@omnitron-dev/omnitron 0.3.0 → 0.3.2

package/dist/daemon/daemon.js

@@ -1,3 +1,16 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { RecoveryMutation, RecoveryBusyError } from './recovery-state.js';
+import { BackendRecoveryMonitor } from './backend-recovery-monitor.js';
+import { checkBackendCandidate } from './backend-candidate.js';
+import { fileURLToPath } from 'node:url';
 /**
  * OmnitronDaemon — The daemon IS a Titan Application
  *
@@ -17,16 +30,20 @@
  *   - RBAC: role-based access on all RPC endpoints (admin/operator/viewer)
  *   - Config resolution: secrets + env-aware injection into apps
  */
+import path from 'node:path';
 import { Application, ShutdownReason, ShutdownPriority, ApplicationEvent } from '@omnitron-dev/titan';
 import { UnixSocketTransport } from '@omnitron-dev/titan/netron/transport/unix';
 import { TcpTransport } from '@omnitron-dev/titan/netron/transport/tcp';
+import { TransportRequestLimiter } from '@omnitron-dev/titan/netron';
 import { HttpTransport } from '@omnitron-dev/titan/netron/transport/http';
 import { WebSocketTransport } from '@omnitron-dev/titan/netron/transport/websocket';
 import { LOGGER_SERVICE_TOKEN } from '@omnitron-dev/titan/module/logger';
 import { SCHEDULER_SERVICE_TOKEN } from '@omnitron-dev/titan-scheduler';
 import { HEALTH_SERVICE_TOKEN as TITAN_HEALTH_TOKEN } from '@omnitron-dev/titan-health';
 import os from 'node:os';
-import { CLI_VERSION, DEFAULT_DAEMON_CONFIG } from '../config/defaults.js';
+import { isLoopbackHost, assertSafeNetworkPublication } from './network-publication.js';
+export { isLoopbackHost } from './network-publication.js';
+import { CLI_VERSION, DEFAULT_DAEMON_CONFIG, OMNITRON_HOME } from '../config/defaults.js';
 import { createDaemonModule, getDaemonLogStream, getDaemonErrorStream, getDaemonLogCollectorStream } from './daemon.module.js';
 import { DaemonRpcService } from './daemon.rpc-service.js';
 import { AuthRpcService } from '../services/auth.rpc-service.js';
@@ -39,21 +56,30 @@ import { SyncRpcService } from '../services/sync.rpc-service.js';
 import { SystemInfoService } from '../services/system-info.service.js';
 import { SystemInfoRpcService } from '../services/system-info.rpc-service.js';
 import { PidManager } from './pid-manager.js';
+import { prepareDaemonDatabase } from './database-startup.js';
 import { FileWatcher } from '../orchestrator/file-watcher.js';
 import { InfrastructureService } from '../infrastructure/infrastructure.service.js';
 import { DockerHealthIndicator } from '../monitoring/docker-health.indicator.js';
 import { AppHealthIndicator } from '../monitoring/app-health.indicator.js';
 import { EventLoopWatch } from '../monitoring/event-loop-watch.js';
 import { EventLoopStallIndicator } from '../monitoring/event-loop-stall.indicator.js';
+import { runtimeDiagnostics } from '../monitoring/runtime-diagnostics.js';
 import { registerDaemonJobs } from './daemon-scheduler.js';
-import { METRICS_SERVICE_TOKEN as TITAN_METRICS_TOKEN } from '@omnitron-dev/titan-metrics';
-import { ORCHESTRATOR_TOKEN, LOG_MANAGER_TOKEN, STATE_STORE_TOKEN, OMNITRON_DB_TOKEN, AUTH_SERVICE_TOKEN, LOG_COLLECTOR_TOKEN, FLEET_SERVICE_TOKEN, ALERT_SERVICE_TOKEN, HEALTH_CHECK_SERVICE_TOKEN, DISCOVERY_SERVICE_TOKEN, KUBERNETES_SERVICE_TOKEN, PIPELINE_SERVICE_TOKEN, TRACE_COLLECTOR_TOKEN, BACKUP_SERVICE_TOKEN, SECRETS_SERVICE_TOKEN, AUDIT_SERVICE_TOKEN, DAEMON_STATE_STORE_TOKEN, TELEMETRY_RELAY_TOKEN, DEPLOY_SERVICE_TOKEN, INFRASTRUCTURE_GATE_TOKEN, PROJECT_SERVICE_TOKEN, SLAVE_STORAGE_TOKEN, } from '../shared/tokens.js';
+import { METRICS_SERVICE_TOKEN as TITAN_METRICS_TOKEN, METRICS_STORAGE_TOKEN, PostgresMetricsStorage, parseMaxAge } from '@omnitron-dev/titan-metrics';
+import { ORCHESTRATOR_TOKEN, LOG_MANAGER_TOKEN, STATE_STORE_TOKEN, OMNITRON_DB_TOKEN, AUTH_SERVICE_TOKEN, LOG_COLLECTOR_TOKEN, FLEET_SERVICE_TOKEN, ALERT_SERVICE_TOKEN, HEALTH_CHECK_SERVICE_TOKEN, DISCOVERY_SERVICE_TOKEN, KUBERNETES_SERVICE_TOKEN, PIPELINE_SERVICE_TOKEN, TRACE_COLLECTOR_TOKEN, BACKUP_SERVICE_TOKEN, SECRETS_SERVICE_TOKEN, AUDIT_SERVICE_TOKEN, DAEMON_STATE_STORE_TOKEN, TELEMETRY_RELAY_TOKEN, DEPLOY_SERVICE_TOKEN, INFRASTRUCTURE_GATE_TOKEN, PROJECT_SERVICE_TOKEN, SYNC_SERVICE_TOKEN, } from '../shared/tokens.js';
 import { APP_EVENTS, INFRA_EVENTS, DAEMON_EVENTS, PROJECT_EVENTS, STACK_EVENTS, NODE_EVENTS, } from '../shared/events.js';
 import { JWT_SERVICE_TOKEN } from '@omnitron-dev/titan-auth';
 import { AuthenticationManager, AuthorizationManager, } from '@omnitron-dev/titan/netron/auth';
 import { createAuthContextWrapper } from '../services/auth-context.js';
+import { createDaemonTokenValidator, createDaemonPrincipalValidator } from '../services/daemon-authority.js';
 import { ROLES } from '../shared/roles.js';
 import { expandPath } from '../shared/paths.js';
+import { createNullLogger } from '@omnitron-dev/titan/module/logger';
+import { connectExecutionOwner } from './execution-launcher.js';
+import { BackendRpcService } from './backend.rpc-service.js';
+import { startBackendControl } from './backend-control.js';
+import { withControlDeadline } from './private-control-client.js';
+import { Errors } from '@omnitron-dev/titan/errors';
 /**
  * Deadline for a request on the daemon's unix socket.
  *
@@ -100,34 +126,7 @@ export function fleetBindHostFor(dc) {
         return dc.host ?? '0.0.0.0';
     return resolveBindHost(dc.host);
 }
-/**
- * The bind address a daemon should END UP with, from what was actually
- * configured.
- *
- * `fleetBindHostFor` above takes the daemon's RUNNING config, and by the time
- * anything holds one, `host` has been filled in from `DEFAULT_DAEMON_CONFIG`
- * — so `?? '0.0.0.0'` can never fire and every slave binds loopback. The
- * information it needs is whether an operator SET a host, and only the saved
- * file knows that: absent means "no opinion", `127.0.0.1` means "loopback,
- * deliberately".
- *
- * Measured 2026-09-14 on a provisioned slave, after the rule was written and
- * before this existed:
- *
- *     LISTEN 127.0.0.1:9700    ← the fleet port no master can dial
- *     LISTEN 127.0.0.1:9801
- *     LISTEN 127.0.0.1:9802
- *
- * The rule was right, the value it was given was already decided. This is the
- * same rule applied where the answer is still open.
- */
-export function effectiveBindHost(saved) {
-    if (saved?.host)
-        return saved.host;
-    if (saved?.role === 'slave')
-        return '0.0.0.0';
-    return DEFAULT_DAEMON_CONFIG.host;
-}
+export { effectiveBindHost } from '../config/saved.js';
 /**
  * Where a daemon binds the surfaces that exist to serve a console: the Netron
  * HTTP RPC and the WebSocket.
@@ -144,20 +143,9 @@ export function effectiveBindHost(saved) {
 export function consoleBindHostFor(dc) {
     return dc.role === 'slave' ? '127.0.0.1' : resolveBindHost(dc.host);
 }
-/** Addresses that reach this host and nowhere else. */
-export function isLoopbackHost(host) {
-    if (!host)
-        return true; // absent means the loopback default above
-    const h = host.trim().toLowerCase();
-    return h === '127.0.0.1' || h === 'localhost' || h === '::1' || h === '[::1]' || h.startsWith('127.');
-}
 /**
  * Is the daemon still accepting the password its own migration seeded?
- *
- * Resolves the auth service lazily and answers `false` on any failure — a
- * daemon that cannot reach its database has a louder problem than this, and
- * a warning that fails the boot would be a worse trade than the risk it
- * describes.
+ * A failed check cannot authorize external ingress.
  */
 async function isSeededAdminPasswordInUse(app, logger) {
     try {
@@ -166,7 +154,7 @@ async function isSeededAdminPasswordInUse(app, logger) {
     }
     catch (err) {
         logger.warn({ err: err.message }, 'Could not check whether the seeded admin password is still in use');
-        return false;
+        throw err;
     }
 }
 /**
@@ -201,6 +189,8 @@ export class OmnitronDaemon {
     /** Port this daemon serves `/netron/invoke` on; advertised to fleet peers. */
     rpcHttpPort = null;
     fileWatcher = null;
+    /** Last boot/reload configuration, which may come from a registered project outside CWD. */
+    watchConfig = null;
     infraService = null;
     eventLoopWatch = null;
     eventBroadcaster = null;
@@ -208,7 +198,13 @@ export class OmnitronDaemon {
     nodeManagerService = null;
     slaveConnector = null;
     meshHandle = null;
+    ownerAdmissionProof;
+    kernelRollouts;
     nodeManagerRpcService = null;
+    terminalRpcService = null;
+    fileNode = null;
+    filesRpcService = null;
+    pipelineService = null;
     /**
      * The live record of release builds this daemon is running.
      *
@@ -217,6 +213,7 @@ export class OmnitronDaemon {
      * directory with no manifest, and that — not this — is the durable trace.
      */
     releaseService = null;
+    backupService = null;
     systemWorkerManager = null;
     /** Everything the health-monitor worker needs to be spawned again. */
     healthWorkerSpawn = null;
@@ -226,17 +223,196 @@ export class OmnitronDaemon {
     healthWorkerStartupTimeout = 0;
     /** In-daemon check timer, armed only while the worker is down. */
     fallbackNodeCheckTimer = null;
-    /** Set by the shutdown task so nothing schedules work on the way out. */
+    /** Latched when shutdown begins, before any asynchronous cleanup. */
     isShuttingDown = false;
+    /** app.stop() owns its task pass; only app.shutdown() may be joined here. */
+    shutdownRequested = false;
+    startupAbort = new AbortController();
+    startupWork = null;
+    healthMonitorStartup = null;
     leaderElection = null;
+    clusterDb;
     configSyncService = null;
     metricsServer = null;
     metricsBridge = null;
+    metricSampling;
     dc = DEFAULT_DAEMON_CONFIG;
+    execution = null;
+    handingOffBackend = false;
+    preparingBackend = false;
+    backendAdmitted = true;
+    stopApplicationsOnExit = false;
+    backendControl = null;
+    recoveryMonitor = null;
+    supervision;
     /** Daemon config accessor for external use (e.g., DaemonRpcService) */
     get daemonConfig() { return this.dc; }
+    assertBackendReady() {
+        if (!this.backendAdmitted)
+            throw Errors.unavailable('Omnitron backend', 'The replacement is restoring its checkpoint; retry after readiness');
+    }
+    backendControlAddress() {
+        if (!this.backendControl)
+            throw new Error(this.backendRuntimeStatus().reason ?? 'Backend control is not ready');
+        return this.backendControl.socket;
+    }
+    backendRuntimeStatus() {
+        const owner = this.execution?.state();
+        return {
+            mode: this.execution ? 'resident' : 'coupled', handoffSupported: !!this.execution,
+            ...(!this.execution ? { reason: 'This daemon owns application forks and threads directly. Installing the resident owner requires one controlled application restart; hot adoption is unavailable.' } : {}),
+            ...(owner ?? {}),
+            ...(this.recoveryMonitor ? { recovery: this.recoveryMonitor.status() } : {}),
+            ...(this.supervision ? { supervision: this.supervision } : {}),
+            blockers: {
+                ...(this.kernelRollouts?.activeCount() ? { kernelRollouts: this.kernelRollouts.activeCount() } : {}),
+                terminalSessions: this.terminalRpcService?.activeSessionCount() ?? 0,
+                fileTransfers: (this.filesRpcService?.activeTransferCount() ?? 0) + (this.fileNode?.activeOperationCount() ?? 0),
+                pipelineRuns: this.pipelineService?.activeRunCount() ?? 0,
+                releaseBuilds: this.releaseService?.builds().filter(build => build.state === 'running').length ?? 0,
+                backupOperations: this.backupService?.activeOperationCount() ?? 0,
+            },
+        };
+    }
+    /** Expensive only for legacy independently supervised owners. Reuse a running
+     * verification for concurrent admissions, never a previous admission result. */
+    async attestApplicationOwner(expected) {
+        const client = this.execution;
+        const { owner, epoch } = expected ?? {};
+        if (!client || !owner || typeof owner.id !== 'string' || !owner.id || owner.id.length > 128 ||
+            !Number.isSafeInteger(owner.pid) || owner.pid < 1 || typeof owner.startedAt !== 'string' ||
+            owner.startedAt.length > 64 || !Number.isSafeInteger(epoch) || epoch < 1)
+            throw new Error('Invalid resident owner observation for admission');
+        const key = JSON.stringify([owner.id, owner.pid, owner.startedAt, epoch]);
+        if (this.ownerAdmissionProof) {
+            if (this.ownerAdmissionProof.key !== key)
+                throw new Error('Another owner is being checked. Refresh the target before admission.');
+            return this.ownerAdmissionProof.build;
+        }
+        const observe = async () => {
+            const snapshot = await client.recoverySnapshot();
+            const status = snapshot.status, live = client.state();
+            if (live?.phase !== 'active' || live.connection.status !== 'connected' || live.epoch !== epoch ||
+                live.owner.id !== owner.id || live.owner.pid !== owner.pid || live.owner.startedAt !== owner.startedAt ||
+                this.execution !== client || this.isShuttingDown || this.handingOffBackend || this.preparingBackend ||
+                status.phase !== 'active' || status.controller.controllerId !== client.controllerId || status.controller.epoch !== epoch ||
+                status.owner.id !== owner.id || status.owner.pid !== owner.pid || status.owner.startedAt !== owner.startedAt)
+                throw new Error('Application owner or controller changed during admission');
+            return snapshot;
+        };
+        const verify = async () => {
+            const before = await observe();
+            if (before.ownerBuild !== undefined) {
+                if (!before.ownerBuild || before.ownerBuild.dirty !== false)
+                    throw new Error('Execution owner did not report a clean build');
+                return before.ownerBuild;
+            }
+            if (!this.supervision)
+                throw new Error('This legacy owner requires independent OS supervision to attest its framework build');
+            const { attestManagedOwnerBuild } = await import('./managed-owner-build.js');
+            const build = await attestManagedOwnerBuild(OMNITRON_HOME, owner);
+            const after = await observe();
+            if (after.ownerBuild !== undefined && (after.ownerBuild?.commit !== build.commit || after.ownerBuild?.dirty !== false))
+                throw new Error('Execution owner reported a different build during native verification');
+            return build;
+        };
+        const build = verify();
+        this.ownerAdmissionProof = { key, build };
+        try {
+            return await build;
+        }
+        finally {
+            this.ownerAdmissionProof = undefined;
+        }
+    }
+    /** Called after the initiating RPC has returned, so it is not waiting for itself. */
+    async prepareBackendHandoff(candidateId) {
+        if (!this.execution || !this.app?.netron || !this.watchConfig)
+            throw new Error(this.backendRuntimeStatus().reason ?? 'Backend is not ready');
+        if (this.handingOffBackend || this.preparingBackend)
+            throw new Error('A backend handoff is already in progress');
+        const assertIdle = () => {
+            const blockers = this.backendRuntimeStatus().blockers;
+            const active = Object.entries(blockers).filter(([, count]) => count > 0);
+            if (active.length)
+                throw new Error(`Finish active work before replacing the backend: ${active.map(([name, count]) => `${name}=${count}`).join(', ')}`);
+        };
+        assertIdle();
+        this.preparingBackend = true;
+        await this.recoveryMonitor?.close(true);
+        this.recoveryMonitor = null;
+        const gate = this.app.netron.inbound;
+        let projects;
+        try {
+            this.backupService?.prepareHandoff();
+            projects = await this.app.container.resolveAsync(PROJECT_SERVICE_TOKEN);
+            const drained = await gate.drain(30_000);
+            if (!drained.drained)
+                throw new Error(`${drained.left} inbound request(s) have not drained; backend transfer was refused`);
+            assertIdle();
+            const projectState = await projects.prepareHandoff();
+            const infrastructure = await this.infraService?.prepareHandoff() ?? null;
+            if (this.metricSampling)
+                await withControlDeadline(this.metricSampling.pauseAndFlush(), 30_000, 'Metric collection has not drained to storage; the current backend will remain active');
+            const prepared = await withControlDeadline(this.execution.prepare(candidateId), 30_000, 'Execution mutations have not drained; the current backend will remain active');
+            return { protocol: 1, ticket: prepared.ticket, projects: projectState, infrastructure,
+                executionInventory: prepared.snapshot.inventoryDigest, watchConfig: this.watchConfig };
+        }
+        catch (error) {
+            await this.execution.abortCandidate(candidateId);
+            this.metricSampling?.resume();
+            projects?.resumeAfterHandoff();
+            await this.backupService?.resumeAfterHandoff();
+            this.infraService?.resumeAfterHandoff();
+            gate.reopen();
+            this.preparingBackend = false;
+            await (await this.initializeRecoveryMonitor())?.start();
+            throw error;
+        }
+    }
+    async abortBackendHandoff(state) {
+        if (!this.execution || !this.app || this.handingOffBackend)
+            throw new Error('The old backend can no longer resume; restore a controller through the resident owner');
+        await this.execution.abort(state.ticket);
+        this.metricSampling?.resume();
+        await this.backupService?.resumeAfterHandoff();
+        const projects = await this.app.container.resolveAsync(PROJECT_SERVICE_TOKEN);
+        projects.resumeAfterHandoff();
+        this.infraService?.resumeAfterHandoff();
+        this.app.netron?.inbound.reopen();
+        this.preparingBackend = false;
+        await (await this.initializeRecoveryMonitor())?.start();
+    }
+    async retireBackend() {
+        if (!this.execution || !this.app?.netron?.inbound.isDraining)
+            throw new Error('Backend must be drained with a resident owner before retirement');
+        this.handingOffBackend = true;
+        await this.app.stop({ timeout: 60_000 });
+    }
+    /** False means shutdown interrupted boot; callers must not announce readiness. */
     async start(config, options, daemonConfig) {
+        if (this.startupWork)
+            throw new Error('Daemon startup was already requested');
+        this.startupWork = this.startRuntime(config, options, daemonConfig);
+        try {
+            await this.startupWork;
+            return true;
+        }
+        catch (error) {
+            if (this.shutdownRequested) {
+                // Join Titan's existing shutdown after the raw startup work settles.
+                // The first shutdown task waits for that work, never this wrapper.
+                await this.app?.shutdown(ShutdownReason.Manual);
+            }
+            if (this.startupAbort.signal.aborted && error === this.startupAbort.signal.reason)
+                return false;
+            throw error;
+        }
+    }
+    async startRuntime(config, options, daemonConfig) {
+        this.backendAdmitted = !options?.backendHandoff;
         this.dc = daemonConfig ?? DEFAULT_DAEMON_CONFIG;
+        this.watchConfig = options?.backendHandoff?.watchConfig ?? config;
         const pidFile = expandPath(this.dc.pidFile);
         this.pidManager = new PidManager(pidFile);
         if (this.pidManager.isRunning()) {
@@ -249,12 +425,30 @@ export class OmnitronDaemon {
         // markers; live daemons get the conflict error above.
         this.pidManager.remove();
         this.pidManager.write();
+        await prepareDaemonDatabase(this.dc.role, {
+            noInfra: Boolean(options?.noInfra),
+            handoff: Boolean(options?.backendHandoff),
+        });
         // 1. Create Titan Application (the daemon itself)
-        const DaemonModule = createDaemonModule(config, this.dc);
+        if (this.dc.executionHost?.enabled) {
+            const connection = await connectExecutionOwner(config, this.dc, createNullLogger(), options?.backendHandoff?.ticket);
+            this.execution = connection.client;
+            this.supervision = connection.supervision;
+            await this.initializeRecoveryMonitor();
+        }
+        else if (options?.backendHandoff) {
+            throw new Error('Backend handoff requires the resident execution owner');
+        }
+        const DaemonModule = createDaemonModule(config, this.dc, this.execution?.orchestrator);
         this.app = await Application.create(DaemonModule, {
             name: 'omnitron',
             version: CLI_VERSION,
         });
+        const loggerModule = await this.app.container.resolveAsync(LOGGER_SERVICE_TOKEN);
+        const logger = loggerModule.logger;
+        // Install the complete cleanup contract BEFORE Titan installs signal
+        // handlers. A stop during boot must own every resource boot can create.
+        this.registerShutdownTasks(this.app, logger);
         // P1-M — install our own SIGHUP handler BEFORE Application's
         // default shutdown handlers attach, so `kill -HUP <daemon>`
         // triggers a config reload (the Unix convention for long-running
@@ -262,7 +456,9 @@ export class OmnitronDaemon {
         // this through the Application's signal manager because that
         // path is wired to `runShutdownTasks()`; we install at the
         // process level and the listener runs first.
-        process.on('SIGHUP', () => {
+        const reloadOnHup = () => {
+            if (this.isShuttingDown)
+                return;
             this.reloadConfigOnHup().catch((err) => {
                 // The message already carries which steps applied — printing only
                 // `.message` was fine for the load failure and misleading for the
@@ -273,47 +469,67 @@ export class OmnitronDaemon {
                     console.warn(`[omnitron]   caused by: ${cause.stack ?? String(cause)}`);
                 }
             });
-        });
+        };
+        process.on('SIGHUP', reloadOnHup);
+        this.app.registerCleanup(() => { process.off('SIGHUP', reloadOnHup); });
         // 2. Register transports (Unix, TCP, HTTP, WebSocket)
         await this.registerTransports(this.dc);
+        this.startupAbort.signal.throwIfAborted();
         // 3. Resolve and expose RPC services via Netron
         await this.exposeRpcServices(config, this.dc);
+        this.startupAbort.signal.throwIfAborted();
+        // Reconcile bookkeeping before any new public listener can admit a
+        // command. Adoption only reads native container identities; it never
+        // deploys an app or applies a new infrastructure declaration.
+        if (options?.backendHandoff) {
+            const projects = await this.app.container.resolveAsync(PROJECT_SERVICE_TOKEN);
+            await projects.adoptHandoff(options.backendHandoff.projects);
+            if (options.backendHandoff.infrastructure) {
+                const logging = await this.app.container.resolveAsync(LOGGER_SERVICE_TOKEN);
+                this.infraService = await InfrastructureService.adoptHandoff(logging.logger, options.backendHandoff.infrastructure);
+            }
+            this.startupAbort.signal.throwIfAborted();
+        }
         // 4. Start the Titan Application (boots DI, starts Netron, opens transports)
         await this.app.start();
-        const loggerModule = await this.app.container.resolveAsync(LOGGER_SERVICE_TOKEN);
-        const logger = loggerModule.logger;
+        this.startupAbort.signal.throwIfAborted();
+        this.execution?.setLogger(logger);
+        if (this.execution)
+            this.backendControl = await startBackendControl(this, this.execution.controllerId, logger);
+        this.startupAbort.signal.throwIfAborted();
+        runtimeDiagnostics.setLogger(logger);
         // As soon as there is somewhere to say it, so a stall in the boot's own
         // steps — infrastructure, migrations — is seen too. A node whose loop
         // stands still answers nothing, its heartbeat included, and until this
         // nothing on the node could say so. See `monitoring/event-loop-watch.ts`.
         this.eventLoopWatch = new EventLoopWatch(logger);
         this.eventLoopWatch.start();
-        logger.info({
-            socketPath: this.dc.socketPath,
-            port: this.dc.port,
-            httpPort: this.dc.httpPort,
-            wsPort: (this.dc.httpPort ?? 9800) + 2,
-            host: this.dc.host,
-            pid: process.pid,
-            version: CLI_VERSION,
-        }, 'Omnitron daemon started');
         // 5. Wire log persistence
         await this.wireLogPersistence();
+        this.startupAbort.signal.throwIfAborted();
         // 5.5. Check for crash recovery
-        await this.checkCrashRecovery(logger);
+        if (!this.execution)
+            await this.checkCrashRecovery(logger);
+        this.startupAbort.signal.throwIfAborted();
         // 6. Provision infrastructure (omnitron-pg + app infra from config.infrastructure)
-        await this.startInfrastructure(config, options, logger);
+        if (options?.backendHandoff) {
+            const gate = await this.app.container.resolveAsync(INFRASTRUCTURE_GATE_TOKEN);
+            gate.markReady(this.infraService?.getState() ?? { services: {}, ready: true });
+        }
+        else
+            await this.startInfrastructure(config, options, logger);
+        this.startupAbort.signal.throwIfAborted();
         // 7. Register custom health indicators (Docker + apps)
         await this.registerHealthIndicators();
+        this.startupAbort.signal.throwIfAborted();
         // 8. File watching (dev mode)
-        this.startFileWatcher(config, options, logger);
-        // 8.5. Wire daemon Netron to orchestrator for native topology routing
+        if (!options?.backendHandoff)
+            await this.startFileWatcher(config, options, logger);
+        this.startupAbort.signal.throwIfAborted();
+        // 8.5. Configure application-owned topology listeners for in-process ownership.
         {
             const orchestrator = await this.app.container.resolveAsync(ORCHESTRATOR_TOKEN);
-            if (this.app.netron) {
-                const socketPath = expandPath(this.dc.socketPath);
-                orchestrator.setDaemonNetron(this.app.netron, socketPath);
-            }
+            orchestrator.setTopologyDirectory(path.join(path.dirname(expandPath(this.dc.socketPath)), 'topology'));
             // 8.6. Wire metrics bridge + start /metrics HTTP endpoint.
             // Bridge subscribes to orchestrator events (restart/crash/escalation),
             // janitor sweeps, and esbuild reset/build hooks. The HTTP server
@@ -339,11 +555,12 @@ export class OmnitronDaemon {
                 logger.warn({ error: err.message }, 'metrics endpoint failed to start — /metrics will be unavailable');
             }
         }
+        this.startupAbort.signal.throwIfAborted();
         // 8.8. Start webapp (nginx container serving Console UI) if enabled
         {
-            const { readSavedDaemonConfig } = await import('../commands/up.js');
+            const { readSavedDaemonConfig } = await import('../config/saved.js');
             const savedConfig = readSavedDaemonConfig();
-            if (savedConfig?.webapp) {
+            if (savedConfig?.webapp && !options?.backendHandoff) {
                 try {
                     const { WebappService } = await import('../webapp/webapp.service.js');
                     // Publishing the console while the seeded password is still in
@@ -371,6 +588,7 @@ export class OmnitronDaemon {
                 }
             }
         }
+        this.startupAbort.signal.throwIfAborted();
         // 8.9. Fleet monitoring. Started BEFORE managed apps and not awaited.
         //
         // It used to be step 11.5, after `startApps`, `startScheduledTasks` and
@@ -386,36 +604,92 @@ export class OmnitronDaemon {
         // worker has a 30-second startup timeout, and the applications should not
         // wait behind it. The function handles and logs its own failures, and arms
         // the in-daemon fallback checks when the worker cannot run.
-        void this.startHealthMonitorWorker(logger).catch((err) => {
+        this.healthMonitorStartup = this.startHealthMonitorWorker(logger).catch((err) => {
             // It handles its own failures; this is the last resort, because an
             // unhandled rejection is a crash of the daemon rather than a lost
             // subsystem.
             logger.error({ error: err.message }, 'Health monitor startup threw');
         });
         // 9. Start managed apps (waits for infra gate if apps have `requires`)
-        await this.startApps(config, logger);
+        if (!options?.backendHandoff)
+            await this.startApps(config, logger);
+        this.startupAbort.signal.throwIfAborted();
         // 10. Start background tasks via titan-scheduler (replaces bare setInterval)
         await this.startScheduledTasks(config, logger);
+        this.startupAbort.signal.throwIfAborted();
         // 11. Start remaining background services (telemetry, traces, leader election)
         await this.startBackgroundServices(config, logger);
+        this.startupAbort.signal.throwIfAborted();
         // (Fleet monitoring is started at 8.5, above — before managed apps.)
         // 12. Wire event broadcasting (orchestrator events → WebSocket push)
         await this.wireEventBroadcasting(logger);
-        // 13. Register shutdown tasks — Application handles SIGTERM/SIGINT
-        // and calls shutdown tasks in priority order before process.exit()
-        this.registerShutdownTasks(this.app);
+        this.startupAbort.signal.throwIfAborted();
+        await this.execution?.activateObservations();
+        this.startupAbort.signal.throwIfAborted();
+        if (options?.backendHandoff) {
+            const projects = await this.app.container.resolveAsync(PROJECT_SERVICE_TOKEN);
+            this.startupAbort.signal.throwIfAborted();
+            projects.resumeAfterHandoff();
+            this.infraService?.resumeAfterHandoff();
+        }
+        await this.recoveryMonitor?.start();
+        this.startupAbort.signal.throwIfAborted();
+        this.backendAdmitted = true;
+        this.metricSampling?.resume();
+        logger.info({ socketPath: this.dc.socketPath, port: this.dc.port,
+            httpPort: this.dc.httpPort, wsPort: (this.dc.httpPort ?? 9800) + 2,
+            host: this.dc.host, pid: process.pid, version: CLI_VERSION }, 'Omnitron daemon started');
         // 15. Broadcast daemon.started event
         this.eventBroadcaster?.broadcast(DAEMON_EVENTS.STARTED, {
             version: CLI_VERSION,
             pid: process.pid,
         });
     }
+    async initializeRecoveryMonitor() {
+        if (!this.execution || this.recoveryMonitor)
+            return this.recoveryMonitor;
+        const directory = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+        // Source checkouts remain usable. Automatic recovery requires a sealed
+        // artifact, whose closure can be verified before another process runs it.
+        let artifact;
+        try {
+            artifact = await checkBackendCandidate(directory);
+        }
+        catch (error) {
+            runtimeDiagnostics.record({ id: 'execution.recovery-artifact', severity: 'warning',
+                title: 'Automatic backend recovery requires a verified runtime', evidence: [error instanceof Error ? error.message : String(error)],
+                remedy: 'Build and install a sealed backend runtime before enabling automatic controller recovery.' });
+            return null;
+        }
+        // A verified installation must invalidate its previous certificate before
+        // proceeding. A journal failure cannot silently disable this guard.
+        const { executionDirectory } = await import('./execution-launcher.js');
+        this.recoveryMonitor = new BackendRecoveryMonitor(executionDirectory(this.dc), artifact, this.dc, this.execution, () => {
+            if (!this.app || !this.watchConfig || this.preparingBackend || this.handingOffBackend)
+                throw new RecoveryBusyError('Backend ownership is not ready for recovery');
+            const blockers = Object.entries(this.backendRuntimeStatus().blockers).filter(([, count]) => count > 0);
+            if (blockers.length)
+                throw new RecoveryBusyError(`Active work has no automatic recovery checkpoint: ${blockers.map(([name, count]) => `${name}=${count}`).join(', ')}`);
+            return { watchConfig: this.watchConfig, projects: this.app.container.resolve(PROJECT_SERVICE_TOKEN), infrastructure: this.infraService };
+        });
+        runtimeDiagnostics.resolve('execution.recovery-artifact');
+        return this.recoveryMonitor;
+    }
     // ============================================================================
     // Transport Registration
     // ============================================================================
     async registerTransports(dc) {
         if (!this.app?.netron)
             return;
+        const isSlave = dc.role === 'slave';
+        const authService = !isSlave
+            ? await this.app.container.resolveAsync(AUTH_SERVICE_TOKEN)
+            : null;
+        // Slaves admit machine credentials only; they have no human login/session
+        // authority. Masters verify policy before registering any network ingress.
+        if (authService) {
+            await assertSafeNetworkPublication([fleetBindHostFor(dc), consoleBindHostFor(dc)], () => authService.isUsingSeededAdminPassword());
+        }
         // Unix socket — local CLI <-> daemon (primary, high-performance)
         this.app.netron.registerTransport('unix', () => new UnixSocketTransport());
         this.app.netron.registerTransportServer('unix', {
@@ -443,7 +717,7 @@ export class OmnitronDaemon {
                 // operator's deployment read exactly like the daemon's own boot
                 // autostart. No proxy stands in front of a unix socket, so the
                 // wrapper trusts no forwarded address — its default.
-                invocationWrapper: createAuthContextWrapper(),
+                invocationWrapper: createAuthContextWrapper({ assertReady: () => this.assertBackendReady() }),
             },
         });
         // Local CLI trust. The Unix socket above is created mode 0600, so any
@@ -481,74 +755,27 @@ export class OmnitronDaemon {
         // unauthenticated `stopAll({force:true})` — is answered by the default
         // being loopback and by that manager now being wired.)
         const tcpHost = fleetBindHostFor(dc);
-        if (!isLoopbackHost(tcpHost)) {
-            // Said, not enforced, and the difference is deliberate: silently
-            // rebinding a fleet transport to loopback would take a cluster down,
-            // and a node that cannot be reached is an outage rather than a
-            // hardening. The console above IS rebound, because its whole purpose
-            // is a password prompt and loopback still serves it.
-            void (async () => {
-                const loggerModule = await this.app.container.resolveAsync(LOGGER_SERVICE_TOKEN);
-                const log = loggerModule.logger;
-                if (await isSeededAdminPasswordInUse(this.app, log)) {
-                    log.error({ host: tcpHost, port: dc.port }, 'The daemon fleet transport is published and the seeded admin password is unchanged — ' +
-                        'anyone who can reach this port can sign in and stop every app. Change it now.');
-                }
-            })().catch(() => undefined);
-        }
         this.app.netron.registerTransport('tcp', () => new TcpTransport());
         this.app.netron.registerTransportServer('tcp', {
             name: 'daemon-fleet',
             options: {
                 port: dc.port,
                 host: tcpHost,
+                // Carry the authenticated mesh identity into service-level guards and audit.
+                invocationWrapper: createAuthContextWrapper({ assertReady: () => this.assertBackendReady() }),
             },
         });
         // Auth — JWT validation + session check + role extraction
-        const isSlave = dc.role === 'slave';
         const jwtService = await this.app.container.resolveAsync(JWT_SERVICE_TOKEN);
         const logModule = await this.app.container.resolveAsync(LOGGER_SERVICE_TOKEN);
         const authLogger = logModule.logger.child({ component: 'auth' });
-        // On master: full JWT + session validation via AuthService (PG-backed)
-        // On slave: JWT-only validation (no session DB — no PG)
-        const authService = !isSlave
-            ? await this.app.container.resolveAsync(AUTH_SERVICE_TOKEN)
-            : null;
         const authManager = new AuthenticationManager(authLogger, {
             authenticate: async () => {
                 throw new Error('Credential authentication not supported. Use JWT Bearer token.');
             },
-            validateToken: async (token) => {
-                // JWT verification with caching via titan-auth JWTService
-                const payload = await jwtService.verify(token);
-                // Session validation — master only (requires PG for omnitron_sessions)
-                if (authService) {
-                    const sessionId = payload['sid'];
-                    if (sessionId) {
-                        const session = await authService.validateToken(token);
-                        if (!session) {
-                            const err = new Error('Session has been revoked or expired');
-                            err.code = 'SESSION_REVOKED';
-                            err.statusCode = 401;
-                            throw err;
-                        }
-                    }
-                }
-                // Role is now in JWT claims (set by AuthService.issueToken)
-                const role = payload['role'] ?? 'viewer';
-                const sessionId = payload['sid'];
-                return {
-                    userId: payload.sub,
-                    roles: [role],
-                    permissions: [],
-                    token: { type: 'bearer' },
-                    metadata: {
-                        sessionId,
-                        isServiceRole: role === 'service_role',
-                    },
-                };
-            },
-            tokenCache: { enabled: true, ttl: 10_000 },
+            validateToken: createDaemonTokenValidator(token => jwtService.verify(token), authService),
+            // Signature verification may be cached; live account/session authority may not.
+            tokenCache: { enabled: false },
         });
         // Wire the AuthorizationManager so the `@Public({ auth: { roles } })`
         // decorators on DaemonRpcService are actually enforced on the wire.
@@ -564,8 +791,10 @@ export class OmnitronDaemon {
         // `trustProxy` is shared with the rate limiter deliberately: both answer
         // the same question — is there a proxy in front whose forwarded headers
         // we may believe? Two separate switches would eventually disagree.
+        const policy = dc.requestRateLimit ?? dc.httpRateLimit ?? {};
         const authContextWrapper = createAuthContextWrapper({
-            trustProxy: dc.httpRateLimit?.trustProxy === true,
+            trustProxy: policy.trustProxy === true,
+            assertReady: () => this.assertBackendReady(),
         });
         // HTTP / WS bind also defaults to 127.0.0.1. The webapp talks to
         // these over the same loopback; nginx fronts the public surface.
@@ -579,8 +808,7 @@ export class OmnitronDaemon {
         // same value then published the Netron HTTP RPC and the WebSocket
         // alongside it. A slave serves no console: the operator uses the
         // master's. So the two surfaces it gained are an authentication endpoint
-        // it does not need and a WebSocket one that, as the note below records,
-        // has no rate limit available to it.
+        // and a WebSocket endpoint it does not need.
         //
         // Rebound rather than warned about, which is the opposite of the choice
         // made for the TCP transport twenty lines up — and for the opposite
@@ -597,7 +825,12 @@ export class OmnitronDaemon {
         const internalHttpPort = (dc.httpPort ?? 9800) + 1;
         this.rpcHttpPort = internalHttpPort;
         this.app.netron.registerTransport('http', () => new HttpTransport());
-        const rl = dc.httpRateLimit ?? {};
+        const requestLimiter = new TransportRequestLimiter({
+            ...policy,
+            enabled: policy.enabled ?? true,
+            maxRequests: policy.maxRequests ?? 3_000,
+            globalMaxRequests: policy.globalMaxRequests ?? 6_000,
+        });
         this.app.netron.registerTransportServer('http', {
             name: 'daemon-http',
             options: {
@@ -605,24 +838,7 @@ export class OmnitronDaemon {
                 host: localHost,
                 cors: true,
                 invocationWrapper: authContextWrapper,
-                // Volume cap on the HTTP RPC surface, and only that one. Password
-                // guessing is bounded by the per-account lockout in AuthService.
-                //
-                // The WebSocket surface below is NOT covered: netron's WebSocket
-                // transport has no rate-limit option — `maxPayload` is the only
-                // bound it accepts — and the console talks over WebSocket. This
-                // comment used to say the limit bounded "everything else, including
-                // attempts to flood the daemon into unresponsiveness", which
-                // describes a protection that covers one of the two transports an
-                // attacker can reach.
-                rateLimit: {
-                    enabled: rl.enabled ?? true,
-                    windowMs: rl.windowMs ?? 60_000,
-                    maxRequests: rl.maxRequests ?? 3_000,
-                    globalMaxRequests: rl.globalMaxRequests ?? 6_000,
-                    trustProxy: rl.trustProxy ?? false,
-                    ...(rl.whitelist ? { whitelist: rl.whitelist } : {}),
-                },
+                requestLimiter,
             },
         });
         // WebSocket — real-time event push to webapp clients
@@ -638,11 +854,7 @@ export class OmnitronDaemon {
                 // HTTP calls do. Until recently only the HTTP server read this
                 // option and this line did nothing.
                 invocationWrapper: authContextWrapper,
-                // The only bound this transport accepts. Left unset it inherits
-                // `ws`'s 100 MB default, which is a lot of memory to hand a single
-                // frame on a control-plane socket that carries RPC arguments and
-                // event pushes. 8 MB is well above anything the console sends and
-                // well below anything worth allocating for a stranger.
+                requestLimiter,
                 maxPayload: dc.wsMaxPayload ?? 8 * 1024 * 1024,
             },
         });
@@ -667,8 +879,10 @@ export class OmnitronDaemon {
         // and the number comes from the config rather than a default chosen
         // inside the collector, because a wrong default there deletes history.
         logCollector.setRetentionDays(config.logging?.databaseRetentionDays ?? 0, loggerModule.logger.child({ component: 'log-retention' }));
-        const rpcService = new DaemonRpcService(orchestrator, titanHealth, logManager, config, this);
+        const projectService = await container.resolveAsync(PROJECT_SERVICE_TOKEN);
+        const rpcService = new DaemonRpcService(orchestrator, titanHealth, logManager, config, this, () => projectService.assertInfrastructureMutable());
         await this.app.netron.peer.exposeService(rpcService);
+        await this.app.netron.peer.exposeService(new BackendRpcService(this));
         // Logs RPC service (works on both master and slave — uses PG or SQLite)
         const logsRpcService = new LogsRpcService(logCollector);
         await this.app.netron.peer.exposeService(logsRpcService);
@@ -677,7 +891,7 @@ export class OmnitronDaemon {
         rpcService.setLogStore(logCollector);
         // Metrics RPC service — provided by TitanMetricsModule
         const metricsService = await container.resolveAsync(TITAN_METRICS_TOKEN);
-        const { MetricsRpcService: MetricsRpc } = await import('@omnitron-dev/titan-metrics');
+        const { OmnitronMetricsRpcService: MetricsRpc } = await import('../services/metrics.rpc-service.js');
         const metricsRpcService = new MetricsRpc(metricsService);
         await this.app.netron.peer.exposeService(metricsRpcService);
         // HealthCheck RPC service (no DB dependency)
@@ -717,6 +931,7 @@ export class OmnitronDaemon {
         // Backup RPC service (no DB dependency)
         const { BackupRpcService: BackupRpc } = await import('../services/backup.rpc-service.js');
         const backupService = await container.resolveAsync(BACKUP_SERVICE_TOKEN);
+        this.backupService = backupService;
         const backupRpcService = new BackupRpc(backupService);
         await this.app.netron.peer.exposeService(backupRpcService);
         // Re-arm any persisted backup schedules so they survive daemon restarts.
@@ -759,11 +974,34 @@ export class OmnitronDaemon {
         // The logger, because the one thing this service says on its own — that
         // a deployment is running on a default credential — is said at error
         // level and reaches nobody without it.
-        loggerModule.logger.child({ component: 'infra' }));
-        await this.app.netron.peer.exposeService(infraRpcService);
+        loggerModule.logger.child({ component: 'infra' }), undefined, () => projectService.getInfraManager().listInstances().flatMap(({ infra }) => Object.values(infra.getState().services)));
         // Project + Stack management RPC service
-        const projectService = await container.resolveAsync(PROJECT_SERVICE_TOKEN);
+        const stateStore = await container.resolveAsync(DAEMON_STATE_STORE_TOKEN);
+        const { clusterDatabaseUrl, clusterEnrollment } = await import('../cluster/enrollment.js');
+        const connectionString = dc.cluster?.enabled
+            ? clusterDatabaseUrl((await import('../shared/env-config.js')).getEnv().OMNITRON_CLUSTER_DATABASE_URL) : undefined;
+        const audience = clusterEnrollment(dc.cluster, stateStore);
+        if (audience && connectionString) {
+            const { createOmnitronDb } = await import('../database/connection.js');
+            const { PostgresLeaseStore } = await import('@omnitron-dev/titan-database/coordination');
+            const { StopRecipient } = await import('../cluster/stop-authority.js');
+            this.clusterDb = await createOmnitronDb({ connectionString, max: 2, connectionTimeoutMillis: 2500, statement_timeout: 5000 });
+            const leases = new PostgresLeaseStore(this.clusterDb);
+            if (!isSlave) {
+                const { LeaderElection } = await import('../cluster/leader-election.js');
+                const fleet = await container.resolveAsync(FLEET_SERVICE_TOKEN);
+                this.leaderElection = new LeaderElection(audience.nodeId, fleet, loggerModule.logger, leases, {
+                    clusterId: audience.clusterId,
+                    ...(dc.cluster?.leaseTtlMs != null && { leaseTtlMs: dc.cluster.leaseTtlMs }),
+                    ...(dc.cluster?.heartbeatInterval != null && { heartbeatInterval: dc.cluster.heartbeatInterval }),
+                });
+            }
+            projectService.setClusterStop(new StopRecipient(audience, leases, stateStore), this.leaderElection ?? undefined);
+        }
         const projectRpcService = new ProjectRpcService(projectService, audit);
+        projectService.setHostedInfrastructure(() => this.infraService ?? undefined, scope => infraRpcService.drainStackProvisioning(scope));
+        infraRpcService.setStackOperationGate(scope => projectService.assertInfrastructureMutable(scope));
+        await this.app.netron.peer.exposeService(infraRpcService);
         await this.app.netron.peer.exposeService(projectRpcService);
         // Releases. Master-only, like the builds themselves: a release is built
         // from clean clones of BOTH repositories, and only a master has both.
@@ -771,42 +1009,19 @@ export class OmnitronDaemon {
             const { ReleaseService } = await import('../services/release.service.js');
             const { ReleaseRpcService } = await import('../services/release.rpc-service.js');
             this.releaseService = new ReleaseService(loggerModule.logger.child({ component: 'release' }));
-            await this.app.netron.peer.exposeService(new ReleaseRpcService(this.releaseService, audit, projectService));
+            const releaseAuth = await container.resolveAsync(AUTH_SERVICE_TOKEN);
+            await this.app.netron.peer.exposeService(new ReleaseRpcService(this.releaseService, audit, projectService, releaseAuth));
         }
-        // Sync service (slave→master data replication)
-        const syncNodeId = `${os.hostname()}-${dc.port}`;
-        let syncDb;
-        if (isSlave) {
-            const slaveStorage = await container.resolveAsync(SLAVE_STORAGE_TOKEN);
-            syncDb = await slaveStorage.getDb();
-        }
-        else {
-            syncDb = await container.resolveAsync(OMNITRON_DB_TOKEN);
-        }
-        this.syncService = new SyncService(syncDb, loggerModule.logger.child({ component: 'sync' }), syncNodeId, dc.role, dc.sync);
-        // Remote metrics into the store the console actually reads.
-        //
-        // `ingestMetric` wrote them to `metrics_raw`, and nothing in this
-        // repository reads that table — the metrics page queries titan-metrics'
-        // own storage. So once the pipeline carried anything, it would have
-        // carried it somewhere invisible. Recording through the same service the
-        // master uses for its own readings makes a remote node a LABEL on the
-        // existing series instead of a second store of the same concept.
-        //
-        // `node` is a distinct argument in the sink's signature rather than a
-        // key a caller may forget to put in `labels`: a sample recorded without
-        // it merges with the master's own, and the chart then shows two machines
-        // summed under one name.
+        // One service owns both the SQLite outbox writer and the replication transport.
+        this.syncService = await container.resolveAsync(SYNC_SERVICE_TOKEN);
+        // The database is the history read by Console. Exposition is updated only after commit.
         if (!isSlave) {
             const syncMetrics = await container.resolveAsync(TITAN_METRICS_TOKEN);
-            this.syncService.setMetricsSink((sample) => {
-                try {
-                    syncMetrics.recordTyped('gauge', sample.name, { ...sample.labels, app: sample.app, node: sample.node }, sample.value);
-                }
-                catch (err) {
-                    loggerModule.logger.warn({ node: sample.node, name: sample.name, error: err.message }, 'Failed to record a replicated metric');
-                }
-            });
+            const storage = await container.resolveAsync(METRICS_STORAGE_TOKEN);
+            if (!(storage instanceof PostgresMetricsStorage))
+                throw new Error('Master replication requires PostgreSQL metrics storage');
+            this.syncService.setMetricsStorage(storage, parseMaxAge(config.monitoring.metrics.historyMaxAge ?? '7d'));
+            this.syncService.setMetricsRegistry(syncMetrics.getRegistry());
         }
         // The producer the replication pipeline never had.
         //
@@ -821,15 +1036,7 @@ export class OmnitronDaemon {
         // has no master to ship to, and doing the work would be pure cost.
         if (isSlave) {
             const syncService = this.syncService;
-            logCollector.setSyncSink((entries) => {
-                void syncService
-                    .bufferBatch(entries.map((e) => ({ category: 'logs', payload: e })))
-                    .catch(() => {
-                    // `bufferBatch` logs its own failure. Swallowed here because the
-                    // lines are already in the local table: losing the replica copy
-                    // must not cost the flush that succeeded.
-                });
-            });
+            logCollector.setSyncSink((entries, transaction) => syncService.bufferBatch(entries.map(entry => ({ category: 'logs', payload: entry })), transaction));
         }
         const syncRpcService = new SyncRpcService(this.syncService);
         await this.app.netron.peer.exposeService(syncRpcService);
@@ -839,18 +1046,24 @@ export class OmnitronDaemon {
         await this.app.netron.peer.exposeService(systemInfoRpcService);
         // Event Broadcaster RPC service (WebSocket subscriptions)
         this.eventBroadcaster = new EventBroadcasterService(loggerModule.logger);
-        const eventBroadcasterRpcService = new EventBroadcasterRpcService(this.eventBroadcaster, this.app.netron);
+        const eventBroadcasterRpcService = new EventBroadcasterRpcService(this.eventBroadcaster, this.app.netron, createDaemonPrincipalValidator(isSlave ? null : await container.resolveAsync(AUTH_SERVICE_TOKEN)));
         await this.app.netron.peer.exposeService(eventBroadcasterRpcService);
         // Node manager — file-based, no PG (master only — manages infrastructure nodes)
         // Health checks delegated to dedicated system worker (started later after infra is ready)
         if (!isSlave) {
             const { NodeManagerService } = await import('../services/node-manager.service.js');
             const { NodeManagerRpcService } = await import('../services/node-manager.rpc-service.js');
-            const { DaemonStateStore: DaemonStateStoreCls } = await import('./daemon-state-store.service.js');
             const daemonStateStore = await container.resolveAsync(DAEMON_STATE_STORE_TOKEN);
             const nodeManager = new NodeManagerService(loggerModule.logger.child({ component: 'nodes' }), daemonStateStore, secretsService);
             this.nodeManagerService = nodeManager;
-            const nodeManagerRpcService = new NodeManagerRpcService(nodeManager, audit);
+            const nodeAuth = await container.resolveAsync(AUTH_SERVICE_TOKEN);
+            if (audit) {
+                const { TerminalRpcService } = await import('../services/terminal.rpc-service.js');
+                this.terminalRpcService = new TerminalRpcService(nodeManager, nodeAuth, daemonStateStore, audit, dc.terminal);
+                await this.app.netron.peer.exposeService(this.terminalRpcService);
+            }
+            const nodeManagerRpcService = new NodeManagerRpcService(nodeManager, audit, () => systemInfoService.getSnapshot({ fresh: true }), nodeAuth);
+            nodeManagerRpcService.setLocalDaemon(rpcService);
             // The deployer reaches nodes through the same SSH implementation as the
             // health checks — the only one that can present a stored password or a
             // key passphrase.
@@ -860,6 +1073,21 @@ export class OmnitronDaemon {
                 const deployLogger = loggerModule.logger.child({ component: 'deploy' });
                 const remoteDeployer = new RemoteDeployer(deployLogger, new ExecutionService(deployLogger));
                 nodeManagerRpcService.setRemoteDeployer(remoteDeployer);
+                const { KernelRolloutService } = await import('../services/kernel-rollout.service.js');
+                this.kernelRollouts = new KernelRolloutService(daemonStateStore, nodeManager, remoteDeployer, error => deployLogger.error({ error }, 'Kernel rollout journal needs reconciliation'), () => {
+                    if (this.dc.cluster?.enabled)
+                        throw new Error('Managed kernel rollout requires a standalone controller. Elected controllers lack a shared cross-node dispatch fence.');
+                    if (this.isShuttingDown || this.preparingBackend || this.handingOffBackend)
+                        throw new Error('Controller handoff or shutdown is in progress');
+                }, () => {
+                    if (!this.execution)
+                        return null; // A coupled controller cannot be an independently owned target.
+                    const local = this.execution.state();
+                    if (!local?.owner?.id || local.connection.status !== 'connected' || local.phase !== 'active')
+                        throw new Error('Cannot exclude the initiating controller: its resident owner is unconfirmed');
+                    return local.owner.id;
+                });
+                nodeManagerRpcService.setKernelRolloutService(this.kernelRollouts);
                 // Upgrading a node from the console: the same build the CLI makes,
                 // made here, then the same two calls. Without this the console could
                 // see every node and update none of them.
@@ -917,19 +1145,20 @@ export class OmnitronDaemon {
             // master, or two connectors pull the same buffer and race to ack it.
             try {
                 const { SlaveConnector } = await import('../cluster/slave-connector.js');
-                const { createMeshDialer } = await import('../cluster/mesh-link.js');
+                const { createMeshDialer, meshRegistration } = await import('../cluster/mesh-link.js');
                 const { startMesh } = await import('../cluster/mesh.js');
                 const { ExecutionService: Exec } = await import('../execution/execution.service.js');
                 const meshLogger = loggerModule.logger.child({ component: 'mesh' });
+                const registeredSshTarget = async (host, port, nodeId) => {
+                    const node = meshRegistration(nodeManager.listNodes(), { host, port, ...(nodeId !== undefined && { nodeId }) });
+                    return node ? nodeManager.nodeToSshTarget(node) : null;
+                };
                 const connector = new SlaveConnector(meshLogger, this.syncService ?? null, {
                     dial: createMeshDialer({
                         logger: meshLogger,
                         execution: new Exec(meshLogger),
                         subject: `mesh:${os.hostname()}`,
-                        sshTargetFor: async ({ host }) => {
-                            const node = nodeManager.listNodes().find((n) => n.host === host && !n.isLocal);
-                            return node ? nodeManager.nodeToSshTarget(node) : null;
-                        },
+                        sshTargetFor: ({ host, port, nodeId }) => registeredSshTarget(host, port, nodeId),
                     }),
                 });
                 this.slaveConnector = connector;
@@ -941,10 +1170,7 @@ export class OmnitronDaemon {
                 // Wired here because this is the side that has both — ProjectService
                 // reads config files, the node registry keeps its secrets in the
                 // daemon's vault.
-                projectService.setNodeCredentialResolver(async (host) => {
-                    const node = nodeManager.listNodes().find((n) => n.host === host && !n.isLocal);
-                    return node ? nodeManager.nodeToSshTarget(node) : null;
-                });
+                projectService.setNodeCredentialResolver(registeredSshTarget);
                 this.meshHandle = startMesh({ registry: nodeManager, connector, logger: meshLogger });
             }
             catch (err) {
@@ -954,27 +1180,50 @@ export class OmnitronDaemon {
                 loggerModule.logger.error({ error: err.message }, 'Mesh not started — registered nodes will buffer their data locally and replicate nothing');
             }
         }
+        // File protocol uses the existing authenticated Netron mesh on every node.
+        const { FileNode } = await import('../files/file-node.js');
+        const { configuredFileRoots } = await import('../files/file-config.js');
+        const { FileNodeRpcService } = await import('../files/file-node.rpc-service.js');
+        const fileState = await container.resolveAsync(DAEMON_STATE_STORE_TOKEN);
+        const fileNode = this.fileNode = new FileNode(configuredFileRoots(dc.files), fileState);
+        await this.app.netron.peer.exposeService(new FileNodeRpcService(fileNode));
+        // Every node answers the same diagnostic contract. Workers use the durable
+        // Sync outbox; absence of the controller's local relay is not a broken RPC.
+        const { TelemetryRpcService: TelemetryRpc } = await import('../services/telemetry.rpc-service.js');
+        const telemetryRpcService = new TelemetryRpc(isSlave ? null
+            : await container.resolveAsync(TELEMETRY_RELAY_TOKEN));
+        this.nodeManagerRpcService?.setTelemetryRelay(telemetryRpcService);
+        await this.app.netron.peer.exposeService(telemetryRpcService);
         // =====================================================================
         // Master-only RPC services (require PostgreSQL)
         // =====================================================================
         if (!isSlave) {
             // Auth RPC service
             const authService = await container.resolveAsync(AUTH_SERVICE_TOKEN);
-            const authRpcService = new AuthRpcService(authService);
+            const authRpcService = new AuthRpcService(authService, this.app.netron);
             await this.app.netron.peer.exposeService(authRpcService);
+            if (audit) {
+                const { AccessRpcService } = await import('../services/access.rpc-service.js');
+                const accessDb = await container.resolveAsync(OMNITRON_DB_TOKEN);
+                await this.app.netron.peer.exposeService(new AccessRpcService(accessDb, authService, audit, this.app.netron));
+                const { FilesRpcService } = await import('../files/files.rpc-service.js');
+                this.filesRpcService = new FilesRpcService(fileNode, async (nodeId, actor, request) => {
+                    const node = this.nodeManagerService?.getNode(nodeId);
+                    if (!node)
+                        throw new Error('Unknown file node');
+                    if (node.isLocal)
+                        return fileNode.invoke(actor, request);
+                    if (!this.slaveConnector)
+                        throw new Error('File node is not connected to the mesh');
+                    return this.slaveConnector.invokeOnSlave(node.host, node.daemonPort, 'OmnitronFileNode', 'invoke', [{ actor, request }]);
+                }, authService, audit, fileState);
+                await this.app.netron.peer.exposeService(this.filesRpcService);
+            }
             // Alert RPC service
             const { AlertRpcService: AlertRpc } = await import('../services/alert.rpc-service.js');
             const alertService = await container.resolveAsync(ALERT_SERVICE_TOKEN);
             const alertRpcService = new AlertRpc(alertService);
             await this.app.netron.peer.exposeService(alertRpcService);
-            // Telemetry relay RPC service
-            const { TelemetryRpcService: TelemetryRpc } = await import('../services/telemetry.rpc-service.js');
-            const telemetryRelay = await container.resolveAsync(TELEMETRY_RELAY_TOKEN);
-            const telemetryRpcService = new TelemetryRpc(telemetryRelay);
-            // The console asks every node for its relay, and a daemon has no mesh
-            // connection to itself, so the local node's answer comes from here.
-            this.nodeManagerRpcService?.setTelemetryRelay(telemetryRelay);
-            await this.app.netron.peer.exposeService(telemetryRpcService);
             // Fleet management RPC service
             const { FleetRpcService: FleetRpc } = await import('../services/fleet.rpc-service.js');
             const fleetService = await container.resolveAsync(FLEET_SERVICE_TOKEN);
@@ -988,7 +1237,12 @@ export class OmnitronDaemon {
             // Pipeline RPC service
             const { PipelineRpcService: PipelineRpc } = await import('../services/pipeline.rpc-service.js');
             const pipelineService = await container.resolveAsync(PIPELINE_SERVICE_TOKEN);
-            const pipelineRpcService = new PipelineRpc(pipelineService);
+            if (!audit || !this.nodeManagerService)
+                throw new Error('Pipeline execution requires audit and node services');
+            pipelineService.configure(this.nodeManagerService, (status, duration) => this.metricsBridge?.recordPipelineRun(status, duration));
+            await pipelineService.initialize();
+            this.pipelineService = pipelineService;
+            const pipelineRpcService = new PipelineRpc(pipelineService, authService, audit);
             await this.app.netron.peer.exposeService(pipelineRpcService);
             // Trace collector RPC service
             const { TraceRpcService: TraceRpc } = await import('../services/trace-collector.rpc-service.js');
@@ -1001,22 +1255,10 @@ export class OmnitronDaemon {
             const deployRpcService = new DeployRpc(deployService);
             await this.app.netron.peer.exposeService(deployRpcService);
         }
-        // Cluster — leader election + config sync (optional, enabled via config, master only)
-        // LeaderElection is created here once and stored; startBackgroundServices() starts it.
-        if (dc.cluster?.enabled && !isSlave) {
-            const { LeaderElection } = await import('../cluster/leader-election.js');
-            const { ClusterRpcService: ClusterRpc } = await import('../cluster/cluster.rpc-service.js');
-            const nodeId = `${os.hostname()}-${dc.port}`;
-            const clusterFleetService = await container.resolveAsync(FLEET_SERVICE_TOKEN);
-            this.leaderElection = new LeaderElection(nodeId, clusterFleetService, loggerModule.logger, {
-                ...(dc.cluster.electionTimeout && { electionTimeout: dc.cluster.electionTimeout }),
-                ...(dc.cluster.heartbeatInterval != null && { heartbeatInterval: dc.cluster.heartbeatInterval }),
-            });
-            const clusterRpcService = new ClusterRpc(this.leaderElection);
-            // The local node's own election state, for the cross-node reader.
-            this.nodeManagerRpcService?.setLeaderElection(this.leaderElection);
-            await this.app.netron.peer.exposeService(clusterRpcService);
-        }
+        const { ClusterRpcService } = await import('../cluster/cluster.rpc-service.js');
+        const clusterReader = new ClusterRpcService(this.leaderElection, audience);
+        this.nodeManagerRpcService?.setClusterReader(clusterReader);
+        await this.app.netron.peer.exposeService(clusterReader);
     }
     // ============================================================================
     // Log Persistence Wiring
@@ -1027,10 +1269,20 @@ export class OmnitronDaemon {
         const orchestrator = await this.app.container.resolveAsync(ORCHESTRATOR_TOKEN);
         const logManager = await this.app.container.resolveAsync(LOG_MANAGER_TOKEN);
         const logCollector = await this.app.container.resolveAsync(LOG_COLLECTOR_TOKEN);
-        orchestrator.onAppLog((appName, line) => {
-            logManager.appendToFile(appName, line);
-            logCollector.ingestPinoLine(appName, line);
-        });
+        if (this.execution) {
+            this.execution.setLogCollector(logCollector);
+            orchestrator.onAppLog((appName, line, context) => logCollector.ingestPinoLine(appName, line, context));
+        }
+        else {
+            logCollector.setCaptureStatus('local');
+            if (logManager.journal) {
+                logCollector.setSourceJournal(logManager.journal);
+                logCollector.setSourceStats(() => logManager.journalStats());
+            }
+            else
+                logManager.onRecord((appName, record) => logCollector.ingestRecord(appName, record));
+            orchestrator.onAppLog((appName, line, context) => logManager.appendToFile(appName, line, context));
+        }
         // Wire daemon's own logs into LogCollector (buffered since pino starts before DI)
         const collectorStream = getDaemonLogCollectorStream();
         if (collectorStream) {
@@ -1079,40 +1331,6 @@ export class OmnitronDaemon {
         }
         const isSlave = this.dc.role === 'slave';
         const startTime = Date.now();
-        // Step 1: Provision omnitron's own database (omnitron-pg)
-        // Slave daemons use SQLite — no Docker, no PostgreSQL
-        if (isSlave) {
-            logger.info({ role: 'slave' }, 'Slave mode — skipping omnitron-pg provisioning (using SQLite)');
-        }
-        else {
-            try {
-                const { resolveOmnitronPg } = await import('../infrastructure/service-resolver.js');
-                const { createContainer, getContainerState, waitForHealthy, ensureImage, removeContainer, createVolume } = await import('../infrastructure/container-runtime.js');
-                const pgSpec = resolveOmnitronPg();
-                const existing = await getContainerState(pgSpec.name);
-                if (!existing || existing.status !== 'running') {
-                    logger.info('Provisioning omnitron-pg...');
-                    if (existing)
-                        await removeContainer(pgSpec.name);
-                    await ensureImage(pgSpec.image);
-                    for (const vol of pgSpec.volumes) {
-                        if (!vol.source.startsWith('/'))
-                            await createVolume(vol.source);
-                    }
-                    await createContainer(pgSpec);
-                    await waitForHealthy(pgSpec.name, 60_000);
-                    logger.info('omnitron-pg ready');
-                }
-                else {
-                    logger.debug('omnitron-pg already running');
-                }
-                await this.runOmnitronMigrations(logger);
-            }
-            catch (err) {
-                logger.error({ error: err.message }, 'Failed to provision omnitron-pg');
-                logger.warn('Continuing without internal database — some features will be unavailable');
-            }
-        }
         // Step 2: Provision app infrastructure (postgres, redis, minio) if declared.
         //
         // Two ownership models share this slot historically:
@@ -1136,8 +1354,13 @@ export class OmnitronDaemon {
         // `infrastructure.services` is informational in this mode (used by
         // stack auto-detection upstream); the daemon does not provision it
         // again here.
+        if (this.dc.cluster?.enabled) {
+            logger.info('Cluster enrollment defers application infrastructure provisioning to the elected controller');
+            gate.markReady({ services: {}, ready: true });
+            return;
+        }
         const { ProjectRegistry } = await import('../project/registry.js');
-        const projects = ProjectRegistry.open().list();
+        const projects = ProjectRegistry.open().listRegistrations();
         const projectModeActive = projects.some((p) => Array.isArray(p.enabledStacks) && p.enabledStacks.length > 0);
         if (projectModeActive) {
             logger.info({ projects: projects.length }, 'project mode active — daemon-level infrastructure deferred to stack provision');
@@ -1146,7 +1369,9 @@ export class OmnitronDaemon {
         }
         if (config.infrastructure && !isSlave) {
             try {
-                this.infraService = new InfrastructureService(logger, config.infrastructure);
+                // The control-plane database was prepared before DI. This allocator
+                // owns application services only, including when PostgreSQL is external.
+                this.infraService = new InfrastructureService(logger, config.infrastructure, undefined, undefined, undefined, false);
                 const infraState = await this.infraService.provision();
                 const provisionTimeMs = Date.now() - startTime;
                 gate.markReady(infraState);
@@ -1197,7 +1422,7 @@ export class OmnitronDaemon {
     async reconcileOrphanContainers(logger, projects, projectService) {
         const { listManagedContainers, stopContainer, removeContainer } = await import('../infrastructure/container-runtime.js');
         const { decideOrphans } = await import('../infrastructure/orphan-containers.js');
-        const managed = await listManagedContainers();
+        const managed = await listManagedContainers({ orThrow: true });
         if (managed.length === 0)
             return;
         // Build set of expected container name prefixes from registered projects/stacks
@@ -1247,6 +1472,7 @@ export class OmnitronDaemon {
                 status: c.status,
                 project: c.project,
                 stack: c.stack,
+                internal: c.labels?.['omnitron.internal'] === 'true',
             })),
             projects: projects.map((p) => p.name),
             expectedPrefixes: [...expectedPrefixes],
@@ -1262,9 +1488,11 @@ export class OmnitronDaemon {
             const container = managed.find((c) => c.name === name);
             logger.info({ container: container.name, status: container.status }, 'Removing orphan container (not part of any registered stack)');
             try {
+                if (!container.containerId || !/^[a-f0-9]{64}$/.test(container.containerId))
+                    throw new Error('Orphan has no immutable identity');
                 if (container.status === 'running')
-                    await stopContainer(container.name);
-                await removeContainer(container.name);
+                    await stopContainer(container.containerId);
+                await removeContainer(container.containerId, { graceful: true });
                 orphanCount++;
             }
             catch (err) {
@@ -1275,25 +1503,6 @@ export class OmnitronDaemon {
             logger.info({ removed: orphanCount }, 'Orphan container cleanup complete');
         }
     }
-    /**
-     * Apply the internal-database schema.
-     *
-     * Delegates to the shared runner (`database/migration-runner.ts`) so this
-     * path, the infrastructure service and the `migrate` CLI all execute the
-     * same registry through the same engine. A failure here is logged as an
-     * ERROR — the daemon keeps running, but every feature backed by
-     * omnitron-pg (alerts, sessions, logs, metrics, deployments) is degraded
-     * and the operator has to see it.
-     */
-    async runOmnitronMigrations(logger) {
-        const { runOmnitronMigrations } = await import('../database/migration-runner.js');
-        try {
-            await runOmnitronMigrations(logger);
-        }
-        catch (err) {
-            logger.error({ error: err.message }, 'Omnitron database migrations FAILED — alerts, sessions, logs and metrics will not work until this is resolved');
-        }
-    }
     // ============================================================================
     // Health Indicators (Phase 2: titan-health custom indicators)
     // ============================================================================
@@ -1304,9 +1513,16 @@ export class OmnitronDaemon {
             const titanHealth = await this.app.container.resolveAsync(TITAN_HEALTH_TOKEN);
             const orchestrator = await this.app.container.resolveAsync(ORCHESTRATOR_TOKEN);
             // Docker containers health indicator
-            titanHealth.registerIndicator(new DockerHealthIndicator(() => this.infraService));
+            titanHealth.registerIndicator(runtimeDiagnostics);
+            const { LogSinkHealthIndicator } = await import('../monitoring/log-sink-health.indicator.js');
+            titanHealth.registerIndicator(new LogSinkHealthIndicator(await this.app.container.resolveAsync(LOGGER_SERVICE_TOKEN)));
+            await orchestrator.configureReadiness(this.dc.applicationReadiness ?? {});
+            const projects = await this.app.container.resolveAsync(PROJECT_SERVICE_TOKEN);
+            titanHealth.registerIndicator(new DockerHealthIndicator(() => this.infraService, undefined, () => projects.getInfrastructureHealthContext()));
             // Managed apps health indicator
             titanHealth.registerIndicator(new AppHealthIndicator(orchestrator));
+            const { MetricsStorageIndicator } = await import('../monitoring/metrics-storage.indicator.js');
+            titanHealth.registerIndicator(new MetricsStorageIndicator(await this.app.container.resolveAsync(TITAN_METRICS_TOKEN)));
             // How long the loop has stood still, and when — the number the console
             // reads for a node that went quiet.
             if (this.eventLoopWatch)
@@ -1317,25 +1533,28 @@ export class OmnitronDaemon {
             // above, because this is the object that has just been given them.
             this.nodeManagerRpcService?.setTitanHealth(titanHealth);
         }
-        catch {
-            // Health module may not be available — non-critical
+        catch (error) {
+            runtimeDiagnostics.failure('runtime.health-registration', 'Health indicators could not be registered', error);
         }
     }
     // ============================================================================
     // File Watching (dev mode)
     // ============================================================================
-    startFileWatcher(config, options, logger) {
-        if (!options?.watch || options?.noWatch || !this.app)
+    async startFileWatcher(config, options, logger) {
+        if (!this.app)
             return;
-        this.app.container.resolveAsync(ORCHESTRATOR_TOKEN).then((orchestrator) => {
-            orchestrator.devMode = true;
-            this.fileWatcher = new FileWatcher(logger, orchestrator, config, process.cwd());
-            this.fileWatcher.start(options.watchApps);
-            const watched = this.fileWatcher.getWatchedApps();
-            for (const w of watched) {
-                logger.info({ app: w.name, directory: w.directory }, 'Watching for changes');
-            }
-        });
+        const orchestrator = await this.app.container.resolveAsync(ORCHESTRATOR_TOKEN);
+        const enabled = !!options?.watch && !options?.noWatch && !this.dc?.cluster?.enabled;
+        if (options?.watch && !options.noWatch && this.dc?.cluster?.enabled)
+            logger.warn('File-triggered restarts require standalone lifecycle authority');
+        orchestrator.devMode = enabled;
+        await orchestrator.setWatchMode(enabled, options?.watchApps);
+        if (this.execution)
+            return;
+        if (!enabled)
+            return;
+        this.fileWatcher = new FileWatcher(logger, orchestrator, config, process.cwd());
+        this.fileWatcher.start(options?.watchApps);
     }
     // ============================================================================
     // Start Managed Apps
@@ -1354,13 +1573,14 @@ export class OmnitronDaemon {
         if (!this.app)
             return;
         const projectService = await this.app.container.resolveAsync(PROJECT_SERVICE_TOKEN);
-        let allProjects = projectService.listProjects();
+        this.startupAbort.signal.throwIfAborted();
+        let allProjects = projectService.listProjectRegistrations();
         // Auto-register project from CWD if no projects registered
         if (allProjects.length === 0) {
             try {
                 // Use ProjectService's own registry to auto-detect — keeps in-memory state consistent
                 projectService.autoDetectProject();
-                allProjects = projectService.listProjects();
+                allProjects = projectService.listProjectRegistrations();
                 if (allProjects.length > 0) {
                     const p = allProjects[0];
                     await projectService.loadProjectConfig(p.name);
@@ -1375,36 +1595,16 @@ export class OmnitronDaemon {
             logger.info('No projects registered. Use `omnitron project add <name> <path>` or run from a directory with omnitron.config.ts');
             return;
         }
-        // When there are enabled stacks to resume, wait for Docker first. Under
-        // OS-service supervision the daemon boots at login, seconds before
-        // OrbStack/dockerd finishes starting — on 2026-07-11 the one-shot resume
-        // fired into "Docker is not available" and the platform stayed appless
-        // for days. Bounded wait; on timeout we proceed and the enabled-stacks
-        // reconciler keeps retrying with backoff.
-        const hasEnabledStacks = allProjects.some((p) => (p.enabledStacks?.length ?? 0) > 0);
-        if (hasEnabledStacks) {
-            const { isDockerAvailable } = await import('../infrastructure/container-runtime.js');
-            const deadline = Date.now() + 120_000;
-            let waited = false;
-            while (!(await isDockerAvailable())) {
-                if (Date.now() > deadline) {
-                    logger.warn('Docker still unavailable after 120s — proceeding; reconciler will retry enabled stacks');
-                    break;
-                }
-                if (!waited) {
-                    logger.info('Docker not available yet (host still booting?) — waiting before stack resume');
-                    waited = true;
-                }
-                await new Promise((r) => setTimeout(r, 3_000));
-            }
-            if (waited)
-                logger.info('Docker is available — continuing stack resume');
-        }
+        // Each stack checks its own declared infrastructure through startStack.
+        // A missing local Docker daemon must not delay remote attachment or
+        // application-only stacks. Failed local provisioning remains visible and
+        // the enabled-stacks reconciler retries that stack independently.
         // Reconcile orphan containers: stop/remove any omnitron.managed containers
         // that don't belong to current registered projects/stacks (e.g. leftovers from
         // a previous session or auto-restarted by Docker after a system reboot).
         try {
-            await this.reconcileOrphanContainers(logger, allProjects, projectService);
+            if (!this.dc?.cluster?.enabled)
+                await this.reconcileOrphanContainers(logger, allProjects, projectService);
         }
         catch (err) {
             logger.warn({ error: err.message }, 'Orphan container reconciliation failed — continuing');
@@ -1412,6 +1612,7 @@ export class OmnitronDaemon {
         // Iterate ALL registered projects and start their enabled stacks
         let totalStacks = 0;
         for (const project of allProjects) {
+            this.startupAbort.signal.throwIfAborted();
             // Load project config (populates internal cache used by listStacks)
             try {
                 await projectService.loadProjectConfig(project.name);
@@ -1433,10 +1634,15 @@ export class OmnitronDaemon {
             logger.info({ project: project.name, stacks: enabledStacks }, 'Starting project stacks');
             // Start each enabled stack
             for (const stackName of enabledStacks) {
+                this.startupAbort.signal.throwIfAborted();
                 try {
-                    await projectService.startStack(project.name, stackName, { source: 'boot' });
-                    totalStacks++;
-                    logger.info({ project: project.name, stack: stackName }, 'Stack started');
+                    const result = await projectService.startStack(project.name, stackName, { source: 'boot' });
+                    if (result.type === 'local' && result.status !== 'running') {
+                        logger.warn({ project: project.name, stack: stackName, status: result.status, notUp: result.notUp }, 'Stack start incomplete during boot');
+                    }
+                    else {
+                        totalStacks++;
+                    }
                 }
                 catch (err) {
                     logger.error({ project: project.name, stack: stackName, error: err.message }, 'Failed to start stack — continuing with remaining');
@@ -1447,6 +1653,7 @@ export class OmnitronDaemon {
         // Keep converging after boot: retry failed resumes (with backoff) and
         // re-start enabled stacks that later fall over. One-shot boot resume is
         // not enough — see the 2026-07-11 Docker-race incident.
+        this.startupAbort.signal.throwIfAborted();
         projectService.startEnabledStacksReconciler();
     }
     // ============================================================================
@@ -1467,19 +1674,17 @@ export class OmnitronDaemon {
             // Both roles: a node evaluates its own alarms on its SQLite (daemon.module.ts).
             const alertService = await container.resolveAsync(ALERT_SERVICE_TOKEN);
             const fleetService = !isSlave ? await container.resolveAsync(FLEET_SERVICE_TOKEN) : null;
-            registerDaemonJobs(scheduler, {
+            this.metricSampling = registerDaemonJobs(scheduler, {
                 logger,
+                diagnostics: runtimeDiagnostics,
                 orchestrator,
                 authService,
                 metricsService: titanMetrics,
+                metricsInitiallyPaused: !this.backendAdmitted,
                 alertService,
                 fleetService,
                 logManager,
                 infraService: this.infraService,
-                // Only a slave replicates. `bufferBatch` is itself a no-op for any
-                // other role, but passing null keeps the job from registering at all
-                // and makes the scheduler's own "skipped, because" line say so.
-                syncService: isSlave ? this.syncService : null,
                 metricsInterval: config.monitoring.metrics.interval,
                 healthCheckInterval: config.monitoring.healthCheck.interval,
             });
@@ -1488,7 +1693,7 @@ export class OmnitronDaemon {
             logger.info('Daemon scheduler started with all periodic jobs');
         }
         catch (err) {
-            logger.warn({ error: err.message }, 'Failed to start scheduler — falling back to manual timers');
+            runtimeDiagnostics.failure('runtime.scheduler-startup', 'Periodic daemon jobs could not be registered', err, 'Repair the scheduler or its dependencies and restart safely; there is no manual timer fallback.');
         }
     }
     // ============================================================================
@@ -1499,7 +1704,7 @@ export class OmnitronDaemon {
             return;
         const container = this.app.container;
         const isSlave = this.dc.role === 'slave';
-        // Start telemetry relay (master only — requires PG)
+        // Local application telemetry uses the controller's persistent log sink.
         if (!isSlave) {
             try {
                 const telemetryRelay = await container.resolveAsync(TELEMETRY_RELAY_TOKEN);
@@ -1507,7 +1712,7 @@ export class OmnitronDaemon {
                 logger.info({ nodeId: telemetryRelay.nodeId, role: telemetryRelay.role }, 'Telemetry relay started');
             }
             catch (err) {
-                logger.warn({ error: err.message }, 'Telemetry relay failed to start');
+                runtimeDiagnostics.failure('runtime.telemetry-startup', 'Telemetry relay failed to start', err);
             }
         }
         // Register self in fleet (master only — requires PG). `registerSelf`, so
@@ -1524,8 +1729,8 @@ export class OmnitronDaemon {
                     metadata: { pid: process.pid, version: CLI_VERSION, httpPort: this.dc.httpPort, rpcPort: this.rpcHttpPort },
                 });
             }
-            catch {
-                // Non-critical — DB may not be ready
+            catch (error) {
+                runtimeDiagnostics.failure('runtime.fleet-registration', 'The daemon could not register its fleet identity', error);
             }
         }
         // Start sync service (slave→master data replication)
@@ -1545,7 +1750,7 @@ export class OmnitronDaemon {
                 logger.info('Trace collector started');
             }
             catch (err) {
-                logger.warn({ error: err.message }, 'Trace collector failed to start');
+                runtimeDiagnostics.failure('runtime.trace-startup', 'Trace collector failed to start', err);
             }
         }
         // Start leader election (cluster mode, master only)
@@ -1559,7 +1764,7 @@ export class OmnitronDaemon {
                 this.configSyncService = new ConfigSyncService(config, loggerModule.logger);
             }
             catch (err) {
-                logger.warn({ error: err.message }, 'Leader election failed to start');
+                runtimeDiagnostics.failure('runtime.leader-startup', 'Leader election failed to start', err);
             }
         }
     }
@@ -1588,8 +1793,8 @@ export class OmnitronDaemon {
      * its process ends, and the daemon runs the checks itself in the meantime.
      */
     async startHealthMonitorWorker(logger) {
-        if (this.dc.role === 'slave')
-            return; // By design: slaves do not manage a fleet.
+        if (this.isShuttingDown || this.dc.role === 'slave')
+            return; // Slaves do not manage a fleet.
         if (!this.app) {
             logger.warn({}, 'Health monitor not started — application is not available');
             return;
@@ -1602,12 +1807,13 @@ export class OmnitronDaemon {
         try {
             const titanPm = await import('@omnitron-dev/titan-pm');
             const { SystemWorkerManager } = await import('../workers/system-worker-manager.js');
-            const { fileURLToPath } = await import('node:url');
             const nodePath = await import('node:path');
             const { omnitronPgConnectionString } = await import('../database/connection.js');
             // Resolve PM from DI
             const pm = await this.app.container.resolveAsync(titanPm.PM_MANAGER_TOKEN);
             const loggerModule = await this.app.container.resolveAsync(LOGGER_SERVICE_TOKEN);
+            if (this.isShuttingDown)
+                return;
             const workerManager = new SystemWorkerManager(pm, loggerModule.logger.child({ component: 'system-workers' }));
             this.systemWorkerManager = workerManager;
             // Get worker process path. The naive heuristic of "tsx in execArgv → .ts"
@@ -1674,6 +1880,8 @@ export class OmnitronDaemon {
             this.healthWorkerSpawn = async () => {
                 const healthConfig = buildConfig();
                 const nodesJson = JSON.stringify(await nodeManager.getNodeCheckTargets());
+                if (this.isShuttingDown)
+                    return;
                 const proxy = await workerManager.spawn('health-monitor', workerPath, { configJson: JSON.stringify(healthConfig), nodesJson }, spawnOpts);
                 // Wire IPC: worker → master status cache updates via PM's public API
                 workerManager.onMessage('health-monitor', (msg) => {
@@ -1709,16 +1917,21 @@ export class OmnitronDaemon {
                 });
             });
             // Wire node CRUD events → sync to worker
+            let nodeSyncRevision = 0;
             const syncNodesToWorker = async () => {
                 if (!workerManager.get('health-monitor'))
                     return;
+                const revision = ++nodeSyncRevision;
                 const targets = await nodeManager.getNodeCheckTargets();
+                if (revision !== nodeSyncRevision)
+                    return;
                 await callWorkerMethod(workerManager, 'updateNodes', JSON.stringify(targets)).catch((err) => {
                     logger.warn({ error: err.message }, 'Failed to sync node list to health monitor');
                 });
             };
             nodeManager.on('node:added', syncNodesToWorker);
             nodeManager.on('node:updated', syncNodesToWorker);
+            nodeManager.on('node:ssh-trust-changed', syncNodesToWorker);
             nodeManager.on('node:removed', syncNodesToWorker);
             // A node changing state is the event the console subscribes to. Four of
             // the five NODE_EVENTS channels were declared and never emitted.
@@ -1748,6 +1961,8 @@ export class OmnitronDaemon {
             await this.healthWorkerSpawn();
         }
         catch (err) {
+            if (this.isShuttingDown)
+                return;
             logger.warn({ error: err.message }, 'Health monitor worker failed to start — falling back to direct checks');
             this.startFallbackNodeChecks(logger);
             if (this.healthWorkerSpawn)
@@ -1771,7 +1986,9 @@ export class OmnitronDaemon {
             this.healthWorkerRestartTimer = null;
             if (this.isShuttingDown || !this.healthWorkerSpawn)
                 return;
-            this.healthWorkerSpawn().catch((err) => {
+            this.healthMonitorStartup = this.healthWorkerSpawn().catch((err) => {
+                if (this.isShuttingDown)
+                    return;
                 logger.warn({ attempt, startupTimeoutMs: this.healthWorkerStartupTimeout, error: err.message }, 'Health monitor worker restart failed');
                 this.scheduleHealthMonitorRestart(logger);
             });
@@ -1879,13 +2096,13 @@ export class OmnitronDaemon {
         projectService.on('project:config_reloaded', (name) => {
             broadcaster.broadcast(PROJECT_EVENTS.CONFIG_RELOADED, { name });
         });
-        projectService.on('stack:started', (project, stack, type) => {
+        projectService.on('stack:started', (project, stack, type, appCount, nodeCount) => {
             broadcaster.broadcast(STACK_EVENTS.STARTED, {
                 project,
                 stack,
                 type: type,
-                appCount: 0,
-                nodeCount: 0,
+                appCount,
+                nodeCount,
             });
         });
         projectService.on('stack:stopped', (project, stack, reason) => {
@@ -1917,15 +2134,24 @@ export class OmnitronDaemon {
     async enableWatch(apps) {
         if (!this.app)
             throw new Error('Daemon not started');
+        const config = this.watchConfig;
+        if (!config)
+            throw new Error('Daemon watch configuration is unavailable');
         const orchestrator = await this.app.container.resolveAsync(ORCHESTRATOR_TOKEN);
         const loggerModule = await this.app.container.resolveAsync(LOGGER_SERVICE_TOKEN);
+        if (this.execution) {
+            orchestrator.devMode = true;
+            await orchestrator.setWatchMode(true, apps);
+            return orchestrator.getBuildWatchedApps();
+        }
         if (this.fileWatcher) {
             this.fileWatcher.stop();
         }
-        const config = await this.getConfig();
         this.fileWatcher = new FileWatcher(loggerModule.logger, orchestrator, config, process.cwd());
+        orchestrator.devMode = true;
+        await orchestrator.setWatchMode(true, apps);
         this.fileWatcher.start(apps);
-        return this.fileWatcher.getWatchedApps();
+        return [...this.fileWatcher.getWatchedApps(), ...orchestrator.getBuildWatchedApps()];
     }
     /**
      * Point the file watcher at a reloaded config, if one is running.
@@ -1935,49 +2161,48 @@ export class OmnitronDaemon {
      * reload updates, which is exactly how the watcher came to be left out of
      * both.
      */
-    applyWatchConfig(config) {
+    async applyWatchConfig(config) {
+        this.watchConfig = config;
         this.fileWatcher?.applyConfig(config);
-    }
-    disableWatch() {
-        if (this.fileWatcher) {
-            this.fileWatcher.stop();
-            this.fileWatcher = null;
+        if (!this.app)
+            return;
+        const orchestrator = await this.app.container.resolveAsync(ORCHESTRATOR_TOKEN);
+        for (const entry of config.apps) {
+            const handle = orchestrator.getHandle(entry.name);
+            // A bare name may resolve to a different registered project's app.
+            // Only the same entry point may update that handle's watch policy.
+            const source = entry.bootstrap ?? entry.script;
+            const running = handle?.entry.bootstrap ?? handle?.entry.script;
+            if (!handle || !source || !running ||
+                path.resolve(entry.cwd ?? process.cwd(), source) !== path.resolve(handle.entry.cwd ?? process.cwd(), running))
+                continue;
+            const next = { ...handle.entry };
+            if (entry.watch === undefined)
+                delete next.watch;
+            else
+                next.watch = entry.watch;
+            await orchestrator.redefineApp(handle.name, next);
         }
     }
-    /**
-     * Whether file watching is running, and over what.
-     *
-     * `enabled` said only that a `FileWatcher` OBJECT existed. Observed on this
-     * host: `{ enabled: true, apps: [] }` — a watcher running over nothing,
-     * reported to an operator as "watching". Everyone downstream read the
-     * boolean and concluded their edits were being picked up.
-     *
-     * The watch set is built from `config.apps` — the daemon's OWN ecosystem
-     * config. Apps that arrive through the project registry are not in it, so a
-     * daemon serving projects watches none of them however the flag reads.
-     * `watching` is the fact an operator actually wants; `enabled` keeps its
-     * old meaning so existing callers do not silently change behaviour, and
-     * `reason` says why the two can disagree.
-     */
-    getWatchStatus() {
-        if (!this.fileWatcher) {
-            return { enabled: false, watching: false, reason: 'the file watcher is not running', apps: [] };
-        }
-        const apps = this.fileWatcher.getWatchedApps();
-        if (apps.length === 0) {
-            return {
-                enabled: true,
-                watching: false,
-                reason: 'the watcher is running but no app matched: the watch set comes from this daemon\'s own ' +
-                    'ecosystem config, and apps registered through a project are not in it',
-                apps,
-            };
+    async disableWatch() {
+        this.fileWatcher?.stop();
+        this.fileWatcher = null;
+        if (this.app) {
+            const orchestrator = await this.app.container.resolveAsync(ORCHESTRATOR_TOKEN);
+            await orchestrator.setWatchMode(false);
         }
-        return { enabled: true, watching: true, apps };
     }
-    async getConfig() {
-        const { loadEcosystemConfig } = await import('../config/loader.js');
-        return loadEcosystemConfig();
+    /** Reports both watcher engines, including registered bootstrap projects. */
+    async getWatchStatus() {
+        const orchestrator = this.app
+            ? await this.app.container.resolveAsync(ORCHESTRATOR_TOKEN) : null;
+        const apps = [...(this.fileWatcher?.getWatchedApps() ?? []), ...(orchestrator?.getBuildWatchedApps() ?? [])];
+        return {
+            enabled: this.execution ? !!orchestrator?.devMode : !!this.fileWatcher,
+            watching: apps.length > 0,
+            ...(apps.length ? {} : { reason: (this.execution ? orchestrator?.devMode : this.fileWatcher) ? 'no enabled app matches the watch policy' : 'watching is disabled' }),
+            apps,
+        };
     }
     // ============================================================================
     // Lifecycle
@@ -1989,6 +2214,7 @@ export class OmnitronDaemon {
     async stop() {
         if (!this.app)
             return;
+        this.stopApplicationsOnExit = true;
         await this.app.shutdown(ShutdownReason.Manual);
         // Application doesn't process.exit() for Manual reason — do it explicitly
         process.exit(0);
@@ -2003,6 +2229,8 @@ export class OmnitronDaemon {
     async reloadConfigOnHup() {
         if (!this.app)
             return;
+        if (this.dc?.cluster?.enabled)
+            throw new Error('Cluster application configuration changes require the elected controller');
         // Loading first, on its own: a malformed file must be rejected before
         // anything is touched, and that failure genuinely means "the daemon is as
         // it was".
@@ -2023,7 +2251,7 @@ export class OmnitronDaemon {
                 name: 'orchestrator',
                 apply: async (cfg) => {
                     const orchestrator = await this.app.container.resolveAsync(ORCHESTRATOR_TOKEN);
-                    orchestrator.setConfig(cfg);
+                    await orchestrator.setConfig(cfg);
                 },
             },
             {
@@ -2032,9 +2260,7 @@ export class OmnitronDaemon {
                 // updated who gets restarted but not who is watched: an app added to
                 // the config was never watched, and one removed from it kept its
                 // watchers and went on triggering restarts.
-                apply: (cfg) => {
-                    this.applyWatchConfig(cfg);
-                },
+                apply: (cfg) => this.applyWatchConfig(cfg),
             },
             {
                 name: 'RPC snapshot',
@@ -2069,10 +2295,30 @@ export class OmnitronDaemon {
      *   VeryLow (90)  — Dispose project service, teardown infrastructure
      *   Last (100)    — Remove PID file
      */
-    registerShutdownTasks(app) {
+    registerShutdownTasks(app, logger) {
         const container = app.container;
+        const cancelStartup = () => {
+            this.isShuttingDown = true;
+            this.backendAdmitted = false;
+            this.startupAbort.abort();
+        };
+        // Titan remains the only shutdown coordinator. Its first task joins the
+        // in-flight startup step before cleanup can dispose resources that step
+        // is still creating. The concurrent health worker is owned by the same
+        // barrier, even though normal boot does not wait for fleet monitoring.
+        app.registerShutdownTask('settle-daemon-startup', async () => {
+            cancelStartup();
+            await this.startupWork?.catch(() => undefined);
+            await this.healthMonitorStartup;
+        }, ShutdownPriority.First - 1, true);
+        app.registerShutdownTask('close-recovery-journal', async () => {
+            await this.recoveryMonitor?.close(this.stopApplicationsOnExit || this.handingOffBackend);
+            this.recoveryMonitor = null;
+        }, ShutdownPriority.First);
         // Broadcast DAEMON_EVENTS.STOPPING on shutdown start
         app.on(ApplicationEvent.ShutdownStart, ({ reason, details }) => {
+            this.shutdownRequested = true;
+            cancelStartup();
             this.eventBroadcaster?.broadcast(DAEMON_EVENTS.STOPPING, {
                 reason,
                 signal: details?.signal,
@@ -2105,7 +2351,25 @@ export class OmnitronDaemon {
             }
         });
         // --- Priority: First (0) — Immediate cleanup ---
+        app.registerShutdownTask('quiesce-metric-sampling', async () => {
+            try {
+                await this.metricSampling?.pauseAndFlush();
+            }
+            catch (error) {
+                runtimeDiagnostics.failure('metrics.shutdown', 'Metric flush before shutdown failed; buffered samples require a final flush', error);
+            }
+        }, ShutdownPriority.First);
         app.registerShutdownTask('stop-file-watcher-and-webapp', async () => {
+            this.eventLoopWatch?.stop();
+            this.eventLoopWatch = null;
+            await this.filesRpcService?.dispose();
+            this.filesRpcService = null;
+            await this.fileNode?.dispose();
+            this.fileNode = null;
+            await this.pipelineService?.dispose();
+            this.pipelineService = null;
+            this.terminalRpcService?.dispose();
+            this.terminalRpcService = null;
             if (this.fileWatcher) {
                 this.fileWatcher.stop();
                 this.fileWatcher = null;
@@ -2121,12 +2385,20 @@ export class OmnitronDaemon {
                 catch { /* non-critical */ }
                 this.metricsServer = null;
             }
-            // Stop webapp nginx container (non-blocking — don't wait if slow)
-            try {
-                const { removeContainer } = await import('../infrastructure/container-runtime.js');
-                void removeContainer('omnitron-nginx');
+            // Only an explicit instance shutdown owns its configured Console.
+            // Backend replacement and instances without a Console must leave it up.
+            if (!this.handingOffBackend && (!this.execution || this.stopApplicationsOnExit)) {
+                try {
+                    const { readSavedDaemonConfig } = await import('../config/saved.js');
+                    if (readSavedDaemonConfig()?.webapp) {
+                        const { WebappService } = await import('../webapp/webapp.service.js');
+                        await new WebappService(logger).stop();
+                    }
+                }
+                catch (error) {
+                    logger.warn({ error }, 'Could not stop this instance’s Console');
+                }
             }
-            catch { /* non-critical */ }
         }, ShutdownPriority.First);
         // A release build outlives its daemon otherwise.
         //
@@ -2144,31 +2416,39 @@ export class OmnitronDaemon {
         }, ShutdownPriority.First);
         // --- Priority: VeryHigh (10) — Stop managed apps (fast — 5s per app max) ---
         app.registerShutdownTask('stop-managed-apps', async () => {
+            if (this.handingOffBackend || (this.execution && !this.stopApplicationsOnExit))
+                return;
             const orchestrator = await container.resolveAsync(ORCHESTRATOR_TOKEN);
             await orchestrator.stopAll(true); // force=true for fast shutdown (SIGTERM + 5s → SIGKILL)
         }, ShutdownPriority.VeryHigh);
         // --- Priority: High (20) — Stop background services ---
         app.registerShutdownTask('stop-background-services', async () => {
-            try {
-                const relay = await container.resolveAsync(TELEMETRY_RELAY_TOKEN);
-                await relay.stop();
+            if (this.dc.role !== 'slave') {
+                try {
+                    const relay = await container.resolveAsync(TELEMETRY_RELAY_TOKEN);
+                    await relay.stop();
+                }
+                catch (error) {
+                    runtimeDiagnostics.failure('runtime.telemetry-shutdown', 'Final local telemetry delivery was not confirmed', error);
+                }
+                try {
+                    const fleet = await container.resolveAsync(FLEET_SERVICE_TOKEN);
+                    fleet.stopHeartbeatSweep();
+                }
+                catch { /* non-critical */ }
+                try {
+                    const tc = await container.resolveAsync(TRACE_COLLECTOR_TOKEN);
+                    await tc.stop();
+                }
+                catch { /* non-critical */ }
             }
-            catch { /* non-critical */ }
             try {
                 const mc = await container.resolveAsync(TITAN_METRICS_TOKEN);
                 await mc.stop();
             }
-            catch { /* non-critical */ }
-            try {
-                const fleet = await container.resolveAsync(FLEET_SERVICE_TOKEN);
-                fleet.stopHeartbeatSweep();
-            }
-            catch { /* non-critical */ }
-            try {
-                const tc = await container.resolveAsync(TRACE_COLLECTOR_TOKEN);
-                await tc.stop();
+            catch (error) {
+                runtimeDiagnostics.failure('metrics.shutdown', 'Final metric flush failed; buffered samples were not confirmed', error);
             }
-            catch { /* non-critical */ }
         }, ShutdownPriority.High);
         // --- Priority: Normal (50) — System workers, node manager, sync, cluster ---
         app.registerShutdownTask('stop-system-services', async () => {
@@ -2196,10 +2476,12 @@ export class OmnitronDaemon {
                 this.syncService = null;
             }
             try {
-                if (this.leaderElection?.stop)
-                    this.leaderElection.stop();
+                if (this.leaderElection)
+                    await this.leaderElection.stop();
             }
             catch { /* non-critical */ }
+            if (this.clusterDb)
+                await this.clusterDb.destroy();
             try {
                 if (this.configSyncService?.stopPeriodicSync)
                     this.configSyncService.stopPeriodicSync();
@@ -2207,7 +2489,6 @@ export class OmnitronDaemon {
             catch { /* non-critical */ }
             // Before stopping the workers: a worker exiting on the way out must not
             // be read as a crash and rescheduled.
-            this.isShuttingDown = true;
             this.healthWorkerSpawn = null;
             if (this.healthWorkerRestartTimer) {
                 clearTimeout(this.healthWorkerRestartTimer);
@@ -2239,16 +2520,12 @@ export class OmnitronDaemon {
             }
             catch { /* non-critical */ }
         }, ShutdownPriority.Normal);
-        // --- Priority: Low (80) — Flush logs, clear state ---
-        app.registerShutdownTask('flush-and-clear', async () => {
-            try {
-                const logCollector = await container.resolveAsync(LOG_COLLECTOR_TOKEN);
-                await logCollector.dispose();
-            }
-            catch { /* non-critical */ }
+        // --- Priority: Low (80) — Clear state ---
+        app.registerShutdownTask('clear-state', async () => {
             try {
                 const stateStore = await container.resolveAsync(STATE_STORE_TOKEN);
-                stateStore.clear();
+                if (!this.execution)
+                    stateStore.clear();
             }
             catch { /* non-critical */ }
         }, ShutdownPriority.Low);
@@ -2272,9 +2549,10 @@ export class OmnitronDaemon {
                 // lifetime. Locally it still tears down — `omnitron down` there means
                 // "I am done for the day" — and on either, `omnitron infra down` is
                 // the command that removes containers on purpose.
-                if (this.dc.role === 'slave') {
+                if (this.dc.cluster?.enabled || this.dc.role === 'slave' || this.handingOffBackend || (this.execution && !this.stopApplicationsOnExit)) {
                     // Said on the way out, because the absence of a teardown is
                     // otherwise indistinguishable from a teardown that failed.
+                    this.infraService.dispose();
                     console.info('[omnitron] leaving this node\'s infrastructure running — the daemon does not own its lifetime');
                 }
                 else {
@@ -2286,12 +2564,61 @@ export class OmnitronDaemon {
                 this.infraService = null;
             }
         }, ShutdownPriority.VeryLow);
+        app.registerShutdownTask('flush-logs', async () => {
+            const logManager = await container.resolveAsync(LOG_MANAGER_TOKEN);
+            const logCollector = await container.resolveAsync(LOG_COLLECTOR_TOKEN);
+            try {
+                await logManager.flush();
+                const module = await container.resolveAsync(LOGGER_SERVICE_TOKEN);
+                await module.flush();
+                getDaemonLogCollectorStream()?.seal();
+                await logCollector.dispose();
+            }
+            catch (error) {
+                runtimeDiagnostics.failure('logs.shutdown', 'Final log delivery remains pending in the local journal', error, 'The next backend retries the same records; inspect log persistence diagnostics.');
+            }
+            // The backend stream stays open for later Titan shutdown messages. Its
+            // synchronous journal captures those for replay by the next backend.
+        }, ShutdownPriority.Last);
         // --- Priority: Last (100) — PID file removal ---
         app.registerShutdownTask('remove-pid', () => {
-            this.pidManager?.remove();
+            this.pidManager?.removeOwned();
+        }, ShutdownPriority.Last);
+        app.registerShutdownTask('release-execution-controller', async () => {
+            if (!this.execution)
+                return;
+            if (!this.handingOffBackend && this.stopApplicationsOnExit)
+                await this.execution.shutdownOwner();
+            await this.execution.close();
+            if (!this.handingOffBackend)
+                await this.backendControl?.stop();
         }, ShutdownPriority.Last);
     }
 }
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Array]),
+    __metadata("design:returntype", Promise)
+], OmnitronDaemon.prototype, "enableWatch", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], OmnitronDaemon.prototype, "applyWatchConfig", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], OmnitronDaemon.prototype, "disableWatch", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], OmnitronDaemon.prototype, "reloadConfigOnHup", null);
 /**
  * Call a method on a system worker's proxy.
  *