@mysten-incubation/devstack 0.1.1 → 0.3.0

package/dist/plugins/walrus/wal-swap.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"wal-swap.mjs","names":[],"sources":["../../../src/plugins/walrus/wal-swap.ts"],"sourcesContent":["import { Effect, Schema } from 'effect';\nimport { Transaction } from '@mysten/sui/transactions';\n\nimport type { ChainProbe } from '../../contracts/chain-probe.ts';\nimport { formatExecutedFailure } from '../../substrate/runtime/sui-execute/index.ts';\nimport { signAndDispatch } from '../../substrate/runtime/sui-execute/sign-and-dispatch.ts';\nimport type { AccountValue } from '../account/index.ts';\nimport type { SuiSdkShim } from '../sui/index.ts';\nimport { SUI_FULL_COIN_TYPE } from '../account/index.ts';\nimport { walrusPluginError, type WalrusPluginError } from './errors.ts';\nimport { WalrusSpans } from './spans.ts';\n\n/** Conservative reserve held back from the gas coin for transaction\n *  gas itself. The swap call splits `paymentMist` off the gas coin\n *  via `tx.coin({ useGasCoin: true })`, so the on-chain balance must\n *  cover BOTH the payment AND a gas budget reserve. The exact gas\n *  budget is set by the SDK at build time; this reserve is a coarse\n *  upper bound used only by the pre-flight refusal — if the wire\n *  call proves the reserve is too small the SDK still surfaces the\n *  native `InsufficientGas` cause with the real numbers. */\nconst WAL_SWAP_GAS_RESERVE_MIST = 50_000_000n;\n\nexport interface WalExchangeHandle {\n\treadonly objectId: string;\n\treadonly packageId: string;\n}\n\nexport type WalExchangeProbeKey = { readonly kind: 'object'; readonly objectId: string };\n\nexport type WalSwapSdk = Pick<SuiSdkShim, 'client'> & {\n\treadonly core: Pick<SuiSdkShim['core'], 'getBalance'>;\n};\n\n/** Read the account's SUI balance (best-effort). Returns `null` if the\n *  RPC throws or the response shape is unexpected — the pre-flight is\n *  a hint, not a hard gate. */\nconst readSuiBalance = (\n\tsdk: WalSwapSdk,\n\towner: string,\n): Effect.Effect<bigint | null, never> =>\n\tEffect.promise(async () => {\n\t\ttry {\n\t\t\tconst response = await sdk.core.getBalance({ owner, coinType: SUI_FULL_COIN_TYPE });\n\t\t\tconst outer =\n\t\t\t\ttypeof response === 'object' && response !== null && 'balance' in response\n\t\t\t\t\t? (response as { readonly balance?: unknown }).balance\n\t\t\t\t\t: response;\n\t\t\tconst value =\n\t\t\t\ttypeof outer === 'object' && outer !== null && 'balance' in outer\n\t\t\t\t\t? (outer as { readonly balance?: unknown }).balance\n\t\t\t\t\t: outer;\n\t\t\tif (typeof value === 'bigint') return value;\n\t\t\tif (typeof value === 'number' && Number.isSafeInteger(value) && value >= 0)\n\t\t\t\treturn BigInt(value);\n\t\t\tif (typeof value === 'string' && /^\\d+$/.test(value)) return BigInt(value);\n\t\t\treturn null;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t});\n\nexport interface WalAccountSwapRequest {\n\treadonly account: AccountValue;\n\treadonly sdk: WalSwapSdk;\n\treadonly exchange: WalExchangeHandle;\n\treadonly recipientAddress: string;\n\treadonly paymentMist: bigint;\n}\n\nconst WalExchangeObjectShape = Schema.Struct({\n\tobjectId: Schema.String,\n\ttype: Schema.String,\n});\n\nexport const resolveWalExchange = (\n\tprobe: ChainProbe<WalExchangeProbeKey>,\n\texchangeObjectId: string | undefined,\n): Effect.Effect<WalExchangeHandle | null, WalrusPluginError> =>\n\tEffect.gen(function* () {\n\t\tif (exchangeObjectId === undefined) return null;\n\t\tconst found = yield* probe\n\t\t\t.get({ kind: 'object', objectId: exchangeObjectId }, WalExchangeObjectShape, 'lenient')\n\t\t\t.pipe(\n\t\t\t\tEffect.mapError((cause) =>\n\t\t\t\t\twalrusPluginError(\n\t\t\t\t\t\t'exchange',\n\t\t\t\t\t\t`walrus.exchange: failed to resolve exchange object ${exchangeObjectId}: ${cause.reason}: ${cause.detail}`,\n\t\t\t\t\t\t{ cause },\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\t\tif (found === null) return null;\n\t\tconst packageId = found.type.split('::')[0];\n\t\tif (packageId === undefined || !packageId.startsWith('0x')) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\twalrusPluginError(\n\t\t\t\t\t'exchange',\n\t\t\t\t\t`walrus.exchange: unexpected exchange object type \"${found.type}\" — expected \"<pkg>::wal_exchange::Exchange\"`,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\treturn { objectId: exchangeObjectId, packageId };\n\t});\n\nexport const buildWalSwapTransaction = (args: {\n\treadonly signerAddress: string;\n\treadonly recipientAddress: string;\n\treadonly exchange: WalExchangeHandle;\n\treadonly paymentMist: bigint;\n}): Transaction => {\n\tconst tx = new Transaction();\n\ttx.setSender(args.signerAddress);\n\tconst paymentCoin = tx.coin({\n\t\tbalance: args.paymentMist,\n\t\ttype: '0x2::sui::SUI',\n\t\tuseGasCoin: true,\n\t});\n\tconst walCoin = tx.moveCall({\n\t\ttarget: `${args.exchange.packageId}::wal_exchange::exchange_all_for_wal`,\n\t\targuments: [tx.object(args.exchange.objectId), paymentCoin],\n\t});\n\ttx.transferObjects([walCoin], tx.pure.address(args.recipientAddress));\n\treturn tx;\n};\n\nexport const swapAccountSuiForWal = (\n\targs: WalAccountSwapRequest,\n): Effect.Effect<{ readonly digest: string }, WalrusPluginError> =>\n\tEffect.gen(function* () {\n\t\t// Pre-flight gas-budget refusal — the swap splits `paymentMist`\n\t\t// off the gas coin via `tx.coin({ useGasCoin: true })`, so the\n\t\t// on-chain SUI balance must cover BOTH the payment AND a gas\n\t\t// reserve. Without this check the failure surfaces as an opaque\n\t\t// `Transaction.build` / chain-side `InsufficientGas` after the\n\t\t// wire call has already been attempted; the typed refusal here\n\t\t// names the numbers so the caller sees the real cause. The\n\t\t// balance read is best-effort — a `null` from the SDK falls\n\t\t// through to the wire call (the existing `mapSignError` /\n\t\t// `onFailed` paths still catch the chain-side failure).\n\t\tconst suiBalance = yield* readSuiBalance(args.sdk, args.account.address);\n\t\tconst required = args.paymentMist + WAL_SWAP_GAS_RESERVE_MIST;\n\t\tif (suiBalance !== null && suiBalance < required) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\twalrusPluginError(\n\t\t\t\t\t'fund-wal',\n\t\t\t\t\t`walrus.fundWal: account '${args.account.name}' (address=${args.account.address}) ` +\n\t\t\t\t\t\t`has insufficient SUI to swap ${args.paymentMist} for WAL — ` +\n\t\t\t\t\t\t`balance=${suiBalance} mist, required≥${required} mist ` +\n\t\t\t\t\t\t`(payment=${args.paymentMist} + gas reserve=${WAL_SWAP_GAS_RESERVE_MIST}). ` +\n\t\t\t\t\t\t`Top up the account's SUI funding before declaring the WAL funding entry.`,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\treturn yield* signAndDispatch({\n\t\t\tsignerSource: args.account,\n\t\t\tbuildTxBytes: () =>\n\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\tconst tx = buildWalSwapTransaction({\n\t\t\t\t\t\tsignerAddress: args.account.address,\n\t\t\t\t\t\trecipientAddress: args.recipientAddress,\n\t\t\t\t\t\texchange: args.exchange,\n\t\t\t\t\t\tpaymentMist: args.paymentMist,\n\t\t\t\t\t});\n\t\t\t\t\treturn yield* Effect.tryPromise({\n\t\t\t\t\t\ttry: () => tx.build({ client: args.sdk.client }),\n\t\t\t\t\t\tcatch: (cause): WalrusPluginError =>\n\t\t\t\t\t\t\twalrusPluginError(\n\t\t\t\t\t\t\t\t'fund-wal',\n\t\t\t\t\t\t\t\t`walrus.fundWal: transaction serialization failed for account '${args.account.name}'.`,\n\t\t\t\t\t\t\t\t{ cause },\n\t\t\t\t\t\t\t),\n\t\t\t\t\t});\n\t\t\t\t}),\n\t\t\tmapSignError: (cause): WalrusPluginError =>\n\t\t\t\twalrusPluginError(\n\t\t\t\t\t'fund-wal',\n\t\t\t\t\t`walrus.fundWal: SUI -> WAL swap failed for ${args.recipientAddress} ` +\n\t\t\t\t\t\t`using account '${args.account.name}' (address=${args.account.address}) ` +\n\t\t\t\t\t\t`against exchange ${args.exchange.objectId}.`,\n\t\t\t\t\t{ cause },\n\t\t\t\t),\n\t\t\tonFailed: (failure) =>\n\t\t\t\tEffect.fail(\n\t\t\t\t\twalrusPluginError(\n\t\t\t\t\t\t'fund-wal',\n\t\t\t\t\t\t`walrus.fundWal: SUI -> WAL swap failed on-chain ` +\n\t\t\t\t\t\t\t`(exchange=${args.exchange.objectId}) ` +\n\t\t\t\t\t\t\tformatExecutedFailure(failure),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\tonSuccess: (ok) => Effect.succeed({ digest: ok.digest }),\n\t\t});\n\t}).pipe(\n\t\tEffect.withSpan('devstack.plugin.walrus.fundWal', {\n\t\t\tattributes: {\n\t\t\t\t[WalrusSpans.fundAccount]: args.account.name,\n\t\t\t\t[WalrusSpans.fundAddress]: args.recipientAddress,\n\t\t\t\t[WalrusSpans.fundExchange]: args.exchange.objectId,\n\t\t\t},\n\t\t}),\n\t);\n"],"mappings":";;;;;;;;;;;;;;;;;AAoBA,MAAM,4BAA4B;;;;AAgBlC,MAAM,kBACL,KACA,UAEA,OAAO,QAAQ,YAAY;AAC1B,KAAI;EACH,MAAM,WAAW,MAAM,IAAI,KAAK,WAAW;GAAE;GAAO,UAAU;GAAoB,CAAC;EACnF,MAAM,QACL,OAAO,aAAa,YAAY,aAAa,QAAQ,aAAa,WAC9D,SAA4C,UAC7C;EACJ,MAAM,QACL,OAAO,UAAU,YAAY,UAAU,QAAQ,aAAa,QACxD,MAAyC,UAC1C;AACJ,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,cAAc,MAAM,IAAI,SAAS,EACxE,QAAO,OAAO,MAAM;AACrB,MAAI,OAAO,UAAU,YAAY,QAAQ,KAAK,MAAM,CAAE,QAAO,OAAO,MAAM;AAC1E,SAAO;SACA;AACP,SAAO;;EAEP;AAUH,MAAM,yBAAyB,OAAO,OAAO;CAC5C,UAAU,OAAO;CACjB,MAAM,OAAO;CACb,CAAC;AAEF,MAAa,sBACZ,OACA,qBAEA,OAAO,IAAI,aAAa;AACvB,KAAI,qBAAqB,KAAA,EAAW,QAAO;CAC3C,MAAM,QAAQ,OAAO,MACnB,IAAI;EAAE,MAAM;EAAU,UAAU;EAAkB,EAAE,wBAAwB,UAAU,CACtF,KACA,OAAO,UAAU,UAChB,kBACC,YACA,sDAAsD,iBAAiB,IAAI,MAAM,OAAO,IAAI,MAAM,UAClG,EAAE,OAAO,CACT,CACD,CACD;AACF,KAAI,UAAU,KAAM,QAAO;CAC3B,MAAM,YAAY,MAAM,KAAK,MAAM,KAAK,CAAC;AACzC,KAAI,cAAc,KAAA,KAAa,CAAC,UAAU,WAAW,KAAK,CACzD,QAAO,OAAO,OAAO,KACpB,kBACC,YACA,qDAAqD,MAAM,KAAK,8CAChE,CACD;AAEF,QAAO;EAAE,UAAU;EAAkB;EAAW;EAC/C;AAEH,MAAa,2BAA2B,SAKrB;CAClB,MAAM,KAAK,IAAI,aAAa;AAC5B,IAAG,UAAU,KAAK,cAAc;CAChC,MAAM,cAAc,GAAG,KAAK;EAC3B,SAAS,KAAK;EACd,MAAM;EACN,YAAY;EACZ,CAAC;CACF,MAAM,UAAU,GAAG,SAAS;EAC3B,QAAQ,GAAG,KAAK,SAAS,UAAU;EACnC,WAAW,CAAC,GAAG,OAAO,KAAK,SAAS,SAAS,EAAE,YAAY;EAC3D,CAAC;AACF,IAAG,gBAAgB,CAAC,QAAQ,EAAE,GAAG,KAAK,QAAQ,KAAK,iBAAiB,CAAC;AACrE,QAAO;;AAGR,MAAa,wBACZ,SAEA,OAAO,IAAI,aAAa;CAWvB,MAAM,aAAa,OAAO,eAAe,KAAK,KAAK,KAAK,QAAQ,QAAQ;CACxE,MAAM,WAAW,KAAK,cAAc;AACpC,KAAI,eAAe,QAAQ,aAAa,SACvC,QAAO,OAAO,OAAO,KACpB,kBACC,YACA,4BAA4B,KAAK,QAAQ,KAAK,aAAa,KAAK,QAAQ,QAAQ,iCAC/C,KAAK,YAAY,qBACtC,WAAW,kBAAkB,SAAS,iBACrC,KAAK,YAAY,iBAAiB,0BAA0B,6EAEzE,CACD;AAEF,QAAO,OAAO,gBAAgB;EAC7B,cAAc,KAAK;EACnB,oBACC,OAAO,IAAI,aAAa;GACvB,MAAM,KAAK,wBAAwB;IAClC,eAAe,KAAK,QAAQ;IAC5B,kBAAkB,KAAK;IACvB,UAAU,KAAK;IACf,aAAa,KAAK;IAClB,CAAC;AACF,UAAO,OAAO,OAAO,WAAW;IAC/B,WAAW,GAAG,MAAM,EAAE,QAAQ,KAAK,IAAI,QAAQ,CAAC;IAChD,QAAQ,UACP,kBACC,YACA,iEAAiE,KAAK,QAAQ,KAAK,KACnF,EAAE,OAAO,CACT;IACF,CAAC;IACD;EACH,eAAe,UACd,kBACC,YACA,8CAA8C,KAAK,iBAAiB,kBACjD,KAAK,QAAQ,KAAK,aAAa,KAAK,QAAQ,QAAQ,qBAClD,KAAK,SAAS,SAAS,IAC5C,EAAE,OAAO,CACT;EACF,WAAW,YACV,OAAO,KACN,kBACC,YACA,6DACc,KAAK,SAAS,SAAS,MACpC,sBAAsB,QAAQ,CAC/B,CACD;EACF,YAAY,OAAO,OAAO,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAC;EACxD,CAAC;EACD,CAAC,KACF,OAAO,SAAS,kCAAkC,EACjD,YAAY;EACV,YAAY,cAAc,KAAK,QAAQ;EACvC,YAAY,cAAc,KAAK;EAC/B,YAAY,eAAe,KAAK,SAAS;CAC1C,EACD,CAAC,CACF"}
+{"version":3,"file":"wal-swap.mjs","names":[],"sources":["../../../src/plugins/walrus/wal-swap.ts"],"sourcesContent":["import { Effect, Schema } from 'effect';\nimport { Transaction } from '@mysten/sui/transactions';\n\nimport type { ChainProbe } from '../../contracts/chain-probe.ts';\nimport type { AccountValue } from '../account/index.ts';\nimport { formatExecutedFailure, signAndDispatch, type SuiSdkShim } from '../sui/index.ts';\nimport { SUI_FULL_COIN_TYPE } from '../account/index.ts';\nimport { walrusPluginError, type WalrusPluginError } from './errors.ts';\n\n/** Conservative reserve held back from the gas coin for transaction\n *  gas itself. The swap call splits `paymentMist` off the gas coin\n *  via `tx.coin({ useGasCoin: true })`, so the on-chain balance must\n *  cover BOTH the payment AND a gas budget reserve. The exact gas\n *  budget is set by the SDK at build time; this reserve is a coarse\n *  upper bound used only by the pre-flight refusal — if the wire\n *  call proves the reserve is too small the SDK still surfaces the\n *  native `InsufficientGas` cause with the real numbers. */\nconst WAL_SWAP_GAS_RESERVE_MIST = 50_000_000n;\n\nexport interface WalExchangeHandle {\n\treadonly objectId: string;\n\treadonly packageId: string;\n}\n\nexport type WalExchangeProbeKey = { readonly kind: 'object'; readonly objectId: string };\n\nexport type WalSwapSdk = Pick<SuiSdkShim, 'client'> & {\n\treadonly core: Pick<SuiSdkShim['core'], 'getBalance'>;\n};\n\n/** Read the account's SUI balance (best-effort). Returns `null` if the\n *  RPC throws or the response shape is unexpected — the pre-flight is\n *  a hint, not a hard gate. */\nconst readSuiBalance = (sdk: WalSwapSdk, owner: string): Effect.Effect<bigint | null, never> =>\n\tEffect.promise(async () => {\n\t\ttry {\n\t\t\tconst response = await sdk.core.getBalance({ owner, coinType: SUI_FULL_COIN_TYPE });\n\t\t\tconst outer =\n\t\t\t\ttypeof response === 'object' && response !== null && 'balance' in response\n\t\t\t\t\t? (response as { readonly balance?: unknown }).balance\n\t\t\t\t\t: response;\n\t\t\tconst value =\n\t\t\t\ttypeof outer === 'object' && outer !== null && 'balance' in outer\n\t\t\t\t\t? (outer as { readonly balance?: unknown }).balance\n\t\t\t\t\t: outer;\n\t\t\tif (typeof value === 'bigint') return value;\n\t\t\tif (typeof value === 'number' && Number.isSafeInteger(value) && value >= 0)\n\t\t\t\treturn BigInt(value);\n\t\t\tif (typeof value === 'string' && /^\\d+$/.test(value)) return BigInt(value);\n\t\t\treturn null;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t});\n\nexport interface WalAccountSwapRequest {\n\treadonly account: AccountValue;\n\treadonly sdk: WalSwapSdk;\n\treadonly exchange: WalExchangeHandle;\n\treadonly recipientAddress: string;\n\treadonly paymentMist: bigint;\n}\n\nconst WalExchangeObjectShape = Schema.Struct({\n\tobjectId: Schema.String,\n\ttype: Schema.String,\n});\n\nexport const resolveWalExchange = (\n\tprobe: ChainProbe<WalExchangeProbeKey>,\n\texchangeObjectId: string | undefined,\n): Effect.Effect<WalExchangeHandle | null, WalrusPluginError> =>\n\tEffect.gen(function* () {\n\t\tif (exchangeObjectId === undefined) return null;\n\t\tconst found = yield* probe\n\t\t\t.get({ kind: 'object', objectId: exchangeObjectId }, WalExchangeObjectShape, 'lenient')\n\t\t\t.pipe(\n\t\t\t\tEffect.mapError((cause) =>\n\t\t\t\t\twalrusPluginError(\n\t\t\t\t\t\t'exchange',\n\t\t\t\t\t\t`walrus.exchange: failed to resolve exchange object ${exchangeObjectId}: ${cause.reason}: ${cause.detail}`,\n\t\t\t\t\t\t{ cause },\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\t\tif (found === null) return null;\n\t\tconst packageId = found.type.split('::')[0];\n\t\tif (packageId === undefined || !packageId.startsWith('0x')) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\twalrusPluginError(\n\t\t\t\t\t'exchange',\n\t\t\t\t\t`walrus.exchange: unexpected exchange object type \"${found.type}\" — expected \"<pkg>::wal_exchange::Exchange\"`,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\treturn { objectId: exchangeObjectId, packageId };\n\t});\n\nexport const buildWalSwapTransaction = (args: {\n\treadonly signerAddress: string;\n\treadonly recipientAddress: string;\n\treadonly exchange: WalExchangeHandle;\n\treadonly paymentMist: bigint;\n}): Transaction => {\n\tconst tx = new Transaction();\n\ttx.setSender(args.signerAddress);\n\tconst paymentCoin = tx.coin({\n\t\tbalance: args.paymentMist,\n\t\ttype: '0x2::sui::SUI',\n\t\tuseGasCoin: true,\n\t});\n\tconst walCoin = tx.moveCall({\n\t\ttarget: `${args.exchange.packageId}::wal_exchange::exchange_all_for_wal`,\n\t\targuments: [tx.object(args.exchange.objectId), paymentCoin],\n\t});\n\ttx.transferObjects([walCoin], tx.pure.address(args.recipientAddress));\n\treturn tx;\n};\n\nexport const swapAccountSuiForWal = (\n\targs: WalAccountSwapRequest,\n): Effect.Effect<{ readonly digest: string }, WalrusPluginError> =>\n\tEffect.gen(function* () {\n\t\t// Pre-flight gas-budget refusal — the swap splits `paymentMist`\n\t\t// off the gas coin via `tx.coin({ useGasCoin: true })`, so the\n\t\t// on-chain SUI balance must cover BOTH the payment AND a gas\n\t\t// reserve. Without this check the failure surfaces as an opaque\n\t\t// `Transaction.build` / chain-side `InsufficientGas` after the\n\t\t// wire call has already been attempted; the typed refusal here\n\t\t// names the numbers so the caller sees the real cause. The\n\t\t// balance read is best-effort — a `null` from the SDK falls\n\t\t// through to the wire call (the existing `mapSignError` /\n\t\t// `onFailed` paths still catch the chain-side failure).\n\t\tconst suiBalance = yield* readSuiBalance(args.sdk, args.account.address);\n\t\tconst required = args.paymentMist + WAL_SWAP_GAS_RESERVE_MIST;\n\t\tif (suiBalance !== null && suiBalance < required) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\twalrusPluginError(\n\t\t\t\t\t'fund-wal',\n\t\t\t\t\t`walrus.fundWal: account '${args.account.name}' (address=${args.account.address}) ` +\n\t\t\t\t\t\t`has insufficient SUI to swap ${args.paymentMist} for WAL — ` +\n\t\t\t\t\t\t`balance=${suiBalance} mist, required≥${required} mist ` +\n\t\t\t\t\t\t`(payment=${args.paymentMist} + gas reserve=${WAL_SWAP_GAS_RESERVE_MIST}). ` +\n\t\t\t\t\t\t`Top up the account's SUI funding before declaring the WAL funding entry.`,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\treturn yield* signAndDispatch({\n\t\t\tsignerSource: args.account,\n\t\t\tbuildTxBytes: () =>\n\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\tconst tx = buildWalSwapTransaction({\n\t\t\t\t\t\tsignerAddress: args.account.address,\n\t\t\t\t\t\trecipientAddress: args.recipientAddress,\n\t\t\t\t\t\texchange: args.exchange,\n\t\t\t\t\t\tpaymentMist: args.paymentMist,\n\t\t\t\t\t});\n\t\t\t\t\treturn yield* Effect.tryPromise({\n\t\t\t\t\t\ttry: () => tx.build({ client: args.sdk.client }),\n\t\t\t\t\t\tcatch: (cause): WalrusPluginError =>\n\t\t\t\t\t\t\twalrusPluginError(\n\t\t\t\t\t\t\t\t'fund-wal',\n\t\t\t\t\t\t\t\t`walrus.fundWal: transaction serialization failed for account '${args.account.name}'.`,\n\t\t\t\t\t\t\t\t{ cause },\n\t\t\t\t\t\t\t),\n\t\t\t\t\t});\n\t\t\t\t}),\n\t\t\tmapSignError: (cause): WalrusPluginError =>\n\t\t\t\twalrusPluginError(\n\t\t\t\t\t'fund-wal',\n\t\t\t\t\t`walrus.fundWal: SUI -> WAL swap failed for ${args.recipientAddress} ` +\n\t\t\t\t\t\t`using account '${args.account.name}' (address=${args.account.address}) ` +\n\t\t\t\t\t\t`against exchange ${args.exchange.objectId}.`,\n\t\t\t\t\t{ cause },\n\t\t\t\t),\n\t\t\tonFailed: (failure) =>\n\t\t\t\tEffect.fail(\n\t\t\t\t\twalrusPluginError(\n\t\t\t\t\t\t'fund-wal',\n\t\t\t\t\t\t`walrus.fundWal: SUI -> WAL swap failed on-chain ` +\n\t\t\t\t\t\t\t`(exchange=${args.exchange.objectId}) ` +\n\t\t\t\t\t\t\tformatExecutedFailure(failure),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\tonSuccess: (ok) => Effect.succeed({ digest: ok.digest }),\n\t\t});\n\t});\n"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,MAAM,4BAA4B;;;;AAgBlC,MAAM,kBAAkB,KAAiB,UACxC,OAAO,QAAQ,YAAY;CAC1B,IAAI;EACH,MAAM,WAAW,MAAM,IAAI,KAAK,WAAW;GAAE;GAAO,UAAU;EAAmB,CAAC;EAClF,MAAM,QACL,OAAO,aAAa,YAAY,aAAa,QAAQ,aAAa,WAC9D,SAA4C,UAC7C;EACJ,MAAM,QACL,OAAO,UAAU,YAAY,UAAU,QAAQ,aAAa,QACxD,MAAyC,UAC1C;EACJ,IAAI,OAAO,UAAU,UAAU,OAAO;EACtC,IAAI,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,SAAS,GACxE,OAAO,OAAO,KAAK;EACpB,IAAI,OAAO,UAAU,YAAY,QAAQ,KAAK,KAAK,GAAG,OAAO,OAAO,KAAK;EACzE,OAAO;CACR,QAAQ;EACP,OAAO;CACR;AACD,CAAC;AAUF,MAAM,yBAAyB,OAAO,OAAO;CAC5C,UAAU,OAAO;CACjB,MAAM,OAAO;AACd,CAAC;AAED,MAAa,sBACZ,OACA,qBAEA,OAAO,IAAI,aAAa;CACvB,IAAI,qBAAqB,KAAA,GAAW,OAAO;CAC3C,MAAM,QAAQ,OAAO,MACnB,IAAI;EAAE,MAAM;EAAU,UAAU;CAAiB,GAAG,wBAAwB,SAAS,CAAC,CACtF,KACA,OAAO,UAAU,UAChB,kBACC,YACA,sDAAsD,iBAAiB,IAAI,MAAM,OAAO,IAAI,MAAM,UAClG,EAAE,MAAM,CACT,CACD,CACD;CACD,IAAI,UAAU,MAAM,OAAO;CAC3B,MAAM,YAAY,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC;CACzC,IAAI,cAAc,KAAA,KAAa,CAAC,UAAU,WAAW,IAAI,GACxD,OAAO,OAAO,OAAO,KACpB,kBACC,YACA,qDAAqD,MAAM,KAAK,6CACjE,CACD;CAED,OAAO;EAAE,UAAU;EAAkB;CAAU;AAChD,CAAC;AAEF,MAAa,2BAA2B,SAKrB;CAClB,MAAM,KAAK,IAAI,YAAY;CAC3B,GAAG,UAAU,KAAK,aAAa;CAC/B,MAAM,cAAc,GAAG,KAAK;EAC3B,SAAS,KAAK;EACd,MAAM;EACN,YAAY;CACb,CAAC;CACD,MAAM,UAAU,GAAG,SAAS;EAC3B,QAAQ,GAAG,KAAK,SAAS,UAAU;EACnC,WAAW,CAAC,GAAG,OAAO,KAAK,SAAS,QAAQ,GAAG,WAAW;CAC3D,CAAC;CACD,GAAG,gBAAgB,CAAC,OAAO,GAAG,GAAG,KAAK,QAAQ,KAAK,gBAAgB,CAAC;CACpE,OAAO;AACR;AAEA,MAAa,wBACZ,SAEA,OAAO,IAAI,aAAa;CAWvB,MAAM,aAAa,OAAO,eAAe,KAAK,KAAK,KAAK,QAAQ,OAAO;CACvE,MAAM,WAAW,KAAK,cAAc;CACpC,IAAI,eAAe,QAAQ,aAAa,UACvC,OAAO,OAAO,OAAO,KACpB,kBACC,YACA,4BAA4B,KAAK,QAAQ,KAAK,aAAa,KAAK,QAAQ,QAAQ,iCAC/C,KAAK,YAAY,qBACtC,WAAW,kBAAkB,SAAS,iBACrC,KAAK,YAAY,iBAAiB,0BAA0B,4EAE1E,CACD;CAED,OAAO,OAAO,gBAAgB;EAC7B,cAAc,KAAK;EACnB,oBACC,OAAO,IAAI,aAAa;GACvB,MAAM,KAAK,wBAAwB;IAClC,eAAe,KAAK,QAAQ;IAC5B,kBAAkB,KAAK;IACvB,UAAU,KAAK;IACf,aAAa,KAAK;GACnB,CAAC;GACD,OAAO,OAAO,OAAO,WAAW;IAC/B,WAAW,GAAG,MAAM,EAAE,QAAQ,KAAK,IAAI,OAAO,CAAC;IAC/C,QAAQ,UACP,kBACC,YACA,iEAAiE,KAAK,QAAQ,KAAK,KACnF,EAAE,MAAM,CACT;GACF,CAAC;EACF,CAAC;EACF,eAAe,UACd,kBACC,YACA,8CAA8C,KAAK,iBAAiB,kBACjD,KAAK,QAAQ,KAAK,aAAa,KAAK,QAAQ,QAAQ,qBAClD,KAAK,SAAS,SAAS,IAC5C,EAAE,MAAM,CACT;EACD,WAAW,YACV,OAAO,KACN,kBACC,YACA,6DACc,KAAK,SAAS,SAAS,MACpC,sBAAsB,OAAO,CAC/B,CACD;EACD,YAAY,OAAO,OAAO,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC;CACxD,CAAC;AACF,CAAC"}

package/dist/primitives/artifact-publisher.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-publisher.mjs","names":[],"sources":["../../src/primitives/artifact-publisher.ts"],"sourcesContent":["// ArtifactPublisher — L0 substrate primitive (architecture §10).\n//\n// Unifies the discipline that recurs across many on-chain\n// produce/verify plugins (substrate must remain service-name-blind;\n// the plugin index is the authoritative list). cache → verify →\n// produce → register on EVERY cycle.\n//\n// This is callable from any plugin; there is NO plugin-side contract\n// to implement. Plugins pass in:\n//\n//   - a namespace + cache-key derivation,\n//   - a verify procedure (calls ChainProbe with a typed Schema,\n//     lenient mode),\n//   - a produce procedure (run on miss / verify-fail),\n//   - a register procedure (fires on EVERY cycle — hit AND miss).\n\nimport type { Effect, Scope } from 'effect';\n\nimport type { ChainId, ContentHash } from '../substrate/brand.ts';\n\n/** Lenient retry profile constants — shared with ChainProbe.\n *  Architecture: 15 attempts, 90s budget, 500ms initial, 1.5×\n *  backoff, [0.8, 1.2) jitter. */\nexport const LENIENT_RETRY_PROFILE = {\n\tattempts: 15,\n\ttotalBudgetMillis: 90_000,\n\tinitialMillis: 500,\n\tbackoffMultiplier: 1.5,\n\tjitterRange: [0.8, 1.2] as const,\n} as const;\n\n/** Input contract for ArtifactPublisher.publish. */\nexport interface ArtifactSpec<Produced, Verified> {\n\t/** Cache namespace — plugin-chosen, e.g. `package`. */\n\treadonly namespace: string;\n\t/** Chain identity — substrate folds into the cache key. */\n\treadonly chain: ChainId;\n\t/** Content-hash of canonical input bytes. */\n\treadonly contentHash: ContentHash;\n\t/** Verify probe — typed Schema; lenient mode. Returns null on\n\t *  not-found OR transient failure.\n\t *\n\t *  The substrate decodes the cached payload (if any) and passes it\n\t *  in as `cached`. Plugins that key their on-chain probe off a\n\t *  field of the cached payload (e.g. action's `digest`, package's\n\t *  `packageId`) read it from here directly — no in-process\n\t *  registry-hop required. Plugins that don't care about the\n\t *  cached payload ignore the parameter.\n\t *\n\t *  When the cache is empty (cold boot) OR decode failed\n\t *  (corruption) the substrate short-circuits to \"miss\" before\n\t *  invoking this; callers can therefore assume `cached` is\n\t *  defined on every call. */\n\treadonly verify: (cached: Produced) => Effect.Effect<Verified | null, never>;\n\t/** Produce procedure — runs on cache miss OR verify-fail. */\n\treadonly produce: Effect.Effect<Produced, ArtifactPublishError, Scope.Scope>;\n\t/** Register procedure — fires on EVERY cycle (hit AND miss). The\n\t *  substrate always hands back the decoded `Produced` payload (on\n\t *  cache hit) or the freshly produced one (on miss); the verify\n\t *  shape is a probe-only signal, never surfaced to callers. */\n\treadonly register: (artifact: Produced) => Effect.Effect<void, never>;\n}\n\n/** Tagged error from a publish round. */\nexport interface ArtifactPublishError {\n\treadonly _tag: 'ArtifactPublishError';\n\treadonly reason: 'produce-failed' | 'verify-exhausted' | 'cache-corrupt';\n\treadonly detail: string;\n}\n\n/** Constructor for `ArtifactPublishError`. Centralising the literal\n *  shape (single `_tag` site, no `as const` ceremony at call sites)\n *  per STYLE_GUIDE §2: tagged errors expose a factory at every\n *  plugin/public boundary. Every plugin's `produce` /\n *  `Effect.mapError` path goes through this. */\nexport const artifactPublishError = (\n\treason: ArtifactPublishError['reason'],\n\tdetail: string,\n): ArtifactPublishError => ({\n\t_tag: 'ArtifactPublishError',\n\treason,\n\tdetail,\n});\n\n/** The publisher service. Plugins call `publish`; substrate handles\n *  cache lookup, verify, produce-on-miss, idempotent register.\n *\n *  Returns the `Produced` payload on EVERY path:\n *  - cache hit + verify succeeds → the decoded cached `Produced`,\n *  - cache miss or verify-fail → the freshly produced `Produced`.\n *\n *  The `Verified` shape is a probe-only signal (drives the lenient\n *  null/non-null decision inside the substrate); it is never returned\n *  to plugin callers. Callers therefore type-narrow trivially against\n *  `Produced` and avoid the `'<sentinel>'` projection dance. */\nexport interface ArtifactPublisher {\n\treadonly publish: <Produced, Verified>(\n\t\tspec: ArtifactSpec<Produced, Verified>,\n\t) => Effect.Effect<Produced, ArtifactPublishError, Scope.Scope>;\n}\n"],"mappings":";;;;;;AA2EA,MAAa,wBACZ,QACA,YAC2B;CAC3B,MAAM;CACN;CACA;CACA"}
+{"version":3,"file":"artifact-publisher.mjs","names":[],"sources":["../../src/primitives/artifact-publisher.ts"],"sourcesContent":["// ArtifactPublisher — L0 substrate primitive (architecture §10).\n//\n// Unifies the discipline that recurs across many on-chain\n// produce/verify plugins (substrate must remain service-name-blind;\n// the plugin index is the authoritative list). cache → verify →\n// produce → register on EVERY cycle.\n//\n// This is callable from any plugin; there is NO plugin-side contract\n// to implement. Plugins pass in:\n//\n//   - a namespace + cache-key derivation,\n//   - a verify procedure (calls ChainProbe with a typed Schema,\n//     lenient mode),\n//   - a produce procedure (run on miss / verify-fail),\n//   - a register procedure (fires on EVERY cycle — hit AND miss).\n\nimport type { Effect, Scope } from 'effect';\n\nimport type { ContentHash } from '../substrate/brand.ts';\n\n/** Input contract for ArtifactPublisher.publish. */\nexport interface ArtifactSpec<Produced, Verified> {\n\t/** Cache namespace — plugin-chosen, e.g. `package`. */\n\treadonly namespace: string;\n\t/** Chain identity (plain string value) — substrate folds into the cache key. */\n\treadonly chain: string;\n\t/** Content-hash of canonical input bytes. */\n\treadonly contentHash: ContentHash;\n\t/** Verify probe — typed Schema; lenient mode. Returns null on\n\t *  not-found OR transient failure.\n\t *\n\t *  The substrate decodes the cached payload (if any) and passes it\n\t *  in as `cached`. Plugins that key their on-chain probe off a\n\t *  field of the cached payload (e.g. action's `digest`, package's\n\t *  `packageId`) read it from here directly — no in-process\n\t *  registry-hop required. Plugins that don't care about the\n\t *  cached payload ignore the parameter.\n\t *\n\t *  When the cache is empty (cold boot) OR decode failed\n\t *  (corruption) the substrate short-circuits to \"miss\" before\n\t *  invoking this; callers can therefore assume `cached` is\n\t *  defined on every call. */\n\treadonly verify: (cached: Produced) => Effect.Effect<Verified | null, never>;\n\t/** Produce procedure — runs on cache miss OR verify-fail. */\n\treadonly produce: Effect.Effect<Produced, ArtifactPublishError, Scope.Scope>;\n\t/** Register procedure — fires on EVERY cycle (hit AND miss). The\n\t *  substrate always hands back the decoded `Produced` payload (on\n\t *  cache hit) or the freshly produced one (on miss); the verify\n\t *  shape is a probe-only signal, never surfaced to callers. */\n\treadonly register: (artifact: Produced) => Effect.Effect<void, never>;\n}\n\n/** Tagged error from a publish round. */\nexport interface ArtifactPublishError {\n\treadonly _tag: 'ArtifactPublishError';\n\treadonly reason: 'produce-failed' | 'verify-exhausted' | 'cache-corrupt';\n\treadonly detail: string;\n}\n\n/** Constructor for `ArtifactPublishError`. Centralising the literal\n *  shape (single `_tag` site, no `as const` ceremony at call sites)\n *  per STYLE_GUIDE §2: tagged errors expose a factory at every\n *  plugin/public boundary. Every plugin's `produce` /\n *  `Effect.mapError` path goes through this. */\nexport const artifactPublishError = (\n\treason: ArtifactPublishError['reason'],\n\tdetail: string,\n): ArtifactPublishError => ({\n\t_tag: 'ArtifactPublishError',\n\treason,\n\tdetail,\n});\n\n/** The publisher service. Plugins call `publish`; substrate handles\n *  cache lookup, verify, produce-on-miss, idempotent register.\n *\n *  Returns the `Produced` payload on EVERY path:\n *  - cache hit + verify succeeds → the decoded cached `Produced`,\n *  - cache miss or verify-fail → the freshly produced `Produced`.\n *\n *  The `Verified` shape is a probe-only signal (drives the lenient\n *  null/non-null decision inside the substrate); it is never returned\n *  to plugin callers. Callers therefore type-narrow trivially against\n *  `Produced` and avoid the `'<sentinel>'` projection dance. */\nexport interface ArtifactPublisher {\n\treadonly publish: <Produced, Verified>(\n\t\tspec: ArtifactSpec<Produced, Verified>,\n\t) => Effect.Effect<Produced, ArtifactPublishError, Scope.Scope>;\n}\n"],"mappings":";;;;;;AAgEA,MAAa,wBACZ,QACA,YAC2B;CAC3B,MAAM;CACN;CACA;AACD"}

package/dist/primitives/cache.d.mts

@@ -1 +1 @@
-import { Effect } from "effect";
+import { Effect, Scope } from "effect";

package/dist/runtime/docker/client.mjs

@@ -1,5 +1,8 @@
 import { capture } from "../../substrate/runtime/observability/subprocess-capture.mjs";
 import { Context, Effect, Layer } from "effect";
+import { existsSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir, tmpdir } from "node:os";
 import { ChildProcess } from "effect/unstable/process";
 //#region src/runtime/docker/client.ts
 var DockerHost = class extends Context.Service()("@devstack/runtime-docker/DockerHost") {};
@@ -8,11 +11,52 @@ const layerDockerHostDefault = Layer.succeed(DockerHost)({});
 *  inject a stub. In production this is `ChildProcessSpawner.make()`
 *  from `effect/unstable/process` (provided via `@effect/platform-node`). */
 var DockerSpawner = class extends Context.Service()("@devstack/runtime-docker/DockerSpawner") {};
-const buildEnv = (host) => {
-	const env = {};
+let sanitizedDockerConfig = null;
+const sourceDockerConfigDir = () => process.env.DOCKER_CONFIG ?? join(homedir(), ".docker");
+const originalDockerConfig = (sourceDir) => {
+	try {
+		const parsed = JSON.parse(readFileSync(join(sourceDir, "config.json"), "utf8"));
+		if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) return { ...parsed };
+	} catch {}
+	return {};
+};
+const symlinkDockerConfigDir = (sourceDir, targetDir, name) => {
+	const source = join(sourceDir, name);
+	if (!existsSync(source)) return;
+	try {
+		symlinkSync(source, join(targetDir, name));
+	} catch {}
+};
+const dockerConfigDir = () => {
+	const source = sourceDockerConfigDir();
+	if (sanitizedDockerConfig !== null && sanitizedDockerConfig.sourceDir === source) return sanitizedDockerConfig.dir;
+	const dir = mkdtempSync(join(tmpdir(), "devstack-docker-config-"));
+	for (const name of [
+		"cli-plugins",
+		"buildx",
+		"contexts"
+	]) symlinkDockerConfigDir(source, dir, name);
+	const { credsStore: _credsStore, credHelpers: _credHelpers, ...config } = originalDockerConfig(source);
+	if (!("auths" in config)) config.auths = {};
+	writeFileSync(join(dir, "config.json"), `${JSON.stringify(config)}\n`, { mode: 384 });
+	process.once("exit", () => {
+		rmSync(dir, {
+			recursive: true,
+			force: true
+		});
+	});
+	sanitizedDockerConfig = {
+		sourceDir: source,
+		dir
+	};
+	return dir;
+};
+const dockerCliEnv = (host = {}) => {
+	const env = { DOCKER_CONFIG: dockerConfigDir() };
 	if (host.dockerHost !== void 0) env.DOCKER_HOST = host.dockerHost;
 	return env;
 };
+const buildEnv = (host) => dockerCliEnv(host);
 /** Grace period between the scope-close SIGTERM and the escalation
 *  SIGKILL. Without `forceKillAfter` the Node spawner sends ONE SIGTERM
 *  on scope close and then waits indefinitely for the child to die — so
@@ -62,6 +106,6 @@ const dockerRunOk = (verb, args, opts) => Effect.gen(function* () {
 	});
 });
 //#endregion
-export { DockerHost, DockerSpawner, dockerCommand, dockerRun, dockerRunOk, layerDockerHostDefault };
+export { DockerHost, DockerSpawner, dockerCliEnv, dockerCommand, dockerRun, dockerRunOk, layerDockerHostDefault };
 
 //# sourceMappingURL=client.mjs.map

package/dist/runtime/docker/client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.mjs","names":[],"sources":["../../../src/runtime/docker/client.ts"],"sourcesContent":["// Thin `docker` CLI wrapper.\n//\n// Every subprocess invocation flows through the L0 subprocess-capture\n// primitive (one capture function, one error class). This module owns:\n//\n//   - The argv constructor (`dockerArgv`).\n//   - The `DOCKER_HOST` env passthrough (architecture §7: one-daemon\n//     assumption, env override supported).\n//   - Two convenience verbs: `run` (capture-with-success-or-fail-by-exit)\n//     and `runOk` (capture, return CaptureResult regardless of exit so\n//     the caller can classify stderr). NO docker compose anywhere.\n//\n// No service names appear here. No stderr-pattern classification —\n// that's in `wrap.ts`. This file is mechanical argv + spawn.\n\nimport { Context, Effect, Layer } from 'effect';\nimport { ChildProcess } from 'effect/unstable/process';\nimport { ChildProcessSpawner } from 'effect/unstable/process';\n\nimport {\n\tcapture,\n\ttype CaptureError,\n\ttype CaptureOptions,\n\ttype CaptureResult,\n} from '../../substrate/runtime/observability/subprocess-capture.ts';\n\n// -----------------------------------------------------------------------------\n// Daemon-host configuration\n// -----------------------------------------------------------------------------\n\n/** Optional `DOCKER_HOST` override. When absent we let the docker CLI\n *  resolve its default socket (Unix: `/var/run/docker.sock`; macOS\n *  Desktop: `unix:///var/run/docker.sock`; remote daemon if the user\n *  set `DOCKER_HOST` in their own env). */\nexport interface DockerHostShape {\n\treadonly dockerHost?: string;\n\t/** Optional explicit binary path (default `docker`). Tests use\n\t *  this to point at a stub; otherwise we resolve via PATH. */\n\treadonly bin?: string;\n}\n\nexport class DockerHost extends Context.Service<DockerHost, DockerHostShape>()(\n\t'@devstack/runtime-docker/DockerHost',\n) {}\n\nexport const layerDockerHostDefault: Layer.Layer<DockerHost> = Layer.succeed(DockerHost)({});\n\nexport const layerDockerHost = (shape: DockerHostShape): Layer.Layer<DockerHost> =>\n\tLayer.succeed(DockerHost)(shape);\n\n// -----------------------------------------------------------------------------\n// Spawner injection\n// -----------------------------------------------------------------------------\n\n/** A spawner service exposing `spawn`. Held as a service so tests can\n *  inject a stub. In production this is `ChildProcessSpawner.make()`\n *  from `effect/unstable/process` (provided via `@effect/platform-node`). */\nexport class DockerSpawner extends Context.Service<\n\tDockerSpawner,\n\tReturnType<typeof ChildProcessSpawner.make>\n>()('@devstack/runtime-docker/DockerSpawner') {}\n\n// -----------------------------------------------------------------------------\n// Argv construction\n// -----------------------------------------------------------------------------\n\nconst buildEnv = (host: DockerHostShape): Record<string, string> => {\n\tconst env: Record<string, string> = {};\n\tif (host.dockerHost !== undefined) env.DOCKER_HOST = host.dockerHost;\n\treturn env;\n};\n\n/** Grace period between the scope-close SIGTERM and the escalation\n *  SIGKILL. Without `forceKillAfter` the Node spawner sends ONE SIGTERM\n *  on scope close and then waits indefinitely for the child to die — so\n *  a timeout-interrupt (see `exec.ts` / `dockerRunOneShot` `Effect.timeout`)\n *  blocks on scope-close if the docker CLI ignores SIGTERM. A few\n *  seconds lets a well-behaved CLI flush and exit cleanly before we\n *  force-kill the wedged case. */\nconst KILL_GRACE = '5 seconds';\n\n/** Build a `ChildProcess.Command` from `(verb, ...args)`. The verb is\n *  separate so observability span attributes can pin the\n *  high-cardinality `args` separately from the `devstack.op` tag.\n *\n *  `forceKillAfter` makes scope-close termination escalate\n *  SIGTERM→SIGKILL so an interrupt (timeout) can't wedge on a docker CLI\n *  that ignores SIGTERM. */\nexport const dockerCommand = (\n\thost: DockerHostShape,\n\tverb: string,\n\targs: ReadonlyArray<string>,\n\toverrideEnv: Readonly<Record<string, string>> = {},\n): ChildProcess.Command => {\n\tconst bin = host.bin ?? 'docker';\n\tconst env = { ...buildEnv(host), ...overrideEnv };\n\treturn ChildProcess.make(bin, [verb, ...args], {\n\t\tenv,\n\t\textendEnv: true,\n\t\tforceKillAfter: KILL_GRACE,\n\t});\n};\n\n// -----------------------------------------------------------------------------\n// Capture verbs\n// -----------------------------------------------------------------------------\n\n/** Capture a docker invocation, fail on non-zero exit. Use when any\n *  non-zero exit is a failure case (most write operations). */\nexport const dockerRun = (\n\tverb: string,\n\targs: ReadonlyArray<string>,\n\topts?: Omit<CaptureOptions, 'op' | 'nonZeroIsFailure'>,\n): Effect.Effect<CaptureResult, CaptureError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst host = yield* DockerHost;\n\t\tconst spawner = yield* DockerSpawner;\n\t\treturn yield* capture(spawner, dockerCommand(host, verb, args), {\n\t\t\t...opts,\n\t\t\top: `docker.${verb}`,\n\t\t\tnonZeroIsFailure: true,\n\t\t});\n\t});\n\n/** Capture a docker invocation, return the `CaptureResult` regardless\n *  of exit. Use when the caller classifies stderr or wants the exit\n *  code (lifecycle state machine, inventory). */\nexport const dockerRunOk = (\n\tverb: string,\n\targs: ReadonlyArray<string>,\n\topts?: Omit<CaptureOptions, 'op' | 'nonZeroIsFailure'>,\n): Effect.Effect<CaptureResult, CaptureError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst host = yield* DockerHost;\n\t\tconst spawner = yield* DockerSpawner;\n\t\treturn yield* capture(spawner, dockerCommand(host, verb, args), {\n\t\t\t...opts,\n\t\t\top: `docker.${verb}`,\n\t\t\tnonZeroIsFailure: false,\n\t\t});\n\t});\n"],"mappings":";;;;AAyCA,IAAa,aAAb,cAAgC,QAAQ,SAAsC,CAC7E,sCACA,CAAC;AAEF,MAAa,yBAAkD,MAAM,QAAQ,WAAW,CAAC,EAAE,CAAC;;;;AAY5F,IAAa,gBAAb,cAAmC,QAAQ,SAGxC,CAAC,yCAAyC,CAAC;AAM9C,MAAM,YAAY,SAAkD;CACnE,MAAM,MAA8B,EAAE;AACtC,KAAI,KAAK,eAAe,KAAA,EAAW,KAAI,cAAc,KAAK;AAC1D,QAAO;;;;;;;;;AAUR,MAAM,aAAa;;;;;;;;AASnB,MAAa,iBACZ,MACA,MACA,MACA,cAAgD,EAAE,KACxB;CAC1B,MAAM,MAAM,KAAK,OAAO;CACxB,MAAM,MAAM;EAAE,GAAG,SAAS,KAAK;EAAE,GAAG;EAAa;AACjD,QAAO,aAAa,KAAK,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE;EAC9C;EACA,WAAW;EACX,gBAAgB;EAChB,CAAC;;;;AASH,MAAa,aACZ,MACA,MACA,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAO,OAAO;AAEpB,QAAO,OAAO,QAAQ,OADC,eACQ,cAAc,MAAM,MAAM,KAAK,EAAE;EAC/D,GAAG;EACH,IAAI,UAAU;EACd,kBAAkB;EAClB,CAAC;EACD;;;;AAKH,MAAa,eACZ,MACA,MACA,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAO,OAAO;AAEpB,QAAO,OAAO,QAAQ,OADC,eACQ,cAAc,MAAM,MAAM,KAAK,EAAE;EAC/D,GAAG;EACH,IAAI,UAAU;EACd,kBAAkB;EAClB,CAAC;EACD"}
+{"version":3,"file":"client.mjs","names":[],"sources":["../../../src/runtime/docker/client.ts"],"sourcesContent":["// Thin `docker` CLI wrapper.\n//\n// Every subprocess invocation flows through the L0 subprocess-capture\n// primitive (one capture function, one error class). This module owns:\n//\n//   - The argv constructor (`dockerArgv`).\n//   - The `DOCKER_HOST` env passthrough (architecture §7: one-daemon\n//     assumption, env override supported).\n//   - Two convenience verbs: `run` (capture-with-success-or-fail-by-exit)\n//     and `runOk` (capture, return CaptureResult regardless of exit so\n//     the caller can classify stderr). NO docker compose anywhere.\n//\n// No service names appear here. No stderr-pattern classification —\n// that's in `wrap.ts`. This file is mechanical argv + spawn.\n\nimport { existsSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';\nimport { homedir, tmpdir } from 'node:os';\nimport { join } from 'node:path';\n\nimport { Context, Effect, Layer } from 'effect';\nimport { ChildProcess } from 'effect/unstable/process';\nimport { ChildProcessSpawner } from 'effect/unstable/process';\n\nimport {\n\tcapture,\n\ttype CaptureError,\n\ttype CaptureOptions,\n\ttype CaptureResult,\n} from '../../substrate/runtime/observability/subprocess-capture.ts';\n\n// -----------------------------------------------------------------------------\n// Daemon-host configuration\n// -----------------------------------------------------------------------------\n\n/** Optional `DOCKER_HOST` override. When absent we let the docker CLI\n *  resolve its default socket (Unix: `/var/run/docker.sock`; macOS\n *  Desktop: `unix:///var/run/docker.sock`; remote daemon if the user\n *  set `DOCKER_HOST` in their own env). */\nexport interface DockerHostShape {\n\treadonly dockerHost?: string;\n\t/** Optional explicit binary path (default `docker`). Tests use\n\t *  this to point at a stub; otherwise we resolve via PATH. */\n\treadonly bin?: string;\n}\n\nexport class DockerHost extends Context.Service<DockerHost, DockerHostShape>()(\n\t'@devstack/runtime-docker/DockerHost',\n) {}\n\nexport const layerDockerHostDefault: Layer.Layer<DockerHost> = Layer.succeed(DockerHost)({});\n\nexport const layerDockerHost = (shape: DockerHostShape): Layer.Layer<DockerHost> =>\n\tLayer.succeed(DockerHost)(shape);\n\n// -----------------------------------------------------------------------------\n// Spawner injection\n// -----------------------------------------------------------------------------\n\n/** A spawner service exposing `spawn`. Held as a service so tests can\n *  inject a stub. In production this is `ChildProcessSpawner.make()`\n *  from `effect/unstable/process` (provided via `@effect/platform-node`). */\nexport class DockerSpawner extends Context.Service<\n\tDockerSpawner,\n\tReturnType<typeof ChildProcessSpawner.make>\n>()('@devstack/runtime-docker/DockerSpawner') {}\n\n// -----------------------------------------------------------------------------\n// Argv construction\n// -----------------------------------------------------------------------------\n\nlet sanitizedDockerConfig: {\n\treadonly sourceDir: string;\n\treadonly dir: string;\n} | null = null;\n\nconst sourceDockerConfigDir = (): string => process.env.DOCKER_CONFIG ?? join(homedir(), '.docker');\n\nconst originalDockerConfig = (sourceDir: string): Record<string, unknown> => {\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(readFileSync(join(sourceDir, 'config.json'), 'utf8'));\n\t\tif (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) {\n\t\t\treturn { ...(parsed as Record<string, unknown>) };\n\t\t}\n\t} catch {\n\t\t// Missing or malformed Docker config: let the CLI fall back to defaults.\n\t}\n\treturn {};\n};\n\nconst symlinkDockerConfigDir = (sourceDir: string, targetDir: string, name: string): void => {\n\tconst source = join(sourceDir, name);\n\tif (!existsSync(source)) return;\n\ttry {\n\t\tsymlinkSync(source, join(targetDir, name));\n\t} catch {\n\t\t// Best effort. Docker can still run without these; buildx/context\n\t\t// preservation only avoids changing behavior for Desktop/remote users.\n\t}\n};\n\nconst dockerConfigDir = (): string => {\n\tconst source = sourceDockerConfigDir();\n\tif (sanitizedDockerConfig !== null && sanitizedDockerConfig.sourceDir === source) {\n\t\treturn sanitizedDockerConfig.dir;\n\t}\n\tconst dir = mkdtempSync(join(tmpdir(), 'devstack-docker-config-'));\n\tfor (const name of ['cli-plugins', 'buildx', 'contexts']) {\n\t\tsymlinkDockerConfigDir(source, dir, name);\n\t}\n\t// Docker Desktop's `credsStore: \"desktop\"` helper can block forever on\n\t// public image metadata resolution. Give the CLI a process-local config with\n\t// credential helpers stripped while preserving static auth entries, proxies,\n\t// custom headers, contexts, and other non-helper Docker config.\n\tconst {\n\t\tcredsStore: _credsStore,\n\t\tcredHelpers: _credHelpers,\n\t\t...config\n\t} = originalDockerConfig(source);\n\tif (!('auths' in config)) config.auths = {};\n\twriteFileSync(join(dir, 'config.json'), `${JSON.stringify(config)}\\n`, {\n\t\tmode: 0o600,\n\t});\n\tprocess.once('exit', () => {\n\t\trmSync(dir, { recursive: true, force: true });\n\t});\n\tsanitizedDockerConfig = { sourceDir: source, dir };\n\treturn dir;\n};\n\nexport const dockerCliEnv = (host: DockerHostShape = {}): Record<string, string> => {\n\tconst env: Record<string, string> = { DOCKER_CONFIG: dockerConfigDir() };\n\tif (host.dockerHost !== undefined) env.DOCKER_HOST = host.dockerHost;\n\treturn env;\n};\n\nconst buildEnv = (host: DockerHostShape): Record<string, string> => dockerCliEnv(host);\n\n/** Grace period between the scope-close SIGTERM and the escalation\n *  SIGKILL. Without `forceKillAfter` the Node spawner sends ONE SIGTERM\n *  on scope close and then waits indefinitely for the child to die — so\n *  a timeout-interrupt (see `exec.ts` / `dockerRunOneShot` `Effect.timeout`)\n *  blocks on scope-close if the docker CLI ignores SIGTERM. A few\n *  seconds lets a well-behaved CLI flush and exit cleanly before we\n *  force-kill the wedged case. */\nconst KILL_GRACE = '5 seconds';\n\n/** Build a `ChildProcess.Command` from `(verb, ...args)`. The verb is\n *  separate so observability span attributes can pin the\n *  high-cardinality `args` separately from the `devstack.op` tag.\n *\n *  `forceKillAfter` makes scope-close termination escalate\n *  SIGTERM→SIGKILL so an interrupt (timeout) can't wedge on a docker CLI\n *  that ignores SIGTERM. */\nexport const dockerCommand = (\n\thost: DockerHostShape,\n\tverb: string,\n\targs: ReadonlyArray<string>,\n\toverrideEnv: Readonly<Record<string, string>> = {},\n): ChildProcess.Command => {\n\tconst bin = host.bin ?? 'docker';\n\tconst env = { ...buildEnv(host), ...overrideEnv };\n\treturn ChildProcess.make(bin, [verb, ...args], {\n\t\tenv,\n\t\textendEnv: true,\n\t\tforceKillAfter: KILL_GRACE,\n\t});\n};\n\n// -----------------------------------------------------------------------------\n// Capture verbs\n// -----------------------------------------------------------------------------\n\n/** Capture a docker invocation, fail on non-zero exit. Use when any\n *  non-zero exit is a failure case (most write operations). */\nexport const dockerRun = (\n\tverb: string,\n\targs: ReadonlyArray<string>,\n\topts?: Omit<CaptureOptions, 'op' | 'nonZeroIsFailure'>,\n): Effect.Effect<CaptureResult, CaptureError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst host = yield* DockerHost;\n\t\tconst spawner = yield* DockerSpawner;\n\t\treturn yield* capture(spawner, dockerCommand(host, verb, args), {\n\t\t\t...opts,\n\t\t\top: `docker.${verb}`,\n\t\t\tnonZeroIsFailure: true,\n\t\t});\n\t});\n\n/** Capture a docker invocation, return the `CaptureResult` regardless\n *  of exit. Use when the caller classifies stderr or wants the exit\n *  code (lifecycle state machine, inventory). */\nexport const dockerRunOk = (\n\tverb: string,\n\targs: ReadonlyArray<string>,\n\topts?: Omit<CaptureOptions, 'op' | 'nonZeroIsFailure'>,\n): Effect.Effect<CaptureResult, CaptureError, DockerHost | DockerSpawner> =>\n\tEffect.gen(function* () {\n\t\tconst host = yield* DockerHost;\n\t\tconst spawner = yield* DockerSpawner;\n\t\treturn yield* capture(spawner, dockerCommand(host, verb, args), {\n\t\t\t...opts,\n\t\t\top: `docker.${verb}`,\n\t\t\tnonZeroIsFailure: false,\n\t\t});\n\t});\n"],"mappings":";;;;;;;AA6CA,IAAa,aAAb,cAAgC,QAAQ,QAAqC,CAAC,CAC7E,qCACD,CAAC,CAAC,CAAC;AAEH,MAAa,yBAAkD,MAAM,QAAQ,UAAU,CAAC,CAAC,CAAC,CAAC;;;;AAY3F,IAAa,gBAAb,cAAmC,QAAQ,QAGzC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC;AAM/C,IAAI,wBAGO;AAEX,MAAM,8BAAsC,QAAQ,IAAI,iBAAiB,KAAK,QAAQ,GAAG,SAAS;AAElG,MAAM,wBAAwB,cAA+C;CAC5E,IAAI;EACH,MAAM,SAAkB,KAAK,MAAM,aAAa,KAAK,WAAW,aAAa,GAAG,MAAM,CAAC;EACvF,IAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GACzE,OAAO,EAAE,GAAI,OAAmC;CAElD,QAAQ,CAER;CACA,OAAO,CAAC;AACT;AAEA,MAAM,0BAA0B,WAAmB,WAAmB,SAAuB;CAC5F,MAAM,SAAS,KAAK,WAAW,IAAI;CACnC,IAAI,CAAC,WAAW,MAAM,GAAG;CACzB,IAAI;EACH,YAAY,QAAQ,KAAK,WAAW,IAAI,CAAC;CAC1C,QAAQ,CAGR;AACD;AAEA,MAAM,wBAAgC;CACrC,MAAM,SAAS,sBAAsB;CACrC,IAAI,0BAA0B,QAAQ,sBAAsB,cAAc,QACzE,OAAO,sBAAsB;CAE9B,MAAM,MAAM,YAAY,KAAK,OAAO,GAAG,yBAAyB,CAAC;CACjE,KAAK,MAAM,QAAQ;EAAC;EAAe;EAAU;CAAU,GACtD,uBAAuB,QAAQ,KAAK,IAAI;CAMzC,MAAM,EACL,YAAY,aACZ,aAAa,cACb,GAAG,WACA,qBAAqB,MAAM;CAC/B,IAAI,EAAE,WAAW,SAAS,OAAO,QAAQ,CAAC;CAC1C,cAAc,KAAK,KAAK,aAAa,GAAG,GAAG,KAAK,UAAU,MAAM,EAAE,KAAK,EACtE,MAAM,IACP,CAAC;CACD,QAAQ,KAAK,cAAc;EAC1B,OAAO,KAAK;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CAC7C,CAAC;CACD,wBAAwB;EAAE,WAAW;EAAQ;CAAI;CACjD,OAAO;AACR;AAEA,MAAa,gBAAgB,OAAwB,CAAC,MAA8B;CACnF,MAAM,MAA8B,EAAE,eAAe,gBAAgB,EAAE;CACvE,IAAI,KAAK,eAAe,KAAA,GAAW,IAAI,cAAc,KAAK;CAC1D,OAAO;AACR;AAEA,MAAM,YAAY,SAAkD,aAAa,IAAI;;;;;;;;AASrF,MAAM,aAAa;;;;;;;;AASnB,MAAa,iBACZ,MACA,MACA,MACA,cAAgD,CAAC,MACvB;CAC1B,MAAM,MAAM,KAAK,OAAO;CACxB,MAAM,MAAM;EAAE,GAAG,SAAS,IAAI;EAAG,GAAG;CAAY;CAChD,OAAO,aAAa,KAAK,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG;EAC9C;EACA,WAAW;EACX,gBAAgB;CACjB,CAAC;AACF;;;AAQA,MAAa,aACZ,MACA,MACA,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAO,OAAO;CAEpB,OAAO,OAAO,QAAQ,OADC,eACQ,cAAc,MAAM,MAAM,IAAI,GAAG;EAC/D,GAAG;EACH,IAAI,UAAU;EACd,kBAAkB;CACnB,CAAC;AACF,CAAC;;;;AAKF,MAAa,eACZ,MACA,MACA,SAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAO,OAAO;CAEpB,OAAO,OAAO,QAAQ,OADC,eACQ,cAAc,MAAM,MAAM,IAAI,GAAG;EAC/D,GAAG;EACH,IAAI,UAAU;EACd,kBAAkB;CACnB,CAAC;AACF,CAAC"}

package/dist/runtime/docker/container.mjs

@@ -1,5 +1,3 @@
-import { StackPathsService } from "../../substrate/runtime/paths.mjs";
-import { addClaim, removeClaim } from "../../substrate/runtime/cross-process/roster.mjs";
 import { dockerRun, dockerRunOk } from "./client.mjs";
 import { ContainerCreateFailed, ContainerNameCollisionUnrecoverable, DaemonUnreachable, ForeignDockerResource, RecreateRefused } from "./errors.mjs";
 import { classifyExit, isDaemonUnreachableStderr, isNameCollisionStderr, isNoSuchContainerStderr, wrapCreateError, wrapGeneric } from "./wrap.mjs";
@@ -65,10 +63,6 @@ const decideRunAction = (facts, desiredImage, policy, desiredPortBindings = [],
 			kind: "refuse",
 			reason: "unclean-shutdown"
 		};
-		return {
-			kind: "resume",
-			id: facts.id
-		};
 	}
 	return {
 		kind: "resume",
@@ -234,7 +228,7 @@ const inspectContainer = (name) => Effect.gen(function* () {
 		networks,
 		networkAttachments
 	};
-}).pipe(Effect.withSpan("runtime.docker.container.inspect"));
+});
 const normalizeNetworkAttachment = (entry) => typeof entry === "string" ? { name: entry } : entry.aliases === void 0 || entry.aliases.length === 0 ? { name: entry.name } : {
 	name: entry.name,
 	aliases: entry.aliases
@@ -268,9 +262,8 @@ const handleOf = (id, name, imageName, status, ips, ports, labels) => ({
 /** Force-remove by name. Used by recreate. Idempotent on
 *  "no such container". */
 const forceRemove = (name) => Effect.gen(function* () {
-	const res = yield* dockerRunOk("rm", ["-f", name]).pipe(Effect.mapError(wrapGeneric("docker.rm")));
-	if (res.exitCode !== 0 && !isNoSuchContainerStderr(res.stderr)) yield* Effect.annotateCurrentSpan({ "docker.rm.warning": res.stderr });
-}).pipe(Effect.withSpan("runtime.docker.container.forceRemove"));
+	yield* dockerRunOk("rm", ["-f", name]).pipe(Effect.mapError(wrapGeneric("docker.rm")));
+});
 const ownershipFailure = (name, expected, actual, detail) => new ForeignDockerResource({
 	resource: "container",
 	name,
@@ -295,7 +288,7 @@ const assertContainerHandleOwned = (handle) => Effect.gen(function* () {
 	if (facts === null) return yield* Effect.fail(ownershipFailure(handle.name, expected, {}, "container is missing"));
 	if (facts.id !== handle.id) return yield* Effect.fail(ownershipFailure(handle.name, expected, facts.labels ?? {}, `id changed to ${facts.id}`));
 	yield* assertOwnedFacts(handle.name, facts, handle.labels);
-}).pipe(Effect.withSpan("runtime.docker.container.assertOwned"));
+});
 const forceRemoveOwned = (name, id, labels) => Effect.gen(function* () {
 	const current = yield* inspectContainer(name);
 	if (current === null) return;
@@ -337,9 +330,34 @@ const startAndAdopt = (name, labels) => Effect.gen(function* () {
 		detail: `start-and-adopt failed: ${cls.stderr}`
 	}));
 });
+/** `docker run` create with a single `imageRef`. The typed
+*  `ImageNotFound` (from `wrapCreateError`) is propagated as-is so the
+*  caller can decide whether a digest fallback is available. */
+const createWithImageRef = (spec, cycle, imageRef) => Effect.gen(function* () {
+	return (yield* dockerRun("run", createArgv(spec, cycle, imageRef)).pipe(Effect.mapError(wrapCreateError(spec.name)))).stdout.trim();
+});
 const freshCreate = (spec, cycle) => Effect.gen(function* () {
-	return (yield* dockerRun("run", createArgv(spec, cycle, spec.image.tag ?? spec.image.digest)).pipe(Effect.mapError(wrapCreateError(spec.name)))).stdout.trim();
+	const taggedRef = spec.image.tag ?? spec.image.digest;
+	const digestRef = spec.image.digest;
+	return yield* createWithImageRef(spec, cycle, taggedRef).pipe(Effect.catchTag("ImageNotFound", (notFound) => {
+		if (digestRef === taggedRef) return Effect.fail(missingImageError(spec, taggedRef));
+		return createWithImageRef(spec, cycle, digestRef).pipe(Effect.catchTag("ImageNotFound", () => Effect.fail(missingImageError(spec, taggedRef, digestRef, notFound))));
+	}));
 });
+/** Clear, actionable failure when neither the tagged nor digest ref
+*  could be created because the image is absent locally. Names the
+*  missing image and points at restore so an operator knows the fix is
+*  re-running restore (which re-promotes / re-loads the image) rather
+*  than a generic create failure. */
+const missingImageError = (spec, taggedRef, digestRef, cause) => {
+	const tried = digestRef !== void 0 && digestRef !== taggedRef ? `tag '${taggedRef}' and digest '${digestRef}'` : `image '${taggedRef}'`;
+	const causeDetail = cause === void 0 ? "" : ` (${cause.detail})`;
+	return new ContainerCreateFailed({
+		name: spec.name,
+		stderr: `required image is not present locally — tried ${tried}${causeDetail}. Re-run restore to re-promote / re-load the target image before booting.`,
+		exitCode: void 0
+	});
+};
 const resumeStart = (name) => Effect.gen(function* () {
 	const res = yield* dockerRunOk("start", [name]).pipe(Effect.mapError(wrapGeneric("docker.start")));
 	if (res.exitCode === 0) return { ok: true };
@@ -462,48 +480,16 @@ const releasePerNameLock = (lock, name) => Effect.gen(function* () {
 *  helper releases the lock. */
 const withSerializedContainerOp = (name, lock, body) => Effect.acquireUseRelease(acquirePerNameLock(lock, name), () => body, () => releasePerNameLock(lock, name));
 /** Idempotent ensure: apply the state machine, register a scope
-*  finalizer that stops the container + releases the cross-process
-*  claim.
+*  finalizer that stops the container.
 *
 *  Returns the running container handle (id + name + status + ips). */
 const ensureContainer = (spec, deps) => Effect.gen(function* () {
 	const desiredImageRef = spec.image.tag ?? spec.image.digest;
-	const paths = yield* StackPathsService;
-	const mapSubstrateClaimError = (eff) => eff.pipe(Effect.catchTags({
-		RosterIoError: (cause) => Effect.fail(new DaemonUnreachable({
-			op: "cross-process.claim.roster-io",
-			detail: `roster IO failed at ${cause.path}`,
-			cause
-		})),
-		RosterCorruptError: (cause) => Effect.fail(new DaemonUnreachable({
-			op: "cross-process.claim.roster-corrupt",
-			detail: `roster ledger corrupt at ${cause.path}`,
-			cause
-		})),
-		StackLockTimeoutError: (cause) => Effect.fail(new DaemonUnreachable({
-			op: "cross-process.claim.stack-lock-timeout",
-			detail: `stack-lock acquire timed out after ${cause.waitedMillis}ms at ${cause.path}`,
-			cause
-		})),
-		StackLockIoError: (cause) => Effect.fail(new DaemonUnreachable({
-			op: "cross-process.claim.stack-lock-io",
-			detail: `stack-lock IO failed at ${cause.path}`,
-			cause
-		}))
-	}));
 	const registerStopFinalizer = (id) => Effect.addFinalizer(() => Effect.gen(function* () {
 		if ((yield* inspectContainer(spec.name).pipe(Effect.tapCause((cause) => Effect.logDebug("container inspect during scope-close failed", {
 			name: spec.name,
 			cause
-		})), Effect.catch(() => Effect.succeed(null))))?.id === id) yield* stopWithGrace(spec.name, spec.stopGraceSeconds ?? 10);
-		yield* removeClaim({
-			stackLockFile: paths.stackLockFile,
-			rosterFile: paths.rosterFile,
-			containerClaimsFile: paths.containerClaimsFile
-		}, spec.name).pipe(Effect.tapCause((cause) => Effect.logDebug("removeClaim during scope-close failed", {
-			name: spec.name,
-			cause
-		})), Effect.catch(() => Effect.succeed({ lastClaimReleased: false })));
+		})), Effect.catch(() => Effect.succeed(null))))?.id === id) yield* stopWithGrace(spec.name, spec.stopGraceSeconds ?? 10, spec.stopSignal);
 	}).pipe(Effect.uninterruptible));
 	const { id, ips, ports } = yield* withSerializedContainerOp(spec.name, deps.perNameLock, Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
 		const facts = yield* inspectContainer(spec.name);
@@ -526,15 +512,9 @@ const ensureContainer = (spec, deps) => Effect.gen(function* () {
 			}
 			const ips = yield* readIps(spec.name);
 			const refreshedFacts = yield* inspectContainer(spec.name);
-			const ports = refreshedFacts?.effectivePorts ?? refreshedFacts?.ports ?? spec.ports;
-			yield* mapSubstrateClaimError(addClaim({
-				stackLockFile: paths.stackLockFile,
-				rosterFile: paths.rosterFile,
-				containerClaimsFile: paths.containerClaimsFile
-			}, spec.name));
 			return {
 				ips,
-				ports
+				ports: refreshedFacts?.effectivePorts ?? refreshedFacts?.ports ?? spec.ports
 			};
 		}));
 		return {
@@ -544,7 +524,7 @@ const ensureContainer = (spec, deps) => Effect.gen(function* () {
 		};
 	})));
 	return handleOf(id, spec.name, spec.image.tag ?? spec.image.digest, "running", ips, ports, spec.labels);
-}).pipe(Effect.withSpan("runtime.docker.container.ensure"));
+});
 /** Apply the decided action. Recovers from name-collision via
 *  one-shot start-and-adopt; second collision surfaces typed. */
 const applyAction = (action, spec, deps) => Effect.gen(function* () {
@@ -588,10 +568,10 @@ const createWithCollisionRecovery = (spec, deps) => freshCreate(spec, deps.cycle
 const stop = (name, graceSeconds, signal) => stopWithGrace(name, graceSeconds, signal).pipe(Effect.asVoid);
 const pause = (name) => Effect.gen(function* () {
 	yield* dockerRun("pause", [name]).pipe(Effect.mapError(wrapGeneric("docker.pause")));
-}).pipe(Effect.withSpan("runtime.docker.container.pause"));
+});
 const unpause = (name) => Effect.gen(function* () {
 	yield* dockerRun("unpause", [name]).pipe(Effect.mapError(wrapGeneric("docker.unpause")));
-}).pipe(Effect.withSpan("runtime.docker.container.unpause"));
+});
 /** Reserved `devstack.role` value stamped on every committed snapshot
 *  byproduct image. Plugin BUILD images carry the source plugin's real
 *  role (`db`, `validator`, …) or no role at all; committed snapshot
@@ -642,7 +622,7 @@ const commit = (name, tag) => Effect.gen(function* () {
 		exitCode: 0
 	}));
 	return digest;
-}).pipe(Effect.withSpan("runtime.docker.container.commit"));
+});
 //#endregion
 export { SNAPSHOT_IMAGE_ROLE, assertContainerHandleOwned, commit, decideRunAction, ensureContainer, inspectContainer, pause, stop, unpause };