@omnitron-dev/omnitron 0.3.3 → 0.4.6

package/dist/services/project.service.js

@@ -8,8 +8,12 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 import { readProjectStacks, resolveProjectStacks } from '../config/project-stacks.js';
+import { readSavedDaemonConfig } from '../config/saved.js';
 import { observeStackHealth } from '../project/stack-health.js';
 import { LocalReleaseSelection } from '../project/local-release-selection.js';
+import { assertResidentApplicationRuntime, assertSameApplicationRuntime } from './host-upgrade.js';
+import { assertReleaseLoaderEnvironment, assertReleaseTarget, releaseOptionsForEnv } from '../release/target-runtime.js';
+import { withClosureLibraryPath } from '../release/closure-library-path.js';
 import { resolveAppPath } from '../config/app-path.js';
 import { infrastructureOwnership, ownsStackInfrastructure } from '../project/infrastructure-ownership.js';
 import { InstalledStackResume, resumeDestinations } from '../project/installed-stack-resume.js';
@@ -17,7 +21,7 @@ import { isDeepStrictEqual } from 'node:util';
 import { diagnoseContainers } from '../project/stack-diagnosis.js';
 import { diagnosisStatus } from '../shared/dto/stack-diagnosis.js';
 import { buildInfraFromRequirements, requirementsFromDefinitions } from '../project/requirements-scanner.js';
-import { randomUUID } from 'node:crypto';
+import { randomUUID, createHash } from 'node:crypto';
 import { NodeStackStop, stackDefinitionFingerprint } from '../project/node-stack-stop.js';
 import { stackStopReview } from '../project/stack-stop-review.js';
 import { inspectStackContainers, removeContainer } from '../infrastructure/container-runtime.js';
@@ -141,7 +145,7 @@ export class ProjectService extends EventEmitter {
     recoveryRegistryDigest() { return this.registry.recoveryDigest(); }
     /** Read-only bookkeeping; no timers are stopped and no Docker call runs. */
     captureRecoveryState() {
-        if (this.rereading?.size || this.ownershipFrozen || this.resumingInstalled || this.startsInFlight.size || this.stopsInFlight.size || this.nodeStackStop.busy || this.reconcilingStacks ||
+        if (this.incomingReleases?.size || this.rereading?.size || this.ownershipFrozen || this.resumingInstalled || this.startsInFlight.size || this.stopsInFlight.size || this.nodeStackStop.busy || this.reconcilingStacks ||
             [...this.stackStates.values()].some(state => state.status === 'starting' || state.status === 'stopping')) {
             throw new RecoveryBusyError('Project ownership is changing; a recovery snapshot is not ready');
         }
@@ -157,7 +161,7 @@ export class ProjectService extends EventEmitter {
     }
     /** Capture controllers' bookkeeping, retaining native application ownership in the execution host. */
     async prepareHandoff() {
-        if (this.rereading?.size || this.ownershipFrozen || this.resumingInstalled || this.startsInFlight.size || this.stopsInFlight.size || this.nodeStackStop.busy || this.reconcilingStacks || [...this.stackStates.values()].some(state => state.status === 'starting' || state.status === 'stopping')) {
+        if (this.incomingReleases?.size || this.rereading?.size || this.ownershipFrozen || this.resumingInstalled || this.startsInFlight.size || this.stopsInFlight.size || this.nodeStackStop.busy || this.reconcilingStacks || [...this.stackStates.values()].some(state => state.status === 'starting' || state.status === 'stopping')) {
             throw new Error('A stack lifecycle operation is active; finish it before transferring the backend');
         }
         this.handoffReconciling = this.resumeTimer !== null;
@@ -244,6 +248,7 @@ export class ProjectService extends EventEmitter {
         this.daemonStateStore = daemonStateStore;
         this.syncService = options.syncService;
         this.secrets = options.secrets;
+        this.receiveRelease = options.receiveRelease;
         this.audit = options.audit;
         // T-7 — registry persistence routed through DaemonStateStore
         // (SQLite, transactional, co-located with daemon-state-kv,
@@ -270,7 +275,18 @@ export class ProjectService extends EventEmitter {
             execution: orchestrator,
             definition: (scope, cached) => this.stopDefinition(scope, cached),
             containers: scope => inspectStackContainers(scope),
-            disableResume: scope => this.registry.setStackEnabled(scope.project, scope.stack, false),
+            disableResume: (scope, keep) => {
+                if (keep)
+                    this.setInfrastructurePolicy(scope.project, scope.stack, null);
+                this.registry.setStackEnabled(scope.project, scope.stack, false);
+            },
+            holdInfrastructure: async (scope) => {
+                await this.drainHostedProvisioning(scope);
+                const hosted = this.hostedInfrastructure();
+                if (hosted?.representsStack(scope))
+                    await hosted.holdForPreservation();
+                await this.infraManager.getInstance(scope.project, scope.stack)?.holdForPreservation();
+            },
             retireInfrastructure: async (scope) => {
                 await this.drainHostedProvisioning(scope);
                 await this.hostedInfrastructure()?.retireStack(scope);
@@ -1315,15 +1331,15 @@ export class ProjectService extends EventEmitter {
                 continue;
             for (const app of await this.launchEntries(scope.project, name, stack, config))
                 if (app.bootstrap)
-                    bootstraps.set(resolveAppPath(directory, app, app.bootstrap), app.name);
+                    bootstraps.set(resolveAppPath(directory, app, app.bootstrap), { app: app.name, ...(app.releaseRoot && { releaseRoot: app.releaseRoot }) });
         }
         const result = { refreshed: 0, failures: [] };
-        for (const [bootstrap, app] of bootstraps) {
+        for (const [bootstrap, { app, releaseRoot }] of bootstraps) {
             try {
                 const remaining = Math.min(30_000, deadline - Date.now());
                 if (remaining <= 0)
                     throw new Error('Declaration refresh deadline exceeded; this application was not read');
-                const { metadata: record } = await readBootstrapMetadata(bootstrap, false, remaining);
+                const { metadata: record } = await readBootstrapMetadata(bootstrap, false, remaining, releaseRoot);
                 this.bootstrapMetadata.save(record);
                 this.bootstrapTopology.set(bootstrap, record.definition);
                 result.refreshed += 1;
@@ -1383,6 +1399,109 @@ export class ProjectService extends EventEmitter {
      */
     rereading;
     startsInFlight = new Map();
+    infrastructurePolicyKey(project, stack) {
+        const registration = this.registry.get(project);
+        if (!registration?.registeredAt)
+            throw Error('Infrastructure authority requires a project registration');
+        return `lifecycle:infrastructure:${stackExecutionKey({ project, stack })}:${registration.registeredAt}`;
+    }
+    infrastructurePolicy(project, stack) {
+        const value = this.daemonStateStore.kvGetSync(this.infrastructurePolicyKey(project, stack), { strict: true });
+        if (value && (value.mode !== 'preserve' || (value.review !== null && !/^[a-f0-9]{64}$/.test(value.review))))
+            throw Error('Invalid retained infrastructure authority');
+        return value;
+    }
+    setInfrastructurePolicy(project, stack, review, reconcile = false) {
+        this.daemonStateStore.kvUpdateSync(this.infrastructurePolicyKey(project, stack), () => reconcile ? null : { mode: 'preserve', review });
+    }
+    /** Read declarations without importing application code or executing startup hooks. */
+    preservationDefinitions(project, stack, entries) {
+        const root = this.registry.get(project)?.path;
+        if (!root)
+            throw Error('Project is not registered');
+        const definitions = new Map();
+        for (const entry of entries) {
+            if (entry.releaseFrom)
+                throw Error('Preservation requires a prepared release installation');
+            if (!entry.bootstrap)
+                continue;
+            const bootstrap = resolveAppPath(root, entry, entry.bootstrap);
+            const { metadata, declared, state, record } = this.readAppDeclaration(project, stack, entry.name, bootstrap);
+            if (declared.malformed || !metadata || !record || state?.failure || metadataSourceChanged(record))
+                throw Error('Current application declarations must be captured before reviewing infrastructure preservation');
+            definitions.set(entry.name, withDeclaredConfig({ name: entry.name, version: '', processes: [], ...metadata }, declared));
+        }
+        return definitions;
+    }
+    /** Shared lifecycle preflight. No release installation, bootstrap import, provisioning or database effects. */
+    async reviewStackStart(project, stackName, options = {}) {
+        if (options.infrastructure !== undefined && options.infrastructure !== 'preserve')
+            throw Error('Start review requires infrastructure=preserve');
+        if (options.workingTree && options.release)
+            throw Error('Select either a release or the working tree');
+        const report = { protocol: 1, project, stack: stackName, infrastructure: 'preserve', checkedAt: new Date().toISOString(),
+            digest: null, targets: [], deferred: ['Application startup and application health; framework setup and migrations are forbidden in preserve mode'] };
+        try {
+            const config = this.getLoadedConfig(project);
+            if (!config)
+                throw Error('Project configuration is not loaded');
+            const stack = this.resolveStacks(config, project)[stackName];
+            if (!stack)
+                throw Error('Stack is not declared');
+            this.assertStartAuthority({ project, stack: stackName }, stack);
+            const local = stack.type === 'local' && !stack.managedOrigin;
+            const prior = local ? this.localSelection(project, stackName).read().release : null;
+            const id = options.release ?? (options.workingTree ? undefined : prior?.id);
+            report.selection = id ? { release: id } : { workingTree: true };
+            const release = id ? await this.admitRelease(project, stackName, stack, config, id) : null;
+            if (!release && stack.release?.mode === 'required')
+                throw Error('A verified release is required');
+            if (release && prior && prior.id === id && prior.manifestSha256 !== release.manifestSha256)
+                throw Error('Selected release changed');
+            const installation = local && release ? await this.installedRelease(project, stackName, stack, config, release, false) : undefined;
+            const entries = installation?.entries ?? this.resolveStackApps(stack, config);
+            resolveStartupOrder(entries);
+            const definitions = release?.remoteDefinitions ?? this.preservationDefinitions(project, stackName, entries);
+            const environment = await this.stackEnvFor(project, stackName, stack, entries.map(entry => entry.name));
+            const effective = mergeInferredInfrastructure(buildInfraFromRequirements(requirementsFromDefinitions(definitions)), installation?.infrastructure ?? mergeInfrastructure(config, stack));
+            const normalized = normalizeInfraConfig(effective ?? {}, createDefaultRegistry());
+            const requirements = { ...normalized };
+            for (const definition of definitions.values())
+                Object.assign(requirements, definition.omnitronConfig?.infrastructure);
+            if (Object.entries(requirements).some(([name, requirement]) => {
+                const binding = bindService(requirement, stack.serviceOverrides?.[name]);
+                return binding.provisioning === 'bareMetal' || binding.provisioning === 'none';
+            }))
+                throw Error('This infrastructure resource has no verifiable native preservation identity');
+            if (stack.type === 'local') {
+                const infrastructure = await this.infraManager.reviewPreservation(project, stackName, stack, effective ?? {}, definitions, this.registry.get(project).path);
+                report.targets.push({ node: 'local', infrastructure });
+            }
+            else {
+                const services = await this.collectDeclaredServices(project, stack, config, { definitions });
+                for (const { node } of resolveNodePlacements(stack, entries)) {
+                    const infrastructure = await this.reviewNodeInfrastructure(node, mergeInfrastructure(config, stack) ?? {}, services, { project, stack: stackName, overrides: await this.resolveOverrideSecrets(project, stack.serviceOverrides) }, this.registry.get(project).path, release?.staticsDir ?? undefined);
+                    report.targets.push({ node: stackNodeKey(node.host, node.port ?? 9700), infrastructure });
+                }
+            }
+            // Bind launch bytes as well as declarations; release installation verification binds the full payload closure.
+            const launch = stack.type === 'local' ? entries.map(entry => {
+                const script = entry.bootstrap ?? entry.script;
+                return script ? [entry.name, createHash('sha256').update(fs.readFileSync(resolveAppPath(this.registry.get(project).path, entry, script))).digest('hex')] : [entry.name];
+            }) : [];
+            if (report.targets.length && report.targets.every(target => target.infrastructure?.digest))
+                report.digest = stackDefinitionFingerprint([
+                    'omnitron/stack-start/preserve/v1', { project, stack: stackName }, this.registry.get(project).registeredAt,
+                    stack, entries, [...definitions], environment, release?.manifestSha256 ?? null, launch,
+                    report.targets.map(target => [target.node, target.infrastructure.digest]),
+                ]);
+        }
+        catch {
+            // Source errors may contain credential values. Evidence contains only reviewed fingerprints and controlled diagnostics.
+            report.targets.push({ node: 'preflight', reason: 'Complete launch and infrastructure preservation could not be verified. Check release preparation, current declarations and recipient capability.' });
+        }
+        return report;
+    }
     async startStack(projectName, stackName, opts) {
         if (this.resumingInstalled)
             throw new Error('An installed allocation is resuming');
@@ -1395,7 +1514,19 @@ export class ProjectService extends EventEmitter {
             throw new Error('Project definitions are being updated; retry the start');
         if (opts?.workingTree && opts.release)
             throw new Error('Select either a release or the working tree');
-        const selection = JSON.stringify([opts?.release, opts?.workingTree === true, opts?.reinstall === true]);
+        if (opts?.infrastructure !== undefined && !['reconcile', 'preserve'].includes(opts.infrastructure))
+            throw Error('Invalid infrastructure start mode');
+        const policy = this.infrastructurePolicy(projectName, stackName);
+        if (policy && opts?.infrastructure === 'reconcile' && (opts.source === 'boot' || opts.source === 'auto-resume'))
+            throw Error('Automatic starts cannot expand preserved infrastructure authority');
+        const mode = opts?.infrastructure ?? policy?.mode ?? 'reconcile';
+        const review = opts?.review ?? (mode === 'preserve' ? policy?.review : undefined);
+        if (mode === 'preserve' && (!review || !/^[a-f0-9]{64}$/.test(review)))
+            throw Error('Preserved infrastructure requires a successful stack start review; inspect --dry-run --infrastructure preserve');
+        if (opts?.review && mode !== 'preserve')
+            throw Error('A preservation review cannot authorize reconciliation');
+        const infrastructure = { mode, review: review ?? undefined, explicitReconcile: opts?.infrastructure === 'reconcile' };
+        const selection = JSON.stringify([opts?.release, opts?.workingTree === true, opts?.reinstall === true, infrastructure]);
         const running = this.startsInFlight.get(inFlightKey);
         if (running) {
             this.logger.info({ project: projectName, stack: stackName }, 'This stack is already being started — joining the run in progress');
@@ -1403,7 +1534,7 @@ export class ProjectService extends EventEmitter {
                 throw new Error('Another stack start selected different launch code; retry after it completes');
             return running.promise;
         }
-        const started = this.startStackOnce(projectName, stackName, opts?.source ?? 'unknown', opts?.allowDirty === true, opts?.release, opts?.reinstall === true, opts?.workingTree === true).finally(() => {
+        const started = this.startStackOnce(projectName, stackName, opts?.source ?? 'unknown', opts?.allowDirty === true, opts?.release, opts?.reinstall === true, opts?.workingTree === true, infrastructure).finally(() => {
             this.startsInFlight.delete(inFlightKey);
         });
         this.startsInFlight.set(inFlightKey, { selection, promise: started });
@@ -1434,10 +1565,10 @@ export class ProjectService extends EventEmitter {
      * deploys nothing, and the reconciler re-asks a node that does not answer
      * every few minutes — rows about looking, not about changing anything.
      */
-    async startStackOnce(projectName, stackName, source, allowDirty, releaseId, reinstall = false, workingTree = false) {
+    async startStackOnce(projectName, stackName, source, allowDirty, releaseId, reinstall = false, workingTree = false, infrastructure) {
         const known = { attach: false };
         try {
-            return await this.runStackStart(projectName, stackName, source, allowDirty, releaseId, known, reinstall, workingTree);
+            return await this.runStackStart(projectName, stackName, source, allowDirty, releaseId, known, reinstall, workingTree, infrastructure);
         }
         catch (err) {
             if (!known.attach) {
@@ -1449,6 +1580,8 @@ export class ProjectService extends EventEmitter {
                     error: err,
                     details: {
                         source,
+                        ...(infrastructure?.mode === 'preserve' ? { infrastructureMode: 'preserve', review: infrastructure.review }
+                            : infrastructure?.explicitReconcile ? { infrastructureMode: 'reconcile' } : {}),
                         ...(known.type ? { type: known.type } : {}),
                         ...((releaseId ?? known.release) ? { release: releaseId ?? known.release } : {}),
                         ...(known.commit !== undefined ? { commit: known.commit } : {}),
@@ -1458,8 +1591,10 @@ export class ProjectService extends EventEmitter {
             throw err;
         }
     }
-    async runStackStart(projectName, stackName, source, allowDirty, releaseId, known, reinstall = false, workingTree = false) {
-        const config = await this.loadProjectConfig(projectName);
+    async runStackStart(projectName, stackName, source, allowDirty, releaseId, known, reinstall = false, workingTree = false, infrastructure) {
+        const config = infrastructure?.mode === 'preserve' ? this.getLoadedConfig(projectName) : await this.loadProjectConfig(projectName);
+        if (!config)
+            throw Error('Project configuration must be loaded before preservation');
         const stacks = this.resolveStacks(config, projectName);
         const stackConfig = stacks[stackName];
         if (!stackConfig)
@@ -1473,6 +1608,13 @@ export class ProjectService extends EventEmitter {
             return this.attachRemoteStack(projectName, stackName, stackConfig, source);
         }
         this.assertStartAuthority({ project: projectName, stack: stackName }, stackConfig);
+        let preservation;
+        if (infrastructure?.mode === 'preserve') {
+            preservation = await this.reviewStackStart(projectName, stackName, { infrastructure: 'preserve', ...(releaseId && { release: releaseId }), ...(workingTree && { workingTree: true }) });
+            if (!preservation.digest || preservation.digest !== infrastructure.review)
+                throw Error('Stack launch or native infrastructure changed since review; no startup effects were admitted');
+            this.setInfrastructurePolicy(projectName, stackName, preservation.digest);
+        }
         // A release, when one is named — and a stack that takes nothing else.
         const local = stackConfig.type === 'local' && !stackConfig.managedOrigin;
         if ((workingTree || (releaseId && stackConfig.type === 'local')) && !local)
@@ -1483,6 +1625,8 @@ export class ProjectService extends EventEmitter {
         let release = null;
         if (requested) {
             known.release = requested;
+            if (this.receiveRelease && releaseId && source === 'operator')
+                await this.fetchMissingRelease(releaseId);
             release = await this.admitRelease(projectName, stackName, stackConfig, config, requested);
             if (prior?.release?.id === requested && prior.release.manifestSha256 !== release.manifestSha256)
                 throw new Error('The selected release manifest changed on disk; restore its original bytes');
@@ -1564,8 +1708,8 @@ export class ProjectService extends EventEmitter {
         if (mounted.length && (!local || !release || !ownsStackInfrastructure(stackConfig)))
             throw Error('Artifact volumes require a selected release on an independently owned local stack');
         const installation = mounted.length && release
-            ? await this.installedRelease(projectName, stackName, stackConfig, config, release, true) : undefined;
-        const entries = installation?.entries ?? (local && release ? await this.installedEntries(projectName, stackName, stackConfig, config, release, true) : undefined);
+            ? await this.installedRelease(projectName, stackName, stackConfig, config, release, !preservation) : undefined;
+        const entries = installation?.entries ?? (local && release ? await this.installedEntries(projectName, stackName, stackConfig, config, release, !preservation) : undefined);
         let localMembershipChanged = false;
         if (local) {
             const target = entries ?? this.resolveStackApps(stackConfig, config);
@@ -1609,7 +1753,7 @@ export class ProjectService extends EventEmitter {
             // wrapper returns the info untouched.
             const current = await this.withRemoteAppStatuses(projectName, this.toStackInfo(projectName, stackName, stackConfig));
             const down = current.apps.filter((a) => a.status !== 'online');
-            if (down.length === 0 && !current.notUp?.length) {
+            if (down.length === 0 && !current.notUp?.length && !preservation && !infrastructure?.explicitReconcile) {
                 if (existing)
                     existing.status = 'running';
                 this.logger.warn({ project: projectName, stack: stackName }, 'Stack already running');
@@ -1657,20 +1801,22 @@ export class ProjectService extends EventEmitter {
                         if (changing && plan.phase !== 'stopped')
                             throw new LocalReleaseStopRequired('Artifact volume selection requires the owner stop fence');
                         return (await this.installedRelease(projectName, stackName, stackConfig, config, release, false)).infrastructure;
-                    } : undefined);
+                    } : undefined, preservation, infrastructure?.explicitReconcile);
                 }
                 else {
-                    await this.startLocalStack(projectName, stackName, stackConfig, config, undefined, async () => { await enable(); });
+                    await this.startLocalStack(projectName, stackName, stackConfig, config, undefined, async () => { await enable(); }, undefined, undefined, preservation, infrastructure?.explicitReconcile);
                 }
             }
             else {
                 this.rememberStackTargets(projectName, stackName, stackConfig, config);
-                reach = await this.startRemoteStack(projectName, stackName, stackConfig, config, release, reinstall);
+                reach = await this.startRemoteStack(projectName, stackName, stackConfig, config, release, reinstall, preservation, infrastructure?.explicitReconcile);
             }
             state.status = 'running';
             state.startedAt = Date.now();
             // Update registry with enabled stack
             this.updateEnabledStacks(projectName, stackName, true);
+            if (infrastructure?.explicitReconcile)
+                this.setInfrastructurePolicy(projectName, stackName, null, true);
             this.markPriorStopSuperseded(projectName, stackName);
             const info = this.toStackInfo(projectName, stackName, stackConfig);
             // What did not come up, said in the row. A boot at 12:14 UTC on
@@ -1722,6 +1868,8 @@ export class ProjectService extends EventEmitter {
                     apps: info.apps.length,
                     ...(notUp.length > 0 ? { notUp: notUp.join(', ') } : {}),
                     source,
+                    ...(preservation ? { infrastructureMode: 'preserve', review: preservation.digest }
+                        : infrastructure?.explicitReconcile ? { infrastructureMode: 'reconcile' } : {}),
                     ...(reach ? { nodes: reach.nodes, reached: reach.reached } : {}),
                     ...(reach && reach.skipped.length > 0 ? { skipped: reach.skipped } : {}),
                     ...(reach && (reach.notReady?.length ?? 0) > 0 ? { notReady: reach.notReady } : {}),
@@ -1962,6 +2110,8 @@ export class ProjectService extends EventEmitter {
             if (cluster)
                 await cluster.election.confirmStopAuthority();
             this.updateEnabledStacks(projectName, stackName, false);
+            if (keepInfrastructure)
+                this.setInfrastructurePolicy(projectName, stackName, null);
             progress.phase = 'stopping';
             progress.intentCommitted = true;
             persist();
@@ -1976,13 +2126,18 @@ export class ProjectService extends EventEmitter {
                 }
             }
             else if (localPlan && localInventory) {
-                await this.orchestrator.stopStackExecution({ operationId: progress.id, plan: localPlan });
-                if (keepInfrastructure) {
+                const verifyRetained = async () => {
                     const retained = await this.infraManager.inspectStopContainers(projectName, stackName);
-                    if (!isDeepStrictEqual([...retained].sort((a, b) => a.id.localeCompare(b.id)), [...localInventory.containers].sort((a, b) => a.id.localeCompare(b.id)))) {
+                    if (!isDeepStrictEqual([...retained].sort((a, b) => a.id.localeCompare(b.id)), [...localInventory.containers].sort((a, b) => a.id.localeCompare(b.id))))
                         throw new Error('Retained stack infrastructure changed; inspect before confirming this application stop');
-                    }
+                };
+                if (keepInfrastructure) {
+                    await this.infraManager.getInstance(projectName, stackName)?.holdForPreservation();
+                    await verifyRetained();
                 }
+                await this.orchestrator.stopStackExecution({ operationId: progress.id, plan: localPlan });
+                if (keepInfrastructure)
+                    await verifyRetained();
                 else
                     await this.infraManager.teardownStack(projectName, stackName, localInventory.containers);
             }
@@ -2112,6 +2267,32 @@ export class ProjectService extends EventEmitter {
         const { releasesRoot } = await import('../release/load.js');
         return releasesRoot();
     }
+    receiveRelease;
+    incomingReleases = new Map();
+    /** A failed or unfinished local build owns its directory; a pull must never replace it. */
+    async fetchMissingRelease(id) {
+        if (!this.receiveRelease)
+            return;
+        const { assertReleaseId } = await import('../release/load.js');
+        assertReleaseId(id);
+        const root = await this.releaseStore();
+        try {
+            await fs.promises.lstat(path.join(root, id));
+            return;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        let operation = this.incomingReleases.get(id);
+        if (!operation) {
+            if (this.ownershipFrozen)
+                throw new RecoveryBusyError('Release transfer must wait for the backend handoff');
+            operation = this.receiveRelease(id, root).finally(() => this.incomingReleases.delete(id));
+            this.incomingReleases.set(id, operation);
+        }
+        await operation;
+    }
     /** Explicit disk inspection: never performed by polling and never alters launch evidence. */
     async inspectInstalledArtifacts(project, stack, catalogProject) {
         const { inspectInstalledArtifacts } = await import('../release/installed-artifacts.js');
@@ -2205,8 +2386,8 @@ export class ProjectService extends EventEmitter {
             if (!stackConfig)
                 throw new Error(`Stack '${stackName}' not found in project '${projectName}'`);
             this.assertStartAuthority({ project: projectName, stack: stackName }, stackConfig);
-            if (prepare && stackConfig.type !== 'local')
-                throw new Error('Preparing a local release requires a local stack');
+            if (prepare && this.receiveRelease)
+                await this.fetchMissingRelease(releaseId);
             const release = await this.admitRelease(projectName, stackName, stackConfig, config, releaseId, 'check');
             let retiring = [];
             if (stackConfig.type === 'local') {
@@ -2237,6 +2418,12 @@ export class ProjectService extends EventEmitter {
         }
         catch (err) {
             const { LocalReleaseNotPreparedError } = await import('../release/local-installation.js');
+            const { MissingReleaseError } = await import('../release/load.js');
+            if (!prepare && this.receiveRelease && err instanceof MissingReleaseError) {
+                return {
+                    ok: false, state: 'missing', because: `Release ${releaseId} is absent from this controller. Fetch it from the configured release store and check target admission.`,
+                };
+            }
             return { ok: false, because: err.message,
                 ...(err instanceof LocalReleaseNotPreparedError && { state: 'unprepared' }),
                 ...(err instanceof LocalReleaseStopRequired && { state: 'requires-stop',
@@ -3262,7 +3449,7 @@ export class ProjectService extends EventEmitter {
     // ===========================================================================
     // Private — Stack Launchers
     // ===========================================================================
-    async startLocalStack(projectName, stackName, stackConfig, ecosystemConfig, selectedEntries, enable, verifyMigrations, verifyArtifactInfrastructure) {
+    async startLocalStack(projectName, stackName, stackConfig, ecosystemConfig, selectedEntries, enable, verifyMigrations, verifyArtifactInfrastructure, preservation, reconcile = false) {
         const ownsInfrastructure = ownsStackInfrastructure(stackConfig);
         const stateKey = `${projectName}/${stackName}`;
         const state = this.stackStates.get(stateKey);
@@ -3273,7 +3460,8 @@ export class ProjectService extends EventEmitter {
         // start here (project/stack-env.ts).
         const stackEnv = await this.stackEnvFor(projectName, stackName, stackConfig, appEntries.map((e) => e.name));
         const project = this.registry.get(projectName);
-        const appDefinitions = await this.loadAppDefinitions(projectName, stackConfig, ecosystemConfig, appEntries);
+        const appDefinitions = preservation ? this.preservationDefinitions(projectName, stackName, appEntries)
+            : await this.loadAppDefinitions(projectName, stackConfig, ecosystemConfig, appEntries);
         // 2. Provision per-stack infrastructure (built-in + app-declared services)
         //    Auto-detect core services (postgres, redis, minio) from app requirements,
         //    then merge with explicit infrastructure config (gateway, custom services).
@@ -3283,8 +3471,13 @@ export class ProjectService extends EventEmitter {
                 throw new Error(`Bootstrap declarations unavailable for ${entry.name}`);
         }
         const effectiveInfra = ownsInfrastructure ? mergeInferredInfrastructure(buildInfraFromRequirements(requirementsFromDefinitions(appDefinitions)), verifyArtifactInfrastructure ? await verifyArtifactInfrastructure() : mergeInfrastructure(ecosystemConfig, stackConfig)) : undefined;
+        if (preservation) {
+            const current = await this.reviewStackStart(projectName, stackName, { infrastructure: 'preserve', ...preservation.selection });
+            if (!current.digest || current.digest !== preservation.digest)
+                throw Error('Launch, release or native infrastructure changed immediately before start');
+        }
         // Refuse missing/tampered migrators before creating or changing infrastructure.
-        if (effectiveInfra && project) {
+        if (effectiveInfra && project && !preservation) {
             const migrations = await localMigrationTargets(requestedMigrations(normalizeInfraConfig(effectiveInfra, createDefaultRegistry())), appEntries, project.path, verifyMigrations);
             const resolveMigration = this.stackEntryBuilder(projectName, stackName, stackConfig, ecosystemConfig, appDefinitions, stackEnv);
             validateMigrationDestinations(migrations.map(target => {
@@ -3294,7 +3487,7 @@ export class ProjectService extends EventEmitter {
         }
         if (effectiveInfra) {
             try {
-                const infraService = await this.infraManager.provisionStack(projectName, stackName, stackConfig, effectiveInfra, appDefinitions, project?.path);
+                const infraService = preservation ? await this.infraManager.preserveStack(projectName, stackName, stackConfig, effectiveInfra, preservation.targets.find(target => target.node === 'local').infrastructure.digest, appDefinitions, project?.path) : await this.infraManager.provisionStack(projectName, stackName, stackConfig, effectiveInfra, appDefinitions, project?.path, reconcile);
                 state.infraService = infraService;
                 const outcome = summariseProvisioning(infraService.getDesiredServices(), infraService.getState().services);
                 if (!outcome.ready && !outcome.empty) {
@@ -3318,7 +3511,7 @@ export class ProjectService extends EventEmitter {
                 // `settings.allowDegradedInfra: true` (the field is namespaced under
                 // settings to remain forward-compatible with stack schema).
                 const allowDegraded = stackConfig.settings?.['allowDegradedInfra'] === true;
-                if (!allowDegraded) {
+                if (!allowDegraded || preservation) {
                     const cleanMsg = `Stack '${projectName}/${stackName}' infrastructure provisioning failed:\n` +
                         `  ${reason}\n\n` +
                         `Apps were not started. Fix the underlying infrastructure issue (Docker socket, ` +
@@ -3337,7 +3530,7 @@ export class ProjectService extends EventEmitter {
         // Resolve once for both migrations and application startup. Inferred service
         // requirements are not permission to connect to a database or run migrations.
         const appConfigBuilder = this.stackEntryBuilder(projectName, stackName, stackConfig, ecosystemConfig, appDefinitions, stackEnv);
-        if (effectiveInfra && project) {
+        if (effectiveInfra && project && !preservation) {
             await this.runStackMigrations(projectName, stackName, this.infraManager.getNormalizedServices(projectName, stackName) ?? {}, appEntries, project.path, appConfigBuilder, verifyMigrations);
         }
         await enable?.(appConfigBuilder);
@@ -3399,10 +3592,10 @@ export class ProjectService extends EventEmitter {
      * and silent about which of its seven steps was running. See
      * `deploy-phases.ts`.
      */
-    async startRemoteStack(projectName, stackName, stackConfig, ecosystemConfig, release = null, reinstall = false) {
+    async startRemoteStack(projectName, stackName, stackConfig, ecosystemConfig, release = null, reinstall = false, preservation, reconcile = false) {
         const phases = reportPhases(this.logger, { project: projectName, stack: stackName });
         try {
-            return await withDeploymentProgress({ project: projectName, stack: stackName, operationId: randomUUID(), ...(release && { releaseId: release.id }) }, () => this.deployRemoteStack(projectName, stackName, stackConfig, ecosystemConfig, phases, release, reinstall));
+            return await withDeploymentProgress({ project: projectName, stack: stackName, operationId: randomUUID(), ...(release && { releaseId: release.id }) }, () => this.deployRemoteStack(projectName, stackName, stackConfig, ecosystemConfig, phases, release, reinstall, preservation, reconcile));
         }
         finally {
             // Every exit, including the refusals: a reporter that outlives its
@@ -3410,7 +3603,7 @@ export class ProjectService extends EventEmitter {
             phases.done();
         }
     }
-    async deployRemoteStack(projectName, stackName, stackConfig, ecosystemConfig, phases, release = null, reinstall = false) {
+    async deployRemoteStack(projectName, stackName, stackConfig, ecosystemConfig, phases, release = null, reinstall = false, preservation, reconcile = false) {
         const nodes = stackConfig.nodes ?? [];
         if (nodes.length === 0) {
             throw new Error(`Remote stack '${stackName}' has no nodes configured`);
@@ -3446,8 +3639,9 @@ export class ProjectService extends EventEmitter {
         const appEntries = this.resolveStackApps(stackConfig, ecosystemConfig);
         const migrationRequests = requestedMigrations({ ...declaredServices,
             ...normalizeInfraConfig(mergeInfrastructure(ecosystemConfig, stackConfig) ?? {}, createDefaultRegistry()) });
-        validateMigrationOwners(migrationRequests, appEntries);
-        const placements = orderMigrationPlacements(migrationRequests, resolveNodePlacements(stackConfig, appEntries));
+        if (!preservation)
+            validateMigrationOwners(migrationRequests, appEntries);
+        const placements = orderMigrationPlacements(preservation ? [] : migrationRequests, resolveNodePlacements(stackConfig, appEntries));
         // What the stack gives its apps, vault references resolved — before any
         // node is touched: a key the vault does not hold refuses the deployment
         // here, not after a node was provisioned (project/stack-env.ts). A remote
@@ -3569,11 +3763,28 @@ export class ProjectService extends EventEmitter {
             targets.set(`${node.host}:${node.port ?? 9700}`, await this.targetForStackNode(node));
         }
         phases.enter(`leasing ${nodes.length} node(s)`);
+        const waited = new Set();
         return withNodeLeases([...targets].map(([node, target]) => ({
             node,
             machine: `${target.host}:${target.sshPort ?? 22}`,
             run: this.deployer.leaseRunner(target),
         })), `${projectName}/${stackName}`, this.logger, async (leases) => {
+            if (preservation) {
+                const current = await this.reviewStackStart(projectName, stackName, { infrastructure: 'preserve', ...preservation.selection });
+                if (!current.digest || current.digest !== preservation.digest)
+                    throw Error('Preserved stack changed while acquiring deployment authority');
+            }
+            if (release && leases.unreachable.size) {
+                const missing = [...leases.unreachable].map(([node, reason]) => `${node}: ${reason}`).join(', ');
+                throw Error('Release deployment requires every selected node to be reachable before activation: ' + missing);
+            }
+            if (waited.size && release) {
+                const current = await this.admitRelease(projectName, stackName, stackConfig, ecosystemConfig, release.id);
+                if (current.manifestSha256 !== release.manifestSha256)
+                    throw Error('Release changed while waiting for the target');
+            }
+            for (const node of waited)
+                this.deployer.emitProgress(node, '*', 'pending', 0, 'Node lease acquired');
             // Each node's platform is held at its gateway from before the first
             // step that can stop an app until the apps answer through it again
             // (`maintenance-lock.ts`). A node whose deployment throws or is
@@ -3603,11 +3814,11 @@ export class ProjectService extends EventEmitter {
                         this.logger.warn({ node: nodeKey, because: master.reason }, 'Provisioning this node without a master address — it will be pulled from, not dial in');
                     }
                     await leases.confirm(nodeKey, `provisioning ${node.host}`);
-                    const lock = await this.holdForDeployment(target, projectName, stackName, stackConfig, ecosystemConfig, release, phases);
+                    const lock = preservation ? null : await this.holdForDeployment(target, projectName, stackName, stackConfig, ecosystemConfig, release, phases);
                     if (lock)
                         locks.set(nodeKey, lock);
                     phases.enter(`provisioning ${node.host}`);
-                    const provisioned = await this.deployer.provisionSlaveNode(target, master.host, masterPort, projectName);
+                    const provisioned = preservation ? true : await this.deployer.provisionSlaveNode(target, master.host, masterPort, projectName);
                     if (!provisioned) {
                         skipped.push(nodeKey);
                         this.logger.error({ node: nodeKey }, 'Failed to provision slave — skipping');
@@ -3634,7 +3845,7 @@ export class ProjectService extends EventEmitter {
                     // Sending only the stack's own block is why a remote deployment had
                     // databases and no gateway, and no onion address to reach it by.
                     const nodeInfra = mergeInfrastructure(ecosystemConfig, stackConfig);
-                    if (nodeInfra || Object.keys(declaredServices).length > 0) {
+                    if (preservation || nodeInfra || Object.keys(declaredServices).length > 0) {
                         await leases.confirm(nodeKey, `bringing up infrastructure on ${node.host}`);
                         phases.enter(`bringing up infrastructure on ${node.host}`);
                         const infrastructure = await this.provisionNodeInfrastructure(connector, node, (nodeInfra ?? {}), declaredServices, 
@@ -3646,8 +3857,12 @@ export class ProjectService extends EventEmitter {
                             project: projectName,
                             stack: stackName,
                             overrides: await this.resolveOverrideSecrets(projectName, stackConfig.serviceOverrides),
-                        }, project?.path, release?.staticsDir ?? undefined);
+                        }, project?.path, release?.staticsDir ?? undefined, preservation ? { mode: 'preserve', review: preservation.targets.find(preservedTarget => preservedTarget.node === nodeKey)?.infrastructure?.digest ?? undefined }
+                            : reconcile ? { mode: 'reconcile' } : undefined);
                         if (!infrastructure.ready) {
+                            if (release || preservation) {
+                                throw new Error(`Deployment stopped before application installation on ${nodeKey}: ${infrastructure.detail}`);
+                            }
                             // Not fatal: a node whose infrastructure is incomplete can still
                             // be looked at, and stopping here would leave the fleet in a state
                             // no command describes. It is said at error level with the node —
@@ -3679,7 +3894,7 @@ export class ProjectService extends EventEmitter {
                     // the rest stay as this stack declared them, because those are the
                     // master's to decide and the node merely carried them out.
                     phases.enter(`reading credentials from ${node.host}`);
-                    const nodeCredentials = await this.readNodeCredentials(connector, node, CREDENTIALED_SERVICES.filter((service) => Boolean(nodeInfra?.[service])));
+                    const nodeCredentials = await this.readNodeCredentials(connector, node, CREDENTIALED_SERVICES.filter(service => Boolean(nodeInfra?.[service] || nodeInfra?.services?.[service] || declaredServices[service])), { project: projectName, stack: stackName });
                     const deployedInfra = overlayCredentials(nodeInfra, nodeCredentials);
                     // Resolved as a LOCAL stack, because from the node's side these
                     // services are: containers on that machine, ports on its loopback. The
@@ -3712,7 +3927,7 @@ export class ProjectService extends EventEmitter {
                         const results = await this.deployer.deployToStack([target], nodeArtifacts, projectName, {
                             apps: nodeApps,
                             appEnv,
-                            migrations: migrationRequests.filter(request => selectedNames.has(request.app)),
+                            migrations: preservation ? [] : migrationRequests.filter(request => selectedNames.has(request.app)),
                             stack: stackName,
                             // Past the node's record of what each app runs: ship and restart all.
                             ...(reinstall ? { force: true } : {}),
@@ -3775,6 +3990,16 @@ export class ProjectService extends EventEmitter {
                     await lock.lift('failed').catch((err) => this.logger.error({ node: nodeKey, err: err.message }, 'Could not lift maintenance — it expires by itself'));
                 }
             }
+        }, undefined, {
+            seconds: stackConfig.settings?.deploymentLeaseWaitSeconds ?? (release ? 300 : 0),
+            onWait: (node, holder, remaining) => {
+                waited.add(node);
+                this.deployer.emitProgress(node, '*', 'waiting', 0, `Waiting for ${holder} on this node · ${remaining}s remaining`);
+            },
+        }).catch((error) => {
+            for (const node of waited)
+                this.deployer.emitProgress(node, '*', 'failed', 0, describeFailure(error));
+            throw error;
         });
     }
     /**
@@ -3953,12 +4178,12 @@ export class ProjectService extends EventEmitter {
      */
     async readNodeCredentials(connector, node, 
     /** The services this stack declares — each must be answered for. */
-    declared = []) {
+    declared, scope) {
         const out = {};
-        for (const service of CREDENTIALED_SERVICES) {
+        for (const service of declared) {
             let info;
             try {
-                info = (await connector.invokeOnSlave(node.host, node.port ?? 9700, 'OmnitronInfra', 'getConnectionInfo', [{ service }], { retryOnDisconnect: true }));
+                info = (await connector.invokeOnSlave(node.host, node.port ?? 9700, 'OmnitronInfra', 'getConnectionInfo', [{ service, ...scope }], { retryOnDisconnect: true }));
             }
             catch (err) {
                 throw new Error(`Could not read ${service}'s credentials from ${node.host}: ${err.message}. ` +
@@ -4122,7 +4347,7 @@ export class ProjectService extends EventEmitter {
     /** Filled with each service whose directory was sent → that directory's absolute path here. */
     shippedDirs, 
     /** The services the stack's apps require — each may name a directory of its own, as the stack's may. */
-    services) {
+    services, strict = false) {
         const { readConfigDirectory } = await import('../infrastructure/config-payload.js');
         const { shippedDirsOf } = await import('../infrastructure/shipped-config.js');
         const fsp = await import('node:fs/promises');
@@ -4145,6 +4370,8 @@ export class ProjectService extends EventEmitter {
                     shippedDirs?.set(name, abs);
                 }
                 if (skipped.length > 0) {
+                    if (strict)
+                        throw Error('Complete service configuration is required for preservation');
                     // Said out loud: a file left behind changes what the service does,
                     // and silence here would make the node's behaviour unexplainable
                     // from the master.
@@ -4152,6 +4379,8 @@ export class ProjectService extends EventEmitter {
                 }
             }
             catch (err) {
+                if (strict)
+                    throw Error('Service configuration cannot be verified for preservation', { cause: err });
                 // Not fatal. A stack whose gateway config is missing still gets its
                 // databases, and the gateway fails visibly rather than the whole
                 // provisioning stopping before anything was done.
@@ -4160,6 +4389,12 @@ export class ProjectService extends EventEmitter {
         }
         return payload;
     }
+    async reviewNodeInfrastructure(node, infrastructure, services, owner, projectRoot, releasedStatics) {
+        const result = await this.provisionNodeInfrastructure(this.getSlaveConnector(), node, infrastructure, services, owner, projectRoot, releasedStatics, { mode: 'review' });
+        if (!result.preservation || result.preservation.protocol !== 1 || result.preservation.mode !== 'preserve')
+            throw Error('Recipient does not confirm infrastructure preservation capability; update or inspect the node before recovery');
+        return result.preservation;
+    }
     async provisionNodeInfrastructure(connector, node, infrastructure, services, owner, 
     /**
      * This project's root on the MASTER, for reading the config files a
@@ -4174,7 +4409,7 @@ export class ProjectService extends EventEmitter {
      */
     projectRoot, 
     /** A release's static bundle, shipped as it was built — see `shipStackStatics`. */
-    releasedStatics) {
+    releasedStatics, authority) {
         const host = node.host;
         const port = node.port ?? 9700;
         await connector.addSlave({ host, port, label: node.label });
@@ -4187,7 +4422,8 @@ export class ProjectService extends EventEmitter {
         }
         try {
             const shippedDirs = new Map();
-            const configFiles = projectRoot ? await this.readStackConfigFiles(infrastructure, projectRoot, shippedDirs, services) : {};
+            const preserving = authority?.mode === 'review' || authority?.mode === 'preserve';
+            const configFiles = projectRoot ? await this.readStackConfigFiles(infrastructure, projectRoot, shippedDirs, services, preserving) : {};
             // A service's bind mounts inside its shipped directory name the node's
             // copy, not this machine's path — the stack's own services and the ones
             // its apps require alike. See `shipped-config.ts`.
@@ -4200,16 +4436,31 @@ export class ProjectService extends EventEmitter {
             // by SSH rather than inside the call: 32 MB is the wrong size for an
             // RPC argument, which is held whole on both sides and blocks the call
             // it rides on. Config files are 65 KB and ride along; a build does not.
-            const shipped = projectRoot
+            const shipped = projectRoot && !preserving
                 ? await this.shipStackStatics(infrastructure, projectRoot, node, releasedStatics, owner)
                 : { dirs: {}, roots: {} };
             const staticRoots = shipped.dirs;
             const staticLinkRoots = shipped.roots;
+            const staticDigests = {};
+            if (preserving && projectRoot && this.staticDirOf(infrastructure, projectRoot)) {
+                const { releaseTreeDigest } = await import('../release/runtime-provenance.js');
+                staticDigests['gateway'] = await releaseTreeDigest(releasedStatics ?? this.staticDirOf(infrastructure, projectRoot), true);
+            }
             // Retry once if the connection turns out to be gone: the deployer just
             // restarted this node's daemon, so the mesh connection the master holds
             // was established to the process that exited. `provisionStack` is a
             // reconciler, so applying it twice is applying it once.
-            const report = (await connector.invokeOnSlave(host, port, 'OmnitronInfra', 'provisionStack', [{ config: configForNode, services: servicesForNode, ...(owner ?? {}), configFiles, staticRoots, staticLinkRoots }], { retryOnDisconnect: true }));
+            const report = (await connector.invokeOnSlave(host, port, 'OmnitronInfra', authority?.mode === 'review' ? 'reviewStack' : 'provisionStack', [{ config: configForNode, services: servicesForNode, ...(owner ?? {}), configFiles, staticRoots, staticLinkRoots,
+                    ...(preserving ? { infrastructure: 'preserve', staticDigests, ...(authority?.review && { review: authority.review }) }
+                        : authority?.mode === 'reconcile' ? { infrastructure: 'reconcile' } : {}) }], { retryOnDisconnect: true }));
+            const preservation = authority?.mode === 'review' ? report : report?.preservation;
+            if (preserving) {
+                if (preservation?.protocol !== 1 || preservation.mode !== 'preserve' || !Array.isArray(preservation.checks) || !Array.isArray(preservation.containers))
+                    throw Error('Recipient does not implement the preservation protocol');
+                if (authority?.mode === 'preserve' && (!preservation.digest || preservation.digest !== authority.review))
+                    throw Error('Recipient did not confirm the reviewed infrastructure identity');
+                return { ready: preservation.digest !== null, detail: 'Native infrastructure preservation checked', preservation };
+            }
             this.logger.info({
                 node: `${host}:${port}`,
                 ready: report?.ready ?? false,
@@ -4226,6 +4477,8 @@ export class ProjectService extends EventEmitter {
             // touched, and going on would put new backends behind the old frontend.
             if (err instanceof FrontendNotDeliveredError)
                 throw err;
+            if (authority?.mode === 'review' || authority?.mode === 'preserve')
+                return { ready: false, detail: 'Recipient preservation capability or complete native identity could not be verified; no provisioning fallback is permitted' };
             this.logger.error({ node: `${host}:${port}`, error: err.message }, 'Could not bring up this node\'s infrastructure');
             return { ready: false, detail: `could not ask the node: ${err.message}` };
         }
@@ -4389,7 +4642,7 @@ export class ProjectService extends EventEmitter {
             if (entry.bootstrap && project) {
                 try {
                     const bootstrapAbsPath = resolveAppPath(project.path, entry, entry.bootstrap);
-                    const { definition: loaded, metadata } = await readBootstrapMetadata(bootstrapAbsPath);
+                    const { definition: loaded, metadata } = await readBootstrapMetadata(bootstrapAbsPath, false, 30_000, entry.releaseRoot);
                     this.bootstrapMetadata.save(metadata);
                     // Preserve only declarative data across backend handoffs, never executable hooks.
                     this.bootstrapTopology.set(bootstrapAbsPath, structuredClone({ ...(loaded.requires ? { requires: loaded.requires } : {}), ...(loaded.omnitronConfig ? { omnitronConfig: loaded.omnitronConfig } : {}) }));
@@ -4456,37 +4709,34 @@ export class ProjectService extends EventEmitter {
             throw new Error('Project is not registered');
         return new LocalReleaseSelection(this.daemonStateStore, { project, stack }, registration.registeredAt);
     }
-    async installedEntries(project, stack, definition, config, release, prepare = false, requiredMigrations, migrationFiles) {
-        return (await this.installedRelease(project, stack, definition, config, release, prepare, requiredMigrations, migrationFiles)).entries;
+    async installedEntries(project, stack, definition, config, release, prepare = false, requiredApps, requiredFiles) {
+        return (await this.installedRelease(project, stack, definition, config, release, prepare, requiredApps, requiredFiles)).entries;
     }
-    async installedRelease(project, stack, definition, config, release, prepare = false, requiredMigrations, migrationFiles) {
+    async installedRelease(project, stack, definition, config, release, prepare = false, requiredApps, requiredFiles, admittedOwner) {
         const root = this.registry.get(project)?.path;
         if (!root)
             throw new Error('Project is not registered');
         const { inspectLocalReleaseInstallation, inspectLocalReleasePayloads } = await import('../release/local-installation.js');
         const stackEntries = this.resolveStackApps(definition, config);
         // Validate the complete stack before narrowing executable verification to
-        // migration owners. Other applications still own their declared environment.
+        // requested executable owners. Other applications still own their declared environment.
         const env = await this.stackEnvFor(project, stack, definition, stackEntries.map(entry => entry.name));
-        const configured = stackEntries.filter(entry => !requiredMigrations || requiredMigrations.includes(entry.name));
+        const configured = stackEntries.filter(entry => !requiredApps || requiredApps.includes(entry.name));
         const entries = configured.map(entry => ({
             ...entry, env: { ...entry.env, ...env[entry.name] },
             ...(!entry.releaseFrom || entry.cwd !== undefined ? { cwd: resolveAppPath(root, entry) } : {}),
             ...(entry.bootstrap && { bootstrap: resolveAppPath(root, entry, entry.bootstrap) }),
         }));
-        const ownerPid = this.orchestrator.getExecutionOwnerPid?.();
-        if (!ownerPid)
-            throw new Error('A verified local release requires a connected independent execution owner');
-        const ownerPackage = await this.orchestrator.getExecutionOwnerPackage?.();
-        if (!ownerPackage)
-            throw new Error('Verified runtime origin requires an independently verified execution-owner package');
+        const owner = admittedOwner ?? await this.orchestrator.getExecutionOwnerRuntime?.();
+        assertResidentApplicationRuntime(owner);
+        assertReleaseTarget(owner.target, owner.target);
         const infrastructure = mergeInfrastructure(config, definition);
         const payloads = artifactVolumeEntries(infrastructure, config.apps);
         const roots = await inspectLocalReleasePayloads(release, payloads, prepare);
         const resolved = await bindArtifactVolumes(infrastructure, roots);
-        const installed = await inspectLocalReleaseInstallation(release, stack, entries, { prepare, ownerPid, ownerPackage,
-            ...(requiredMigrations && { requiredFiles: migrationFiles ?? Object.fromEntries(requiredMigrations.map(app => [app, [COMPILED_MIGRATION_ENTRY]])) }),
-        });
+        const installed = await inspectLocalReleaseInstallation(release, stack, entries, { prepare,
+            ownerPid: owner.execution.pid, ownerPackage: owner.root, runtime: owner.target,
+            ...(requiredApps && { requiredFiles: requiredFiles ?? Object.fromEntries(requiredApps.map(app => [app, [COMPILED_MIGRATION_ENTRY]])) }), });
         const preparedArtifactVolumes = artifactVolumeBindings(infrastructure).map(([binding, value]) => {
             const service = resolved?.services?.[value.service];
             const mount = service && !('preset' in service) ? service.docker?.volumes?.[binding] : undefined;
@@ -4498,6 +4748,84 @@ export class ProjectService extends EventEmitter {
         });
         return { entries: installed, infrastructure: resolved, preparedArtifactVolumes };
     }
+    /** Read-only admission for an operation in an already selected, prepared release.
+     * The returned fence repeats admission before each Xec attempt; it cannot install,
+     * select a release, run setup, or silently adopt a different owner/registration. */
+    async resolvePipelineRelease(target, options) {
+        const { readInstalledReleaseReceipt } = await import('../release/installed-origin.js');
+        const { frozenMember } = await import('../release/frozen-installation.js');
+        const inspect = async () => {
+            assertReleaseLoaderEnvironment(process.env);
+            assertReleaseLoaderEnvironment(options.env);
+            const scope = await this.resolveProjectStack({ project: target.project, stack: target.stack }, { readOnly: true });
+            this.assertStackMutable(scope);
+            const registered = this.registry.get(scope.project);
+            const config = this.getLoadedConfig(scope.project);
+            if (!registered || !config)
+                throw Error('Release pipeline target requires a registered, loaded project');
+            const registration = structuredClone(registered);
+            const definition = this.resolveStacks(config, scope.project)[scope.stack];
+            if (!definition || definition.type !== 'local' || definition.managedOrigin)
+                throw Error('Release pipeline target requires an independently owned local stack; remote execution is unsupported');
+            const fingerprint = () => createHash('sha256').update(JSON.stringify({
+                definition: this.resolveStacks(this.getLoadedConfig(scope.project), scope.project)[scope.stack],
+                config: this.getLoadedConfig(scope.project),
+            })).digest('hex');
+            const definitionFingerprint = fingerprint();
+            const selection = this.localSelection(scope.project, scope.stack).read();
+            if (!selection.release)
+                throw Error('Release pipeline target has no selected immutable release');
+            const owner = await this.orchestrator.getExecutionOwnerRuntime?.();
+            assertResidentApplicationRuntime(owner);
+            assertReleaseTarget(owner.target, owner.target);
+            if (!owner.execution?.lifetime)
+                throw Error('Release pipeline execution requires native owner lifetime evidence');
+            const release = await this.admitRelease(scope.project, scope.stack, definition, config, selection.release.id, 'check');
+            if (release.manifestSha256 !== selection.release.manifestSha256)
+                throw Error('Selected release manifest changed on disk');
+            const source = releaseArtifactOrigins(release.manifest, release.manifestSha256).find(item => item.app === target.app);
+            const origin = source?.origin;
+            const artifact = origin?.runtimeOrigin && { releaseId: origin.releaseId, manifestSha256: origin.manifestSha256,
+                artifactSha256: origin.artifactSha256, producerApp: origin.runtimeOrigin.producerApp,
+                projectCommit: origin.runtimeOrigin.projectCommit, frameworkCommit: origin.frameworkCommit };
+            if (!artifact || !isDeepStrictEqual(artifact, target.artifact))
+                throw Error('Selected release does not contain the pinned pipeline artifact');
+            const installed = await this.installedRelease(scope.project, scope.stack, definition, config, release, false, [target.app], { [target.app]: [target.entry] }, owner);
+            if (installed.entries.length !== 1 || !installed.entries[0]?.releaseRoot)
+                throw Error('Pipeline application is absent from the selected stack');
+            const entry = installed.entries[0], root = entry.releaseRoot;
+            const file = await frozenMember(root, target.entry);
+            const receipt = await readInstalledReleaseReceipt(root);
+            const env = { ...Object.fromEntries(Object.entries(process.env).filter((item) => typeof item[1] === 'string')),
+                ...entry.env, ...options.env, NODE_OPTIONS: releaseOptionsForEnv(entry.env), NODE_PATH: '',
+                PATH: path.dirname(owner.executable) + path.delimiter + '/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin' };
+            const cwd = options.cwd ?? entry.cwd ?? root;
+            if (!path.isAbsolute(cwd) || await fs.promises.realpath(cwd) !== cwd || !(await fs.promises.stat(cwd)).isDirectory())
+                throw Error('A release pipeline working directory must be an absolute physical directory');
+            const command = { command: owner.executable, args: [file, ...options.args ?? []], shell: false,
+                cwd,
+                env: withClosureLibraryPath(env, { verifiedRoot: root }, {}) ?? env };
+            const evidence = { artifact,
+                consumer: origin.runtimeOrigin.consumer,
+                installationRoot: root, treeSha256: receipt.treeSha256, entry: file, executable: owner.executable, cwd,
+                environmentSha256: createHash('sha256').update(JSON.stringify(Object.entries(command.env).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0))).digest('hex'), target: owner.target,
+                owner: { id: owner.execution.ownerId, pid: owner.execution.pid, epoch: owner.execution.epoch,
+                    lifetime: owner.execution.lifetime, frameworkCommit: owner.commit } };
+            const observed = await this.orchestrator.getExecutionOwnerRuntime?.();
+            assertSameApplicationRuntime(owner, observed);
+            assertReleaseTarget(owner.target, observed?.target);
+            this.assertStackMutable(scope);
+            if (!isDeepStrictEqual(registration, this.registry.get(scope.project)) ||
+                !isDeepStrictEqual(selection, this.localSelection(scope.project, scope.stack).read()) || fingerprint() !== definitionFingerprint)
+                throw Error('Pipeline registration, configuration or release selection changed during admission');
+            return { command, evidence, registration, selection, scope, definition: definitionFingerprint };
+        };
+        const admitted = await inspect();
+        return { command: admitted.command, evidence: admitted.evidence, verify: async () => {
+                if (!isDeepStrictEqual(admitted, await inspect()))
+                    throw Error('Pipeline release, application environment or execution owner changed after admission');
+            } };
+    }
     /** All consumers of executable declarations must see the same physical entry as the owner. */
     async launchEntries(project, stack, definition, config, requiredMigrations, migrationFiles) {
         const selected = definition.type === 'local' && !definition.managedOrigin ? this.localSelection(project, stack).read().release : null;
@@ -4866,6 +5194,7 @@ export class ProjectService extends EventEmitter {
         const selectedRelease = config.type === 'local' && !config.managedOrigin ? this.localSelection(projectName, stackName).read().release : null;
         return {
             name: stackName,
+            infrastructureMode: this.infrastructurePolicy(projectName, stackName)?.mode ?? 'reconcile',
             type: config.type,
             ...(selectedRelease && { selectedRelease }),
             status,
@@ -5034,7 +5363,26 @@ export const MASTER_PROJECT_SERVICE_PROVIDER = {
     // deployed app is handed `<secret:…>` as a password. `audit` is here
     // because two of the three callers of `startStack` never pass through the
     // RPC layer that used to record it.
-    new ProjectService(loggerModule.logger, orchestrator, daemonStateStore, { secrets, audit }),
+    new ProjectService(loggerModule.logger, orchestrator, daemonStateStore, {
+        secrets, audit, ...(readSavedDaemonConfig()?.releaseStore ? { receiveRelease: async (id, root) => {
+                const { configuredReleaseStore, configuredStoreConfig } = await import('../release/configured-store.js');
+                const { pullRelease } = await import('../release/artifact-store.js');
+                await audit.record({ action: 'release.pull.requested', resourceType: 'release', resourceId: id }, true);
+                const store = await configuredReleaseStore(configuredStoreConfig(), key => secrets.get(key));
+                try {
+                    const result = await pullRelease(id, store, { root });
+                    await audit.record({ action: 'release.pull', resourceType: 'release', resourceId: id,
+                        details: { indexSha256: result.indexSha256, files: result.moved.files, bytes: result.moved.bytes } }, true);
+                }
+                catch (error) {
+                    await audit.record({ action: 'release.pull', resourceType: 'release', resourceId: id, outcome: 'failed', error });
+                    throw error;
+                }
+                finally {
+                    await store.close();
+                }
+            } } : {}),
+    }),
 };
 /** A slave has its own encrypted vault even though it has no master database/audit service. */
 export const SLAVE_PROJECT_SERVICE_PROVIDER = {