\n\t\tphase: Schema.Literals([\n\t\t\t'read-meta',\n\t\t\t'meta-corrupt',\n\t\t\t'meta-absent',\n\t\t\t'read-state',\n\t\t\t'read-contribution',\n\t\t\t'read-integrity',\n\t\t\t'verify-integrity',\n\t\t\t'preflight',\n\t\t\t'pre-restore-hook',\n\t\t\t'untar-host-tree',\n\t\t\t'load-image',\n\t\t\t'retag-image',\n\t\t\t'expand-state',\n\t\t\t'post-restore-hook',\n\t\t\t'pre-cleanup',\n\t\t\t'write-restore-pending',\n\t\t\t'read-restore-pending',\n\t\t\t'clear-restore-pending',\n\t\t\t'missing-subtree-fatal',\n\t\t]),\n\t\tplugin: Schema.optional(Schema.String),\n\t\tdetail: Schema.String,\n\t\tcause: Schema.optional(Schema.Defect),\n\t},\n) {}\n\nconst failPhase = makePhaseFailer(RestorePhaseError);\n\nconst failRestore = (\n\tphase: RestorePhaseError['phase'],\n\tdetail: string,\n\tplugin?: string,\n): Effect.Effect<never, RestorePhaseError> =>\n\tEffect.fail(new RestorePhaseError({ phase, plugin, detail }));\n\nconst failImageBundleTagScan =\n\t(phase: RestorePhaseError['phase'], plugin?: string) =>\n\t(cause: ImageBundleTagScanError): Effect.Effect<never, RestorePhaseError> =>\n\t\tEffect.fail(new RestorePhaseError({ phase, plugin, detail: cause.detail, cause }));\n\n/** Project a `SnapshotStateDocumentError` onto a `RestorePhaseError`,\n *  branching by `kind` so a phase classifier never inspects message\n *  substrings. */\nconst failStateDocument =\n\t(\n\t\treadPhase: RestorePhaseError['phase'],\n\t\twritePhase: RestorePhaseError['phase'],\n\t\tplugin?: string,\n\t) =>\n\t(err: SnapshotStateDocumentError): Effect.Effect<never, RestorePhaseError> =>\n\t\tEffect.fail(\n\t\t\tnew RestorePhaseError({\n\t\t\t\tphase: err.kind === 'write' ? writePhase : readPhase,\n\t\t\t\tplugin,\n\t\t\t\tdetail: err.detail,\n\t\t\t\tcause: err.cause,\n\t\t\t}),\n\t\t);\n\n// -----------------------------------------------------------------------------\n// Participants — what restore needs from each plugin\n// -----------------------------------------------------------------------------\n\n/** One plugin's restore-side contributions: a live identity probe\n *  (read fresh from the live stack), an opaque pre-restore validation\n *  hook, and a post-restore hook. Mirrors `SnapshotableDecl`'s\n *  pre/post hook surface but closed over the plugin's key. */\nexport interface RestoreParticipant {\n\treadonly plugin: string;\n\treadonly liveIdentity: Effect.Effect<IdentitySlice>;\n\t/** Pre-restore application-level validation (version compat,\n\t *  side-state). Identity-guard runs FIRST and unilaterally; this\n\t *  is the plugin's extra hook. */\n\treadonly preRestore?: Effect.Effect<void>;\n\t/** Post-restore hook: re-validate, warm caches, etc. */\n\treadonly postRestore?: Effect.Effect<void>;\n}\n\n// -----------------------------------------------------------------------------\n// Metadata read — authoritative; absent / unparseable refuses restore.\n// -----------------------------------------------------------------------------\n\nconst readMeta = (\n\tartifactDir: string,\n\texpectedId: SnapshotId,\n): Effect.Effect<SnapshotMetadata, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst path = `${artifactDir}/${SnapshotLayout.metaFile}`;\n\t\tconst exists = yield* fs.exists(path).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (!exists) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'meta-absent',\n\t\t\t\t\tdetail: `snapshot meta.json not found at ${path}`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst text = yield* fs\n\t\t\t.readFileString(path)\n\t\t\t.pipe(Effect.catch(failPhase('read-meta', `read meta.json failed at ${path}`)));\n\t\tconst raw = yield* parseJsonText(text, {\n\t\t\tsource: path,\n\t\t\tmkError: (issue) =>\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'meta-corrupt',\n\t\t\t\t\tdetail: `meta.json is not valid JSON at ${path}`,\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t});\n\t\tconst meta = yield* decodeUnknown(SnapshotMetadataSchema, raw, {\n\t\t\tsource: path,\n\t\t\tmkError: (issue) =>\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'meta-corrupt',\n\t\t\t\t\tdetail: `meta.json failed schema decode at ${path}`,\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t});\n\t\tconst parsedId = parseSnapshotId(meta.id);\n\t\tif (parsedId === null) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'meta-corrupt',\n\t\t\t\t`meta.json contains an unsafe snapshot id: ${meta.id}`,\n\t\t\t);\n\t\t}\n\t\tif (parsedId !== expectedId) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'meta-corrupt',\n\t\t\t\t`meta.json id ${meta.id} does not match requested snapshot id ${expectedId}`,\n\t\t\t);\n\t\t}\n\t\treturn meta;\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.read-meta'));\n\nconst verifyIntegrity = (\n\tartifactDir: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tverifyArtifactIntegrity(artifactDir).pipe(\n\t\tEffect.catchTag('SnapshotIntegrityError', (err) =>\n\t\t\tEffect.fail(\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: err.kind === 'missing' ? 'read-integrity' : 'verify-integrity',\n\t\t\t\t\tdetail: err.detail,\n\t\t\t\t\tcause: err.cause,\n\t\t\t\t}),\n\t\t\t),\n\t\t),\n\t);\n\n// -----------------------------------------------------------------------------\n// Managed-container removal by label.\n// -----------------------------------------------------------------------------\n\n/** Restore must discard the current writable layer even when the live\n *  supervisor still holds a claim for the container. This is\n *  intentionally separate from orphan sweep, which skips claimed\n *  containers by design. */\nconst removeCapturedContainers = (\n\tmeta: SnapshotMetadata,\n\truntime: ContainerRuntime,\n\truntimeIdentity: SnapshotRuntimeIdentity,\n): Effect.Effect<void, RestorePhaseError> =>\n\tEffect.gen(function* () {\n\t\tfor (const captured of meta.containers) {\n\t\t\tyield* runtime\n\t\t\t\t.removeManagedContainers({\n\t\t\t\t\tapp: runtimeIdentity.app,\n\t\t\t\t\tstack: runtimeIdentity.stack,\n\t\t\t\t\tplugin: captured.plugin,\n\t\t\t\t\trole: captured.role,\n\t\t\t\t})\n\t\t\t\t.pipe(\n\t\t\t\t\tEffect.catch(\n\t\t\t\t\t\tfailPhase(\n\t\t\t\t\t\t\t'pre-cleanup',\n\t\t\t\t\t\t\t`remove managed containers for ${captured.plugin}/${captured.role} failed`,\n\t\t\t\t\t\t\tcaptured.plugin,\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t}\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.remove-containers'));\n\n// -----------------------------------------------------------------------------\n// Post-publish Docker finalization recovery marker.\n// -----------------------------------------------------------------------------\n//\n// Recovery contract: see `pending-marker.ts` and `recover-pending.ts`.\n// Restore writes the marker BEFORE the atomic swap, rewrites it after\n// each successful promote in `promoteStagedImages` so a mid-loop\n// crash leaves the marker reflecting exactly which images still need\n// retagging, and clears it once every entry has been promoted. The\n// supervise startup hook re-runs the recovery scanner before any\n// plugin acquire.\n\n// Re-export the marker shapes restored from the dedicated module so\n// downstream tests + the recovery scanner continue to import from\n// the snapshot orchestrator barrel.\nexport {\n\tRESTORE_PENDING_FILE_NAME,\n\tRestorePendingDocumentSchema,\n\tSNAPSHOT_RESTORE_PENDING_VERSION,\n\ttype RestorePendingDocument,\n};\n\ninterface StagedContainerImage {\n\treadonly captured: CapturedContainer;\n\treadonly stagedRef: ImageRef;\n\treadonly stagedImageTag: string;\n}\n\nconst stagedImageToPendingEntry = (image: StagedContainerImage): RestorePendingContainer => ({\n\tplugin: image.captured.plugin,\n\trole: image.captured.role,\n\ttargetImageName: image.captured.imageName,\n\tstagedImageTag: image.stagedImageTag,\n\t// The digest is the loaded image's content-addressed identity\n\t// (carried through `stageLoadedImage` from `loadImageBundle`'s\n\t// docker-load output). Persisting it in the marker lets the\n\t// recovery scanner re-tag from the digest as a fallback when both\n\t// `targetImageName` and `stagedImageTag` have been pruned out of\n\t// the daemon between crash and restart.\n\tdigest: image.stagedRef.digest,\n});\n\nconst loadedBundleTags = (bundle: { readonly refs: ReadonlyArray<ImageRef> }): Set<string> => {\n\tconst tags = new Set<string>();\n\tfor (const ref of bundle.refs) {\n\t\tif (ref.tag !== undefined) tags.add(ref.tag);\n\t}\n\treturn tags;\n};\n\nconst mintRestoreStagingTag = (): string => `devstack-snapshot:restore-${mintRandomSuffix(24)}`;\n\nconst mapMarkerIoError =\n\t(phase: RestorePhaseError['phase']) =>\n\t(err: RestorePendingMarkerIoError): Effect.Effect<never, RestorePhaseError> =>\n\t\tEffect.fail(new RestorePhaseError({ phase, detail: err.detail, cause: err.cause }));\n\nconst writeRestorePendingMarker = (args: {\n\treadonly runtimeRoot: string;\n\treadonly meta: SnapshotMetadata;\n\treadonly artifactDir: string;\n\treadonly stagedImages: ReadonlyArray<StagedContainerImage>;\n}): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> => {\n\tif (args.stagedImages.length === 0) return Effect.void;\n\tconst doc = makePendingMarkerDocument({\n\t\tmeta: args.meta,\n\t\tartifactDir: args.artifactDir,\n\t\tcontainers: args.stagedImages.map(stagedImageToPendingEntry),\n\t});\n\treturn writePendingMarkerIo(args.runtimeRoot, doc).pipe(\n\t\tEffect.catchTag(\n\t\t\t'SnapshotRestorePendingMarkerIoError',\n\t\t\tmapMarkerIoError('write-restore-pending'),\n\t\t),\n\t);\n};\n\nconst rewriteRestorePendingMarker = (\n\truntimeRoot: string,\n\tdoc: RestorePendingDocument,\n\tstillPending: ReadonlyArray<RestorePendingContainer>,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\twritePendingMarkerIo(runtimeRoot, rewritePendingMarkerContainers(doc, stillPending)).pipe(\n\t\tEffect.catchTag(\n\t\t\t'SnapshotRestorePendingMarkerIoError',\n\t\t\tmapMarkerIoError('write-restore-pending'),\n\t\t),\n\t);\n\nconst clearRestorePendingMarker = (\n\truntimeRoot: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tremovePendingMarkerIo(runtimeRoot).pipe(\n\t\tEffect.catchTag(\n\t\t\t'SnapshotRestorePendingMarkerIoError',\n\t\t\tmapMarkerIoError('clear-restore-pending'),\n\t\t),\n\t);\n\nconst readRestorePendingMarker = (\n\truntimeRoot: string,\n): Effect.Effect<RestorePendingDocument | null, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst path = pendingMarkerPath(runtimeRoot);\n\t\tconst exists = yield* fs.exists(path).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (!exists) return null;\n\t\tconst text = yield* fs\n\t\t\t.readFileString(path)\n\t\t\t.pipe(Effect.catch(failPhase('read-restore-pending', `read ${RESTORE_PENDING_FILE_NAME}`)));\n\t\tconst raw = yield* parseJsonText(text, {\n\t\t\tsource: path,\n\t\t\tmkError: (issue) =>\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'read-restore-pending',\n\t\t\t\t\tdetail: `${RESTORE_PENDING_FILE_NAME} is not valid JSON`,\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t});\n\t\treturn yield* decodeUnknown(RestorePendingDocumentSchema, raw, {\n\t\t\tsource: path,\n\t\t\tmkError: (issue) =>\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'read-restore-pending',\n\t\t\t\t\tdetail: `${RESTORE_PENDING_FILE_NAME} failed schema decode`,\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t});\n\t});\n\n// -----------------------------------------------------------------------------\n// Artifact preflight — no destructive cleanup until required files are present.\n// -----------------------------------------------------------------------------\n\nconst requirePathSegment = (\n\tkind: string,\n\tvalue: string,\n\tplugin?: string,\n): Effect.Effect<void, RestorePhaseError> =>\n\tisSafeSnapshotPathSegment(value)\n\t\t? Effect.void\n\t\t: failRestore('preflight', `unsafe snapshot ${kind} path segment: ${value}`, plugin);\n\nconst requireReadableNonEmptyFile = (\n\tpath: string,\n\tphase: RestorePhaseError['phase'],\n\tdetail: string,\n\tplugin?: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst stat = yield* fs\n\t\t\t.stat(path)\n\t\t\t.pipe(Effect.catch(failPhase(phase, `${detail}: stat failed at ${path}`, plugin)));\n\t\tif (stat.size === 0n) {\n\t\t\treturn yield* failRestore(phase, `${detail}: empty file at ${path}`, plugin);\n\t\t}\n\t\tyield* Stream.runDrain(fs.stream(path).pipe(Stream.take(1))).pipe(\n\t\t\tEffect.catch(failPhase(phase, `${detail}: read failed at ${path}`, plugin)),\n\t\t);\n\t});\n\nconst preflightCapturedContainer = (\n\tcaptured: CapturedContainer,\n\tartifactDir: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tyield* requirePathSegment('plugin', captured.plugin, captured.plugin);\n\t\tyield* requirePathSegment('role', captured.role, captured.plugin);\n\t\tif (!isSafeSnapshotRelativePath(captured.tarPath)) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'preflight',\n\t\t\t\t`unsafe container image tar path: ${captured.tarPath}`,\n\t\t\t\tcaptured.plugin,\n\t\t\t);\n\t\t}\n\t\tconst expectedTarPath = containerImagesBundlePath();\n\t\tif (captured.tarPath !== expectedTarPath) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'preflight',\n\t\t\t\t`container image tar path ${captured.tarPath} does not match canonical bundle ${expectedTarPath}`,\n\t\t\t\tcaptured.plugin,\n\t\t\t);\n\t\t}\n\t\tif (!isRestorableContainerImageName(captured.imageName)) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'preflight',\n\t\t\t\t`container imageName is not a restorable Docker tag destination: ${captured.imageName}`,\n\t\t\t\tcaptured.plugin,\n\t\t\t);\n\t\t}\n\t\tif (!isRestorableContainerImageName(captured.snapshotTag)) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'preflight',\n\t\t\t\t`container snapshotTag is not a restorable Docker tag source: ${captured.snapshotTag}`,\n\t\t\t\tcaptured.plugin,\n\t\t\t);\n\t\t}\n\t\tyield* requireReadableNonEmptyFile(\n\t\t\t`${artifactDir}/${captured.tarPath}`,\n\t\t\t'load-image',\n\t\t\t'container image tar is required',\n\t\t\tcaptured.plugin,\n\t\t);\n\t});\n\nconst preflightContributionDoc = (\n\tpluginKey: string,\n\tartifactDir: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst path = `${artifactDir}/${contributionPath(pluginKey)}`;\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst text = yield* fs\n\t\t\t.readFileString(path)\n\t\t\t.pipe(\n\t\t\t\tEffect.catch(\n\t\t\t\t\tfailPhase('read-contribution', `read contribution doc failed at ${path}`, pluginKey),\n\t\t\t\t),\n\t\t\t);\n\t\tconst raw = yield* parseJsonText(text, {\n\t\t\tsource: path,\n\t\t\tmkError: (issue) =>\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'read-contribution',\n\t\t\t\t\tplugin: pluginKey,\n\t\t\t\t\tdetail: `contribution doc is not valid JSON at ${path}`,\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t});\n\t\tconst decoded = yield* decodeUnknown(ContributionDocSchema, raw, {\n\t\t\tsource: path,\n\t\t\tmkError: (issue) =>\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'read-contribution',\n\t\t\t\t\tplugin: pluginKey,\n\t\t\t\t\tdetail: `contribution doc failed schema decode at ${path}`,\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t});\n\t\tif (decoded.plugin !== pluginKey) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'read-contribution',\n\t\t\t\t`contribution doc plugin ${decoded.plugin} does not match ${pluginKey}`,\n\t\t\t\tpluginKey,\n\t\t\t);\n\t\t}\n\t});\n\nconst preflightArtifact = (\n\tmeta: SnapshotMetadata,\n\tartifactDir: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst seenSnapshotTags = new Map<string, CapturedContainer>();\n\t\tfor (const captured of meta.containers) {\n\t\t\tyield* preflightCapturedContainer(captured, artifactDir);\n\t\t\tconst previous = seenSnapshotTags.get(captured.snapshotTag);\n\t\t\tif (previous !== undefined) {\n\t\t\t\treturn yield* failRestore(\n\t\t\t\t\t'preflight',\n\t\t\t\t\t`duplicate container snapshotTag ${captured.snapshotTag} for ${previous.plugin}/${previous.role} and ${captured.plugin}/${captured.role}`,\n\t\t\t\t\tcaptured.plugin,\n\t\t\t\t);\n\t\t\t}\n\t\t\tseenSnapshotTags.set(captured.snapshotTag, captured);\n\t\t}\n\t\tfor (const pluginKey of meta.participants) {\n\t\t\tyield* preflightContributionDoc(pluginKey, artifactDir);\n\t\t}\n\t\tconst statePath = `${artifactDir}/${SnapshotLayout.stateFile}`;\n\t\tconst stateExists = yield* fs.exists(statePath).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (stateExists) {\n\t\t\tyield* readSnapshotStateDocument(statePath).pipe(\n\t\t\t\tEffect.catchTag(\n\t\t\t\t\t'SnapshotStateDocumentError',\n\t\t\t\t\tfailStateDocument('read-state', 'expand-state'),\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\tif (meta.hostTreeIncluded) {\n\t\t\tconst tarPath = `${artifactDir}/${SnapshotLayout.hostTreeTar}`;\n\t\t\tyield* requireReadableNonEmptyFile(tarPath, 'untar-host-tree', 'host-tree tar is required');\n\t\t\tconst tarStream = fs.stream(tarPath).pipe(\n\t\t\t\tStream.mapError(\n\t\t\t\t\t(cause) =>\n\t\t\t\t\t\tnew HostTreeTarError({\n\t\t\t\t\t\t\tstage: 'entry-validation',\n\t\t\t\t\t\t\toperation: 'untar',\n\t\t\t\t\t\t\tdetail: `read host-tree tar failed at ${tarPath}`,\n\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t);\n\t\t\tyield* validateHostTreeTarEntries(tarStream).pipe(\n\t\t\t\tEffect.catch(failPhase('untar-host-tree', `host-tree tar entry validation failed`)),\n\t\t\t);\n\t\t}\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.preflight'));\n\n// -----------------------------------------------------------------------------\n// Image load + staged re-tag.\n// -----------------------------------------------------------------------------\n\nconst loadImageBundle = (\n\ttarPath: string,\n\tartifactDir: string,\n\truntime: ContainerRuntime,\n\texpectedSnapshotTags: ReadonlyArray<string>,\n): Effect.Effect<ReadonlyMap<string, ImageRef>, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst fullTarPath = `${artifactDir}/${tarPath}`;\n\t\tconst exists = yield* fs.exists(fullTarPath).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (!exists) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'load-image',\n\t\t\t\t\tdetail: `container image bundle absent at ${fullTarPath}`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst bundleTags = yield* readImageBundleTags(fullTarPath, tarPath).pipe(\n\t\t\tEffect.catch(failImageBundleTagScan('load-image')),\n\t\t);\n\t\tyield* verifyImageBundleTags(tarPath, bundleTags, expectedSnapshotTags).pipe(\n\t\t\tEffect.catch(failImageBundleTagScan('load-image')),\n\t\t);\n\t\tconst loaded = yield* runtime\n\t\t\t.loadImage(fs.stream(fullTarPath))\n\t\t\t.pipe(\n\t\t\t\tEffect.catch(\n\t\t\t\t\tfailPhase('load-image', `load container image bundle from ${fullTarPath} failed`),\n\t\t\t\t),\n\t\t\t);\n\t\tconst loadedTags = loadedBundleTags(loaded);\n\t\tconst missing = expectedSnapshotTags.filter((tag) => !loadedTags.has(tag));\n\t\tif (missing.length > 0) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'load-image',\n\t\t\t\t`container image bundle ${tarPath} did not load expected snapshot tags: ${missing.join(', ')}`,\n\t\t\t);\n\t\t}\n\t\tconst refsByTag = new Map<string, ImageRef>();\n\t\tfor (const ref of loaded.refs) {\n\t\t\tif (ref.tag === undefined || !expectedSnapshotTags.includes(ref.tag)) continue;\n\t\t\tif (refsByTag.has(ref.tag)) {\n\t\t\t\treturn yield* failRestore(\n\t\t\t\t\t'load-image',\n\t\t\t\t\t`container image bundle ${tarPath} loaded duplicate snapshot tag ${ref.tag}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\trefsByTag.set(ref.tag, ref);\n\t\t}\n\t\treturn refsByTag;\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.load-image-bundle'));\n\nconst expectedSnapshotTagsByBundle = (\n\tcontainers: ReadonlyArray<CapturedContainer>,\n): ReadonlyMap<string, ReadonlyArray<string>> => {\n\tconst byBundle = new Map<string, string[]>();\n\tfor (const captured of containers) {\n\t\tconst tags = byBundle.get(captured.tarPath);\n\t\tif (tags === undefined) {\n\t\t\tbyBundle.set(captured.tarPath, [captured.snapshotTag]);\n\t\t} else {\n\t\t\ttags.push(captured.snapshotTag);\n\t\t}\n\t}\n\treturn byBundle;\n};\n\nconst stageLoadedImage = (\n\tcaptured: CapturedContainer,\n\tloadedRef: ImageRef,\n\truntime: ContainerRuntime,\n\tregisterStagedImage: (image: StagedContainerImage) => Effect.Effect<void>,\n): Effect.Effect<StagedContainerImage, RestorePhaseError> =>\n\tEffect.gen(function* () {\n\t\tconst stagedImageTag = mintRestoreStagingTag();\n\t\tconst stagedImage: StagedContainerImage = {\n\t\t\tcaptured,\n\t\t\tstagedRef: { digest: loadedRef.digest, tag: stagedImageTag },\n\t\t\tstagedImageTag,\n\t\t};\n\t\tyield* registerStagedImage(stagedImage);\n\t\tyield* runtime\n\t\t\t.tagImage(loadedRef, stagedImageTag, { removeSourceAfterTag: true })\n\t\t\t.pipe(\n\t\t\t\tEffect.catch(\n\t\t\t\t\tfailPhase(\n\t\t\t\t\t\t'retag-image',\n\t\t\t\t\t\t`tag restored image ${captured.snapshotTag} as staging ref ${stagedImageTag} failed`,\n\t\t\t\t\t\tcaptured.plugin,\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\t\treturn stagedImage;\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.stage-image'));\n\nconst cleanupRestoreStagingImages = (\n\truntime: ContainerRuntime,\n\timages: ReadonlyArray<StagedContainerImage>,\n): Effect.Effect<void> =>\n\tEffect.forEach(\n\t\timages,\n\t\t(image) =>\n\t\t\truntime\n\t\t\t\t.removeImage(image.stagedRef)\n\t\t\t\t.pipe(\n\t\t\t\t\tEffect.catch((cause) =>\n\t\t\t\t\t\tEffect.logWarning(\n\t\t\t\t\t\t\t`remove restore staging image ${image.stagedImageTag} failed during restore cleanup: ${String(\n\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t)}`,\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t{ concurrency: 'unbounded' },\n\t).pipe(Effect.asVoid);\n\n/** Promote each staged image to its recorded name, rewriting the\n *  on-disk pending marker after each successful tag. If the loop\n *  fails mid-way the marker reflects exactly which images are still\n *  pending (the failed entry + every entry not yet attempted), so\n *  the supervise-startup `recoverPendingRestore` only has to retry\n *  the remaining set — no scanning Docker for \"which targets exist\n *  already?\" required. */\nconst promoteStagedImages = (\n\timages: ReadonlyArray<StagedContainerImage>,\n\truntime: ContainerRuntime,\n\truntimeStackRoot: string,\n\tpendingDoc: RestorePendingDocument | null,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tfor (let i = 0; i < images.length; i += 1) {\n\t\t\tconst image = images[i]!;\n\t\t\tyield* runtime\n\t\t\t\t.tagImage(image.stagedRef, image.captured.imageName, {\n\t\t\t\t\tremoveSourceAfterTag: true,\n\t\t\t\t})\n\t\t\t\t.pipe(\n\t\t\t\t\tEffect.catch(\n\t\t\t\t\t\tfailPhase(\n\t\t\t\t\t\t\t'retag-image',\n\t\t\t\t\t\t\t`tag staged image ${image.stagedImageTag} as ${image.captured.imageName} failed`,\n\t\t\t\t\t\t\timage.captured.plugin,\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t// Rewrite the marker with only the still-pending entries\n\t\t\t// (everything we haven't promoted yet). The final entry's\n\t\t\t// rewrite leaves an empty `containers: []` marker on disk;\n\t\t\t// `clearRestorePendingMarker` removes the file shortly\n\t\t\t// after this function returns.\n\t\t\tif (pendingDoc !== null) {\n\t\t\t\tconst stillPending = images.slice(i + 1).map(stagedImageToPendingEntry);\n\t\t\t\tyield* rewriteRestorePendingMarker(runtimeStackRoot, pendingDoc, stillPending);\n\t\t\t}\n\t\t}\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.promote-images'));\n\nconst restoreHostTree = (\n\tartifactDir: string,\n\ttarget: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst tarPath = `${artifactDir}/${SnapshotLayout.hostTreeTar}`;\n\t\tconst exists = yield* fs.exists(tarPath).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (!exists) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'untar-host-tree',\n\t\t\t\t\tdetail: `host-tree tar absent at ${tarPath}`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst tarStream = fs.stream(tarPath).pipe(\n\t\t\tStream.mapError(\n\t\t\t\t(cause) =>\n\t\t\t\t\tnew HostTreeTarError({\n\t\t\t\t\t\tstage: 'stream-stdin',\n\t\t\t\t\t\toperation: 'untar',\n\t\t\t\t\t\tdetail: `read host-tree tar failed at ${tarPath}`,\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t\tyield* Effect.scoped(untarHostTree(tarStream, { target })).pipe(\n\t\t\tEffect.catch(failPhase('untar-host-tree', `untar ${tarPath} to ${target} failed`)),\n\t\t);\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.host-tree'));\n\nconst LIVE_RESTORE_PRESERVED_PATHS: ReadonlyArray<StageAndSwapPreservedPath> = [\n\t{ relativePath: SNAPSHOTS_DIR_NAME, kind: 'directory' },\n\t{ relativePath: COMMAND_CHANNEL_COMMANDS_FILE_NAME, kind: 'file' },\n\t{ relativePath: COMMAND_CHANNEL_EVENTS_FILE_NAME, kind: 'file' },\n\t{ relativePath: 'roster.json', kind: 'file' },\n\t{ relativePath: 'container-claims.json', kind: 'file' },\n\t{ relativePath: 'snapshot.reservation', kind: 'file' },\n\t// Deploy/mint caches. The snapshot CAPTURES these (DEPLOY_CACHE_NAMESPACES in\n\t// descriptor.ts, tarred in capture.ts), and that captured copy — untarred into\n\t// staging, consistent with the restored chain — WINS (`overwrite: false`).\n\t// This live-side entry is only a FALLBACK: it carries the deploy ids forward\n\t// when staging doesn't already have them (e.g. a `snapshot → wipe → restore`\n\t// where the captured copy IS present, or a pre-capture snapshot where it is\n\t// not). Either way the post-restore boot REUSES the deploy instead of\n\t// re-running it with fresh ids (which would orphan every pre-snapshot object).\n\t// The generic per-call `cache/entry` is NOT a deploy namespace and stays\n\t// dropped (restore.test.ts pins that rollback).\n\t...DEPLOY_CACHE_NAMESPACES.map(\n\t\t(namespace): StageAndSwapPreservedPath => ({\n\t\t\trelativePath: `${CACHE_DIR_NAME}/${namespace}`,\n\t\t\tkind: 'directory',\n\t\t\t// The snapshot-CAPTURED copy (untarred into staging) wins; only fall\n\t\t\t// back to the live copy when staging doesn't carry it (e.g. a snapshot\n\t\t\t// taken before deploy-cache capture existed). Avoids clobbering the\n\t\t\t// snapshot-consistent id with a possibly-drifted live one.\n\t\t\toverwrite: false,\n\t\t}),\n\t),\n];\n\n// -----------------------------------------------------------------------------\n// Top-level restore — bracketed-atomic via stage-and-swap.\n// -----------------------------------------------------------------------------\n\nexport interface RestoreInputs {\n\treadonly snapshotId: SnapshotId;\n\treadonly artifactDir: string;\n\treadonly runtimeStackRoot: string;\n\treadonly runtimeStagingPath: string;\n\treadonly runtimeBackupPath: string;\n\treadonly participants: ReadonlyArray<RestoreParticipant>;\n\treadonly runtime: ContainerRuntime;\n\treadonly runtimeIdentity: SnapshotRuntimeIdentity;\n}\n\n/**\n * Run the full restore. Bracketed-atomic via `stageAndSwap` at the\n * runtime-root level — external watchers never observe a half-restored\n * tree.\n *\n * Order:\n *   1. Read meta.json (refuse if absent / corrupt — no mutation).\n *   2. Run identity-guard against runtime metadata and merged plugin\n *      contributions (refuse on any disagreement — no mutation).\n *   3. Pre-restore hooks (per-plugin validation; soft errors).\n *   4. Stage:\n *      - Untar host-tree into staging.\n *      - Copy state.json into staging.\n *      - Re-read contribution docs.\n *      - Load image bundles and stage verified snapshot tags.\n *      - Write a restore-pending marker into the staged root.\n *   5. Atomic swap staging → runtime root, preserving live command /\n *      event channel files and other explicit runtime-control files.\n *   6. Promote staged images to recorded refs, then remove captured\n *      managed containers by label. If this fails, the pending marker\n *      remains in the restored root for diagnosis/recovery.\n *   7. Post-restore hooks.\n *\n * The caller is responsible for `acquireReservation`; restore supplies\n * the runtime-control publish lock to `stageAndSwap`.\n */\nexport const runRestore = (\n\tinputs: RestoreInputs,\n): Effect.Effect<\n\tSnapshotMetadata,\n\tRestorePhaseError | IdentityGuardError | IdentityContributionConflictError | StageAndSwapError,\n\tFileSystem.FileSystem\n> =>\n\tEffect.gen(function* () {\n\t\tyield* Effect.annotateCurrentSpan({\n\t\t\t'devstack.snapshot.phase': 'restore',\n\t\t\t'devstack.snapshot.artifact': inputs.artifactDir,\n\t\t});\n\n\t\t// 1. Authoritative meta read.\n\t\tconst meta = yield* readMeta(inputs.artifactDir, inputs.snapshotId);\n\t\tyield* verifyIntegrity(inputs.artifactDir);\n\n\t\t// 2. Identity guard — compare the metadata's runtime identity\n\t\t//    and plugin-contributed identity. FAIL-CLOSED before any mutation.\n\t\tyield* runRuntimeIdentityGuard(\n\t\t\t{ app: meta.app, stack: meta.stack, network: meta.network },\n\t\t\tinputs.runtimeIdentity,\n\t\t);\n\t\tconst liveContributions: IdentityContribution[] = [];\n\t\tfor (const participant of inputs.participants) {\n\t\t\tconst slice = yield* participant.liveIdentity;\n\t\t\tliveContributions.push({ plugin: participant.plugin, slice });\n\t\t}\n\t\tconst live = yield* mergeContributions(liveContributions);\n\t\tyield* runIdentityGuard(meta.identity, live);\n\n\t\t// 3. Plugin-level preRestore hooks (run AFTER identity-guard so\n\t\t//    a mismatch refuses without ever calling them).\n\t\tfor (const participant of inputs.participants) {\n\t\t\tif (participant.preRestore) {\n\t\t\t\tyield* participant.preRestore.pipe(\n\t\t\t\t\tEffect.catch(failPhase('pre-restore-hook', `preRestore failed`, participant.plugin)),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tyield* preflightArtifact(meta, inputs.artifactDir);\n\n\t\t// 4. Stage filesystem content and non-destructive Docker image\n\t\t//    refs; atomic swap on success, then promote staged images and\n\t\t//    clear the recovery marker. The inner `Effect.scoped` keeps\n\t\t//    `cleanupRestoreStagingImages` armed across BOTH the\n\t\t//    stage-and-swap build phase AND the post-swap Docker handoff\n\t\t//    (promote → remove containers → clear marker). The handoff\n\t\t//    flag flips only after `clearRestorePendingMarker` returns,\n\t\t//    so a mid-handoff failure (e.g. promotion of image N of M\n\t\t//    refuses) leaves the swapped tree carrying the pending\n\t\t//    marker (re-supervise can detect the broken handoff) AND\n\t\t//    has the inner scope clean the still-tagged staging refs so\n\t\t//    Docker is not littered with orphan `devstack-snapshot:restore-*`\n\t\t//    tags. The post-publish three-step sequence runs under\n\t\t//    `Effect.uninterruptible` so an outer interrupt cannot\n\t\t//    arrive between promote and the marker clear and tear the\n\t\t//    handoff state.\n\t\tyield* Effect.scoped(\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst stagedImages: StagedContainerImage[] = [];\n\t\t\t\tlet recoveryHandoffComplete = false;\n\t\t\t\tyield* Effect.addFinalizer((exit) =>\n\t\t\t\t\tExit.isFailure(exit) && !recoveryHandoffComplete\n\t\t\t\t\t\t? cleanupRestoreStagingImages(inputs.runtime, stagedImages)\n\t\t\t\t\t\t: Effect.void,\n\t\t\t\t);\n\t\t\t\tyield* stageAndSwap({\n\t\t\t\t\ttargetPath: inputs.runtimeStackRoot,\n\t\t\t\t\tstagingPath: inputs.runtimeStagingPath,\n\t\t\t\t\tbackupPath: inputs.runtimeBackupPath,\n\t\t\t\t\tpreserveFromTarget: LIVE_RESTORE_PRESERVED_PATHS,\n\t\t\t\t\tpublishLockPath: runtimeControlLockPathForStackRoot(inputs.runtimeStackRoot),\n\t\t\t\t\tbuild: Effect.gen(function* () {\n\t\t\t\t\t\t// 4a. Untar host-tree into staging.\n\t\t\t\t\t\tif (meta.hostTreeIncluded) {\n\t\t\t\t\t\t\tyield* restoreHostTree(inputs.artifactDir, inputs.runtimeStagingPath);\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// 4b. Copy state.json into staging.\n\t\t\t\t\t\tconst fs = yield* FileSystem.FileSystem;\n\t\t\t\t\t\tconst srcState = `${inputs.artifactDir}/${SnapshotLayout.stateFile}`;\n\t\t\t\t\t\tconst stateExists = yield* fs\n\t\t\t\t\t\t\t.exists(srcState)\n\t\t\t\t\t\t\t.pipe(Effect.catch(() => Effect.succeed(false)));\n\t\t\t\t\t\tif (stateExists) {\n\t\t\t\t\t\t\tconst stateDoc = yield* readSnapshotStateDocument(srcState).pipe(\n\t\t\t\t\t\t\t\tEffect.catchTag(\n\t\t\t\t\t\t\t\t\t'SnapshotStateDocumentError',\n\t\t\t\t\t\t\t\t\tfailStateDocument('read-state', 'expand-state'),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\tyield* writeSnapshotStateDocument(\n\t\t\t\t\t\t\t\t`${inputs.runtimeStagingPath}/${SnapshotLayout.stateFile}`,\n\t\t\t\t\t\t\t\tstateDoc,\n\t\t\t\t\t\t\t).pipe(\n\t\t\t\t\t\t\t\tEffect.catchTag(\n\t\t\t\t\t\t\t\t\t'SnapshotStateDocumentError',\n\t\t\t\t\t\t\t\t\tfailStateDocument('expand-state', 'expand-state'),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// 4c. Read each contribution doc — the participants'\n\t\t\t\t\t\t//      post-restore hooks may want this; we surface it\n\t\t\t\t\t\t//      via the participant's own state-store reads after\n\t\t\t\t\t\t//      the swap lands.\n\t\t\t\t\t\tfor (const pluginKey of meta.participants) {\n\t\t\t\t\t\t\tconst path = `${inputs.artifactDir}/${contributionPath(pluginKey)}`;\n\t\t\t\t\t\t\tconst exists = yield* fs.exists(path).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\t\t\t\t\t\tif (!exists) {\n\t\t\t\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\t\t\t\t\t\tphase: 'read-contribution',\n\t\t\t\t\t\t\t\t\t\tplugin: pluginKey,\n\t\t\t\t\t\t\t\t\t\tdetail: `contribution doc absent at ${path}`,\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// 4d. Load + tag committed images under restore-staging\n\t\t\t\t\t\t//     refs only after all artifact expansion/copy work\n\t\t\t\t\t\t//     has succeeded. The Docker save manifest must match\n\t\t\t\t\t\t//     snapshot metadata exactly before docker load mutates\n\t\t\t\t\t\t//     the daemon; loaded refs then supply the real digest\n\t\t\t\t\t\t//     used for staging tags.\n\t\t\t\t\t\tconst expectedTagsByBundle = expectedSnapshotTagsByBundle(meta.containers);\n\t\t\t\t\t\tconst loadedRefsBySnapshotTag = new Map<string, ImageRef>();\n\t\t\t\t\t\tfor (const [tarPath, expectedTags] of expectedTagsByBundle) {\n\t\t\t\t\t\t\tconst loadedRefs = yield* loadImageBundle(\n\t\t\t\t\t\t\t\ttarPath,\n\t\t\t\t\t\t\t\tinputs.artifactDir,\n\t\t\t\t\t\t\t\tinputs.runtime,\n\t\t\t\t\t\t\t\texpectedTags,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\tfor (const [tag, ref] of loadedRefs) {\n\t\t\t\t\t\t\t\tloadedRefsBySnapshotTag.set(tag, ref);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t\tfor (const captured of meta.containers) {\n\t\t\t\t\t\t\tconst loadedRef = loadedRefsBySnapshotTag.get(captured.snapshotTag);\n\t\t\t\t\t\t\tif (loadedRef === undefined) {\n\t\t\t\t\t\t\t\treturn yield* failRestore(\n\t\t\t\t\t\t\t\t\t'load-image',\n\t\t\t\t\t\t\t\t\t`container image bundle did not return loaded ref for ${captured.snapshotTag}`,\n\t\t\t\t\t\t\t\t\tcaptured.plugin,\n\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tyield* stageLoadedImage(captured, loadedRef, inputs.runtime, (image) =>\n\t\t\t\t\t\t\t\tEffect.sync(() => {\n\t\t\t\t\t\t\t\t\tstagedImages.push(image);\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\t\t\t\t\t\tyield* writeRestorePendingMarker({\n\t\t\t\t\t\t\truntimeRoot: inputs.runtimeStagingPath,\n\t\t\t\t\t\t\tmeta,\n\t\t\t\t\t\t\tartifactDir: inputs.artifactDir,\n\t\t\t\t\t\t\tstagedImages,\n\t\t\t\t\t\t});\n\t\t\t\t\t\treturn stagedImages;\n\t\t\t\t\t}),\n\t\t\t\t});\n\n\t\t\t\t// 5. Docker finalization happens after filesystem publish.\n\t\t\t\t//    Promote → remove captured containers → clear marker, all\n\t\t\t\t//    inside the staging-cleanup scope. The pending marker\n\t\t\t\t//    landed in the swapped runtime root as part of the\n\t\t\t\t//    stage-and-swap; `promoteStagedImages` rewrites it after\n\t\t\t\t//    each successful tag so a mid-loop crash leaves the\n\t\t\t\t//    marker reflecting exactly which images still need\n\t\t\t\t//    retagging — `recoverPendingRestore` on the next\n\t\t\t\t//    supervise picks up the breadcrumb. Uninterruptible so\n\t\t\t\t//    an outer interrupt cannot tear the handoff between\n\t\t\t\t//    promote and `clearRestorePendingMarker`.\n\t\t\t\tif (stagedImages.length > 0) {\n\t\t\t\t\tconst pendingDocAfterSwap = yield* readRestorePendingMarker(inputs.runtimeStackRoot);\n\t\t\t\t\tyield* Effect.uninterruptible(\n\t\t\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\t\t\tyield* promoteStagedImages(\n\t\t\t\t\t\t\t\tstagedImages,\n\t\t\t\t\t\t\t\tinputs.runtime,\n\t\t\t\t\t\t\t\tinputs.runtimeStackRoot,\n\t\t\t\t\t\t\t\tpendingDocAfterSwap,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\tyield* removeCapturedContainers(meta, inputs.runtime, inputs.runtimeIdentity);\n\t\t\t\t\t\t\tyield* clearRestorePendingMarker(inputs.runtimeStackRoot);\n\t\t\t\t\t\t\trecoveryHandoffComplete = true;\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t} else {\n\t\t\t\t\trecoveryHandoffComplete = true;\n\t\t\t\t}\n\t\t\t}),\n\t\t);\n\n\t\t// 6. Post-restore hooks (after the swap lands so plugins read\n\t\t//    fresh state from the runtime root).\n\t\tfor (const participant of inputs.participants) {\n\t\t\tif (participant.postRestore) {\n\t\t\t\tyield* participant.postRestore.pipe(\n\t\t\t\t\tEffect.catch(failPhase('post-restore-hook', `postRestore failed`, participant.plugin)),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\treturn meta;\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore'));\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAoGA,IAAa,oBAAb,cAAuC,OAAO,kBAAqC,CAClF,6BACA;CACC,OAAO,OAAO,SAAS;EACtB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,CAAC;CACF,QAAQ,OAAO,SAAS,OAAO,OAAO;CACtC,QAAQ,OAAO;CACf,OAAO,OAAO,SAAS,OAAO,OAAO;CACrC,CACD,CAAC;AAEF,MAAM,YAAY,gBAAgB,kBAAkB;AAEpD,MAAM,eACL,OACA,QACA,WAEA,OAAO,KAAK,IAAI,kBAAkB;CAAE;CAAO;CAAQ;CAAQ,CAAC,CAAC;AAE9D,MAAM,0BACJ,OAAmC,YACnC,UACA,OAAO,KAAK,IAAI,kBAAkB;CAAE;CAAO;CAAQ,QAAQ,MAAM;CAAQ;CAAO,CAAC,CAAC;;;;AAKpF,MAAM,qBAEJ,WACA,YACA,YAEA,QACA,OAAO,KACN,IAAI,kBAAkB;CACrB,OAAO,IAAI,SAAS,UAAU,aAAa;CAC3C;CACA,QAAQ,IAAI;CACZ,OAAO,IAAI;CACX,CAAC,CACF;AAyBH,MAAM,YACL,aACA,eAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,GAAG,YAAY,GAAG,eAAe;AAE9C,KAAI,EAAC,OADiB,GAAG,OAAO,KAAK,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAEpF,QAAO,OAAO,OAAO,KACpB,IAAI,kBAAkB;EACrB,OAAO;EACP,QAAQ,mCAAmC;EAC3C,CAAC,CACF;CAcF,MAAM,OAAO,OAAO,cAAc,wBAAwB,OATvC,cAAc,OAHb,GAClB,eAAe,KAAK,CACpB,KAAK,OAAO,MAAM,UAAU,aAAa,4BAA4B,OAAO,CAAC,CAAC,EACzC;EACtC,QAAQ;EACR,UAAU,UACT,IAAI,kBAAkB;GACrB,OAAO;GACP,QAAQ,kCAAkC;GAC1C,OAAO,MAAM;GACb,CAAC;EACH,CAAC,EAC6D;EAC9D,QAAQ;EACR,UAAU,UACT,IAAI,kBAAkB;GACrB,OAAO;GACP,QAAQ,qCAAqC;GAC7C,OAAO,MAAM;GACb,CAAC;EACH,CAAC;CACF,MAAM,WAAW,gBAAgB,KAAK,GAAG;AACzC,KAAI,aAAa,KAChB,QAAO,OAAO,YACb,gBACA,6CAA6C,KAAK,KAClD;AAEF,KAAI,aAAa,WAChB,QAAO,OAAO,YACb,gBACA,gBAAgB,KAAK,GAAG,wCAAwC,aAChE;AAEF,QAAO;EACN,CAAC,KAAK,OAAO,SAAS,0CAA0C,CAAC;AAEpE,MAAM,mBACL,gBAEA,wBAAwB,YAAY,CAAC,KACpC,OAAO,SAAS,2BAA2B,QAC1C,OAAO,KACN,IAAI,kBAAkB;CACrB,OAAO,IAAI,SAAS,YAAY,mBAAmB;CACnD,QAAQ,IAAI;CACZ,OAAO,IAAI;CACX,CAAC,CACF,CACD,CACD;;;;;AAUF,MAAM,4BACL,MACA,SACA,oBAEA,OAAO,IAAI,aAAa;AACvB,MAAK,MAAM,YAAY,KAAK,WAC3B,QAAO,QACL,wBAAwB;EACxB,KAAK,gBAAgB;EACrB,OAAO,gBAAgB;EACvB,QAAQ,SAAS;EACjB,MAAM,SAAS;EACf,CAAC,CACD,KACA,OAAO,MACN,UACC,eACA,iCAAiC,SAAS,OAAO,GAAG,SAAS,KAAK,UAClE,SAAS,OACT,CACD,CACD;EAEF,CAAC,KAAK,OAAO,SAAS,kDAAkD,CAAC;AA8B5E,MAAM,6BAA6B,WAA0D;CAC5F,QAAQ,MAAM,SAAS;CACvB,MAAM,MAAM,SAAS;CACrB,iBAAiB,MAAM,SAAS;CAChC,gBAAgB,MAAM;CAOtB,QAAQ,MAAM,UAAU;CACxB;AAED,MAAM,oBAAoB,WAAoE;CAC7F,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,OAAO,OAAO,KACxB,KAAI,IAAI,QAAQ,KAAA,EAAW,MAAK,IAAI,IAAI,IAAI;AAE7C,QAAO;;AAGR,MAAM,8BAAsC,6BAA6B,iBAAiB,GAAG;AAE7F,MAAM,oBACJ,WACA,QACA,OAAO,KAAK,IAAI,kBAAkB;CAAE;CAAO,QAAQ,IAAI;CAAQ,OAAO,IAAI;CAAO,CAAC,CAAC;AAErF,MAAM,6BAA6B,SAKkC;AACpE,KAAI,KAAK,aAAa,WAAW,EAAG,QAAO,OAAO;CAClD,MAAM,MAAM,0BAA0B;EACrC,MAAM,KAAK;EACX,aAAa,KAAK;EAClB,YAAY,KAAK,aAAa,IAAI,0BAA0B;EAC5D,CAAC;AACF,QAAOA,mBAAqB,KAAK,aAAa,IAAI,CAAC,KAClD,OAAO,SACN,uCACA,iBAAiB,wBAAwB,CACzC,CACD;;AAGF,MAAM,+BACL,aACA,KACA,iBAEAA,mBAAqB,aAAa,+BAA+B,KAAK,aAAa,CAAC,CAAC,KACpF,OAAO,SACN,uCACA,iBAAiB,wBAAwB,CACzC,CACD;AAEF,MAAM,6BACL,gBAEAC,oBAAsB,YAAY,CAAC,KAClC,OAAO,SACN,uCACA,iBAAiB,wBAAwB,CACzC,CACD;AAEF,MAAM,4BACL,gBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,kBAAkB,YAAY;AAE3C,KAAI,EAAC,OADiB,GAAG,OAAO,KAAK,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EACxE,QAAO;AAapB,QAAO,OAAO,cAAc,8BAA8B,OATvC,cAAc,OAHb,GAClB,eAAe,KAAK,CACpB,KAAK,OAAO,MAAM,UAAU,wBAAwB,QAAQ,4BAA4B,CAAC,CAAC,EACrD;EACtC,QAAQ;EACR,UAAU,UACT,IAAI,kBAAkB;GACrB,OAAO;GACP,QAAQ,GAAG,0BAA0B;GACrC,OAAO,MAAM;GACb,CAAC;EACH,CAAC,EAC6D;EAC9D,QAAQ;EACR,UAAU,UACT,IAAI,kBAAkB;GACrB,OAAO;GACP,QAAQ,GAAG,0BAA0B;GACrC,OAAO,MAAM;GACb,CAAC;EACH,CAAC;EACD;AAMH,MAAM,sBACL,MACA,OACA,WAEA,0BAA0B,MAAM,GAC7B,OAAO,OACP,YAAY,aAAa,mBAAmB,KAAK,iBAAiB,SAAS,OAAO;AAEtF,MAAM,+BACL,MACA,OACA,QACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;AAI7B,MAAI,OAHgB,GAClB,KAAK,KAAK,CACV,KAAK,OAAO,MAAM,UAAU,OAAO,GAAG,OAAO,mBAAmB,QAAQ,OAAO,CAAC,CAAC,EAC1E,SAAS,GACjB,QAAO,OAAO,YAAY,OAAO,GAAG,OAAO,kBAAkB,QAAQ,OAAO;AAE7E,QAAO,OAAO,SAAS,GAAG,OAAO,KAAK,CAAC,KAAK,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,KAC5D,OAAO,MAAM,UAAU,OAAO,GAAG,OAAO,mBAAmB,QAAQ,OAAO,CAAC,CAC3E;EACA;AAEH,MAAM,8BACL,UACA,gBAEA,OAAO,IAAI,aAAa;AACvB,QAAO,mBAAmB,UAAU,SAAS,QAAQ,SAAS,OAAO;AACrE,QAAO,mBAAmB,QAAQ,SAAS,MAAM,SAAS,OAAO;AACjE,KAAI,CAAC,2BAA2B,SAAS,QAAQ,CAChD,QAAO,OAAO,YACb,aACA,oCAAoC,SAAS,WAC7C,SAAS,OACT;CAEF,MAAM,kBAAkB,2BAA2B;AACnD,KAAI,SAAS,YAAY,gBACxB,QAAO,OAAO,YACb,aACA,4BAA4B,SAAS,QAAQ,mCAAmC,mBAChF,SAAS,OACT;AAEF,KAAI,CAAC,+BAA+B,SAAS,UAAU,CACtD,QAAO,OAAO,YACb,aACA,mEAAmE,SAAS,aAC5E,SAAS,OACT;AAEF,KAAI,CAAC,+BAA+B,SAAS,YAAY,CACxD,QAAO,OAAO,YACb,aACA,gEAAgE,SAAS,eACzE,SAAS,OACT;AAEF,QAAO,4BACN,GAAG,YAAY,GAAG,SAAS,WAC3B,cACA,mCACA,SAAS,OACT;EACA;AAEH,MAAM,4BACL,WACA,gBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAO,GAAG,YAAY,GAAG,iBAAiB,UAAU;CAmB1D,MAAM,UAAU,OAAO,cAAc,uBAAuB,OAVzC,cAAc,QAPb,OADF,WAAW,YAE3B,eAAe,KAAK,CACpB,KACA,OAAO,MACN,UAAU,qBAAqB,mCAAmC,QAAQ,UAAU,CACpF,CACD,EACqC;EACtC,QAAQ;EACR,UAAU,UACT,IAAI,kBAAkB;GACrB,OAAO;GACP,QAAQ;GACR,QAAQ,yCAAyC;GACjD,OAAO,MAAM;GACb,CAAC;EACH,CAAC,EAC+D;EAChE,QAAQ;EACR,UAAU,UACT,IAAI,kBAAkB;GACrB,OAAO;GACP,QAAQ;GACR,QAAQ,4CAA4C;GACpD,OAAO,MAAM;GACb,CAAC;EACH,CAAC;AACF,KAAI,QAAQ,WAAW,UACtB,QAAO,OAAO,YACb,qBACA,2BAA2B,QAAQ,OAAO,kBAAkB,aAC5D,UACA;EAED;AAEH,MAAM,qBACL,MACA,gBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,mCAAmB,IAAI,KAAgC;AAC7D,MAAK,MAAM,YAAY,KAAK,YAAY;AACvC,SAAO,2BAA2B,UAAU,YAAY;EACxD,MAAM,WAAW,iBAAiB,IAAI,SAAS,YAAY;AAC3D,MAAI,aAAa,KAAA,EAChB,QAAO,OAAO,YACb,aACA,mCAAmC,SAAS,YAAY,OAAO,SAAS,OAAO,GAAG,SAAS,KAAK,OAAO,SAAS,OAAO,GAAG,SAAS,QACnI,SAAS,OACT;AAEF,mBAAiB,IAAI,SAAS,aAAa,SAAS;;AAErD,MAAK,MAAM,aAAa,KAAK,aAC5B,QAAO,yBAAyB,WAAW,YAAY;CAExD,MAAM,YAAY,GAAG,YAAY,GAAG,eAAe;AAEnD,KAAI,OADuB,GAAG,OAAO,UAAU,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,CAE9F,QAAO,0BAA0B,UAAU,CAAC,KAC3C,OAAO,SACN,8BACA,kBAAkB,cAAc,eAAe,CAC/C,CACD;AAEF,KAAI,KAAK,kBAAkB;EAC1B,MAAM,UAAU,GAAG,YAAY,GAAG,eAAe;AACjD,SAAO,4BAA4B,SAAS,mBAAmB,4BAA4B;AAY3F,SAAO,2BAXW,GAAG,OAAO,QAAQ,CAAC,KACpC,OAAO,UACL,UACA,IAAI,iBAAiB;GACpB,OAAO;GACP,WAAW;GACX,QAAQ,gCAAgC;GACxC;GACA,CAAC,CACH,CAEyC,CAAC,CAAC,KAC5C,OAAO,MAAM,UAAU,mBAAmB,wCAAwC,CAAC,CACnF;;EAED,CAAC,KAAK,OAAO,SAAS,0CAA0C,CAAC;AAMpE,MAAM,mBACL,SACA,aACA,SACA,yBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,cAAc,GAAG,YAAY,GAAG;AAEtC,KAAI,EAAC,OADiB,GAAG,OAAO,YAAY,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAE3F,QAAO,OAAO,OAAO,KACpB,IAAI,kBAAkB;EACrB,OAAO;EACP,QAAQ,oCAAoC;EAC5C,CAAC,CACF;AAKF,QAAO,sBAAsB,SAAS,OAHZ,oBAAoB,aAAa,QAAQ,CAAC,KACnE,OAAO,MAAM,uBAAuB,aAAa,CAAC,CAClD,EACiD,qBAAqB,CAAC,KACvE,OAAO,MAAM,uBAAuB,aAAa,CAAC,CAClD;CACD,MAAM,SAAS,OAAO,QACpB,UAAU,GAAG,OAAO,YAAY,CAAC,CACjC,KACA,OAAO,MACN,UAAU,cAAc,oCAAoC,YAAY,SAAS,CACjF,CACD;CACF,MAAM,aAAa,iBAAiB,OAAO;CAC3C,MAAM,UAAU,qBAAqB,QAAQ,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAC;AAC1E,KAAI,QAAQ,SAAS,EACpB,QAAO,OAAO,YACb,cACA,0BAA0B,QAAQ,wCAAwC,QAAQ,KAAK,KAAK,GAC5F;CAEF,MAAM,4BAAY,IAAI,KAAuB;AAC7C,MAAK,MAAM,OAAO,OAAO,MAAM;AAC9B,MAAI,IAAI,QAAQ,KAAA,KAAa,CAAC,qBAAqB,SAAS,IAAI,IAAI,CAAE;AACtE,MAAI,UAAU,IAAI,IAAI,IAAI,CACzB,QAAO,OAAO,YACb,cACA,0BAA0B,QAAQ,iCAAiC,IAAI,MACvE;AAEF,YAAU,IAAI,IAAI,KAAK,IAAI;;AAE5B,QAAO;EACN,CAAC,KAAK,OAAO,SAAS,kDAAkD,CAAC;AAE5E,MAAM,gCACL,eACgD;CAChD,MAAM,2BAAW,IAAI,KAAuB;AAC5C,MAAK,MAAM,YAAY,YAAY;EAClC,MAAM,OAAO,SAAS,IAAI,SAAS,QAAQ;AAC3C,MAAI,SAAS,KAAA,EACZ,UAAS,IAAI,SAAS,SAAS,CAAC,SAAS,YAAY,CAAC;MAEtD,MAAK,KAAK,SAAS,YAAY;;AAGjC,QAAO;;AAGR,MAAM,oBACL,UACA,WACA,SACA,wBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,iBAAiB,uBAAuB;CAC9C,MAAM,cAAoC;EACzC;EACA,WAAW;GAAE,QAAQ,UAAU;GAAQ,KAAK;GAAgB;EAC5D;EACA;AACD,QAAO,oBAAoB,YAAY;AACvC,QAAO,QACL,SAAS,WAAW,gBAAgB,EAAE,sBAAsB,MAAM,CAAC,CACnE,KACA,OAAO,MACN,UACC,eACA,sBAAsB,SAAS,YAAY,kBAAkB,eAAe,UAC5E,SAAS,OACT,CACD,CACD;AACF,QAAO;EACN,CAAC,KAAK,OAAO,SAAS,4CAA4C,CAAC;AAEtE,MAAM,+BACL,SACA,WAEA,OAAO,QACN,SACC,UACA,QACE,YAAY,MAAM,UAAU,CAC5B,KACA,OAAO,OAAO,UACb,OAAO,WACN,gCAAgC,MAAM,eAAe,kCAAkC,OACtF,MACA,GACD,CACD,CACD,EACH,EAAE,aAAa,aAAa,CAC5B,CAAC,KAAK,OAAO,OAAO;;;;;;;;AAStB,MAAM,uBACL,QACA,SACA,kBACA,eAEA,OAAO,IAAI,aAAa;AACvB,MAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,GAAG;EAC1C,MAAM,QAAQ,OAAO;AACrB,SAAO,QACL,SAAS,MAAM,WAAW,MAAM,SAAS,WAAW,EACpD,sBAAsB,MACtB,CAAC,CACD,KACA,OAAO,MACN,UACC,eACA,oBAAoB,MAAM,eAAe,MAAM,MAAM,SAAS,UAAU,UACxE,MAAM,SAAS,OACf,CACD,CACD;AAMF,MAAI,eAAe,KAElB,QAAO,4BAA4B,kBAAkB,YADhC,OAAO,MAAM,IAAI,EAAE,CAAC,IAAI,0BACgC,CAAC;;EAG/E,CAAC,KAAK,OAAO,SAAS,+CAA+C,CAAC;AAEzE,MAAM,mBACL,aACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,UAAU,GAAG,YAAY,GAAG,eAAe;AAEjD,KAAI,EAAC,OADiB,GAAG,OAAO,QAAQ,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAEvF,QAAO,OAAO,OAAO,KACpB,IAAI,kBAAkB;EACrB,OAAO;EACP,QAAQ,2BAA2B;EACnC,CAAC,CACF;CAEF,MAAM,YAAY,GAAG,OAAO,QAAQ,CAAC,KACpC,OAAO,UACL,UACA,IAAI,iBAAiB;EACpB,OAAO;EACP,WAAW;EACX,QAAQ,gCAAgC;EACxC;EACA,CAAC,CACH,CACD;AACD,QAAO,OAAO,OAAO,cAAc,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,KAC1D,OAAO,MAAM,UAAU,mBAAmB,SAAS,QAAQ,MAAM,OAAO,SAAS,CAAC,CAClF;EACA,CAAC,KAAK,OAAO,SAAS,0CAA0C,CAAC;AAEpE,MAAM,+BAAyE;CAC9E;EAAE,cAAc;EAAoB,MAAM;EAAa;CACvD;EAAE,cAAc;EAAoC,MAAM;EAAQ;CAClE;EAAE,cAAc;EAAkC,MAAM;EAAQ;CAChE;EAAE,cAAc;EAAe,MAAM;EAAQ;CAC7C;EAAE,cAAc;EAAyB,MAAM;EAAQ;CACvD;EAAE,cAAc;EAAwB,MAAM;EAAQ;CAWtD,GAAG,wBAAwB,KACzB,eAA0C;EAC1C,cAAc,GAAG,eAAe,GAAG;EACnC,MAAM;EAKN,WAAW;EACX,EACD;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CD,MAAa,cACZ,WAMA,OAAO,IAAI,aAAa;AACvB,QAAO,OAAO,oBAAoB;EACjC,2BAA2B;EAC3B,8BAA8B,OAAO;EACrC,CAAC;CAGF,MAAM,OAAO,OAAO,SAAS,OAAO,aAAa,OAAO,WAAW;AACnE,QAAO,gBAAgB,OAAO,YAAY;AAI1C,QAAO,wBACN;EAAE,KAAK,KAAK;EAAK,OAAO,KAAK;EAAO,SAAS,KAAK;EAAS,EAC3D,OAAO,gBACP;CACD,MAAM,oBAA4C,EAAE;AACpD,MAAK,MAAM,eAAe,OAAO,cAAc;EAC9C,MAAM,QAAQ,OAAO,YAAY;AACjC,oBAAkB,KAAK;GAAE,QAAQ,YAAY;GAAQ;GAAO,CAAC;;CAE9D,MAAM,OAAO,OAAO,mBAAmB,kBAAkB;AACzD,QAAO,iBAAiB,KAAK,UAAU,KAAK;AAI5C,MAAK,MAAM,eAAe,OAAO,aAChC,KAAI,YAAY,WACf,QAAO,YAAY,WAAW,KAC7B,OAAO,MAAM,UAAU,oBAAoB,qBAAqB,YAAY,OAAO,CAAC,CACpF;AAIH,QAAO,kBAAkB,MAAM,OAAO,YAAY;AAkBlD,QAAO,OAAO,OACb,OAAO,IAAI,aAAa;EACvB,MAAM,eAAuC,EAAE;EAC/C,IAAI,0BAA0B;AAC9B,SAAO,OAAO,cAAc,SAC3B,KAAK,UAAU,KAAK,IAAI,CAAC,0BACtB,4BAA4B,OAAO,SAAS,aAAa,GACzD,OAAO,KACV;AACD,SAAO,aAAa;GACnB,YAAY,OAAO;GACnB,aAAa,OAAO;GACpB,YAAY,OAAO;GACnB,oBAAoB;GACpB,iBAAiB,mCAAmC,OAAO,iBAAiB;GAC5E,OAAO,OAAO,IAAI,aAAa;AAE9B,QAAI,KAAK,iBACR,QAAO,gBAAgB,OAAO,aAAa,OAAO,mBAAmB;IAGtE,MAAM,KAAK,OAAO,WAAW;IAC7B,MAAM,WAAW,GAAG,OAAO,YAAY,GAAG,eAAe;AAIzD,QAAI,OAHuB,GACzB,OAAO,SAAS,CAChB,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAChC;KAChB,MAAM,WAAW,OAAO,0BAA0B,SAAS,CAAC,KAC3D,OAAO,SACN,8BACA,kBAAkB,cAAc,eAAe,CAC/C,CACD;AACD,YAAO,2BACN,GAAG,OAAO,mBAAmB,GAAG,eAAe,aAC/C,SACA,CAAC,KACD,OAAO,SACN,8BACA,kBAAkB,gBAAgB,eAAe,CACjD,CACD;;AAMF,SAAK,MAAM,aAAa,KAAK,cAAc;KAC1C,MAAM,OAAO,GAAG,OAAO,YAAY,GAAG,iBAAiB,UAAU;AAEjE,SAAI,EAAC,OADiB,GAAG,OAAO,KAAK,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAEpF,QAAO,OAAO,OAAO,KACpB,IAAI,kBAAkB;MACrB,OAAO;MACP,QAAQ;MACR,QAAQ,8BAA8B;MACtC,CAAC,CACF;;IASH,MAAM,uBAAuB,6BAA6B,KAAK,WAAW;IAC1E,MAAM,0CAA0B,IAAI,KAAuB;AAC3D,SAAK,MAAM,CAAC,SAAS,iBAAiB,sBAAsB;KAC3D,MAAM,aAAa,OAAO,gBACzB,SACA,OAAO,aACP,OAAO,SACP,aACA;AACD,UAAK,MAAM,CAAC,KAAK,QAAQ,WACxB,yBAAwB,IAAI,KAAK,IAAI;;AAGvC,SAAK,MAAM,YAAY,KAAK,YAAY;KACvC,MAAM,YAAY,wBAAwB,IAAI,SAAS,YAAY;AACnE,SAAI,cAAc,KAAA,EACjB,QAAO,OAAO,YACb,cACA,wDAAwD,SAAS,eACjE,SAAS,OACT;AAEF,YAAO,iBAAiB,UAAU,WAAW,OAAO,UAAU,UAC7D,OAAO,WAAW;AACjB,mBAAa,KAAK,MAAM;OACvB,CACF;;AAEF,WAAO,0BAA0B;KAChC,aAAa,OAAO;KACpB;KACA,aAAa,OAAO;KACpB;KACA,CAAC;AACF,WAAO;KACN;GACF,CAAC;AAaF,MAAI,aAAa,SAAS,GAAG;GAC5B,MAAM,sBAAsB,OAAO,yBAAyB,OAAO,iBAAiB;AACpF,UAAO,OAAO,gBACb,OAAO,IAAI,aAAa;AACvB,WAAO,oBACN,cACA,OAAO,SACP,OAAO,kBACP,oBACA;AACD,WAAO,yBAAyB,MAAM,OAAO,SAAS,OAAO,gBAAgB;AAC7E,WAAO,0BAA0B,OAAO,iBAAiB;AACzD,8BAA0B;KACzB,CACF;QAED,2BAA0B;GAE1B,CACF;AAID,MAAK,MAAM,eAAe,OAAO,aAChC,KAAI,YAAY,YACf,QAAO,YAAY,YAAY,KAC9B,OAAO,MAAM,UAAU,qBAAqB,sBAAsB,YAAY,OAAO,CAAC,CACtF;AAIH,QAAO;EACN,CAAC,KAAK,OAAO,SAAS,gCAAgC,CAAC"}
+{"version":3,"file":"restore.mjs","names":[],"sources":["../../../src/orchestrators/snapshot/restore.ts"],"sourcesContent":["// Restore pipeline.\n//\n// Architecture § Snapshot lifecycle (restore half):\n//\n//   Identity guard (chain identity + plugin contributions)\n//       │   (refuse and stop if mismatch — nothing touched)\n//       ▼\n//   Stage atomic restore in tempdir\n//       │\n//       ▼\n//   Per plugin: expand tar to staging, load committed images\n//       │\n//       ▼\n//   Atomic swap into runtime dir, preserving live control files\n//       │\n//       ▼\n//   snapshot.restored event → next stack acquire picks it up\n//\n// Bracketed-atomic — Tension 9 decision: one outer atomic swap, not\n// per-phase idempotency.\n\nimport { mintRandomSuffix } from '../../substrate/runtime/random-suffix.ts';\n\nimport { Effect, Exit, FileSystem, Schema, Stream } from 'effect';\n\nimport type { ContainerRuntime, ImageRef } from '../../contracts/container-runtime.ts';\nimport {\n\tHostTreeTarError,\n\tuntarHostTree,\n\tvalidateHostTreeTarEntries,\n} from '../../substrate/runtime/host-tree-tar/index.ts';\nimport { decodeUnknown, parseJsonText } from '../../substrate/runtime/runtime-decode.ts';\nimport {\n\tContributionDocSchema,\n\tcontainerImagesBundlePath,\n\tcontributionPath,\n\tdeployCacheSubtreeRelPaths,\n\tSnapshotLayout,\n\tSnapshotMetadataSchema,\n\ttype SnapshotId,\n\ttype CapturedContainer,\n\ttype IdentitySlice,\n\ttype SnapshotGraphInputIdentity,\n\ttype SnapshotMetadata,\n\tisRestorableContainerImageName,\n\tisSafeSnapshotPathSegment,\n\tisSafeSnapshotRelativePath,\n\tparseSnapshotId,\n} from './descriptor.ts';\nimport {\n\tmakeTarReaderState,\n\tprocessTarChunk,\n\tfinishTarReader,\n\tskipEntry,\n\tstopScan,\n\ttype TarEntry,\n} from '../../substrate/runtime/tar/reader.ts';\nimport { makePhaseFailer } from './phase-error.ts';\nimport {\n\tmergeContributions,\n\trequireIdentity,\n\trunIdentityGuard,\n\trunRuntimeIdentityGuard,\n\ttype IdentityContribution,\n\ttype IdentityContributionConflictError,\n\ttype IdentityGuardError,\n\ttype SnapshotRuntimeIdentity,\n} from './identity-guard.ts';\nimport {\n\ttype StageAndSwapError,\n\ttype StageAndSwapPreservedPath,\n} from '../../substrate/runtime/stage-and-swap/index.ts';\nimport { executeFsPlan, type ReconcileFsOp } from '../../substrate/runtime/reconcile/index.ts';\nimport {\n\tCOMMAND_CHANNEL_COMMANDS_FILE_NAME,\n\tCOMMAND_CHANNEL_EVENTS_FILE_NAME,\n\truntimeControlLockPathForStackRoot,\n} from '../../substrate/runtime/cross-process/command-channel/index.ts';\nimport {\n\tImageBundleTagScanError,\n\treadImageBundleTags,\n\tverifyImageBundleTags,\n} from './image-bundle-tags.ts';\nimport { verifyArtifactIntegrity } from './integrity.ts';\nimport { clearRestoreSentinel, writeRestoreSentinel } from './interrupted-restore.ts';\nimport { CACHE_DIR_NAME, SNAPSHOTS_DIR_NAME } from './wipe.ts';\n\n// -----------------------------------------------------------------------------\n// Errors\n// -----------------------------------------------------------------------------\n\n/** Tagged failure during a restore step. Phase discriminates the\n *  failing step so the user-facing message can point at it. */\nexport class RestorePhaseError extends Schema.TaggedErrorClass<RestorePhaseError>()(\n\t'SnapshotRestorePhaseError',\n\t{\n\t\tphase: Schema.Literals([\n\t\t\t'read-meta',\n\t\t\t'meta-corrupt',\n\t\t\t'meta-absent',\n\t\t\t'read-contribution',\n\t\t\t'read-integrity',\n\t\t\t'verify-integrity',\n\t\t\t'preflight',\n\t\t\t'cache-missing',\n\t\t\t'pre-restore-hook',\n\t\t\t'untar-host-tree',\n\t\t\t'load-image',\n\t\t\t'retag-image',\n\t\t\t'post-restore-hook',\n\t\t\t'pre-cleanup',\n\t\t\t'resume',\n\t\t\t'missing-subtree-fatal',\n\t\t\t'graph-input-mismatch',\n\t\t]),\n\t\tplugin: Schema.optional(Schema.String),\n\t\tdetail: Schema.String,\n\t\tcause: Schema.optional(Schema.Defect),\n\t},\n) {}\n\nconst failPhase = makePhaseFailer(RestorePhaseError);\n\nconst failRestore = (\n\tphase: RestorePhaseError['phase'],\n\tdetail: string,\n\tplugin?: string,\n): Effect.Effect<never, RestorePhaseError> =>\n\tEffect.fail(new RestorePhaseError({ phase, plugin, detail }));\n\nconst failImageBundleTagScan =\n\t(phase: RestorePhaseError['phase'], plugin?: string) =>\n\t(cause: ImageBundleTagScanError): Effect.Effect<never, RestorePhaseError> =>\n\t\tEffect.fail(new RestorePhaseError({ phase, plugin, detail: cause.detail, cause }));\n\n// -----------------------------------------------------------------------------\n// Participants — what restore needs from each plugin\n// -----------------------------------------------------------------------------\n\n/** One plugin's restore-side contributions: a live identity probe\n *  (read fresh from the live stack), an opaque pre-restore validation\n *  hook, and a post-restore hook. Mirrors `SnapshotableDecl`'s\n *  pre/post hook surface but closed over the plugin's key. */\nexport interface RestoreParticipant {\n\treadonly plugin: string;\n\treadonly liveIdentity: Effect.Effect<IdentitySlice>;\n\t/** Pre-restore application-level validation (version compat,\n\t *  side-state). Identity-guard runs FIRST and unilaterally; this\n\t *  is the plugin's extra hook. */\n\treadonly preRestore?: Effect.Effect<void>;\n\t/** Post-restore hook: re-validate caches or plugin side state. */\n\treadonly postRestore?: Effect.Effect<void>;\n}\n\n// -----------------------------------------------------------------------------\n// Metadata read — authoritative; absent / unparseable refuses restore.\n// -----------------------------------------------------------------------------\n\nconst readMeta = (\n\tartifactDir: string,\n\texpectedId: SnapshotId,\n): Effect.Effect<SnapshotMetadata, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst path = `${artifactDir}/${SnapshotLayout.metaFile}`;\n\t\tconst exists = yield* fs.exists(path).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (!exists) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'meta-absent',\n\t\t\t\t\tdetail: `snapshot meta.json not found at ${path}`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst text = yield* fs\n\t\t\t.readFileString(path)\n\t\t\t.pipe(Effect.catch(failPhase('read-meta', `read meta.json failed at ${path}`)));\n\t\tconst raw = yield* parseJsonText(text, {\n\t\t\tsource: path,\n\t\t\tmkError: (issue) =>\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'meta-corrupt',\n\t\t\t\t\tdetail: `meta.json is not valid JSON at ${path}`,\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t});\n\t\tconst meta = yield* decodeUnknown(SnapshotMetadataSchema, raw, {\n\t\t\tsource: path,\n\t\t\tmkError: (issue) =>\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'meta-corrupt',\n\t\t\t\t\tdetail: `meta.json failed schema decode at ${path}`,\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t});\n\t\tconst parsedId = parseSnapshotId(meta.id);\n\t\tif (parsedId === null) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'meta-corrupt',\n\t\t\t\t`meta.json contains an unsafe snapshot id: ${meta.id}`,\n\t\t\t);\n\t\t}\n\t\tif (parsedId !== expectedId) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'meta-corrupt',\n\t\t\t\t`meta.json id ${meta.id} does not match requested snapshot id ${expectedId}`,\n\t\t\t);\n\t\t}\n\t\treturn meta;\n\t});\n\nconst verifyIntegrity = (\n\tartifactDir: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tverifyArtifactIntegrity(artifactDir).pipe(\n\t\tEffect.catchTag('SnapshotIntegrityError', (err) =>\n\t\t\tEffect.fail(\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: err.kind === 'missing' ? 'read-integrity' : 'verify-integrity',\n\t\t\t\t\tdetail: err.detail,\n\t\t\t\t\tcause: err.cause,\n\t\t\t\t}),\n\t\t\t),\n\t\t),\n\t);\n\n// -----------------------------------------------------------------------------\n// Managed-container removal by label.\n// -----------------------------------------------------------------------------\n\n/** Restore must discard the current writable layer even when the live\n *  supervisor still holds a claim for the container. This is\n *  intentionally separate from orphan sweep, which skips claimed\n *  containers by design. */\nconst removeCapturedContainers = (\n\tmeta: SnapshotMetadata,\n\truntime: ContainerRuntime,\n\truntimeIdentity: SnapshotRuntimeIdentity,\n): Effect.Effect<void, RestorePhaseError> =>\n\tEffect.gen(function* () {\n\t\tfor (const captured of meta.containers) {\n\t\t\tyield* runtime\n\t\t\t\t.removeManagedContainers({\n\t\t\t\t\tapp: runtimeIdentity.app,\n\t\t\t\t\tstack: runtimeIdentity.stack,\n\t\t\t\t\tplugin: captured.plugin,\n\t\t\t\t\trole: captured.role,\n\t\t\t\t})\n\t\t\t\t.pipe(\n\t\t\t\t\tEffect.catch(\n\t\t\t\t\t\tfailPhase(\n\t\t\t\t\t\t\t'pre-cleanup',\n\t\t\t\t\t\t\t`remove managed containers for ${captured.plugin}/${captured.role} failed`,\n\t\t\t\t\t\t\tcaptured.plugin,\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t}\n\t});\n\n// -----------------------------------------------------------------------------\n// Post-publish Docker image finalization.\n// -----------------------------------------------------------------------------\n//\n// After the atomic swap, each staged image is re-tagged to its\n// captured target name (`promoteStagedImages`) and the original\n// captured containers are removed. The IMAGE resumption contract needs\n// no scanner: the staged image is left at its TARGET name, so on the\n// next boot the supervisor's image-match adoption (`decideRunAction` in\n// `runtime/docker/container.ts`) finds the image locally by name and\n// `docker run`s it without scanning or re-tagging — the resumption\n// contract is carried by the image name itself.\n//\n// The one gap the image-name contract does NOT cover is a hard kill\n// (SIGKILL / power-loss) landing BETWEEN the atomic swap and the end of\n// this promotion+removal handoff: the swap published a new tree but the\n// images are only PARTIALLY promoted, and `Effect.uninterruptible` does\n// not survive a SIGKILL so the cleanup finalizer never runs. The\n// interrupted-restore sentinel (`interrupted-restore.ts`) closes exactly\n// that gap — it rides the swap into the live root and is cleared the\n// instant this handoff completes, so the next boot's\n// `recoverInterruptedRestore` resumes a still-pending one and a clean\n// restore leaves nothing behind.\n\ninterface StagedContainerImage {\n\treadonly captured: CapturedContainer;\n\treadonly stagedRef: ImageRef;\n\treadonly stagedImageTag: string;\n}\n\nconst loadedBundleTags = (bundle: { readonly refs: ReadonlyArray<ImageRef> }): Set<string> => {\n\tconst tags = new Set<string>();\n\tfor (const ref of bundle.refs) {\n\t\tif (ref.tag !== undefined) tags.add(ref.tag);\n\t}\n\treturn tags;\n};\n\nconst mintRestoreStagingTag = (): string => `devstack-snapshot:restore-${mintRandomSuffix(24)}`;\n\n// -----------------------------------------------------------------------------\n// Artifact preflight — no destructive cleanup until required files are present.\n// -----------------------------------------------------------------------------\n\nconst requirePathSegment = (\n\tkind: string,\n\tvalue: string,\n\tplugin?: string,\n): Effect.Effect<void, RestorePhaseError> =>\n\tisSafeSnapshotPathSegment(value)\n\t\t? Effect.void\n\t\t: failRestore('preflight', `unsafe snapshot ${kind} path segment: ${value}`, plugin);\n\nconst requireReadableNonEmptyFile = (\n\tpath: string,\n\tphase: RestorePhaseError['phase'],\n\tdetail: string,\n\tplugin?: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst stat = yield* fs\n\t\t\t.stat(path)\n\t\t\t.pipe(Effect.catch(failPhase(phase, `${detail}: stat failed at ${path}`, plugin)));\n\t\tif (stat.size === 0n) {\n\t\t\treturn yield* failRestore(phase, `${detail}: empty file at ${path}`, plugin);\n\t\t}\n\t\tyield* Stream.runDrain(fs.stream(path).pipe(Stream.take(1))).pipe(\n\t\t\tEffect.catch(failPhase(phase, `${detail}: read failed at ${path}`, plugin)),\n\t\t);\n\t});\n\nconst preflightCapturedContainer = (\n\tcaptured: CapturedContainer,\n\tartifactDir: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tyield* requirePathSegment('plugin', captured.plugin, captured.plugin);\n\t\tyield* requirePathSegment('role', captured.role, captured.plugin);\n\t\tif (!isSafeSnapshotRelativePath(captured.tarPath)) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'preflight',\n\t\t\t\t`unsafe container image tar path: ${captured.tarPath}`,\n\t\t\t\tcaptured.plugin,\n\t\t\t);\n\t\t}\n\t\tconst expectedTarPath = containerImagesBundlePath();\n\t\tif (captured.tarPath !== expectedTarPath) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'preflight',\n\t\t\t\t`container image tar path ${captured.tarPath} does not match canonical bundle ${expectedTarPath}`,\n\t\t\t\tcaptured.plugin,\n\t\t\t);\n\t\t}\n\t\tif (!isRestorableContainerImageName(captured.imageName)) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'preflight',\n\t\t\t\t`container imageName is not a restorable Docker tag destination: ${captured.imageName}`,\n\t\t\t\tcaptured.plugin,\n\t\t\t);\n\t\t}\n\t\tif (!isRestorableContainerImageName(captured.snapshotTag)) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'preflight',\n\t\t\t\t`container snapshotTag is not a restorable Docker tag source: ${captured.snapshotTag}`,\n\t\t\t\tcaptured.plugin,\n\t\t\t);\n\t\t}\n\t\tyield* requireReadableNonEmptyFile(\n\t\t\t`${artifactDir}/${captured.tarPath}`,\n\t\t\t'load-image',\n\t\t\t'container image tar is required',\n\t\t\tcaptured.plugin,\n\t\t);\n\t});\n\nconst preflightContributionDoc = (\n\tpluginKey: string,\n\tartifactDir: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst path = `${artifactDir}/${contributionPath(pluginKey)}`;\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst text = yield* fs\n\t\t\t.readFileString(path)\n\t\t\t.pipe(\n\t\t\t\tEffect.catch(\n\t\t\t\t\tfailPhase('read-contribution', `read contribution doc failed at ${path}`, pluginKey),\n\t\t\t\t),\n\t\t\t);\n\t\tconst raw = yield* parseJsonText(text, {\n\t\t\tsource: path,\n\t\t\tmkError: (issue) =>\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'read-contribution',\n\t\t\t\t\tplugin: pluginKey,\n\t\t\t\t\tdetail: `contribution doc is not valid JSON at ${path}`,\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t});\n\t\tconst decoded = yield* decodeUnknown(ContributionDocSchema, raw, {\n\t\t\tsource: path,\n\t\t\tmkError: (issue) =>\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'read-contribution',\n\t\t\t\t\tplugin: pluginKey,\n\t\t\t\t\tdetail: `contribution doc failed schema decode at ${path}`,\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t});\n\t\tif (decoded.plugin !== pluginKey) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'read-contribution',\n\t\t\t\t`contribution doc plugin ${decoded.plugin} does not match ${pluginKey}`,\n\t\t\t\tpluginKey,\n\t\t\t);\n\t\t}\n\t});\n\nconst preflightArtifact = (\n\tmeta: SnapshotMetadata,\n\tartifactDir: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst seenSnapshotTags = new Map<string, CapturedContainer>();\n\t\tfor (const captured of meta.containers) {\n\t\t\tyield* preflightCapturedContainer(captured, artifactDir);\n\t\t\tconst previous = seenSnapshotTags.get(captured.snapshotTag);\n\t\t\tif (previous !== undefined) {\n\t\t\t\treturn yield* failRestore(\n\t\t\t\t\t'preflight',\n\t\t\t\t\t`duplicate container snapshotTag ${captured.snapshotTag} for ${previous.plugin}/${previous.role} and ${captured.plugin}/${captured.role}`,\n\t\t\t\t\tcaptured.plugin,\n\t\t\t\t);\n\t\t\t}\n\t\t\tseenSnapshotTags.set(captured.snapshotTag, captured);\n\t\t}\n\t\tfor (const pluginKey of meta.participants) {\n\t\t\tyield* preflightContributionDoc(pluginKey, artifactDir);\n\t\t}\n\t\tif (meta.hostTreeIncluded) {\n\t\t\tconst tarPath = `${artifactDir}/${SnapshotLayout.hostTreeTar}`;\n\t\t\tyield* requireReadableNonEmptyFile(tarPath, 'untar-host-tree', 'host-tree tar is required');\n\t\t\tconst tarStream = fs.stream(tarPath).pipe(\n\t\t\t\tStream.mapError(\n\t\t\t\t\t(cause) =>\n\t\t\t\t\t\tnew HostTreeTarError({\n\t\t\t\t\t\t\tstage: 'entry-validation',\n\t\t\t\t\t\t\toperation: 'untar',\n\t\t\t\t\t\t\tdetail: `read host-tree tar failed at ${tarPath}`,\n\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t);\n\t\t\tyield* validateHostTreeTarEntries(tarStream).pipe(\n\t\t\t\tEffect.catch(failPhase('untar-host-tree', `host-tree tar entry validation failed`)),\n\t\t\t);\n\t\t}\n\t});\n\n// -----------------------------------------------------------------------------\n// Image load + staged re-tag.\n// -----------------------------------------------------------------------------\n\nconst loadImageBundle = (\n\ttarPath: string,\n\tartifactDir: string,\n\truntime: ContainerRuntime,\n\texpectedSnapshotTags: ReadonlyArray<string>,\n): Effect.Effect<ReadonlyMap<string, ImageRef>, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst fullTarPath = `${artifactDir}/${tarPath}`;\n\t\tconst exists = yield* fs.exists(fullTarPath).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (!exists) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'load-image',\n\t\t\t\t\tdetail: `container image bundle absent at ${fullTarPath}`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst bundleTags = yield* readImageBundleTags(fullTarPath, tarPath).pipe(\n\t\t\tEffect.catch(failImageBundleTagScan('load-image')),\n\t\t);\n\t\tyield* verifyImageBundleTags(tarPath, bundleTags, expectedSnapshotTags).pipe(\n\t\t\tEffect.catch(failImageBundleTagScan('load-image')),\n\t\t);\n\t\tconst loaded = yield* runtime\n\t\t\t.loadImage(fs.stream(fullTarPath))\n\t\t\t.pipe(\n\t\t\t\tEffect.catch(\n\t\t\t\t\tfailPhase('load-image', `load container image bundle from ${fullTarPath} failed`),\n\t\t\t\t),\n\t\t\t);\n\t\tconst loadedTags = loadedBundleTags(loaded);\n\t\tconst missing = expectedSnapshotTags.filter((tag) => !loadedTags.has(tag));\n\t\tif (missing.length > 0) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'load-image',\n\t\t\t\t`container image bundle ${tarPath} did not load expected snapshot tags: ${missing.join(', ')}`,\n\t\t\t);\n\t\t}\n\t\tconst refsByTag = new Map<string, ImageRef>();\n\t\tfor (const ref of loaded.refs) {\n\t\t\tif (ref.tag === undefined || !expectedSnapshotTags.includes(ref.tag)) continue;\n\t\t\tif (refsByTag.has(ref.tag)) {\n\t\t\t\treturn yield* failRestore(\n\t\t\t\t\t'load-image',\n\t\t\t\t\t`container image bundle ${tarPath} loaded duplicate snapshot tag ${ref.tag}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\trefsByTag.set(ref.tag, ref);\n\t\t}\n\t\treturn refsByTag;\n\t});\n\nconst expectedSnapshotTagsByBundle = (\n\tcontainers: ReadonlyArray<CapturedContainer>,\n): ReadonlyMap<string, ReadonlyArray<string>> => {\n\tconst byBundle = new Map<string, string[]>();\n\tfor (const captured of containers) {\n\t\tconst tags = byBundle.get(captured.tarPath);\n\t\tif (tags === undefined) {\n\t\t\tbyBundle.set(captured.tarPath, [captured.snapshotTag]);\n\t\t} else {\n\t\t\ttags.push(captured.snapshotTag);\n\t\t}\n\t}\n\treturn byBundle;\n};\n\nconst stageLoadedImage = (\n\tcaptured: CapturedContainer,\n\tloadedRef: ImageRef,\n\truntime: ContainerRuntime,\n\tregisterStagedImage: (image: StagedContainerImage) => Effect.Effect<void>,\n): Effect.Effect<StagedContainerImage, RestorePhaseError> =>\n\tEffect.gen(function* () {\n\t\tconst stagedImageTag = mintRestoreStagingTag();\n\t\tconst stagedImage: StagedContainerImage = {\n\t\t\tcaptured,\n\t\t\tstagedRef: { digest: loadedRef.digest, tag: stagedImageTag },\n\t\t\tstagedImageTag,\n\t\t};\n\t\tyield* registerStagedImage(stagedImage);\n\t\tyield* runtime\n\t\t\t.tagImage(loadedRef, stagedImageTag, { removeSourceAfterTag: true })\n\t\t\t.pipe(\n\t\t\t\tEffect.catch(\n\t\t\t\t\tfailPhase(\n\t\t\t\t\t\t'retag-image',\n\t\t\t\t\t\t`tag restored image ${captured.snapshotTag} as staging ref ${stagedImageTag} failed`,\n\t\t\t\t\t\tcaptured.plugin,\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\t\treturn stagedImage;\n\t});\n\nconst cleanupRestoreStagingImages = (\n\truntime: ContainerRuntime,\n\timages: ReadonlyArray<StagedContainerImage>,\n): Effect.Effect<void> =>\n\tEffect.forEach(\n\t\timages,\n\t\t(image) =>\n\t\t\truntime\n\t\t\t\t.removeImage(image.stagedRef)\n\t\t\t\t.pipe(\n\t\t\t\t\tEffect.catch((cause) =>\n\t\t\t\t\t\tEffect.logWarning(\n\t\t\t\t\t\t\t`remove restore staging image ${image.stagedImageTag} failed during restore cleanup: ${String(\n\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t)}`,\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t{ concurrency: 'unbounded' },\n\t).pipe(Effect.asVoid);\n\n/** Promote each staged image to its recorded TARGET name. The target\n *  name is the original image name the supervisor used for the\n *  container, so leaving the staged image at that name lets the next\n *  boot's image-match adoption (`decideRunAction`) find it locally and\n *  `docker run` it — no scanner, no on-disk marker. A mid-loop failure\n *  promotes a prefix of the images; the inner staging-cleanup scope\n *  prunes the un-promoted staging refs, and a re-run of restore re-stages\n *  and re-promotes from the snapshot artifact. */\nconst promoteStagedImages = (\n\timages: ReadonlyArray<StagedContainerImage>,\n\truntime: ContainerRuntime,\n): Effect.Effect<void, RestorePhaseError> =>\n\tEffect.gen(function* () {\n\t\tfor (const image of images) {\n\t\t\t// Image GC: the promote below moves `image.captured.imageName` from\n\t\t\t// the layer it currently resolves to (a prior restore/capture of the\n\t\t\t// same name, now superseded) onto the freshly-staged snapshot layer.\n\t\t\t// The previous layer is then orphaned — no tag references it — and\n\t\t\t// would dangle forever. Read the old layer's digest BEFORE the promote\n\t\t\t// so we can drop it AFTER. A null here (first restore: nothing tagged\n\t\t\t// that name yet) means there is no orphan to collect. Mirrors capture's\n\t\t\t// `resumeAfterCapture` GC exactly.\n\t\t\tconst oldDigest = yield* runtime\n\t\t\t\t.inspectImageDigest(image.captured.imageName)\n\t\t\t\t.pipe(Effect.catch(() => Effect.succeed(null)));\n\t\t\tyield* runtime\n\t\t\t\t.tagImage(image.stagedRef, image.captured.imageName, {\n\t\t\t\t\tremoveSourceAfterTag: true,\n\t\t\t\t})\n\t\t\t\t.pipe(\n\t\t\t\t\tEffect.catch(\n\t\t\t\t\t\tfailPhase(\n\t\t\t\t\t\t\t'retag-image',\n\t\t\t\t\t\t\t`tag staged image ${image.stagedImageTag} as ${image.captured.imageName} failed`,\n\t\t\t\t\t\t\timage.captured.plugin,\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t// ORDERING INVARIANT: GC runs strictly AFTER the promote succeeds.\n\t\t\t// Removing the old layer before the promote would destroy the live\n\t\t\t// image if the promote then failed. Now `imageName` resolves to the\n\t\t\t// new staged layer; read that digest to confirm the orphan is\n\t\t\t// genuinely distinct.\n\t\t\tconst newDigest = yield* runtime\n\t\t\t\t.inspectImageDigest(image.captured.imageName)\n\t\t\t\t.pipe(Effect.catch(() => Effect.succeed(null)));\n\t\t\t// Two guards before removal:\n\t\t\t//   - null guard: no previous layer to collect (first restore).\n\t\t\t//   - equal-digest guard: the staged image is an identical layer id,\n\t\t\t//     so `imageName` still resolves to it — removing `oldDigest` would\n\t\t\t//     delete the LIVE layer. Skip the no-op case.\n\t\t\tif (oldDigest !== null && oldDigest !== newDigest) {\n\t\t\t\t// Digest-only target: `removeImage` resolves `tag ?? digest`, so a\n\t\t\t\t// digest-only ref drops the orphaned layer by id, NOT the live\n\t\t\t\t// `imageName` tag. Best-effort — any failure (image-in-use,\n\t\t\t\t// multiple tags, ImageRemoveFailed) is logged and swallowed; it\n\t\t\t\t// must NEVER fail the restore. Mirrors capture's GC swallow.\n\t\t\t\tyield* runtime\n\t\t\t\t\t.removeImage({ digest: oldDigest })\n\t\t\t\t\t.pipe(\n\t\t\t\t\t\tEffect.catch((cause) =>\n\t\t\t\t\t\t\tEffect.logWarning(\n\t\t\t\t\t\t\t\t`GC of superseded image layer ${oldDigest} for ${image.captured.imageName} failed (best-effort): ${String(\n\t\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t\t)}`,\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t),\n\t\t\t\t\t);\n\t\t\t}\n\t\t}\n\t});\n\nconst restoreHostTree = (\n\tartifactDir: string,\n\ttarget: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst tarPath = `${artifactDir}/${SnapshotLayout.hostTreeTar}`;\n\t\tconst exists = yield* fs.exists(tarPath).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (!exists) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'untar-host-tree',\n\t\t\t\t\tdetail: `host-tree tar absent at ${tarPath}`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst tarStream = fs.stream(tarPath).pipe(\n\t\t\tStream.mapError(\n\t\t\t\t(cause) =>\n\t\t\t\t\tnew HostTreeTarError({\n\t\t\t\t\t\tstage: 'stream-stdin',\n\t\t\t\t\t\toperation: 'untar',\n\t\t\t\t\t\tdetail: `read host-tree tar failed at ${tarPath}`,\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t\tyield* Effect.scoped(untarHostTree(tarStream, { target })).pipe(\n\t\t\tEffect.catch(failPhase('untar-host-tree', `untar ${tarPath} to ${target} failed`)),\n\t\t);\n\t});\n\nconst LIVE_RESTORE_PRESERVED_PATHS: ReadonlyArray<StageAndSwapPreservedPath> = [\n\t{ relativePath: SNAPSHOTS_DIR_NAME },\n\t{ relativePath: COMMAND_CHANNEL_COMMANDS_FILE_NAME },\n\t{ relativePath: COMMAND_CHANNEL_EVENTS_FILE_NAME },\n\t{ relativePath: 'roster.json' },\n\t// Deploy/mint caches (DEPLOY_CACHE_NAMESPACES) are DELIBERATELY ABSENT from\n\t// this preserve list. The snapshot's host-tree tar now CARRIES `cache/<ns>`\n\t// (see `deployCacheSubtreeRelPaths` in descriptor.ts + capture's gather), so\n\t// the restore untars the snapshot's cache into the swapped tree — that copy\n\t// is the SOLE source on restore (no preserve-from-live, so no double-store\n\t// drift). On a same-machine rollback the snapshot's (older) ids are the\n\t// correct rollback target; on a CROSS-MACHINE restore (a fresh runner with an\n\t// empty live cache) the snapshot populates the cache from nothing. Either way\n\t// the post-restore boot REUSES the deploy rather than re-running it with fresh\n\t// ids (which would orphan every pre-snapshot object). The generic per-call\n\t// `cache/entry` is not a deploy namespace and is not captured, so it stays\n\t// dropped on restore (restore.test.ts pins that rollback); a hard reset that\n\t// wipes the live cache after restore re-deploys with fresh ids, surfaced LOUD\n\t// by the matrix probe's fail-loud assertion.\n];\n\n// -----------------------------------------------------------------------------\n// Cache-existence preflight — fail-closed BEFORE any mutation.\n// -----------------------------------------------------------------------------\n\n/** The deploy-cache subtree relPaths (`cache/<ns>`) the snapshot RECORDS as\n *  captured in its metadata. Capture tars a namespace only if it existed on disk\n *  (`missingTolerance: 'fine'`) and writes `meta.subtrees` AFTER a successful\n *  tar, so a relPath here means \"this snapshot intended to carry this cache\n *  namespace\". A disabled-plugin namespace (e.g. `cache/deepbook` in a\n *  deepbook-less stack) is simply absent from the list, so the preflight never\n *  over-requires it. */\nconst recordedDeployCacheRelPaths = (meta: SnapshotMetadata): ReadonlyArray<string> => {\n\tconst expected = new Set(deployCacheSubtreeRelPaths(CACHE_DIR_NAME));\n\tconst recorded: string[] = [];\n\tfor (const subtree of meta.subtrees) {\n\t\tif (expected.has(subtree.relPath)) recorded.push(subtree.relPath);\n\t}\n\treturn recorded;\n};\n\n/** Stream the host-tree tar and collect which of `expectedRelPaths` physically\n *  appear as an entry prefix. An entry path `cache/<ns>/<chain>/<hash>.json`\n *  (or the bare `cache/<ns>/` directory) marks `cache/<ns>` present. Read-only:\n *  bodies are skipped, never buffered. */\nconst scanHostTreeCacheRelPaths = (\n\tartifactDir: string,\n\texpectedRelPaths: ReadonlyArray<string>,\n): Effect.Effect<ReadonlySet<string>, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst tarPath = `${artifactDir}/${SnapshotLayout.hostTreeTar}`;\n\t\tconst present = new Set<string>();\n\t\tconst state = makeTarReaderState();\n\t\tconst matchEntry = (entryPath: string): void => {\n\t\t\tfor (const rel of expectedRelPaths) {\n\t\t\t\tif (present.has(rel)) continue;\n\t\t\t\tif (entryPath === rel || entryPath.startsWith(`${rel}/`)) present.add(rel);\n\t\t\t}\n\t\t};\n\t\tconst hooks = {\n\t\t\tonEntry: (entry: TarEntry) => {\n\t\t\t\tmatchEntry(entry.path);\n\t\t\t\t// Stop as soon as every expected namespace is found — the host-tree\n\t\t\t\t// tar can be large (walrus blobs, the seal vault), and capture tars\n\t\t\t\t// the deploy cache FIRST, so the answer settles in the leading\n\t\t\t\t// entries. `stopScan` flips `state.stopped`; the `takeWhile` below\n\t\t\t\t// then halts the stream so the trailing blob bytes are never read.\n\t\t\t\treturn present.size === expectedRelPaths.length ? stopScan() : skipEntry();\n\t\t\t},\n\t\t\tonExtendedError: (detail: string): RestorePhaseError =>\n\t\t\t\tnew RestorePhaseError({ phase: 'cache-missing', detail }),\n\t\t} as const;\n\t\tconst tarStream = fs.stream(tarPath).pipe(\n\t\t\tStream.mapError(\n\t\t\t\t(cause): RestorePhaseError =>\n\t\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\t\tphase: 'cache-missing',\n\t\t\t\t\t\tdetail: `read host-tree tar failed at ${tarPath}`,\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t),\n\t\t\t// Stop pulling chunks once the reader signalled `stop` (all namespaces\n\t\t\t// found) — genuinely terminates the disk read, not just the parse.\n\t\t\tStream.takeWhile(() => !state.stopped),\n\t\t);\n\t\tyield* Stream.runForEach(tarStream, (chunk) => {\n\t\t\tconst error = processTarChunk(state, chunk, hooks);\n\t\t\treturn error === null ? Effect.void : Effect.fail(error);\n\t\t});\n\t\tconst finalError = finishTarReader(\n\t\t\tstate,\n\t\t\t(detail): RestorePhaseError => new RestorePhaseError({ phase: 'cache-missing', detail }),\n\t\t);\n\t\tif (finalError !== null) return yield* Effect.fail(finalError);\n\t\treturn present;\n\t});\n\n/**\n * The SNAPSHOT's host-tree `cache/<DEPLOY_CACHE_NAMESPACES>` is the SOLE source\n * of the on-chain deploy/mint ids on restore (capture tars `cache/<ns>` into the\n * artifact; restore untars it and does NOT preserve-from-live — see\n * LIVE_RESTORE_PRESERVED_PATHS). So the cache check is against the SNAPSHOT, not\n * the live stack — which is exactly what makes a CROSS-MACHINE restore work: a\n * fresh runner has an empty live cache, and the snapshot supplies the ids.\n *\n * Refuse (fail-closed, BEFORE any mutation, matching the identity-guard posture)\n * if the snapshot's cache is NOT self-contained: every deploy-cache namespace\n * the metadata RECORDS as captured must be physically present in the host-tree\n * tar. A partial loss (metadata claims `cache/<ns>` but the tar lacks it — a\n * corrupted/tampered artifact) would let the post-restore boot re-deploy that\n * namespace with FRESH ids and orphan its pre-snapshot objects. Requiring ALL\n * recorded namespaces (not just ANY one) is the FIX over the prior \"any one dir\n * present\" check, which passed a partial cache and re-minted the rest.\n *\n * A snapshot that records NO deploy-cache subtrees (a genuine pre-deploy /\n * empty-stack capture) has nothing to verify and passes — there are no minted\n * ids to lose. The matrix's hard-reset phase asserts the loud re-deploy on a\n * post-restore live-cache wipe.\n */\nconst requireSnapshotDeployCache = (\n\tmeta: SnapshotMetadata,\n\tartifactDir: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst recorded = recordedDeployCacheRelPaths(meta);\n\t\tif (recorded.length === 0) return;\n\t\tif (!meta.hostTreeIncluded) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'cache-missing',\n\t\t\t\t`snapshot metadata records deploy-cache subtrees (${recorded.join(', ')}) but the ` +\n\t\t\t\t\t`artifact carries no host-tree tar. The snapshot's cache is the SOLE source of the ` +\n\t\t\t\t\t`on-chain deploy/mint ids restore reuses; restoring without it would let the next boot ` +\n\t\t\t\t\t`re-deploy with FRESH ids and orphan every pre-snapshot object. Refusing.`,\n\t\t\t);\n\t\t}\n\t\tconst present = yield* scanHostTreeCacheRelPaths(artifactDir, recorded);\n\t\tconst missing = recorded.filter((rel) => !present.has(rel));\n\t\tif (missing.length > 0) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'cache-missing',\n\t\t\t\t`snapshot host-tree is missing deploy-cache namespaces it recorded as captured ` +\n\t\t\t\t\t`(${missing.join(', ')}). The snapshot's cache is the SOLE source of the on-chain ` +\n\t\t\t\t\t`deploy/mint ids restore reuses; a partial cache would let the next boot re-deploy the ` +\n\t\t\t\t\t`missing namespaces with FRESH ids and orphan their pre-snapshot objects. Refusing.`,\n\t\t\t);\n\t\t}\n\t});\n\n// -----------------------------------------------------------------------------\n// Top-level restore — bracketed-atomic via stage-and-swap.\n// -----------------------------------------------------------------------------\n\nexport interface RestoreInputs {\n\treadonly snapshotId: SnapshotId;\n\treadonly artifactDir: string;\n\treadonly runtimeStackRoot: string;\n\treadonly runtimeStagingPath: string;\n\treadonly runtimeBackupPath: string;\n\t/** Live-stack participants whose `liveIdentity` probes feed the\n\t *  cross-plugin CONTRIBUTION guard (`runIdentityGuard`). An EMPTY list\n\t *  means \"no live stack to compare against\" — startup restore,\n\t *  interrupted-restore recovery, the offline CLI verb, or the live\n\t *  supervisor's own first acquire. In that case the\n\t *  contribution guard is satisfied tautologically (there is nothing live\n\t *  to disagree with the snapshot's recorded identity) and is SKIPPED;\n\t *  the snapshot-side emptiness refusal (`requireIdentity`) and the\n\t *  runtime guard (`runRuntimeIdentityGuard`, app/stack/network) STILL\n\t *  fire. See the step0 body for the rationale. */\n\treadonly participants: ReadonlyArray<RestoreParticipant>;\n\treadonly runtime: ContainerRuntime;\n\treadonly runtimeIdentity: SnapshotRuntimeIdentity;\n\treadonly currentGraphInput?: SnapshotGraphInputIdentity;\n\treadonly graphInputMismatchPolicy?: 'warn' | 'block';\n\t// RESUME is intentionally NOT a field here. `runRestore` performs the\n\t// destructive swap+load+hard-rm UNDER `stack.lock` (held by the caller).\n\t// The resume re-converges the stack, and each plugin's re-acquire takes\n\t// `stack.lock` for its container claim — a non-reentrant O_EXCL lock — so\n\t// running the resume inside this function (under the lock) self-deadlocks.\n\t// The orchestrator (`service.ts`) therefore runs the injected resume AFTER\n\t// the lock scope closes; `runRestore` owns only the locked half of the\n\t// bounce. NEVER `docker start` — the resume is recreate-from-restored-image.\n}\n\nexport const graphInputMismatchDetail = (\n\tsnapshotGraphInputId: string,\n\tcurrentGraphInputId: string,\n): string =>\n\t`snapshot graph input id ${snapshotGraphInputId} does not match current graph input id ${currentGraphInputId}; restoring may create inconsistent state`;\n\nconst checkGraphInputCompatibility = (\n\tmeta: SnapshotMetadata,\n\tcurrent: SnapshotGraphInputIdentity | undefined,\n\tpolicy: 'warn' | 'block' | undefined,\n): Effect.Effect<void, RestorePhaseError> => {\n\tif (current === undefined) return Effect.void;\n\tif (meta.graphInput.graphInputId === current.graphInputId) return Effect.void;\n\tconst detail = graphInputMismatchDetail(meta.graphInput.graphInputId, current.graphInputId);\n\tif (policy === 'block') {\n\t\treturn Effect.fail(new RestorePhaseError({ phase: 'graph-input-mismatch', detail }));\n\t}\n\treturn Effect.logWarning(detail);\n};\n\n/**\n * Run the full restore. Routed through the unified reconcile as an\n * ORDERED 4-step body — restore is NOT a single converge target\n * but a destructive ordered pair around an fs swap:\n *\n *   step0  — PRECONDITION: identity-guard, FAIL-CLOSED BEFORE ANY MUTATION.\n *            The runtime-identity guard + merged plugin-contribution guard\n *            complete BEFORE the first mutation (the docker load/tag inside\n *            the swap-tree build). On mismatch the sweep / load / tag spies\n *            stay EMPTY — zero mutations (restore.test `:214/:263`). Keep\n *            the pure meta read → guard → only then mutate ordering.\n *   step1  — fsPlan `swap-tree(untar)`: a single-op `ReconcileFsPlan` run\n *            through `executeFsPlan`, which publishes the new tree via the\n *            UNCHANGED `stageAndSwap`. The build untars the host-tree +\n *            loads/stages the committed image bundle into staging; the\n *            atomic swap preserves the RESTORE preserve list\n *            (`LIVE_RESTORE_PRESERVED_PATHS` — per-namespace live cache +\n *            control files, a restore-direction constant, NOT wipe's\n *            wholesale predicate). Promote staged\n *            images to their captured TARGET names is the swap step's\n *            docker tail.\n *   step2 R1 — HARD container removal (target = absent, label scope,\n *            policy-independent, unconditional, claim-bypassing) via\n *            `removeManagedContainers`. STRICTLY before R2. Never expressed\n *            as flip-image-and-let-decideRunAction-recreate (guardrail\n *            §3.6).\n *   step2 R2 — CONVERGE (recreate-from-fresh): NOT in `runRestore`. R1\n *            removed the containers, so the NEXT acquire (the live\n *            supervisor's `doSelectiveRestart`, itself routed through\n *            `reconcileGraph`, or the offline CLI's next-boot acquire) sees\n *            facts:null → fresh → creates from the RESTORED images. Verb is\n *            recreate-from-fresh, NOT adopt.\n *\n * Bracketed-atomic at the runtime-root level — external watchers never\n * observe a half-restored tree. The caller holds `stack.lock` for the\n * bounded snapshot window; restore supplies the runtime-control publish lock\n * to the swap-tree op.\n */\nexport const runRestore = (\n\tinputs: RestoreInputs,\n): Effect.Effect<\n\tSnapshotMetadata,\n\tRestorePhaseError | IdentityGuardError | IdentityContributionConflictError | StageAndSwapError,\n\tFileSystem.FileSystem\n> =>\n\tEffect.gen(function* () {\n\t\t// Authoritative meta read (PURE — no mutation), then re-verify the\n\t\t// artifact's per-file SHA-256 integrity before any mutation. The\n\t\t// artifact is being RESTORED here, so `integrity.json` is re-hashed\n\t\t// and compared file-by-file: a missing record fails at\n\t\t// `read-integrity`, a hash/file-list disagreement at\n\t\t// `verify-integrity` — both fail-closed before the host-tree untar,\n\t\t// docker load, or container replacement.\n\t\tconst meta = yield* readMeta(inputs.artifactDir, inputs.snapshotId);\n\t\tyield* verifyIntegrity(inputs.artifactDir);\n\t\tyield* checkGraphInputCompatibility(\n\t\t\tmeta,\n\t\t\tinputs.currentGraphInput,\n\t\t\tinputs.graphInputMismatchPolicy,\n\t\t);\n\n\t\t// step0 — PRECONDITION: identity guard, FAIL-CLOSED before the FIRST\n\t\t//    mutation. Compare the metadata's runtime identity and the merged\n\t\t//    plugin-contributed identity; on disagreement restore refuses\n\t\t//    HERE, before the swap-tree build's docker load/tag runs (guardrail\n\t\t//    §3.2; restore.test sweep/load/tag === [] on mismatch).\n\t\t//\n\t\t//    The RUNTIME guard (app/stack/network) ALWAYS fires — its `live`\n\t\t//    side is `inputs.runtimeIdentity`, sourced from the live process's\n\t\t//    `IdentityContext`, never from the snapshot — so a boot against a\n\t\t//    foreign app/stack/network still refuses.\n\t\tyield* runRuntimeIdentityGuard(\n\t\t\t{ app: meta.app, stack: meta.stack, network: meta.network },\n\t\t\tinputs.runtimeIdentity,\n\t\t);\n\t\t// The cross-plugin CONTRIBUTION guard is conditional on there being a\n\t\t// LIVE stack to compare against. Startup/offline restore\n\t\t// (interrupted-restore recovery, the offline CLI verb, or the live\n\t\t// supervisor's own initial acquire) runs with `participants === []`:\n\t\t// the supervisor has not yet registered any snapshot participant, so\n\t\t// there is no live identity to contribute. Running `runIdentityGuard`\n\t\t// against an empty live slice would ALWAYS fail `IdentityMissingLive`\n\t\t// because the snapshot recorded keys that no live participant has\n\t\t// contributed yet. With no live stack the comparison is vacuously\n\t\t// satisfied, so skip it.\n\t\t// The snapshot-side emptiness refusal still fires: a snapshot that\n\t\t// recorded NO identity is untrusted regardless of a live stack.\n\t\tif (inputs.participants.length === 0) {\n\t\t\tyield* requireIdentity(meta.identity, 'snapshot');\n\t\t} else {\n\t\t\tconst liveContributions: IdentityContribution[] = [];\n\t\t\tfor (const participant of inputs.participants) {\n\t\t\t\tconst slice = yield* participant.liveIdentity;\n\t\t\t\tliveContributions.push({ plugin: participant.plugin, slice });\n\t\t\t}\n\t\t\tconst live = yield* mergeContributions(liveContributions);\n\t\t\tyield* runIdentityGuard(meta.identity, live);\n\t\t}\n\n\t\t// step0b — cache-existence preflight, ALSO fail-closed before any\n\t\t//    mutation. The SNAPSHOT's host-tree cache is the SOLE source of the\n\t\t//    on-chain ids restore reuses (capture tars it; restore untars it and\n\t\t//    does NOT preserve-from-live). Refuse (`cache-missing`) if the\n\t\t//    snapshot is not self-contained — any recorded deploy-cache namespace\n\t\t//    missing from the tar — rather than let the next boot re-deploy that\n\t\t//    namespace with fresh ids. Checked against the SNAPSHOT (not the live\n\t\t//    stack), so a cross-machine restore onto an empty live cache passes.\n\t\tyield* requireSnapshotDeployCache(meta, inputs.artifactDir);\n\n\t\t// Plugin-level preRestore hooks (run AFTER identity-guard so a\n\t\t// mismatch refuses without ever calling them). Pre-restore validation\n\t\t// is read-only / soft; the FIRST mutation is still the docker load/tag\n\t\t// inside the swap-tree build below.\n\t\tfor (const participant of inputs.participants) {\n\t\t\tif (participant.preRestore) {\n\t\t\t\tyield* participant.preRestore.pipe(\n\t\t\t\t\tEffect.catch(failPhase('pre-restore-hook', `preRestore failed`, participant.plugin)),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tyield* preflightArtifact(meta, inputs.artifactDir);\n\n\t\t// steps 1 + 2 (R1) — staged file content + docker handoff, inside one\n\t\t// `Effect.scoped` that keeps `cleanupRestoreStagingImages` armed across\n\t\t// BOTH the swap-tree build phase AND the post-swap docker handoff\n\t\t// (promote → remove captured containers). The handoff flag flips only\n\t\t// after `removeCapturedContainers` returns, so a mid-handoff failure\n\t\t// has the inner scope clean the still-tagged staging refs so Docker is\n\t\t// not littered with orphan `devstack-snapshot:restore-*` tags. The\n\t\t// post-publish sequence runs under `Effect.uninterruptible` so an outer\n\t\t// Effect-level interrupt cannot arrive mid-handoff and tear the state.\n\t\t// `promoteStagedImages` leaves each image at its captured TARGET name,\n\t\t// so R2 (the next acquire's image-match recreate-from-fresh) re-runs the\n\t\t// deploy from the local image with no scanner. `Effect.uninterruptible`\n\t\t// does NOT survive a SIGKILL, though — the interrupted-restore sentinel\n\t\t// (written into the staged tree, riding the swap into the live root, and\n\t\t// cleared the instant this handoff completes) is the durable breadcrumb\n\t\t// that lets the next boot resume a hard-kill-mid-promotion.\n\t\tyield* Effect.scoped(\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst stagedImages: StagedContainerImage[] = [];\n\t\t\t\tlet recoveryHandoffComplete = false;\n\t\t\t\tyield* Effect.addFinalizer((exit) =>\n\t\t\t\t\tExit.isFailure(exit) && !recoveryHandoffComplete\n\t\t\t\t\t\t? cleanupRestoreStagingImages(inputs.runtime, stagedImages)\n\t\t\t\t\t\t: Effect.void,\n\t\t\t\t);\n\n\t\t\t\t// step1 — fsPlan `swap-tree(untar)`: the build untars the\n\t\t\t\t//   host-tree + loads/stages the committed image bundle into\n\t\t\t\t//   staging; the unchanged `stageAndSwap` (assembled by the\n\t\t\t\t//   executor from the op) publishes it atomically, preserving the\n\t\t\t\t//   RESTORE preserve list. The build's success value (the staged\n\t\t\t\t//   refs) is captured via the `stagedImages` closure above, so\n\t\t\t\t//   the fs-plan result is the empty default — the build value\n\t\t\t\t//   never threads back through the op vocabulary.\n\t\t\t\tconst swapBuild = Effect.gen(function* () {\n\t\t\t\t\t// Untar host-tree into staging.\n\t\t\t\t\tif (meta.hostTreeIncluded) {\n\t\t\t\t\t\tyield* restoreHostTree(inputs.artifactDir, inputs.runtimeStagingPath);\n\t\t\t\t\t}\n\t\t\t\t\tconst fs = yield* FileSystem.FileSystem;\n\t\t\t\t\t// Confirm each contribution doc is present — the\n\t\t\t\t\t// participants' post-restore hooks read fresh state after\n\t\t\t\t\t// the swap lands.\n\t\t\t\t\tfor (const pluginKey of meta.participants) {\n\t\t\t\t\t\tconst path = `${inputs.artifactDir}/${contributionPath(pluginKey)}`;\n\t\t\t\t\t\tconst exists = yield* fs.exists(path).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\t\t\t\t\tif (!exists) {\n\t\t\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\t\t\t\t\tphase: 'read-contribution',\n\t\t\t\t\t\t\t\t\tplugin: pluginKey,\n\t\t\t\t\t\t\t\t\tdetail: `contribution doc absent at ${path}`,\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\t// Load + tag committed images under restore-staging refs\n\t\t\t\t\t// only after all artifact expansion/copy work has\n\t\t\t\t\t// succeeded. The Docker save manifest must match snapshot\n\t\t\t\t\t// metadata exactly before docker load mutates the daemon;\n\t\t\t\t\t// loaded refs then supply the real digest used for staging\n\t\t\t\t\t// tags.\n\t\t\t\t\tconst expectedTagsByBundle = expectedSnapshotTagsByBundle(meta.containers);\n\t\t\t\t\tconst loadedRefsBySnapshotTag = new Map<string, ImageRef>();\n\t\t\t\t\tfor (const [tarPath, expectedTags] of expectedTagsByBundle) {\n\t\t\t\t\t\tconst loadedRefs = yield* loadImageBundle(\n\t\t\t\t\t\t\ttarPath,\n\t\t\t\t\t\t\tinputs.artifactDir,\n\t\t\t\t\t\t\tinputs.runtime,\n\t\t\t\t\t\t\texpectedTags,\n\t\t\t\t\t\t);\n\t\t\t\t\t\tfor (const [tag, ref] of loadedRefs) {\n\t\t\t\t\t\t\tloadedRefsBySnapshotTag.set(tag, ref);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tfor (const captured of meta.containers) {\n\t\t\t\t\t\tconst loadedRef = loadedRefsBySnapshotTag.get(captured.snapshotTag);\n\t\t\t\t\t\tif (loadedRef === undefined) {\n\t\t\t\t\t\t\treturn yield* failRestore(\n\t\t\t\t\t\t\t\t'load-image',\n\t\t\t\t\t\t\t\t`container image bundle did not return loaded ref for ${captured.snapshotTag}`,\n\t\t\t\t\t\t\t\tcaptured.plugin,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\t\t\t\t\t\tyield* stageLoadedImage(captured, loadedRef, inputs.runtime, (image) =>\n\t\t\t\t\t\t\tEffect.sync(() => {\n\t\t\t\t\t\t\t\tstagedImages.push(image);\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\t// Write the interrupted-restore sentinel into the STAGED tree\n\t\t\t\t\t// root so it RIDES the atomic stage-and-swap into the live\n\t\t\t\t\t// runtime root (the swap is a `rename(staging → stackRoot)`, so\n\t\t\t\t\t// the sentinel is published atomically WITH the new tree — there\n\t\t\t\t\t// is no pre-swap window where it could be observed early or lost).\n\t\t\t\t\t// The clear on the success path below removes it the instant the\n\t\t\t\t\t// promotion+removal handoff completes; a hard kill AFTER the swap\n\t\t\t\t\t// but mid-promotion leaves it live for the next boot's\n\t\t\t\t\t// `recoverInterruptedRestore` to resume. Best-effort: a write\n\t\t\t\t\t// failure is logged, not fatal (it only widens the already-\n\t\t\t\t\t// existing unrecoverable window).\n\t\t\t\t\tyield* writeRestoreSentinel(inputs.runtimeStagingPath, {\n\t\t\t\t\t\tsnapshotId: inputs.snapshotId,\n\t\t\t\t\t\tartifactDir: inputs.artifactDir,\n\t\t\t\t\t});\n\t\t\t\t\treturn stagedImages;\n\t\t\t\t});\n\n\t\t\t\tconst swapTree: ReconcileFsOp<RestorePhaseError | StageAndSwapError> = {\n\t\t\t\t\top: 'swap-tree',\n\t\t\t\t\ttargetPath: inputs.runtimeStackRoot,\n\t\t\t\t\tstagingPath: inputs.runtimeStagingPath,\n\t\t\t\t\tbackupPath: inputs.runtimeBackupPath,\n\t\t\t\t\tbuildEffect: swapBuild,\n\t\t\t\t\t// RESTORE-DIRECTION preserve constant — per-namespace live\n\t\t\t\t\t// cache + control files, NOT wipe's wholesale predicate.\n\t\t\t\t\tpreserveFromTarget: LIVE_RESTORE_PRESERVED_PATHS,\n\t\t\t\t\tpublishLockPath: runtimeControlLockPathForStackRoot(inputs.runtimeStackRoot),\n\t\t\t\t\t// Identity pass-through — restore keeps `StageAndSwapError`\n\t\t\t\t\t// in its own public signature (behavior-preserving), so the\n\t\t\t\t\t// executor never invents an error tag for it.\n\t\t\t\t\tonSwapError: (cause) => Effect.fail(cause),\n\t\t\t\t};\n\n\t\t\t\tyield* executeFsPlan<RestorePhaseError | StageAndSwapError>({ ops: [swapTree] });\n\n\t\t\t\t// step2 R1 — HARD container removal (target = absent, label\n\t\t\t\t//   scope, policy-INDEPENDENT, unconditional, claim-bypassing)\n\t\t\t\t//   via `removeManagedContainers`, plus the swap step's docker\n\t\t\t\t//   tail (promote staged images to their captured TARGET names).\n\t\t\t\t//   Inside the staging-cleanup scope, uninterruptible so an\n\t\t\t\t//   outer interrupt cannot tear the handoff between promote and\n\t\t\t\t//   container removal. Each promoted image is left at its\n\t\t\t\t//   captured TARGET name, so R2 (the next acquire's image-match\n\t\t\t\t//   recreate-from-fresh) re-runs the deploy from the local image\n\t\t\t\t//   — no scanner. R1 is STRICTLY before R2 (R2 runs in the\n\t\t\t\t//   caller's converge after `runRestore` returns), and is NEVER\n\t\t\t\t//   expressed as flip-image-and-let-decideRunAction-recreate.\n\t\t\t\t//   The interrupted-restore sentinel (written into the staged tree\n\t\t\t\t//   above, now live after the swap) is the durable breadcrumb a\n\t\t\t\t//   hard kill BETWEEN the swap and this handoff completing leaves\n\t\t\t\t//   behind; it is cleared the instant the handoff finishes below.\n\t\t\t\tif (stagedImages.length > 0) {\n\t\t\t\t\tyield* Effect.uninterruptible(\n\t\t\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\t\t\tyield* promoteStagedImages(stagedImages, inputs.runtime);\n\t\t\t\t\t\t\tyield* removeCapturedContainers(meta, inputs.runtime, inputs.runtimeIdentity);\n\t\t\t\t\t\t\trecoveryHandoffComplete = true;\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t} else {\n\t\t\t\t\trecoveryHandoffComplete = true;\n\t\t\t\t}\n\n\t\t\t\t// Success path: the promotion+removal handoff is complete, so the\n\t\t\t\t// interrupted-restore sentinel has served its purpose — clear it\n\t\t\t\t// from the LIVE runtime root (it rode the swap in) so the next boot\n\t\t\t\t// reads no sentinel and never loops. A hard kill that lands AFTER\n\t\t\t\t// `recoveryHandoffComplete = true` but BEFORE this clear is benign:\n\t\t\t\t// re-running the restore on the next boot is idempotent (re-stages\n\t\t\t\t// from the preserved artifact, re-promotes to the same TARGET\n\t\t\t\t// names, re-removes the already-absent containers), then clears the\n\t\t\t\t// sentinel. Idempotent (`force: true`), best-effort.\n\t\t\t\tyield* clearRestoreSentinel(inputs.runtimeStackRoot);\n\t\t\t}),\n\t\t);\n\n\t\t// Post-restore hooks (after the swap lands so plugins read\n\t\t//    fresh state from the runtime root).\n\t\tfor (const participant of inputs.participants) {\n\t\t\tif (participant.postRestore) {\n\t\t\t\tyield* participant.postRestore.pipe(\n\t\t\t\t\tEffect.catch(failPhase('post-restore-hook', `postRestore failed`, participant.plugin)),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// RESUME = recreate-from-restored-image + wait-write-ready. The R1\n\t\t// hard-rm above made the containers facts:null → the resume's converge\n\t\t// sees them missing and recreates fresh from the restored images (whose\n\t\t// names were re-tagged to the captured TARGET names), inheriting walrus's\n\t\t// write-ready ready-gate. The resume is NOT run here: it must execute with\n\t\t// `stack.lock` RELEASED (its per-plugin container claims re-take the lock),\n\t\t// so the orchestrator (`service.ts`) runs the injected resume AFTER this\n\t\t// function's lock scope closes. OMITTED entirely on the offline restore\n\t\t// (the next boot is the resume). NEVER `docker start`.\n\n\t\treturn meta;\n\t});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA6FA,IAAa,oBAAb,cAAuC,OAAO,iBAAoC,CAAC,CAClF,6BACA;CACC,OAAO,OAAO,SAAS;EACtB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACD,CAAC;CACD,QAAQ,OAAO,SAAS,OAAO,MAAM;CACrC,QAAQ,OAAO;CACf,OAAO,OAAO,SAAS,OAAO,MAAM;AACrC,CACD,CAAC,CAAC,CAAC;AAEH,MAAM,YAAY,gBAAgB,iBAAiB;AAEnD,MAAM,eACL,OACA,QACA,WAEA,OAAO,KAAK,IAAI,kBAAkB;CAAE;CAAO;CAAQ;AAAO,CAAC,CAAC;AAE7D,MAAM,0BACJ,OAAmC,YACnC,UACA,OAAO,KAAK,IAAI,kBAAkB;CAAE;CAAO;CAAQ,QAAQ,MAAM;CAAQ;AAAM,CAAC,CAAC;AAyBnF,MAAM,YACL,aACA,eAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,GAAG,YAAY,GAAG,eAAe;CAE9C,IAAI,EAAC,OADiB,GAAG,OAAO,IAAI,CAAC,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC,IAEnF,OAAO,OAAO,OAAO,KACpB,IAAI,kBAAkB;EACrB,OAAO;EACP,QAAQ,mCAAmC;CAC5C,CAAC,CACF;CAcD,MAAM,OAAO,OAAO,cAAc,wBAAwB,OATvC,cAAc,OAHb,GAClB,eAAe,IAAI,CAAC,CACpB,KAAK,OAAO,MAAM,UAAU,aAAa,4BAA4B,MAAM,CAAC,CAAC,GACxC;EACtC,QAAQ;EACR,UAAU,UACT,IAAI,kBAAkB;GACrB,OAAO;GACP,QAAQ,kCAAkC;GAC1C,OAAO,MAAM;EACd,CAAC;CACH,CAAC,GAC8D;EAC9D,QAAQ;EACR,UAAU,UACT,IAAI,kBAAkB;GACrB,OAAO;GACP,QAAQ,qCAAqC;GAC7C,OAAO,MAAM;EACd,CAAC;CACH,CAAC;CACD,MAAM,WAAW,gBAAgB,KAAK,EAAE;CACxC,IAAI,aAAa,MAChB,OAAO,OAAO,YACb,gBACA,6CAA6C,KAAK,IACnD;CAED,IAAI,aAAa,YAChB,OAAO,OAAO,YACb,gBACA,gBAAgB,KAAK,GAAG,wCAAwC,YACjE;CAED,OAAO;AACR,CAAC;AAEF,MAAM,mBACL,gBAEA,wBAAwB,WAAW,CAAC,CAAC,KACpC,OAAO,SAAS,2BAA2B,QAC1C,OAAO,KACN,IAAI,kBAAkB;CACrB,OAAO,IAAI,SAAS,YAAY,mBAAmB;CACnD,QAAQ,IAAI;CACZ,OAAO,IAAI;AACZ,CAAC,CACF,CACD,CACD;;;;;AAUD,MAAM,4BACL,MACA,SACA,oBAEA,OAAO,IAAI,aAAa;CACvB,KAAK,MAAM,YAAY,KAAK,YAC3B,OAAO,QACL,wBAAwB;EACxB,KAAK,gBAAgB;EACrB,OAAO,gBAAgB;EACvB,QAAQ,SAAS;EACjB,MAAM,SAAS;CAChB,CAAC,CAAC,CACD,KACA,OAAO,MACN,UACC,eACA,iCAAiC,SAAS,OAAO,GAAG,SAAS,KAAK,UAClE,SAAS,MACV,CACD,CACD;AAEH,CAAC;AAgCF,MAAM,oBAAoB,WAAoE;CAC7F,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,OAAO,OAAO,MACxB,IAAI,IAAI,QAAQ,KAAA,GAAW,KAAK,IAAI,IAAI,GAAG;CAE5C,OAAO;AACR;AAEA,MAAM,8BAAsC,6BAA6B,iBAAiB,EAAE;AAM5F,MAAM,sBACL,MACA,OACA,WAEA,0BAA0B,KAAK,IAC5B,OAAO,OACP,YAAY,aAAa,mBAAmB,KAAK,iBAAiB,SAAS,MAAM;AAErF,MAAM,+BACL,MACA,OACA,QACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAI7B,KAAI,OAHgB,GAClB,KAAK,IAAI,CAAC,CACV,KAAK,OAAO,MAAM,UAAU,OAAO,GAAG,OAAO,mBAAmB,QAAQ,MAAM,CAAC,CAAC,EAAA,CACzE,SAAS,IACjB,OAAO,OAAO,YAAY,OAAO,GAAG,OAAO,kBAAkB,QAAQ,MAAM;CAE5E,OAAO,OAAO,SAAS,GAAG,OAAO,IAAI,CAAC,CAAC,KAAK,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAC5D,OAAO,MAAM,UAAU,OAAO,GAAG,OAAO,mBAAmB,QAAQ,MAAM,CAAC,CAC3E;AACD,CAAC;AAEF,MAAM,8BACL,UACA,gBAEA,OAAO,IAAI,aAAa;CACvB,OAAO,mBAAmB,UAAU,SAAS,QAAQ,SAAS,MAAM;CACpE,OAAO,mBAAmB,QAAQ,SAAS,MAAM,SAAS,MAAM;CAChE,IAAI,CAAC,2BAA2B,SAAS,OAAO,GAC/C,OAAO,OAAO,YACb,aACA,oCAAoC,SAAS,WAC7C,SAAS,MACV;CAED,MAAM,kBAAkB,0BAA0B;CAClD,IAAI,SAAS,YAAY,iBACxB,OAAO,OAAO,YACb,aACA,4BAA4B,SAAS,QAAQ,mCAAmC,mBAChF,SAAS,MACV;CAED,IAAI,CAAC,+BAA+B,SAAS,SAAS,GACrD,OAAO,OAAO,YACb,aACA,mEAAmE,SAAS,aAC5E,SAAS,MACV;CAED,IAAI,CAAC,+BAA+B,SAAS,WAAW,GACvD,OAAO,OAAO,YACb,aACA,gEAAgE,SAAS,eACzE,SAAS,MACV;CAED,OAAO,4BACN,GAAG,YAAY,GAAG,SAAS,WAC3B,cACA,mCACA,SAAS,MACV;AACD,CAAC;AAEF,MAAM,4BACL,WACA,gBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAO,GAAG,YAAY,GAAG,iBAAiB,SAAS;CAmBzD,MAAM,UAAU,OAAO,cAAc,uBAAuB,OAVzC,cAAc,QAPb,OADF,WAAW,WAAA,CAE3B,eAAe,IAAI,CAAC,CACpB,KACA,OAAO,MACN,UAAU,qBAAqB,mCAAmC,QAAQ,SAAS,CACpF,CACD,GACsC;EACtC,QAAQ;EACR,UAAU,UACT,IAAI,kBAAkB;GACrB,OAAO;GACP,QAAQ;GACR,QAAQ,yCAAyC;GACjD,OAAO,MAAM;EACd,CAAC;CACH,CAAC,GACgE;EAChE,QAAQ;EACR,UAAU,UACT,IAAI,kBAAkB;GACrB,OAAO;GACP,QAAQ;GACR,QAAQ,4CAA4C;GACpD,OAAO,MAAM;EACd,CAAC;CACH,CAAC;CACD,IAAI,QAAQ,WAAW,WACtB,OAAO,OAAO,YACb,qBACA,2BAA2B,QAAQ,OAAO,kBAAkB,aAC5D,SACD;AAEF,CAAC;AAEF,MAAM,qBACL,MACA,gBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,mCAAmB,IAAI,IAA+B;CAC5D,KAAK,MAAM,YAAY,KAAK,YAAY;EACvC,OAAO,2BAA2B,UAAU,WAAW;EACvD,MAAM,WAAW,iBAAiB,IAAI,SAAS,WAAW;EAC1D,IAAI,aAAa,KAAA,GAChB,OAAO,OAAO,YACb,aACA,mCAAmC,SAAS,YAAY,OAAO,SAAS,OAAO,GAAG,SAAS,KAAK,OAAO,SAAS,OAAO,GAAG,SAAS,QACnI,SAAS,MACV;EAED,iBAAiB,IAAI,SAAS,aAAa,QAAQ;CACpD;CACA,KAAK,MAAM,aAAa,KAAK,cAC5B,OAAO,yBAAyB,WAAW,WAAW;CAEvD,IAAI,KAAK,kBAAkB;EAC1B,MAAM,UAAU,GAAG,YAAY,GAAG,eAAe;EACjD,OAAO,4BAA4B,SAAS,mBAAmB,2BAA2B;EAY1F,OAAO,2BAXW,GAAG,OAAO,OAAO,CAAC,CAAC,KACpC,OAAO,UACL,UACA,IAAI,iBAAiB;GACpB,OAAO;GACP,WAAW;GACX,QAAQ,gCAAgC;GACxC;EACD,CAAC,CACH,CAEyC,CAAC,CAAC,CAAC,KAC5C,OAAO,MAAM,UAAU,mBAAmB,uCAAuC,CAAC,CACnF;CACD;AACD,CAAC;AAMF,MAAM,mBACL,SACA,aACA,SACA,yBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,cAAc,GAAG,YAAY,GAAG;CAEtC,IAAI,EAAC,OADiB,GAAG,OAAO,WAAW,CAAC,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC,IAE1F,OAAO,OAAO,OAAO,KACpB,IAAI,kBAAkB;EACrB,OAAO;EACP,QAAQ,oCAAoC;CAC7C,CAAC,CACF;CAKD,OAAO,sBAAsB,SAAS,OAHZ,oBAAoB,aAAa,OAAO,CAAC,CAAC,KACnE,OAAO,MAAM,uBAAuB,YAAY,CAAC,CAClD,GACkD,oBAAoB,CAAC,CAAC,KACvE,OAAO,MAAM,uBAAuB,YAAY,CAAC,CAClD;CACA,MAAM,SAAS,OAAO,QACpB,UAAU,GAAG,OAAO,WAAW,CAAC,CAAC,CACjC,KACA,OAAO,MACN,UAAU,cAAc,oCAAoC,YAAY,QAAQ,CACjF,CACD;CACD,MAAM,aAAa,iBAAiB,MAAM;CAC1C,MAAM,UAAU,qBAAqB,QAAQ,QAAQ,CAAC,WAAW,IAAI,GAAG,CAAC;CACzE,IAAI,QAAQ,SAAS,GACpB,OAAO,OAAO,YACb,cACA,0BAA0B,QAAQ,wCAAwC,QAAQ,KAAK,IAAI,GAC5F;CAED,MAAM,4BAAY,IAAI,IAAsB;CAC5C,KAAK,MAAM,OAAO,OAAO,MAAM;EAC9B,IAAI,IAAI,QAAQ,KAAA,KAAa,CAAC,qBAAqB,SAAS,IAAI,GAAG,GAAG;EACtE,IAAI,UAAU,IAAI,IAAI,GAAG,GACxB,OAAO,OAAO,YACb,cACA,0BAA0B,QAAQ,iCAAiC,IAAI,KACxE;EAED,UAAU,IAAI,IAAI,KAAK,GAAG;CAC3B;CACA,OAAO;AACR,CAAC;AAEF,MAAM,gCACL,eACgD;CAChD,MAAM,2BAAW,IAAI,IAAsB;CAC3C,KAAK,MAAM,YAAY,YAAY;EAClC,MAAM,OAAO,SAAS,IAAI,SAAS,OAAO;EAC1C,IAAI,SAAS,KAAA,GACZ,SAAS,IAAI,SAAS,SAAS,CAAC,SAAS,WAAW,CAAC;OAErD,KAAK,KAAK,SAAS,WAAW;CAEhC;CACA,OAAO;AACR;AAEA,MAAM,oBACL,UACA,WACA,SACA,wBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,iBAAiB,sBAAsB;CAC7C,MAAM,cAAoC;EACzC;EACA,WAAW;GAAE,QAAQ,UAAU;GAAQ,KAAK;EAAe;EAC3D;CACD;CACA,OAAO,oBAAoB,WAAW;CACtC,OAAO,QACL,SAAS,WAAW,gBAAgB,EAAE,sBAAsB,KAAK,CAAC,CAAC,CACnE,KACA,OAAO,MACN,UACC,eACA,sBAAsB,SAAS,YAAY,kBAAkB,eAAe,UAC5E,SAAS,MACV,CACD,CACD;CACD,OAAO;AACR,CAAC;AAEF,MAAM,+BACL,SACA,WAEA,OAAO,QACN,SACC,UACA,QACE,YAAY,MAAM,SAAS,CAAC,CAC5B,KACA,OAAO,OAAO,UACb,OAAO,WACN,gCAAgC,MAAM,eAAe,kCAAkC,OACtF,KACD,GACD,CACD,CACD,GACF,EAAE,aAAa,YAAY,CAC5B,CAAC,CAAC,KAAK,OAAO,MAAM;;;;;;;;;AAUrB,MAAM,uBACL,QACA,YAEA,OAAO,IAAI,aAAa;CACvB,KAAK,MAAM,SAAS,QAAQ;EAS3B,MAAM,YAAY,OAAO,QACvB,mBAAmB,MAAM,SAAS,SAAS,CAAC,CAC5C,KAAK,OAAO,YAAY,OAAO,QAAQ,IAAI,CAAC,CAAC;EAC/C,OAAO,QACL,SAAS,MAAM,WAAW,MAAM,SAAS,WAAW,EACpD,sBAAsB,KACvB,CAAC,CAAC,CACD,KACA,OAAO,MACN,UACC,eACA,oBAAoB,MAAM,eAAe,MAAM,MAAM,SAAS,UAAU,UACxE,MAAM,SAAS,MAChB,CACD,CACD;EAMD,MAAM,YAAY,OAAO,QACvB,mBAAmB,MAAM,SAAS,SAAS,CAAC,CAC5C,KAAK,OAAO,YAAY,OAAO,QAAQ,IAAI,CAAC,CAAC;EAM/C,IAAI,cAAc,QAAQ,cAAc,WAMvC,OAAO,QACL,YAAY,EAAE,QAAQ,UAAU,CAAC,CAAC,CAClC,KACA,OAAO,OAAO,UACb,OAAO,WACN,gCAAgC,UAAU,OAAO,MAAM,SAAS,UAAU,yBAAyB,OAClG,KACD,GACD,CACD,CACD;CAEH;AACD,CAAC;AAEF,MAAM,mBACL,aACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,UAAU,GAAG,YAAY,GAAG,eAAe;CAEjD,IAAI,EAAC,OADiB,GAAG,OAAO,OAAO,CAAC,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC,IAEtF,OAAO,OAAO,OAAO,KACpB,IAAI,kBAAkB;EACrB,OAAO;EACP,QAAQ,2BAA2B;CACpC,CAAC,CACF;CAED,MAAM,YAAY,GAAG,OAAO,OAAO,CAAC,CAAC,KACpC,OAAO,UACL,UACA,IAAI,iBAAiB;EACpB,OAAO;EACP,WAAW;EACX,QAAQ,gCAAgC;EACxC;CACD,CAAC,CACH,CACD;CACA,OAAO,OAAO,OAAO,cAAc,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAC1D,OAAO,MAAM,UAAU,mBAAmB,SAAS,QAAQ,MAAM,OAAO,QAAQ,CAAC,CAClF;AACD,CAAC;AAEF,MAAM,+BAAyE;CAC9E,EAAE,cAAc,mBAAmB;CACnC,EAAE,cAAc,mCAAmC;CACnD,EAAE,cAAc,iCAAiC;CACjD,EAAE,cAAc,cAAc;AAe/B;;;;;;;;AAaA,MAAM,+BAA+B,SAAkD;CACtF,MAAM,WAAW,IAAI,IAAI,2BAA2B,cAAc,CAAC;CACnE,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,WAAW,KAAK,UAC1B,IAAI,SAAS,IAAI,QAAQ,OAAO,GAAG,SAAS,KAAK,QAAQ,OAAO;CAEjE,OAAO;AACR;;;;;AAMA,MAAM,6BACL,aACA,qBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,UAAU,GAAG,YAAY,GAAG,eAAe;CACjD,MAAM,0BAAU,IAAI,IAAY;CAChC,MAAM,QAAQ,mBAAmB;CACjC,MAAM,cAAc,cAA4B;EAC/C,KAAK,MAAM,OAAO,kBAAkB;GACnC,IAAI,QAAQ,IAAI,GAAG,GAAG;GACtB,IAAI,cAAc,OAAO,UAAU,WAAW,GAAG,IAAI,EAAE,GAAG,QAAQ,IAAI,GAAG;EAC1E;CACD;CACA,MAAM,QAAQ;EACb,UAAU,UAAoB;GAC7B,WAAW,MAAM,IAAI;GAMrB,OAAO,QAAQ,SAAS,iBAAiB,SAAS,SAAS,IAAI,UAAU;EAC1E;EACA,kBAAkB,WACjB,IAAI,kBAAkB;GAAE,OAAO;GAAiB;EAAO,CAAC;CAC1D;CACA,MAAM,YAAY,GAAG,OAAO,OAAO,CAAC,CAAC,KACpC,OAAO,UACL,UACA,IAAI,kBAAkB;EACrB,OAAO;EACP,QAAQ,gCAAgC;EACxC;CACD,CAAC,CACH,GAGA,OAAO,gBAAgB,CAAC,MAAM,OAAO,CACtC;CACA,OAAO,OAAO,WAAW,YAAY,UAAU;EAC9C,MAAM,QAAQ,gBAAgB,OAAO,OAAO,KAAK;EACjD,OAAO,UAAU,OAAO,OAAO,OAAO,OAAO,KAAK,KAAK;CACxD,CAAC;CACD,MAAM,aAAa,gBAClB,QACC,WAA8B,IAAI,kBAAkB;EAAE,OAAO;EAAiB;CAAO,CAAC,CACxF;CACA,IAAI,eAAe,MAAM,OAAO,OAAO,OAAO,KAAK,UAAU;CAC7D,OAAO;AACR,CAAC;;;;;;;;;;;;;;;;;;;;;;;AAwBF,MAAM,8BACL,MACA,gBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,WAAW,4BAA4B,IAAI;CACjD,IAAI,SAAS,WAAW,GAAG;CAC3B,IAAI,CAAC,KAAK,kBACT,OAAO,OAAO,YACb,iBACA,oDAAoD,SAAS,KAAK,IAAI,EAAE,2PAIzE;CAED,MAAM,UAAU,OAAO,0BAA0B,aAAa,QAAQ;CACtE,MAAM,UAAU,SAAS,QAAQ,QAAQ,CAAC,QAAQ,IAAI,GAAG,CAAC;CAC1D,IAAI,QAAQ,SAAS,GACpB,OAAO,OAAO,YACb,iBACA,kFACK,QAAQ,KAAK,IAAI,EAAE,oOAGzB;AAEF,CAAC;AAqCF,MAAa,4BACZ,sBACA,wBAEA,2BAA2B,qBAAqB,yCAAyC,oBAAoB;AAE9G,MAAM,gCACL,MACA,SACA,WAC4C;CAC5C,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO;CACzC,IAAI,KAAK,WAAW,iBAAiB,QAAQ,cAAc,OAAO,OAAO;CACzE,MAAM,SAAS,yBAAyB,KAAK,WAAW,cAAc,QAAQ,YAAY;CAC1F,IAAI,WAAW,SACd,OAAO,OAAO,KAAK,IAAI,kBAAkB;EAAE,OAAO;EAAwB;CAAO,CAAC,CAAC;CAEpF,OAAO,OAAO,WAAW,MAAM;AAChC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,MAAa,cACZ,WAMA,OAAO,IAAI,aAAa;CAQvB,MAAM,OAAO,OAAO,SAAS,OAAO,aAAa,OAAO,UAAU;CAClE,OAAO,gBAAgB,OAAO,WAAW;CACzC,OAAO,6BACN,MACA,OAAO,mBACP,OAAO,wBACR;CAYA,OAAO,wBACN;EAAE,KAAK,KAAK;EAAK,OAAO,KAAK;EAAO,SAAS,KAAK;CAAQ,GAC1D,OAAO,eACR;CAaA,IAAI,OAAO,aAAa,WAAW,GAClC,OAAO,gBAAgB,KAAK,UAAU,UAAU;MAC1C;EACN,MAAM,oBAA4C,CAAC;EACnD,KAAK,MAAM,eAAe,OAAO,cAAc;GAC9C,MAAM,QAAQ,OAAO,YAAY;GACjC,kBAAkB,KAAK;IAAE,QAAQ,YAAY;IAAQ;GAAM,CAAC;EAC7D;EACA,MAAM,OAAO,OAAO,mBAAmB,iBAAiB;EACxD,OAAO,iBAAiB,KAAK,UAAU,IAAI;CAC5C;CAUA,OAAO,2BAA2B,MAAM,OAAO,WAAW;CAM1D,KAAK,MAAM,eAAe,OAAO,cAChC,IAAI,YAAY,YACf,OAAO,YAAY,WAAW,KAC7B,OAAO,MAAM,UAAU,oBAAoB,qBAAqB,YAAY,MAAM,CAAC,CACpF;CAIF,OAAO,kBAAkB,MAAM,OAAO,WAAW;CAkBjD,OAAO,OAAO,OACb,OAAO,IAAI,aAAa;EACvB,MAAM,eAAuC,CAAC;EAC9C,IAAI,0BAA0B;EAC9B,OAAO,OAAO,cAAc,SAC3B,KAAK,UAAU,IAAI,KAAK,CAAC,0BACtB,4BAA4B,OAAO,SAAS,YAAY,IACxD,OAAO,IACX;EAUA,MAAM,YAAY,OAAO,IAAI,aAAa;GAEzC,IAAI,KAAK,kBACR,OAAO,gBAAgB,OAAO,aAAa,OAAO,kBAAkB;GAErE,MAAM,KAAK,OAAO,WAAW;GAI7B,KAAK,MAAM,aAAa,KAAK,cAAc;IAC1C,MAAM,OAAO,GAAG,OAAO,YAAY,GAAG,iBAAiB,SAAS;IAEhE,IAAI,EAAC,OADiB,GAAG,OAAO,IAAI,CAAC,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC,IAEnF,OAAO,OAAO,OAAO,KACpB,IAAI,kBAAkB;KACrB,OAAO;KACP,QAAQ;KACR,QAAQ,8BAA8B;IACvC,CAAC,CACF;GAEF;GAOA,MAAM,uBAAuB,6BAA6B,KAAK,UAAU;GACzE,MAAM,0CAA0B,IAAI,IAAsB;GAC1D,KAAK,MAAM,CAAC,SAAS,iBAAiB,sBAAsB;IAC3D,MAAM,aAAa,OAAO,gBACzB,SACA,OAAO,aACP,OAAO,SACP,YACD;IACA,KAAK,MAAM,CAAC,KAAK,QAAQ,YACxB,wBAAwB,IAAI,KAAK,GAAG;GAEtC;GACA,KAAK,MAAM,YAAY,KAAK,YAAY;IACvC,MAAM,YAAY,wBAAwB,IAAI,SAAS,WAAW;IAClE,IAAI,cAAc,KAAA,GACjB,OAAO,OAAO,YACb,cACA,wDAAwD,SAAS,eACjE,SAAS,MACV;IAED,OAAO,iBAAiB,UAAU,WAAW,OAAO,UAAU,UAC7D,OAAO,WAAW;KACjB,aAAa,KAAK,KAAK;IACxB,CAAC,CACF;GACD;GAYA,OAAO,qBAAqB,OAAO,oBAAoB;IACtD,YAAY,OAAO;IACnB,aAAa,OAAO;GACrB,CAAC;GACD,OAAO;EACR,CAAC;EAkBD,OAAO,cAAqD,EAAE,KAAK,CAAC;GAfnE,IAAI;GACJ,YAAY,OAAO;GACnB,aAAa,OAAO;GACpB,YAAY,OAAO;GACnB,aAAa;GAGb,oBAAoB;GACpB,iBAAiB,mCAAmC,OAAO,gBAAgB;GAI3E,cAAc,UAAU,OAAO,KAAK,KAAK;EAGiC,CAAC,EAAE,CAAC;EAkB/E,IAAI,aAAa,SAAS,GACzB,OAAO,OAAO,gBACb,OAAO,IAAI,aAAa;GACvB,OAAO,oBAAoB,cAAc,OAAO,OAAO;GACvD,OAAO,yBAAyB,MAAM,OAAO,SAAS,OAAO,eAAe;GAC5E,0BAA0B;EAC3B,CAAC,CACF;OAEA,0BAA0B;EAY3B,OAAO,qBAAqB,OAAO,gBAAgB;CACpD,CAAC,CACF;CAIA,KAAK,MAAM,eAAe,OAAO,cAChC,IAAI,YAAY,aACf,OAAO,YAAY,YAAY,KAC9B,OAAO,MAAM,UAAU,qBAAqB,sBAAsB,YAAY,MAAM,CAAC,CACtF;CAcF,OAAO;AACR,CAAC"}

package/dist/orchestrators/snapshot/service.mjs

@@ -1,19 +1,16 @@
-import { IdentityContext, StackPathsService } from "../../substrate/runtime/paths.mjs";
 import { decodeJsonText } from "../../substrate/runtime/runtime-decode.mjs";
-import { ownHolder } from "../../substrate/runtime/cross-process/liveness.mjs";
 import { acquireStackLock } from "../../substrate/runtime/cross-process/stack-lock.mjs";
 import { mintRandomSuffix } from "../../substrate/runtime/random-suffix.mjs";
+import { IdentityContext, StackPathsService } from "../../substrate/runtime/paths.mjs";
 import { ContainerRuntimeService } from "../../runtime/docker/service.mjs";
 import "../../runtime/docker/index.mjs";
-import { acquireReservation } from "../../substrate/runtime/cross-process/snapshot-reservation.mjs";
 import { SNAPSHOT_ID_RULE, SnapshotDescriptorError, SnapshotLayout, SnapshotMetadataSchema, parseSnapshotId } from "./descriptor.mjs";
+import { stageAndSwap } from "../../substrate/runtime/stage-and-swap/index.mjs";
 import { planWipe, runWipe } from "./wipe.mjs";
 import "./identity-guard.mjs";
-import { runCapture } from "./capture.mjs";
+import { resumeAfterCapture, runCapture } from "./capture.mjs";
 import { runPrune } from "./prune.mjs";
-import { recoverPendingRestore } from "./recover-pending.mjs";
-import { stageAndSwap } from "../../substrate/runtime/stage-and-swap/index.mjs";
-import { runRestore } from "./restore.mjs";
+import { RestorePhaseError, runRestore } from "./restore.mjs";
 import { Context, Effect, FileSystem, Layer, Ref, Schema } from "effect";
 //#region src/orchestrators/snapshot/service.ts
 var SnapshotIdError = class extends Schema.TaggedErrorClass()("SnapshotIdError", {
@@ -63,12 +60,6 @@ const normalizeSnapshotName = (operation, name) => {
 	}));
 	return Effect.succeed(normalized);
 };
-/** Read this process's canonical startTime stamp for the snapshot
-*  reservation liveness check. Returns `null` when the kernel-probe
-*  couldn't determine startTime — matches `RosterHolderSchema.startTime`
-*  semantics and is honored by the sweep's `checkHolderLiveness`
-*  null-conservative short-circuit. */
-const ownStartTime = () => ownHolder("snapshot").startTime;
 const normalizeIdentityValue = (value) => {
 	if (Array.isArray(value)) return value.map(normalizeIdentityValue);
 	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, nested]) => [key, normalizeIdentityValue(nested)]));
@@ -78,6 +69,15 @@ const stableIdentityString = (value) => {
 	return JSON.stringify(normalizeIdentityValue(value)) ?? String(value);
 };
 const identityHookFromDecl = (pluginKey, decl) => decl.preRestore === void 0 ? Effect.succeed({}) : decl.preRestore.pipe(Effect.map((value) => ({ [pluginKey]: stableIdentityString(value) })));
+/**
+* Wire the orchestrator from the substrate's path resolver + the runtime
+* container adapter.
+*
+* Discipline: capture/restore acquire `stack.lock` for the (bounded,
+* whole-stack-stopped) snapshot window; the `stageAndSwap` rename publishes
+* atomically inside it. List/delete/wipe/prune acquire `stack.lock` briefly
+* (they don't bounce containers).
+*/
 const layerSnapshotOrchestrator = Layer.effect(SnapshotOrchestratorService, Effect.gen(function* () {
 	const paths = yield* StackPathsService;
 	const identity = yield* IdentityContext;
@@ -104,58 +104,66 @@ const layerSnapshotOrchestrator = Layer.effect(SnapshotOrchestratorService, Effe
 		};
 		yield* Ref.update(participantsRef, (xs) => [...xs, entry]);
 		yield* Effect.addFinalizer(() => Ref.update(participantsRef, (xs) => xs.filter((e) => e.seq !== seq)));
-		yield* Effect.annotateCurrentSpan({
-			"snapshot.participant.plugin": pluginKey,
-			"snapshot.participant.subtrees": decl.subtrees.length
-		});
-	}).pipe(Effect.withSpan("orchestrator.snapshot.registerParticipant"));
-	const capture = ({ id, label, participants, onProgress }) => Effect.gen(function* () {
+	});
+	const capture = ({ id, label, graphInput, replaceExistingLabel, participants, resume }) => Effect.gen(function* () {
 		const snapshotId = id === void 0 ? yield* mintSnapshotId() : yield* validateSnapshotId("capture", id);
 		const snapshotName = yield* normalizeSnapshotName("capture", label);
 		const effectiveParticipants = participants ?? (yield* Ref.get(participantsRef)).map((e) => e.capture);
 		const artifactDir = `${paths.snapshotDir}/${snapshotId}`;
 		const stagingDir = `${paths.snapshotDir}/.staging.${snapshotId}`;
 		const backupDir = `${paths.snapshotDir}/.bak.${snapshotId}`;
-		return yield* Effect.scoped(Effect.gen(function* () {
-			yield* acquireReservation(paths.snapshotReservationFile, ownStartTime());
+		const { meta, replacedSnapshotIds } = yield* Effect.scoped(Effect.gen(function* () {
+			yield* acquireStackLock(paths.stackLockFile);
 			if (yield* (yield* FileSystem.FileSystem).exists(artifactDir).pipe(Effect.catch(() => Effect.succeed(false)))) return yield* Effect.fail(new SnapshotIdError({
 				operation: "capture",
 				field: "id",
 				value: snapshotId,
 				detail: "snapshot id already exists"
 			}));
-			if ((yield* list).some((entry) => entry.metadata?.label === snapshotName)) return yield* Effect.fail(new SnapshotIdError({
+			const duplicateLabels = (yield* list).filter((entry) => entry.metadata?.label === snapshotName);
+			if (duplicateLabels.length > 0 && replaceExistingLabel !== true) return yield* Effect.fail(new SnapshotIdError({
 				operation: "capture",
 				field: "name",
 				value: snapshotName,
 				detail: "snapshot name already exists"
 			}));
-			return yield* stageAndSwap({
-				targetPath: artifactDir,
-				stagingPath: stagingDir,
-				backupPath: backupDir,
-				build: runCapture({
-					stagingDir,
-					snapshotId,
-					label: snapshotName,
-					app: identity.app,
-					stack: identity.stack,
-					network: identity.chain,
-					runtimeStackRoot: paths.stackRoot,
-					stateFilePath: paths.stateFile,
-					participants: effectiveParticipants,
-					runtime,
-					onProgress
-				})
-			});
+			const replacedSnapshotIds = duplicateLabels.map((entry) => entry.id).filter((entryId) => entryId !== snapshotId);
+			return {
+				meta: yield* stageAndSwap({
+					targetPath: artifactDir,
+					stagingPath: stagingDir,
+					backupPath: backupDir,
+					build: runCapture({
+						stagingDir,
+						snapshotId,
+						label: snapshotName,
+						app: identity.app,
+						stack: identity.stack,
+						network: identity.network,
+						graphInput,
+						runtimeStackRoot: paths.stackRoot,
+						participants: effectiveParticipants,
+						runtime
+					})
+				}),
+				replacedSnapshotIds
+			};
 		}));
-	}).pipe(Effect.withSpan("orchestrator.snapshot.capture.entry"));
-	const restore = ({ id, participants }) => Effect.gen(function* () {
+		yield* resumeAfterCapture(meta, {
+			runtime,
+			app: identity.app,
+			stack: identity.stack,
+			...resume === void 0 ? {} : { resume }
+		});
+		yield* Effect.forEach(replacedSnapshotIds, del, { discard: true });
+		return meta;
+	});
+	const restore = ({ id, currentGraphInput, graphInputMismatchPolicy, participants, resume }) => Effect.gen(function* () {
 		const snapshotId = yield* validateSnapshotId("restore", id);
 		const artifactDir = `${paths.snapshotDir}/${snapshotId}`;
 		const effectiveParticipants = participants ?? (yield* Ref.get(participantsRef)).map((e) => e.restore);
-		return yield* Effect.scoped(Effect.gen(function* () {
-			yield* acquireReservation(paths.snapshotReservationFile, ownStartTime());
+		const meta = yield* Effect.scoped(Effect.gen(function* () {
+			yield* acquireStackLock(paths.stackLockFile);
 			return yield* runRestore({
 				snapshotId,
 				artifactDir,
@@ -167,11 +175,19 @@ const layerSnapshotOrchestrator = Layer.effect(SnapshotOrchestratorService, Effe
 				runtimeIdentity: {
 					app: identity.app,
 					stack: identity.stack,
-					network: identity.chain
-				}
+					network: identity.network
+				},
+				...currentGraphInput === void 0 ? {} : { currentGraphInput },
+				...graphInputMismatchPolicy === void 0 ? {} : { graphInputMismatchPolicy }
 			});
 		}));
-	}).pipe(Effect.withSpan("orchestrator.snapshot.restore.entry"));
+		if (resume !== void 0) yield* resume.pipe(Effect.mapError((cause) => new RestorePhaseError({
+			phase: "resume",
+			detail: "stack resume after restore failed",
+			cause
+		})));
+		return meta;
+	});
 	const list = Effect.gen(function* () {
 		const fs = yield* FileSystem.FileSystem;
 		if (!(yield* fs.exists(paths.snapshotDir).pipe(Effect.catch(() => Effect.succeed(false))))) return [];
@@ -223,7 +239,7 @@ const layerSnapshotOrchestrator = Layer.effect(SnapshotOrchestratorService, Effe
 			});
 		}
 		return entries;
-	}).pipe(Effect.withSpan("orchestrator.snapshot.list"));
+	});
 	const del = (id) => Effect.gen(function* () {
 		const snapshotId = yield* validateSnapshotId("delete", id);
 		const fs = yield* FileSystem.FileSystem;
@@ -235,7 +251,7 @@ const layerSnapshotOrchestrator = Layer.effect(SnapshotOrchestratorService, Effe
 				force: true
 			}).pipe(Effect.ignore);
 		}));
-	}).pipe(Effect.withSpan("orchestrator.snapshot.delete"));
+	});
 	const wipe = (args) => Effect.gen(function* () {
 		yield* Effect.scoped(Effect.gen(function* () {
 			yield* acquireStackLock(paths.stackLockFile);
@@ -245,26 +261,22 @@ const layerSnapshotOrchestrator = Layer.effect(SnapshotOrchestratorService, Effe
 					stack: identity.stack
 				},
 				stackRoot: paths.stackRoot,
-				stateFilePath: paths.stateFile,
 				runtime,
-				keepSnapshots: args.keepSnapshots,
-				keepCache: args.keepCache
+				keepSnapshots: args.keepSnapshots
 			});
 		}));
-	}).pipe(Effect.withSpan("orchestrator.snapshot.wipe.entry"));
+	});
 	const wipePlan = (args) => planWipe({
 		labelMatch: {
 			app: identity.app,
 			stack: identity.stack
 		},
 		stackRoot: paths.stackRoot,
-		stateFilePath: paths.stateFile,
 		runtime,
-		keepSnapshots: args.keepSnapshots,
-		keepCache: args.keepCache
-	}).pipe(Effect.withSpan("orchestrator.snapshot.wipe.plan.entry"));
+		keepSnapshots: args.keepSnapshots
+	});
 	const prune = () => Effect.scoped(Effect.gen(function* () {
-		yield* acquireReservation(paths.snapshotReservationFile, ownStartTime());
+		yield* acquireStackLock(paths.stackLockFile);
 		return yield* runPrune({
 			stackRoot: paths.stackRoot,
 			imageLabelFilter: {
@@ -273,8 +285,7 @@ const layerSnapshotOrchestrator = Layer.effect(SnapshotOrchestratorService, Effe
 			},
 			runtime
 		});
-	})).pipe(Effect.withSpan("orchestrator.snapshot.prune.entry"));
-	const recoverPendingRestoreImpl = recoverPendingRestore(paths.stackRoot, runtime).pipe(Effect.withSpan("orchestrator.snapshot.recover-pending.entry"));
+	}));
 	return SnapshotOrchestratorService.of({
 		registerParticipant,
 		capture,
@@ -283,8 +294,7 @@ const layerSnapshotOrchestrator = Layer.effect(SnapshotOrchestratorService, Effe
 		delete: del,
 		wipe,
 		wipePlan,
-		prune,
-		recoverPendingRestore: recoverPendingRestoreImpl
+		prune
 	});
 }));
 //#endregion