@omnitron-dev/omnitron 0.3.0 → 0.3.2

package/dist/orchestrator/orchestrator.service.js

@@ -1,3 +1,10 @@
+import { Errors } from '@omnitron-dev/titan/errors';
+import { OWNER_CAPABILITIES } from '../daemon/execution-capabilities.js';
+import { parsePoolScaleRequest, assertPoolScaleTarget } from '../shared/pool-scale.js';
+import { installedEntryRevision, installedExecutable, requireInstalledBinding } from './installed-execution.js';
+import { topologyRevision } from '../project/topology-plan.js';
+import { createHash } from 'node:crypto';
+import { stackExecutionKey, executionScopeKey, executionScopeOwns } from '../shared/dto/stack-execution.js';
 /**
  * OrchestratorService — Core orchestration logic
  *
@@ -7,7 +14,7 @@
  *   - Each app gets a ProcessSupervisor via pm.supervisor(config)
  *   - Supervisor manages all child lifecycle: spawn, health, metrics, crash recovery, restart
  *   - Single or multi-instance (pool) — configured via ISupervisorChildConfig
- *   - Scaling delegates to supervisor.scaleChild()
+ *   - Runtime resizing addresses one declared topology pool
  *
  * Classic mode:
  *   - child_process.fork() with manual exit handling (legacy compat)
@@ -26,13 +33,16 @@
  *     → Full Titan Application inside each worker
  *     → Two Netron instances: PM management plane + app HTTP data plane
  */
+import { ReadinessMonitor } from '../health/readiness.js';
 import fs from 'node:fs';
 import { readDeclaredConfig, withDeclaredConfig } from '../project/declared-config.js';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { PoolStrategy, SupervisionStrategy, ProcessLifecycleQueue, LifecyclePreempted, computeBackoff, isAlive, discoverManagedProcesses, } from '@omnitron-dev/titan-pm';
+import { PoolStrategy, SupervisionStrategy, ProcessLifecycleQueue, LifecyclePreempted, computeBackoff, RestartWindow, isAlive, killChildAndVerify, discoverManagedProcesses, } from '@omnitron-dev/titan-pm';
 import { EventEmitter } from '@omnitron-dev/eventemitter';
 import { AppHandle } from './app-handle.js';
+import { verifyLaunchRelease } from '../release/runtime-provenance.js';
+import { withClosureLibraryPath } from '../release/closure-library-path.js';
 import { parsePsLine, parsePsBatch } from './ps-metrics.js';
 import { launchClassic } from './classic-launcher.js';
 import { resolveStartupOrder, resolveShutdownOrder } from './dependency-resolver.js';
@@ -60,7 +70,9 @@ function qualifyChildName(appName, childName) {
 const TOPOLOGY_EXPOSE_TIMEOUT_MS = 30_000;
 const TOPOLOGY_EXPOSE_POLL_MS = 250;
 import { ServiceRouter } from './service-router.js';
-import { loadBootstrapConfig, clearCacheFor } from './bootstrap-loader.js';
+import { ApplicationTopology } from './application-topology.js';
+import { clearCacheFor } from './bootstrap-loader.js';
+import { readBootstrapMetadata } from '../project/bootstrap-metadata.js';
 /** Levels a pino logger accepts. A child is spawned with nothing else. */
 const PINO_LEVELS = new Set(['fatal', 'error', 'warn', 'info', 'debug', 'trace', 'silent']);
 /**
@@ -81,6 +93,7 @@ import { collectOwnedPids } from './owned-pids.js';
 import { combineProcessHealth, notRunningHealth, poolHealth } from './app-health.js';
 import { combineProcessTraffic } from './app-traffic.js';
 import { CLI_VERSION } from '../config/defaults.js';
+import { applicationBootstrapRuntime } from './application-runtime.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 // Resolve bootstrap-process path — .ts in dev (tsx), .js when compiled
 function resolveBootstrapProcessPath() {
@@ -185,6 +198,7 @@ export class OrchestratorService extends EventEmitter {
     logger;
     pm;
     stateStore;
+    ownerOptions;
     handles = new Map();
     /**
      * Per-name in-flight start lock (T#57). When two `startApp()` calls
@@ -197,6 +211,8 @@ export class OrchestratorService extends EventEmitter {
      * for the same name isn't permanently locked out.
      */
     startingApps = new Map();
+    stoppingApps = null;
+    stopGeneration = 0;
     /**
      * Per-app async serial-execution queue covering start / stop / restart
      * / crash-restart-timer (P0-E + P0-I + P2-B in the audit). Pre-this-
@@ -212,15 +228,18 @@ export class OrchestratorService extends EventEmitter {
      * The queue collapses all four into one primitive ordered by
      * priority (stop > restart > start > crash-restart). The same-key
      * mutex means stop ALWAYS observes a completed start, and an
-     * explicit stop ALWAYS preempts a pending crash-restart timer.
+     * explicit stop cancels recovery waits before joining the queue.
      */
     lifecycleQueue = new ProcessLifecycleQueue();
     /**
-     * Pending post-escalation cool-down timers, keyed by app name.
+     * Pending crash backoff and post-escalation timers, keyed by app name.
      * Held here rather than inside a lifecycle-queue slot so that a
      * crashed app still answers operator commands while it waits.
      */
     coolDownTimers = new Map();
+    appStopIntents = new Map();
+    readinessMonitor = new ReadinessMonitor();
+    readinessSignatures = new WeakMap();
     config = null;
     cwd;
     metricsTimer = null;
@@ -229,6 +248,57 @@ export class OrchestratorService extends EventEmitter {
     devMode = false;
     /** esbuild bundling pipeline — pre-bundles TS entry points for child processes */
     buildService = null;
+    watchDisabled = false;
+    watchSelection = null;
+    bootstrapSources = new Map();
+    allowsWatch(entry) {
+        return this.devMode && !this.watchDisabled && !entry.releaseRoot && entry.watch !== false &&
+            (!this.watchSelection || this.watchSelection.has(entry.name));
+    }
+    /** One policy for both fs.watch and esbuild; disabling does not stop apps. */
+    async setWatchMode(enabled, apps) {
+        this.devMode = enabled;
+        this.watchDisabled = !enabled;
+        this.watchSelection = apps ? new Set(apps.map((name) => this.resolveAppName(name) ?? name)) : null;
+        for (const [name, state] of this.restartCoalescer) {
+            if (!enabled || !this.handles.get(name) || !this.allowsWatch(this.handles.get(name).entry))
+                state.watchSerial = 0;
+        }
+        await Promise.all([...this.bootstrapSources.keys()].map((name) => this.syncBootstrapWatch(name)));
+    }
+    getBuildWatchedApps() {
+        return [...this.bootstrapSources].filter(([name]) => this.buildService?.isWatching(name))
+            .map(([name, source]) => ({ name, directory: path.dirname(source.path) }));
+    }
+    async syncBootstrapWatch(name) {
+        const source = this.bootstrapSources.get(name);
+        const entry = this.handles.get(name)?.entry;
+        if (!this.buildService || !source)
+            return;
+        if (!entry || this.executionBusy(name) || !this.allowsWatch(entry) || !entry.bootstrap ||
+            path.resolve(entry.cwd ?? this.cwd, entry.bootstrap) !== source.path) {
+            const state = this.restartCoalescer.get(name);
+            if (state)
+                state.watchSerial = 0;
+            await this.buildService.unwatchApp(name);
+            return;
+        }
+        if (this.buildService.isWatching(name))
+            return;
+        await this.buildService.watchApp(name, source.path, source.definition, () => {
+            void this.restartAfterChange(name).catch((error) => {
+                this.logger.error({ app: name, error: error.message }, 'Restart after source change failed');
+            });
+        }, this.devMode);
+    }
+    /** Automatic triggers remain revocable while queued; manual restart is independent. */
+    async restartAfterChange(name) {
+        const canonical = this.resolveAppName(name) ?? name;
+        const handle = this.handles.get(canonical);
+        if (!handle || !this.allowsWatch(handle.entry))
+            return handle;
+        return this.restartAppCoalesced(canonical, true, 'watch');
+    }
     /** Cached build results per app name */
     buildResults = new Map();
     /**
@@ -279,19 +349,9 @@ export class OrchestratorService extends EventEmitter {
      */
     bootReconciled = false;
     bootReconcilePromise = null;
-    /** Daemon's Netron instance for native service routing */
-    daemonNetron = null;
-    /** Daemon Unix socket path for child-to-daemon Netron connections */
-    daemonSocketPath = null;
-    /**
-     * Promise that resolves once the daemon's Netron is wired up. Apps that
-     * declare topology cannot launch until this is ready — instead of failing
-     * with "daemon Netron not available" the launcher awaits this promise
-     * (with a generous timeout) so transient startup-order interleavings
-     * resolve themselves instead of becoming user-visible errors.
-     */
-    daemonNetronReady;
-    resolveDaemonNetronReady = () => undefined;
+    topologyDirectory = null;
+    topologyReady;
+    resolveTopologyReady = () => undefined;
     /**
      * Optional metrics sink. Set by the daemon at boot via
      * `setMetricsBridge` so the orchestrator can forward janitor sweeps,
@@ -300,25 +360,32 @@ export class OrchestratorService extends EventEmitter {
      * bootstraps).
      */
     metricsBridge = null;
-    constructor(logger, pm, stateStore, cwd) {
+    constructor(logger, pm, stateStore, cwd, ownerOptions = {}) {
         super();
         this.logger = logger;
         this.pm = pm;
         this.stateStore = stateStore;
+        this.ownerOptions = ownerOptions;
         this.cwd = cwd ?? process.cwd();
-        this.daemonNetronReady = new Promise((resolve) => {
-            this.resolveDaemonNetronReady = resolve;
+        if (pm.outputCaptureVersion === 1)
+            pm.on('process:output', (name, line, stream, context) => {
+                const app = [...this.handles.keys()].filter(key => name === key || name.startsWith(`${key}/`) || name.startsWith(`${key}-`))
+                    .sort((a, b) => b.length - a.length)[0];
+                const handle = app ? this.handles.get(app) : undefined;
+                if (app && handle)
+                    this.childLogForwarder(app, handle)(line, stream, context);
+            });
+        this.topologyReady = new Promise((resolve) => {
+            this.resolveTopologyReady = resolve;
         });
     }
-    /**
-     * Set the daemon Netron instance and socket path for native topology routing.
-     * Called by the daemon after start when Netron is available.
-     */
-    setDaemonNetron(netron, socketPath) {
-        this.daemonNetron = netron;
-        this.daemonSocketPath = socketPath;
-        this.resolveDaemonNetronReady();
-        this.logger.info({ socketPath }, 'Daemon Netron set for native topology routing');
+    /** Application RPC listeners never share the owner's management namespace. */
+    setTopologyDirectory(directory) {
+        this.topologyDirectory = path.resolve(directory);
+        this.resolveTopologyReady();
+    }
+    async bootstrapRuntime(bootstrap) {
+        return applicationBootstrapRuntime(bootstrap, BOOTSTRAP_PROCESS_PATH, this.ownerOptions.allowSdklessBootstrap ?? true);
     }
     /**
      * Wire the metrics bridge. Called once during daemon bootstrap.
@@ -350,18 +417,20 @@ export class OrchestratorService extends EventEmitter {
             this.metricsBridge?.recordAppEscalated(app);
         });
     }
-    /**
-     * Wait until the daemon Netron is available, with a hard ceiling so we
-     * never hang forever if `setDaemonNetron()` was never wired in.
-     */
-    async ensureDaemonNetronReady(timeoutMs = 30_000) {
-        if (this.daemonNetron && this.daemonSocketPath)
+    async ensureTopologyReady(timeoutMs = 30_000) {
+        if (this.topologyDirectory)
             return;
+        let timer;
         const timeout = new Promise((_resolve, reject) => {
-            const timer = setTimeout(() => reject(new Error(`Daemon Netron not initialized within ${timeoutMs}ms — wiring bug?`)), timeoutMs);
+            timer = setTimeout(() => reject(new Error(`Application topology directory not configured within ${timeoutMs}ms`)), timeoutMs);
             timer.unref?.();
         });
-        await Promise.race([this.daemonNetronReady, timeout]);
+        try {
+            await Promise.race([this.topologyReady, timeout]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
     }
     // ============================================================================
     // Lifecycle
@@ -517,6 +586,7 @@ export class OrchestratorService extends EventEmitter {
         if (this.janitor)
             return this.janitor;
         this.janitor = new ProcessJanitor({
+            reapForeignOrphans: this.ownerOptions.reapForeignOrphans ?? true,
             logger: this.logger,
             getOwnedPids: () => this.collectOwnedPids(),
             onMetrics: (m) => this.metricsBridge?.recordJanitorSweep(m),
@@ -635,14 +705,9 @@ export class OrchestratorService extends EventEmitter {
         return pids;
     }
     async startApp(entry, config) {
-        // T#63: run the one-shot cold-start reconcile (orphan reap +
-        // janitor arming) before ANY app spawns. Project-mode boots flow
-        // through `projectService.startStack → orchestrator.startApp`
-        // and historically bypassed the reap entirely — a previous
-        // daemon's children (now reparented to init) kept their HTTP
-        // listen ports and the fresh child failed to bind silently.
-        // No-op after first call thanks to `bootReconciled`.
-        await this.ensureBootReconciled(config);
+        const stopGeneration = this.stopGeneration;
+        if (this.stoppingApps)
+            throw new Error('Application stop is in progress; new starts are not admitted');
         // Defensive auto-namespacing — promotes a bare entry.name to the
         // canonical `${project}/${stack}/${name}` form when the env carries
         // OMNITRON_PROJECT + OMNITRON_STACK. Catches every code path that
@@ -651,8 +716,29 @@ export class OrchestratorService extends EventEmitter {
         //   - legacy ecosystem configs without per-app namespace
         //   - daemon startAll() flows over a not-yet-namespaced config
         entry = ensureNamespacedEntry(entry);
+        this.assertAppStartAllowed(this.resolveAppName(entry.name) ?? entry.name);
+        if (!this.appStopIntents.has(entry.name)) {
+            this.appStopIntents.set(entry.name, { revision: 0, stopped: false });
+        }
+        const stopRevision = this.appStopIntents.get(entry.name)?.revision;
+        // T#63: run the one-shot cold-start reconcile (orphan reap +
+        // janitor arming) before ANY app spawns. Project-mode boots flow
+        // through `projectService.startStack → orchestrator.startApp`
+        // and historically bypassed the reap entirely — a previous
+        // daemon's children (now reparented to init) kept their HTTP
+        // listen ports and the fresh child failed to bind silently.
+        // No-op after first call thanks to `bootReconciled`.
+        await this.ensureBootReconciled(config);
+        if (this.stoppingApps || stopGeneration !== this.stopGeneration ||
+            stopRevision !== this.appStopIntents.get(entry.name)?.revision) {
+            throw new Error('Application stop interrupted start admission');
+        }
+        const intent = this.appStopIntents.get(entry.name);
+        const wasStopped = intent?.stopped;
+        if (intent)
+            intent.stopped = false;
         const inflight = this.startingApps.get(entry.name);
-        if (inflight) {
+        if (inflight && !wasStopped) {
             this.logger.debug({ app: entry.name }, 'Coalescing concurrent startApp into in-flight launch (T#57)');
             return inflight;
         }
@@ -661,12 +747,17 @@ export class OrchestratorService extends EventEmitter {
         // (or in-flight) now waits its turn instead of racing through
         // and leaving an orphan supervisor.
         const promise = this.lifecycleQueue.enqueue(entry.name, 'start', () => this.startAppInternal(entry, config)).finally(() => {
-            this.startingApps.delete(entry.name);
+            if (this.startingApps.get(entry.name) === promise)
+                this.startingApps.delete(entry.name);
         });
         this.startingApps.set(entry.name, promise);
         return promise;
     }
-    async startAppInternal(entry, config) {
+    async startAppInternal(entry, config, installed) {
+        if (!installed)
+            this.assertAppStartAllowed(entry.name);
+        else
+            this.assertApplicationFence(entry.name);
         // Persist ecosystem config for restartApp — stack mode passes config per-app,
         // but restartApp calls startApp without it.
         if (config && !this.config) {
@@ -686,7 +777,8 @@ export class OrchestratorService extends EventEmitter {
         //   - exact key already exists, online   → return it (idempotent)
         //   - exact key already exists, not online → fall through and re-launch
         //     under the same key
-        //   - DIFFERENT key with the same effective short name:
+        //   - different fully qualified keys are distinct apps and coexist
+        //   - bare/qualified keys with the same effective short name:
         //       - new is MORE specific (namespaced) and existing is bare → stop
         //         the bare one and re-launch under the namespaced key. Without
         //         this, a boot-race where bare-name auto-start beats the
@@ -696,13 +788,22 @@ export class OrchestratorService extends EventEmitter {
         //         restart by canonical name, not register an alias.
         const effective = effectiveAppName(entry.name);
         const newIsNamespaced = entry.name.includes('/');
+        if (!newIsNamespaced && [...this.handles.keys()].filter(key => key.includes('/') && effectiveAppName(key) === effective).length > 1) {
+            throw new Error(`Ambiguous app name '${entry.name}'; use its full project/stack/app identity`);
+        }
         for (const [key, h] of this.handles) {
             if (key === entry.name)
                 continue;
             if (effectiveAppName(key) !== effective)
                 continue;
             const existingIsNamespaced = key.includes('/');
-            // Same effective app under a different key.
+            // Qualified identities are separate deployments, even when their basename matches.
+            if (newIsNamespaced && existingIsNamespaced)
+                continue;
+            if (installed)
+                throw new Error('Installed stack start cannot displace another application');
+            this.assertAppStartAllowed(key);
+            // A bare alias may still refer to the one qualified deployment.
             if (h.status === 'online') {
                 if (newIsNamespaced && !existingIsNamespaced) {
                     this.logger.info({ stale: key, replacing_with: entry.name, effective }, 'Stopping bare-name handle to re-register under namespaced key');
@@ -710,7 +811,8 @@ export class OrchestratorService extends EventEmitter {
                         await this.stopApp(key);
                     }
                     catch (err) {
-                        this.logger.warn({ stale: key, error: err.message }, 'stopApp during dedup failed — clearing handle anyway');
+                        this.logger.error({ stale: key, error: err.message }, 'Cannot replace app registration while its previous processes remain unconfirmed');
+                        throw new Error(`Cannot replace '${key}' with '${entry.name}': the previous application did not stop`, { cause: err });
                     }
                     this.handles.delete(key);
                     if (key !== entry.name)
@@ -728,8 +830,7 @@ export class OrchestratorService extends EventEmitter {
             // its services are still registered on the daemon's Netron. Dropping the
             // handle here is the last moment anything knows they exist — or that its
             // processes still run: an errored app's other children and its pools.
-            await this.releaseExposedServices(h);
-            await this.tearDownProcesses(h);
+            await this.tearDownApp(h);
             this.handles.delete(key);
             // Drop any metrics that were collected under the stale alias so it
             // doesn't haunt future snapshots as a ghost offline app.
@@ -746,12 +847,15 @@ export class OrchestratorService extends EventEmitter {
         // crashing leaves its siblings — the server among them — up; and its pools
         // were never any supervisor's to stop. Stopped before the new handle
         // starts, or the new one finds its own predecessor on its port: on
-        // daos/test (2026-09-25) paysys's crash restarts failed five times on
+        // sample/test (2026-09-25) payments's crash restarts failed five times on
         // `EADDRINUSE :3004`, «held by … a child this daemon still accounts for».
-        if (existing) {
-            await this.releaseExposedServices(existing);
-            await this.tearDownProcesses(existing);
+        if (existing && !installed) {
+            await this.tearDownApp(existing);
         }
+        // A sealed entry never inherits a former source build, including a
+        // bootstrap-to-classic transition. Retained resumes still reject pollution.
+        if (entry.releaseRoot && !installed)
+            await this.discardSourceBuild(entry.name);
         const mode = entry.bootstrap ? 'bootstrap' : 'classic';
         const handle = new AppHandle(entry, mode);
         // The restart budget belongs to the APP, not to this handle instance.
@@ -759,8 +863,10 @@ export class OrchestratorService extends EventEmitter {
         // can never reach `maxRestarts` — which made the budget, the escalation
         // and the cool-down unreachable even once the restart itself worked. The
         // window is enforced by the policy, not by forgetting.
-        if (existing)
+        if (existing) {
             handle.restarts = existing.restarts;
+            handle.restartWindow = existing.restartWindow;
+        }
         this.handles.set(entry.name, handle);
         // Arm metrics sampling here — the one place an app enters the registry.
         //
@@ -777,16 +883,20 @@ export class OrchestratorService extends EventEmitter {
         this.ensureMetricsPolling();
         this.logger.info({ app: entry.name, mode }, 'Starting app');
         try {
-            if (mode === 'classic') {
-                await this.launchClassicMode(entry, handle, cfg);
-            }
-            else {
-                await this.launchBootstrapMode(entry, handle, cfg);
+            if (entry.releaseRoot) {
+                // Bootstrap metadata executes application code. Authenticate the sealed
+                // tree before introspection on initial launches as well as resumes.
+                handle.release = await verifyLaunchRelease(entry, handle.generation, [installedExecutable(entry, this.cwd)]);
+                requireInstalledBinding(handle.release, installedEntryRevision(entry, cfg, this.cwd), installed);
             }
+            const launch = mode === 'classic' ? await this.launchClassicMode(entry, handle, cfg, installed)
+                : await this.launchBootstrapMode(entry, handle, cfg, installed);
             // «App started» only for an app that is. It was logged in the same
             // millisecond as a child's «Process failed to start», for an app whose
             // processes never all came up.
             if (handle.status === 'online') {
+                if (launch)
+                    this.installedLaunches.set(handle, { binding: Object.freeze(launch), config: cfg });
                 this.logger.info({ app: entry.name, pid: handle.pid, mode }, 'App started');
             }
             else {
@@ -811,11 +921,24 @@ export class OrchestratorService extends EventEmitter {
             // The counter is bumped by hand because `markErrored()` deliberately
             // does not (an app that never ran has not "restarted"), and without it
             // the budget below can never trip and the retry would be unbounded.
+            // A rejected topology is not a partially running application. Keep
+            // resource ownership if cleanup fails so a later stop can retry it.
+            handle.markStopping();
+            let failure = err;
+            try {
+                await this.tearDownApp(handle);
+                handle.markStopped();
+            }
+            catch (cleanupError) {
+                failure = new AggregateError([err, cleanupError], `Application '${entry.name}' startup failed and cleanup is incomplete: ${String(err)}; ${String(cleanupError)}`);
+            }
             handle.markErrored();
+            handle.recordExit({ code: null, signal: null, expected: false, message: String(failure) });
             handle.restarts++;
             this.persistState();
-            this.scheduleRecovery(entry, handle, cfg);
-            throw err;
+            if (!installed)
+                this.scheduleRecovery(entry, handle, cfg);
+            throw failure;
         }
     }
     /**
@@ -827,13 +950,14 @@ export class OrchestratorService extends EventEmitter {
      * `topologyPools` — so `supervisor.stop()` never reached them, and nothing
      * in the orchestrator destroyed a pool: only the daemon's own shutdown did.
      * Every restart of an app with `instances > 1` left the previous workers
-     * running. On daos/test (2026-09-25): priceverse's `ohlcv-aggregator` and
+     * running. On sample/test (2026-09-25): quotes's `ohlcv-aggregator` and
      * storage's `transform` in three generations at once.
      *
      * The pools go even when the supervisor's stop throws: a stop that failed
      * half-way must not also leave the half nobody asked about.
      */
     async tearDownProcesses(handle, force = false, timeout = 10_000) {
+        const failures = [];
         try {
             if (handle.mode === 'bootstrap' && handle.supervisor) {
                 await handle.supervisor.stop();
@@ -842,58 +966,472 @@ export class OrchestratorService extends EventEmitter {
                 await this.stopChildProcess(handle, force, timeout);
             }
         }
-        finally {
-            for (const [name, pool] of handle.topologyPools) {
-                try {
-                    await pool.destroy();
-                }
-                catch (err) {
-                    this.logger.warn({ app: handle.name, pool: name, error: err.message }, 'Destroying a topology pool failed — its workers may still run');
-                }
+        catch (error) {
+            failures.push(error);
+        }
+        for (const [name, pool] of handle.topologyPools) {
+            try {
+                await pool.destroy();
+                handle.topologyPools.delete(name);
+            }
+            catch (error) {
+                failures.push(error);
+                this.logger.error({ app: handle.name, pool: name, error: String(error) }, 'Pool termination unconfirmed; retaining ownership for retry');
             }
-            handle.topologyPools.clear();
+        }
+        if (failures.length) {
+            throw new AggregateError(failures, `Application stop incomplete: ${failures.map(String).join('; ')}`);
         }
     }
-    /**
-     * Give back every service an app exposed on the daemon's Netron.
-     *
-     * A registration outlives the process behind it: the daemon keeps answering
-     * `queryInterface` with the full method list and every call through the name
-     * fails at the socket. `takeOverExisting` rescues a name the next launch
-     * re-exposes; one it does not stays advertised for the life of the daemon.
-     */
+    /** Close only the listener and registrations owned by this launch. */
     async releaseExposedServices(handle) {
-        if (!handle.serviceRouter)
+        if (!handle.topology)
             return;
+        await handle.topology.close();
+        handle.topology = null;
+    }
+    async tearDownApp(handle, force = false, timeout = 10_000) {
+        const failures = [];
         try {
-            await handle.serviceRouter.releaseAll();
+            await this.releaseExposedServices(handle);
         }
-        catch (err) {
-            this.logger.warn({ app: handle.name, error: err.message }, 'Releasing exposed services failed — the daemon may still advertise them');
+        catch (error) {
+            failures.push(error);
+        }
+        try {
+            await this.tearDownProcesses(handle, force, timeout);
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        if (failures.length)
+            throw new AggregateError(failures, `Application '${handle.name}' stop incomplete: ${failures.map(String).join('; ')}`);
+    }
+    /** Historical launch identity stays private to the handle; membership changes can invalidate its live release observation. */
+    installedLaunches = new WeakMap();
+    executionOperations = new Map();
+    getExecutionCapabilities() { return OWNER_CAPABILITIES; }
+    executionBusy(name) {
+        return [...this.executionOperations.keys()].some(key => name === key || name.startsWith(`${key}/`));
+    }
+    assertExecutionIdle(scope) {
+        const key = executionScopeKey(scope);
+        if ([...this.executionOperations.keys()].some(active => active === key || active.startsWith(`${key}/`) || key.startsWith(`${active}/`))) {
+            throw new Error(`Execution scope '${key}' is busy; wait for its stop or reconciliation before starting another operation`);
+        }
+    }
+    /** One in-flight boundary for whole-stack and child-scope lifecycle mutations. */
+    executionOperation(scope, operationId, fingerprint, work) {
+        const key = executionScopeKey(scope);
+        if (typeof operationId !== 'string' || !/^[a-f0-9-]{36}$/.test(operationId))
+            throw new Error('Invalid execution operation identity');
+        const active = this.executionOperations.get(key);
+        if (active?.id === operationId && active.fingerprint === fingerprint)
+            return active.promise;
+        this.assertExecutionIdle(scope);
+        // Reserve before invoking work, including its synchronous checks and first write.
+        const promise = Promise.resolve().then(work).finally(() => this.executionOperations.delete(key));
+        this.executionOperations.set(key, { id: operationId, fingerprint, promise });
+        return promise;
+    }
+    /**
+     * Reconcile an explicitly selected graph behind its durable stop fence.
+     * This neither stops nor starts a process and never deletes logs or artifacts.
+     * The controller's existing release selection remains the desired-state source.
+     */
+    reconcileStoppedStack(request) {
+        const input = structuredClone(request);
+        const { plan, entries, operationId } = input;
+        const key = stackExecutionKey(plan);
+        if (plan.application !== undefined || plan.phase !== 'stopped') {
+            throw new Error('Stack reconciliation requires a completed whole-stack stop');
+        }
+        if (!Array.isArray(entries))
+            throw new Error('Stack reconciliation requires the complete target graph');
+        const target = new Map();
+        for (const entry of entries) {
+            if (!entry || typeof entry.name !== 'string' || !entry.name.startsWith(`${key}/`) ||
+                executionScopeKey({ ...plan, application: entry.name.slice(key.length + 1) }) !== entry.name || target.has(entry.name)) {
+                throw new Error('Stack reconciliation requires unique canonical applications inside its scope');
+            }
+            target.set(entry.name, entry);
+        }
+        const fingerprint = topologyRevision({ kind: 'reconcile', ...input });
+        return this.executionOperation(plan, operationId, fingerprint, async () => {
+            if (topologyRevision(this.stackExecutionPlan(plan)) !== topologyRevision(plan)) {
+                throw new Error('Stack changed; inspect its stopped generations before reconciling');
+            }
+            const retained = plan.apps.map(app => {
+                const handle = this.handles.get(app.name);
+                return { handle, definition: handle.definitionRevision };
+            });
+            const assertStopped = () => {
+                if (this.stoppingApps)
+                    throw new Error('Global application shutdown is active; wait before reconciling the stack');
+                for (const { handle, definition } of retained) {
+                    if (this.handles.get(handle.name) !== handle || handle.definitionRevision !== definition ||
+                        handle.status !== 'stopped' || handle.pid !== null || handle.childProcess || handle.supervisor ||
+                        handle.topology || handle.topologyPools.size || this.restartCoalescer.get(handle.name)?.inFlight) {
+                        throw new Error(`Application '${handle.name}' is not the reviewed, fully stopped generation`);
+                    }
+                }
+            };
+            assertStopped();
+            // Revoke old plans durably before changing watchers or the retained inventory.
+            const intent = this.stateStore.updateStackIntent(plan, current => {
+                if (current.phase !== 'stopped' || current.revision !== plan.revision || current.revision === Number.MAX_SAFE_INTEGER) {
+                    throw new Error('Stack stop changed before reconciliation');
+                }
+                return { phase: 'stopped', revision: current.revision + 1, operationId, fingerprint };
+            });
+            for (const { handle } of retained)
+                await this.discardSourceBuild(handle.name);
+            assertStopped();
+            const expected = { ...plan, revision: intent.revision };
+            if (topologyRevision(this.stackExecutionPlan(plan)) !== topologyRevision(expected)) {
+                throw new Error('Stack changed during reconciliation; it has not been enabled');
+            }
+            const retired = [];
+            // No await between final validation and the complete inventory change.
+            for (const { handle } of retained) {
+                const entry = target.get(handle.name);
+                if (entry)
+                    handle.redefine(entry);
+                else {
+                    this.handles.delete(handle.name);
+                    this.clearCoolDown(handle.name);
+                    this.restartCoalescer.delete(handle.name);
+                    this.appStopIntents.delete(handle.name);
+                    retired.push(handle.name);
+                }
+            }
+            this.persistState();
+            for (const name of retired) {
+                this.emit('app:retired', name);
+                this.metricsBridge?.evictApp(name);
+            }
+            await this.stateStore.flush();
+            this.logger.info({ project: plan.project, stack: plan.stack, revision: intent.revision, retired }, 'Stopped stack membership reconciled');
+            return { project: plan.project, stack: plan.stack, revision: intent.revision, retired,
+                retained: retained.filter(({ handle }) => target.has(handle.name)).map(({ handle }) => handle.name),
+                added: [...target.keys()].filter(name => !plan.apps.some(app => app.name === name)), observedAt: new Date().toISOString() };
+        });
+    }
+    /** The owner supplies generations; backend caches cannot establish stop authority. */
+    async inspectStackExecution(scope) {
+        return this.stackExecutionPlan(scope);
+    }
+    stackExecutionPlan(scope) {
+        return this.executionPlan({ project: scope.project, stack: scope.stack });
+    }
+    async inspectExecution(scope) {
+        return this.executionPlan(scope);
+    }
+    executionPlan(scope) {
+        const key = executionScopeKey(scope);
+        const names = this.listHandleNames().filter(name => executionScopeOwns(scope, name)).sort();
+        if (scope.application !== undefined && names.length !== 1)
+            throw new Error(`Application '${key}' is not retained by this owner`);
+        if (names.some(name => this.lifecycleQueue.isBusy(name)) ||
+            [...this.startingApps.keys()].some(name => executionScopeOwns(scope, name))) {
+            throw new Error(`Execution scope '${key}' has active application operations; retry after they finish`);
+        }
+        const { revision, phase } = this.stateStore.getExecutionIntent(scope);
+        const parent = scope.application !== undefined ? this.stateStore.getStackIntent(scope) : undefined;
+        if (parent?.phase === 'stopping' || parent?.phase === 'starting')
+            throw new Error('Parent stack has an unfinished operation');
+        return { project: scope.project, stack: scope.stack, revision, phase,
+            ...(scope.application !== undefined && { application: scope.application, parentRevision: parent.revision }),
+            apps: names.map(name => ({ name, generation: this.handles.get(name).generation })) };
+    }
+    retainedApp(name, generation) {
+        const handle = this.handles.get(name);
+        if (!handle || handle.generation !== generation || handle.status !== 'stopped' || handle.pid !== null ||
+            handle.childProcess || handle.supervisor || handle.topology || handle.topologyPools.size) {
+            throw new Error(`Application '${name}' is not the retained stopped generation`);
+        }
+        const bare = effectiveAppName(name);
+        if (this.handles.has(bare) || this.startingApps.has(bare) || this.lifecycleQueue.isBusy(bare) ||
+            this.buildResults.has(name) || !handle.entry.releaseRoot || !path.isAbsolute(handle.entry.cwd ?? '') ||
+            (handle.entry.bootstrap && !handle.entry.env?.['OMNITRON_STACK'])) {
+            throw new Error(`Application '${name}' requires an unambiguous precompiled installed release with retained launch configuration`);
+        }
+        const launch = this.installedLaunches.get(handle);
+        if (!launch)
+            throw new Error(`Application '${name}' has no verified installed launch recorded for its generation`);
+        if (launch.binding.entrySha256 !== installedEntryRevision(handle.entry, launch.config, this.cwd)) {
+            throw new Error(`Application '${name}' launch configuration changed since its verified launch`);
+        }
+        return { handle, ...launch };
+    }
+    /** A stopped intent is insufficient if its handles or their launch inputs disappeared. */
+    async inspectInstalledStack(scope) {
+        const plan = this.stackExecutionPlan(scope);
+        if (plan.phase !== 'stopped' || !plan.apps.length)
+            throw new Error('Installed stack start requires a completed stop with retained applications');
+        for (const item of plan.apps)
+            this.assertApplicationFence(item.name);
+        const apps = [];
+        for (const item of plan.apps) {
+            const { handle, binding } = this.retainedApp(item.name, item.generation);
+            const entry = handle.entry;
+            const executable = installedExecutable(entry, this.cwd);
+            const paths = [executable, ...(handle.topologyProcesses ?? []).map(child => path.resolve(path.dirname(executable), child.module))];
+            const release = await verifyLaunchRelease(entry, item.generation, paths);
+            requireInstalledBinding(release, binding.entrySha256, binding);
+            apps.push({ ...item, installed: { ...binding } });
+        }
+        for (const item of plan.apps)
+            this.retainedApp(item.name, item.generation);
+        if (topologyRevision(this.stackExecutionPlan(scope)) !== topologyRevision(plan)) {
+            throw new Error('Installed stack changed during inspection; prepare a new start');
+        }
+        return { ...plan, apps };
+    }
+    async openInstalledStack({ operationId, plan }) {
+        if (typeof operationId !== 'string' || !/^[a-f0-9-]{36}$/.test(operationId))
+            throw new Error('Invalid start operation identity');
+        this.assertExecutionIdle(plan);
+        const observed = this.stackExecutionPlan(plan);
+        if (observed.phase !== 'stopped' || plan.phase !== 'stopped' || observed.revision !== plan.revision ||
+            !observed.apps.length || observed.apps.length !== plan.apps.length ||
+            observed.apps.some((item, index) => {
+                const expected = plan.apps[index];
+                if (!expected?.installed || expected.name !== item.name || expected.generation !== item.generation)
+                    return true;
+                return topologyRevision(this.retainedApp(item.name, item.generation).binding) !== topologyRevision(expected.installed);
+            }))
+            throw new Error('Installed stack changed; prepare a new start');
+        for (const item of plan.apps)
+            this.assertApplicationFence(item.name);
+        const fingerprint = topologyRevision(plan);
+        this.stateStore.updateStackIntent(plan, current => {
+            if (current.phase !== 'stopped' || current.revision !== plan.revision || current.revision === Number.MAX_SAFE_INTEGER) {
+                throw new Error('Installed stack stop is no longer current');
+            }
+            return { phase: 'starting', revision: current.revision + 1, operationId, fingerprint, remaining: plan.apps.map(app => app.name) };
+        });
+    }
+    async resumeInstalledApp({ operationId, plan, name }) {
+        const app = plan.apps.find(item => item.name === name);
+        if (!app?.installed || !name.startsWith(`${stackExecutionKey(plan)}/`))
+            throw new Error('Application is outside the prepared installed stack');
+        const expected = app.installed;
+        const fingerprint = topologyRevision(plan);
+        const stopGeneration = this.stopGeneration;
+        const stopRevision = this.appStopIntents.get(name)?.revision;
+        await this.lifecycleQueue.enqueue(name, 'start', async () => {
+            const { handle, config } = this.retainedApp(name, app.generation);
+            const entry = structuredClone(handle.entry);
+            if (this.stoppingApps || this.stopGeneration !== stopGeneration ||
+                installedEntryRevision(entry, config, this.cwd) !== expected.entrySha256) {
+                throw new Error('Installed start admission changed');
+            }
+            // Reserve before the first effect. A crash or lost reply cannot authorize a second attempt.
+            this.stateStore.updateStackIntent(plan, current => {
+                if (current.phase !== 'starting' || current.operationId !== operationId || current.fingerprint !== fingerprint ||
+                    current.pendingApp || !current.remaining?.includes(name))
+                    throw new Error('Installed start is stale, busy or already consumed');
+                return { ...current, pendingApp: name };
+            });
+            await this.ensureBootReconciled(config);
+            this.retainedApp(name, app.generation);
+            // Introspection loads bootstrap code. Verify it before reading the process topology;
+            // the final launch verification binds the child modules discovered there.
+            if (entry.bootstrap) {
+                const evidence = await verifyLaunchRelease(entry, app.generation, [installedExecutable(entry, this.cwd)]);
+                requireInstalledBinding(evidence, installedEntryRevision(entry, config, this.cwd), expected);
+                this.retainedApp(name, app.generation);
+            }
+            if (this.stoppingApps || this.stopGeneration !== stopGeneration ||
+                stopRevision !== this.appStopIntents.get(name)?.revision)
+                throw new Error('Stop interrupted installed start admission');
+            const intent = this.appStopIntents.get(name);
+            if (intent)
+                intent.stopped = false;
+            const started = await this.startAppInternal(entry, config, expected);
+            if (started.status !== 'online')
+                throw new Error(`Installed application '${name}' did not come online`);
+            requireInstalledBinding(started.release, installedEntryRevision(started.entry, config, this.cwd), expected);
+            this.stateStore.updateStackIntent(plan, current => {
+                if (current.phase !== 'starting' || current.operationId !== operationId || current.fingerprint !== fingerprint ||
+                    current.pendingApp !== name)
+                    throw new Error('Installed start was superseded');
+                const remaining = current.remaining.filter(item => item !== name);
+                if (!remaining.length && plan.apps.some(item => this.handles.get(item.name)?.status !== 'online')) {
+                    throw new Error('Installed start incomplete: previously started application is no longer online');
+                }
+                return remaining.length ? { phase: 'starting', revision: current.revision, operationId, fingerprint, remaining }
+                    : { phase: 'running', revision: current.revision };
+            });
+        });
+    }
+    async enableStackExecution(scope, options = {}) {
+        return this.enableExecution({ project: scope.project, stack: scope.stack }, options);
+    }
+    async enableExecution(scope, options = {}) {
+        const key = executionScopeKey(scope);
+        this.assertExecutionIdle(scope);
+        if (scope.application !== undefined && this.stateStore.getStackIntent(scope).phase !== 'running') {
+            throw new Error('Parent stack must be running before admitting an application start');
+        }
+        this.stateStore.updateExecutionIntent(scope, current => {
+            if (scope.application !== undefined && (!Number.isSafeInteger(options.expectedRevision) || options.expectedRevision !== current.revision)) {
+                throw new Error('Application execution intent changed; inspect it before admitting a start');
+            }
+            if (current.phase === 'starting')
+                throw new Error(`Stack '${key}' has an unfinished installed start; inspect and stop it before starting again`);
+            if (current.phase === 'stopping')
+                throw new Error(`Stack '${key}' has an unconfirmed stop; complete it before starting`);
+            if (current.phase === 'running')
+                return current;
+            if (options.automatic)
+                throw new Error(`Stack '${key}' was deliberately stopped; an explicit stack start is required`);
+            if (current.revision === Number.MAX_SAFE_INTEGER)
+                throw new Error('Stack execution revision exhausted');
+            return { revision: current.revision + 1, phase: 'running' };
+        });
+    }
+    stopStackExecution(request) {
+        if (request.plan.application !== undefined)
+            throw new Error('Use the scoped execution contract for an application stop');
+        return this.stopExecution(request);
+    }
+    stopExecution(request) {
+        const fingerprint = topologyRevision({ kind: 'stop', plan: request.plan });
+        return this.executionOperation(request.plan, request.operationId, fingerprint, () => this.stopExecutionNow(request));
+    }
+    async stopExecutionNow({ operationId, plan }) {
+        const key = executionScopeKey(plan);
+        const fingerprint = createHash('sha256').update(JSON.stringify(plan)).digest('hex');
+        const prior = this.stateStore.getExecutionIntent(plan);
+        const retry = prior.operationId === operationId && prior.fingerprint === fingerprint;
+        if (prior.operationId === operationId && !retry)
+            throw new Error('Stop operation identity was reused with different arguments');
+        if (!retry) {
+            const observed = this.executionPlan(plan);
+            if (JSON.stringify(observed) !== JSON.stringify(plan))
+                throw new Error(`Stack '${key}' changed; prepare a new stop`);
+        }
+        // A durable stop fence also covers crash recovery and file-watch restarts.
+        // No newly admitted start may pass it while this operation awaits exits.
+        const assertParent = () => {
+            if (plan.application === undefined)
+                return;
+            const parent = this.stateStore.getStackIntent(plan);
+            if (parent.revision !== plan.parentRevision || parent.phase === 'starting' || parent.phase === 'stopping') {
+                throw new Error('Parent stack intent changed; inspect before retrying the application operation');
+            }
+        };
+        assertParent();
+        const intent = this.stateStore.updateExecutionIntent(plan, current => {
+            if (current.operationId === operationId && current.fingerprint === fingerprint)
+                return current;
+            if (current.revision !== plan.revision)
+                throw new Error(`Stack '${key}' intent changed; prepare a new stop`);
+            if (current.revision === Number.MAX_SAFE_INTEGER)
+                throw new Error('Stack execution revision exhausted');
+            return { revision: current.revision + 1, phase: 'stopping', operationId, fingerprint };
+        });
+        const failures = [];
+        for (const expected of [...plan.apps].reverse()) {
+            assertParent();
+            const handle = this.handles.get(expected.name);
+            if (!executionScopeOwns(plan, expected.name) || !handle || handle.generation !== expected.generation) {
+                failures.push(new Error(`Application '${expected.name}' changed generation; inspect before retrying`));
+                continue;
+            }
+            try {
+                await this.stopApp(expected.name);
+            }
+            catch (error) {
+                failures.push(error);
+            }
+        }
+        const survivors = this.listHandleNames().filter(name => executionScopeOwns(plan, name) && this.handles.get(name)?.status !== 'stopped');
+        if (survivors.length)
+            failures.push(new Error(`Exit unconfirmed for: ${survivors.join(', ')}`));
+        if (failures.length)
+            throw new AggregateError(failures, `Stack '${key}' stop incomplete: ${failures.map(String).join('; ')}`);
+        assertParent();
+        this.stateStore.updateExecutionIntent(plan, current => {
+            if (current.revision !== intent.revision || current.operationId !== operationId)
+                throw new Error('Stack stop authority changed');
+            return { ...current, phase: 'stopped' };
+        });
+        return { project: plan.project, stack: plan.stack, operationId, revision: intent.revision,
+            ...(plan.application !== undefined && { application: plan.application }),
+            stopped: plan.apps.map(app => app.name), observedAt: new Date().toISOString() };
+    }
+    assertAppStartAllowed(name) {
+        const parts = name.split('/');
+        // Stack stops own the whole prefix, including retained legacy nested names.
+        // Admission must enforce the same boundary before recovery or watch can restart them.
+        if (parts.length < 3)
+            return;
+        const scope = { project: parts[0], stack: parts[1] };
+        this.assertExecutionIdle({ ...scope, ...(parts.length === 3 && { application: parts[2] }) });
+        const phase = this.stateStore.getStackIntent(scope).phase;
+        if (phase === 'starting')
+            throw new Error(`Stack '${stackExecutionKey(scope)}' has an unfinished installed stack start; inspect its receipt and stop before retrying`);
+        if (phase !== 'running') {
+            throw new Error(`Stack '${stackExecutionKey(scope)}' is stopped or stopping; use stack start after confirming its stop`);
+        }
+        this.assertApplicationFence(name);
+    }
+    assertApplicationFence(name) {
+        const parts = name.split('/');
+        if (parts.length !== 3)
+            return;
+        const scope = { project: parts[0], stack: parts[1], application: parts[2] };
+        if (this.stateStore.getExecutionIntent(scope).phase !== 'running') {
+            throw new Error(`Application '${name}' is fenced; inspect and explicitly admit its start`);
         }
-        handle.serviceRouter = null;
     }
     async stopApp(name, force = false, timeout = 10_000) {
         const canonical = this.resolveAppName(name) ?? name;
         // Outside the queue on purpose: the operator's intent lands the
         // moment the command arrives, not whenever the queue drains.
+        // Unknown names need no retained intent. Start admission registers its
+        // token before its first await, including before a handle exists.
+        if (this.handles.has(canonical) || this.appStopIntents.has(canonical)) {
+            this.appStopIntents.set(canonical, {
+                revision: (this.appStopIntents.get(canonical)?.revision ?? 0) + 1,
+                stopped: true,
+            });
+        }
         this.clearCoolDown(canonical);
+        const restart = this.restartCoalescer.get(canonical);
+        if (restart) {
+            restart.manualSerial = 0;
+            restart.watchSerial = 0;
+            restart.cooldownUntil = 0;
+        }
         return this.lifecycleQueue.enqueue(canonical, 'stop', async () => {
             const handle = this.handles.get(canonical);
-            if (!handle || handle.status === 'stopped')
+            if (!handle || (handle.status === 'stopped' && !handle.topology && !handle.supervisor && !handle.childProcess && handle.topologyPools.size === 0))
                 return;
             handle.markStopping();
-            // Unexpose topology services from daemon Netron before stopping processes
-            await this.releaseExposedServices(handle);
-            await this.tearDownProcesses(handle, force, timeout);
+            await this.tearDownApp(handle, force, timeout);
             handle.markStopped();
             this.persistState();
             this.logger.info({ app: name }, 'App stopped');
         });
     }
-    async stopAll(force = false) {
-        if (!this.config)
-            return 0;
+    stopAll(force = false) {
+        if (this.stoppingApps)
+            return this.stoppingApps;
+        this.stopGeneration++;
+        for (const name of this.coolDownTimers.keys())
+            this.clearCoolDown(name);
+        const operation = Promise.resolve().then(() => this.stopAllOnce(force));
+        this.stoppingApps = operation;
+        const settled = () => { if (this.stoppingApps === operation)
+            this.stoppingApps = null; };
+        void operation.then(settled, settled);
+        return operation;
+    }
+    async stopAllOnce(force) {
         if (this.metricsTimer) {
             clearInterval(this.metricsTimer);
             this.metricsTimer = null;
@@ -904,34 +1442,65 @@ export class OrchestratorService extends EventEmitter {
             this.janitor.stop();
         }
         let count = 0;
+        const failures = [];
         // When force=true (daemon shutdown), use short timeout per app (3s SIGTERM, then SIGKILL)
         const perAppTimeout = force ? 3_000 : 10_000;
-        for (const batch of resolveShutdownOrder(this.config.apps)) {
+        // Registered projects need not belong to the daemon's root ecosystem.
+        // Ownership is defined by handles, not by whichever config booted first.
+        // Drain admitted starts before taking the shutdown graph snapshot.
+        await Promise.allSettled([...this.startingApps.values()]);
+        const entries = [...this.handles.values()].map((handle) => handle.entry);
+        const names = new Set(entries.map((entry) => entry.name));
+        const graph = entries.map((entry) => {
+            const scope = entry.name.slice(0, entry.name.lastIndexOf('/') + 1);
+            return {
+                ...entry,
+                dependsOn: (entry.dependsOn ?? []).flatMap((dependency) => {
+                    const name = !dependency.includes('/') && names.has(scope + dependency)
+                        ? scope + dependency : dependency;
+                    // A dependency never started here has no owned process to stop.
+                    return names.has(name) ? [name] : [];
+                }),
+            };
+        });
+        let batches;
+        try {
+            batches = resolveShutdownOrder(graph);
+        }
+        catch (error) {
+            // Invalid reconfiguration must not turn shutdown into leaked children.
+            this.logger.error({ error: error.message }, 'Invalid shutdown graph; stopping every owned app');
+            batches = [entries];
+        }
+        for (const batch of batches) {
             await Promise.all(batch.map(async (entry) => {
                 try {
                     await this.stopApp(entry.name, force, perAppTimeout);
                     count++;
                 }
                 catch (err) {
+                    failures.push(new Error(`Application '${entry.name}' stop failed: ${String(err)}`, { cause: err }));
                     this.logger.error({ app: entry.name, error: err.message }, 'Failed to stop');
                 }
             }));
         }
-        try {
-            await this.pm.shutdown({ force, timeout: force ? 5_000 : 30_000 });
-        }
-        catch {
-            /* PM may have nothing left to clean up */
-        }
+        // Stop-all is a reversible application operation. The resident owner (or
+        // Titan lifecycle) owns terminal ProcessManager shutdown, including workers
+        // outside application handles. Keeping that boundary permits startAll later.
         // Dispose esbuild watch contexts
         if (this.buildService) {
             try {
                 await this.buildService.dispose();
+                this.buildService = null;
+            }
+            catch (error) {
+                failures.push(error);
             }
-            catch { /* best-effort */ }
-            this.buildService = null;
         }
         this.buildResults.clear();
+        this.bootstrapSources.clear();
+        if (failures.length)
+            throw new AggregateError(failures, `Application shutdown incomplete: ${failures.map(String).join('; ')}`);
         return count;
     }
     /**
@@ -940,11 +1509,23 @@ export class OrchestratorService extends EventEmitter {
      * `restartApp` starts from this. `false` when nothing by that name runs
      * here. See `AppHandle.redefine`.
      */
-    redefineApp(name, entry) {
+    async redefineApp(name, entry) {
         const handle = this.handles.get(this.resolveAppName(name) ?? name);
         if (!handle)
             return false;
+        const [project, stack, app] = handle.name.split('/');
+        if (project && stack && app)
+            this.assertExecutionIdle({ project, stack });
+        if (project && stack && app && this.stateStore.getStackIntent({ project, stack }).phase === 'starting') {
+            throw new Error('An installed stack start is active; its application entry cannot be changed');
+        }
         handle.redefine(entry);
+        if (!this.allowsWatch(entry)) {
+            const state = this.restartCoalescer.get(handle.name);
+            if (state)
+                state.watchSerial = 0;
+        }
+        await this.syncBootstrapWatch(handle.name);
         return true;
     }
     /**
@@ -980,7 +1561,7 @@ export class OrchestratorService extends EventEmitter {
      * triggers, just continuations — they must not bump or the trailing
      * coalesced restart would re-fire forever.
      */
-    async restartAppCoalesced(name, fromExternal) {
+    async restartAppCoalesced(name, fromExternal, cause = 'manual') {
         const canonical = this.resolveAppName(name) ?? name;
         const handle = this.handles.get(canonical);
         if (!handle) {
@@ -1036,10 +1617,21 @@ export class OrchestratorService extends EventEmitter {
             throw new Error(`Unknown app: ${name}`);
         }
         name = canonical;
+        this.assertAppStartAllowed(name);
         const state = this.getCoalescerState(name);
-        if (fromExternal)
+        if (fromExternal) {
             state.triggerSerial += 1;
-        const observedSerial = state.triggerSerial;
+            if (cause === 'watch')
+                state.watchSerial = state.triggerSerial;
+            else
+                state.manualSerial = state.triggerSerial;
+        }
+        if (!this.allowsWatch(handle.entry) || ['errored', 'crashed', 'stopped', 'stopping'].includes(handle.status)) {
+            state.watchSerial = 0;
+        }
+        const observedSerial = Math.max(state.manualSerial, state.watchSerial);
+        if (observedSerial <= state.firedSerial)
+            return handle;
         // Cooldown: the app reported online recently. Wait it out, then
         // proceed as a non-external continuation (we already counted this
         // trigger when we first arrived).
@@ -1068,7 +1660,7 @@ export class OrchestratorService extends EventEmitter {
         }
         // Take the slot. Capture which serial this run is consuming —
         // anything bumped after this is the next run's problem.
-        const consumedSerial = state.triggerSerial;
+        const consumedSerial = observedSerial;
         const promise = this.restartAppNow(name);
         state.inFlight = promise;
         try {
@@ -1084,7 +1676,7 @@ export class OrchestratorService extends EventEmitter {
             // trigger arrived between when we claimed the slot and now.
             // Two coalescer arms colliding can no longer cause this branch
             // to fire because they don't bump triggerSerial.
-            if (state.triggerSerial > consumedSerial) {
+            if (Math.max(state.manualSerial, state.watchSerial) > consumedSerial) {
                 this.restartAppCoalesced(name, /* fromExternal */ false).catch((err) => {
                     this.logger.error({ app: name, error: err.message }, 'Trailing coalesced restart failed');
                 });
@@ -1130,17 +1722,28 @@ export class OrchestratorService extends EventEmitter {
         const handle = this.handles.get(name);
         if (!handle)
             throw new Error(`Unknown app: ${name}`);
+        this.assertAppStartAllowed(name);
         const entry = handle.entry;
+        const definitionRevision = handle.definitionRevision;
         if (this.devMode && entry.bootstrap) {
             clearCacheFor(path.resolve(entry.cwd ?? this.cwd, entry.bootstrap));
         }
-        await this.stopApp(name);
+        const stopped = this.stopApp(name);
+        const intent = this.appStopIntents.get(name);
+        const generation = this.stopGeneration;
+        await stopped;
+        if (this.stoppingApps || generation !== this.stopGeneration || intent !== this.appStopIntents.get(name)) {
+            throw new Error('Application stop interrupted restart');
+        }
+        if (this.handles.get(name) !== handle || handle.definitionRevision !== definitionRevision || handle.entry !== entry) {
+            throw new Error(`Application '${name}' definition changed while stopping; restart was cancelled. Inspect the current definition and start it explicitly.`);
+        }
         return this.startApp(entry);
     }
     getCoalescerState(name) {
         let state = this.restartCoalescer.get(name);
         if (!state) {
-            state = { inFlight: null, triggerSerial: 0, firedSerial: 0, cooldownUntil: 0 };
+            state = { inFlight: null, triggerSerial: 0, firedSerial: 0, manualSerial: 0, watchSerial: 0, cooldownUntil: 0 };
             this.restartCoalescer.set(name, state);
         }
         return state;
@@ -1179,7 +1782,7 @@ export class OrchestratorService extends EventEmitter {
         // is the one with that address. Falling through to the short-name match
         // answered a question about one deployment with another's data:
         //
-        //     omnitron logs daos/deployed/main   →  daos/dev/main
+        //     omnitron logs sample/deployed/main   →  sample/dev/main
         //
         // — the node's app asked for, this laptop's app printed, with nothing
         // said. `startApp` already refuses this for the same reason ("a
@@ -1215,6 +1818,7 @@ export class OrchestratorService extends EventEmitter {
         if (!handle)
             throw new Error(`Unknown app: ${name}`);
         name = canonical;
+        this.assertAppStartAllowed(name);
         // Classic mode or no supervisor — cannot do zero-downtime, fall back to restart
         if (handle.mode !== 'bootstrap' || !handle.supervisor) {
             return this.restartApp(name);
@@ -1223,33 +1827,39 @@ export class OrchestratorService extends EventEmitter {
         if (childNames.length === 0) {
             return this.restartApp(name);
         }
-        this.logger.info({ app: name, children: childNames.length }, 'Zero-downtime reload starting');
-        // For each child process, do a rolling restart via the supervisor.
-        // The supervisor's restartChild stops the old child and starts a new one.
-        // For pool children, the pool handles draining automatically.
-        // We restart one child at a time to maintain availability.
-        for (const childName of childNames) {
-            this.logger.info({ app: name, child: childName }, 'Reloading child process');
-            try {
-                await handle.supervisor.restartChild(childName);
-                // Wait for the new child to become healthy
-                const health = await this.waitForChildHealth(handle, childName, 30_000);
-                if (!health) {
-                    this.logger.warn({ app: name, child: childName }, 'Child did not become healthy after reload — continuing with remaining children');
+        return this.lifecycleQueue.enqueue(name, 'restart', async () => {
+            this.assertAppStartAllowed(name);
+            if (this.handles.get(name) !== handle)
+                throw new Error('Application changed while queued; retry the operation');
+            this.logger.info({ app: name, children: childNames.length }, 'Zero-downtime reload starting');
+            handle.invalidateRelease();
+            // For each child process, do a rolling restart via the supervisor.
+            // The supervisor's restartChild stops the old child and starts a new one.
+            // For pool children, the pool handles draining automatically.
+            // We restart one child at a time to maintain availability.
+            for (const childName of childNames) {
+                this.logger.info({ app: name, child: childName }, 'Reloading child process');
+                try {
+                    await handle.supervisor.restartChild(childName);
+                    // Wait for the new child to become healthy
+                    const health = await this.waitForChildHealth(handle, childName, 30_000);
+                    if (!health) {
+                        this.logger.warn({ app: name, child: childName }, 'Child did not become healthy after reload — continuing with remaining children');
+                    }
+                    this.logger.info({ app: name, child: childName }, 'Child reloaded successfully');
+                }
+                catch (err) {
+                    // `error: err`, not `error: err.message`: the logger aliases `error`
+                    // onto pino's error serializer, so the object arrives with its stack
+                    // and a string arrives as a string with nothing behind it.
+                    this.logger.error({ app: name, child: childName, error: err }, 'Failed to reload child — aborting zero-downtime reload');
+                    throw new Error(`Zero-downtime reload failed for '${name}' at child '${childName}': ${err.message}`, { cause: err });
                 }
-                this.logger.info({ app: name, child: childName }, 'Child reloaded successfully');
-            }
-            catch (err) {
-                // `error: err`, not `error: err.message`: the logger aliases `error`
-                // onto pino's error serializer, so the object arrives with its stack
-                // and a string arrives as a string with nothing behind it.
-                this.logger.error({ app: name, child: childName, error: err }, 'Failed to reload child — aborting zero-downtime reload');
-                throw new Error(`Zero-downtime reload failed for '${name}' at child '${childName}': ${err.message}`, { cause: err });
             }
-        }
-        this.logger.info({ app: name }, 'Zero-downtime reload complete');
-        this.persistState();
-        return handle;
+            this.logger.info({ app: name }, 'Zero-downtime reload complete');
+            this.persistState();
+            return handle;
+        });
     }
     /**
      * Wait for a child process to report healthy status within a timeout.
@@ -1276,29 +1886,58 @@ export class OrchestratorService extends EventEmitter {
     // ============================================================================
     // Scaling — delegates to PM supervisor
     // ============================================================================
-    async scaleApp(name, instances) {
-        const canonical = this.resolveAppName(name) ?? name;
+    async scaleApp(name, instances, process) {
+        const request = parsePoolScaleRequest({ name, instances, process });
+        const canonical = this.resolveAppName(request.name) ?? request.name;
+        assertPoolScaleTarget(this.getApp(canonical), request);
         const handle = this.handles.get(canonical);
-        if (!handle)
-            throw new Error(`Unknown app: ${name}`);
-        name = canonical;
-        if (!this.config)
-            throw new Error('Ecosystem config not loaded');
-        if (handle.mode !== 'bootstrap') {
-            this.logger.warn({ app: name }, 'Classic mode apps do not support scaling');
-            return handle;
-        }
-        if (instances < 1)
-            throw new Error('Instance count must be at least 1');
-        if (instances === handle.instanceCount)
+        const generation = handle.generation;
+        this.assertAppStartAllowed(canonical);
+        return this.lifecycleQueue.enqueue(canonical, 'restart', async () => {
+            this.assertAppStartAllowed(canonical);
+            if (this.handles.get(canonical) !== handle || handle.generation !== generation)
+                throw new Error('Application changed while queued; retry the operation');
+            assertPoolScaleTarget(this.getApp(canonical), request);
+            if (handle.status !== 'online')
+                throw Errors.conflict('Process pools can only be resized while the application is online');
+            const declaration = handle.topologyProcesses.find(item => item.name === request.process);
+            const pool = handle.topologyPools.get(request.process);
+            if (!pool)
+                throw Errors.conflict('Declared process pool is not running');
+            const declared = declaration.instances;
+            const automatic = declaration.scaling?.strategy === 'auto';
+            const minimum = automatic ? declared : 1;
+            const maximum = declaration.scaling?.maxInstances ?? (automatic ? declared * 4 : declared);
+            if (!Number.isSafeInteger(declared) || declared < 2 || !Number.isSafeInteger(maximum) || maximum < declared)
+                throw new Error('Process pool has invalid declared scaling limits');
+            if (request.instances < minimum || request.instances > maximum)
+                throw Errors.badRequest(`Process pool resize must stay within declared limits ${minimum}..${maximum}`);
+            if (pool.size === request.instances)
+                return handle;
+            this.logger.info({ app: canonical, process: request.process, from: pool.size, to: request.instances,
+                automatic, lifetime: 'until-restart' }, 'Resizing a declared process pool');
+            handle.invalidateRelease();
+            // PM owns membership serialization and waits for every admitted spawn/exit.
+            // The source declaration and installed entry remain unchanged. Automatic
+            // pools retain their policy and can subsequently resize within its limits.
+            await pool.scale(request.instances);
+            if (pool.size !== request.instances)
+                throw new Error('Process pool resize is unconfirmed; inspect its observed membership');
+            this.persistState(); // Observations only, never a durable desired-size override.
             return handle;
-        if (!handle.supervisor)
-            throw new Error(`No supervisor for app: ${name}`);
-        this.logger.info({ app: name, from: handle.instanceCount, to: instances }, 'Scaling app');
-        await handle.supervisor.scaleChild(name, instances);
-        handle.instanceCount = instances;
-        this.persistState();
-        return handle;
+        });
+    }
+    async restartAppChild(name, child) {
+        const canonical = this.resolveAppName(name) ?? name;
+        this.assertAppStartAllowed(canonical);
+        await this.lifecycleQueue.enqueue(canonical, 'restart', async () => {
+            this.assertAppStartAllowed(canonical);
+            const supervisor = this.handles.get(canonical)?.supervisor;
+            if (!supervisor)
+                throw new Error(`No supervisor for '${canonical}'`);
+            this.handles.get(canonical)?.invalidateRelease();
+            await supervisor.restartChild(child);
+        });
     }
     // ============================================================================
     // Information
@@ -1379,7 +2018,7 @@ export class OrchestratorService extends EventEmitter {
     }
     /**
      * `name` is resolved like every other per-app question (`main` finds
-     * `daos/dev/main`); it was compared verbatim, so `omnitron metrics main`
+     * `sample/dev/main`); it was compared verbatim, so `omnitron metrics main`
      * printed «(no data)». An unknown name answers `{}`, and the caller says so.
      */
     async getMetrics(name) {
@@ -1404,12 +2043,19 @@ export class OrchestratorService extends EventEmitter {
         }
         return result;
     }
+    configureReadiness(declarations) {
+        this.readinessMonitor.configure(declarations);
+    }
+    hasDeclaredReadiness(name) {
+        const handle = this.getHandle(name);
+        return Boolean(handle && this.readinessMonitor.isConfigured(handle.entry));
+    }
     /**
      * Each app's health, asked of every process it runs — its supervisor
      * children and its worker pools — and combined (`app-health.ts`).
      *
      * `name` is resolved like every other per-app question: `main` finds
-     * `daos/dev/main`. It was compared verbatim, so `omnitron health main`
+     * `sample/dev/main`. It was compared verbatim, so `omnitron health main`
      * matched nothing and the answer was empty. An unknown name answers `{}`,
      * and the caller says so.
      */
@@ -1418,12 +2064,11 @@ export class OrchestratorService extends EventEmitter {
         if (name !== undefined && wanted === undefined)
             return {};
         const result = {};
-        for (const [appName, handle] of this.handles) {
-            if (wanted && appName !== wanted)
-                continue;
+        const entries = [...this.handles].filter(([appName]) => !wanted || appName === wanted);
+        const measure = async ([appName, handle]) => {
             if (handle.status !== 'online') {
                 result[appName] = notRunningHealth(handle.status);
-                continue;
+                return;
             }
             if (handle.mode === 'bootstrap' && handle.supervisor) {
                 const supervisor = handle.supervisor;
@@ -1431,14 +2076,40 @@ export class OrchestratorService extends EventEmitter {
                 for (const [pool, instance] of handle.topologyPools) {
                     answers.push([pool, poolHealth(instance.metrics)]);
                 }
-                const health = answers.length > 0 ? combineProcessHealth(answers) : handle.lastHealth;
+                if (handle.entry && this.readinessMonitor.isConfigured(handle.entry))
+                    answers.push(['readiness', await this.readinessMonitor.check(handle, handle.entry, handle.healthRunId)]);
+                const health = handle.status !== 'online' ? notRunningHealth(handle.status)
+                    : answers.length > 0 ? combineProcessHealth(answers) : handle.lastHealth;
                 handle.lastHealth = health;
                 result[appName] = health;
             }
             else {
-                result[appName] = handle.lastHealth;
+                const runId = handle.healthRunId;
+                const declaration = handle.entry;
+                const measured = await this.readinessMonitor.check(handle, declaration, runId);
+                if (runId !== handle.healthRunId || declaration !== handle.entry) {
+                    result[appName] = { timestamp: Date.now(), status: 'degraded', checks: [{ name: 'readiness', status: 'warn', message: 'measurement_superseded: application restarted or its declaration changed during this probe; request a fresh measurement.' }] };
+                    return;
+                }
+                const health = handle.status === 'online' ? measured : notRunningHealth(handle.status);
+                handle.lastHealth = health;
+                result[appName] = health;
+                const signature = JSON.stringify([health.status, health.checks.map(c => [c.name, c.status, c.status === 'pass' ? '' : c.message])]);
+                if (this.readinessSignatures.get(handle) !== signature) {
+                    this.readinessSignatures.set(handle, signature);
+                    const details = { event: 'application.readiness.changed', app: appName, status: health.status, checks: health.checks };
+                    if (health.status === 'healthy')
+                        this.logger.info(details, 'Application readiness verified');
+                    else if (health.status === 'degraded')
+                        this.logger.warn(details, 'Application readiness needs attention');
+                    else
+                        this.logger.error(details, 'Application readiness failed');
+                }
             }
-        }
+        };
+        // Keep a fleet of failed endpoints from serializing the entire health response.
+        for (let offset = 0; offset < entries.length; offset += 4)
+            await Promise.all(entries.slice(offset, offset + 4).map(measure));
         return result;
     }
     /**
@@ -1527,8 +2198,11 @@ export class OrchestratorService extends EventEmitter {
     // ============================================================================
     // Private — Launch
     // ============================================================================
-    async launchClassicMode(entry, handle, config) {
-        const child = await launchClassic(entry, handle, this.cwd, this.logger, this.appLogHandlers);
+    async launchClassicMode(entry, handle, config, installed) {
+        handle.release = await verifyLaunchRelease(entry, handle.generation, [installedExecutable(entry, this.cwd)]);
+        const launch = entry.releaseRoot || installed || handle.release.state === 'confirmed'
+            ? requireInstalledBinding(handle.release, installedEntryRevision(entry, config, this.cwd), installed) : undefined;
+        const child = await launchClassic(entry, handle, this.cwd, this.logger, this.appLogHandlers, Boolean(installed));
         child.on('exit', (code, signal) => {
             if (handle.status === 'stopping') {
                 handle.markStopped();
@@ -1540,6 +2214,7 @@ export class OrchestratorService extends EventEmitter {
             }
             this.persistState();
         });
+        return launch;
     }
     /**
      * Launch bootstrap app via PM ProcessSupervisor.
@@ -1548,7 +2223,7 @@ export class OrchestratorService extends EventEmitter {
      * all topology children (server + worker pools) and wires IPC relay between them.
      * Otherwise, creates a single bootstrap-process as before.
      */
-    async launchBootstrapMode(entry, handle, config) {
+    async launchBootstrapMode(entry, handle, config, installed) {
         handle.markStarting();
         const bootstrapAbsPath = path.resolve(entry.cwd ?? this.cwd, entry.bootstrap);
         // Load bootstrap definition to check for process topology and requirements.
@@ -1562,14 +2237,16 @@ export class OrchestratorService extends EventEmitter {
         let topology;
         let definition;
         try {
-            definition = await loadBootstrapConfig(bootstrapAbsPath, { devMode: this.devMode, freshModuleGraph: true });
+            const captured = await readBootstrapMetadata(bootstrapAbsPath, this.devMode && !entry.releaseRoot, 60_000);
+            definition = captured.definition;
+            handle.bootstrapMetadata = captured.metadata;
             topology = definition.processes;
         }
         catch (err) {
             // Refused, with the reason. This fell back to «single-process mode» at
             // warn — but every definition declares its topology (IAppDefinition:
             // `processes` is required), so the fallback started the app in a shape
-            // it was never written for. Measured 2026-09-23 on the master: paysys
+            // it was never written for. Measured 2026-09-23 on the master: payments
             // and messaging, whose definitions failed to load («Parameter
             // decorators only work when experimental decorators are enabled»), were
             // started that way and died on «Dependency 'AuthModule:JWTService' not
@@ -1604,7 +2281,7 @@ export class OrchestratorService extends EventEmitter {
         }
         // Resolve infrastructure config and inject as env vars.
         // Skip if already injected by project.service.ts (stack flow sets OMNITRON_STACK).
-        const alreadyResolved = !!(entry.env?.['OMNITRON_STACK'] && entry.env?.['DATABASE_URL']);
+        const alreadyResolved = !!entry.env?.['OMNITRON_STACK'];
         if (!alreadyResolved && (definition?.requires || definition?.omnitronConfig)) {
             try {
                 const { resolveStack, resolvedConfigToEnv } = await import('../project/config-resolver.js');
@@ -1620,7 +2297,7 @@ export class OrchestratorService extends EventEmitter {
                 if (appConfig) {
                     const envVars = resolvedConfigToEnv(appConfig, entry.name, stackName);
                     if (Object.keys(envVars).length > 0) {
-                        entry.env = { ...entry.env, ...envVars };
+                        entry.env = { ...envVars, ...entry.env };
                         this.logger.debug({ app: entry.name, envCount: Object.keys(envVars).length }, 'Injected resolved infrastructure config as env vars');
                     }
                 }
@@ -1631,105 +2308,68 @@ export class OrchestratorService extends EventEmitter {
         }
         // Build all entry points via esbuild (dev mode bundles from source .ts)
         //
-        // On a *restart* (as opposed to a first start), buildResults already
-        // has a fresh entry — esbuild's watcher just produced the bundle
-        // that triggered us. Reusing it skips a redundant cold rebuild
-        // (which was costing ~500ms per restart and racing against the
-        // watcher's own incremental output). The watch context is also
-        // preserved (we never unwatched), so we don't re-arm it either.
-        if (definition && this.devMode) {
-            try {
-                if (!this.buildService) {
-                    this.buildService = new BuildService(/* isDev */ true, {
-                        onEsbuildReset: (info) => this.metricsBridge?.recordResilientHandleReset(info),
-                        onBuildResult: ({ app, kind, durationMs, ok }) => this.metricsBridge?.recordEsbuildBuild(app, kind, durationMs, ok),
-                    });
-                }
-                const existing = this.buildResults.get(entry.name);
-                const existingWatch = this.buildService.isWatching?.(entry.name);
-                // Bundle on-disk presence check. A restart can race against
-                // the user (or a script) removing `.omnitron-build/` between
-                // builds — without this stat the orchestrator hands the
-                // worker a path that no longer exists and the child dies
-                // with `ERR_MODULE_NOT_FOUND` before the supervisor can
-                // recover. Cheap stat, big DX win.
-                const bundlePresent = existing
-                    ? fs.existsSync(existing.bootstrapPath)
-                    : false;
-                if (existing && existingWatch && bundlePresent) {
-                    // Restart path — keep the already-built bundle and live watch.
-                    this.logger.debug({ app: entry.name, modules: existing.modulePaths.size }, 'Reusing existing esbuild bundle + watch (restart path)');
-                }
-                else {
-                    if (existing && existingWatch && !bundlePresent) {
-                        // Bundle was deleted out from under us. Clear the watch
-                        // and the cached BuildResult so the next call rebuilds
-                        // from cold and re-arms the watcher cleanly.
-                        this.logger.warn({ app: entry.name, bootstrapPath: existing.bootstrapPath }, 'Cached bundle missing on disk — forcing rebuild');
-                        try {
-                            await this.buildService.unwatchApp?.(entry.name);
-                        }
-                        catch (err) {
-                            this.logger.debug({ err, app: entry.name }, 'unwatchApp failed (non-fatal)');
-                        }
-                        this.buildResults.delete(entry.name);
-                    }
-                    // First-start path — build everything from cold and arm the watcher.
-                    const buildResult = await this.buildService.buildApp(entry.name, bootstrapAbsPath, definition);
-                    this.buildResults.set(entry.name, buildResult);
-                    this.logger.info({ app: entry.name, modules: buildResult.modulePaths.size }, 'Built entry points via esbuild');
-                    // Start esbuild watch for incremental rebuilds on source changes.
-                    // On rebuild → fire a restart trigger; the coalescer takes it
-                    // from there.
-                    await this.buildService.watchApp(entry.name, bootstrapAbsPath, definition, () => {
-                        // Gate: skip if the app is in a non-running state — repeated
-                        // restarts of an escalated/errored process just churn forever
-                        // without forward progress (Fix #248).
-                        // Skip restart when the app is in a terminal non-running
-                        // state. Includes 'crashed' (supervisor escalated after
-                        // exceeding its restart budget) and 'errored' (start
-                        // failed). 'stopped' means operator explicitly stopped it.
-                        // In all three cases, restarting just churns a known-broken
-                        // process; the operator must fix the underlying issue and
-                        // call `omnitron start <app>` to clear the state.
-                        const status = this.getAppStatus(entry.name);
-                        if (status === 'errored' || status === 'crashed' || status === 'stopped') {
-                            this.logger.warn({ app: entry.name, status }, 'esbuild rebuild detected but app is not running — skipping restart');
-                            return;
-                        }
-                        this.logger.info({ app: entry.name }, 'esbuild rebuild detected — restarting');
-                        this.metricsBridge?.recordEsbuildBuild(entry.name, 'rebuild', 0, true);
-                        this.restartApp(entry.name).catch((err) => {
-                            this.logger.error({ app: entry.name, error: err.message }, 'Restart after esbuild rebuild failed');
-                        });
-                    });
-                }
-            }
-            catch (err) {
-                // The "fall back to tsx" wording was misleading — the orchestrator
-                // does not inject a tsx loader into spawned children, so without
-                // a build the bootstrap-process will try to `import` the source
-                // .ts file (referenced as `./app.module.js` in the topology) and
-                // fail with a cryptic "Cannot find module" downstream. Surface
-                // the build error directly so the operator sees the actual
-                // problem on `omnitron start/restart`.
-                // esbuild's error carries an `errors[]` with file, line and column.
-                // `.message` is the summary; the locations are what an operator needs
-                // to fix the build, and they exist only on the original.
-                this.logger.error({ app: entry.name, error: err }, 'esbuild build failed — app cannot start without bundled output');
-                throw new Error(`Cannot launch '${entry.name}' in dev mode: esbuild build failed (${err.message}). ` +
-                    `Fix the build error and retry, or run with bundled output present in apps/${entry.name}/.omnitron-build/.`, { cause: err });
-            }
+        if (installed && this.buildResults.has(entry.name)) {
+            throw new Error('Installed stack start cannot use a development build');
         }
+        if (definition && !installed)
+            await this.prepareBootstrapBuild(entry, bootstrapAbsPath, definition);
         const buildResult = this.buildResults.get(entry.name);
         // Use bundled bootstrap path for topology import when available
         const effectiveBootstrapPath = buildResult?.bootstrapPath ?? bootstrapAbsPath;
+        handle.release = buildResult
+            ? { state: 'unreported', reason: 'This launch uses a generated build; an installed release receipt cannot identify that executable.' }
+            : await verifyLaunchRelease(entry, handle.generation, [bootstrapAbsPath, ...(topology ?? []).map(process => path.resolve(path.dirname(bootstrapAbsPath), process.module))]);
+        const launch = entry.releaseRoot || installed || handle.release.state === 'confirmed'
+            ? requireInstalledBinding(handle.release, installedEntryRevision(entry, config, this.cwd), installed) : undefined;
         if (topology && topology.length > 0) {
             await this.launchTopology(entry, handle, config, effectiveBootstrapPath, topology, buildResult);
         }
         else {
             await this.launchSingleProcess(entry, handle, config, effectiveBootstrapPath, buildResult);
         }
+        return launch;
+    }
+    async discardSourceBuild(name) {
+        const state = this.restartCoalescer.get(name);
+        if (state)
+            state.watchSerial = 0;
+        await this.buildService?.unwatchApp(name);
+        this.buildResults.delete(name);
+        this.bootstrapSources.delete(name);
+    }
+    async prepareBootstrapBuild(entry, bootstrapAbsPath, definition) {
+        const sourceTopology = /\.(?:[cm]?ts|tsx)$/.test(bootstrapAbsPath) ||
+            definition.processes.some((process) => /\.(?:[cm]?ts|tsx)$/.test(process.module));
+        if (entry.releaseRoot || (!this.devMode && !sourceTopology)) {
+            // A prior source launch under this name must not redirect a prebuilt
+            // release to a stale generated executable or leave its watcher active.
+            await this.discardSourceBuild(entry.name);
+            return;
+        }
+        try {
+            this.buildService ??= new BuildService(this.devMode, {
+                onEsbuildReset: (info) => this.metricsBridge?.recordResilientHandleReset(info),
+                onBuildResult: ({ app, kind, durationMs, ok }) => this.metricsBridge?.recordEsbuildBuild(app, kind, durationMs, ok),
+            });
+            const existing = this.buildResults.get(entry.name);
+            const current = this.handles.get(entry.name)?.entry ?? entry;
+            const reusable = existing && this.allowsWatch(current) && this.buildService.isWatching(entry.name) &&
+                this.buildService.canReuseBuild(existing, bootstrapAbsPath, definition, this.devMode);
+            if (!reusable) {
+                // A manual restart with watch:false deliberately compiles the current
+                // sources. It must not reuse an artifact that stopped being maintained.
+                await this.buildService.unwatchApp(entry.name);
+                this.buildResults.delete(entry.name);
+                this.buildResults.set(entry.name, await this.buildService.buildApp(entry.name, bootstrapAbsPath, definition, this.devMode));
+                this.logger.info({ app: entry.name }, 'Built entry points via esbuild');
+            }
+            this.bootstrapSources.set(entry.name, { path: bootstrapAbsPath, definition });
+            await this.syncBootstrapWatch(entry.name);
+        }
+        catch (error) {
+            this.logger.error({ app: entry.name, error }, 'esbuild build failed — app cannot start without bundled output');
+            throw new Error(`Cannot launch '${entry.name}': esbuild build failed (${error.message}). Fix the build error and retry.`, { cause: error });
+        }
     }
     /**
      * Launch app with process topology — multiple children managed by Omnitron.
@@ -1738,30 +2378,34 @@ export class OrchestratorService extends EventEmitter {
      * The BootstrapProcess finds its own entry, imports the module, and wires transports.
      *
      * Processes with `instances > 1` are launched as PM pools with load balancing.
-     * Processes with `topology.access` get Netron-native proxies via daemon socket.
-     * Processes with `topology.expose` auto-expose their @Service on daemon Netron.
+     * Processes with `topology.access` get native Netron proxies within this application.
+     * Processes with `topology.expose` publish their @Service on its private listener.
      *
      * Service metadata is auto-discovered from pool workers — no manual `exports`
      * config needed. The @Service decorator on the worker IS the source of truth.
      */
     async launchTopology(entry, handle, config, bootstrapAbsPath, topology, buildResult) {
+        // One fresh, aligned adapter for every pool and single process in this
+        // application generation. Resolve before allocating topology resources.
+        const runtime = await this.bootstrapRuntime(bootstrapAbsPath);
         const policy = buildRestartPolicy(entry, config);
-        // Wait for daemon Netron to be wired up. Cheap no-op if already ready;
-        // otherwise blocks (with timeout) instead of immediately failing — the
-        // race between daemon startup and stack auto-resume is benign and just
-        // needs a single rendezvous.
-        await this.ensureDaemonNetronReady();
-        const serviceRouter = new ServiceRouter(this.daemonNetron, this.logger);
-        const daemonSocketUrl = `unix://${this.daemonSocketPath}`;
+        const spawnEnv = withClosureLibraryPath(entry.env, [entry.releaseRoot, entry.cwd, bootstrapAbsPath]);
+        const needsRouting = topology.some(proc => proc.topology?.expose === true || proc.topology?.access?.length);
+        handle.deferStartup();
+        if (needsRouting) {
+            await this.ensureTopologyReady();
+            handle.topology = await ApplicationTopology.allocate(this.topologyDirectory, entry.name, this.logger);
+            await handle.topology.start();
+        }
+        const serviceRouter = handle.topology?.router;
+        const topologySocketUrl = handle.topology?.url;
         // Topology startup order: providers (topology.expose) before consumers (topology.access).
-        // Providers register their @Service on daemon Netron via ServiceRouter.
-        // Consumers connect to daemon and queryInterface() for those services.
-        // Currently only pool processes support topology.expose (ServiceRouter wraps pool.execute).
+        // Each application's private namespace contains both pool and single providers.
         const poolEntries = topology.filter((p) => (p.instances ?? 1) > 1);
         const singleEntries = topology.filter((p) => (p.instances ?? 1) <= 1);
         // Step 1: Create PM pools — must complete before Step 2 so services are available
         // Pools with topology.expose auto-discover @Service metadata from the first
-        // worker via getExposedServices() and register on daemon Netron via ServiceRouter.
+        // worker via getExposedServices() and publish within this application's namespace.
         const poolNames = [];
         for (const procEntry of poolEntries) {
             const instances = procEntry.instances;
@@ -1785,14 +2429,15 @@ export class OrchestratorService extends EventEmitter {
                     allMethodsPublic: true,
                     ...(handle.appLogLevel && { logLevel: handle.appLogLevel }),
                     startupTimeout: procEntry.startupTimeout ?? entry.startupTimeout ?? DEFAULT_CHILD_STARTUP_TIMEOUT,
-                    ...(entry.env && { env: entry.env }),
-                    ...(entry.cwd && { cwd: entry.cwd }),
+                    ...(spawnEnv && { env: spawnEnv }),
+                    cwd: entry.cwd ?? this.cwd,
                     dependencies: {
                         bootstrapPath: bootstrapAbsPath,
                         processName: procEntry.name,
                         ...(bundledModulePath && { bundledModulePath }),
                         ...(topologyAccess.length > 0 && {
-                            __daemonSocketUrl: daemonSocketUrl,
+                            // Retain the bootstrap wire key for previously sealed SDKs.
+                            __daemonSocketUrl: topologySocketUrl,
                             __topologyConnects: topologyAccess,
                         }),
                     },
@@ -1835,7 +2480,7 @@ export class OrchestratorService extends EventEmitter {
             };
             this.logger.info({ app: entry.name, process: procEntry.name, instances }, 'Creating topology process pool');
             // pm.pool() returns a Proxy wrapping ProcessPool — execute() dispatches to pool workers
-            const pool = await this.pm.pool(BOOTSTRAP_PROCESS_PATH, poolOptions);
+            const pool = await this.pm.pool(runtime, poolOptions);
             poolNames.push(procEntry.name);
             // Track the pool on the AppHandle so `getInfo()` can report the
             // actual worker count for pool-managed topology entries. Without
@@ -1843,56 +2488,15 @@ export class OrchestratorService extends EventEmitter {
             // which returns null for pool workers (they aren't supervisor
             // children) and the entry is mis-reported as `status: 'stopped'`.
             handle.topologyPools.set(procEntry.name, pool);
+            this.observePoolReleaseMembership(handle, pool);
             this.attachPoolLogCapture(entry.name, procEntry.name, handle, pool);
             // Auto-discover @Service metadata from pool workers and expose via ServiceRouter.
             // No manual `exports` needed — @Service decorator IS the source of truth.
             // Requires explicit `topology: { expose: true }` — opt-in for security.
             if (procEntry.topology?.expose === true) {
-                try {
-                    // A pool worker reports ready before its Application has started, and
-                    // `@Service` classes are exposed to Netron during start — so asking
-                    // once, or once more 500ms later, asks a worker that is still booting.
-                    // What it answers then is an empty list, or a service whose method
-                    // list has not been filled in yet, and both used to end the same way:
-                    // nothing registered on the daemon, the consumer process starting
-                    // seconds later, querying, and being told the service does not exist.
-                    // The consumer resolves its topology proxy exactly once, so that
-                    // answer disabled the feature for the life of the process — in the
-                    // case that surfaced this, every OHLCV candle aggregation.
-                    //
-                    // Poll instead, and treat "a service with no methods" as not ready
-                    // rather than as a service, because an empty method list produces a
-                    // proxy that can do nothing.
-                    const usable = (list) => Array.isArray(list) && list.length > 0 && list.some((svc) => svc.methods?.length > 0);
-                    let services = await pool.execute('getExposedServices');
-                    const deadline = Date.now() + TOPOLOGY_EXPOSE_TIMEOUT_MS;
-                    while (!usable(services) && Date.now() < deadline) {
-                        await new Promise((r) => setTimeout(r, TOPOLOGY_EXPOSE_POLL_MS));
-                        services = await pool.execute('getExposedServices');
-                    }
-                    if (!usable(services)) {
-                        this.logger.warn({
-                            app: entry.name,
-                            process: procEntry.name,
-                            waitedMs: TOPOLOGY_EXPOSE_TIMEOUT_MS,
-                            reported: services?.map((svc) => `${svc.name}(${svc.methods?.length ?? 0})`) ?? [],
-                        }, 'No usable @Service found on pool worker — topology.expose has no effect, and any ' +
-                            'process declaring topology.access on it will start without a proxy');
-                    }
-                    for (const svc of services ?? []) {
-                        if (svc.methods.length === 0) {
-                            // Silently skipped before. A consumer then failed to find a
-                            // service its own declaration named, with nothing anywhere
-                            // connecting the two facts.
-                            this.logger.warn({ app: entry.name, process: procEntry.name, service: svc.name }, 'Pool service exposes no methods — not registered on the daemon');
-                            continue;
-                        }
-                        await serviceRouter.exposePoolService(procEntry.name, svc.name, svc.version ?? '1.0.0', pool, svc.methods);
-                        this.logger.info({ app: entry.name, process: procEntry.name, service: svc.name, methods: svc.methods.length }, 'Auto-discovered and exposed pool service on daemon Netron');
-                    }
-                }
-                catch (err) {
-                    this.logger.error({ app: entry.name, process: procEntry.name, error: err.message }, 'Failed to auto-discover/expose pool services');
+                const services = await this.discoverTopologyServices(entry.name, procEntry.name, () => pool.execute('getExposedServices'));
+                for (const svc of services) {
+                    await serviceRouter.exposePoolService(procEntry.name, svc.name, svc.version ?? '1.0.0', pool, svc.methods);
                 }
             }
         }
@@ -1909,14 +2513,14 @@ export class OrchestratorService extends EventEmitter {
                 // path beside it has always stated one. See CHILD_REQUEST_TIMEOUT.
                 requestTimeout: CHILD_REQUEST_TIMEOUT,
                 startupTimeout: procEntry.startupTimeout ?? entry.startupTimeout ?? DEFAULT_CHILD_STARTUP_TIMEOUT,
-                ...(entry.env && { env: entry.env }),
-                ...(entry.cwd && { cwd: entry.cwd }),
+                ...(spawnEnv && { env: spawnEnv }),
+                cwd: entry.cwd ?? this.cwd,
                 dependencies: {
                     bootstrapPath: bootstrapAbsPath,
                     processName: procEntry.name,
                     ...(bundledModulePath && { bundledModulePath }),
                     ...(topologyAccess.length > 0 && {
-                        __daemonSocketUrl: daemonSocketUrl,
+                        __daemonSocketUrl: topologySocketUrl,
                         __topologyConnects: topologyAccess,
                     }),
                 },
@@ -1930,7 +2534,7 @@ export class OrchestratorService extends EventEmitter {
             };
             children.push({
                 name: `${entry.name}/${procEntry.name}`,
-                process: BOOTSTRAP_PROCESS_PATH,
+                process: runtime,
                 spawnOptions: spawnOpts,
                 critical: procEntry.critical ?? entry.critical ?? false,
             });
@@ -1938,7 +2542,7 @@ export class OrchestratorService extends EventEmitter {
         // Step 3: Create supervisor for single-instance children
         const supervisorConfig = {
             strategy: mapStrategy(config.supervision.strategy),
-            maxRestarts: policy.maxRestarts ?? config.supervision.maxRestarts,
+            maxRestarts: policy.enabled === false ? 0 : policy.maxRestarts ?? config.supervision.maxRestarts,
             window: policy.window ?? config.supervision.window,
             backoff: policy.backoff ?? config.supervision.backoff,
             children,
@@ -1958,7 +2562,6 @@ export class OrchestratorService extends EventEmitter {
         this.onChildStarted(entry, handle, supervisor);
         // Set supervisor on handle BEFORE start so attachLogCapture can access it
         handle.supervisor = supervisor;
-        handle.serviceRouter = serviceRouter;
         handle.instanceCount = entry.instances ?? 1;
         handle.topologyProcesses = topology;
         this.wireSupervisorEvents(entry, handle, supervisor);
@@ -1969,7 +2572,7 @@ export class OrchestratorService extends EventEmitter {
         // This was a pool-only feature, ignored in silence everywhere else: a
         // process declaring `expose: true` got no registration and no warning,
         // and every consumer naming it in `topology.access` started without a
-        // proxy. Measured on priceverse, whose `collector` is a single process
+        // proxy. Measured on quotes, whose `collector` is a single process
         // holding the only objects that know whether the exchange WebSockets are
         // up — the server process could not ask, and answered `ready: down —
         // exchanges unavailable` while three were connected.
@@ -1977,58 +2580,48 @@ export class OrchestratorService extends EventEmitter {
         // After `supervisor.start()` because there is no child to ask before it.
         // A consumer among these children may therefore start before the service
         // is registered; consumers re-resolve their proxy on use for exactly that
-        // reason (see priceverse's `OhlcvSchedulerService`).
-        await this.exposeChildTopologyServices(entry, supervisor, serviceRouter, singleEntries);
+        // reason (see quotes's `OhlcvSchedulerService`).
+        if (serviceRouter)
+            await this.exposeChildTopologyServices(entry, supervisor, serviceRouter, singleEntries);
+        if (handle.finishStartup())
+            this.announceOnline(entry.name, handle);
+    }
+    /** Shared discovery contract for pools and supervisor children. */
+    async discoverTopologyServices(application, provider, ask) {
+        const deadline = Date.now() + TOPOLOGY_EXPOSE_TIMEOUT_MS;
+        let reported;
+        while (true) {
+            try {
+                reported = await ask();
+            }
+            catch (error) {
+                throw new Error(`Application '${application}' topology provider '${provider}' discovery failed: ${String(error)}`, { cause: error });
+            }
+            if (Array.isArray(reported) && reported.length) {
+                if (reported.some(service => !service || typeof service.name !== 'string' || !service.name ||
+                    (service.version !== undefined && typeof service.version !== 'string') ||
+                    !Array.isArray(service.methods) || service.methods.some((method) => typeof method !== 'string' || !method))) {
+                    throw new Error(`Application '${application}' topology provider '${provider}' returned invalid service metadata`);
+                }
+                const services = reported.filter(service => service.methods.length > 0);
+                if (services.length)
+                    return services;
+            }
+            if (Date.now() >= deadline) {
+                throw new Error(`Application '${application}' topology provider '${provider}' exposed no callable services within ${TOPOLOGY_EXPOSE_TIMEOUT_MS}ms`);
+            }
+            await new Promise(resolve => setTimeout(resolve, TOPOLOGY_EXPOSE_POLL_MS));
+        }
     }
-    /**
-     * Register each single process's `@Service` classes on the daemon.
-     *
-     * Mirrors the pool path above, including its poll: a child reports ready
-     * before its Application has started, and `@Service` classes are exposed to
-     * Netron during start, so asking once asks a process that is still booting
-     * and gets an empty list back.
-     */
+    /** Publish each single provider after its supervisor has started. */
     async exposeChildTopologyServices(entry, supervisor, serviceRouter, singleEntries) {
         for (const procEntry of singleEntries) {
             if (procEntry.topology?.expose !== true)
                 continue;
-            const childName = `${entry.name}/${procEntry.name}`;
-            const getProxy = () => supervisor.getChildProxy(childName);
-            try {
-                const usable = (list) => Array.isArray(list) && list.length > 0 && list.some((svc) => svc.methods?.length > 0);
-                const ask = async () => {
-                    const child = getProxy();
-                    if (!child?.getExposedServices)
-                        return undefined;
-                    return (await child.getExposedServices());
-                };
-                let services = await ask();
-                const deadline = Date.now() + TOPOLOGY_EXPOSE_TIMEOUT_MS;
-                while (!usable(services) && Date.now() < deadline) {
-                    await new Promise((r) => setTimeout(r, TOPOLOGY_EXPOSE_POLL_MS));
-                    services = await ask();
-                }
-                if (!usable(services)) {
-                    this.logger.warn({
-                        app: entry.name,
-                        process: procEntry.name,
-                        waitedMs: TOPOLOGY_EXPOSE_TIMEOUT_MS,
-                        reported: services?.map((svc) => `${svc.name}(${svc.methods?.length ?? 0})`) ?? [],
-                    }, 'No usable @Service found on this process — topology.expose has no effect, and any ' +
-                        'process declaring topology.access on it will start without a proxy');
-                    continue;
-                }
-                for (const svc of services ?? []) {
-                    if (svc.methods.length === 0) {
-                        this.logger.warn({ app: entry.name, process: procEntry.name, service: svc.name }, 'Process service exposes no methods — not registered on the daemon');
-                        continue;
-                    }
-                    await serviceRouter.exposeChildService(procEntry.name, svc.name, svc.version ?? '1.0.0', getProxy, svc.methods);
-                    this.logger.info({ app: entry.name, process: procEntry.name, service: svc.name, methods: svc.methods.length }, 'Auto-discovered and exposed process service on daemon Netron');
-                }
-            }
-            catch (err) {
-                this.logger.error({ app: entry.name, process: procEntry.name, error: err.message }, "Failed to auto-discover/expose this process's services");
+            const getProxy = () => supervisor.getChildProxy(`${entry.name}/${procEntry.name}`);
+            const services = await this.discoverTopologyServices(entry.name, procEntry.name, async () => getProxy()?.getExposedServices?.());
+            for (const svc of services) {
+                await serviceRouter.exposeChildService(procEntry.name, svc.name, svc.version ?? '1.0.0', getProxy, svc.methods);
             }
         }
     }
@@ -2038,6 +2631,7 @@ export class OrchestratorService extends EventEmitter {
     async launchSingleProcess(entry, handle, config, bootstrapAbsPath, buildResult) {
         const instances = entry.instances ?? 1;
         const policy = buildRestartPolicy(entry, config);
+        const spawnEnv = withClosureLibraryPath(entry.env, [entry.releaseRoot, entry.cwd, bootstrapAbsPath]);
         // For single-process apps, use the first (only) process entry's bundled module
         const firstProcessName = buildResult?.modulePaths.keys().next().value;
         const bundledModulePath = firstProcessName
@@ -2046,9 +2640,12 @@ export class OrchestratorService extends EventEmitter {
         const spawnOpts = {
             name: entry.name,
             version: '1.0.0',
+            // The execution owner's sealed runtime is never the application's
+            // implicit working directory. Titan PM forwards this to native fork.
+            cwd: entry.cwd ?? this.cwd,
             // As above: a single child's client otherwise runs on netron's default.
             requestTimeout: CHILD_REQUEST_TIMEOUT,
-            ...(entry.env && { env: entry.env }),
+            ...(spawnEnv && { env: spawnEnv }),
             dependencies: {
                 bootstrapPath: bootstrapAbsPath,
                 ...(bundledModulePath && { bundledModulePath }),
@@ -2073,7 +2670,7 @@ export class OrchestratorService extends EventEmitter {
         };
         const childConfig = {
             name: entry.name,
-            process: BOOTSTRAP_PROCESS_PATH,
+            process: await this.bootstrapRuntime(bootstrapAbsPath),
             spawnOptions: spawnOpts,
             critical: entry.critical ?? false,
         };
@@ -2082,6 +2679,7 @@ export class OrchestratorService extends EventEmitter {
                 size: instances,
                 strategy: PoolStrategy.ROUND_ROBIN,
                 metrics: true,
+                spawnOptions: spawnOpts,
                 // See the note on the other pool: `replaceUnhealthy` is declared by
                 // titan-pm and read by nothing.
                 healthCheck: {
@@ -2090,25 +2688,16 @@ export class OrchestratorService extends EventEmitter {
                 },
                 spawnOptionsFactory: (index) => ({
                     name: `${entry.name}-${index}`,
-                    ...(entry.env && { env: entry.env }),
-                    ...(entry.startupTimeout != null && { startupTimeout: entry.startupTimeout }),
                     dependencies: {
-                        bootstrapPath: bootstrapAbsPath,
-                        ...(bundledModulePath && { bundledModulePath }),
+                        ...spawnOpts.dependencies,
                         portOffset: index,
                     },
-                    health: {
-                        enabled: true,
-                        interval: config.monitoring.healthCheck.interval,
-                        timeout: config.monitoring.healthCheck.timeout,
-                    },
-                    observability: { metrics: true },
                 }),
             };
         }
         const supervisorConfig = {
             strategy: mapStrategy(config.supervision.strategy),
-            maxRestarts: policy.maxRestarts ?? config.supervision.maxRestarts,
+            maxRestarts: policy.enabled === false ? 0 : policy.maxRestarts ?? config.supervision.maxRestarts,
             window: policy.window ?? config.supervision.window,
             backoff: policy.backoff ?? config.supervision.backoff,
             children: [childConfig],
@@ -2155,10 +2744,15 @@ export class OrchestratorService extends EventEmitter {
             this.persistState();
             if (!whole)
                 return;
-            this.startPostOnlineCooldown(entry.name);
-            this.emit('app:online', entry.name);
+            this.announceOnline(entry.name, handle);
         });
     }
+    announceOnline(name, handle) {
+        handle.clearLastExit();
+        this.startPostOnlineCooldown(name);
+        this.persistState();
+        this.emit('app:online', name);
+    }
     /**
      * Wire common supervisor events (crash, restart, escalate) and log capture.
      */
@@ -2169,7 +2763,8 @@ export class OrchestratorService extends EventEmitter {
             // The app re-entered a live state — drop the previous crash
             // context so a future `omnitron inspect` shows the *next*
             // crash, not the last one.
-            handle.clearLastExit();
+            if (handle.status === 'online')
+                handle.clearLastExit();
         });
         // A child that is down leaves the app partial until it is back — a
         // sibling's restart must not bring the app `online` around it.
@@ -2252,20 +2847,19 @@ export class OrchestratorService extends EventEmitter {
             // module that throws on import does — so the streams below are often
             // empty and the only account of what happened is on the error.
             this.persistChildFailure(entry.name, childName, error);
-            this.persistChildOutput(entry.name, childName, details?.stdout, 'stdout');
-            this.persistChildOutput(entry.name, childName, details?.stderr, 'stderr');
+            if (this.pm.outputCaptureVersion !== 1) {
+                this.persistChildOutput(entry.name, childName, details?.stdout, 'stdout');
+                this.persistChildOutput(entry.name, childName, details?.stderr, 'stderr');
+            }
             handle.recordExit({
                 code: null,
                 signal: null,
                 expected: false,
                 message: error.message,
             });
-            // The supervisor gives up on a non-critical child whose start failed (a
-            // critical one throws, and `startApp` says so). That went unseen while
-            // the first child's start made the app `online`; now the app would wait
-            // for a child that is not coming, in `starting` — which `omnitron start`
-            // takes for a start in progress and leaves alone. A declared process
-            // that did not start is an app that did not start.
+            // The supervisor retries within its configured budget. Until a real
+            // ready event arrives, the application is unavailable, not still booting.
+            handle.childGone(childName);
             if (handle.status === 'starting')
                 handle.markErrored();
             this.logger.error({ app: entry.name, child: childName, err: error.message }, 'Process failed to start');
@@ -2276,6 +2870,12 @@ export class OrchestratorService extends EventEmitter {
             this.logger.info({ app: entry.name, child: childName, attempt }, 'Process restarting');
             this.emit('app:restart', entry.name, attempt);
         });
+        supervisor.on('child:recovery-stopped', (childName, error) => {
+            handle.status = 'crashed';
+            this.logger.error({ app: entry.name, child: childName, reason: error.message }, 'Process recovery stopped by restart policy; inspect the last failure before retrying');
+            this.persistState();
+            this.emit('app:escalated', entry.name, childName);
+        });
         supervisor.on('escalate', (childName, _error) => {
             handle.status = 'crashed';
             this.logger.error({ app: entry.name, child: childName }, 'App exceeded max restarts — escalated');
@@ -2288,6 +2888,8 @@ export class OrchestratorService extends EventEmitter {
      * Routes child stdout/stderr lines to AppHandle ring buffer for `getLogs()`.
      */
     attachLogCapture(appName, childName, handle) {
+        if (this.pm.outputCaptureVersion === 1)
+            return;
         const supervisor = handle.supervisor;
         if (!supervisor)
             return;
@@ -2299,6 +2901,21 @@ export class OrchestratorService extends EventEmitter {
             return;
         workerHandle.onLog(this.childLogForwarder(appName, handle));
     }
+    /** Pool initialization is complete; every later membership change supersedes this launch proof. */
+    observePoolReleaseMembership(handle, pool) {
+        const invalidate = () => handle.invalidateRelease();
+        for (const event of ['worker:spawned', 'worker:shutdown', 'worker:replaced', 'pool:scaled', 'pool:destroyed'])
+            pool.on(event, invalidate);
+        // A crash precedes the pool's health check and replacement; stop confirming
+        // the old membership as soon as the initial worker reports its exit.
+        for (const id of pool.getWorkerIds()) {
+            const worker = pool.getWorkerHandle(id);
+            if (worker?.onExit)
+                worker.onExit(invalidate);
+            else
+                invalidate();
+        }
+    }
     /**
      * Attach log capture to the workers of a topology POOL.
      *
@@ -2314,6 +2931,8 @@ export class OrchestratorService extends EventEmitter {
      * alternative is an event this package does not expose yet.
      */
     attachPoolLogCapture(appName, processName, handle, pool) {
+        if (this.pm.outputCaptureVersion === 1)
+            return;
         const forward = this.childLogForwarder(appName, handle);
         let attached = 0;
         for (const workerId of pool.getWorkerIds()) {
@@ -2327,8 +2946,12 @@ export class OrchestratorService extends EventEmitter {
     }
     /** The one place a child's line becomes an app's line. */
     childLogForwarder(appName, handle) {
-        return (line, stream) => {
+        return (line, stream, context) => {
             // In-memory ring buffer (for live CLI tailing)
+            // Accept durable capture before updating volatile views: a retry keeps
+            // the same ID and must not duplicate the diagnostic ring.
+            for (const handler of this.appLogHandlers)
+                handler(appName, line, context);
             handle.appendLog(line);
             // Separate stderr ring — feeds `lastExit.stderrTail` on death.
             // Without this, the operator running `omnitron inspect` after
@@ -2336,15 +2959,6 @@ export class OrchestratorService extends EventEmitter {
             if (stream === 'stderr') {
                 handle.appendStderr(line);
             }
-            // Persist to disk via registered log handlers (LogManager)
-            for (const handler of this.appLogHandlers) {
-                try {
-                    handler(appName, line);
-                }
-                catch {
-                    // Log handler failure must not break the app
-                }
-            }
         };
     }
     /**
@@ -2454,46 +3068,11 @@ export class OrchestratorService extends EventEmitter {
     // ============================================================================
     async stopChildProcess(handle, force, timeout) {
         const child = handle.childProcess;
-        if (!child || !child.pid)
+        if (!child)
             return;
-        const pid = child.pid;
-        // P0-D — Signal the whole process group, not just the direct
-        // child. classic-launcher spawns with `detached: true` so the
-        // child becomes group leader (pgid === pid). `process.kill(-pid)`
-        // delivers the signal to every process in the group, reaping
-        // grandchildren (ffmpeg, docker, worker pools …) that ignore the
-        // direct-child kill. Falls back to `child.kill` when the negative-
-        // pid call fails (test environments, restricted permissions, the
-        // child wasn't started detached — bootstrap-mode currently isn't).
-        const sendSignal = (sig) => {
-            try {
-                process.kill(-pid, sig);
-                return;
-            }
-            catch (err) {
-                const code = err.code;
-                if (code !== 'ESRCH' && code !== 'EPERM') {
-                    // ESRCH/EPERM = group already gone or not a group leader.
-                    // Anything else (EINVAL etc.) → log via best-effort.
-                    this.logger.debug({ app: handle.name, pid, sig, code }, 'process.kill(-pid) fallback');
-                }
-            }
-            try {
-                child.kill(sig);
-            }
-            catch { /* best-effort */ }
-        };
-        await new Promise((resolve) => {
-            const timer = setTimeout(() => {
-                sendSignal('SIGKILL');
-                resolve();
-            }, timeout);
-            child.once('exit', () => {
-                clearTimeout(timer);
-                resolve();
-            });
-            sendSignal(force ? 'SIGKILL' : 'SIGTERM');
-        });
+        const stopped = await killChildAndVerify(child, this.logger, { app: handle.name }, timeout, { force, processGroup: true });
+        if (!stopped)
+            throw new Error(`Application '${handle.name}' (pid ${child.pid}) did not confirm process-group exit`);
     }
     /**
      * Cancel a pending crash cool-down for `name`, if one is armed.
@@ -2508,131 +3087,63 @@ export class OrchestratorService extends EventEmitter {
         }
     }
     async scheduleRecovery(entry, handle, config) {
+        const generation = this.stopGeneration;
+        const revision = this.appStopIntents.get(entry.name)?.revision;
+        const eligible = () => !this.stoppingApps && generation === this.stopGeneration &&
+            revision === this.appStopIntents.get(entry.name)?.revision &&
+            !this.appStopIntents.get(entry.name)?.stopped &&
+            this.handles.get(entry.name) === handle &&
+            (handle.status === 'crashed' || handle.status === 'errored');
+        if (!eligible())
+            return;
         const policy = buildRestartPolicy(entry, config);
+        const maxRestarts = policy.maxRestarts ?? 5;
         if (!policy.enabled)
             return;
-        if (handle.restarts >= (policy.maxRestarts ?? 5)) {
+        if (maxRestarts <= 0) {
             handle.status = 'crashed';
-            this.logger.error({ app: entry.name }, 'Max restarts exceeded');
             this.emit('app:escalated', entry.name);
-            // P1-I — auto-recovery after a cool-down. pm2 has this as
-            // `restart_delay` + a fresh attempt window; pre-fix omnitron
-            // left the app permanently 'crashed' until human intervention.
-            // We reset the counter + schedule one fresh attempt 10 minutes
-            // out. If THAT attempt also crashes through maxRestarts we
-            // land back here and pause another 10 minutes — bounded
-            // self-healing without thrashing.
-            //
-            // The wait happens OUTSIDE the lifecycle queue, and that is the
-            // whole point. It used to be a queued `crash-restart` whose
-            // `run()` slept for the entire cool-down — but `enqueue` will
-            // not preempt a RUNNING head, and with an empty queue the
-            // sleeper always became the head immediately. So the `onPreempt`
-            // hook meant to cancel it could never fire, and an operator's
-            // `stop` or `restart` simply queued behind ten minutes of sleep:
-            // the CLI's RPC timed out after 60s while the op stayed queued,
-            // to fire whenever the cool-down finally elapsed. An app that
-            // exhausted its restart budget was unreachable by every command
-            // the CLI offers — `restart` hung, `stop` hung, `stack start`
-            // skipped it — and the only recovery was restarting the daemon.
-            const COOL_DOWN_MS = 10 * 60_000;
-            this.clearCoolDown(entry.name);
-            const timer = setTimeout(() => {
-                this.coolDownTimers.delete(entry.name);
-                // Re-read the handle: every start replaces it (see
-                // `startAppInternal`), so the one captured above is stale the
-                // moment anything restarts this app. Only a still-crashed app
-                // wants this attempt — an operator who started it meanwhile
-                // has already settled the question.
-                const current = this.handles.get(entry.name);
-                if (!current || current.status !== 'crashed')
-                    return;
-                this.logger.info({ app: entry.name }, 'Cool-down elapsed — attempting fresh recovery');
-                current.restarts = 0; // fresh attempt window
-                current.status = 'stopped';
-                void this.lifecycleQueue
-                    .enqueue(entry.name, 'crash-restart', () => this.startAppInternal(entry, config))
-                    .catch((err) => {
-                    if (err instanceof LifecyclePreempted)
-                        return;
-                    this.logger.error({ app: entry.name, err: err.message }, 'Cool-down recovery failed');
-                });
-            }, COOL_DOWN_MS);
-            timer.unref?.();
-            this.coolDownTimers.set(entry.name, timer);
             return;
         }
-        const backoff = policy.backoff ?? config.supervision.backoff;
-        const delay = this.calculateBackoff(handle.restarts, backoff);
-        this.logger.info({ app: entry.name, delay, attempt: handle.restarts + 1 }, 'Scheduling restart');
-        // P0-I — schedule the crash-restart through the lifecycle queue
-        // so an explicit stop preempts the pending restart before it
-        // fires. The setTimeout is still the timing source, but the
-        // queue.enqueue with `onPreempt` guarantees the timer is cleared
-        // (and the promise rejected with LifecyclePreempted) the moment a
-        // higher-priority op for the same app arrives. Pre-fix the timer
-        // could fire during stopApp's `await stopChild(...)` window and
-        // spawn a zombie under the same handle.
-        let timer = null;
-        const restartPromise = this.lifecycleQueue.enqueue(entry.name, 'crash-restart', () => new Promise((resolve, reject) => {
-            timer = setTimeout(async () => {
-                timer = null;
-                // Guard: don't restart if orchestrator was stopped during backoff
-                if (handle.status === 'stopping' || handle.status === 'stopped') {
-                    resolve();
-                    return;
-                }
-                try {
-                    handle.status = 'stopped';
-                    // `startAppInternal`, not `startApp`.
-                    //
-                    // This task holds the lifecycle-queue slot for `entry.name`.
-                    // `startApp` enqueues 'start' on that same key, and the queue
-                    // cannot run it until this task returns — so the await never
-                    // settles and the restart silently never happens. Measured:
-                    // `startApp:enter` with no matching exit, and the app left in
-                    // whatever state the crash put it in.
-                    //
-                    // This is why the whole policy below — bounded attempts,
-                    // exponential backoff, the ten-minute cool-down described in its
-                    // own comment as "bounded self-healing" — had never restarted
-                    // anything. The queue was introduced (P0-I) to stop a restart
-                    // timer racing a stop; it also made the restart unreachable, and
-                    // nothing failed loudly enough to say so.
-                    await this.startAppInternal(entry, config);
-                    resolve();
-                }
-                catch (err) {
-                    const message = err.message;
-                    this.logger.error({ app: entry.name, error: message }, 'Restart failed');
-                    // Said separately and after, because reading the process table
-                    // takes a moment and the failure itself must not wait for it.
-                    void this.explainPortConflict(message).then((held) => {
-                        if (held)
-                            this.logger.error({ app: entry.name }, `Restart failed — ${held}`);
-                    });
-                    reject(err);
-                }
-            }, delay);
-        }), () => {
-            // onPreempt — explicit stop / restart arrived. Cancel the
-            // pending timer so the restart never fires.
-            if (timer) {
-                clearTimeout(timer);
-                timer = null;
-            }
-        });
-        // Swallow LifecyclePreempted — that's the explicit-stop happy
-        // path, not an error. Anything else gets logged.
-        restartPromise.catch((err) => {
-            if (err instanceof LifecyclePreempted)
+        const window = handle.restartWindow ??= new RestartWindow();
+        const recent = window.recent(policy.window);
+        const exhausted = recent >= maxRestarts;
+        if (exhausted) {
+            handle.status = 'crashed';
+            this.logger.error({ app: entry.name }, 'Max restarts exceeded');
+            this.emit('app:escalated', entry.name);
+        }
+        const delay = exhausted ? 10 * 60_000 : this.calculateBackoff(recent, policy.backoff ?? config.supervision.backoff);
+        this.logger.info({ app: entry.name, delay, attempt: exhausted ? 1 : recent + 1 }, 'Scheduling restart');
+        this.clearCoolDown(entry.name);
+        // Waiting must not occupy the lifecycle queue: a running queue head
+        // cannot be preempted. Only the actual launch takes the queue slot.
+        const timer = setTimeout(() => {
+            this.coolDownTimers.delete(entry.name);
+            if (!eligible())
                 return;
-            this.logger.warn({ app: entry.name, err: err.message }, 'Crash restart task rejected');
-        });
-        // Legacy field — callers still poke handle.crashRestartTimer to
-        // check "is a restart pending"; keep it in sync with the queued
-        // timer so existing inspect / status code paths don't break.
-        handle.crashRestartTimer = timer;
+            void this.lifecycleQueue.enqueue(entry.name, 'crash-restart', async () => {
+                // A stop can arrive after the timer fires but before this job runs.
+                if (!eligible())
+                    return;
+                if (exhausted)
+                    window.clear();
+                window.record(policy.window);
+                handle.status = 'stopped';
+                await this.startAppInternal(entry, config);
+            }).catch((err) => {
+                if (err instanceof LifecyclePreempted)
+                    return;
+                const message = err.message;
+                this.logger.error({ app: entry.name, error: message }, 'Restart failed');
+                void this.explainPortConflict(message).then((held) => {
+                    if (held)
+                        this.logger.error({ app: entry.name }, `Restart failed — ${held}`);
+                });
+            });
+        }, delay);
+        timer.unref?.();
+        this.coolDownTimers.set(entry.name, timer);
     }
     calculateBackoff(attempt, backoff) {
         // Delegate to the shared backoff library in titan-pm. Pre-fix the
@@ -2923,6 +3434,7 @@ export class OrchestratorService extends EventEmitter {
         }
         const info = {
             name: handle.name,
+            generation: handle.generation,
             pid: handle.pid,
             status,
             cpu: handle.cpu,
@@ -2932,6 +3444,7 @@ export class OrchestratorService extends EventEmitter {
             instances: handle.instanceCount,
             port: handle.port,
             mode: handle.mode,
+            release: handle.release,
             critical: handle.entry.critical ?? false,
         };
         // Include sub-process topology if present