@omnitron-dev/omnitron 0.3.1 → 0.3.2

package/dist/services/project.service.js

@@ -1,3 +1,43 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { observeStackHealth } from '../project/stack-health.js';
+import { LocalReleaseSelection } from '../project/local-release-selection.js';
+import { resolveAppPath } from '../config/app-path.js';
+import { infrastructureOwnership, ownsStackInfrastructure } from '../project/infrastructure-ownership.js';
+import { InstalledStackResume, resumeDestinations } from '../project/installed-stack-resume.js';
+import { isDeepStrictEqual } from 'node:util';
+import { diagnoseContainers } from '../project/stack-diagnosis.js';
+import { diagnosisStatus } from '../shared/dto/stack-diagnosis.js';
+import { buildInfraFromRequirements, requirementsFromDefinitions } from '../project/requirements-scanner.js';
+import { randomUUID } from 'node:crypto';
+import { NodeStackStop, stackDefinitionFingerprint } from '../project/node-stack-stop.js';
+import { stackStopReview } from '../project/stack-stop-review.js';
+import { inspectStackContainers, removeContainer } from '../infrastructure/container-runtime.js';
+import { stackExecutionKey } from '../shared/dto/stack-execution.js';
+import { publicStack } from '../project/public-stack.js';
+import { TopologyStateStore } from '../project/topology-state.js';
+import { TopologyControl } from '../project/topology-control.js';
+import { artifactVolumeBindings, artifactVolumeEntries, bindArtifactVolumes } from '../release/artifact-volumes.js';
+import { mergeInfrastructure, mergeInferredInfrastructure } from '../infrastructure/merge-config.js';
+export { mergeInfrastructure } from '../infrastructure/merge-config.js';
+import { currentActor, describeFailure } from './audit.service.js';
+import { publicLaunchFailure } from '../project/launch-failure.js';
+import { nodeApplicationNames, resolveNodePlacements, stackNodeKey } from '../project/stack-placement.js';
+import { StackTargets } from '../project/stack-targets.js';
+import { configurationInfo, publicStackName, validateConfigurationNames } from '../project/configuration-catalog.js';
+import { nodePlacement, observeStack } from '../project/stack-observation.js';
+import { getCachedBootstrapDefinition } from '../orchestrator/bootstrap-loader.js';
+import { BootstrapMetadataStore, readBootstrapMetadata, metadataSourceChanged, TOPOLOGY_REFRESH_TIMEOUT_MS } from '../project/bootstrap-metadata.js';
+import { appDependencies } from '../project/dependency-topology.js';
+import { isControlPlaneWorkspace } from '../project/workspace-kind.js';
+import { RecoveryMutation, RecoveryBusyError } from '../daemon/recovery-state.js';
 /**
  * ProjectService — Manages projects and their stacks
  *
@@ -24,7 +64,7 @@ import { reportPhases } from '../project/deploy-phases.js';
 import { effectiveAppName } from '../orchestrator/orchestrator.service.js';
 import { summariseSync } from './sync-summary.js';
 import { StackInfrastructureManager } from '../infrastructure/stack-infra-manager.js';
-import { describeProvisioning, summariseProvisioning } from '../infrastructure/provisioning-outcome.js';
+import { describeProvisioning, summariseProvisioning, stackServiceObservation } from '../infrastructure/provisioning-outcome.js';
 import { waitForPostgres } from './wait-for-postgres.js';
 import { resolveStack, resolvedConfigToEnv } from '../project/config-resolver.js';
 import { resolveStartupOrder } from '../orchestrator/dependency-resolver.js';
@@ -34,8 +74,9 @@ import { NODE_STACK } from '../project/node-app-config.js';
 import { overlayCredentials } from '../infrastructure/node-credentials.js';
 import { readDeclaredConfig, withDeclaredConfig } from '../project/declared-config.js';
 import { bindService } from '../infrastructure/service-binding.js';
-import { RemoteDeployer, stackNodeToDeployTarget, withNodeCredentials, } from './remote-deployer.service.js';
+import { RemoteDeployer, stackNodeToDeployTarget, withNodeCredentials, withDeploymentProgress, } from './remote-deployer.service.js';
 import { withNodeLeases } from './node-deploy-lease.js';
+import { readDeploymentProgress } from '../shared/release-reading.js';
 import { DEFAULT_MAINTENANCE_TIMING, MaintenanceLock } from './maintenance-lock.js';
 import { gatewayRedisDb } from '../infrastructure/gateway-redis-db.js';
 /**
@@ -45,7 +86,21 @@ import { gatewayRedisDb } from '../infrastructure/gateway-redis-db.js';
  */
 const MAINTENANCE_PROBE_PATHS = ['/', '/api/main/health'];
 import { migrationOutput } from './migration-output.js';
+import { redactDiagnosticText } from '@omnitron-dev/titan/diagnostics';
+import { COMPILED_MIGRATION_ENTRY, localMigrationTargets, requestedMigrations, migrationDatabaseEnvironment, validateMigrationDestinations, validateMigrationOwners, orderMigrationPlacements } from './migration-target.js';
+import { executeLocalMigration } from './migration-process.js';
+import { expandServiceDeclarations, normalizeInfraConfig } from '../infrastructure/config-normalizer.js';
+import { createDefaultRegistry } from '../infrastructure/presets/index.js';
+import { readArchiveInfrastructure } from '../release/infrastructure.js';
+import { releaseArtifactOrigins } from '../release/origin.js';
 import { ExecutionService } from '../execution/execution.service.js';
+class LocalReleaseStopRequired extends Error {
+}
+function sameLaunchCode(actual, expected) {
+    if (!expected.releaseRoot)
+        return !actual.releaseRoot;
+    return actual.bootstrap === expected.bootstrap && actual.script === expected.script && actual.releaseRoot === expected.releaseRoot;
+}
 /** Whether two paths name one directory — symlinks and `..` resolved. */
 function samePath(a, b) {
     const real = (p) => {
@@ -58,25 +113,6 @@ function samePath(a, b) {
     };
     return real(a) === real(b);
 }
-/**
- * The infrastructure a stack actually gets: the ecosystem's, plus its own.
- *
- * Shallow for the top-level keys — a stack that declares `postgres` replaces
- * the ecosystem's — and merged for `services`, because those are named
- * things and a stack adding one must not remove the rest.
- */
-export function mergeInfrastructure(ecosystemConfig, stackConfig) {
-    if (!stackConfig.infrastructure && !ecosystemConfig.infrastructure)
-        return undefined;
-    return {
-        ...ecosystemConfig.infrastructure,
-        ...stackConfig.infrastructure,
-        services: {
-            ...ecosystemConfig.infrastructure?.services,
-            ...stackConfig.infrastructure?.services,
-        },
-    };
-}
 // =============================================================================
 // ProjectService
 // =============================================================================
@@ -100,16 +136,93 @@ const CREDENTIALED_SERVICES = ['postgres', 'redis', 'minio'];
 export class ProjectService extends EventEmitter {
     logger;
     orchestrator;
+    daemonStateStore;
+    recoveryRegistryDigest() { return this.registry.recoveryDigest(); }
+    /** Read-only bookkeeping; no timers are stopped and no Docker call runs. */
+    captureRecoveryState() {
+        if (this.rereading?.size || this.ownershipFrozen || this.resumingInstalled || this.startsInFlight.size || this.stopsInFlight.size || this.nodeStackStop.busy || this.reconcilingStacks ||
+            [...this.stackStates.values()].some(state => state.status === 'starting' || state.status === 'stopping')) {
+            throw new RecoveryBusyError('Project ownership is changing; a recovery snapshot is not ready');
+        }
+        return this.projectSnapshot(this.infraManager.captureRecoveryState(), this.resumeTimer !== null);
+    }
+    projectSnapshot(infrastructure, reconciling) {
+        return structuredClone({
+            projects: [...this.configRegistry], infrastructure,
+            bootstrapTopology: [...this.bootstrapTopology],
+            resumeBackoff: [...this.resumeBackoff], reconciling,
+            stacks: [...this.stackStates].map(([key, { infraService: _infra, ...state }]) => [key, state]),
+        });
+    }
+    /** Capture controllers' bookkeeping, retaining native application ownership in the execution host. */
+    async prepareHandoff() {
+        if (this.rereading?.size || this.ownershipFrozen || this.resumingInstalled || this.startsInFlight.size || this.stopsInFlight.size || this.nodeStackStop.busy || this.reconcilingStacks || [...this.stackStates.values()].some(state => state.status === 'starting' || state.status === 'stopping')) {
+            throw new Error('A stack lifecycle operation is active; finish it before transferring the backend');
+        }
+        this.handoffReconciling = this.resumeTimer !== null;
+        this.ownershipFrozen = true;
+        if (this.resumeTimer)
+            clearInterval(this.resumeTimer);
+        this.resumeTimer = null;
+        try {
+            const infrastructure = await this.infraManager.prepareHandoff();
+            return this.projectSnapshot(infrastructure, this.handoffReconciling);
+        }
+        catch (error) {
+            this.resumeAfterHandoff();
+            throw error;
+        }
+    }
+    resumeAfterHandoff() {
+        this.ownershipFrozen = false;
+        this.infraManager.resumeAfterHandoff();
+        if (this.handoffReconciling)
+            this.startEnabledStacksReconciler();
+        this.handoffReconciling = false;
+    }
+    async adoptHandoff(snapshot) {
+        if (this.stackStates.size)
+            throw new Error('Project runtime is not empty before adoption');
+        for (const [name, project] of snapshot.projects) {
+            const registered = this.registry.get(name);
+            if (!registered)
+                throw new Error(`Project disappeared during backend transfer: ${name}`);
+            this.configRegistry.set(name, project);
+        }
+        for (const [key, definition] of snapshot.bootstrapTopology ?? [])
+            this.bootstrapTopology.set(key, definition);
+        await this.infraManager.adoptHandoff(snapshot.infrastructure);
+        for (const [key, value] of snapshot.resumeBackoff)
+            this.resumeBackoff.set(key, value);
+        this.handoffReconciling = snapshot.reconciling;
+        this.ownershipFrozen = true;
+        for (const [key, state] of snapshot.stacks) {
+            this.stackStates.set(key, { ...state, infraService: this.infraManager.getInstance(state.project, state.stack) });
+        }
+    }
     registry;
+    topologyControl;
+    bootstrapTopology = new Map();
+    bootstrapMetadata;
     configRegistry = new Map();
     stackStates = new Map();
     infraManager;
+    nodeStackStop;
+    clusterStop;
+    installedResume;
+    coordinatingResume = false;
+    get resumingInstalled() { return this.coordinatingResume || this.installedResume?.busy === true; }
+    hostedInfrastructure = () => undefined;
+    drainHostedProvisioning = async () => { };
+    stopsInFlight = new Map();
     slaveConnector = null;
     deployer;
     // Enabled-stacks reconciler state (see startEnabledStacksReconciler)
     resumeTimer = null;
     resumeBackoff = new Map();
-    dockerWasAvailable = null;
+    reconcilingStacks = false;
+    handoffReconciling = false;
+    ownershipFrozen = false;
     syncService;
     secrets;
     audit;
@@ -127,6 +240,7 @@ export class ProjectService extends EventEmitter {
         super();
         this.logger = logger;
         this.orchestrator = orchestrator;
+        this.daemonStateStore = daemonStateStore;
         this.syncService = options.syncService;
         this.secrets = options.secrets;
         this.audit = options.audit;
@@ -135,11 +249,237 @@ export class ProjectService extends EventEmitter {
         // pid-lock, etc.). The registry itself is unchanged in API;
         // only its backing storage moved.
         this.registry = new ProjectRegistry(daemonStateStore);
+        this.bootstrapMetadata = new BootstrapMetadataStore(daemonStateStore);
+        this.topologyControl = new TopologyControl(new TopologyStateStore(daemonStateStore), {
+            configuration: async (scope) => {
+                const config = await this.loadProjectConfig(scope.project);
+                const stack = this.resolveStacks(config, scope.project)[scope.stack];
+                if (!stack)
+                    throw new Error(`Stack '${scope.stack}' not found`);
+                return { config, stack, apps: this.resolveStackApps(stack, config), userStacks: this.loadUserStacks(scope.project) };
+            },
+            observation: scope => this.withRemoteAppStatuses(scope.project, this.getStack(scope.project, scope.stack)),
+            dependencies: scope => this.getTopology(scope),
+            nodes: () => daemonStateStore.selectNodesSync().map(node => ({
+                id: node.id, name: node.name, host: node.host, port: node.port,
+            })),
+        });
         this.infraManager = new StackInfrastructureManager(logger);
+        this.nodeStackStop = new NodeStackStop(daemonStateStore, {
+            execution: orchestrator,
+            definition: (scope, cached) => this.stopDefinition(scope, cached),
+            containers: scope => inspectStackContainers(scope),
+            disableResume: scope => this.registry.setStackEnabled(scope.project, scope.stack, false),
+            retireInfrastructure: async (scope) => {
+                await this.drainHostedProvisioning(scope);
+                await this.hostedInfrastructure()?.retireStack(scope);
+                await this.infraManager.getInstance(scope.project, scope.stack)?.retireStack(scope);
+            },
+            removeContainer: id => removeContainer(id, { graceful: true }),
+        });
         // The deployer reaches nodes through the same SSH implementation as the
         // health checks, which is the only one that can present a password or a
         // key passphrase — see the note at the top of `remote-deployer.service.ts`.
         this.deployer = new RemoteDeployer(logger, new ExecutionService(logger));
+        this.deployer.onProgress(event => {
+            if (event.project && event.stack)
+                this.emit('stack:deploy_progress', event.project, event.stack, event);
+        });
+    }
+    setHostedInfrastructure(get, drain) {
+        this.hostedInfrastructure = get;
+        this.drainHostedProvisioning = drain;
+    }
+    /** Authority needed by an explicit start, including infrastructure provisioning. */
+    assertStartAuthority(scope, stack) {
+        if (this.clusterStop && (stack.type !== 'local' || stack.managedOrigin)) {
+            throw new Error('Deploying this allocation requires a recipient-fenced deployment adapter. To recover retained applications after a confirmed stop, use stack resume.');
+        }
+        this.assertStackMutable(stack.managedOrigin ?? scope);
+    }
+    assertStackMutable(scope) {
+        this.assertInfrastructureMutable(scope);
+    }
+    assertInfrastructureMutable(scope) {
+        if (this.clusterStop)
+            throw new Error('Direct cluster lifecycle changes require recipient-fenced authority. Use a reviewed stack stop or resume the installed applications.');
+        this.nodeStackStop.assertMutable(scope);
+    }
+    setClusterStop(recipient, election) {
+        this.nodeStackStop.setRecipient(recipient);
+        this.clusterStop = { recipient, election };
+        this.installedResume = new InstalledStackResume(recipient, this.nodeStackStop, this.daemonStateStore, this.orchestrator, async (scope) => {
+            const { runtime, fingerprint } = await this.stopDefinition({ ...scope, applications: true }, true);
+            if (!runtime)
+                throw new Error('No installed application allocation is bound to this stack');
+            const config = this.getLoadedConfig(runtime.project);
+            const stack = this.resolveStacks(config, runtime.project)[runtime.stack];
+            if (ownsStackInfrastructure(stack))
+                throw new Error('Installed recovery requires application-only infrastructure ownership');
+            const order = resolveStartupOrder(this.resolveStackApps(stack, config)).flat().map(app => app.name);
+            return { runtime, fingerprint, order };
+        }, (runtime, receipt) => {
+            const state = this.stackStates.get(stackExecutionKey(runtime));
+            if (state) {
+                state.status = receipt.outcome === 'running' ? 'running' : 'error';
+                state.startedAt = receipt.outcome === 'running' ? Date.parse(receipt.observedAt) : null;
+            }
+        });
+    }
+    resumeRecipient() {
+        if (!this.installedResume)
+            throw new Error('This node is not enrolled for signed application recovery');
+        if (this.ownershipFrozen || this.reconcilingStacks || this.startsInFlight.size || this.stopsInFlight.size || this.nodeStackStop.busy) {
+            throw new Error('A stack operation or backend transfer is in progress');
+        }
+        return this.installedResume;
+    }
+    prepareNodeInstalledResume(request) { return this.resumeRecipient().prepare(request); }
+    executeNodeInstalledResume(request) { return this.resumeRecipient().execute(request); }
+    getNodeInstalledResumeReceipt(request) {
+        if (!this.installedResume)
+            throw new Error('This node is not enrolled for signed application recovery');
+        return this.installedResume.receipt(request);
+    }
+    async resumeInstalledStack(project, stack) {
+        const scope = { project, stack }, key = stackExecutionKey(scope);
+        const cluster = this.clusterStop;
+        if (!cluster?.election?.isLeader)
+            throw new Error('Installed stack recovery requires the elected controller');
+        const election = cluster.election;
+        this.resumeRecipient();
+        if (this.resumingInstalled)
+            throw new Error('Another installed allocation is resuming');
+        this.coordinatingResume = true;
+        try {
+            const stop = this.daemonStateStore.kvGetSync(`stack:${key}:last-stop`, { strict: true });
+            if (stop?.phase !== 'stopped' || stop.supersededAt || !stop.intentCommitted || !stop.nodes.length) {
+                throw new Error('Review and complete a signed stop on every recipient before installed recovery');
+            }
+            const config = await this.loadProjectConfig(project);
+            const declaration = this.resolveStacks(config, project)[stack];
+            if (!declaration)
+                throw new Error('Registered stack configuration is unavailable');
+            const apps = this.resolveStackApps(declaration, config);
+            const source = declaration.managedOrigin ?? scope;
+            const operationId = randomUUID();
+            const placements = declaration.type === 'local'
+                ? [{ node: undefined, apps }]
+                : resolveNodePlacements(declaration, apps);
+            if (declaration.type === 'local' && !declaration.managedOrigin)
+                throw new Error('Local recovery requires an explicitly bound allocation');
+            const targets = placements.map(placement => {
+                const { node } = placement;
+                const nodeId = node ? node.nodeId : cluster.recipient.audience.nodeId;
+                const label = node ? stackNodeKey(node.host, node.port) : 'local';
+                const stopped = stop.nodes.find(item => item.authority?.nodeId === nodeId &&
+                    // Older stop journals used unbracketed IPv6 endpoint strings.
+                    (item.node === label || (node && item.node === `${node.host}:${node.port ?? 9700}`)));
+                if (!nodeId || !placement.apps.length || !stopped?.observedAt || !stopped.operationId || stopped.outcome !== 'stopped' ||
+                    stopped.authority?.clusterId !== cluster.recipient.audience.clusterId) {
+                    throw new Error(`Target '${label}' lacks a matching signed stop for the application placement`);
+                }
+                const request = { ...source, audience: { clusterId: stopped.authority.clusterId, nodeId },
+                    operationId, stopOperationId: stopped.operationId, stopObservedAt: stopped.observedAt, apps: placement.apps.map(app => app.name) };
+                if (!node)
+                    return { node: label, request, prepare: () => this.prepareNodeInstalledResume(request),
+                        execute: (plan, permit) => this.executeNodeInstalledResume({ ...request, plan, permit }),
+                        receipt: async () => this.getNodeInstalledResumeReceipt(request) };
+                const connector = this.slaveConnector;
+                if (!connector)
+                    throw new Error('Cluster node RPC is unavailable');
+                const rpc = (method, input, read = false) => connector.invokeOnSlave(node.host, node.port ?? 9700, 'OmnitronProject', method, [input], { retryOnDisconnect: read });
+                return { node: label, request,
+                    prepare: () => rpc('prepareNodeInstalledResume', request, true),
+                    execute: (plan, permit) => rpc('executeNodeInstalledResume', { ...request, plan, permit }),
+                    receipt: () => rpc('getNodeInstalledResumeReceipt', request, true) };
+            });
+            if (targets.length !== stop.nodes.length || new Set(targets.map(t => t.request.audience.nodeId)).size !== targets.length) {
+                throw new Error('Placement differs from the last confirmed stop');
+            }
+            const report = { ...scope, operationId, stopOperationId: stop.id, outcome: 'unconfirmed', nodes: [] };
+            const journal = `stack:${key}:last-resume`;
+            const previous = this.daemonStateStore.kvGetSync(journal, { strict: true });
+            if (previous?.stopOperationId === stop.id)
+                throw new Error('Recovery was already attempted. Inspect its receipts and obtain a fresh signed stop before retrying.');
+            let targetsRemembered = false;
+            const result = await resumeDestinations(report, targets, plan => election.authorizeEffect(plan), progress => {
+                if (!targetsRemembered && declaration.type !== 'local') {
+                    this.rememberStackTargets(project, stack, declaration, config);
+                    targetsRemembered = true;
+                }
+                this.daemonStateStore.kvUpdateSync(journal, current => {
+                    if (current?.stopOperationId === stop.id && current.operationId !== operationId)
+                        throw new Error('A different controller already attempted this stop');
+                    return progress;
+                });
+            });
+            this.stackStates.set(key, { project, stack, config: declaration, status: result.outcome === 'running' ? 'running' : 'error',
+                startedAt: result.outcome === 'running' ? Date.now() : null, infraService: null });
+            if (result.outcome === 'running')
+                this.markPriorStopSuperseded(project, stack, stop.id);
+            return result;
+        }
+        finally {
+            this.coordinatingResume = false;
+        }
+    }
+    async stopDefinition(scope, cached = false) {
+        let allocation;
+        let unbound = false;
+        // Only registrations owned by this project can claim one of its allocations.
+        const registrations = this.registry.get(scope.project) ? this.registry.registrations(scope.project) : [];
+        for (const registration of registrations) {
+            const config = cached ? this.getLoadedConfig(registration.name) : await this.loadProjectConfig(registration.name);
+            if (!config)
+                throw new Error(`Configuration '${registration.name}' is unavailable for inspection; refresh its declarations`);
+            for (const [name, stack] of Object.entries(this.resolveStacks(config, registration.name))) {
+                if (stack.type !== 'local')
+                    continue;
+                if (!stack.managedOrigin) {
+                    unbound = true;
+                    continue;
+                }
+                if (stack.managedOrigin.project !== scope.project || stack.managedOrigin.stack !== scope.stack)
+                    continue;
+                if (allocation)
+                    throw new Error('Ambiguous node allocation ownership');
+                if (!scope.applications)
+                    throw new Error('Node owns an application allocation outside the requested placement; reconcile the topology');
+                const runtime = { project: registration.name, stack: name };
+                allocation = { runtime, fingerprint: stackDefinitionFingerprint([runtime.project, name, stack, config.apps]) };
+            }
+        }
+        if (!allocation && (scope.applications || unbound))
+            throw new Error(`Node allocation '${scope.project}/${scope.stack}' has no verified source-stack binding; bind its managedOrigin before remote stop`);
+        return allocation ?? { runtime: null, fingerprint: stackDefinitionFingerprint([scope.project, scope.stack, false]) };
+    }
+    inspectNodeStackStop(scope) {
+        return this.nodeStackStop.inspect(scope);
+    }
+    async prepareNodeStackStop(scope) {
+        if (this.resumingInstalled)
+            throw new Error('An installed allocation is resuming');
+        if (this.ownershipFrozen)
+            throw new Error('Project ownership is frozen for backend transfer');
+        if (this.startsInFlight.size || this.stopsInFlight.size)
+            throw new Error('A stack lifecycle operation is active; retry when it finishes');
+        return this.nodeStackStop.prepare(scope);
+    }
+    async executeNodeStackStop(scope) {
+        if (this.resumingInstalled)
+            throw new Error('An installed allocation is resuming');
+        if (this.ownershipFrozen)
+            throw new Error('Project ownership is frozen for backend transfer');
+        const receipt = await this.nodeStackStop.execute(scope);
+        if (receipt.applications) {
+            const state = this.stackStates.get(stackExecutionKey(receipt.applications));
+            if (state) {
+                state.status = 'stopped';
+                state.startedAt = null;
+            }
+        }
+        return receipt;
     }
     /**
      * Adopt the daemon's mesh connector.
@@ -175,7 +515,7 @@ export class ProjectService extends EventEmitter {
         const declared = stackNodeToDeployTarget(node);
         if (!this.resolveNodeCredentials)
             return declared;
-        const registered = await this.resolveNodeCredentials(node.host).catch(() => null);
+        const registered = await this.resolveNodeCredentials(node.host, node.port ?? 9700, node.nodeId);
         return withNodeCredentials(declared, registered);
     }
     /**
@@ -213,17 +553,99 @@ export class ProjectService extends EventEmitter {
      * `deploying` from the first second to the last, and every event that said
      * WHERE it was reached a handler that re-emitted it to nobody.
      */
-    getDeployProgress() {
-        return this.deployer.getProgress();
+    getDeployProgress(scope) {
+        const records = this.deployer.getProgress();
+        if (!scope)
+            return records;
+        const configurations = this.registry.registrations(scope.project).map(configurationInfo);
+        return readDeploymentProgress(records, { name: scope.project, configurations }, scope.stack).transfers;
     }
     listProjects() {
-        return this.registry.list().map((p) => this.toProjectInfo(p));
+        const revision = this.registry.catalogRevision();
+        return this.registry.list().filter(project => !isControlPlaneWorkspace(project.path)).map(project => {
+            const records = this.registry.registrations(project.name);
+            const infos = records.map(record => this.toProjectInfo(record));
+            return {
+                ...this.toProjectInfo(project),
+                enabledStacks: records.flatMap(record => (record.enabledStacks ?? []).map(stack => publicStackName(record, stack))),
+                runningStacks: infos.reduce((count, info) => count + info.runningStacks, 0),
+                totalStacks: infos.reduce((count, info) => count + info.totalStacks, 0),
+                configurations: records.map(configurationInfo),
+                catalogRevision: revision,
+            };
+        });
+    }
+    /** Source inventory for execution, backup and recovery; not the public project catalogue. */
+    listProjectRegistrations() {
+        return this.registry.listRegistrations().filter(project => !isControlPlaneWorkspace(project.path)).map(project => this.toProjectInfo(project));
+    }
+    projectConfigurations(project) {
+        return this.registry.registrations(project);
+    }
+    async resolveProjectStack(scope, options = {}) {
+        const resolved = this.registry.resolveStack(scope);
+        if (resolved.project !== scope.project) {
+            const config = options.readOnly ? this.getLoadedConfig(scope.project) : await this.ensureConfig(scope.project);
+            if (!config)
+                throw new Error('Project configuration is not loaded; reload it before resolving imported stack diagnostics');
+            if (Object.hasOwn(this.resolveStacks(config, scope.project), scope.stack))
+                throw new Error(`Ambiguous stack '${scope.stack}': both default and imported configurations declare it`);
+        }
+        return { ...scope, ...resolved };
+    }
+    publicStackInfo(project, source, info) {
+        return {
+            ...publicStack(info),
+            name: project === source.name ? info.name : publicStackName(source, info.name),
+            runtimeScope: { project: source.name, stack: info.name },
+        };
+    }
+    async importProjectConfiguration(input) {
+        validateConfigurationNames(input?.name, input?.stacks);
+        if (typeof input.project !== 'string' || typeof input.path !== 'string' || typeof input.expectedRevision !== 'string')
+            throw new Error('Project, configuration path and catalogue revision are required');
+        const candidate = this.registry.prepareConfiguration(input);
+        const { loadEcosystemConfig } = await import('../config/loader.js');
+        const source = await loadEcosystemConfig(candidate.path);
+        const sourceStacks = this.resolveStacks(source, candidate);
+        const declared = Object.keys(sourceStacks);
+        if (declared.length !== Object.keys(input.stacks).length || declared.some(name => !Object.hasOwn(input.stacks, name)))
+            throw new Error('Map every configured source stack explicitly; none may disappear during import');
+        const owner = await this.ensureConfig(input.project);
+        const occupied = new Set(Object.keys(this.resolveStacks(owner, input.project)));
+        for (const name of Object.values(input.stacks))
+            if (occupied.has(name))
+                throw new Error(`Stack '${name}' already exists in the project default configuration`);
+        const existing = this.registry.get(candidate.name);
+        if (existing) {
+            for (const name of existing.enabledStacks ?? [])
+                if (!input.stacks[name])
+                    throw new Error(`Auto-start source stack '${name}' is missing from the mapping`);
+            for (const name of this.getRunningStacks(existing.name, true))
+                if (!input.stacks[name])
+                    throw new Error(`Running source stack '${name}' is missing from the mapping`);
+            for (const name of Object.keys(this.loadUserStacks(existing.name)))
+                if (!input.stacks[name])
+                    throw new Error(`User-defined source stack '${name}' is missing from the mapping`);
+        }
+        const record = this.registry.importConfiguration(input);
+        this.configRegistry.set(record.name, { config: source, loadedAt: Date.now() });
+        await this.audit?.record({ action: 'project.configuration.import', resourceType: 'project', resourceId: input.project,
+            details: { configuration: input.name, runtimeProject: record.name, stacks: input.stacks } });
+        this.emit('project:updated', input.project, {});
+        return this.getProject(input.project);
+    }
+    async detachProjectConfiguration(data) {
+        this.registry.detachConfiguration(data.project, data.name, data.expectedRevision);
+        await this.audit?.record({ action: 'project.configuration.detach', resourceType: 'project', resourceId: data.project,
+            details: { configuration: data.name } });
+        this.emit('project:updated', data.project, {});
     }
     getProject(name) {
         const project = this.registry.get(name);
         if (!project)
             throw new Error(`Project '${name}' not found`);
-        return this.toProjectInfo(project);
+        return this.listProjects().find(record => record.name === (project.configuration?.project ?? name));
     }
     async addProject(name, projectPath) {
         // Already registered AT THIS PATH: read it again rather than refuse.
@@ -257,19 +679,32 @@ export class ProjectService extends EventEmitter {
      * running apps were redefined.
      */
     async rereadProject(name) {
+        if (this.ownershipFrozen || this.rereading?.has(name) || [...this.startsInFlight.keys()].some(key => key.startsWith(name + '/')))
+            throw new Error('Project launch definitions are changing; retry after the current operation');
+        (this.rereading ??= new Set()).add(name);
+        try {
+            return await this.rereadProjectOnce(name);
+        }
+        finally {
+            this.rereading.delete(name);
+        }
+    }
+    async rereadProjectOnce(name) {
         this.configRegistry.delete(name);
         const config = await this.loadProjectConfig(name);
         const stacks = this.resolveStacks(config, name);
         let redefined = 0;
         for (const [key, state] of this.stackStates) {
-            if (!key.startsWith(`${name}/`) || state.status === 'stopped' || state.status === 'error')
+            if (!key.startsWith(`${name}/`) || state.status === 'stopped' || (state.status === 'error' && state.startedAt === null))
                 continue;
             const stackConfig = stacks[state.stack];
             // A remote stack's apps run on its nodes; they are redefined there.
             if (!stackConfig || stackConfig.type !== 'local')
                 continue;
-            const definitions = await this.loadAppDefinitions(name, stackConfig, config);
-            const entries = this.resolveStackApps(stackConfig, config);
+            const entries = await this.launchEntries(name, state.stack, stackConfig, config);
+            if (entries.some(entry => entry.releaseRoot) && !stackConfig.managedOrigin)
+                await this.checkLocalOwner(name, state.stack, entries, false);
+            const definitions = await this.loadAppDefinitions(name, stackConfig, config, entries);
             const stackEnv = await this.stackEnvFor(name, state.stack, stackConfig, entries.map((e) => e.name));
             const build = this.stackEntryBuilder(name, state.stack, stackConfig, config, definitions, stackEnv);
             for (const entry of entries) {
@@ -284,6 +719,17 @@ export class ProjectService extends EventEmitter {
     }
     /** Refresh only local container monitoring from the current validated project config. */
     async refreshInfrastructureOwnership(projectName, stackName) {
+        if (this.ownershipFrozen || this.resumingInstalled || this.startsInFlight.size || this.stopsInFlight.size || this.reconcilingStacks)
+            throw new Error('Project lifecycle ownership is changing; retry the infrastructure refresh after it settles');
+        this.ownershipFrozen = true;
+        try {
+            return await this.refreshInfrastructureOwnershipOnce(projectName, stackName);
+        }
+        finally {
+            this.ownershipFrozen = false;
+        }
+    }
+    async refreshInfrastructureOwnershipOnce(projectName, stackName) {
         const project = this.registry.get(projectName);
         if (!project)
             throw new Error(`Project '${projectName}' not found`);
@@ -292,13 +738,21 @@ export class ProjectService extends EventEmitter {
         const stack = this.resolveStacks(config, projectName)[stackName];
         if (!stack || stack.type !== 'local')
             throw new Error('Ownership refresh requires a declared local stack');
-        const definitions = await this.loadAppDefinitions(projectName, stack, config);
+        if (!ownsStackInfrastructure(stack)) {
+            const released = await this.infraManager.refreshOwnership(projectName, stackName, stack, {}, undefined, project.path);
+            const state = this.stackStates.get(`${projectName}/${stackName}`);
+            if (state) {
+                state.config = stack;
+                state.infraService = null;
+            }
+            return released;
+        }
+        const entries = await this.launchEntries(projectName, stackName, stack, config);
+        const definitions = await this.loadAppDefinitions(projectName, stack, config, entries);
         // The same requirements merge used at stack start. A failed fresh scan must
         // refuse a handoff rather than silently releasing auto-detected services.
-        const { scanRequirements, buildInfraFromRequirements } = await import('../project/requirements-scanner.js');
-        const auto = buildInfraFromRequirements(await scanRequirements(this.resolveStackApps(stack, config), project.path));
-        const explicit = mergeInfrastructure(config, stack);
-        const effective = { ...auto, ...explicit, services: { ...explicit?.services } };
+        const auto = buildInfraFromRequirements(requirementsFromDefinitions(definitions));
+        const effective = mergeInferredInfrastructure(auto, mergeInfrastructure(config, stack));
         return this.infraManager.refreshOwnership(projectName, stackName, stack, effective, definitions, project.path);
     }
     updateProject(name, data) {
@@ -308,7 +762,7 @@ export class ProjectService extends EventEmitter {
         if (data.path) {
             const nextPath = path.resolve(data.path);
             if (nextPath !== path.resolve(project.path)) {
-                const running = this.getRunningStacks(name);
+                const running = this.getRunningStacks(name, true);
                 if (running.length > 0) {
                     throw new Error(`Project '${name}' has running stacks: ${running.join(', ')}. Stop them before changing its path.`);
                 }
@@ -324,7 +778,7 @@ export class ProjectService extends EventEmitter {
     }
     removeProject(name) {
         // Stop all running stacks for this project first
-        const runningStacks = this.getRunningStacks(name);
+        const runningStacks = this.getRunningStacks(name, true);
         if (runningStacks.length > 0) {
             throw new Error(`Project '${name}' has running stacks: ${runningStacks.join(', ')}. Stop them first.`);
         }
@@ -386,7 +840,7 @@ export class ProjectService extends EventEmitter {
         // Check for duplicates in both config stacks and user stacks
         const config = await this.loadProjectConfig(project);
         const allStacks = this.resolveStacks(config, project);
-        if (allStacks[input.name]) {
+        if (allStacks[input.name] || this.registry.registrations(project).some(source => Object.values(source.configuration?.stacks ?? {}).includes(input.name))) {
             throw new Error(`Stack '${input.name}' already exists`);
         }
         // Build stack config
@@ -394,7 +848,12 @@ export class ProjectService extends EventEmitter {
             type: input.type,
             apps: input.apps,
             ...(input.nodeIds && input.type !== 'local' && {
-                nodes: input.nodeIds.map((id) => ({ host: id, role: 'app' })),
+                nodes: input.nodeIds.map((id) => {
+                    const node = this.daemonStateStore.selectNodesSync().find(candidate => candidate.id === id);
+                    if (!node)
+                        throw new Error(`Fleet node '${id}' not found; register it before creating a stack`);
+                    return { nodeId: node.id, host: node.host, port: node.port, label: node.name, role: 'app' };
+                }),
             }),
         };
         // For local stacks, auto-generate optimal infrastructure from app requirements
@@ -437,7 +896,6 @@ export class ProjectService extends EventEmitter {
                     // `pull access denied` for, while the preset named the image the
                     // resolver actually uses. A prefetch that pulls something else is
                     // worse than none — it reports success and warms nothing.
-                    const { createDefaultRegistry } = await import('../infrastructure/presets/index.js');
                     const presets = createDefaultRegistry();
                     const images = new Set();
                     for (const name of ['postgres', 'redis', 'minio']) {
@@ -483,6 +941,11 @@ export class ProjectService extends EventEmitter {
         if (state && state.status !== 'stopped') {
             throw new Error(`Stack '${stackName}' is currently ${state.status}. Stop it first.`);
         }
+        if (userStacks[stackName].type === 'local') {
+            const selection = this.localSelection(project, stackName).read();
+            if (selection.release)
+                throw new Error('Clear the selected release before deleting this stack');
+        }
         this.deleteUserStack(project, stackName);
         this.stackStates.delete(stateKey);
         this.logger.info({ project, stack: stackName }, 'Stack deleted');
@@ -494,14 +957,18 @@ export class ProjectService extends EventEmitter {
             throw new Error(`Project '${project}' not found`);
         return path.join(proj.path, 'omnitron.stacks.json');
     }
-    loadUserStacks(project) {
-        const filePath = this.getUserStacksPath(project);
+    loadUserStacks(project, filePath = this.getUserStacksPath(project)) {
         try {
             const raw = fs.readFileSync(filePath, 'utf-8');
-            return JSON.parse(raw);
+            const stacks = JSON.parse(raw);
+            if (!stacks || typeof stacks !== 'object' || Array.isArray(stacks))
+                throw new Error('Expected an object of stacks');
+            return stacks;
         }
-        catch {
-            return {};
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return {};
+            throw new Error(`Cannot read stack overrides for '${project}'; file left intact`, { cause: error });
         }
     }
     saveUserStack(project, name, config) {
@@ -519,6 +986,368 @@ export class ProjectService extends EventEmitter {
     // ===========================================================================
     // Stacks
     // ===========================================================================
+    /** Remote deployments across projects; local process/container inventory has its own authoritative source. */
+    async getTopologyInventory() {
+        const result = {
+            generatedAt: new Date().toISOString(), deployments: [], errors: [],
+        };
+        for (const project of this.listProjectRegistrations()) {
+            const source = this.registry.get(project.name);
+            const owner = source.configuration?.project ?? project.name;
+            try {
+                await this.ensureConfig(project.name);
+                const stacks = this.listStacks(project.name).filter(stack => stack.type !== 'local');
+                for (let offset = 0; offset < stacks.length; offset += 4) {
+                    const observations = await Promise.allSettled(stacks.slice(offset, offset + 4).map(stack => this.withRemoteAppStatuses(project.name, stack)));
+                    observations.forEach((observation, index) => {
+                        if (observation.status === 'fulfilled') {
+                            result.deployments.push({ project: owner, stack: this.publicStackInfo(owner, source, observation.value) });
+                        }
+                        else {
+                            result.errors.push({
+                                project: owner, stack: publicStackName(source, stacks[offset + index].name), reason: 'Node inventory could not be read',
+                            });
+                        }
+                    });
+                }
+            }
+            catch {
+                result.errors.push({ project: owner, reason: `Configuration '${source.configuration?.name ?? 'default'}' could not be read` });
+            }
+        }
+        return result;
+    }
+    async getTopologyWorkspace(scope) {
+        return this.topologyControl.workspace(scope);
+    }
+    async saveTopologyDraft(data) {
+        return this.topologyControl.saveDraft(data);
+    }
+    async planTopology(data) {
+        return this.topologyControl.plan(data);
+    }
+    async applyTopologyPlan(data) {
+        const result = await this.topologyControl.apply(data, currentActor());
+        if (result.changed) {
+            // The local FULL commit already contains intent and its receipt; this is a searchable audit copy.
+            await this.audit?.record({
+                action: 'topology.apply', resourceType: 'stack', resourceId: `${data.project}/${data.stack}`,
+                details: {
+                    plan: result.plan.id, revision: result.plan.baseRevision,
+                    effect: result.plan.effect, changes: result.plan.changes,
+                },
+            });
+            this.emit('project:updated', data.project, {});
+        }
+        return result.plan;
+    }
+    /** Reads persisted launch evidence and static JSON only; never imports application code. */
+    readAppDeclaration(project, stack, app, bootstrap) {
+        const state = this.bootstrapMetadata?.readState(bootstrap);
+        const saved = state?.metadata;
+        const launched = this.orchestrator?.getHandle(ProjectService.handleKey(project, stack, app))?.bootstrapMetadata;
+        const observed = launched?.bootstrap === bootstrap ? launched : null;
+        const record = observed && (!saved || observed.capturedAt > saved.capturedAt) ? observed : saved;
+        const metadata = record?.definition ?? getCachedBootstrapDefinition(bootstrap) ?? this.bootstrapTopology.get(bootstrap);
+        const declared = readDeclaredConfig(bootstrap);
+        return { state, record, metadata, declared, observed };
+    }
+    /** Inspect prerequisites without provisioning, migration, application start or bootstrap imports. */
+    diagnosesInFlight = new Map();
+    async diagnoseStack(projectName, stackName) {
+        const key = JSON.stringify([projectName, stackName]);
+        const pending = this.diagnosesInFlight.get(key);
+        if (pending)
+            return pending;
+        const request = this.inspectStackReadiness(projectName, stackName);
+        this.diagnosesInFlight.set(key, request);
+        try {
+            return await request;
+        }
+        finally {
+            this.diagnosesInFlight.delete(key);
+        }
+    }
+    async inspectStackReadiness(projectName, stackName) {
+        const started = Date.now();
+        const checks = [];
+        const deferred = ['Application startup and application health', 'Database authentication, schema and migrations', 'Registry downloads and available storage capacity', 'Configuration changes made after this observation'];
+        const done = () => ({ project: projectName, stack: stackName, checkedAt: new Date().toISOString(), durationMs: Date.now() - started, status: diagnosisStatus(checks), checks, deferred });
+        const add = (code, resource, state, message, action) => checks.push({ code, resource, state, message, ...(action && { action }) });
+        const project = this.registry.get(projectName);
+        if (!project)
+            throw new Error('Project is not registered');
+        const loaded = this.configRegistry.get(projectName);
+        if (!loaded) {
+            add('configuration.unloaded', 'Project configuration', 'unknown', 'Project configuration has not been loaded.', 'Reload the trusted project configuration, then retry.');
+            return done();
+        }
+        const config = loaded.config;
+        const stack = this.resolveStacks(config, projectName)[stackName];
+        if (!stack)
+            throw new Error('Stack is not declared');
+        try {
+            this.assertStartAuthority({ project: projectName, stack: stackName }, stack);
+        }
+        catch (err) {
+            add('start.authority', 'Start authority', 'blocked', err.message, 'Inspect the allocation owner and its stop operation before planning a start.');
+        }
+        add('configuration.loaded', 'Project configuration', 'pass', `Using daemon configuration loaded at ${new Date(loaded.loadedAt).toISOString()}.`, 'Reload project configuration after editing it.');
+        // This is observed history, not a fresh execution of user code. Reuse the
+        // status reader so a recovered app or an intentionally stopped stack does
+        // not keep an obsolete launch failure in its readiness report.
+        if (stack.type === 'local' && this.stackStates.get(`${projectName}/${stackName}`)?.appStartErrors) {
+            const previous = this.toStackInfo(projectName, stackName, stack);
+            for (const issue of previous.notUp ?? [])
+                add('application.previous-start', 'Previous start', 'unknown', `${previous.startedAt ? previous.startedAt + ' · ' : ''}${issue}`, 'This records the previous start attempt; current startup remains unverified. Correct the cause and retry the stack start.');
+        }
+        let entries;
+        let infrastructure = mergeInfrastructure(config, stack);
+        try {
+            const selected = stack.type === 'local' && !stack.managedOrigin ? this.localSelection(projectName, stackName).read().release : null;
+            if (selected && artifactVolumeBindings(infrastructure).length) {
+                const { loadRelease } = await import('../release/load.js');
+                const release = await loadRelease(selected.id, await this.releaseStore());
+                if (release.manifestSha256 !== selected.manifestSha256)
+                    throw Error('Selected release manifest changed on disk');
+                const installed = await this.installedRelease(projectName, stackName, stack, config, release);
+                if (!installed.infrastructure)
+                    throw Error('Selected artifact infrastructure is unavailable');
+                entries = installed.entries;
+                infrastructure = installed.infrastructure;
+            }
+            else
+                entries = await this.launchEntries(projectName, stackName, stack, config);
+            if (selected)
+                add('release.selected', 'Release', 'pass', 'Next start uses verified release ' + selected.id);
+            else if (stack.release?.mode === 'required')
+                add('release.required', 'Release', 'unknown', 'This stack requires an immutable release; no release was selected for this check.', 'Use Deploy release and review its admission checks.');
+        }
+        catch (error) {
+            add('release.unavailable', 'Selected release', 'blocked', describeFailure(error), 'Restore the pinned installation or select another verified release.');
+            return done();
+        }
+        if (Array.isArray(stack.apps)) {
+            const available = new Set(entries.map(entry => entry.name));
+            for (const name of stack.apps)
+                if (!available.has(name))
+                    add('application.undeclared', name, 'blocked', 'The selected application is absent or disabled in project configuration.');
+        }
+        if (!entries.length)
+            add('applications.empty', 'Applications', 'blocked', 'No enabled applications are selected.');
+        try {
+            resolveStartupOrder(entries);
+            add('dependencies.valid', 'Application dependencies', 'pass', 'Startup dependency order resolved.');
+        }
+        catch {
+            add('dependencies.invalid', 'Application dependencies', 'blocked', 'Application dependencies cannot be ordered.', 'Check missing dependencies and dependency cycles in the project configuration.');
+        }
+        let migrationEnvironment = null;
+        try {
+            migrationEnvironment = await this.stackEnvFor(projectName, stackName, stack, entries.map(entry => entry.name));
+            add('environment.valid', 'Environment', 'pass', 'Environment declarations and vault references resolved; values are withheld.');
+        }
+        catch {
+            add('environment.invalid', 'Environment', 'blocked', 'Environment declarations or vault references could not be resolved.', 'Check stack environment variable names and required vault entries.');
+        }
+        const definitions = new Map();
+        for (const entry of entries) {
+            if (entry.releaseFrom) {
+                add('release.import-unselected', entry.name, 'blocked', 'This application comes from a pinned producer release; no verified installation is selected.', 'Prepare and select the consumer release before checking its application prerequisites.');
+                continue;
+            }
+            if (!entry.bootstrap) {
+                add('application.classic', entry.name, 'unknown', 'Executable prerequisites for this command-based application have not been probed.', 'Check the configured command and working directory before starting.');
+                continue;
+            }
+            const bootstrap = resolveAppPath(project.path, entry, entry.bootstrap);
+            if (!fs.existsSync(bootstrap))
+                add('bootstrap.missing', entry.name, 'blocked', 'The configured bootstrap file is missing.', 'Restore the application sources or correct its bootstrap path.');
+            const { metadata, declared, state, record } = this.readAppDeclaration(projectName, stackName, entry.name, bootstrap);
+            if (declared.malformed)
+                add('declaration.invalid', entry.name, 'blocked', 'Application configuration is invalid or unreadable.', 'Check config/default.json syntax and permissions.');
+            if (!metadata || !record || metadataSourceChanged(record) || state?.failure)
+                add('declaration.unknown', entry.name, 'unknown', state?.failure ? `Last declaration read at ${state.failure.at}: ${state.failure.reason}` : 'Current bootstrap declarations have not been verified.', 'Refresh declarations as an administrator, then run diagnosis again.');
+            else
+                add('declaration.current', entry.name, 'pass', `Bootstrap declaration captured at ${record.capturedAt}; source file is unchanged.`);
+            if (metadata || declared.omnitron)
+                definitions.set(entry.name, withDeclaredConfig({ name: entry.name, version: '', processes: [], ...metadata }, declared));
+        }
+        try {
+            if (!ownsStackInfrastructure(stack)) {
+                const mode = infrastructureOwnership(stack);
+                const owner = mode === 'controller' ? `${stack.managedOrigin.project}/${stack.managedOrigin.stack}` : 'an external operator';
+                add('infrastructure.delegated', 'Infrastructure ownership', 'pass', `Infrastructure provisioning and migrations belong to ${owner}; this stack starts applications only.`);
+                add('infrastructure.external-readiness', 'Application connections', 'unknown', 'Explicit application connection settings are retained. Endpoint reachability, credentials and schema have not been verified.', 'Inspect the owning infrastructure and application health; this node will not create substitute services.');
+                return done();
+            }
+        }
+        catch (error) {
+            add('infrastructure.ownership-invalid', 'Infrastructure ownership', 'blocked', error.message, 'Correct the explicit ownership binding; diagnosis changes no infrastructure.');
+            return done();
+        }
+        if (stack.type !== 'local') {
+            try {
+                resolveNodePlacements(stack, entries);
+                add('placement.valid', 'Placement', 'pass', 'Configured node placement resolved.');
+            }
+            catch {
+                add('placement.invalid', 'Placement', 'blocked', 'Node placement is incomplete or inconsistent.', 'Check selected applications, node identities and placement assignments.');
+            }
+            add('remote.prerequisites', 'Remote infrastructure', 'unknown', 'Host prerequisites must be inspected on each target node; local Docker is not evidence for a remote stack.', `Use omnitron infra inspect ${projectName}/${stackName} for host-service evidence and Nodes for RPC diagnostics.`);
+            return done();
+        }
+        try {
+            const effective = mergeInferredInfrastructure(buildInfraFromRequirements(requirementsFromDefinitions(definitions)), infrastructure);
+            const migrations = requestedMigrations(expandServiceDeclarations(effective, createDefaultRegistry()));
+            if (migrations.length) {
+                try {
+                    const targets = await localMigrationTargets(migrations, entries, project.path, (names, files) => this.launchEntries(projectName, stackName, stack, config, names, files));
+                    if (migrationEnvironment) {
+                        const resolveMigration = this.stackEntryBuilder(projectName, stackName, stack, config, definitions, migrationEnvironment);
+                        validateMigrationDestinations(targets.map(target => {
+                            const entry = entries.find(app => app.name === target.app);
+                            return { app: target.app, database: migrationDatabaseEnvironment(target.environmentApp, resolveMigration(entry).env?.['DATABASE_URL'] ?? '', target.database, target.mode) };
+                        }));
+                    }
+                    add('migrations.entries', 'Database migration programs', 'pass', `Migration owners: ${targets.map(target => `${target.service}/${target.database} → ${target.app} (${target.mode === 'config' ? target.release : 'legacy script'})`).join('; ')}. Programs are available; database access, schema and execution remain unverified.`);
+                }
+                catch (error) {
+                    add('migrations.unavailable', 'Database migration programs', 'blocked', describeFailure(error), 'Restore the requested migration program or prepare a complete verified release. No database or infrastructure was changed.');
+                }
+            }
+            const declaredServices = { ...effective.services };
+            for (const definition of definitions.values())
+                Object.assign(declaredServices, definition.omnitronConfig?.infrastructure);
+            for (const [service, requirement] of Object.entries(declaredServices)) {
+                // Presets acquire their provisioning definition in the shared resolver below.
+                if ('preset' in requirement)
+                    continue;
+                const binding = bindService(requirement, stack.serviceOverrides?.[service]);
+                if (binding.provisioning === 'none')
+                    add('service.unconfigured', service, 'blocked', 'This service has no provisioning definition or external endpoint.');
+                if (binding.provisioning === 'bareMetal' || binding.provisioning === 'external')
+                    add('service.host', service, 'unknown', 'This service uses a host or external endpoint; Docker readiness does not verify it.', 'Check the service endpoint, authentication and host configuration separately.');
+            }
+            const mounts = artifactVolumeBindings(effective);
+            if (mounts.length) {
+                add('release.mounts-unselected', 'Artifact volumes', 'blocked', 'These mounts require an installed release: ' + mounts.map(([, mount]) => mount.app + ' → ' + mount.service + ':' + mount.target).join(', '), 'Prepare and select the consumer release, then run diagnosis again.');
+            }
+            else {
+                const containers = await this.infraManager.planStack(projectName, stackName, stack, effective, definitions, project.path);
+                checks.push(...await diagnoseContainers(containers));
+            }
+        }
+        catch {
+            add('infrastructure.invalid', 'Infrastructure plan', 'blocked', 'The infrastructure declaration could not be resolved.', 'Review service presets, port mappings and service overrides. No infrastructure was changed.');
+        }
+        return done();
+    }
+    /** Configuration evidence from the launch builder; it never starts, probes or modifies applications. */
+    async getTopology(scope) {
+        const result = { version: 1, generatedAt: new Date().toISOString(), dependencies: [], warnings: [], coverage: [] };
+        const projects = scope.project ? [scope.project] : this.listProjectRegistrations().map(project => project.name);
+        for (const project of projects) {
+            let config;
+            try {
+                config = await this.ensureConfig(project);
+            }
+            catch {
+                result.warnings.push({ project, reason: 'Project configuration could not be read' });
+                continue;
+            }
+            for (const [stack, stackConfig] of Object.entries(this.resolveStacks(config, project))) {
+                if (scope.stack && stack !== scope.stack)
+                    continue;
+                try {
+                    const entries = this.resolveStackApps(stackConfig, config);
+                    const pinned = stackConfig.type === 'local' && !stackConfig.managedOrigin && this.localSelection(project, stack).read().release;
+                    const definitions = new Map();
+                    const directory = this.registry.get(project)?.path;
+                    for (const entry of entries) {
+                        const handle = pinned ? this.orchestrator.getHandle(ProjectService.handleKey(project, stack, entry.name)) : undefined;
+                        if (!entry.bootstrap && (!entry.releaseFrom || (handle?.entry?.script && !handle.entry.bootstrap))) {
+                            result.coverage.push({ project, stack, app: entry.name, source: 'entry' });
+                            continue;
+                        }
+                        if (!directory)
+                            continue;
+                        const bootstrap = pinned ? handle?.bootstrapMetadata?.bootstrap
+                            : entry.bootstrap ? resolveAppPath(directory, entry, entry.bootstrap) : undefined;
+                        if (!bootstrap) {
+                            result.coverage.push({ project, stack, app: entry.name, source: 'missing' });
+                            result.warnings.push({ project, stack, app: entry.name, reason: pinned ? 'Owner has not reported a launch declaration for the selected release' : 'Imported application has no selected release; prepare and select it before reading topology declarations' });
+                            continue;
+                        }
+                        const { state, record, metadata, declared, observed } = this.readAppDeclaration(project, stack, entry.name, bootstrap);
+                        result.coverage.push({ project, stack, app: entry.name,
+                            source: record ? record === observed ? 'launch' : 'snapshot' : metadata ? 'memory' : 'missing',
+                            ...(record && { capturedAt: record.capturedAt }) });
+                        if (!metadata)
+                            result.warnings.push({ project, stack, app: entry.name, reason: 'Bootstrap metadata not loaded; refresh declarations before relying on complete dependency coverage' });
+                        if (state?.failure)
+                            result.warnings.push({ project, stack, app: entry.name, reason: state.failure.reason });
+                        if (record && metadataSourceChanged(record))
+                            result.warnings.push({ project, stack, app: entry.name, reason: 'Bootstrap file changed after declaration capture; refresh metadata to inspect the current configuration' });
+                        if (declared.malformed)
+                            result.warnings.push({ project, stack, app: entry.name, reason: 'Application configuration is malformed; file declarations are unavailable' });
+                        if (metadata || declared.omnitron)
+                            definitions.set(entry.name, withDeclaredConfig({ name: entry.name, version: '', processes: [], ...metadata }, declared));
+                    }
+                    const env = await this.stackEnvFor(project, stack, stackConfig, entries.map(entry => entry.name));
+                    const build = this.stackEntryBuilder(project, stack, stackConfig, config, definitions, env);
+                    for (const entry of entries) {
+                        if (entry.enabled === false)
+                            continue;
+                        const definition = definitions.get(entry.name);
+                        result.dependencies.push(...appDependencies(project, stack, build(entry), definition));
+                    }
+                }
+                catch {
+                    result.warnings.push({ project, stack, reason: 'Launch configuration could not be resolved; dependencies are incomplete' });
+                }
+            }
+        }
+        return result;
+    }
+    /** Explicit administrative discovery. Imports trusted declarations in bounded child processes, never starts a stack. */
+    async refreshTopologyMetadata(scope, deadline = Date.now() + TOPOLOGY_REFRESH_TIMEOUT_MS) {
+        const config = await this.ensureConfig(scope.project);
+        const directory = this.registry.get(scope.project)?.path;
+        if (!directory)
+            throw new Error('Project is not registered');
+        const bootstraps = new Map();
+        const stacks = this.resolveStacks(config, scope.project);
+        if (scope.stack && !stacks[scope.stack])
+            throw new Error('Stack is not configured');
+        for (const [name, stack] of Object.entries(stacks)) {
+            if (scope.stack && scope.stack !== name)
+                continue;
+            for (const app of await this.launchEntries(scope.project, name, stack, config))
+                if (app.bootstrap)
+                    bootstraps.set(resolveAppPath(directory, app, app.bootstrap), app.name);
+        }
+        const result = { refreshed: 0, failures: [] };
+        for (const [bootstrap, app] of bootstraps) {
+            try {
+                const remaining = Math.min(30_000, deadline - Date.now());
+                if (remaining <= 0)
+                    throw new Error('Declaration refresh deadline exceeded; this application was not read');
+                const { metadata: record } = await readBootstrapMetadata(bootstrap, false, remaining);
+                this.bootstrapMetadata.save(record);
+                this.bootstrapTopology.set(bootstrap, record.definition);
+                result.refreshed += 1;
+            }
+            catch (error) {
+                this.bootstrapMetadata.fail(bootstrap, error);
+                this.logger.error({ project: scope.project, app, error }, 'Bootstrap metadata refresh failed; previous declaration retained');
+                result.failures.push({ project: scope.project, app, reason: `Declaration read failed: ${publicLaunchFailure(error)}. Previous metadata was retained.` });
+            }
+        }
+        await this.audit?.record({ action: 'topology.metadata.refresh', resourceType: 'project', resourceId: scope.project,
+            details: { stack: scope.stack, refreshed: result.refreshed, failures: result.failures.length } });
+        return result;
+    }
     listStacks(projectName) {
         const config = this.getLoadedConfig(projectName);
         if (!config)
@@ -562,18 +1391,32 @@ export class ProjectService extends EventEmitter {
      * asking for a stack that is already being started should end when it has
      * been started, which is what the caller meant.
      */
+    rereading;
     startsInFlight = new Map();
     async startStack(projectName, stackName, opts) {
+        if (this.resumingInstalled)
+            throw new Error('An installed allocation is resuming');
+        if (this.ownershipFrozen)
+            throw new Error('Project ownership is frozen for backend transfer');
         const inFlightKey = `${projectName}/${stackName}`;
+        if (this.stopsInFlight.has(inFlightKey))
+            throw new Error('This stack is stopping; wait for its acknowledgement');
+        if (this.rereading?.has(projectName))
+            throw new Error('Project definitions are being updated; retry the start');
+        if (opts?.workingTree && opts.release)
+            throw new Error('Select either a release or the working tree');
+        const selection = JSON.stringify([opts?.release, opts?.workingTree === true, opts?.reinstall === true]);
         const running = this.startsInFlight.get(inFlightKey);
         if (running) {
             this.logger.info({ project: projectName, stack: stackName }, 'This stack is already being started — joining the run in progress');
-            return running;
+            if (running.selection !== selection)
+                throw new Error('Another stack start selected different launch code; retry after it completes');
+            return running.promise;
         }
-        const started = this.startStackOnce(projectName, stackName, opts?.source ?? 'unknown', opts?.allowDirty === true, opts?.release, opts?.reinstall === true).finally(() => {
+        const started = this.startStackOnce(projectName, stackName, opts?.source ?? 'unknown', opts?.allowDirty === true, opts?.release, opts?.reinstall === true, opts?.workingTree === true).finally(() => {
             this.startsInFlight.delete(inFlightKey);
         });
-        this.startsInFlight.set(inFlightKey, started);
+        this.startsInFlight.set(inFlightKey, { selection, promise: started });
         return started;
     }
     /**
@@ -601,10 +1444,10 @@ export class ProjectService extends EventEmitter {
      * deploys nothing, and the reconciler re-asks a node that does not answer
      * every few minutes — rows about looking, not about changing anything.
      */
-    async startStackOnce(projectName, stackName, source, allowDirty, releaseId, reinstall = false) {
+    async startStackOnce(projectName, stackName, source, allowDirty, releaseId, reinstall = false, workingTree = false) {
         const known = { attach: false };
         try {
-            return await this.runStackStart(projectName, stackName, source, allowDirty, releaseId, known, reinstall);
+            return await this.runStackStart(projectName, stackName, source, allowDirty, releaseId, known, reinstall, workingTree);
         }
         catch (err) {
             if (!known.attach) {
@@ -617,7 +1460,7 @@ export class ProjectService extends EventEmitter {
                     details: {
                         source,
                         ...(known.type ? { type: known.type } : {}),
-                        ...(releaseId ? { release: releaseId } : {}),
+                        ...((releaseId ?? known.release) ? { release: releaseId ?? known.release } : {}),
                         ...(known.commit !== undefined ? { commit: known.commit } : {}),
                     },
                 });
@@ -625,23 +1468,34 @@ export class ProjectService extends EventEmitter {
             throw err;
         }
     }
-    async runStackStart(projectName, stackName, source, allowDirty, releaseId, known, reinstall = false) {
+    async runStackStart(projectName, stackName, source, allowDirty, releaseId, known, reinstall = false, workingTree = false) {
         const config = await this.loadProjectConfig(projectName);
         const stacks = this.resolveStacks(config, projectName);
         const stackConfig = stacks[stackName];
         if (!stackConfig)
             throw new Error(`Stack '${stackName}' not found in project '${projectName}'`);
         known.type = stackConfig.type;
+        ownsStackInfrastructure(stackConfig); // Reject ambiguous ownership before attachment, build, migration or provisioning.
         // A restart of this daemon re-attaches a remote stack; it never deploys
         // one. See `attachRemoteStack`.
         if (stackConfig.type !== 'local' && (source === 'boot' || source === 'auto-resume')) {
             known.attach = true;
             return this.attachRemoteStack(projectName, stackName, stackConfig, source);
         }
+        this.assertStartAuthority({ project: projectName, stack: stackName }, stackConfig);
         // A release, when one is named — and a stack that takes nothing else.
+        const local = stackConfig.type === 'local' && !stackConfig.managedOrigin;
+        if ((workingTree || (releaseId && stackConfig.type === 'local')) && !local)
+            throw new Error('Only an independently managed local stack can change its local release selection');
+        const selector = local ? this.localSelection(projectName, stackName) : null;
+        const prior = selector?.read();
+        const requested = releaseId ?? (workingTree ? undefined : prior?.release?.id);
         let release = null;
-        if (releaseId) {
-            release = await this.admitRelease(projectName, stackName, stackConfig, config, releaseId);
+        if (requested) {
+            known.release = requested;
+            release = await this.admitRelease(projectName, stackName, stackConfig, config, requested);
+            if (prior?.release?.id === requested && prior.release.manifestSha256 !== release.manifestSha256)
+                throw new Error('The selected release manifest changed on disk; restore its original bytes');
         }
         else if (stackConfig.release?.mode === 'required') {
             throw new Error(`${projectName}/${stackName} takes releases only: \`omnitron release build ${projectName} --for ${stackName}\`, ` +
@@ -696,7 +1550,7 @@ export class ProjectService extends EventEmitter {
         // With a release the disk has already been held to the release's commit
         // (`admitRelease`) — stricter than HEAD, and the artifacts are not built
         // from it at all.
-        if (stackConfig.type === 'remote' && !release) {
+        if (stackConfig.type !== 'local' && !release) {
             if (!allowDirty) {
                 for (const { root, tree: t } of trees) {
                     const refusal = refusalForDirtyTree(t, `${projectName}/${stackName}`);
@@ -714,10 +1568,32 @@ export class ProjectService extends EventEmitter {
                 this.logger.warn({ project: projectName, stack: stackName, why: tree.why }, 'Could not tell whether the working tree matches its commit — shipping what is on disk');
             }
         }
+        const selected = release ? { id: release.id, manifestSha256: release.manifestSha256 } : null;
+        const changing = !!selector && !isDeepStrictEqual(prior?.release, selected);
+        const mounted = artifactVolumeBindings(mergeInfrastructure(config, stackConfig));
+        if (mounted.length && (!local || !release || !ownsStackInfrastructure(stackConfig)))
+            throw Error('Artifact volumes require a selected release on an independently owned local stack');
+        const installation = mounted.length && release
+            ? await this.installedRelease(projectName, stackName, stackConfig, config, release, true) : undefined;
+        const entries = installation?.entries ?? (local && release ? await this.installedEntries(projectName, stackName, stackConfig, config, release, true) : undefined);
+        let localMembershipChanged = false;
+        if (local) {
+            const target = entries ?? this.resolveStackApps(stackConfig, config);
+            const plan = await this.checkLocalOwner(projectName, stackName, target, changing, source === 'boot' || source === 'auto-resume');
+            // A changed immutable mount may not reach Docker before the ordinary owner stop fence.
+            if (mounted.length && changing && plan.phase !== 'stopped')
+                throw new LocalReleaseStopRequired('Stop this local stack before changing its immutable artifact volumes');
+            const names = new Set(target.map(entry => ProjectService.handleKey(projectName, stackName, entry.name)));
+            localMembershipChanged = plan.apps.some(app => !names.has(app.name));
+            if ((source === 'boot' || source === 'auto-resume') && plan.phase !== 'running')
+                throw new Error('The selected local stack is fenced; an explicit start must recover or roll back the selection');
+        }
         const stateKey = `${projectName}/${stackName}`;
         const existing = this.stackStates.get(stateKey);
         // Not for a release: putting a release onto a running stack is the point.
-        if (existing?.status === 'running' && !release) {
+        const completedLocalStart = stackConfig.type === 'local' && existing?.startedAt != null &&
+            (existing.status === 'degraded' || existing.status === 'error');
+        if ((existing?.status === 'running' || completedLocalStart) && !changing && !localMembershipChanged && (!release || local)) {
             // `running` is a claim about the past, and nothing revises it when the
             // apps underneath fall over — so this short-circuit used to hand the
             // operator a stack it had not touched. `toStackInfo` reads live
@@ -743,7 +1619,9 @@ export class ProjectService extends EventEmitter {
             // wrapper returns the info untouched.
             const current = await this.withRemoteAppStatuses(projectName, this.toStackInfo(projectName, stackName, stackConfig));
             const down = current.apps.filter((a) => a.status !== 'online');
-            if (down.length === 0) {
+            if (down.length === 0 && !current.notUp?.length) {
+                if (existing)
+                    existing.status = 'running';
                 this.logger.warn({ project: projectName, stack: stackName }, 'Stack already running');
                 return current;
             }
@@ -770,21 +1648,40 @@ export class ProjectService extends EventEmitter {
         this.emit('stack:starting', projectName, stackName, stackConfig.type);
         let reach = null;
         try {
+            this.assertStackMutable(stackConfig.managedOrigin ?? { project: projectName, stack: stackName });
             if (stackConfig.type === 'local') {
-                await this.startLocalStack(projectName, stackName, stackConfig, config);
+                const scope = { project: projectName, stack: stackName };
+                const enable = () => this.orchestrator.enableStackExecution(scope, { automatic: source === 'boot' || source === 'auto-resume' });
+                if (selector && prior) {
+                    const target = entries ?? this.resolveStackApps(stackConfig, config);
+                    await this.startLocalStack(projectName, stackName, stackConfig, config, target, async (build) => {
+                        await this.prepareLocalOwner(projectName, stackName, target, changing, build, () => {
+                            if (changing)
+                                selector.select(prior.revision, selected);
+                            else if (selector.read().revision !== prior.revision)
+                                throw new Error('Local release selection changed during admission');
+                        });
+                        await enable();
+                    }, release ? (names, files) => this.installedEntries(projectName, stackName, stackConfig, config, release, false, names, files) : undefined, installation ? async () => {
+                        const plan = await this.checkLocalOwner(projectName, stackName, target, changing);
+                        if (changing && plan.phase !== 'stopped')
+                            throw new LocalReleaseStopRequired('Artifact volume selection requires the owner stop fence');
+                        return (await this.installedRelease(projectName, stackName, stackConfig, config, release, false)).infrastructure;
+                    } : undefined);
+                }
+                else {
+                    await this.startLocalStack(projectName, stackName, stackConfig, config, undefined, async () => { await enable(); });
+                }
             }
-            else if (stackConfig.type === 'remote') {
+            else {
+                this.rememberStackTargets(projectName, stackName, stackConfig, config);
                 reach = await this.startRemoteStack(projectName, stackName, stackConfig, config, release, reinstall);
             }
-            else if (stackConfig.type === 'cluster') {
-                await this.startClusterStack(projectName, stackName, stackConfig, config);
-            }
             state.status = 'running';
             state.startedAt = Date.now();
             // Update registry with enabled stack
             this.updateEnabledStacks(projectName, stackName, true);
-            this.emit('stack:started', projectName, stackName, stackConfig.type);
-            this.logger.info({ project: projectName, stack: stackName, source }, 'Stack started');
+            this.markPriorStopSuperseded(projectName, stackName);
             const info = this.toStackInfo(projectName, stackName, stackConfig);
             // What did not come up, said in the row. A boot at 12:14 UTC on
             // 2026-09-23 started sample/dev with payments and messaging errored and
@@ -792,11 +1689,22 @@ export class ProjectService extends EventEmitter {
             // apps never did. For a local stack the apps are this daemon's; for a
             // remote one, what did not happen is a node that was skipped.
             const notUp = stackConfig.type === 'local'
-                ? info.apps.filter((a) => a.status !== 'online').map((a) => `${a.name} (${a.status})`)
+                ? info.notUp ?? info.apps.filter((a) => a.status !== 'online').map((a) => `${a.name} (${a.status})`)
                 : [
                     ...(reach?.skipped ?? []).map((n) => `node ${typeof n === 'string' ? n : JSON.stringify(n)}`),
                     ...(reach?.notReady ?? []).map((n) => `infrastructure on ${n}`),
                 ];
+            if (stackConfig.type === 'local')
+                state.status = info.status;
+            const outcome = notUp.length === 0 ? 'ok' : state.status === 'error' ? 'failed' : 'partial';
+            if (outcome === 'ok') {
+                this.emit('stack:started', projectName, stackName, stackConfig.type, info.apps.length, info.nodes?.length ?? 0);
+                this.logger.info({ project: projectName, stack: stackName, source }, 'Stack started');
+            }
+            else {
+                this.emit('stack:error', projectName, stackName, notUp.join(', '));
+                this.logger.warn({ project: projectName, stack: stackName, source, outcome, notUp }, 'Stack start incomplete');
+            }
             // Recorded for every caller, and saying WHICH one. `source: 'unknown'`
             // is deliberate rather than a default of `'operator'`: a caller that
             // has not been taught to identify itself should be visible in the
@@ -810,7 +1718,7 @@ export class ProjectService extends EventEmitter {
                 resourceType: 'stack',
                 resourceId: `${projectName}/${stackName}`,
                 // Said, now that the other ending is recorded too (`startStackOnce`).
-                outcome: notUp.length > 0 ? 'partial' : 'ok',
+                outcome,
                 // The commit, so the trail answers what went out and not only when.
                 // A node's artifacts carry no revision (every app is version `0.0.1`
                 // forever, and `BUNDLE.json` is excluded from the checksum and read
@@ -841,6 +1749,7 @@ export class ProjectService extends EventEmitter {
                     ...(release
                         ? {
                             release: release.id,
+                            releaseManifestSha256: release.manifestSha256,
                             releaseProjectCommit: release.manifest.project.commit.slice(0, 8),
                             releaseOmniCommit: release.manifest.omni.commit.slice(0, 8),
                         }
@@ -861,52 +1770,293 @@ export class ProjectService extends EventEmitter {
             throw err;
         }
     }
-    async stopStack(projectName, stackName) {
-        const stateKey = `${projectName}/${stackName}`;
-        const state = this.stackStates.get(stateKey);
-        if (!state || state.status === 'stopped') {
-            const config = this.getLoadedConfig(projectName);
-            const stacks = config ? this.resolveStacks(config, projectName) : {};
-            const stackConfig = stacks[stackName];
-            if (!stackConfig)
-                throw new Error(`Stack '${stackName}' not found`);
-            return this.toStackInfo(projectName, stackName, stackConfig);
+    declaredStopTargets(stack, config) {
+        if (stack.type === 'local')
+            return [];
+        const apps = this.resolveStackApps(stack, config).map(app => app.name);
+        return (stack.nodes ?? []).map(node => ({ host: node.host, port: node.port ?? 9700,
+            applications: nodeApplicationNames(stack, node, apps).length > 0, ...(node.nodeId && { nodeId: node.nodeId }) }));
+    }
+    stopRequest(scope, node, keepInfrastructure = false) {
+        if (this.clusterStop && !node.nodeId)
+            throw new Error('A pinned recipient nodeId is required for clustered stack stop');
+        return { ...scope, applications: node.applications, ...(keepInfrastructure && { keepInfrastructure: true }),
+            ...(this.clusterStop && { audience: { clusterId: this.clusterStop.recipient.audience.clusterId, nodeId: node.nodeId } }) };
+    }
+    validateStopInventory(request, result) {
+        if (result?.protocol !== 1 || result.project !== request.project || result.stack !== request.stack ||
+            result.applications !== request.applications || !result.definition || !Array.isArray(result.containers) ||
+            (request.applications ? !result.execution || !Array.isArray(result.execution.apps) : result.execution !== null)) {
+            throw new Error('Invalid node stop inventory; update the recipient before stopping');
+        }
+        if (result.audience?.clusterId !== request.audience?.clusterId || result.audience?.nodeId !== request.audience?.nodeId) {
+            throw new Error('Recipient did not confirm the required cluster and node identity');
+        }
+        if ((result.keepInfrastructure === true) !== (request.keepInfrastructure === true) ||
+            (result.keepInfrastructure !== undefined && typeof result.keepInfrastructure !== 'boolean')) {
+            throw new Error('Recipient did not confirm the requested infrastructure retention mode; update it before stopping');
         }
-        this.logger.info({ project: projectName, stack: stackName }, 'Stopping stack');
-        state.status = 'stopping';
-        this.emit('stack:stopping', projectName, stackName);
+    }
+    async localStopInventory(scope, stack, execution, keepInfrastructure = false) {
+        const containers = await this.infraManager.inspectStopContainers(scope.project, scope.stack);
+        return { ...scope, protocol: 1, applications: true, execution, definition: stackDefinitionFingerprint(stack),
+            containers, ...(keepInfrastructure && { keepInfrastructure: true }) };
+    }
+    async reviewStackStop(project, stack, keepInfrastructure = false) {
+        if (typeof keepInfrastructure !== 'boolean')
+            throw new Error('Invalid infrastructure retention mode');
+        const scope = { project, stack };
+        const key = stackExecutionKey(scope);
+        const targets = [];
         try {
-            // Stop all apps with this stack's namespace prefix (reverse order for graceful shutdown)
-            const prefix = `${projectName}/${stackName}/`;
-            const handleNames = this.orchestrator.listHandleNames(prefix);
-            for (const name of handleNames.reverse()) {
+            if (this.ownershipFrozen || this.resumingInstalled || this.startsInFlight.has(key) || this.stopsInFlight.has(key))
+                throw new Error('A lifecycle operation is active; wait and check again');
+            if (this.clusterStop) {
+                if (!this.clusterStop.election)
+                    throw new Error('Review this stop on the elected controller');
+                await this.clusterStop.election.confirmStopAuthority();
+            }
+            const config = this.getLoadedConfig(project);
+            if (!config)
+                throw new Error('Project declarations are unavailable; refresh them before reviewing this stop');
+            const declaration = this.stackStates.get(key)?.config ?? this.resolveStacks(config, project)[stack];
+            if (!declaration)
+                throw new Error(`Stack '${key}' not found`);
+            const journal = new StackTargets(this.daemonStateStore);
+            const { nodes } = journal.inspect(scope, this.declaredStopTargets(declaration, config));
+            if (declaration.type === 'local') {
                 try {
-                    await this.orchestrator.stopApp(name);
+                    if (this.clusterStop && !declaration.managedOrigin)
+                        throw new Error('Cluster stack stop requires an explicitly bound allocation');
+                    const inventory = declaration.managedOrigin
+                        ? await this.nodeStackStop.inspect({ ...declaration.managedOrigin, applications: true,
+                            ...(keepInfrastructure && { keepInfrastructure: true }),
+                            ...(this.clusterStop && { audience: this.clusterStop.recipient.audience }) })
+                        : await this.localStopInventory(scope, declaration, await this.orchestrator.inspectStackExecution(scope), keepInfrastructure);
+                    targets.push({ node: 'local', inventory });
                 }
-                catch (err) {
-                    this.logger.warn({ app: name, error: err.message }, 'Failed to stop app during stack shutdown');
+                catch (error) {
+                    targets.push({ node: 'local', reason: describeFailure(error) });
+                }
+            }
+            else if (!nodes.length)
+                throw new Error('No remote allocation inventory is available');
+            for (const node of nodes) {
+                const endpoint = stackNodeKey(node.host, node.port);
+                try {
+                    if (!this.slaveConnector)
+                        throw new Error('Node RPC is unavailable');
+                    const request = this.stopRequest(scope, node, keepInfrastructure);
+                    const inventory = await this.slaveConnector.invokeOnSlave(node.host, node.port, 'OmnitronProject', 'inspectNodeStackStop', [request]);
+                    this.validateStopInventory(request, inventory);
+                    targets.push({ node: endpoint, inventory });
+                }
+                catch (error) {
+                    targets.push({ node: endpoint, reason: describeFailure(error) });
+                }
+            }
+        }
+        catch (error) {
+            targets.push({ node: 'controller', reason: describeFailure(error) });
+        }
+        return stackStopReview(scope, targets, keepInfrastructure);
+    }
+    async stopStack(projectName, stackName, review, keepInfrastructure = false) {
+        if (typeof keepInfrastructure !== 'boolean')
+            throw new Error('Invalid infrastructure retention mode');
+        const key = stackExecutionKey({ project: projectName, stack: stackName });
+        if (this.resumingInstalled)
+            throw new Error('An installed allocation is resuming');
+        if (this.ownershipFrozen)
+            throw new Error('Project ownership is frozen for backend transfer');
+        if (this.startsInFlight.has(key))
+            throw new Error('This stack is starting; finish or reconcile the start before stopping');
+        const pending = this.stopsInFlight.get(key);
+        if (pending && (review !== undefined || pending.keepInfrastructure !== keepInfrastructure))
+            throw new Error('A stop is already running; inspect its progress');
+        if (pending)
+            return pending.promise;
+        if (review !== undefined && (typeof review !== 'string' || !/^[a-f0-9]{64}$/.test(review)))
+            throw new Error('Invalid stack stop review');
+        const operation = this.stopStackOnce(projectName, stackName, review, keepInfrastructure).finally(() => this.stopsInFlight.delete(key));
+        this.stopsInFlight.set(key, { keepInfrastructure, promise: operation });
+        return operation;
+    }
+    async stopStackOnce(projectName, stackName, review, keepInfrastructure) {
+        const key = `${projectName}/${stackName}`;
+        const config = await this.loadProjectConfig(projectName);
+        const stackConfig = this.stackStates.get(key)?.config ?? this.resolveStacks(config, projectName)[stackName];
+        if (!stackConfig)
+            throw new Error(`Stack '${stackName}' not found`);
+        const state = this.stackStates.get(key) ?? {
+            project: projectName, stack: stackName, status: 'stopped',
+            config: stackConfig, startedAt: null, infraService: null,
+        };
+        this.stackStates.set(key, state);
+        const progress = {
+            id: randomUUID(), phase: 'preparing', startedAt: new Date().toISOString(), nodes: [],
+            ...(keepInfrastructure && { keepInfrastructure: true }),
+        };
+        const persist = () => this.daemonStateStore.kvUpdateSync(`stack:${key}:last-stop`, () => progress);
+        persist();
+        try {
+            // Complete every read-only admission check before sending any stop.
+            const prepared = [];
+            const cluster = this.clusterStop;
+            if (cluster && !cluster.election?.isLeader)
+                throw new Error('Stack stop requires the elected controller of this cluster');
+            let managedPlan = null;
+            let managedPermit;
+            let targetsRevision;
+            let localPlan = null;
+            if (stackConfig.type === 'local' && stackConfig.managedOrigin) {
+                managedPlan = await this.nodeStackStop.prepare({ ...stackConfig.managedOrigin, applications: true,
+                    ...(keepInfrastructure && { keepInfrastructure: true }),
+                    ...(cluster && { audience: cluster.recipient.audience }) });
+                managedPermit = cluster?.election?.authorizeStop(managedPlan);
+            }
+            else if (stackConfig.type === 'local') {
+                if (cluster)
+                    throw new Error('Cluster stack stop requires an explicitly bound allocation');
+                localPlan = await this.orchestrator.inspectStackExecution({ project: projectName, stack: stackName });
+            }
+            const scope = { project: projectName, stack: stackName };
+            const localInventory = localPlan ? await this.localStopInventory(scope, stackConfig, localPlan, keepInfrastructure) : null;
+            const declared = this.declaredStopTargets(stackConfig, config);
+            const targetJournal = new StackTargets(this.daemonStateStore);
+            if (declared.length)
+                targetJournal.remember({ project: projectName, stack: stackName }, declared);
+            const targets = targetJournal.inspect({ project: projectName, stack: stackName });
+            if (stackConfig.type !== 'local' && targets.nodes.length === 0)
+                throw new Error('No remote allocation inventory is available; stop cannot be confirmed');
+            if (targets.nodes.length) {
+                if (!this.slaveConnector)
+                    throw new Error('Node RPC is unavailable; no remote stop has been sent');
+                targetsRevision = targets.revision;
+                progress.nodes = targets.nodes.map(node => ({ node: `${node.host}:${node.port}`, outcome: 'checking' }));
+                persist();
+                for (const [index, node] of targets.nodes.entries()) {
+                    let plan;
+                    try {
+                        const request = this.stopRequest(scope, node, keepInfrastructure);
+                        plan = await this.slaveConnector.invokeOnSlave(node.host, node.port, 'OmnitronProject', 'prepareNodeStackStop', [request]);
+                        this.validateStopInventory(request, plan);
+                        if (!plan.operationId)
+                            throw new Error('Invalid node stop plan');
+                        const permit = cluster?.election?.authorizeStop(plan);
+                        prepared.push({ host: node.host, port: node.port, plan, permit });
+                        if (permit && request.audience)
+                            progress.nodes[index].authority = { ...request.audience, epoch: permit.epoch };
+                    }
+                    catch (error) {
+                        progress.nodes[index].outcome = 'unknown';
+                        progress.nodes[index].reason = describeFailure(error);
+                        throw new Error(`Cannot prepare ${node.host}:${node.port}: ${describeFailure(error)}`, { cause: error });
+                    }
+                    progress.nodes[index].outcome = 'prepared';
+                    persist();
+                }
+            }
+            if (review !== undefined) {
+                const actual = [];
+                if (managedPlan)
+                    actual.push({ node: 'local', inventory: managedPlan });
+                if (localInventory)
+                    actual.push({ node: 'local', inventory: localInventory });
+                for (const target of prepared)
+                    actual.push({ node: stackNodeKey(target.host, target.port), inventory: target.plan });
+                if (stackStopReview(scope, actual, keepInfrastructure).digest !== review)
+                    throw new Error('Stack changed since review; inspect the current footprint before stopping');
+            }
+            // Losing this durable write refuses the operation before any effect.
+            if (cluster)
+                await cluster.election.confirmStopAuthority();
+            this.updateEnabledStacks(projectName, stackName, false);
+            progress.phase = 'stopping';
+            progress.intentCommitted = true;
+            persist();
+            state.status = 'stopping';
+            this.emit('stack:stopping', projectName, stackName);
+            if (managedPlan) {
+                const receipt = await this.nodeStackStop.execute({ ...stackConfig.managedOrigin, operationId: managedPlan.operationId,
+                    ...(keepInfrastructure && { keepInfrastructure: true }), ...(managedPermit && { permit: managedPermit }) });
+                if (receipt.authority) {
+                    progress.nodes.push({ node: 'local', outcome: 'stopped', operationId: receipt.operationId, observedAt: receipt.observedAt, authority: receipt.authority });
+                    persist();
                 }
             }
-            // Disconnect slave daemons for remote/cluster stacks
-            if (state.config.type !== 'local' && this.slaveConnector) {
-                for (const node of state.config.nodes ?? []) {
-                    await this.slaveConnector.removeSlave(node.host, node.port ?? 9700);
+            else if (localPlan && localInventory) {
+                await this.orchestrator.stopStackExecution({ operationId: progress.id, plan: localPlan });
+                if (keepInfrastructure) {
+                    const retained = await this.infraManager.inspectStopContainers(projectName, stackName);
+                    if (!isDeepStrictEqual([...retained].sort((a, b) => a.id.localeCompare(b.id)), [...localInventory.containers].sort((a, b) => a.id.localeCompare(b.id)))) {
+                        throw new Error('Retained stack infrastructure changed; inspect before confirming this application stop');
+                    }
                 }
+                else
+                    await this.infraManager.teardownStack(projectName, stackName, localInventory.containers);
             }
-            // Teardown per-stack infrastructure (namespaced containers)
-            await this.infraManager.teardownStack(projectName, stackName);
+            if (prepared.length) {
+                const failures = [];
+                for (const [index, target] of prepared.entries()) {
+                    const item = progress.nodes[index];
+                    item.outcome = 'stopping';
+                    persist();
+                    try {
+                        const receipt = await this.slaveConnector.invokeOnSlave(target.host, target.port, 'OmnitronProject', 'executeNodeStackStop', [{ project: projectName, stack: stackName, operationId: target.plan.operationId,
+                                ...(keepInfrastructure && { keepInfrastructure: true }),
+                                ...(target.permit && { permit: target.permit }) }], { retryOnDisconnect: true });
+                        if (receipt?.protocol !== 1 || receipt.operationId !== target.plan.operationId || receipt.project !== projectName ||
+                            receipt.stack !== stackName || receipt.outcome !== 'stopped' ||
+                            (receipt.keepInfrastructure === true) !== keepInfrastructure ||
+                            (keepInfrastructure && (!Array.isArray(receipt.keptContainers) || receipt.removedContainers?.length !== 0 ||
+                                !isDeepStrictEqual([...receipt.keptContainers].sort(), target.plan.containers.map(c => c.id).sort()))) || (target.permit &&
+                            (receipt.authority?.epoch !== target.permit.epoch || receipt.authority.nodeId !== target.plan.audience.nodeId ||
+                                receipt.authority.clusterId !== target.plan.audience.clusterId)))
+                            throw new Error('Invalid node stop acknowledgement');
+                        item.outcome = 'stopped';
+                        item.operationId = receipt.operationId;
+                        item.observedAt = receipt.observedAt;
+                    }
+                    catch (error) {
+                        item.outcome = 'unknown';
+                        item.reason = describeFailure(error);
+                        failures.push(`${item.node}: ${item.reason}`);
+                    }
+                    persist();
+                }
+                if (failures.length)
+                    throw new Error(`Stack stop is unconfirmed on ${failures.join('; ')}`);
+            }
+            // Retained infrastructure is still owned here, including former placements.
+            // A later full stop must retain the obligation to contact those nodes.
+            if (!keepInfrastructure && targetsRevision !== undefined)
+                new StackTargets(this.daemonStateStore)
+                    .confirmStopped({ project: projectName, stack: stackName }, targetsRevision);
+            progress.phase = 'stopped';
+            progress.completedAt = new Date().toISOString();
+            persist();
             state.status = 'stopped';
             state.startedAt = null;
-            this.updateEnabledStacks(projectName, stackName, false);
             this.emit('stack:stopped', projectName, stackName, 'manual');
-            this.logger.info({ project: projectName, stack: stackName }, 'Stack stopped');
-            return this.toStackInfo(projectName, stackName, state.config);
+            return this.toStackInfo(projectName, stackName, stackConfig);
         }
-        catch (err) {
-            state.status = 'error';
-            throw err;
+        catch (error) {
+            progress.phase = 'failed';
+            progress.error = describeFailure(error);
+            persist();
+            if (progress.intentCommitted)
+                state.status = 'error';
+            this.emit('stack:error', projectName, stackName, String(error));
+            throw error;
         }
     }
+    rememberStackTargets(project, stack, definition, config) {
+        const targets = resolveNodePlacements(definition, this.resolveStackApps(definition, config))
+            .map(({ node, apps }) => ({ host: node.host, port: node.port ?? 9700, applications: apps.length > 0,
+            ...(node.nodeId && { nodeId: node.nodeId }) }));
+        new StackTargets(this.daemonStateStore).remember({ project, stack }, targets);
+    }
     /**
      * What is running in this stack, asked of whoever is running it.
      *
@@ -932,60 +2082,23 @@ export class ProjectService extends EventEmitter {
         const stackConfig = stacks[stackName] ?? state?.config;
         if (!stackConfig)
             throw new Error(`Stack '${stackName}' not found`);
-        const prefix = `${projectName}/${stackName}/`;
-        // Match by namespaced prefix OR by bare-name when the bare entry's
-        // effective name is part of this stack's configured app set. See
-        // toStackInfo for the full rationale; we keep the same rule here so
-        // CLI `omnitron list` and the webapp's stack status agree.
-        const configForStatus = this.getLoadedConfig(projectName);
-        const configuredNames = configForStatus
-            ? new Set(this.resolveStackApps(stackConfig, configForStatus).map((a) => a.name))
-            : new Set();
-        const apps = this.orchestrator.list().filter((a) => {
-            if (a.name.startsWith(prefix))
-                return true;
-            if (a.name.includes('/'))
-                return false;
-            return configuredNames.has(effectiveAppName(a.name));
-        });
-        const onlineApps = apps.filter((a) => a.status === 'online');
-        // Derive status from app health if running
-        let status = state?.status ?? 'stopped';
-        if (status === 'running' && apps.length > 0 && onlineApps.length < apps.length) {
-            status = 'degraded';
-        }
-        const base = {
+        const observed = stackConfig.type === 'local'
+            ? { info: await this.withRemoteAppStatuses(projectName, this.toStackInfo(projectName, stackName, stackConfig)), answered: 1 }
+            : await this.askNodes(projectName, this.getStack(projectName, stackName));
+        const { info, answered } = observed;
+        return {
             name: stackName,
             type: stackConfig.type,
-            status,
-            totalApps: apps.length,
-            onlineApps: onlineApps.length,
-            totalNodes: stackConfig.nodes?.length ?? 1,
-            connectedNodes: stackConfig.type === 'local' ? 1 : 0,
-            totalCpu: apps.reduce((sum, a) => sum + a.cpu, 0),
-            totalMemory: apps.reduce((sum, a) => sum + a.memory, 0),
-            syncSummary: (stackConfig.type === 'remote' || stackConfig.type === 'cluster')
-                ? summariseSync(this.nodesWithSync(stackConfig))
-                : null,
-        };
-        if (stackConfig.type === 'local')
-            return base;
-        // The node is asked, and what it answers replaces every count that was
-        // taken from this machine. `connectedNodes` is the number of nodes that
-        // ANSWERED rather than the number of entries in the connector's
-        // registry: that registry reported 0 connections for a node that was
-        // answering RPCs in the same second.
-        const { info, answered } = await this.askNodes(projectName, this.getStack(projectName, stackName));
-        const remote = info.apps;
-        const up = remote.filter((a) => a.status === 'online');
-        return {
-            ...base,
             status: info.status,
-            totalApps: remote.length,
-            onlineApps: up.length,
+            ...(info.health && { health: info.health }),
+            ...(info.notUp?.length && { notUp: info.notUp }),
+            totalApps: info.apps.length,
+            onlineApps: info.apps.filter(app => app.status === 'online').length,
+            totalNodes: stackConfig.type === 'local' ? 1 : stackConfig.nodes?.length ?? 0,
             connectedNodes: answered,
-            totalCpu: remote.reduce((sum, a) => sum + (a.cpu ?? 0), 0),
-            totalMemory: remote.reduce((sum, a) => sum + (a.memory ?? 0), 0),
+            totalCpu: info.apps.reduce((sum, app) => sum + (app.cpu ?? 0), 0),
+            totalMemory: info.apps.reduce((sum, app) => sum + (app.memory ?? 0), 0),
+            syncSummary: stackConfig.type === 'local' ? null : summariseSync(this.nodesWithSync(stackConfig)),
         };
     }
     /**
@@ -1009,6 +2122,66 @@ export class ProjectService extends EventEmitter {
         const { releasesRoot } = await import('../release/load.js');
         return releasesRoot();
     }
+    /** Explicit disk inspection: never performed by polling and never alters launch evidence. */
+    async inspectInstalledArtifacts(project, stack, catalogProject) {
+        const { inspectInstalledArtifacts } = await import('../release/installed-artifacts.js');
+        const { installedReleaseCatalog, installedReleaseReport, boundedInstalledNodeRead, installedNodeFailure, installedReadDeadline } = await import('../release/installed-release.js');
+        await this.ensureConfig(project);
+        const configured = this.getStack(project, stack);
+        const catalog = await installedReleaseCatalog(await this.releaseStore(), catalogProject);
+        let info = configured;
+        if (configured.type !== 'local') {
+            this.getSlaveConnector();
+            try {
+                info = await installedReadDeadline(() => this.withRemoteAppStatuses(project, configured), 10_000);
+            }
+            catch {
+                return installedReleaseReport(catalogProject, stack, catalog, [{ node: stack, error: 'Stack node inventory is unavailable or timed out; installed files were not inspected' }]);
+            }
+        }
+        const nodes = [];
+        if (info.type === 'local') {
+            const names = info.apps.map(app => app.handleKey);
+            try {
+                nodes.push({ node: 'local', observations: names.length ? await inspectInstalledArtifacts(this.orchestrator, names) : [] });
+            }
+            catch {
+                nodes.push({ node: 'local', error: 'Installed-file inspection failed or the process owner is unavailable' });
+            }
+        }
+        else {
+            const placements = info.placements ?? [];
+            if (placements.length > 16)
+                throw new Error('Installed-file inspection supports up to 16 nodes per stack');
+            const deadline = Date.now() + 60_000;
+            for (let offset = 0; offset < placements.length; offset += 4) {
+                await Promise.all(placements.slice(offset, offset + 4).map(async (placement) => {
+                    const node = placement.label ?? placement.nodeKey;
+                    if (deadline - Date.now() < 55_000) {
+                        nodes.push({ node, error: 'Stack inspection time budget exhausted before this node; inspect again' });
+                        return;
+                    }
+                    const names = placement.apps.flatMap(app => app.process ? [app.process.name] : []);
+                    if (!placement.appsObserved) {
+                        nodes.push({ node, error: 'Node inventory is unavailable' });
+                        return;
+                    }
+                    if (!names.length) {
+                        nodes.push({ node, error: 'No installed application handles were reported by this node' });
+                        return;
+                    }
+                    try {
+                        const observations = await boundedInstalledNodeRead(() => this.getSlaveConnector().invokeOnSlave(placement.host, placement.port, 'OmnitronDaemon', 'inspectInstalledArtifacts', [{ names }]));
+                        nodes.push({ node, observations });
+                    }
+                    catch (error) {
+                        nodes.push({ node, error: installedNodeFailure(error) });
+                    }
+                }));
+            }
+        }
+        return installedReleaseReport(catalogProject, stack, catalog, nodes);
+    }
     /**
      * Take a release for a stack, or say why not.
      *
@@ -1033,25 +2206,51 @@ export class ProjectService extends EventEmitter {
      * thing worse than a refusal at deploy time is a console that promised the
      * opposite.
      */
-    async checkRelease(projectName, stackName, releaseId) {
+    async checkRelease(projectName, stackName, releaseId, prepare = false) {
+        let preparedArtifactVolumes;
         try {
             const config = await this.loadProjectConfig(projectName);
             const stacks = this.resolveStacks(config, projectName);
             const stackConfig = stacks[stackName];
             if (!stackConfig)
                 throw new Error(`Stack '${stackName}' not found in project '${projectName}'`);
+            this.assertStartAuthority({ project: projectName, stack: stackName }, stackConfig);
+            if (prepare && stackConfig.type !== 'local')
+                throw new Error('Preparing a local release requires a local stack');
             const release = await this.admitRelease(projectName, stackName, stackConfig, config, releaseId, 'check');
+            let retiring = [];
+            if (stackConfig.type === 'local') {
+                const inspected = artifactVolumeBindings(mergeInfrastructure(config, stackConfig)).length
+                    ? await this.installedRelease(projectName, stackName, stackConfig, config, release, prepare) : undefined;
+                const entries = inspected?.entries ?? await this.installedEntries(projectName, stackName, stackConfig, config, release, prepare);
+                if (prepare && inspected)
+                    preparedArtifactVolumes = inspected.preparedArtifactVolumes;
+                const prior = this.localSelection(projectName, stackName).read().release;
+                if (prior?.id === release.id && prior.manifestSha256 !== release.manifestSha256)
+                    throw new Error('Selected manifest changed on disk');
+                const plan = await this.checkLocalOwner(projectName, stackName, entries, prior?.id !== release.id);
+                if (artifactVolumeBindings(mergeInfrastructure(config, stackConfig)).length && prior?.id !== release.id && plan.phase !== 'stopped')
+                    throw new LocalReleaseStopRequired('Stop this local stack before changing its immutable artifact volumes');
+                const target = new Set(entries.map(entry => ProjectService.handleKey(projectName, stackName, entry.name)));
+                retiring = plan.apps.filter(app => !target.has(app.name)).map(app => app.name);
+            }
             const gates = release.manifest.gates;
             const passed = gates.filter((g) => g.status === 'passed').length;
             return {
                 ok: true,
+                ...(preparedArtifactVolumes?.length && { preparedArtifactVolumes }),
                 because: `${projectName}/${stackName} would take ${release.id}: ${passed} of ${gates.length} gates passed, ` +
                     `${release.files.length} artifact(s) match the manifest` +
-                    `${release.staticsDir ? `, static bundle built for ${release.manifest.statics?.stack}` : ''}.`,
+                    `${release.staticsDir ? `, static bundle built for ${release.manifest.statics?.stack}` : ''}.` +
+                    (retiring.length ? ` After a confirmed whole-stack stop, reconciliation will retire these application registrations: ${retiring.join(', ')}. Logs, artifacts and infrastructure are preserved.` : ''),
             };
         }
         catch (err) {
-            return { ok: false, because: err.message };
+            const { LocalReleaseNotPreparedError } = await import('../release/local-installation.js');
+            return { ok: false, because: err.message,
+                ...(err instanceof LocalReleaseNotPreparedError && { state: 'unprepared' }),
+                ...(err instanceof LocalReleaseStopRequired && { state: 'requires-stop',
+                    ...(preparedArtifactVolumes?.length && { preparedArtifactVolumes }) }) };
         }
     }
     /**
@@ -1493,20 +2692,25 @@ export class ProjectService extends EventEmitter {
      * with nothing, so an uncommitted edit to the gateway's template reached the
      * test node past every gate a release has.
      */
-    async deploymentReads(projectName, stackConfig, config, root) {
+    async deploymentReads(projectName, stackConfig, config, root, definitions) {
         const { definitionInputs } = await import('../release/definition-inputs.js');
         const { shippedDirsOf } = await import('../infrastructure/shipped-config.js');
-        const shipped = shippedDirsOf(mergeInfrastructure(config, stackConfig), await this.collectDeclaredServices(projectName, stackConfig, config));
-        return definitionInputs(root, this.resolveStackApps(stackConfig, config).flatMap((a) => (a.bootstrap ? [a.bootstrap] : [])), shipped.map(([, dir]) => dir));
+        const shipped = shippedDirsOf(mergeInfrastructure(config, stackConfig), await this.collectDeclaredServices(projectName, stackConfig, config, { definitions }));
+        return definitionInputs(root, this.resolveStackApps(stackConfig, config).flatMap((a) => (a.bootstrap ? [resolveAppPath(root, a, a.bootstrap)] : [])), shipped.map(([, dir]) => dir));
     }
     async admitRelease(projectName, stackName, stackConfig, config, releaseId, purpose = 'deploy') {
-        if (stackConfig.type === 'local') {
-            throw new Error(`A release is for a remote stack — ${projectName}/${stackName} is local and runs its working tree.`);
-        }
+        if (stackConfig.type === 'local' && stackConfig.managedOrigin)
+            throw new Error('A node allocation takes its release from its owning controller');
         const { loadRelease, treeEqualsCommit } = await import('../release/load.js');
         const { decideStackRelease } = await import('../release/manifest.js');
         const release = await loadRelease(releaseId, await this.releaseStore());
-        const apps = this.resolveStackApps(stackConfig, config).map((a) => a.name);
+        const configuredApps = this.resolveStackApps(stackConfig, config);
+        if (stackConfig.type !== 'local' && configuredApps.some(entry => entry.releaseFrom || release.manifest.artifacts.some(artifact => artifact.app === entry.name && artifact.origin)))
+            throw Error('Imported applications require verified local release installation. Remote admission needs producer-captured deployment declarations and a compatible execution owner.');
+        const mounted = artifactVolumeEntries(mergeInfrastructure(config, stackConfig), config.apps);
+        if (mounted.length && (stackConfig.type !== 'local' || stackConfig.managedOrigin || !ownsStackInfrastructure(stackConfig)))
+            throw Error('Artifact volumes require an independently owned local stack');
+        const apps = [...new Set([...configuredApps, ...mounted].map(a => a.name))];
         // The fourth argument, which was `[]` for as long as nothing wrote one:
         // a stack declaring `verifiedOn` refused every release forever, with a
         // refusal that read «nothing has been verified on 'test'» while there
@@ -1526,13 +2730,23 @@ export class ProjectService extends EventEmitter {
             this.logger.info({ project: projectName, stack: stackName }, 'No release is recorded as running on this stack — applied migrations are not compared');
         }
         else if (running !== release.id) {
-            let ran;
+            let previous;
             try {
-                ran = (await loadRelease(running, await this.releaseStore())).manifest.migrations;
+                previous = (await loadRelease(running, await this.releaseStore())).manifest;
             }
             catch (err) {
                 this.logger.warn({ project: projectName, stack: stackName, running, error: err.message }, 'The release running on this stack could not be read — its migrations are not compared');
             }
+            if (previous) {
+                const { changedImportedMigrations } = await import('../release/migrations.js');
+                const imported = changedImportedMigrations(previous, release.manifest, apps);
+                if (imported.length)
+                    throw Error('Refusing release ' + release.id + ': imported migration history changed (' + imported.slice(0, 5).join(', ') + '). Preserve applied migrations in the producer package.');
+            }
+            else if (release.manifest.artifacts.some(artifact => apps.includes(artifact.app) && artifact.origin)) {
+                throw Error('Cannot verify imported migration history because the previously running release is unavailable: ' + running);
+            }
+            const ran = previous?.migrations;
             if (ran && release.manifest.migrations) {
                 const { changedReleasedMigrations } = await import('../release/migrations.js');
                 const changed = changedReleasedMigrations(ran, release.manifest.migrations);
@@ -1550,17 +2764,48 @@ export class ProjectService extends EventEmitter {
         if (!project)
             throw new Error(`Project '${projectName}' is not in the registry`);
         const commit = release.manifest.project.commit;
-        // Only what the definition reads has to be the release's — see
-        // `release/definition-inputs.ts`. The rest of the checkout is other
-        // people's work in progress, which no deployment reads. When the files
-        // cannot be named, the whole tree is compared, as before.
+        if (stackConfig.type === 'local') {
+            if (!/^[a-f0-9]{40}$/.test(commit))
+                throw new Error('A local release requires a full source commit');
+            const { promisify } = await import('node:util');
+            const { execFile } = await import('node:child_process');
+            const { stdout } = await promisify(execFile)('git', ['rev-parse', '--show-prefix'], { cwd: project.path });
+            const directory = stdout.trimEnd().replace(/\/$/, '');
+            if (directory !== (release.manifest.project.directory ?? ''))
+                throw new Error('This local release belongs to another project directory in the repository');
+        }
+        // Only what the definition reads has to be the release's. A failed input
+        // inventory cannot be replaced by a narrower or unverified comparison.
         const root = fs.realpathSync(project.path);
+        // Local admission materializes the verified package itself. On remote deployments
+        // the old single-project bootstrap still supplies its code declarations; its data
+        // file must come from the admitted archive, including when that file is absent.
+        let remoteDefinitions;
+        if (stackConfig.type !== 'local') {
+            const entries = this.resolveStackApps(stackConfig, config);
+            const archived = new Map();
+            for (const entry of entries) {
+                if (entry.bootstrap)
+                    archived.set(entry.name, await readArchiveInfrastructure(release, entry.name));
+            }
+            remoteDefinitions = await this.loadAppDefinitions(projectName, stackConfig, config, entries, archived);
+        }
         let inputs;
         try {
-            inputs = await this.deploymentReads(projectName, stackConfig, config, root);
+            // Local launches read executable app declarations from the verified installation. Only
+            // project-level configuration and explicitly mounted infrastructure still come from Git.
+            if (stackConfig.type === 'local') {
+                const { definitionInputs } = await import('../release/definition-inputs.js');
+                const { shippedDirsOf } = await import('../infrastructure/shipped-config.js');
+                inputs = await definitionInputs(root, [], shippedDirsOf(mergeInfrastructure(config, stackConfig), {}).map(([, dir]) => dir));
+                if (!inputs.length)
+                    throw new Error('No registered configuration inputs are available');
+            }
+            else
+                inputs = await this.deploymentReads(projectName, stackConfig, config, root, remoteDefinitions);
         }
         catch (err) {
-            this.logger.warn({ project: projectName, stack: stackName, error: err.message }, 'Could not name the files the definition reads — the whole working tree has to be the release\'s commit');
+            throw new Error(`Cannot verify deployment inputs for ${projectName}/${stackName}: ${err.message}`, { cause: err });
         }
         const tree = await treeEqualsCommit(root, commit, inputs);
         if (!tree.equal) {
@@ -1571,15 +2816,17 @@ export class ProjectService extends EventEmitter {
                 `The definition is read from ${project.path}, so those have to be the release's: commit or set them aside, ` +
                 `check out ${commit.slice(0, 8)}, or build a release from what is here.`);
         }
-        // The omni an application runs on a node is that node daemon's, not the
-        // release's — see `release/daemon-omni.ts`.
-        const { refuseForeignOmni } = await import('../release/daemon-omni.js');
-        const foreign = refuseForeignOmni(release.manifest.omni.commit, await this.askDaemonVersions(stackConfig));
-        if (foreign) {
-            throw new Error(`Refusing release ${release.id} for ${projectName}/${stackName}: ${foreign}.`);
+        // Admission and installation use the same native resident/runtime proof.
+        // A frozen application supplies its own SDK; a controller build is not its runtime.
+        const { refuseReleaseOwners } = await import('../release/owner-admission.js');
+        const incompatible = stackConfig.type === 'local' ? null : refuseReleaseOwners(release.manifest, stackConfig, configuredApps, await this.askReleaseOwners(stackConfig, configuredApps));
+        if (incompatible) {
+            throw new Error(`Refusing release ${release.id} for ${projectName}/${stackName}: ${incompatible}.`);
         }
         const infra = mergeInfrastructure(config, stackConfig);
         const servesStatics = Boolean(infra?.services?.['gateway']?.config?.staticDir ?? infra?.gateway?.staticDir);
+        if (servesStatics && stackConfig.type === 'local')
+            throw new Error('This local gateway serves a working-tree static directory; an immutable local gateway binding is required');
         if (servesStatics && (!release.staticsDir || release.manifest.statics?.stack !== stackName)) {
             throw new Error(`Refusing release ${release.id} for ${projectName}/${stackName}: the stack's gateway serves a static bundle, and the ` +
                 `release carries ${release.manifest.statics ? `one built for '${release.manifest.statics.stack}'` : 'none'} — ` +
@@ -1593,18 +2840,19 @@ export class ProjectService extends EventEmitter {
             projectCommit: commit.slice(0, 8),
             omniCommit: release.manifest.omni.commit.slice(0, 8),
         }, purpose === 'check' ? 'Release would be admitted — asked, not deployed' : 'Release admitted');
-        return release;
+        return remoteDefinitions ? { ...release, remoteDefinitions } : release;
     }
-    /** What each of a stack's nodes says its daemon is — the omni its applications load. */
-    async askDaemonVersions(stackConfig) {
-        const connector = this.getSlaveConnector();
-        return Promise.all((stackConfig.nodes ?? []).map(async (node) => {
+    /** Inspect exactly the nodes that will execute applications. Delivery repeats
+     * this OS/private-Netron proof; version suffixes never substitute for it. */
+    async askReleaseOwners(stackConfig, apps) {
+        return Promise.all(resolveNodePlacements(stackConfig, apps).filter(placement => placement.apps.length).map(async ({ node }) => {
             try {
-                const pong = (await connector.invokeOnSlave(node.host, node.port ?? 9700, 'OmnitronDaemon', 'ping', []));
-                return { host: node.host, version: pong?.version ?? null };
+                const bundle = await this.deployer.inspectInstalledBundle(await this.targetForStackNode(node));
+                return { host: node.host, port: node.port ?? 9700,
+                    ...(bundle.applicationRuntime && { runtime: bundle.applicationRuntime }) };
             }
             catch (err) {
-                return { host: node.host, version: null, error: err.message };
+                return { host: node.host, port: node.port ?? 9700, error: describeFailure(err) };
             }
         }));
     }
@@ -1665,6 +2913,38 @@ export class ProjectService extends EventEmitter {
     getInfraManager() {
         return this.infraManager;
     }
+    /** Cached declarations plus persisted intent; this query never starts infrastructure. */
+    getInfrastructureHealthContext() {
+        const context = { stacks: [], requiredContainers: [], unresolvedStacks: [],
+            observedServices: this.infraManager.listInstances().flatMap(({ infra }) => Object.values(infra.getState().services)) };
+        const apps = this.orchestrator.list();
+        for (const project of this.registry.listRegistrations()) {
+            const config = this.getLoadedConfig(project.name);
+            if (!config)
+                continue; // Unknown ownership must remain visible to the indicator.
+            const running = this.getRunningStacks(project.name);
+            for (const [stack, declaration] of Object.entries(this.resolveStacks(config, project.name))) {
+                if (declaration.type !== 'local')
+                    continue;
+                const prefix = `${project.name}/${stack}/`;
+                const active = project.enabledStacks?.includes(stack) || running.includes(stack) ||
+                    apps.some(app => app.name.startsWith(prefix) && ['online', 'starting', 'restarting'].includes(app.status));
+                const intent = active ? 'running' : project.enabledStacks ? 'inactive' : 'unknown';
+                const scope = { project: project.name, stack, intent };
+                context.stacks.push(scope);
+                if (intent !== 'running')
+                    continue;
+                const infra = this.infraManager.getInstance(project.name, stack);
+                if (infra) {
+                    scope.containers = infra.getDesiredServices().map(service => service.name);
+                    context.requiredContainers.push(...scope.containers);
+                }
+                else if (mergeInfrastructure(config, declaration))
+                    context.unresolvedStacks.push(`${project.name}/${stack}`);
+            }
+        }
+        return context;
+    }
     // ===========================================================================
     // Enabled-stacks reconciler — desired-state convergence
     // ===========================================================================
@@ -1686,9 +2966,12 @@ export class ProjectService extends EventEmitter {
         if (this.resumeTimer)
             return;
         this.resumeTimer = setInterval(() => {
+            if (this.ownershipFrozen || this.resumingInstalled || this.reconcilingStacks)
+                return;
+            this.reconcilingStacks = true;
             void this.reconcileEnabledStacks().catch((err) => {
                 this.logger.warn({ error: err.message }, 'Enabled-stacks reconciler tick failed');
-            });
+            }).finally(() => { this.reconcilingStacks = false; });
         }, intervalMs);
         this.resumeTimer.unref();
         this.logger.info({ intervalMs }, 'Enabled-stacks reconciler started');
@@ -1696,10 +2979,13 @@ export class ProjectService extends EventEmitter {
     async reconcileEnabledStacks() {
         // Collect the divergence set first — cheap, no I/O.
         const pending = [];
-        for (const project of this.registry.list()) {
+        for (const project of this.registry.listRegistrations()) {
             for (const stackName of project.enabledStacks ?? []) {
                 const state = this.stackStates.get(`${project.name}/${stackName}`);
-                const status = state?.status;
+                // Only retry a failed lifecycle attempt. App supervision owns later
+                // changes to a running stack, including individual operator stops.
+                const status = state?.status === 'error' && state.config.type === 'local' && state.startedAt != null
+                    ? this.toStackInfo(project.name, stackName, state.config).status : state?.status;
                 // Converge only from fully-down states (absent/stopped/error).
                 // 'degraded' means mostly-up — restarting the whole stack over it
                 // would churn healthy apps; per-app recovery owns that case.
@@ -1711,17 +2997,9 @@ export class ProjectService extends EventEmitter {
         }
         if (pending.length === 0)
             return;
-        // One cheap probe gates the whole round: without Docker every start is
-        // guaranteed to fail, so don't burn backoff budget on it.
-        const { isDockerAvailable } = await import('../infrastructure/container-runtime.js');
-        if (!(await isDockerAvailable())) {
-            if (this.dockerWasAvailable !== false) {
-                this.logger.warn({ pending: pending.map((p) => `${p.project}/${p.stack}`) }, 'Reconciler: Docker unavailable — deferring enabled-stack resume');
-            }
-            this.dockerWasAvailable = false;
-            return;
-        }
-        this.dockerWasAvailable = true;
+        // Infrastructure admission belongs to startStack, including ownership and
+        // inferred requirements. A global Docker probe would strand remote and
+        // externally provisioned stacks behind an unrelated local dependency.
         const now = Date.now();
         for (const { project, stack } of pending) {
             const key = `${project}/${stack}`;
@@ -1735,7 +3013,14 @@ export class ProjectService extends EventEmitter {
                 if (!this.getLoadedConfig(project)) {
                     await this.loadProjectConfig(project);
                 }
-                await this.startStack(project, stack, { source: 'auto-resume' });
+                const result = await this.startStack(project, stack, { source: 'auto-resume' });
+                if (result.type === 'local' && result.status !== 'running') {
+                    if (result.status === 'degraded') {
+                        this.logger.warn({ project, stack, notUp: result.notUp }, 'Reconciler: partial start under application supervision');
+                        continue;
+                    }
+                    throw new Error(result.notUp?.join(', ') || `Stack state: ${result.status}`);
+                }
                 this.resumeBackoff.delete(key);
                 this.logger.info({ project, stack }, 'Reconciler: stack resumed');
             }
@@ -1803,7 +3088,7 @@ export class ProjectService extends EventEmitter {
             this.emit('project:config_reloaded', projectName);
         }
         else {
-            for (const project of this.registry.list()) {
+            for (const project of this.registry.listRegistrations()) {
                 await this.loadProjectConfig(project.name);
                 this.emit('project:config_reloaded', project.name);
             }
@@ -1812,12 +3097,19 @@ export class ProjectService extends EventEmitter {
     // ===========================================================================
     // Helpers
     // ===========================================================================
-    getRunningStacks(projectName) {
+    getRunningStacks(projectName, includeIncomplete = false) {
         const result = [];
         for (const [, state] of this.stackStates) {
-            if (state.project === projectName && (state.status === 'running' || state.status === 'starting')) {
+            if (state.project !== projectName)
+                continue;
+            if (includeIncomplete && state.status !== 'stopped') {
                 result.push(state.stack);
+                continue;
             }
+            const status = state.config.type === 'local' && state.startedAt != null
+                ? this.toStackInfo(projectName, state.stack, state.config).status : state.status;
+            if (status === 'running' || status === 'starting')
+                result.push(state.stack);
         }
         return result;
     }
@@ -1877,7 +3169,7 @@ export class ProjectService extends EventEmitter {
                 if (config.database) {
                     const dbConfig = typeof config.database === 'object' ? config.database : {};
                     databases[appName] = {
-                        migrate: true,
+                        // A discovered dependency is not authority to execute a migration.
                         ...(dbConfig.extensions?.length ? { extensions: dbConfig.extensions } : {}),
                     };
                 }
@@ -1973,105 +3265,42 @@ export class ProjectService extends EventEmitter {
         return readings;
     }
     async validateStackInfrastructure(projectName, stackName) {
-        const config = await this.loadProjectConfig(projectName);
-        const stacks = this.resolveStacks(config, projectName);
-        const stackConfig = stacks[stackName];
-        if (!stackConfig) {
-            return { valid: false, issues: [`Stack '${stackName}' not found`] };
-        }
-        const project = this.registry.get(projectName);
-        if (!project) {
-            return { valid: false, issues: [`Project '${projectName}' not found`] };
-        }
-        // Determine effective infrastructure: stack-level overrides ecosystem-level
-        const effectiveInfra = stackConfig.infrastructure ?? config.infrastructure;
-        const issues = [];
-        // Scan app requirements
-        const { scanRequirements } = await import('../project/requirements-scanner.js');
-        const appEntries = this.resolveStackApps(stackConfig, config);
-        const reqs = await scanRequirements(appEntries, project.path);
-        // Check PostgreSQL
-        if (reqs.databases.length > 0 && !effectiveInfra?.postgres) {
-            issues.push(`PostgreSQL required by ${reqs.databases.map((d) => d.app).join(', ')} but not configured in infrastructure`);
-        }
-        else if (reqs.databases.length > 0 && effectiveInfra?.postgres) {
-            // Check individual databases exist in config
-            const configuredDbs = new Set(Object.keys(effectiveInfra.postgres.databases ?? {}));
-            for (const db of reqs.databases) {
-                if (!configuredDbs.has(db.database)) {
-                    issues.push(`Database '${db.database}' needed by '${db.app}' not found in postgres.databases`);
-                }
-            }
-        }
-        // Check Redis
-        if (reqs.redis.appCount > 0 && !effectiveInfra?.redis) {
-            issues.push(`Redis required by ${reqs.redis.allocations.map((a) => a.app).join(', ')} but not configured in infrastructure`);
-        }
-        // Check S3/MinIO
-        if (reqs.buckets.length > 0 && !effectiveInfra?.minio) {
-            issues.push(`S3/MinIO required by ${reqs.buckets.map((b) => b.app).join(', ')} but not configured in infrastructure`);
-        }
-        else if (reqs.buckets.length > 0 && effectiveInfra?.minio) {
-            const configuredBuckets = new Set(effectiveInfra.minio.buckets ?? []);
-            for (const b of reqs.buckets) {
-                if (configuredBuckets.size > 0 && !configuredBuckets.has(b.bucket)) {
-                    issues.push(`Bucket '${b.bucket}' needed by '${b.app}' not found in minio.buckets`);
-                }
-            }
-        }
+        const report = await this.diagnoseStack(projectName, stackName);
+        const issues = report.checks.filter(check => check.state === 'blocked' || check.state === 'unknown').map(check => `${check.resource}: ${check.message}`);
         return { valid: issues.length === 0, issues };
     }
     // ===========================================================================
     // Private — Stack Launchers
     // ===========================================================================
-    async startLocalStack(projectName, stackName, stackConfig, ecosystemConfig) {
+    async startLocalStack(projectName, stackName, stackConfig, ecosystemConfig, selectedEntries, enable, verifyMigrations, verifyArtifactInfrastructure) {
+        const ownsInfrastructure = ownsStackInfrastructure(stackConfig);
         const stateKey = `${projectName}/${stackName}`;
         const state = this.stackStates.get(stateKey);
-        // 0. Validate infrastructure covers app requirements (warn only, don't block)
-        try {
-            const validation = await this.validateStackInfrastructure(projectName, stackName);
-            if (!validation.valid) {
-                for (const issue of validation.issues) {
-                    this.logger.warn({ project: projectName, stack: stackName, issue }, 'Infrastructure validation issue');
-                }
-            }
-        }
-        catch {
-            // Validation is best-effort — don't block stack start
-        }
         // 1. Load bootstrap definitions (needed for both infra provisioning and config resolution)
-        const appEntries = this.resolveStackApps(stackConfig, ecosystemConfig);
+        const appEntries = selectedEntries ?? this.resolveStackApps(stackConfig, ecosystemConfig);
         // What the stack gives its apps, vault references resolved — now, before
         // anything is provisioned: a key the vault does not hold refuses the
         // start here (project/stack-env.ts).
         const stackEnv = await this.stackEnvFor(projectName, stackName, stackConfig, appEntries.map((e) => e.name));
         const project = this.registry.get(projectName);
-        const appDefinitions = await this.loadAppDefinitions(projectName, stackConfig, ecosystemConfig);
+        const appDefinitions = await this.loadAppDefinitions(projectName, stackConfig, ecosystemConfig, appEntries);
         // 2. Provision per-stack infrastructure (built-in + app-declared services)
         //    Auto-detect core services (postgres, redis, minio) from app requirements,
         //    then merge with explicit infrastructure config (gateway, custom services).
         // Merge stack-level + ecosystem-level infrastructure (stack overrides ecosystem, but both contribute)
-        let effectiveInfra = mergeInfrastructure(ecosystemConfig, stackConfig);
-        if (project) {
-            try {
-                const { scanRequirements, buildInfraFromRequirements } = await import('../project/requirements-scanner.js');
-                const reqs = await scanRequirements(appEntries, project.path);
-                const autoInfra = buildInfraFromRequirements(reqs);
-                if (Object.keys(autoInfra).length > 0) {
-                    const explicitServices = effectiveInfra?.services ?? {};
-                    this.logger.info({ explicitServiceKeys: Object.keys(explicitServices), hasEffective: !!effectiveInfra }, 'Pre-merge: explicit services from config');
-                    // Merge: auto-detected core services + explicit config (gateway, custom services)
-                    effectiveInfra = {
-                        ...autoInfra,
-                        ...effectiveInfra,
-                        services: { ...explicitServices },
-                    };
-                    this.logger.info({ project: projectName, stack: stackName, auto: Object.keys(autoInfra), explicit: Object.keys(effectiveInfra.services ?? {}) }, 'Merged auto-detected + explicit infrastructure');
-                }
-            }
-            catch (err) {
-                this.logger.warn({ error: err.message }, 'Failed to auto-detect infrastructure requirements');
-            }
+        for (const entry of appEntries) {
+            if (entry.bootstrap && !appDefinitions.has(entry.name))
+                throw new Error(`Bootstrap declarations unavailable for ${entry.name}`);
+        }
+        const effectiveInfra = ownsInfrastructure ? mergeInferredInfrastructure(buildInfraFromRequirements(requirementsFromDefinitions(appDefinitions)), verifyArtifactInfrastructure ? await verifyArtifactInfrastructure() : mergeInfrastructure(ecosystemConfig, stackConfig)) : undefined;
+        // Refuse missing/tampered migrators before creating or changing infrastructure.
+        if (effectiveInfra && project) {
+            const migrations = await localMigrationTargets(requestedMigrations(normalizeInfraConfig(effectiveInfra, createDefaultRegistry())), appEntries, project.path, verifyMigrations);
+            const resolveMigration = this.stackEntryBuilder(projectName, stackName, stackConfig, ecosystemConfig, appDefinitions, stackEnv);
+            validateMigrationDestinations(migrations.map(target => {
+                const entry = appEntries.find(app => app.name === target.app);
+                return { app: target.app, database: migrationDatabaseEnvironment(target.environmentApp, resolveMigration(entry).env?.['DATABASE_URL'] ?? '', target.database, target.mode) };
+            }));
         }
         if (effectiveInfra) {
             try {
@@ -2092,10 +3321,10 @@ export class ProjectService extends EventEmitter {
                 // Bail out with a clear, structured error so the operator sees the
                 // real cause first.
                 //
-                // Edge case: stacks that intentionally talk to *external* infra and
-                // declare nothing in their `infrastructure` section never reach this
-                // branch (`effectiveInfra` is falsy). For deliberate degraded-mode
-                // operation the stack settings can opt in via
+                // Explicit controller/external ownership never enters this provisioning
+                // branch. Declarations alone do not imply permission to manage an
+                // application's existing services. For deliberate degraded-mode
+                // operation of stack-owned infrastructure, settings can opt in via
                 // `settings.allowDegradedInfra: true` (the field is namespaced under
                 // settings to remain forward-compatible with stack schema).
                 const allowDegraded = stackConfig.settings?.['allowDegradedInfra'] === true;
@@ -2111,17 +3340,17 @@ export class ProjectService extends EventEmitter {
                     throwable.cause = err;
                     throw throwable;
                 }
+                state.infrastructureStartFailed = true;
                 this.logger.warn({ project: projectName, stack: stackName }, 'allowDegradedInfra=true — proceeding with app start despite infra failure');
             }
         }
-        // 2b. Run database migrations for apps that have migrate: true
+        // Resolve once for both migrations and application startup. Inferred service
+        // requirements are not permission to connect to a database or run migrations.
+        const appConfigBuilder = this.stackEntryBuilder(projectName, stackName, stackConfig, ecosystemConfig, appDefinitions, stackEnv);
         if (effectiveInfra && project) {
-            await this.runStackMigrations(projectName, stackName, effectiveInfra, appEntries, project.path);
+            await this.runStackMigrations(projectName, stackName, this.infraManager.getNormalizedServices(projectName, stackName) ?? {}, appEntries, project.path, appConfigBuilder, verifyMigrations);
         }
-        // 3. How each app is started: its entry, built from the stack's resolved
-        //    configuration (`stackEntryBuilder` — the same builder a re-read of
-        //    the project uses to redefine running apps).
-        const appConfigBuilder = this.stackEntryBuilder(projectName, stackName, stackConfig, ecosystemConfig, appDefinitions, stackEnv);
+        await enable?.(appConfigBuilder);
         // 4. Start apps in dependency-aware parallel batches.
         //
         // Pre-fix this was a serial `for ... await` loop in declaration
@@ -2139,13 +3368,12 @@ export class ProjectService extends EventEmitter {
         // parallel, and a wave can't start until every member of the
         // previous wave is online. Same skip-on-failed-dep semantics
         // as startAll.
-        const failed = new Set();
-        const blocked = new Set();
+        const problems = new Map();
         for (const wave of resolveStartupOrder(appEntries)) {
             await Promise.all(wave.map(async (entry) => {
-                const blockingDep = (entry.dependsOn ?? []).find((d) => failed.has(d) || blocked.has(d));
+                const blockingDep = (entry.dependsOn ?? []).find((d) => problems.has(d));
                 if (blockingDep) {
-                    blocked.add(entry.name);
+                    problems.set(entry.name, `dependency ${blockingDep} did not start`);
                     this.logger.warn({ app: entry.name, project: projectName, stack: stackName, blockedBy: blockingDep }, 'Skipping app — dependency failed or was blocked');
                     return;
                 }
@@ -2162,14 +3390,15 @@ export class ProjectService extends EventEmitter {
                     await this.orchestrator.startApp(namespacedEntry, ecosystemConfig);
                 }
                 catch (err) {
-                    failed.add(entry.name);
+                    // The raw exception can contain credentials, app output or host paths.
+                    // Keep bounded process evidence in stack views available to readers.
+                    problems.set(entry.name, publicLaunchFailure(err));
                     this.logger.error({ app: entry.name, project: projectName, stack: stackName, error: err.message }, 'Failed to start app in stack');
                 }
             }));
         }
-        if (failed.size > 0 || blocked.size > 0) {
-            this.logger.warn({ project: projectName, stack: stackName, failed: [...failed], blocked: [...blocked] }, 'Stack startup finished with failures — some apps did not launch');
-        }
+        if (problems.size)
+            state.appStartErrors = Object.fromEntries(problems);
     }
     /**
      * Deploy a stack to its nodes, and say what it is doing while it does it.
@@ -2183,7 +3412,7 @@ export class ProjectService extends EventEmitter {
     async startRemoteStack(projectName, stackName, stackConfig, ecosystemConfig, release = null, reinstall = false) {
         const phases = reportPhases(this.logger, { project: projectName, stack: stackName });
         try {
-            return await this.deployRemoteStack(projectName, stackName, stackConfig, ecosystemConfig, phases, release, reinstall);
+            return await withDeploymentProgress({ project: projectName, stack: stackName, operationId: randomUUID(), ...(release && { releaseId: release.id }) }, () => this.deployRemoteStack(projectName, stackName, stackConfig, ecosystemConfig, phases, release, reinstall));
         }
         finally {
             // Every exit, including the refusals: a reporter that outlives its
@@ -2220,9 +3449,15 @@ export class ProjectService extends EventEmitter {
         // variant selection and override merging, on the side with less
         // information.
         phases.enter('reading what the applications declare');
-        const declaredServices = await this.collectDeclaredServices(projectName, stackConfig, ecosystemConfig);
+        if (release && !release.remoteDefinitions)
+            throw Error('Checked remote release has no admitted infrastructure definitions');
+        const declaredServices = await this.collectDeclaredServices(projectName, stackConfig, ecosystemConfig, { definitions: release?.remoteDefinitions });
         // Build artifacts for apps in this stack
         const appEntries = this.resolveStackApps(stackConfig, ecosystemConfig);
+        const migrationRequests = requestedMigrations({ ...declaredServices,
+            ...normalizeInfraConfig(mergeInfrastructure(ecosystemConfig, stackConfig) ?? {}, createDefaultRegistry()) });
+        validateMigrationOwners(migrationRequests, appEntries);
+        const placements = orderMigrationPlacements(migrationRequests, resolveNodePlacements(stackConfig, appEntries));
         // What the stack gives its apps, vault references resolved — before any
         // node is touched: a key the vault does not hold refuses the deployment
         // here, not after a node was provisioned (project/stack-env.ts). A remote
@@ -2240,6 +3475,7 @@ export class ProjectService extends EventEmitter {
             // Built in clean clones, gated, and checked against the manifest by
             // `loadRelease` — nothing is compiled here, from this machine's disk.
             const files = new Map(release.files.map((f) => [f.app, f]));
+            const sources = new Map(releaseArtifactOrigins(release.manifest, release.manifestSha256).map(source => [source.app, source]));
             artifacts = appEntries.flatMap((entry) => {
                 const file = files.get(entry.name);
                 return file
@@ -2251,6 +3487,8 @@ export class ProjectService extends EventEmitter {
                             builtAt: release.manifest.builtAt,
                             checksum: file.inputs,
                             tarballSha256: file.sha256,
+                            release: sources.get(file.app).origin,
+                            ...(sources.get(file.app).artifact.launch && { launch: sources.get(file.app).artifact.launch }),
                         }]
                     : [];
             });
@@ -2353,7 +3591,9 @@ export class ProjectService extends EventEmitter {
             const locks = new Map();
             try {
                 // Deploy to each node: provision slave → deploy artifacts → connect
-                for (const node of nodes) {
+                for (const { node, apps: nodeApps } of placements) {
+                    const selectedNames = new Set(nodeApps.map(app => app.name));
+                    const nodeArtifacts = artifacts.filter(artifact => selectedNames.has(artifact.app));
                     const nodeKey = `${node.host}:${node.port ?? 9700}`;
                     if (!leases.has(nodeKey)) {
                         skipped.push(nodeKey);
@@ -2361,9 +3601,6 @@ export class ProjectService extends EventEmitter {
                         continue;
                     }
                     // 1. Provision slave: install runtime + omnitron + generate slave config + start daemon
-                    const unsubProvision = this.deployer.onProgress((progress) => {
-                        this.emit('stack:deploy_progress', projectName, stackName, progress);
-                    });
                     const target = targets.get(nodeKey);
                     const master = await resolveMasterHost({ advertiseHost: _dc.advertiseHost, bindHost: _dc.host }, target);
                     if (master.host) {
@@ -2381,7 +3618,6 @@ export class ProjectService extends EventEmitter {
                         locks.set(nodeKey, lock);
                     phases.enter(`provisioning ${node.host}`);
                     const provisioned = await this.deployer.provisionSlaveNode(target, master.host, masterPort, projectName);
-                    unsubProvision();
                     if (!provisioned) {
                         skipped.push(nodeKey);
                         this.logger.error({ node: nodeKey }, 'Failed to provision slave — skipping');
@@ -2470,25 +3706,23 @@ export class ProjectService extends EventEmitter {
                     // and swept the master's `sample-test-*` as orphans. An address is not an
                     // instruction to build what it points at.
                     phases.enter(`resolving the environment for ${node.host}`);
-                    const appEnv = await this.resolveNodeAppEnv(ecosystemConfig, projectName, stackConfig, appEntries, deployedInfra);
+                    const appEnv = await this.resolveNodeAppEnv(ecosystemConfig, projectName, stackConfig, nodeApps, deployedInfra, release?.remoteDefinitions);
                     // The stack's own, over the computed — as on a local stack, where
                     // `settings.env` wins over both.
-                    for (const [app, env] of Object.entries(stackEnv))
+                    for (const [app, env] of Object.entries(stackEnv).filter(([name]) => selectedNames.has(name)))
                         appEnv[app] = { ...(appEnv[app] ?? {}), ...env };
                     // 3. Deploy app artifacts via SSH
-                    if (artifacts.length > 0) {
-                        const unsubDeploy = this.deployer.onProgress((progress) => {
-                            this.emit('stack:deploy_progress', projectName, stackName, progress);
-                        });
+                    if (nodeArtifacts.length > 0) {
                         // The definitions travel with the artifacts. A node that receives
                         // one without the other has files it cannot run, and says so only if
                         // someone asks it directly.
-                        await leases.confirm(nodeKey, `delivering ${artifacts.length} artifact(s) to ${node.host}`);
-                        phases.enter(`delivering ${artifacts.length} artifact(s) to ${node.host}`);
+                        await leases.confirm(nodeKey, `delivering ${nodeArtifacts.length} artifact(s) to ${node.host}`);
+                        phases.enter(`delivering ${nodeArtifacts.length} artifact(s) to ${node.host}`);
                         const sink = ecosystemConfig.monitoring?.alertSink;
-                        const results = await this.deployer.deployToStack([target], artifacts, projectName, {
-                            apps: appEntries,
+                        const results = await this.deployer.deployToStack([target], nodeArtifacts, projectName, {
+                            apps: nodeApps,
                             appEnv,
+                            migrations: migrationRequests.filter(request => selectedNames.has(request.app)),
                             stack: stackName,
                             // Past the node's record of what each app runs: ship and restart all.
                             ...(reinstall ? { force: true } : {}),
@@ -2496,7 +3730,6 @@ export class ProjectService extends EventEmitter {
                             // sink on the stack it runs; named as the master names the stack.
                             ...(sink && { alertSink: { ...sink, host: `${projectName}/${stackName}` } }),
                         });
-                        unsubDeploy();
                         const failed = results.filter((r) => r.status === 'failed');
                         if (failed.length > 0) {
                             // The other half of the same invariant. Building every artifact
@@ -2620,7 +3853,7 @@ export class ProjectService extends EventEmitter {
      * node, beside containers whose ports are published on that node's
      * loopback. Local is what they are from where they stand.
      */
-    async resolveNodeAppEnv(ecosystemConfig, projectName, stackConfig, appEntries, infrastructure) {
+    async resolveNodeAppEnv(ecosystemConfig, projectName, stackConfig, appEntries, infrastructure, admitted) {
         if (!infrastructure)
             return {};
         try {
@@ -2633,7 +3866,7 @@ export class ProjectService extends EventEmitter {
             // Measured: the node's config carried five environment variables per
             // app and not the one the apps were failing for. An empty map is not a
             // map of nothing declared; it is a map nobody filled.
-            const definitions = await this.loadAppDefinitions(projectName, stackConfig, ecosystemConfig);
+            const definitions = admitted ?? await this.loadAppDefinitions(projectName, stackConfig, ecosystemConfig);
             // The stack's answers about services it does not provision.
             //
             // `serviceOverrides` is where a stack says that bitcoin and monero are
@@ -2668,8 +3901,8 @@ export class ProjectService extends EventEmitter {
             // Not fatal, and loud: the apps would start with whatever their own
             // definitions carry, which is how they came to be started with
             // `postgres:postgres` in the first place.
-            this.logger.error({ project: projectName, error: err.message }, 'Could not resolve what the deployed apps connect to — they will start with their declared env only');
-            return {};
+            this.logger.error({ project: projectName, error: err.message }, 'Could not resolve application service bindings; deployment refused before application delivery');
+            throw new Error('Could not resolve application service bindings', { cause: err });
         }
     }
     /**
@@ -3007,206 +4240,59 @@ export class ProjectService extends EventEmitter {
             return { ready: false, detail: `could not ask the node: ${err.message}` };
         }
     }
-    async startClusterStack(projectName, stackName, stackConfig, ecosystemConfig) {
-        const nodes = stackConfig.nodes ?? [];
-        if (nodes.length === 0) {
-            throw new Error(`Cluster stack '${stackName}' has no nodes configured`);
-        }
-        this.logger.info({ project: projectName, stack: stackName, nodes: nodes.length }, 'Starting cluster stack — coordinating slave daemons');
-        const connector = this.getSlaveConnector();
-        // Build artifacts
-        const appEntries = this.resolveStackApps(stackConfig, ecosystemConfig);
-        const project = this.registry.get(projectName);
-        let artifacts = [];
-        if (project) {
-            try {
-                const { ArtifactBuilder } = await import('../project/artifact-builder.js');
-                const builder = new ArtifactBuilder(project.path, undefined, {
-                    info: (msg) => this.logger.info({ project: project.name }, msg),
-                });
-                const outcome = await builder.buildAll(appEntries);
-                artifacts = outcome.built;
-                for (const f of outcome.failed) {
-                    this.logger.error({ app: f.app, error: f.error }, 'Artifact build failed');
-                }
-            }
-            catch (err) {
-                this.logger.error({ error: err.message }, 'Artifact build failed');
-            }
-        }
-        // Resolve master address (from the SLAVE's perspective — what it dials)
-        const { DEFAULT_DAEMON_CONFIG: _dc } = await import('../config/defaults.js');
-        const { resolveMasterHost } = await import('./master-address.js');
-        const masterPort = _dc.port;
-        // Provision all slave nodes in parallel (install runtime + omnitron + config)
-        const appNodes = nodes.filter((n) => n.role !== 'database' && n.role !== 'cache');
-        // One writer per machine, as for a remote stack — see `deployRemoteStack`
-        // and `node-deploy-lease.ts`.
-        const targets = new Map();
-        for (const node of appNodes) {
-            targets.set(`${node.host}:${node.port ?? 9700}`, await this.targetForStackNode(node));
-        }
-        await withNodeLeases([...targets].map(([node, target]) => ({
-            node,
-            machine: `${target.host}:${target.sshPort ?? 22}`,
-            run: this.deployer.leaseRunner(target),
-        })), `${projectName}/${stackName}`, this.logger, async (leases) => {
-            const leased = appNodes.filter((n) => leases.has(`${n.host}:${n.port ?? 9700}`));
-            for (const [node, because] of leases.unreachable) {
-                this.logger.error({ node, because }, 'Could not reach this node to lease it — skipping');
-            }
-            for (const node of leased) {
-                const nodeKey = `${node.host}:${node.port ?? 9700}`;
-                const unsubProvision = this.deployer.onProgress((progress) => {
-                    this.emit('stack:deploy_progress', projectName, stackName, progress);
-                });
-                const target = targets.get(nodeKey);
-                const master = await resolveMasterHost({ advertiseHost: _dc.advertiseHost, bindHost: _dc.host }, target);
-                this.logger.info({ node: node.host, masterHost: master.host ?? '(none — this node is pulled from)', from: master.source }, 'Resolved the master address this slave will dial');
-                await leases.confirm(nodeKey, `provisioning ${node.host}`);
-                await this.deployer.provisionSlaveNode(target, master.host, masterPort, projectName);
-                unsubProvision();
-            }
-            // Deploy app artifacts to all provisioned nodes
-            if (artifacts.length > 0 && leased.length > 0) {
-                for (const node of leased) {
-                    await leases.confirm(`${node.host}:${node.port ?? 9700}`, `delivering to ${node.host}`);
-                }
-                const unsubDeploy = this.deployer.onProgress((progress) => {
-                    this.emit('stack:deploy_progress', projectName, stackName, progress);
-                });
-                const results = await this.deployer.deployToStack(leased.map((n) => targets.get(`${n.host}:${n.port ?? 9700}`)), artifacts, projectName, 
-                // Same on the cluster path: artifacts without definitions are files a
-                // node cannot run.
-                { concurrency: 5, apps: appEntries });
-                unsubDeploy();
-                const successful = results.filter((r) => r.status === 'success').length;
-                const failed = results.filter((r) => r.status === 'failed').length;
-                this.logger.info({ successful, failed, total: results.length }, 'Cluster deployment complete');
-            }
-        });
-        // Connect to all slave daemons
-        for (const node of nodes) {
-            await connector.addSlave({
-                host: node.host,
-                port: node.port ?? 9700,
-                label: node.label,
-                stack: stackName,
-                project: projectName,
-            });
-        }
-    }
     // ===========================================================================
     // Private — Utilities
     // ===========================================================================
     /**
-     * Run database migrations for apps that declare migrate: true in their
-     * stack infrastructure config. Migrations are executed after databases are
+     * Execute the explicit normalized migration owners in their declared order. Migrations are executed after databases are
      * created but before apps are started, so apps always see a current schema.
      *
-     * Convention: each app's migration script is at `apps/{appName}/src/database/migrate.ts`.
-     * The script reads DATABASE_URL or app-specific env vars and defaults to
-     * localhost:{port}/{dbName} with postgres:postgres — matching the stack's provisioned postgres.
+     * Config bindings use declared cwd and verified release members. Legacy true
+     * retains the conventional script. Both receive the owner's resolved environment.
+     * Normalized presets are the authority for opt-in, including legacy sugar.
      */
-    async runStackMigrations(projectName, stackName, infraConfig, appEntries, projectPath) {
-        const pgConfig = infraConfig.postgres;
-        if (!pgConfig?.databases)
-            return;
-        const appNames = new Set(appEntries.map((a) => a.name));
-        const port = pgConfig.port ?? 5432;
-        const user = pgConfig.user ?? 'postgres';
-        const password = typeof pgConfig.password === 'string' ? pgConfig.password : 'postgres';
-        // Wait for postgres to actually accept connections before running ANY
-        // migrations. Containers can be reported "running" by Docker before
-        // pg_isready would pass, especially right after a fresh provision. Without
-        // this we hit ECONNREFUSED on the first migration and fail-fast bubbles
-        // into the user's face.
-        //
-        // Three minutes, not one. A minute fits a container that already has its
-        // data directory; it does not fit a cold one, which has to initdb and
-        // install extensions before it listens — and on a loaded machine that is
-        // several minutes. When the wait gives up the whole `stack start` aborts
-        // and no app is started at all, so a deadline set for the warm case turns
-        // a slow first boot into a stack that will not come up.
-        await waitForPostgres('localhost', port, user, password, 180_000);
-        for (const [dbName, dbConfig] of Object.entries(pgConfig.databases)) {
-            // Only run if migrate flag is set AND a matching app exists
-            if (!dbConfig || typeof dbConfig !== 'object' || !dbConfig.migrate)
-                continue;
-            if (!appNames.has(dbName))
-                continue;
-            const migrateScript = path.join(projectPath, 'apps', dbName, 'src', 'database', 'migrate.ts');
-            try {
-                await fs.promises.access(migrateScript);
-            }
-            catch {
-                this.logger.debug({ app: dbName, script: migrateScript }, 'Migration script not found — skipping');
-                continue;
-            }
-            this.logger.info({ project: projectName, stack: stackName, database: dbName }, 'Running database migrations');
-            // Retry policy: up to 5 attempts with exponential backoff (1s, 2s, 4s, 8s, 16s).
-            // Migration tools are typically idempotent, so retrying after a transient
-            // ECONNREFUSED / role-creation race is safe.
-            const maxAttempts = 5;
-            let attempt = 0;
-            let lastErr = null;
-            while (attempt < maxAttempts) {
-                attempt++;
+    async runStackMigrations(projectName, stackName, services, appEntries, projectPath, resolveEntry, verifyMigrations) {
+        const names = requestedMigrations(services);
+        const planned = await localMigrationTargets(names, appEntries, projectPath, verifyMigrations);
+        // Validate every resolved destination before the first DB probe. No missing source fallback.
+        const targets = planned.map(target => {
+            const env = resolveEntry(appEntries.find(entry => entry.name === target.app)).env;
+            const database = migrationDatabaseEnvironment(target.environmentApp, env?.['DATABASE_URL'] ?? '', target.database, target.mode);
+            return { target, env, database };
+        });
+        validateMigrationDestinations(targets.map(({ target, database }) => ({ app: target.app, database })));
+        // Import every config and resolve its definitions before the first connection.
+        // Runtime connect()/SQL are intentionally not executed by this preflight.
+        for (const { target, env, database } of targets)
+            if (target.mode === 'config') {
                 try {
-                    // Asynchronously. This was `execFileSync`, and a synchronous spawn
-                    // holds the daemon's whole event loop for as long as the child runs
-                    // — no RPC answered, no heartbeat, no mesh — which the event-loop
-                    // watch caught at a master boot on 2026-09-23: six migrations back
-                    // to back, 1 539 / 871 / 727 / 941 / 740 / 782 ms, 5.6 s of a daemon
-                    // that answered nothing, on every restart. And with the retries
-                    // below, a migration that hangs held it up to 60 s per attempt.
-                    const { execFile } = await import('node:child_process');
-                    const { promisify } = await import('node:util');
-                    const running = promisify(execFile)(process.execPath, ['--import', 'tsx/esm', migrateScript], {
-                        cwd: path.join(projectPath, 'apps', dbName),
-                        env: {
-                            ...process.env,
-                            DATABASE_URL: `postgresql://${user}:${password}@localhost:${port}/${dbName}`,
-                            // App-specific env vars (various naming conventions)
-                            [`${dbName.toUpperCase()}__DATABASE__HOST`]: 'localhost',
-                            [`${dbName.toUpperCase()}__DATABASE__PORT`]: String(port),
-                            [`${dbName.toUpperCase()}__DATABASE__DATABASE`]: dbName,
-                            [`${dbName.toUpperCase()}__DATABASE__USER`]: user,
-                            [`${dbName.toUpperCase()}__DATABASE__PASSWORD`]: password,
-                        },
-                        timeout: 60_000,
-                        maxBuffer: 16 * 1024 * 1024,
-                    });
-                    // Nothing to read from us, as `stdio: 'ignore'` said before.
-                    running.child.stdin?.end();
-                    const { stdout } = await running;
-                    // What the migrations said, in order — see `migrationOutput`.
-                    for (const line of migrationOutput(String(stdout))) {
-                        this.logger.info({ database: dbName, line }, 'Migration said');
-                    }
-                    this.logger.info({ database: dbName, attempts: attempt }, 'Migrations applied');
-                    lastErr = null;
-                    break;
+                    await executeLocalMigration(target, { ...env, ...database.env }, { validate: true });
                 }
-                catch (err) {
-                    lastErr = err;
-                    const stderr = err.stderr?.toString?.()?.trim?.() ?? '';
-                    // Only retry on transient connection errors. Schema / SQL errors
-                    // are deterministic and won't go away by trying again.
-                    const transient = /ECONNREFUSED|ECONNRESET|ENOTCONN|terminat(ing|ed)|server closing|kysely.*Connection/i.test(stderr) ||
-                        /ECONNREFUSED|ECONNRESET/i.test(err.message ?? '');
-                    if (!transient || attempt >= maxAttempts) {
-                        this.logger.error({ database: dbName, attempt, error: err.message, stderr }, 'Migration failed — app may fail to start');
-                        break;
-                    }
-                    const delayMs = Math.min(1000 * 2 ** (attempt - 1), 16_000);
-                    this.logger.warn({ database: dbName, attempt, nextRetryInMs: delayMs, error: err.message }, 'Migration transient failure — retrying');
-                    await new Promise((r) => setTimeout(r, delayMs));
+                catch (error) {
+                    const failed = error;
+                    throw new Error(`Migration config refused for ${target.service}/${target.database} (${target.app}); no migrations executed: ${describeFailure(failed.stderr?.trim() || failed)}`, { cause: error });
                 }
             }
-            if (lastErr) {
-                // Already logged above; intentionally do NOT throw here so other
-                // databases can still attempt their migrations.
+        for (const { target, env, database } of targets) {
+            const { host, port, user, password, connectionString } = database;
+            this.logger.info({ project: projectName, stack: stackName, database: target.database, host, port }, 'Waiting for migration database');
+            await waitForPostgres(host, port, user, password, 180_000, connectionString);
+            // Database readiness may take minutes. Recheck the canonical payload and owner immediately before execution.
+            const [current] = await localMigrationTargets([target], appEntries, projectPath, verifyMigrations);
+            if (!current || !isDeepStrictEqual(current, target))
+                throw Error('Migration target changed during database readiness');
+            this.logger.info({ project: projectName, stack: stackName, database: target.database }, 'Running database migrations');
+            try {
+                const { stdout } = await executeLocalMigration(target, { ...env, ...database.env });
+                for (const line of migrationOutput(stdout))
+                    this.logger.info({ database: target.database, line: redactDiagnosticText(line) }, 'Migration said');
+                this.logger.info({ database: target.database, attempts: 1 }, 'Migrations applied');
+            }
+            catch (error) {
+                const failed = error;
+                this.logger.error({ database: target.database, error: redactDiagnosticText(failed.message), stderr: redactDiagnosticText(failed.stderr?.trim() ?? '') }, 'Migration failed — stack startup refused');
+                const reason = describeFailure(failed.stderr?.trim() || failed);
+                throw new Error(`Migration failed for ${projectName}/${stackName}/${target.service}/${target.database} (${target.app}); stack startup refused: ${reason}. Inspect the migration ledger before retrying.`, { cause: error });
             }
         }
     }
@@ -3216,10 +4302,13 @@ export class ProjectService extends EventEmitter {
      * Config stacks take precedence over user stacks with the same name.
      * No implicit fallbacks — stacks must be created explicitly.
      */
-    resolveStacks(config, projectName) {
+    resolveStacks(config, project) {
         const configStacks = config.stacks ?? {};
-        if (projectName) {
-            const userStacks = this.loadUserStacks(projectName);
+        if (project) {
+            const userStacks = typeof project === 'string' ? this.loadUserStacks(project)
+                : this.loadUserStacks(project.name, path.join(project.path, 'omnitron.stacks.json'));
+            // Saved topology intent is deliberately separate from executable configuration.
+            // A daemon restart, auto-resume or ordinary stack start must not admit a migration.
             return { ...userStacks, ...configStacks };
         }
         return configStacks;
@@ -3253,17 +4342,17 @@ export class ProjectService extends EventEmitter {
         const project = this.registry.get(projectName);
         const portAllocation = this.infraManager.getPortAllocation(projectName, stackName);
         const normalizedSvcs = this.infraManager.getNormalizedServices(projectName, stackName);
-        const resolvedStack = resolveStack(ecosystemConfig, projectName, stackName, stackConfig, appDefinitions, portAllocation ?? undefined, normalizedSvcs ?? undefined);
+        const resolvedStack = ownsStackInfrastructure(stackConfig) ? resolveStack(ecosystemConfig, projectName, stackName, stackConfig, appDefinitions, portAllocation ?? undefined, normalizedSvcs ?? undefined) : undefined;
         return (entry) => {
-            const appConfig = resolvedStack.appConfigs.get(entry.name);
+            const appConfig = resolvedStack?.appConfigs.get(entry.name);
             const infraEnv = appConfig ? resolvedConfigToEnv(appConfig, entry.name, stackName) : {};
             return {
                 ...entry,
                 name: ProjectService.handleKey(projectName, stackName, entry.name),
                 ...(entry.bootstrap && project
-                    ? { bootstrap: path.resolve(project.path, entry.bootstrap) }
+                    ? { bootstrap: resolveAppPath(project.path, entry, entry.bootstrap) }
                     : {}),
-                ...(project ? { cwd: project.path } : {}),
+                ...(project ? { cwd: resolveAppPath(project.path, entry) } : {}),
                 env: {
                     // Derived first, stated second. `infraEnv` is COMPUTED from the
                     // stack's configuration; `entry.env` is WRITTEN — by a developer
@@ -3304,39 +4393,35 @@ export class ProjectService extends EventEmitter {
      * its chain daemon, its cache — was invisible on that path. The local
      * path had it all along, twenty lines up from where it was needed.
      */
-    async loadAppDefinitions(projectName, stackConfig, ecosystemConfig) {
+    async loadAppDefinitions(projectName, stackConfig, ecosystemConfig, appEntries = this.resolveStackApps(stackConfig, ecosystemConfig), archived) {
         const appDefinitions = new Map();
-        const appEntries = this.resolveStackApps(stackConfig, ecosystemConfig);
         const project = this.registry.get(projectName);
         for (const entry of appEntries) {
+            if (entry.releaseFrom)
+                throw Error('Application ' + entry.name + ' requires a prepared and selected release before its prerequisites can be read');
             if (entry.bootstrap && project) {
                 try {
-                    const bootstrapAbsPath = path.resolve(project.path, entry.bootstrap);
-                    const { loadBootstrapConfig } = await import('../orchestrator/bootstrap-loader.js');
-                    const loaded = await loadBootstrapConfig(bootstrapAbsPath, { devMode: false });
+                    const bootstrapAbsPath = resolveAppPath(project.path, entry, entry.bootstrap);
+                    const { definition: loaded, metadata } = await readBootstrapMetadata(bootstrapAbsPath);
+                    this.bootstrapMetadata.save(metadata);
+                    // Preserve only declarative data across backend handoffs, never executable hooks.
+                    this.bootstrapTopology.set(bootstrapAbsPath, structuredClone({ ...(loaded.requires ? { requires: loaded.requires } : {}), ...(loaded.omnitronConfig ? { omnitronConfig: loaded.omnitronConfig } : {}) }));
                     // The app's `config/default.json`, read now and put on a COPY of
                     // the definition: the loaded one is the loader's cache entry, and
                     // writing to it made the first read the only one until the daemon
                     // restarted (`project/declared-config.ts`).
-                    const declared = readDeclaredConfig(bootstrapAbsPath);
-                    if (declared.malformed) {
-                        this.logger.error({ app: entry.name, configPath: declared.configPath, error: declared.malformed }, 'config/default.json does not parse — its `omnitron` section is being ignored');
-                    }
+                    const declared = archived ? archived.get(entry.name) : readDeclaredConfig(bootstrapAbsPath);
+                    if (!declared)
+                        throw Error('Missing admitted app declaration');
+                    if (declared.malformed)
+                        throw new Error(`Application configuration is invalid or unreadable: ${entry.name}`);
                     const definition = withDeclaredConfig(loaded, declared);
                     appDefinitions.set(entry.name, definition);
                 }
                 catch (err) {
-                    // An app can start without its definition; a STACK cannot be
-                    // provisioned without it. The definition is where an application
-                    // declares what it needs — its database, its cache, its chain
-                    // daemon — so a swallowed failure here does not degrade the
-                    // deployment, it silently removes a whole category from it.
-                    //
-                    // Measured: a remote stack reported `declared by apps: (none)` and
-                    // provisioned no infrastructure, because every bootstrap import
-                    // had failed in a process that could not load TypeScript. Nothing
-                    // said so at any level.
-                    this.logger.warn({ app: entry.name, bootstrap: entry.bootstrap, error: err.message }, 'Could not load this app\'s definition — anything it declares it needs will not be provisioned');
+                    this.bootstrapMetadata.fail(resolveAppPath(project.path, entry, entry.bootstrap), err);
+                    this.logger.error({ app: entry.name, bootstrap: entry.bootstrap }, 'Stack prerequisites unavailable; refusing incomplete provisioning');
+                    throw new Error(`Could not read declarations for ${entry.name}: ${publicLaunchFailure(err)}. Refresh declarations before starting.`, { cause: err });
                 }
             }
         }
@@ -3348,16 +4433,14 @@ export class ProjectService extends EventEmitter {
      * One entry per service name: two applications that both declare
      * `postgres` mean one Postgres, which is what `serviceOverrides` keys on
      * and what the container resolver has always assumed. A later declaration
-     * that disagrees with an earlier one is not merged silently — the first
-     * wins and the disagreement is said, because two applications wanting
-     * different versions of one service is a fact about the stack, not a
-     * detail to resolve by ordering.
+     * that disagrees with an earlier one refuses the plan; application ordering
+     * must not silently choose the configuration of a shared service.
      */
     async collectDeclaredServices(projectName, stackConfig, ecosystemConfig, 
     /** Keep the ones reached elsewhere too — to ask whether they answer, not to provision them. */
     options = {}) {
         const merged = {};
-        const definitions = await this.loadAppDefinitions(projectName, stackConfig, ecosystemConfig);
+        const definitions = options.definitions ?? await this.loadAppDefinitions(projectName, stackConfig, ecosystemConfig);
         for (const [appName, definition] of definitions) {
             const declared = definition.omnitronConfig?.infrastructure;
             if (!declared)
@@ -3371,7 +4454,8 @@ export class ProjectService extends EventEmitter {
                 if (provisioning === 'disabled' || (provisioning === 'external' && !options.external))
                     continue;
                 if (merged[name]) {
-                    this.logger.debug({ service: name, app: appName }, 'Service already declared by another app in this stack — the first declaration stands');
+                    if (!isDeepStrictEqual(merged[name], requirement))
+                        throw new Error(`Conflicting infrastructure declarations for ${name}; use one shared specification or distinct service names`);
                     continue;
                 }
                 merged[name] = requirement;
@@ -3379,6 +4463,114 @@ export class ProjectService extends EventEmitter {
         }
         return merged;
     }
+    localSelection(project, stack) {
+        const registration = this.registry.get(project);
+        if (!registration)
+            throw new Error('Project is not registered');
+        return new LocalReleaseSelection(this.daemonStateStore, { project, stack }, registration.registeredAt);
+    }
+    async installedEntries(project, stack, definition, config, release, prepare = false, requiredMigrations, migrationFiles) {
+        return (await this.installedRelease(project, stack, definition, config, release, prepare, requiredMigrations, migrationFiles)).entries;
+    }
+    async installedRelease(project, stack, definition, config, release, prepare = false, requiredMigrations, migrationFiles) {
+        const root = this.registry.get(project)?.path;
+        if (!root)
+            throw new Error('Project is not registered');
+        const { inspectLocalReleaseInstallation, inspectLocalReleasePayloads } = await import('../release/local-installation.js');
+        const stackEntries = this.resolveStackApps(definition, config);
+        // Validate the complete stack before narrowing executable verification to
+        // migration owners. Other applications still own their declared environment.
+        const env = await this.stackEnvFor(project, stack, definition, stackEntries.map(entry => entry.name));
+        const configured = stackEntries.filter(entry => !requiredMigrations || requiredMigrations.includes(entry.name));
+        const entries = configured.map(entry => ({
+            ...entry, env: { ...entry.env, ...env[entry.name] },
+            ...(!entry.releaseFrom || entry.cwd !== undefined ? { cwd: resolveAppPath(root, entry) } : {}),
+            ...(entry.bootstrap && { bootstrap: resolveAppPath(root, entry, entry.bootstrap) }),
+        }));
+        const ownerPid = this.orchestrator.getExecutionOwnerPid?.();
+        if (!ownerPid)
+            throw new Error('A verified local release requires a connected independent execution owner');
+        const ownerPackage = await this.orchestrator.getExecutionOwnerPackage?.();
+        if (!ownerPackage)
+            throw new Error('Verified runtime origin requires an independently verified execution-owner package');
+        const infrastructure = mergeInfrastructure(config, definition);
+        const payloads = artifactVolumeEntries(infrastructure, config.apps);
+        const roots = await inspectLocalReleasePayloads(release, payloads, prepare);
+        const resolved = await bindArtifactVolumes(infrastructure, roots);
+        const installed = await inspectLocalReleaseInstallation(release, stack, entries, { prepare, ownerPid, ownerPackage,
+            ...(requiredMigrations && { requiredFiles: migrationFiles ?? Object.fromEntries(requiredMigrations.map(app => [app, [COMPILED_MIGRATION_ENTRY]])) }),
+        });
+        const preparedArtifactVolumes = artifactVolumeBindings(infrastructure).map(([binding, value]) => {
+            const service = resolved?.services?.[value.service];
+            const mount = service && !('preset' in service) ? service.docker?.volumes?.[binding] : undefined;
+            const artifact = release.manifest.artifacts.find(item => item.app === value.app);
+            if (!mount || typeof mount === 'string' || mount.readonly !== true || !artifact)
+                throw Error('Verified artifact volume result is unavailable');
+            return { binding, ...value, source: mount.source, target: mount.target, readonly: true,
+                releaseId: release.id, manifestSha256: release.manifestSha256, artifactSha256: artifact.sha256 };
+        });
+        return { entries: installed, infrastructure: resolved, preparedArtifactVolumes };
+    }
+    /** All consumers of executable declarations must see the same physical entry as the owner. */
+    async launchEntries(project, stack, definition, config, requiredMigrations, migrationFiles) {
+        const selected = definition.type === 'local' && !definition.managedOrigin ? this.localSelection(project, stack).read().release : null;
+        if (!selected)
+            return this.resolveStackApps(definition, config);
+        const { loadRelease } = await import('../release/load.js');
+        const release = await loadRelease(selected.id, await this.releaseStore());
+        if (release.manifestSha256 !== selected.manifestSha256)
+            throw new Error('Selected release manifest changed on disk');
+        return this.installedEntries(project, stack, definition, config, release, false, requiredMigrations, migrationFiles);
+    }
+    async checkLocalOwner(project, stack, entries, changing, automatic = false) {
+        const plan = await this.orchestrator.inspectStackExecution({ project, stack });
+        await this.orchestrator.refreshObservation?.();
+        if (plan.phase === 'stopping' || plan.phase === 'starting')
+            throw new Error('Stack has an unfinished owner operation; inspect it before selecting a release');
+        const expected = new Map(entries.map(entry => [ProjectService.handleKey(project, stack, entry.name), entry]));
+        const retiring = plan.apps.filter(app => !expected.has(app.name));
+        if (retiring.length) {
+            if (this.orchestrator.getExecutionCapabilities?.()['stoppedStackReconciliation'] !== 1)
+                throw new Error('Execution owner does not support stopped stack reconciliation; prepare an owner upgrade with an application restart plan before changing stack membership.');
+            if (automatic)
+                throw new Error('Automatic resume cannot remove retained applications; explicitly stop and start the selected stack to reconcile its membership');
+        }
+        for (const app of plan.apps) {
+            const handle = this.orchestrator.getHandle(app.name);
+            const entry = expected.get(app.name);
+            if (!handle)
+                throw new Error('Owner observation changed; inspect the local stack before selecting a release: ' + app.name);
+            if (handle.status === 'stopped' && handle.pid === null)
+                continue;
+            if (retiring.length || changing || plan.phase === 'stopped' || !entry || !sameLaunchCode(handle.entry, entry))
+                throw new LocalReleaseStopRequired('Stop the applications of this local stack before changing launch code or membership: ' + app.name);
+        }
+        return plan;
+    }
+    /** The owner's durable stop fence covers the gap between the SQLite commit and the complete graph reconciliation. */
+    async prepareLocalOwner(project, stack, entries, changing, build, commit) {
+        let plan = await this.checkLocalOwner(project, stack, entries, changing);
+        const next = new Map(entries.map(entry => { const built = build(entry); return [built.name, built]; }));
+        const retiring = plan.apps.some(app => !next.has(app.name));
+        if ((changing || retiring) && plan.phase !== 'stopped') {
+            await this.orchestrator.stopStackExecution({ operationId: randomUUID(), plan });
+            plan = await this.orchestrator.inspectStackExecution({ project, stack });
+        }
+        commit();
+        if (changing || plan.phase === 'stopped') {
+            if (this.orchestrator.getExecutionCapabilities?.()['stoppedStackReconciliation'] === 1) {
+                await this.orchestrator.reconcileStoppedStack({ operationId: randomUUID(), plan, entries: [...next.values()] });
+            }
+            else {
+                // Existing owners can replace entries of an unchanged inventory only.
+                // checkLocalOwner refuses membership changes before committing a selection.
+                for (const { name } of plan.apps) {
+                    if (!await this.orchestrator.redefineApp(name, next.get(name)))
+                        throw new Error('Owner could not confirm the selected entry for ' + name + '; the stack remains fenced');
+                }
+            }
+        }
+    }
     resolveStackApps(stackConfig, ecosystemConfig) {
         const allApps = ecosystemConfig.apps.filter((a) => a.enabled !== false);
         if (!stackConfig.apps || stackConfig.apps === 'all') {
@@ -3386,25 +4578,15 @@ export class ProjectService extends EventEmitter {
         }
         return allApps.filter((a) => Array.isArray(stackConfig.apps) ? stackConfig.apps.includes(a.name) : true);
     }
+    markPriorStopSuperseded(project, stack, expectedStopId) {
+        this.daemonStateStore.kvUpdateSync(`stack:${project}/${stack}:last-stop`, prior => {
+            if (!prior || (expectedStopId && prior.id !== expectedStopId))
+                return prior;
+            return { ...prior, supersededAt: new Date().toISOString() };
+        });
+    }
     updateEnabledStacks(projectName, stackName, enabled) {
-        const project = this.registry.get(projectName);
-        if (!project)
-            return;
-        const enabledStacks = new Set(project.enabledStacks ?? []);
-        if (enabled) {
-            enabledStacks.add(stackName);
-        }
-        else {
-            enabledStacks.delete(stackName);
-        }
-        project.enabledStacks = [...enabledStacks];
-        // Persist to disk via registry
-        try {
-            this.registry.persist();
-        }
-        catch {
-            // Non-critical — runtime state is authoritative
-        }
+        this.registry.setStackEnabled(projectName, stackName, enabled);
     }
     toProjectInfo(project) {
         const config = this.configRegistry.get(project.name)?.config;
@@ -3438,12 +4620,25 @@ export class ProjectService extends EventEmitter {
      * deployment fails a script; and the console's stack page shows the same
      * six rows, stopped.
      *
-     * A node that cannot be asked leaves its apps exactly as they were, with a
-     * line saying why. "We could not ask" is not "they are down" — and the
-     * local rows are at least honest about being local.
+     * Each node retains its own observation. An unavailable source is unknown;
+     * a replica on another node cannot turn that missing observation into online.
      */
+    localHealthRead = null;
     async withRemoteAppStatuses(projectName, info) {
-        return (await this.askNodes(projectName, info)).info;
+        if (info.type !== 'local')
+            return (await this.askNodes(projectName, info)).info;
+        // Concurrent inventory consumers share one owner read; no stale health cache
+        // survives an application restart or silently becomes a green default.
+        const read = this.localHealthRead ??= Promise.resolve().then(() => this.orchestrator.getHealth())
+            .catch(() => null).finally(() => { if (this.localHealthRead === read)
+            this.localHealthRead = null; });
+        const health = await read;
+        // Re-read lifecycle after the asynchronous health observation.
+        const current = this.getStack(projectName, info.name);
+        const unchanged = new Set(info.apps.filter(a => current.apps.some(b => b.handleKey === a.handleKey &&
+            b.pid === a.pid && b.status === a.status && b.restarts === a.restarts)).map(a => a.handleKey));
+        const bound = health && Object.fromEntries(Object.entries(health).filter(([name]) => unchanged.has(name)));
+        return observeStackHealth(current, new Map([['local', bound]]), new Date().toISOString());
     }
     /**
      * The same question, with the count of nodes that answered it.
@@ -3457,85 +4652,46 @@ export class ProjectService extends EventEmitter {
     async askNodes(projectName, info) {
         if (info.type !== 'remote' && info.type !== 'cluster')
             return { info, answered: 0 };
-        const nodes = info.config.nodes ?? [];
-        if (nodes.length === 0 || !this.slaveConnector)
-            return { info, answered: 0 };
-        const reported = new Map();
-        let remoteInfra = null;
-        let answered = 0;
-        for (const node of nodes) {
-            try {
-                const status = (await this.slaveConnector.invokeOnSlave(node.host, node.port ?? 9700, 'OmnitronDaemon', 'status', []));
-                answered += 1;
-                // The containers are on the node too — `infraManager.getInstance`
-                // answers about THIS machine, where a remote stack has none, so the
-                // stack read "Infrastructure: not provisioned" beside a node running
-                // postgres, redis, minio, the gateway and tor.
-                remoteInfra ??= await this.remoteInfraStatus(projectName, info.name, node);
-                for (const app of status?.apps ?? []) {
-                    // The node names them `<project>/deployed/<app>`; the stack knows
-                    // them by the app's own name.
-                    const bare = app.name.includes('/') ? app.name.slice(app.name.lastIndexOf('/') + 1) : app.name;
-                    reported.set(bare, app);
-                }
-            }
-            catch (err) {
-                this.logger.warn({ project: projectName, stack: info.name, node: node.host, error: err.message }, 'Could not ask this node what it is running — its apps are reported as this master sees them');
-            }
-        }
-        if (answered === 0)
-            return { info, answered };
-        const apps = info.apps.map((app) => {
-            const running = reported.get(app.name);
-            if (!running)
-                return app;
+        const nodes = [...(info.config.nodes ?? [])];
+        // Keep the last actual runtime footprint visible if its source configuration changes.
+        // Unadmitted target plans are never evidence that a workload ran on a node.
+        for (const old of this.stackStates.get(`${projectName}/${info.name}`)?.config.nodes ?? [])
+            if (!nodes.some(node => node.host === old.host && (node.port ?? 9700) === (old.port ?? 9700)))
+                nodes.push({ ...old, apps: [] });
+        if (nodes.length === 0)
+            return { info: observeStackHealth(info, new Map(), new Date().toISOString()), answered: 0 };
+        if (!this.slaveConnector)
             return {
-                ...app,
-                handleKey: running.name,
-                status: running.status,
-                pid: running.pid,
-                instances: running.instances,
-                uptime: running.uptime,
-                restarts: running.restarts,
-                cpu: running.cpu,
-                memory: running.memory,
-                port: running.port ?? null,
+                info: observeStackHealth(observeStack(info, nodes.map(node => nodePlacement(projectName, info, node, null, null, new Date().toISOString()))), new Map(), new Date().toISOString()),
+                answered: 0,
             };
-        });
-        // The stack's own status is this master's memory of having started it,
-        // and a daemon restart forgets it — so a stack whose six applications
-        // are running on a node read `stopped` a minute after an upgrade. The
-        // apps are the fact here too.
-        const online = apps.filter((a) => a.status === 'online').length;
-        const status = online === apps.length && apps.length > 0
-            ? 'running'
-            : online > 0
-                ? 'degraded'
-                : info.status;
-        // And when the stack started is when its applications did: the
-        // longest-running one a node reports online. An uptime is a duration the
-        // node measured on its own clock, so taking it from this one needs no
-        // agreement between the two clocks.
-        const longest = apps.reduce((max, a) => (reported.has(a.name) && a.status === 'online' && a.uptime > max ? a.uptime : max), 0);
-        return {
-            info: {
-                ...info,
-                status,
-                infrastructure: remoteInfra ?? info.infrastructure,
-                apps,
-                startedAt: longest > 0 ? new Date(Date.now() - longest).toISOString() : null,
-                uptime: longest,
-            },
-            answered,
-        };
+        const health = new Map();
+        const placements = [];
+        // Bounded fan-out: one failed peer must not hide the other peers' inventory.
+        for (let offset = 0; offset < nodes.length; offset += 4) {
+            placements.push(...await Promise.all(nodes.slice(offset, offset + 4).map(async (node) => {
+                const [processAnswer, infrastructureAnswer, healthAnswer] = await Promise.allSettled([
+                    this.slaveConnector.invokeOnSlave(node.host, node.port ?? 9700, 'OmnitronDaemon', 'status', []),
+                    this.remoteInfraStatus(projectName, info.name, node),
+                    this.slaveConnector.invokeOnSlave(node.host, node.port ?? 9700, 'OmnitronDaemon', 'getHealth', [{}]),
+                ]);
+                const status = processAnswer.status === 'fulfilled'
+                    ? processAnswer.value : null;
+                const processes = status && Array.isArray(status.apps) ? status.apps : null;
+                const reading = healthAnswer.status === 'fulfilled' ? healthAnswer.value : null;
+                health.set(stackNodeKey(node.host, node.port), reading?.apps ?? null);
+                return nodePlacement(projectName, info, node, processes, infrastructureAnswer.status === 'fulfilled' ? infrastructureAnswer.value : null, new Date().toISOString());
+            })));
+        }
+        return { info: observeStackHealth(observeStack(info, placements), health, new Date().toISOString()), answered: placements.filter(node => node.appsObserved).length };
     }
     /**
      * One node's infrastructure, named the way the stack names it.
      *
      * The node's container names carry ITS prefix (`sample-test-postgres`), and
      * a reader wants the service — `postgres` — so the same stripping the
-     * local path does is done here. `null` when the node cannot answer or has
-     * no infrastructure of its own, which leaves the master's view in place.
+     * local path does is done here. `null` means the node could not answer;
+     * an empty inventory is an observed absence, never this master's inventory.
      */
     async remoteInfraStatus(projectName, stackName, node) {
         if (!this.slaveConnector)
@@ -3552,25 +4708,21 @@ export class ProjectService extends EventEmitter {
             const entries = state?.services
                 ? Object.entries(state.services)
                 : ((await this.slaveConnector.invokeOnSlave(node.host, node.port ?? 9700, 'OmnitronInfra', 'listContainers', [])) ?? [])
-                    .filter((c) => c.name.startsWith(prefix))
                     .map((c) => [c.name, c]);
-            if (entries.length === 0)
-                return null;
-            for (const [containerName, svc] of entries) {
+            const owned = entries.filter(([, service]) => service.project || service.stack
+                ? service.project === projectName && service.stack === stackName
+                : service.name.startsWith(prefix));
+            for (const [containerName, svc] of owned) {
                 const name = containerName.startsWith(prefix) ? containerName.slice(prefix.length) : containerName;
-                services[name] = {
-                    status: svc.status === 'running' ? 'running' : svc.error ? 'error' : 'stopped',
-                    containerName: svc.name,
-                    port: svc.ports ? Object.values(svc.ports)[0] ?? null : null,
-                };
+                services[name] = stackServiceObservation({ ...svc, service: svc.service ?? name });
             }
             // Without the node's own verdict, "ready" is what the containers say:
             // every one of them running.
-            const ready = state?.ready ?? Object.values(services).every((svc) => svc.status === 'running');
+            const ready = Object.values(services).every(svc => svc.status === 'running' && svc.health !== 'unhealthy' && svc.health !== 'starting' && !svc.error && (!svc.provisioning || svc.provisioning === 'ready'));
             return { ready, services };
         }
         catch (err) {
-            this.logger.warn({ project: projectName, stack: stackName, node: node.host, error: err.message }, 'Could not ask this node about its infrastructure — the stack shows this master\'s view');
+            this.logger.warn({ project: projectName, stack: stackName, node: node.host, error: err.message }, 'Node infrastructure inventory unavailable; placement state is unknown');
             return null;
         }
     }
@@ -3611,6 +4763,8 @@ export class ProjectService extends EventEmitter {
                     cpu: running.cpu,
                     memory: running.memory,
                     port: running.port ?? null,
+                    ...(running.generation !== undefined && { generation: running.generation }),
+                    ...(running.release && { release: running.release }),
                 };
             }
             // App is configured but not running
@@ -3640,6 +4794,8 @@ export class ProjectService extends EventEmitter {
                 cpu: running.cpu,
                 memory: running.memory,
                 port: running.port ?? null,
+                ...(running.generation !== undefined && { generation: running.generation }),
+                ...(running.release && { release: running.release }),
             });
         }
         // Populate real node connectivity from SlaveConnector
@@ -3684,11 +4840,7 @@ export class ProjectService extends EventEmitter {
                 const serviceName = containerName.startsWith(stackPrefix)
                     ? containerName.slice(stackPrefix.length)
                     : containerName;
-                infraServices[serviceName] = {
-                    status: svcState.status === 'running' ? 'running' : svcState.error ? 'error' : 'stopped',
-                    containerName: svcState.name,
-                    port: svcState.ports ? Object.values(svcState.ports)[0] ?? null : null,
-                };
+                infraServices[serviceName] = stackServiceObservation(svcState);
             }
         }
         const infrastructure = {
@@ -3704,10 +4856,35 @@ export class ProjectService extends EventEmitter {
         // restart). It is reported as what it is.
         const onNodes = config.type === 'remote' || config.type === 'cluster';
         const since = state?.startedAt ?? null;
+        let status = state?.status ?? 'stopped';
+        const notUp = [];
+        if (!onNodes && (status === 'running' || (since !== null && (status === 'degraded' || status === 'error')))) {
+            const down = apps.filter(app => app.status !== 'online');
+            for (const app of down) {
+                const errors = state?.appStartErrors;
+                const reason = errors && Object.hasOwn(errors, app.name) ? errors[app.name] : undefined;
+                notUp.push(`${app.name} (${app.status})${reason ? ': ' + reason : ''}`);
+            }
+            if (!infrastructure.ready && (state?.infrastructureStartFailed || state?.infraService?.getDesiredServices().length)) {
+                notUp.push('infrastructure: required services are not ready (see daemon log)');
+            }
+            if (notUp.length === 0)
+                status = 'running';
+            else if (down.length < apps.length || down.some(app => app.status === 'starting') ||
+                (apps.length === 0 && Object.values(infrastructure.services).some(service => service.status === 'running')))
+                status = 'degraded';
+            else
+                status = 'error';
+        }
+        const selectedRelease = config.type === 'local' && !config.managedOrigin ? this.localSelection(projectName, stackName).read().release : null;
         return {
             name: stackName,
             type: config.type,
-            status: state?.status ?? 'stopped',
+            ...(selectedRelease && { selectedRelease }),
+            status,
+            ...(notUp.length > 0 && { notUp }),
+            resumeOperation: this.daemonStateStore.kvGetSync(`stack:${stateKey}:last-resume`, { strict: true }) ?? undefined,
+            stopOperation: this.daemonStateStore.kvGetSync(`stack:${projectName}/${stackName}:last-stop`, { strict: true }) ?? undefined,
             config,
             nodes,
             apps,
@@ -3719,6 +4896,138 @@ export class ProjectService extends EventEmitter {
         };
     }
 }
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", void 0)
+], ProjectService.prototype, "executeNodeInstalledResume", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String]),
+    __metadata("design:returntype", Promise)
+], ProjectService.prototype, "resumeInstalledStack", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ProjectService.prototype, "prepareNodeStackStop", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ProjectService.prototype, "executeNodeStackStop", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ProjectService.prototype, "importProjectConfiguration", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ProjectService.prototype, "detachProjectConfiguration", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String]),
+    __metadata("design:returntype", Promise)
+], ProjectService.prototype, "addProject", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], ProjectService.prototype, "rereadProject", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String]),
+    __metadata("design:returntype", Promise)
+], ProjectService.prototype, "refreshInfrastructureOwnership", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Object)
+], ProjectService.prototype, "updateProject", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", void 0)
+], ProjectService.prototype, "removeProject", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], ProjectService.prototype, "createStack", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String]),
+    __metadata("design:returntype", Promise)
+], ProjectService.prototype, "deleteStack", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ProjectService.prototype, "saveTopologyDraft", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ProjectService.prototype, "planTopology", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ProjectService.prototype, "applyTopologyPlan", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], ProjectService.prototype, "refreshTopologyMetadata", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, Object]),
+    __metadata("design:returntype", Promise)
+], ProjectService.prototype, "startStack", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, String, Object]),
+    __metadata("design:returntype", Promise)
+], ProjectService.prototype, "stopStack", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], ProjectService.prototype, "reconcileEnabledStacks", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], ProjectService.prototype, "loadProjectConfig", null);
+__decorate([
+    RecoveryMutation(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], ProjectService.prototype, "reloadConfig", null);
 /**
  * How a master's daemon builds this service: the tokens it resolves, in
  * order, and the factory that receives them.