@or3/cloud 0.1.38 → 0.1.49

package/dist/cli.mjs

@@ -1,19 +1,21 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { createHash, randomBytes } from "node:crypto";
+import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { execFile as execFileCallback, spawn } from "node:child_process";
 import { createServer } from "node:net";
 import { lookup } from "node:dns/promises";
 import readline from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
-import { createReadStream, createWriteStream, existsSync } from "node:fs";
+import { createReadStream, createWriteStream, existsSync, readFileSync } from "node:fs";
 import {
   chmod,
   copyFile,
   mkdir,
+  open,
   readFile,
   readdir,
+  realpath,
   rename,
   rm,
   stat,
@@ -27,16 +29,26 @@ import { dirname, basename, isAbsolute, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createGunzip } from "node:zlib";
 var execFile = promisify(execFileCallback);
-var PACKAGE_VERSION = "0.1.38";
+var PACKAGE_ROOT = resolve(fileURLToPath(new URL("../", import.meta.url)));
+var PACKAGE_VERSION = "0.1.49";
 var IMAGE_REPOSITORY = "ghcr.io/saluana/or3-chat";
 var ASSET_ROOT = resolve(fileURLToPath(new URL("../assets/", import.meta.url)));
 var STATE_SCHEMA_VERSION = 1;
 var DEFAULT_PORT = 3000;
 var DEEP_HEALTH_TIMEOUT_MS = 180000;
+var COMMAND_TIMEOUT_MS = 180000;
+var STREAM_COMMAND_TIMEOUT_MS = 15 * 60000;
 var BACKUP_RETENTION_KEEP = 5;
 var PURGE_REQUIRES_BACKUP_WITHIN_MS = 24 * 60 * 60 * 1000;
 var FREE_SPACE_HEADROOM_BYTES = 64 * 1024 * 1024;
 var BACKUP_ID_PATTERN = /^backup-[0-9A-Za-z-]+$/;
+var MANAGED_ASSET_INVENTORY_VERSION = 3;
+var DASHBOARD_LEASE_STALE_MS = 30000;
+var PROVISIONING_CREDENTIAL_KEYS = [
+  "OR3_BASIC_AUTH_BOOTSTRAP_EMAIL",
+  "OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD",
+  "OR3_ADMIN_PASSWORD"
+];
 var SECRET_KEYS = [
   "OR3_BASIC_AUTH_JWT_SECRET",
   "OR3_BASIC_AUTH_REFRESH_SECRET",
@@ -54,6 +66,32 @@ var DEPLOYMENT_ENV_KEYS = [
   "OR3_PORT",
   "OR3_PUBLIC_DOMAIN"
 ];
+var DEPLOYMENT_ID_ENV_KEY = "OR3_DEPLOYMENT_ID";
+var PROCESS_ENV_PASSTHROUGH = [
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "SHELL",
+  "TMPDIR",
+  "TMP",
+  "TEMP",
+  "XDG_CONFIG_HOME",
+  "XDG_RUNTIME_DIR",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR",
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "NO_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "no_proxy",
+  "DOCKER_HOST",
+  "DOCKER_CONTEXT",
+  "DOCKER_TLS_VERIFY",
+  "DOCKER_CERT_PATH",
+  "DOCKER_CONFIG"
+];
 var ALLOWED_ENV_KEYS = new Set([
   "SSR_AUTH_ENABLED",
   "AUTH_PROVIDER",
@@ -68,6 +106,7 @@ var ALLOWED_ENV_KEYS = new Set([
   "OR3_BASIC_AUTH_DB_PATH",
   "OR3_BASIC_AUTH_BOOTSTRAP_EMAIL",
   "OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD",
+  "OR3_MANAGED_OWNER_EMAIL",
   "OR3_SYNC_ENABLED",
   "OR3_CLOUD_SYNC_ENABLED",
   "OR3_SYNC_PROVIDER",
@@ -116,6 +155,9 @@ function serializeInitialCredentials(input2) {
 `);
 }
 function validatePassword(password) {
+  if (password.includes("\x00") || /\r|\n/.test(password)) {
+    throw new Error("The administrator password may not contain NUL or newline characters.");
+  }
   if (password.length < 12 || !/[A-Z]/.test(password) || !/[a-z]/.test(password) || !/[0-9]/.test(password)) {
     throw new Error("The administrator password must be at least 12 characters and contain uppercase, lowercase, and numeric characters.");
   }
@@ -127,7 +169,7 @@ function redact(text, secrets = []) {
   let output2 = text;
   for (const secret of secrets.filter(Boolean))
     output2 = output2.replaceAll(secret, "[REDACTED]");
-  output2 = output2.replace(/((?:PASSWORD|SECRET|TOKEN|JWT)\s*[=:]\s*)([^\s\n]+)/gi, "$1[REDACTED]");
+  output2 = output2.replace(/((?:PASSWORD|SECRET|TOKEN|JWT)\s*[=:]\s*)(?!\[REDACTED\])([^\r\n]+)/gi, "$1[REDACTED]");
   return output2;
 }
 function parseFlags(argv) {
@@ -161,9 +203,10 @@ var COMMAND_FLAGS = {
   restore: ["yes"],
   rollback: ["yes"],
   doctor: [],
+  verify: ["public", "verification-email", "verification-password-file"],
   recover: [],
   adopt: ["from"],
-  credentials: ["yes", "owner-password", "admin-password"],
+  credentials: ["yes", "owner-password", "owner-password-file", "admin-password", "admin-password-file"],
   status: [],
   logs: ["tail"],
   start: [],
@@ -178,6 +221,28 @@ function assertCommandFlags(command, flags) {
     throw new Error(`Unknown option${unknown.length === 1 ? "" : "s"} for ${command}: ${unknown.map((flag) => `--${flag}`).join(", ")}. Run npx @or3/cloud ${command} --help.`);
   }
 }
+function assertCommandPositionals(command, positionals) {
+  if (command === "backup" || command === "credentials")
+    return;
+  if (command === "init" || command === "adopt") {
+    if (positionals.length > 1)
+      throw new Error(`${command} accepts at most one target directory.`);
+    return;
+  }
+  if (command === "restore") {
+    if (positionals.length !== 1)
+      throw new Error("restore requires exactly one backup ID or absolute backup path.");
+    return;
+  }
+  if (command === "logs") {
+    if (positionals.length > 1)
+      throw new Error("logs accepts at most one service name.");
+    return;
+  }
+  if (positionals.length > 0) {
+    throw new Error(`${command} accepts no positional arguments. Run npx @or3/cloud ${command} --help.`);
+  }
+}
 function stringFlag(flags, key) {
   const value = flags[key];
   return typeof value === "string" ? value : undefined;
@@ -202,6 +267,9 @@ function imageFor(version) {
     return testImage;
   return `${IMAGE_REPOSITORY}:${version}`;
 }
+function operatorImageFor(version) {
+  return process.env.OR3_CLOUD_TEST_OPERATOR_IMAGE?.trim() || `${IMAGE_REPOSITORY}:${version}-operator`;
+}
 function sanitizeName(value, fallback = "or3-cloud") {
   const name = value.toLowerCase().replaceAll(/[^a-z0-9_-]+/g, "-").replaceAll(/^-+|-+$/g, "");
   return name || fallback;
@@ -234,14 +302,38 @@ function validateDomain(domain) {
     throw new Error(`"${domain}" is not a hostname. Use a name such as cloud.example.com.`);
   }
 }
-async function run(command, args, cwd) {
+function composeProcessEnv(directory) {
+  const safe = {};
+  for (const key of PROCESS_ENV_PASSTHROUGH) {
+    if (process.env[key] !== undefined)
+      safe[key] = process.env[key];
+  }
+  const envPath = join(directory, ".env");
+  try {
+    for (const [key, value] of Object.entries(parseEnv(readFileSync(envPath, "utf8")))) {
+      if (key.startsWith("OR3_"))
+        safe[key] = value;
+    }
+    return safe;
+  } catch (error) {
+    throw new Error(`Could not read managed Compose environment ${envPath}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function commandEnvironment(command, args, cwd, supplied) {
+  if (supplied)
+    return supplied;
+  return command === "docker" && args[0] === "compose" && cwd ? composeProcessEnv(cwd) : process.env;
+}
+async function run(command, args, cwd, environment) {
   const printable = `${command} ${args.map(quote).join(" ")}`;
   try {
     const result = await execFile(command, args, {
       cwd,
       maxBuffer: 4 * 1024 * 1024,
       encoding: "utf8",
-      env: process.env
+      timeout: COMMAND_TIMEOUT_MS,
+      killSignal: "SIGKILL",
+      env: commandEnvironment(command, args, cwd, environment)
     });
     return {
       ok: true,
@@ -274,13 +366,35 @@ async function writeSecure(path, content) {
   const temporary = `${path}.tmp-${randomBytes(4).toString("hex")}`;
   await writeFile(temporary, content, { mode: 384 });
   await chmod(temporary, 384);
-  await rename(temporary, path);
-  await chmod(path, 384);
+  await durableRename(temporary, path);
+}
+async function syncFile(path) {
+  const handle = await open(path, "r");
+  try {
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+async function syncDirectory(path) {
+  const handle = await open(path, "r");
+  try {
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+async function durableRename(source, destination) {
+  await syncFile(source);
+  await rename(source, destination);
+  await syncDirectory(dirname(destination));
 }
 async function copySecure(source, destination) {
   await mkdir(dirname(destination), { recursive: true, mode: 448 });
   await copyFile(source, destination);
   await chmod(destination, 384);
+  await syncFile(destination);
+  await syncDirectory(dirname(destination));
 }
 async function fileExists(path) {
   try {
@@ -293,6 +407,13 @@ async function fileExists(path) {
 async function readText(path) {
   return readFile(path, "utf8");
 }
+async function readOwnerOnlyText(path, label) {
+  const info = await stat(path);
+  if (!info.isFile() || (info.mode & 63) !== 0) {
+    throw new Error(`${label} must be a regular owner-only file with no group/world permissions.`);
+  }
+  return readText(path);
+}
 function requiredArchiveSpace(requiredBytes) {
   return requiredBytes + Math.max(Math.ceil(requiredBytes / 2), FREE_SPACE_HEADROOM_BYTES);
 }
@@ -353,9 +474,56 @@ function deploymentPaths(directory) {
     state: join(cloud, "state.json"),
     operations: join(cloud, "operations"),
     backups: join(cloud, "backups"),
-    exports: join(cloud, "exports")
+    exports: join(cloud, "exports"),
+    lease: join(cloud, "operation-lease"),
+    backupAuthKey: join(cloud, "backup-auth.key"),
+    operatorIpc: join(cloud, "operator-ipc")
   };
 }
+async function backupAuthenticationKey(directory, create = false) {
+  const keyPath = deploymentPaths(directory).backupAuthKey;
+  try {
+    const key = (await readText(keyPath)).trim();
+    if (!/^[0-9a-f]{64}$/i.test(key))
+      throw new Error("invalid format");
+    return key;
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      throw new Error(`Backup authentication key at ${keyPath} is invalid or unreadable. Restore is refused until it is repaired from the deployment owner’s secure key material.`);
+    }
+    if (!create) {
+      throw new Error(`This deployment has no backup authentication key at ${keyPath}. Backups created by older CLI versions are intentionally not trusted for restore. Create a new verified backup before attempting a destructive restore.`);
+    }
+    const key = randomBytes(32).toString("hex");
+    await writeSecure(keyPath, `${key}
+`);
+    return key;
+  }
+}
+function backupAuthenticationTag(key, manifestContents) {
+  return createHmac("sha256", Buffer.from(key, "hex")).update(manifestContents).digest("hex");
+}
+async function writeBackupAuthentication(directory, backupPath, manifestContents) {
+  const key = await backupAuthenticationKey(directory, true);
+  await writeSecure(join(backupPath, "manifest.auth"), `${backupAuthenticationTag(key, manifestContents)}
+`);
+}
+async function assertBackupAuthentication(directory, backupPath, manifestContents) {
+  const key = await backupAuthenticationKey(directory);
+  let provided;
+  try {
+    const value = (await readText(join(backupPath, "manifest.auth"))).trim();
+    if (!/^[0-9a-f]{64}$/i.test(value))
+      throw new Error("invalid authentication tag");
+    provided = Buffer.from(value, "hex");
+  } catch {
+    throw new Error(`Backup at ${backupPath} has no valid deployment authentication tag. Refusing to restore or export an unauthenticated backup.`);
+  }
+  const expected = Buffer.from(backupAuthenticationTag(key, manifestContents), "hex");
+  if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) {
+    throw new Error(`Backup authentication failed for ${backupPath}. Refusing to trust data, configuration, or managed assets from another deployment.`);
+  }
+}
 async function readState(directory) {
   const paths = deploymentPaths(directory);
   const parsed = JSON.parse(await readText(paths.state));
@@ -371,8 +539,15 @@ async function writeState(directory, state) {
 async function readDirectoryEmpty(directory) {
   try {
     const entries = await readdir(directory);
-    if (entries.length)
+    const nonLeaseEntries = entries.filter((entry) => entry !== ".or3-cloud");
+    if (nonLeaseEntries.length)
       throw new Error(`Refusing to use non-empty directory ${directory}. Choose a new directory or run adopt explicitly.`);
+    if (entries.includes(".or3-cloud")) {
+      const cloudEntries = await readdir(join(directory, ".or3-cloud"));
+      if (cloudEntries.some((entry) => entry !== "operation-lease")) {
+        throw new Error(`Refusing to use non-empty directory ${directory}. Choose a new directory or run adopt explicitly.`);
+      }
+    }
     return false;
   } catch (error) {
     if (error.code === "ENOENT")
@@ -380,12 +555,124 @@ async function readDirectoryEmpty(directory) {
     throw error;
   }
 }
+async function readLeaseOwner(leasePath) {
+  try {
+    const owner = JSON.parse(await readText(join(leasePath, "owner.json")));
+    if (owner.schemaVersion !== 1 || typeof owner.nonce !== "string" || typeof owner.command !== "string" || owner.origin !== "cli" && owner.origin !== "dashboard" || !Number.isSafeInteger(owner.pid) || typeof owner.acquiredAt !== "string" || typeof owner.heartbeatAt !== "string")
+      return;
+    return owner;
+  } catch {
+    return;
+  }
+}
+function cliLeaseOwnerIsGone(owner) {
+  if (owner.origin !== "cli")
+    return false;
+  try {
+    process.kill(owner.pid, 0);
+    return false;
+  } catch (error) {
+    return error.code === "ESRCH";
+  }
+}
+function dashboardLeaseOwnerIsStale(owner, jobId) {
+  if (owner.origin !== "dashboard" || jobId && owner.jobId !== jobId)
+    return false;
+  const heartbeat = Date.parse(owner.heartbeatAt);
+  return Number.isFinite(heartbeat) && Date.now() - heartbeat > DASHBOARD_LEASE_STALE_MS;
+}
+async function acquireDeploymentLease(directory, command) {
+  const leasePath = deploymentPaths(directory).lease;
+  await mkdir(dirname(leasePath), { recursive: true, mode: 448 });
+  const nonce = randomBytes(16).toString("hex");
+  const owner = {
+    schemaVersion: 1,
+    nonce,
+    command,
+    origin: process.env.OR3_DASHBOARD_UPDATE_JOB_ID ? "dashboard" : "cli",
+    jobId: process.env.OR3_DASHBOARD_UPDATE_JOB_ID?.trim() || undefined,
+    pid: process.pid,
+    acquiredAt: now(),
+    heartbeatAt: now()
+  };
+  try {
+    await mkdir(leasePath, { recursive: false, mode: 448 });
+  } catch (error) {
+    if (error.code !== "EEXIST")
+      throw error;
+    const active = await readLeaseOwner(leasePath);
+    if (active && (cliLeaseOwnerIsGone(active) || dashboardLeaseOwnerIsStale(active, owner.jobId))) {
+      const stalePath = `${leasePath}.stale-${randomBytes(8).toString("hex")}`;
+      try {
+        await rename(leasePath, stalePath);
+        await rm(stalePath, { recursive: true, force: true });
+        await mkdir(leasePath, { recursive: false, mode: 448 });
+      } catch (reclaimError) {
+        throw new Error(`Another OR3 Cloud operation owns ${directory}. Refusing to race its lifecycle lock. ${reclaimError instanceof Error ? reclaimError.message : String(reclaimError)}`);
+      }
+    } else {
+      const detail = active ? `${active.command} (${active.origin}) acquired at ${active.acquiredAt}` : "an unreadable owner record";
+      throw new Error(`Another OR3 Cloud operation owns ${directory}: ${detail}. Refusing to run concurrently.`);
+    }
+  }
+  try {
+    await writeSecure(join(leasePath, "owner.json"), `${JSON.stringify(owner, null, 2)}
+`);
+  } catch (error) {
+    await rm(leasePath, { recursive: true, force: true }).catch(() => {
+      return;
+    });
+    throw error;
+  }
+  const heartbeat = setInterval(() => {
+    owner.heartbeatAt = now();
+    writeSecure(join(leasePath, "owner.json"), `${JSON.stringify(owner, null, 2)}
+`).catch(() => {
+      return;
+    });
+  }, 5000);
+  heartbeat.unref();
+  return async () => {
+    clearInterval(heartbeat);
+    const current = await readLeaseOwner(leasePath);
+    if (current?.nonce === nonce)
+      await rm(leasePath, { recursive: true, force: true });
+  };
+}
+async function withDeploymentLease(directory, command, action) {
+  const release = await acquireDeploymentLease(directory, command);
+  try {
+    return await action();
+  } finally {
+    await release();
+  }
+}
+function dashboardUpdatesEnabled(directory) {
+  try {
+    return parseEnv(readFileSync(join(directory, ".env"), "utf8")).OR3_DASHBOARD_UPDATES_ENABLED === "true";
+  } catch {
+    return false;
+  }
+}
 function composeArgs(directory, mode, command = []) {
+  const env = parseEnv(readFileSync(join(directory, ".env"), "utf8"));
+  const project = env.OR3_COMPOSE_PROJECT;
+  if (!project)
+    throw new Error(`Managed Compose environment at ${join(directory, ".env")} has no OR3_COMPOSE_PROJECT.`);
   const files = ["-f", join(directory, "compose.yaml")];
   if (mode === "public")
     files.push("-f", join(directory, "compose.public.yaml"));
+  if (dashboardUpdatesEnabled(directory)) {
+    const operatorOverlay = join(directory, "compose.operator.yaml");
+    if (!existsSync(operatorOverlay)) {
+      throw new Error("Dashboard updates are enabled but compose.operator.yaml is missing. Run `npx @or3/cloud recover` before operating on this deployment.");
+    }
+    files.push("-f", operatorOverlay);
+  }
   return [
     "compose",
+    "--project-name",
+    project,
     "--project-directory",
     directory,
     "--env-file",
@@ -395,7 +682,7 @@ function composeArgs(directory, mode, command = []) {
   ];
 }
 function diagnostics(directory, mode) {
-  const files = `-f ${quote(join(directory, "compose.yaml"))}${mode === "public" ? ` -f ${quote(join(directory, "compose.public.yaml"))}` : ""}`;
+  const files = `-f ${quote(join(directory, "compose.yaml"))}${mode === "public" ? ` -f ${quote(join(directory, "compose.public.yaml"))}` : ""}${dashboardUpdatesEnabled(directory) ? ` -f ${quote(join(directory, "compose.operator.yaml"))}` : ""}`;
   return `cd ${quote(directory)} && docker compose --env-file ${quote(join(directory, ".env"))} ${files} ps && docker compose --env-file ${quote(join(directory, ".env"))} ${files} logs --tail=200`;
 }
 async function captureComposeDiagnostics(directory, mode, secrets) {
@@ -453,6 +740,15 @@ function composeEnvironmentValue(service, key) {
   const value = environment?.[key];
   return typeof value === "string" ? value : undefined;
 }
+function composeLabelValue(service, key) {
+  const labels = service.labels;
+  if (Array.isArray(labels)) {
+    const line = labels.find((value2) => value2.startsWith(`${key}=`));
+    return line?.slice(key.length + 1);
+  }
+  const value = labels?.[key];
+  return typeof value === "string" ? value : undefined;
+}
 function composePublishedPort(port) {
   const target = Number(port.target);
   const published = Number(port.published);
@@ -465,6 +761,8 @@ function checkResolvedLoopbackBinding(config, expectedPort) {
     const service = parsed.services?.or3;
     if (!service)
       return false;
+    if (service.network_mode)
+      return false;
     const ports = (service.ports ?? []).map(composePublishedPort);
     const appPorts = ports.filter(({ target }) => target === 3000);
     if (!appPorts.length)
@@ -485,12 +783,94 @@ ${result.stderr}`);
 }
 async function assertSafeComposeBinding(directory, mode, env) {
   const config = await resolvedComposeConfig(directory, mode);
+  const parsed = parseComposeConfig(config);
+  const service = parsed.services?.or3;
+  if (parsed.name !== undefined && parsed.name !== env.OR3_COMPOSE_PROJECT) {
+    throw new Error("Resolved Compose configuration does not use the managed project name. Refusing to operate on another deployment.");
+  }
   if (!checkResolvedLoopbackBinding(config, Number(env.OR3_PORT))) {
     throw new Error("Resolved Compose configuration must publish OR3 port 3000 only on 127.0.0.1. Refusing to expose the application directly.");
   }
+  if (!service || service.image !== env.OR3_IMAGE) {
+    throw new Error("Resolved Compose configuration does not use the managed immutable OR3 image reference. Refusing to start an unexpected image.");
+  }
+  if (env.OR3_DEPLOYMENT_ID && composeLabelValue(service, "io.or3.cloud.deployment-id") !== env.OR3_DEPLOYMENT_ID) {
+    throw new Error("Resolved Compose configuration does not carry the managed deployment identity label. Refusing to start an unbound project.");
+  }
+  const dataMount = (service.volumes ?? []).find((mount) => mount.target === "/data");
+  const source = typeof dataMount?.source === "string" ? dataMount.source : "";
+  const volumeName = source ? parsed.volumes?.[source]?.name : undefined;
+  if (dataMount?.type !== "volume" || volumeName !== env.OR3_VOLUME_NAME) {
+    throw new Error("Resolved Compose configuration does not bind the managed OR3 data volume. Refusing to operate on an unexpected volume.");
+  }
+  const volumeLabels = source ? parsed.volumes?.[source]?.labels : undefined;
+  const deploymentLabel = Array.isArray(volumeLabels) ? volumeLabels.find((value) => value.startsWith("io.or3.cloud.deployment-id="))?.slice("io.or3.cloud.deployment-id=".length) : volumeLabels?.["io.or3.cloud.deployment-id"];
+  if (env.OR3_DEPLOYMENT_ID && deploymentLabel !== env.OR3_DEPLOYMENT_ID) {
+    throw new Error("Resolved managed data volume lacks the expected deployment identity label.");
+  }
+  if (env.OR3_DASHBOARD_UPDATES_ENABLED === "true") {
+    const operator = parsed.services?.["or3-operator"];
+    if (!operator || operator.network_mode || operator.image !== env.OR3_OPERATOR_IMAGE || env.OR3_DEPLOYMENT_ID && composeLabelValue(operator, "io.or3.cloud.deployment-id") !== env.OR3_DEPLOYMENT_ID) {
+      throw new Error("Resolved dashboard operator does not match the managed digest-qualified deployment bridge. Refusing to start it.");
+    }
+    if (process.env.OR3_CLOUD_SKIP_PULL !== "true" && !/@sha256:[0-9a-f]{64}$/i.test(env.OR3_OPERATOR_IMAGE ?? "")) {
+      throw new Error("The dashboard operator image is not digest-qualified. Refusing to start a mutable privileged runtime.");
+    }
+  }
+}
+async function assertRunningAppImage(directory, mode, expectedImage) {
+  const container = await run("docker", composeArgs(directory, mode, ["ps", "-q", "or3"]), directory);
+  const containerId = container.stdout.trim();
+  if (!container.ok || !containerId)
+    throw new Error("OR3 started without a running application container.");
+  const image = await run("docker", ["inspect", "--format", "{{.Image}}", containerId], directory);
+  if (!image.ok || !image.stdout.trim())
+    throw new Error("Could not inspect the image of the running OR3 container.");
+  const expectedDigest = expectedImage.match(/@((?:sha256:)[0-9a-f]{64})$/i)?.[1];
+  if (!expectedDigest && process.env.OR3_CLOUD_SKIP_PULL === "true") {
+    const expectedId = await run("docker", ["image", "inspect", "--format", "{{.Id}}", expectedImage], directory);
+    if (!expectedId.ok || expectedId.stdout.trim() !== image.stdout.trim()) {
+      throw new Error("The local qualification fixture started a different OR3 image than the one selected by the managed environment.");
+    }
+    return;
+  }
+  if (!expectedDigest)
+    throw new Error(`Managed OR3 image ${expectedImage} is not digest-qualified.`);
+  const repoDigests = await run("docker", ["image", "inspect", "--format", "{{json .RepoDigests}}", image.stdout.trim()], directory);
+  if (!repoDigests.ok)
+    throw new Error("Could not inspect repository digests for the running OR3 container.");
+  let values;
+  try {
+    values = JSON.parse(repoDigests.stdout.trim());
+  } catch {
+    throw new Error("The running OR3 container has no readable repository digests.");
+  }
+  const expected = `${imageRepository(expectedImage)}@${expectedDigest}`;
+  if (!values.includes(expected)) {
+    throw new Error(`The running OR3 container image does not match the managed digest ${expectedDigest}. Refusing to commit startup.`);
+  }
 }
 var HEALTH_SCRIPT = "const fs=require('node:fs');try{fs.accessSync('/data',fs.constants.R_OK|fs.constants.W_OK);for(const path of [process.env.OR3_BASIC_AUTH_DB_PATH,process.env.OR3_SQLITE_DB_PATH].filter(Boolean)){const fd=fs.openSync(path,'r+');fs.closeSync(fd)}}catch{process.exit(1)}fetch('http://127.0.0.1:3000/api/health?deep=true').then(async response=>{const body=await response.json().catch(()=>({}));if(!response.ok||body.status!=='ok')process.exit(1)}).catch(()=>process.exit(1))";
 var MAINTENANCE_SCRIPT = "fetch('http://127.0.0.1:3000/api/health?deep=true').then(async response=>{const body=await response.json().catch(()=>({}));const m=body?.providers?.sync?.details?.maintenance;if(m)console.log(JSON.stringify(m))}).catch(()=>{})";
+var VERIFY_DATABASES_SCRIPT = `
+const fs = require('node:fs');
+const Database = require('/app/.output/server/node_modules/better-sqlite3');
+const results = [];
+for (const path of [process.env.OR3_BASIC_AUTH_DB_PATH, process.env.OR3_SQLITE_DB_PATH].filter(Boolean)) {
+  const info = fs.statSync(path);
+  if (info.uid !== 65532 || info.gid !== 65532) throw new Error(path + ' must be owned by 65532:65532');
+  const db = new Database(path, { readonly: true, fileMustExist: true });
+  const quickCheck = db.pragma('quick_check', { simple: true });
+  const tables = db.prepare("select count(*) as count from sqlite_master where type = 'table'").get().count;
+  db.close();
+  if (quickCheck !== 'ok') throw new Error(path + ' quick_check failed: ' + quickCheck);
+  results.push({ path, quickCheck, tables });
+}
+if (process.env.OR3_FORCE_HTTPS === 'true' && process.env.NUXT_SECURITY_PROXY_TRUST_PROXY !== 'true') {
+  throw new Error('NUXT_SECURITY_PROXY_TRUST_PROXY must be true for a managed public deployment');
+}
+console.log(JSON.stringify(results));
+`;
 var CONTAINER_NODE = "/nodejs/bin/node";
 var LEGACY_CONTAINER_NODE = "/usr/local/bin/node";
 var CONTAINER_NODE_SHELL = `if [ -x ${CONTAINER_NODE} ]; then exec ${CONTAINER_NODE} -e "$1"; elif [ -x ${LEGACY_CONTAINER_NODE} ]; then exec ${LEGACY_CONTAINER_NODE} -e "$1"; else exit 127; fi`;
@@ -580,6 +960,81 @@ async function setManagedVolumeRootOwnership(image, volume, ownership) {
     throw new Error(`Managed volume ${volume} root ownership verification failed.`);
   }
 }
+function updateRequiresVolumeRecreation(state, env) {
+  return !state.deploymentId && !env.OR3_DEPLOYMENT_ID;
+}
+function restoreRequiresVolumeRecreation(currentEnv, targetEnv) {
+  return currentEnv.OR3_DEPLOYMENT_ID !== targetEnv.OR3_DEPLOYMENT_ID;
+}
+async function removeManagedDataVolumeForRecreation(directory, state) {
+  const containers = await run("docker", [
+    "ps",
+    "-aq",
+    "--filter",
+    `label=com.docker.compose.project=${state.composeProject}`,
+    "--filter",
+    "label=com.docker.compose.service=or3"
+  ], directory);
+  if (!containers.ok)
+    throw new Error(`Could not resolve the managed OR3 container. ${containers.stderr.trim()}`);
+  const containerIds = containers.stdout.trim().split(/\s+/).filter(Boolean);
+  if (containerIds.some((value) => !/^[0-9a-f]{12,64}$/i.test(value))) {
+    throw new Error("Docker returned an invalid managed OR3 container ID. Refusing to recreate the data volume.");
+  }
+  if (containerIds.length) {
+    const removedContainers = await run("docker", ["rm", "--force", ...containerIds], directory);
+    if (!removedContainers.ok)
+      throw new Error(`Could not remove the stopped managed OR3 container. ${removedContainers.stderr.trim()}`);
+  }
+  const inspected = await run("docker", ["volume", "inspect", state.volumeName, "--format", "{{json .}}"], directory);
+  if (!inspected.ok)
+    return;
+  let volume;
+  try {
+    volume = JSON.parse(inspected.stdout.trim());
+  } catch {
+    throw new Error(`Docker returned unreadable metadata for managed volume ${state.volumeName}.`);
+  }
+  if (volume.Name !== state.volumeName || volume.Labels?.["com.docker.compose.project"] !== state.composeProject || volume.Labels?.["com.docker.compose.volume"] !== "or3-data") {
+    throw new Error(`Volume ${state.volumeName} is not bound to this managed Compose deployment. Refusing to recreate it.`);
+  }
+  const removedVolume = await run("docker", ["volume", "rm", state.volumeName], directory);
+  if (!removedVolume.ok)
+    throw new Error(`Could not remove the verified legacy data volume for recreation. ${removedVolume.stderr.trim()}`);
+}
+async function ensureManagedDataVolume(directory, mode, state, env) {
+  const existing = await run("docker", ["volume", "inspect", state.volumeName, "--format", "{{.Name}}"], directory);
+  if (existing.ok && existing.stdout.trim() === state.volumeName)
+    return;
+  const created = await run("docker", composeArgs(directory, mode, [
+    "run",
+    "--rm",
+    "-T",
+    "--no-deps",
+    "--entrypoint",
+    "sh",
+    "or3",
+    "-c",
+    "true"
+  ]), directory);
+  if (!created.ok)
+    throw new Error(`Could not create the managed data volume. ${redact(created.stderr, secretValues(env))}`);
+  const inspected = await run("docker", ["volume", "inspect", state.volumeName, "--format", "{{json .Labels}}"], directory);
+  if (!inspected.ok)
+    throw new Error(`Could not verify the recreated managed data volume ${state.volumeName}.`);
+  let labels;
+  try {
+    labels = JSON.parse(inspected.stdout.trim());
+  } catch {
+    throw new Error(`Docker returned unreadable labels for recreated managed volume ${state.volumeName}.`);
+  }
+  if (!labels || typeof labels !== "object") {
+    throw new Error(`Recreated volume ${state.volumeName} has no managed deployment labels.`);
+  }
+  if (labels["com.docker.compose.project"] !== state.composeProject || labels["com.docker.compose.volume"] !== "or3-data" || env.OR3_DEPLOYMENT_ID && labels["io.or3.cloud.deployment-id"] !== env.OR3_DEPLOYMENT_ID) {
+    throw new Error(`Recreated volume ${state.volumeName} does not carry the expected managed deployment labels.`);
+  }
+}
 async function portAvailable(port) {
   return new Promise((resolvePromise) => {
     const server = createServer();
@@ -588,6 +1043,16 @@ async function portAvailable(port) {
     server.listen(port, "127.0.0.1");
   });
 }
+async function dockerDaemonIsLocal() {
+  const configured = process.env.DOCKER_HOST?.trim();
+  if (configured)
+    return configured.startsWith("unix://") || configured.startsWith("npipe://");
+  const context = await run("docker", ["context", "inspect", "--format", "{{.Endpoints.docker.Host}}"]);
+  if (!context.ok)
+    throw new Error(`Could not resolve the active Docker context endpoint. ${context.stderr.trim()}`);
+  const endpoint = context.stdout.trim();
+  return endpoint.startsWith("unix://") || endpoint.startsWith("npipe://");
+}
 async function waitForDeepHealth(directory, mode, secrets = []) {
   try {
     await waitForDeepHealthWithArgs(composeArgs(directory, mode), directory, secrets);
@@ -599,9 +1064,84 @@ ${captured}
 Diagnostics: ${diagnostics(directory, mode)}`);
   }
 }
-async function pullImage(image) {
+function packagedImageDigest(version) {
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(join(PACKAGE_ROOT, "package.json"), "utf8"));
+  } catch {
+    return;
+  }
+  if (manifest.version !== version || manifest.or3Cloud?.imageDigest === undefined)
+    return;
+  const digest = manifest.or3Cloud.imageDigest;
+  if (typeof digest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(digest)) {
+    throw new Error("This @or3/cloud package contains an invalid release image digest. Refusing to pull an unverified image.");
+  }
+  return digest;
+}
+function packagedOperatorImageDigest(version) {
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(join(PACKAGE_ROOT, "package.json"), "utf8"));
+  } catch {
+    return;
+  }
+  if (manifest.version !== version || manifest.or3Cloud?.operatorImageDigest === undefined)
+    return;
+  const digest = manifest.or3Cloud.operatorImageDigest;
+  if (typeof digest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(digest)) {
+    throw new Error("This @or3/cloud package contains an invalid dashboard operator image digest. Refusing to enable a mutable privileged runtime.");
+  }
+  return digest;
+}
+function packagedSourceRevision(version) {
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(join(PACKAGE_ROOT, "package.json"), "utf8"));
+  } catch {
+    return;
+  }
+  if (manifest.version !== version || manifest.or3Cloud?.sourceRevision === undefined)
+    return;
+  const revision = manifest.or3Cloud.sourceRevision;
+  if (typeof revision !== "string" || !/^[0-9a-f]{40}$/.test(revision)) {
+    throw new Error("This @or3/cloud package contains an invalid source revision. Refusing to run an unbound release image.");
+  }
+  return revision;
+}
+function expectedImageDigest(version) {
+  const packaged = packagedImageDigest(version);
+  const supplied = process.env.OR3_EXPECTED_IMAGE_DIGEST?.trim();
+  if (supplied && !/^sha256:[0-9a-f]{64}$/.test(supplied)) {
+    throw new Error("OR3_EXPECTED_IMAGE_DIGEST must be a complete sha256 digest.");
+  }
+  if (packaged && supplied && packaged !== supplied) {
+    throw new Error("The requested image digest does not match the authenticated @or3/cloud package.");
+  }
+  return packaged ?? supplied;
+}
+function expectedOperatorImageDigest(version) {
+  const packaged = packagedOperatorImageDigest(version);
+  const supplied = process.env.OR3_EXPECTED_OPERATOR_IMAGE_DIGEST?.trim();
+  if (supplied && !/^sha256:[0-9a-f]{64}$/.test(supplied)) {
+    throw new Error("OR3_EXPECTED_OPERATOR_IMAGE_DIGEST must be a complete sha256 digest.");
+  }
+  if (packaged && supplied && packaged !== supplied) {
+    throw new Error("The requested dashboard operator digest does not match the authenticated @or3/cloud package.");
+  }
+  return packaged ?? supplied;
+}
+async function pullImage(image, expectedDigest) {
   const local = await run("docker", ["image", "inspect", image]);
-  if (!local.ok && process.env.OR3_CLOUD_SKIP_PULL !== "true") {
+  if (local.ok) {
+    const localDigest = await imageDigest(image);
+    if (!expectedDigest || localDigest === expectedDigest)
+      return localDigest;
+    if (process.env.OR3_CLOUD_SKIP_PULL === "true") {
+      throw new Error(`Local image digest mismatch for ${image}. Expected ${expectedDigest}, found ${localDigest}, and OR3_CLOUD_SKIP_PULL=true prevents downloading the authenticated image.`);
+    }
+  }
+  if (process.env.OR3_CLOUD_SKIP_PULL !== "true") {
     const result = await run("docker", ["pull", image]);
     if (!result.ok) {
       const detail = result.stderr.trim();
@@ -610,10 +1150,14 @@ async function pullImage(image) {
       }
       throw new Error(`Could not download ${image}. Check your internet connection and Docker registry access, then retry. ${detail}`);
     }
-  } else if (!local.ok) {
+  } else {
     throw new Error(`${image} is not available locally and OR3_CLOUD_SKIP_PULL=true prevents downloading it.`);
   }
-  return imageDigest(image);
+  const actual = await imageDigest(image);
+  if (expectedDigest && actual !== expectedDigest) {
+    throw new Error(`Published image digest mismatch for ${image}. Expected the package-authenticated ${expectedDigest}, found ${actual}. The image tag may have been replaced; refusing to continue.`);
+  }
+  return actual;
 }
 function imageRepository(image) {
   const reference = image.split("@", 1)[0];
@@ -621,6 +1165,19 @@ function imageRepository(image) {
   const colon = reference.lastIndexOf(":");
   return colon > slash ? reference.slice(0, colon) : reference;
 }
+function imageAtDigest(image, digest) {
+  if (!/^sha256:[0-9a-f]{64}$/i.test(digest)) {
+    throw new Error(`Could not bind ${image} to a complete immutable image digest.`);
+  }
+  if (image.includes("@")) {
+    if (!image.endsWith(`@${digest}`))
+      throw new Error(`Image reference ${image} does not match expected digest ${digest}.`);
+    return image;
+  }
+  if (process.env.OR3_CLOUD_SKIP_PULL === "true")
+    return image;
+  return `${imageRepository(image)}@${digest}`;
+}
 async function requireImageDigest(image, expected, label) {
   const actual = await imageDigest(image);
   if (actual !== expected) {
@@ -629,12 +1186,30 @@ async function requireImageDigest(image, expected, label) {
   return actual;
 }
 async function pullAndRequireImage(image, expected, label) {
-  const actual = await pullImage(image);
+  const actual = await pullImage(image, expected);
   if (actual !== expected) {
     throw new Error(`${label} image digest mismatch for ${image}. Expected ${expected}, found ${actual}. The registry tag may have moved; refusing to mutate the deployment.`);
   }
   return actual;
 }
+function assertImageReleaseLabels(image, labels, version, expectedRevision) {
+  const revision = labels["org.opencontainers.image.revision"];
+  if (labels["org.opencontainers.image.source"] !== "https://github.com/Saluana/or3-chat" || labels["org.opencontainers.image.version"] !== version || typeof revision !== "string" || !/^[0-9a-f]{40}$/i.test(revision) || expectedRevision !== undefined && revision.toLowerCase() !== expectedRevision) {
+    throw new Error(`OR3 image ${image} does not carry the expected source/version release labels for ${version}.`);
+  }
+}
+async function assertImageReleaseIdentity(image, version) {
+  const result = await run("docker", ["image", "inspect", "--format", "{{json .Config.Labels}}", image]);
+  if (!result.ok)
+    throw new Error(`Could not inspect release labels for ${image}. ${result.stderr.trim()}`);
+  let labels;
+  try {
+    labels = JSON.parse(result.stdout.trim());
+  } catch {
+    throw new Error(`OR3 image ${image} has no readable release labels.`);
+  }
+  assertImageReleaseLabels(image, labels, version, packagedSourceRevision(version));
+}
 async function imageDigest(image) {
   const result = await run("docker", ["image", "inspect", "--format", "{{json .RepoDigests}}", image]);
   if (!result.ok)
@@ -668,15 +1243,19 @@ function assertSupportedArchitecture(manifest, hostArch) {
     throw new Error(`OR3 does not publish a ${hostArch} image for this version yet. Supported architectures: ${supported.join(", ") || "none detected"}. Install on a supported machine or wait for the next release.`);
   }
 }
-function hostArchitecture() {
-  if (process.arch === "arm64")
+async function dockerDaemonArchitecture() {
+  const result = await run("docker", ["info", "--format", "{{.Architecture}}"]);
+  if (!result.ok)
+    throw new Error(`Could not determine the selected Docker daemon architecture. ${result.stderr.trim()}`);
+  const architecture = result.stdout.trim().toLowerCase();
+  if (architecture === "arm64" || architecture === "aarch64")
     return "arm64";
-  if (process.arch === "x64")
+  if (architecture === "amd64" || architecture === "x86_64")
     return "amd64";
-  throw new Error(`OR3 supports only linux/amd64 and linux/arm64 hosts; this machine reports ${process.arch}. Install on a supported machine.`);
+  throw new Error(`OR3 supports only linux/amd64 and linux/arm64 Docker daemons; the selected daemon reports ${architecture || "no architecture"}.`);
 }
 async function assertSupportedHostArchitecture(image) {
-  const hostArch = hostArchitecture();
+  const hostArch = await dockerDaemonArchitecture();
   if (process.env.OR3_CLOUD_SKIP_PULL === "true") {
     const local = await run("docker", ["image", "inspect", "--format", "{{.Architecture}}", image]);
     if (local.ok && local.stdout.trim()) {
@@ -705,13 +1284,149 @@ function composeProjectNames(directory) {
     caddyConfig: `${base}-caddy-config`
   };
 }
+async function assertDockerProjectAbsent(project) {
+  for (const [resource, args] of [
+    ["container", ["ps", "-aq", "--filter", `label=com.docker.compose.project=${project}`]],
+    ["network", ["network", "ls", "-q", "--filter", `label=com.docker.compose.project=${project}`]]
+  ]) {
+    const result = await run("docker", args);
+    if (!result.ok) {
+      throw new Error(`Could not inspect Docker ${resource}s for Compose project ${project}. Refusing to continue while the daemon state is unknown. ${result.stderr.trim()}`);
+    }
+    if (result.stdout.trim()) {
+      throw new Error(`Docker ${resource}s already exist for Compose project ${project}. Choose a different target directory or inspect the existing project before continuing.`);
+    }
+  }
+}
+async function dashboardOperatorEnv(directory, version) {
+  if (process.platform !== "linux" || !process.getuid || !process.getgid)
+    return;
+  const expectedDigest = expectedOperatorImageDigest(version);
+  if (!expectedDigest)
+    return;
+  const configured = process.env.DOCKER_HOST?.trim();
+  if (configured && !configured.startsWith("unix://"))
+    return;
+  const socket = configured ? configured.slice("unix://".length) : "/var/run/docker.sock";
+  if (!isAbsolute(socket))
+    return;
+  let socketStat;
+  let uid;
+  let gid;
+  try {
+    socketStat = await stat(socket);
+    if (!socketStat.isSocket())
+      return;
+    uid = process.getuid();
+    gid = process.getgid();
+    if (!Number.isSafeInteger(uid) || uid < 0 || !Number.isSafeInteger(gid) || gid < 0)
+      return;
+  } catch {
+    return;
+  }
+  const operatorTag = operatorImageFor(version);
+  let digest;
+  try {
+    digest = await pullImage(operatorTag, expectedDigest);
+    await assertSupportedHostArchitecture(operatorTag);
+    await assertImageReleaseIdentity(operatorTag, version);
+  } catch {
+    return;
+  }
+  return {
+    OR3_DASHBOARD_UPDATES_ENABLED: "true",
+    OR3_OPERATOR_IMAGE: imageAtDigest(operatorTag, digest),
+    OR3_DEPLOYMENT_DIR: resolve(directory),
+    OR3_OPERATOR_UID: String(uid),
+    OR3_OPERATOR_GID: String(gid),
+    OR3_DOCKER_SOCKET: socket,
+    OR3_DOCKER_GID: String(socketStat.gid)
+  };
+}
+async function prepareDashboardOperatorIpc(directory, enabled) {
+  if (!enabled)
+    return;
+  const ipc = deploymentPaths(directory).operatorIpc;
+  await mkdir(ipc, { recursive: true, mode: 456 });
+  await chmod(ipc, 456);
+}
+async function verifyDashboardOperatorBridge(directory, operator) {
+  if (!operator)
+    return false;
+  const probe = `.operator-probe-${randomBytes(8).toString("hex")}`;
+  const result = await run("docker", [
+    "run",
+    "--rm",
+    "--network",
+    "none",
+    "--read-only",
+    "--user",
+    `${operator.OR3_OPERATOR_UID}:${operator.OR3_OPERATOR_GID}`,
+    "--group-add",
+    operator.OR3_DOCKER_GID,
+    "--mount",
+    `type=bind,src=${operator.OR3_DOCKER_SOCKET},dst=/var/run/docker.sock`,
+    "--mount",
+    `type=bind,src=${operator.OR3_DEPLOYMENT_DIR},dst=/deployment`,
+    "--workdir",
+    "/deployment",
+    "--tmpfs",
+    "/tmp:rw,noexec,nosuid,size=16m",
+    "--entrypoint",
+    "sh",
+    operator.OR3_OPERATOR_IMAGE,
+    "-c",
+    `docker version --format '{{.Server.Version}}' >/dev/null && umask 077 && : > .or3-cloud/operator-ipc/${probe} && test -O .or3-cloud/operator-ipc/${probe} && rm .or3-cloud/operator-ipc/${probe}`
+  ], directory);
+  if (!result.ok) {
+    return false;
+  }
+  return true;
+}
+async function prepareVerifiedDashboardOperator(directory, version) {
+  const candidate = await dashboardOperatorEnv(directory, version);
+  if (!candidate)
+    return;
+  try {
+    await prepareDashboardOperatorIpc(directory, true);
+    if (await verifyDashboardOperatorBridge(directory, candidate))
+      return candidate;
+  } catch {}
+  await rm(deploymentPaths(directory).operatorIpc, { recursive: true, force: true }).catch(() => {
+    return;
+  });
+  console.warn("Dashboard updates are unavailable on this Docker setup; the deployment will remain host-CLI managed.");
+  return;
+}
+var DASHBOARD_OPERATOR_ENV_KEYS = [
+  "OR3_DASHBOARD_UPDATES_ENABLED",
+  "OR3_OPERATOR_IMAGE",
+  "OR3_DEPLOYMENT_DIR",
+  "OR3_OPERATOR_UID",
+  "OR3_OPERATOR_GID",
+  "OR3_DOCKER_SOCKET",
+  "OR3_DOCKER_GID"
+];
+function withoutDashboardOperator(env) {
+  const result = { ...env };
+  for (const key of DASHBOARD_OPERATOR_ENV_KEYS)
+    delete result[key];
+  return result;
+}
+function withoutProvisioningCredentials(env) {
+  const result = { ...env };
+  for (const key of PROVISIONING_CREDENTIAL_KEYS)
+    delete result[key];
+  return result;
+}
 function buildEnv(input2) {
   const names = composeProjectNames(input2.directory);
   const secrets = input2.secrets ?? {};
   const publicOrigin = input2.mode === "public" ? `https://${input2.domain}` : `http://127.0.0.1:${input2.port}`;
   const values = {
     OR3_VERSION: input2.version,
-    OR3_IMAGE: imageFor(input2.version),
+    OR3_IMAGE: input2.image ?? imageFor(input2.version),
+    OR3_DEPLOYMENT_ID: input2.deploymentId ?? id("deployment"),
     OR3_COMPOSE_PROJECT: names.project,
     OR3_VOLUME_NAME: names.volume,
     OR3_CADDY_DATA_VOLUME: names.caddyData,
@@ -732,6 +1447,7 @@ function buildEnv(input2) {
     OR3_BASIC_AUTH_DB_PATH: "/data/auth.sqlite",
     OR3_BASIC_AUTH_BOOTSTRAP_EMAIL: input2.email,
     OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD: input2.password,
+    OR3_MANAGED_OWNER_EMAIL: input2.email,
     OR3_AUTH_INVITE_TOKEN_SECRET: secrets.OR3_AUTH_INVITE_TOKEN_SECRET ?? randomSecret(),
     OR3_SYNC_ENABLED: "true",
     OR3_CLOUD_SYNC_ENABLED: "true",
@@ -757,6 +1473,8 @@ function buildEnv(input2) {
     OR3_TRUST_PROXY: input2.mode === "public" ? "true" : "false",
     OR3_FORWARDED_FOR_HEADER: "x-forwarded-for"
   };
+  if (input2.dashboardOperator)
+    Object.assign(values, input2.dashboardOperator);
   return values;
 }
 function secretValues(env) {
@@ -795,12 +1513,21 @@ async function readPassword(flags) {
   return password;
 }
 function managedAssetNames(mode) {
+  return ["compose.yaml", "compose.operator.yaml", "dashboard-operator.mjs", ...mode === "public" ? ["compose.public.yaml", "Caddyfile"] : []];
+}
+function managedAssetNamesForInventory(mode, inventoryVersion) {
+  if (inventoryVersion === MANAGED_ASSET_INVENTORY_VERSION)
+    return managedAssetNames(mode);
+  if (inventoryVersion === 2) {
+    return ["compose.yaml", "dashboard-operator.mjs", ...mode === "public" ? ["compose.public.yaml", "Caddyfile"] : []];
+  }
   return ["compose.yaml", ...mode === "public" ? ["compose.public.yaml", "Caddyfile"] : []];
 }
 async function installManagedAssets(directory, assets) {
   await mkdir(directory, { recursive: true, mode: 448 });
   const token = randomBytes(4).toString("hex");
   const staged = [];
+  let retainRollbackCopies = false;
   try {
     for (const [name, contents] of assets) {
       const destination = join(directory, name);
@@ -821,16 +1548,29 @@ async function installManagedAssets(directory, assets) {
     const applied = [];
     try {
       for (const entry of staged) {
-        await rename(entry.replacement, entry.destination);
         applied.push(entry);
-        await chmod(entry.destination, 420);
+        await durableRename(entry.replacement, entry.destination);
+      }
+      for (const [name, contents] of assets) {
+        if (!(await readFile(join(directory, name))).equals(contents)) {
+          throw new Error(`Managed asset ${name} did not match its staged replacement after commit.`);
+        }
       }
     } catch (error) {
+      const rollbackErrors = [];
       for (const entry of applied.reverse()) {
-        if (entry.rollback)
-          await rename(entry.rollback, entry.destination);
-        else
-          await rm(entry.destination, { force: true });
+        try {
+          if (entry.rollback)
+            await durableRename(entry.rollback, entry.destination);
+          else
+            await rm(entry.destination, { force: true });
+        } catch (rollbackError) {
+          rollbackErrors.push(rollbackError instanceof Error ? rollbackError : new Error(String(rollbackError)));
+        }
+      }
+      if (rollbackErrors.length > 0) {
+        retainRollbackCopies = true;
+        throw new AggregateError([error, ...rollbackErrors], "Managed asset installation failed and one or more rollback copies could not be restored. Recovery copies were retained.");
       }
       throw error;
     }
@@ -839,7 +1579,7 @@ async function installManagedAssets(directory, assets) {
       await rm(entry.replacement, { force: true }).catch(() => {
         return;
       });
-      if (entry.rollback)
+      if (entry.rollback && !retainRollbackCopies)
         await rm(entry.rollback, { force: true }).catch(() => {
           return;
         });
@@ -859,6 +1599,8 @@ async function snapshotManagedAssets(directory, mode, backupDir) {
   await chmod(assetDir, 448);
   const checksums = {};
   for (const name of managedAssetNames(mode)) {
+    if ((name === "dashboard-operator.mjs" || name === "compose.operator.yaml") && !await fileExists(join(directory, name)))
+      continue;
     const destination = join(assetDir, name);
     await copySecure(join(directory, name), destination);
     checksums[name] = await sha256File(destination);
@@ -869,9 +1611,9 @@ async function verifiedManagedAssetContents(backupPath, manifest) {
   const checksums = manifest.managedAssetSha256;
   if (!checksums)
     return;
-  const expected = managedAssetNames(manifest.mode).sort();
+  const expected = managedAssetNamesForInventory(manifest.mode, manifest.managedAssetInventoryVersion).sort();
   const actual = Object.keys(checksums).sort();
-  if (actual.length !== expected.length || actual.some((name, index) => name !== expected[index])) {
+  if (manifest.managedAssetInventoryVersion !== undefined && manifest.managedAssetInventoryVersion !== 2 && manifest.managedAssetInventoryVersion !== MANAGED_ASSET_INVENTORY_VERSION || actual.length !== expected.length || actual.some((name, index) => name !== expected[index])) {
     throw new Error(`Backup ${manifest.backupId} has an invalid managed asset inventory.`);
   }
   const assets = new Map;
@@ -891,11 +1633,23 @@ async function verifiedManagedAssetContents(backupPath, manifest) {
 }
 async function restoreManagedAssets(directory, backupPath, manifest) {
   const assets = await verifiedManagedAssetContents(backupPath, manifest);
-  if (!assets)
-    return false;
+  if (!assets) {
+    throw new Error(`Backup ${manifest.backupId} predates authenticated managed-asset snapshots. Refusing to run its image under today's Compose/Caddy assets; restore with the exact historical @or3/cloud release after separately authenticating its assets.`);
+  }
   await installManagedAssets(directory, assets);
+  if (manifest.managedAssetInventoryVersion !== 2 && manifest.managedAssetInventoryVersion !== MANAGED_ASSET_INVENTORY_VERSION) {
+    await rm(join(directory, "dashboard-operator.mjs"), { force: true });
+  }
+  if (manifest.managedAssetInventoryVersion !== MANAGED_ASSET_INVENTORY_VERSION) {
+    await rm(join(directory, "compose.operator.yaml"), { force: true });
+  }
   return true;
 }
+function assertRestorableManagedAssets(manifest) {
+  if (!manifest.managedAssetSha256) {
+    throw new Error(`Backup ${manifest.backupId} predates authenticated managed-asset snapshots. Refusing to run its image under today's Compose/Caddy assets; restore with the exact historical @or3/cloud release after separately authenticating its assets.`);
+  }
+}
 async function checkPublicPrerequisites(domain) {
   validateDomain(domain);
   let address;
@@ -907,6 +1661,10 @@ async function checkPublicPrerequisites(domain) {
   return address;
 }
 async function markPending(directory, state, operation) {
+  const dashboardJobId = process.env.OR3_DASHBOARD_UPDATE_JOB_ID?.trim();
+  operation.origin = dashboardJobId ? "dashboard" : "cli";
+  if (dashboardJobId)
+    operation.dashboardJobId = dashboardJobId;
   state.incompleteOperation = operation;
   await writeState(directory, state);
   await writeSecure(join(deploymentPaths(directory).operations, `${operation.id}.json`), `${JSON.stringify(operation, null, 2)}
@@ -936,10 +1694,29 @@ async function clearPending(directory, state) {
 async function stopProject(directory, mode) {
   await compose(directory, mode, ["stop", "or3"]);
 }
+async function projectServiceRunning(directory, mode) {
+  const result = await run("docker", composeArgs(directory, mode, ["ps", "--status", "running", "-q", "or3"]), directory);
+  if (!result.ok)
+    throw new Error(`Could not determine whether OR3 is running. ${result.stderr.trim()}`);
+  return Boolean(result.stdout.trim());
+}
+async function sourceServiceRunning(directory, composeFiles) {
+  const result = await run("docker", [...sourceComposeArgs(directory, composeFiles), "ps", "--status", "running", "-q", "or3"], directory);
+  if (!result.ok)
+    throw new Error(`Could not determine whether the V1 OR3 service is running. ${result.stderr.trim()}`);
+  return Boolean(result.stdout.trim());
+}
+async function removeDashboardOperator(directory, mode) {
+  if (!dashboardUpdatesEnabled(directory))
+    return;
+  await compose(directory, mode, ["rm", "--stop", "--force", "or3-operator"]);
+}
 async function startProject(directory, mode, env) {
   await assertSafeComposeBinding(directory, mode, env);
-  await compose(directory, mode, ["up", "-d", "--wait", "--wait-timeout", "180"], secretValues(env));
+  const services = process.env.OR3_DASHBOARD_UPDATE_JOB_ID ? ["or3"] : [];
+  await compose(directory, mode, ["up", "-d", "--wait", "--wait-timeout", "180", ...services], secretValues(env));
   await waitForDeepHealth(directory, mode, secretValues(env));
+  await assertRunningAppImage(directory, mode, env.OR3_IMAGE);
 }
 function backupDirectory(directory, backupId) {
   return join(deploymentPaths(directory).backups, backupId);
@@ -954,7 +1731,22 @@ async function dataVolumeSize(directory, mode, env) {
   const exec = await run("docker", [...composeArgs(directory, mode, ["exec", "-T", "or3", "sh", "-c", "du -sb /data 2>/dev/null"])], directory);
   if (exec.ok)
     return parseDuOutput(exec.stdout);
-  const fallback = await run("docker", [...composeArgs(directory, mode, ["run", "--rm", "--no-deps", "--entrypoint", "sh", "or3", "-c", "du -sb /data 2>/dev/null"])], directory);
+  const fallback = await run("docker", [
+    "run",
+    "--rm",
+    "--network",
+    "none",
+    "--read-only",
+    "--cap-drop",
+    "ALL",
+    "-v",
+    `${env.OR3_VOLUME_NAME}:/data:ro`,
+    "--entrypoint",
+    "sh",
+    env.OR3_IMAGE,
+    "-c",
+    "du -sb /data 2>/dev/null"
+  ], directory);
   if (fallback.ok)
     return parseDuOutput(fallback.stdout);
   throw new Error(`Could not measure the data volume size for the free-space preflight. Start the deployment and retry. ${redact(`${exec.stderr} ${fallback.stderr}`)}`);
@@ -974,37 +1766,41 @@ async function removeNamedBackupArtifact(directory, backupId) {
   await rm(target, { recursive: true, force: true });
   await rm(join(deploymentPaths(directory).exports, `${backupId}.json`), { force: true });
 }
-async function readBackupManifestMetadata(backupPath) {
-  try {
-    const manifest = JSON.parse(await readText(join(backupPath, "manifest.json")));
-    if (manifest.schemaVersion !== 1 || !manifest.backupId || !manifest.createdAt)
-      return null;
-    return manifest;
-  } catch {
-    return null;
+async function removeEnumeratedBackupArtifact(directory, backup) {
+  const backupsRoot = resolve(deploymentPaths(directory).backups);
+  const target = resolve(backup.path);
+  if (dirname(target) !== backupsRoot || basename(target) !== backup.backupId || !BACKUP_ID_PATTERN.test(backup.backupId)) {
+    throw new Error(`Refusing to prune an untrusted backup path ${backup.path}.`);
   }
+  await rm(target, { recursive: true, force: true });
+  await rm(join(deploymentPaths(directory).exports, `${backup.backupId}.json`), { force: true });
 }
 async function enumerateBackups(directory) {
   const backupsRoot = deploymentPaths(directory).backups;
   let entries = [];
   try {
     entries = await readdir(backupsRoot);
-  } catch {
-    return [];
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return [];
+    throw new Error(`Could not enumerate managed backups at ${backupsRoot}: ${error instanceof Error ? error.message : String(error)}`);
   }
   const result = [];
   for (const entry of entries) {
+    if (!BACKUP_ID_PATTERN.test(entry)) {
+      throw new Error(`Backup store contains an unexpected artifact ${join(backupsRoot, entry)}. Refusing to use it for retention; inspect or remove it explicitly.`);
+    }
     const path = join(backupsRoot, entry);
-    const manifest = await readBackupManifestMetadata(path);
-    if (!manifest)
-      continue;
+    const manifest = await readManifest(path, directory);
+    if (manifest.backupId !== entry) {
+      throw new Error(`Backup directory ${path} does not match manifest ID ${manifest.backupId}. Refusing to use it for retention.`);
+    }
+    if (!Number.isFinite(Date.parse(manifest.createdAt))) {
+      throw new Error(`Backup ${manifest.backupId} has an invalid creation time.`);
+    }
     let bytes = 0;
-    try {
-      for (const file of ["data.tgz", "config.env", "manifest.json"]) {
-        bytes += (await stat(join(path, file))).size;
-      }
-    } catch {
-      bytes = 0;
+    for (const file of ["data.tgz", "config.env", "manifest.json", "manifest.auth"]) {
+      bytes += (await stat(join(path, file))).size;
     }
     result.push({
       backupId: manifest.backupId,
@@ -1044,8 +1840,11 @@ async function pruneBackups(directory, state, keep, force) {
     console.log(`--force --yes will permanently delete: ${targets.join(", ")}`);
   }
   for (const backupId of targets) {
-    await removeNamedBackupArtifact(directory, backupId);
-    console.log(`Deleted backup ${backupId} at ${backupDirectory(directory, backupId)}`);
+    const backup = backups.find((entry) => entry.backupId === backupId);
+    if (!backup)
+      throw new Error(`Retention selected backup ${backupId}, but its verified path disappeared before deletion.`);
+    await removeEnumeratedBackupArtifact(directory, backup);
+    console.log(`Deleted backup ${backupId} at ${backup.path}`);
   }
   return targets.length;
 }
@@ -1065,9 +1864,31 @@ function assertDeploymentIdentity(state, env) {
       throw new Error(`Managed state does not match ${key} in .env. Refusing to operate on an unexpected deployment identity.`);
     }
   }
+  const pending = state.incompleteOperation;
+  let pendingTargetImage;
+  if (pending?.targetImage) {
+    try {
+      pendingTargetImage = pending.targetImageDigest ? imageAtDigest(pending.targetImage, pending.targetImageDigest) : pending.targetImage;
+    } catch {
+      pendingTargetImage = undefined;
+    }
+  }
+  const journaledTarget = Boolean(pending && (pending.operation === "update" || pending.operation === "restore" || pending.operation === "rollback") && pending.targetVersion && pendingTargetImage && env.OR3_VERSION === pending.targetVersion && env.OR3_IMAGE === pendingTargetImage);
+  const journaledIdentityMigration = Boolean(journaledTarget && !state.deploymentId && pending?.targetDeploymentId && env[DEPLOYMENT_ID_ENV_KEY] === pending.targetDeploymentId);
+  if (state.deploymentId || env[DEPLOYMENT_ID_ENV_KEY]) {
+    if ((!state.deploymentId || env[DEPLOYMENT_ID_ENV_KEY] !== state.deploymentId) && !journaledIdentityMigration) {
+      throw new Error("Managed state does not match OR3_DEPLOYMENT_ID in .env. Refusing to operate on an unexpected deployment identity.");
+    }
+  }
+  if ((env.OR3_VERSION !== state.appVersion || env.OR3_IMAGE !== state.image) && !journaledTarget) {
+    throw new Error("Managed state does not match OR3_VERSION or OR3_IMAGE in .env. Refusing to create a backup or mutate an unverified release configuration.");
+  }
 }
 function assertDeploymentDirectoryIdentity(directory, state) {
   const resolved = resolve(directory);
+  if (state.deploymentRoot && resolve(state.deploymentRoot) !== resolved) {
+    throw new Error(`Managed deployment root is ${state.deploymentRoot}, not ${resolved}. Refusing to operate on a copied or relocated deployment; perform an explicit relocation before mutation.`);
+  }
   const names = composeProjectNames(resolved);
   const mismatches = [];
   if (state.composeProject !== names.project) {
@@ -1121,6 +1942,12 @@ function assertBackupMatchesDeployment(manifest, backupEnv, state, env) {
   if (manifest.caddyConfigVolume !== undefined && manifest.caddyConfigVolume !== state.caddyConfigVolume) {
     throw new Error(`Backup ${manifest.backupId} belongs to a different Caddy config volume.`);
   }
+  if (state.deploymentId && (manifest.deploymentId !== state.deploymentId || backupEnv.OR3_DEPLOYMENT_ID !== state.deploymentId)) {
+    const legacySnapshot = manifest.deploymentId === undefined && backupEnv.OR3_DEPLOYMENT_ID === undefined;
+    if (!legacySnapshot) {
+      throw new Error(`Backup ${manifest.backupId} belongs to a different immutable deployment identity.`);
+    }
+  }
   if (manifest.port !== undefined && manifest.port !== state.port) {
     throw new Error(`Backup ${manifest.backupId} belongs to port ${manifest.port}, not ${state.port}.`);
   }
@@ -1135,14 +1962,35 @@ async function sha256File(path) {
   });
   return digest.digest("hex");
 }
+function terminateChildProcess(child) {
+  if (child.killed)
+    return;
+  if (process.platform !== "win32" && child.pid) {
+    try {
+      process.kill(-child.pid, "SIGKILL");
+      return;
+    } catch {}
+  }
+  child.kill("SIGKILL");
+}
 async function streamCommandToFile(command, args, destination, cwd, secrets = []) {
   if (await fileExists(destination)) {
     throw new Error(`Refusing to overwrite existing archive ${destination}.`);
   }
   await mkdir(dirname(destination), { recursive: true, mode: 448 });
   const temporary = `${destination}.${randomBytes(8).toString("hex")}.partial`;
-  const child = spawn(command, args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
+  const child = spawn(command, args, {
+    cwd,
+    env: commandEnvironment(command, args, cwd),
+    detached: process.platform !== "win32",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
   let stderr = "";
+  let timedOut = false;
+  const timeout = setTimeout(() => {
+    timedOut = true;
+    terminateChildProcess(child);
+  }, STREAM_COMMAND_TIMEOUT_MS);
   child.stderr.setEncoding("utf8");
   child.stderr.on("data", (chunk) => {
     stderr = `${stderr}${chunk}`.slice(-64 * 1024);
@@ -1156,25 +2004,38 @@ async function streamCommandToFile(command, args, destination, cwd, secrets = []
       exit,
       pipeline(child.stdout, createWriteStream(temporary, { flags: "wx", mode: 384 }))
     ]);
+    if (timedOut)
+      throw new Error(`${command} exceeded the ${STREAM_COMMAND_TIMEOUT_MS / 1000}-second archive deadline.`);
     if (exitCode !== 0) {
       throw new Error(`${command} ${args.join(" ")} exited with ${exitCode}. ${redact(stderr, secrets)}`.trim());
     }
     await chmod(temporary, 384);
-    await rename(temporary, destination);
+    await durableRename(temporary, destination);
   } catch (error) {
-    if (!child.killed)
-      child.kill("SIGTERM");
+    terminateChildProcess(child);
     await rm(temporary, { force: true }).catch(() => {
       return;
     });
     const detail = error instanceof Error ? error.message : String(error);
     throw new Error(`${detail}${stderr && !detail.includes(stderr) ? `
 ${redact(stderr, secrets)}` : ""}`);
+  } finally {
+    clearTimeout(timeout);
   }
 }
 async function streamFileToCommand(command, args, source, cwd, secrets = []) {
-  const child = spawn(command, args, { cwd, stdio: ["pipe", "ignore", "pipe"] });
+  const child = spawn(command, args, {
+    cwd,
+    env: commandEnvironment(command, args, cwd),
+    detached: process.platform !== "win32",
+    stdio: ["pipe", "ignore", "pipe"]
+  });
   let stderr = "";
+  let timedOut = false;
+  const timeout = setTimeout(() => {
+    timedOut = true;
+    terminateChildProcess(child);
+  }, STREAM_COMMAND_TIMEOUT_MS);
   child.stderr.setEncoding("utf8");
   child.stderr.on("data", (chunk) => {
     stderr = `${stderr}${chunk}`.slice(-64 * 1024);
@@ -1188,15 +2049,18 @@ async function streamFileToCommand(command, args, source, cwd, secrets = []) {
       exit,
       pipeline(createReadStream(source), child.stdin)
     ]);
+    if (timedOut)
+      throw new Error(`${command} exceeded the ${STREAM_COMMAND_TIMEOUT_MS / 1000}-second archive deadline.`);
     if (exitCode !== 0) {
       throw new Error(`${command} ${args.join(" ")} exited with ${exitCode}. ${redact(stderr, secrets)}`.trim());
     }
   } catch (error) {
-    if (!child.killed)
-      child.kill("SIGTERM");
+    terminateChildProcess(child);
     const detail = error instanceof Error ? error.message : String(error);
     throw new Error(`${detail}${stderr && !detail.includes(stderr) ? `
 ${redact(stderr, secrets)}` : ""}`);
+  } finally {
+    clearTimeout(timeout);
   }
 }
 async function gzipUncompressedBytes(path) {
@@ -1214,38 +2078,121 @@ async function volumeArchive(directory, mode, env, backupDir) {
   await streamCommandToFile("docker", composeArgs(directory, mode, [
     "run",
     "--rm",
-    "--no-deps",
+    "--no-deps",
+    "--entrypoint",
+    "sh",
+    "or3",
+    "-c",
+    "tar czf - -C /data ."
+  ]), join(backupDir, "data.tgz"), directory, secretValues(env));
+}
+async function archiveExternalVolume(image, volume, backupDir) {
+  await streamCommandToFile("docker", [
+    "run",
+    "--rm",
+    "--network",
+    "none",
+    "--read-only",
+    "--user",
+    "0:0",
+    "--security-opt",
+    "no-new-privileges:true",
+    "--cap-drop",
+    "ALL",
+    "--cap-add",
+    "DAC_READ_SEARCH",
+    "--tmpfs",
+    "/tmp:rw,noexec,nosuid,size=16m",
+    "-v",
+    `${volume}:/source:ro`,
+    image,
+    "sh",
+    "-c",
+    "tar czf - -C /source ."
+  ], join(backupDir, "data.tgz"));
+}
+async function restoreVolumeArchive(directory, mode, env, backupPath) {
+  const state = await readState(directory);
+  await ensureManagedDataVolume(directory, mode, state, env);
+  const clear = await run("docker", [
+    "run",
+    "--rm",
+    "--network",
+    "none",
+    "--user",
+    "0:0",
+    "--read-only",
+    "--cap-drop",
+    "ALL",
+    "--cap-add",
+    "DAC_OVERRIDE",
+    "--cap-add",
+    "FOWNER",
+    "--security-opt",
+    "no-new-privileges:true",
+    "-v",
+    `${state.volumeName}:/data`,
+    "--entrypoint",
+    "sh",
+    env.OR3_IMAGE,
+    "-c",
+    "find /data -mindepth 1 -delete"
+  ], directory);
+  if (!clear.ok) {
+    throw new Error(`Could not safely clear the managed data volume before restore. ${redact(clear.stderr, secretValues(env))}`);
+  }
+  await streamFileToCommand("docker", [
+    "run",
+    "--rm",
+    "-i",
+    "--network",
+    "none",
+    "--read-only",
+    "--security-opt",
+    "no-new-privileges:true",
+    "--cap-drop",
+    "ALL",
+    "-v",
+    `${state.volumeName}:/data`,
     "--entrypoint",
     "sh",
-    "or3",
+    env.OR3_IMAGE,
     "-c",
-    "tar czf - -C /data ."
-  ]), join(backupDir, "data.tgz"), directory, secretValues(env));
-}
-async function archiveExternalVolume(image, volume, backupDir) {
-  await streamCommandToFile("docker", ["run", "--rm", "--user", "0:0", "-v", `${volume}:/source:ro`, image, "sh", "-c", "tar czf - -C /source ."], join(backupDir, "data.tgz"));
+    "tar xzf - -C /data"
+  ], join(backupPath, "data.tgz"), directory, secretValues(env));
 }
-async function restoreVolumeArchive(directory, mode, env, backupPath) {
-  await streamFileToCommand("docker", composeArgs(directory, mode, [
+async function validateVolumeArchive(directory, _mode, env, backupPath) {
+  await streamFileToCommand("docker", [
     "run",
     "--rm",
-    "-T",
-    "--no-deps",
+    "-i",
+    "--network",
+    "none",
+    "--read-only",
+    "--security-opt",
+    "no-new-privileges:true",
+    "--cap-drop",
+    "ALL",
     "--entrypoint",
     "sh",
-    "or3",
+    env.OR3_IMAGE,
     "-c",
-    "find /data -mindepth 1 -delete && tar xzf - -C /data"
-  ]), join(backupPath, "data.tgz"), directory, secretValues(env));
+    "tar tzf - >/dev/null"
+  ], join(backupPath, "data.tgz"), directory, secretValues(env));
 }
-async function createBackup(directory, state, env) {
+async function createBackup(directory, state, env, options = {}) {
+  const restartAfter = options.restartAfter ?? true;
   await requireImageDigest(state.image, state.imageDigest, "Current deployment");
-  const backupId = id("backup");
+  const backupId = options.backupId ?? id("backup");
+  if (!BACKUP_ID_PATTERN.test(backupId))
+    throw new Error(`Backup ID ${backupId} is invalid.`);
   const backupDir = backupDirectory(directory, backupId);
+  const initiallyRunning = options.initiallyRunning ?? await projectServiceRunning(directory, state.mode);
   const volumeSize = await dataVolumeSize(directory, state.mode, env);
   await assertFreeSpaceForArchive(backupDir, volumeSize, "Backup");
   let manifestWritten = false;
   let stopAttempted = false;
+  let backupFailure;
   try {
     await mkdir(backupDir, { recursive: true, mode: 448 });
     await chmod(backupDir, 448);
@@ -1265,44 +2212,53 @@ async function createBackup(directory, state, env) {
       dataBytes: volumeSize,
       configSha256: await sha256File(join(backupDir, "config.env")),
       managedAssetSha256,
+      managedAssetInventoryVersion: managedAssetSha256["compose.operator.yaml"] ? MANAGED_ASSET_INVENTORY_VERSION : managedAssetSha256["dashboard-operator.mjs"] ? 2 : undefined,
       mode: state.mode,
       domain: state.domain,
       composeProject: state.composeProject,
       volumeName: state.volumeName,
       caddyDataVolume: state.caddyDataVolume,
       caddyConfigVolume: state.caddyConfigVolume,
+      deploymentId: state.deploymentId,
       port: state.port
     };
-    await writeSecure(join(backupDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
-`);
+    const manifestContents = `${JSON.stringify(manifest, null, 2)}
+`;
+    await writeSecure(join(backupDir, "manifest.json"), manifestContents);
+    await writeBackupAuthentication(directory, backupDir, manifestContents);
+    const verifiedManifest = await readManifest(backupDir, directory);
     manifestWritten = true;
-    try {
-      await pruneBackups(directory, state, BACKUP_RETENTION_KEEP, false);
-    } catch (error) {
-      console.log(`Warning: automatic backup retention could not run: ${error instanceof Error ? error.message : String(error)}`);
-    }
-    return { backupId, backupDir, manifest };
+    return { backupId, backupDir, manifest: verifiedManifest };
   } catch (error) {
     if (!manifestWritten) {
       await removeNamedBackupArtifact(directory, backupId).catch(() => {
         return;
       });
-      throw new Error(`${error instanceof Error ? error.message : String(error)} The partial backup artifact at ${backupDir} was removed.`);
+      backupFailure = new Error(`${error instanceof Error ? error.message : String(error)} The partial backup artifact at ${backupDir} was removed.`);
+      throw backupFailure;
     }
+    backupFailure = error instanceof Error ? error : new Error(String(error));
     throw error;
   } finally {
-    if (stopAttempted) {
+    if (stopAttempted && restartAfter && initiallyRunning) {
       try {
         await startProject(directory, state.mode, env);
       } catch (error) {
+        const restartFailure = error instanceof Error ? error : new Error(String(error));
+        if (backupFailure) {
+          throw new AggregateError([backupFailure, restartFailure], `Backup failed and OR3 could not restart. Primary failure: ${backupFailure.message}. Restart failure: ${restartFailure.message}`);
+        }
         throw new Error(`Backup was created but OR3 could not restart: ${error instanceof Error ? error.message : String(error)}`);
       }
     }
   }
 }
-async function readManifest(backupPath) {
-  const manifest = JSON.parse(await readText(join(backupPath, "manifest.json")));
-  if (manifest.schemaVersion !== 1 || !manifest.backupId || !isVersion(manifest.appVersion) || !manifest.image || !/^sha256:[0-9a-f]{64}$/i.test(manifest.imageDigest) || manifest.dataBytes !== undefined && (!Number.isSafeInteger(manifest.dataBytes) || manifest.dataBytes < 0)) {
+async function readManifest(backupPath, authenticatedForDirectory) {
+  const manifestContents = await readText(join(backupPath, "manifest.json"));
+  if (authenticatedForDirectory)
+    await assertBackupAuthentication(authenticatedForDirectory, backupPath, manifestContents);
+  const manifest = JSON.parse(manifestContents);
+  if (manifest.schemaVersion !== 1 || !BACKUP_ID_PATTERN.test(manifest.backupId) || !Number.isFinite(Date.parse(manifest.createdAt)) || !isVersion(manifest.appVersion) || !manifest.image || !/^sha256:[0-9a-f]{64}$/i.test(manifest.imageDigest) || !/^[0-9a-f]{64}$/i.test(manifest.dataSha256) || !/^[0-9a-f]{64}$/i.test(manifest.configSha256 ?? "") || manifest.dataBytes !== undefined && (!Number.isSafeInteger(manifest.dataBytes) || manifest.dataBytes < 0)) {
     throw new Error(`Invalid backup manifest at ${backupPath}.`);
   }
   const actual = await sha256File(join(backupPath, "data.tgz"));
@@ -1316,6 +2272,18 @@ async function readManifest(backupPath) {
   await verifiedManagedAssetContents(backupPath, manifest);
   return manifest;
 }
+async function cleanupJournaledPartialBackup(directory, backupId, backupPath) {
+  if (!backupId || !backupPath || !BACKUP_ID_PATTERN.test(backupId))
+    return;
+  const expectedPath = resolve(backupDirectory(directory, backupId));
+  if (resolve(backupPath) !== expectedPath || !await fileExists(expectedPath))
+    return;
+  try {
+    await readManifest(expectedPath, directory);
+  } catch {
+    await removeNamedBackupArtifact(directory, backupId);
+  }
+}
 async function dataVolumeFreeBytes(directory, mode, env) {
   const parse = (stdout) => {
     const blocks = Number(stdout.trim());
@@ -1327,7 +2295,22 @@ async function dataVolumeFreeBytes(directory, mode, env) {
   const exec = await run("docker", [...composeArgs(directory, mode, ["exec", "-T", "or3", "sh", "-c", script])], directory);
   if (exec.ok)
     return parse(exec.stdout);
-  const fallback = await run("docker", [...composeArgs(directory, mode, ["run", "--rm", "--no-deps", "--entrypoint", "sh", "or3", "-c", script])], directory);
+  const fallback = await run("docker", [
+    "run",
+    "--rm",
+    "--network",
+    "none",
+    "--read-only",
+    "--cap-drop",
+    "ALL",
+    "-v",
+    `${env.OR3_VOLUME_NAME}:/data:ro`,
+    "--entrypoint",
+    "sh",
+    env.OR3_IMAGE,
+    "-c",
+    script
+  ], directory);
   if (fallback.ok)
     return parse(fallback.stdout);
   throw new Error(`Could not measure free space in the Docker data volume. ${redact(`${exec.stderr} ${fallback.stderr}`, secretValues(env))}`);
@@ -1336,10 +2319,12 @@ async function assertRestoreFreeSpace(directory, state, env, manifest, backupPat
   const archiveBytes = await gzipUncompressedBytes(join(backupPath, "data.tgz"));
   const requiredBytes = Math.max(manifest.dataBytes ?? 0, archiveBytes);
   const freeBytes = await dataVolumeFreeBytes(directory, state.mode, env);
-  assertEnoughFreeSpace(freeBytes, requiredBytes, "Restore");
+  const reclaimableBytes = await dataVolumeSize(directory, state.mode, env);
+  assertEnoughFreeSpace(freeBytes + reclaimableBytes, requiredBytes, "Restore");
 }
-async function restoreBackupData(directory, state, env, backupPath) {
-  const manifest = await readManifest(backupPath);
+async function restoreBackupData(directory, state, env, backupPath, options = {}) {
+  const manifest = await readManifest(backupPath, directory);
+  assertRestorableManagedAssets(manifest);
   const backupEnv = parseEnv(await readText(join(backupPath, "config.env")));
   if (backupEnv.OR3_VERSION !== manifest.appVersion || backupEnv.OR3_IMAGE !== manifest.image) {
     throw new Error(`Backup ${manifest.backupId} configuration does not match its manifest.`);
@@ -1347,30 +2332,28 @@ async function restoreBackupData(directory, state, env, backupPath) {
   assertBackupMatchesDeployment(manifest, backupEnv, state, env);
   if (manifest.imageDigest)
     await requireImageDigest(manifest.image, manifest.imageDigest, `Backup ${manifest.backupId}`);
+  await validateVolumeArchive(directory, state.mode, env, backupPath);
+  await ensureManagedDataVolume(directory, state.mode, state, env);
   await assertRestoreFreeSpace(directory, state, env, manifest, backupPath);
-  let started = false;
-  let stopAttempted = false;
-  try {
-    stopAttempted = true;
+  const restoresOperatorOverlay = manifest.managedAssetInventoryVersion === MANAGED_ASSET_INVENTORY_VERSION && Boolean(manifest.managedAssetSha256?.["compose.operator.yaml"]);
+  const restoredEnv = restoresOperatorOverlay ? {
+    ...backupEnv,
+    OR3_IMAGE: imageAtDigest(manifest.image, manifest.imageDigest)
+  } : withoutDashboardOperator({
+    ...backupEnv,
+    OR3_IMAGE: imageAtDigest(manifest.image, manifest.imageDigest)
+  });
+  if (options.recreateDataVolume)
+    await removeManagedDataVolumeForRecreation(directory, state);
+  else
     await stopProject(directory, state.mode);
-    await copySecure(join(backupPath, "config.env"), deploymentPaths(directory).env);
-    await restoreManagedAssets(directory, backupPath, manifest);
-    await restoreVolumeArchive(directory, state.mode, backupEnv, backupPath);
-    const restoredEnv = parseEnv(await readText(deploymentPaths(directory).env));
-    await startProject(directory, state.mode, restoredEnv);
-    started = true;
-  } catch (error) {
-    let restartError = "";
-    if (stopAttempted && !started) {
-      try {
-        const recoveryEnv = parseEnv(await readText(deploymentPaths(directory).env));
-        await startProject(directory, state.mode, recoveryEnv);
-      } catch (recovery) {
-        restartError = ` OR3 could not be restarted: ${recovery instanceof Error ? recovery.message : String(recovery)}`;
-      }
-    }
-    throw new Error(`Restore failed for ${manifest.backupId}: ${error instanceof Error ? error.message : String(error)}${restartError}`);
+  if (dashboardUpdatesEnabled(directory) && restoredEnv.OR3_DASHBOARD_UPDATES_ENABLED !== "true" && !process.env.OR3_DASHBOARD_UPDATE_JOB_ID) {
+    await removeDashboardOperator(directory, state.mode);
   }
+  await writeSecure(deploymentPaths(directory).env, serializeEnv(restoredEnv));
+  await restoreManagedAssets(directory, backupPath, manifest);
+  await restoreVolumeArchive(directory, state.mode, restoredEnv, backupPath);
+  await startProject(directory, state.mode, restoredEnv);
   return manifest;
 }
 function stateFromEnv(directory, env, mode, operation, digest) {
@@ -1381,6 +2364,8 @@ function stateFromEnv(directory, env, mode, operation, digest) {
     volumeName: env.OR3_VOLUME_NAME,
     caddyDataVolume: mode === "public" ? env.OR3_CADDY_DATA_VOLUME : undefined,
     caddyConfigVolume: mode === "public" ? env.OR3_CADDY_CONFIG_VOLUME : undefined,
+    deploymentId: env.OR3_DEPLOYMENT_ID,
+    deploymentRoot: resolve(directory),
     appVersion: env.OR3_VERSION,
     image: env.OR3_IMAGE,
     imageDigest: digest,
@@ -1400,8 +2385,9 @@ Usage:
   npx @or3/cloud backup [list|prune [--keep <n>]|export <backup-id> <destination-dir>]
   npx @or3/cloud restore <backup-id-or-path> --yes
   npx @or3/cloud rollback --yes
-  npx @or3/cloud credentials reset --yes [--owner-password <p> --admin-password <p>]
+  npx @or3/cloud credentials reset --yes [--owner-password-file <path> --admin-password-file <path>]
   npx @or3/cloud doctor
+  npx @or3/cloud verify [--public] [--verification-email <email> --verification-password-file <path>]
   npx @or3/cloud recover
   npx @or3/cloud adopt --from <v1-directory> [directory]
   npx @or3/cloud status
@@ -1412,12 +2398,16 @@ Usage:
 Options:
   --admin-email <email>          Administrator email for first login
   --admin-password <password>    Explicit password (prefer --admin-password-file); for credentials reset, the new admin password
-  --admin-password-file <path>   Read the bootstrap password without shell history
+  --admin-password-file <path>   Read the bootstrap/reset admin password without shell history
   --owner-password <password>    New owner (basic auth) password for credentials reset
+  --owner-password-file <path>   Read the new owner password without shell history
+  --verification-email <email>   Current owner email used only for this verification
+  --verification-password-file <path>  Read the current owner password for this verification
   --port <port>                  Local OR3 port (default: 3000)
   --keep <n>                     Backups to retain when pruning (default: 5)
   --force                        Prune backups even when referenced by the rollback point
   --tail <n>                     Log lines to show (default: 200)
+  --public                       Require verification through the public HTTPS origin
   --purge-data                   Remove data volumes and managed files (with remove)
   --yes                          Confirm a destructive restore, rollback, credentials reset, or purge
   --help                         Show this help
@@ -1447,9 +2437,10 @@ async function initCommand(positionals, flags) {
     throw new Error("--port must be a valid TCP port.");
   if (mode === "public" && [80, 443].includes(port))
     throw new Error("Public mode reserves ports 80 and 443 for Caddy; choose another --port for OR3.");
-  if (!await portAvailable(port))
+  const localDockerDaemon = await dockerDaemonIsLocal();
+  if (localDockerDaemon && !await portAvailable(port))
     throw new Error(`Port ${port} is already in use. Choose another port with --port.`);
-  if (mode === "public") {
+  if (mode === "public" && localDockerDaemon) {
     for (const publicPort of [80, 443]) {
       if (!await portAvailable(publicPort))
         throw new Error(`Public port ${publicPort} is already in use. Stop the conflicting service before starting Caddy.`);
@@ -1457,23 +2448,31 @@ async function initCommand(positionals, flags) {
   }
   await ensureDocker();
   const names = composeProjectNames(directory);
+  await assertDockerProjectAbsent(names.project);
   for (const volume of [names.volume, ...mode === "public" ? [names.caddyData, names.caddyConfig] : []]) {
     const existing = await run("docker", ["volume", "inspect", volume]);
     if (existing.ok)
       throw new Error(`Docker volume ${volume} already exists. Choose a new directory or inspect it before initializing.`);
+    if (existing.exitCode !== 1 || !/no such volume/i.test(`${existing.stdout}
+${existing.stderr}`)) {
+      throw new Error(`Could not confirm whether Docker volume ${volume} exists. Refusing initialization until Docker returns an explicit not-found result. ${existing.stderr.trim()}`);
+    }
   }
   const email = await resolveAdminEmail(flags);
   const password = await readPassword(flags);
   const version = PACKAGE_VERSION;
-  const image = imageFor(version);
-  await pullImage(image);
-  await assertSupportedHostArchitecture(image);
+  const imageTag = imageFor(version);
+  const digest = await pullImage(imageTag, expectedImageDigest(version));
+  await assertSupportedHostArchitecture(imageTag);
+  await assertImageReleaseIdentity(imageTag, version);
+  const image = imageAtDigest(imageTag, digest);
   await mkdir(directory, { recursive: true, mode: 448 });
   await chmod(directory, 448);
   await mkdir(deploymentPaths(directory).operations, { recursive: true, mode: 448 });
   await mkdir(deploymentPaths(directory).backups, { recursive: true, mode: 448 });
+  const operator = await prepareVerifiedDashboardOperator(directory, version);
   await copyAssets(directory, mode);
-  const env = buildEnv({ mode, version, directory, email, password, domain, port });
+  const env = buildEnv({ mode, version, directory, image, email, password, domain, port, dashboardOperator: operator });
   await writeSecure(deploymentPaths(directory).env, serializeEnv(env));
   await writeSecure(join(directory, ".or3-initial-credentials"), serializeInitialCredentials({
     bootstrapEmail: email,
@@ -1481,7 +2480,6 @@ async function initCommand(positionals, flags) {
     adminUsername: email,
     adminPassword: password
   }));
-  const digest = await imageDigest(image);
   const state = stateFromEnv(directory, env, mode, "init", digest);
   await markPending(directory, state, {
     id: id("init"),
@@ -1491,12 +2489,19 @@ async function initCommand(positionals, flags) {
   });
   try {
     await startProject(directory, mode, env);
+    await provisionManagedCredentials(mode === "public" ? new URL(`https://${domain}`) : new URL(`http://127.0.0.1:${port}`), email, password);
+    const runtimeEnv = withoutProvisioningCredentials(env);
+    await writeSecure(deploymentPaths(directory).env, serializeEnv(runtimeEnv));
+    await stopProject(directory, mode);
+    await startProject(directory, mode, runtimeEnv);
     await clearPending(directory, state);
     console.log(`
 OR3 Cloud ${version} is running at ${mode === "public" ? `https://${domain}` : `http://127.0.0.1:${port}`}`);
     console.log(`Credentials were written to ${join(directory, ".or3-initial-credentials")} (mode 0600). Save them, then remove that file.`);
     console.log(`
 Check: cd ${quote(directory)} && npx @or3/cloud doctor`);
+    if (operator)
+      console.log("Dashboard updates are enabled for super admins in Operations.");
   } catch (error) {
     state.lastError = redact(error instanceof Error ? error.message : String(error), secretValues(env));
     await writeState(directory, state);
@@ -1512,6 +2517,7 @@ async function loadManaged(directory = process.cwd()) {
   const state = await readState(resolved);
   const env = parseEnv(await readText(deploymentPaths(resolved).env));
   assertDeploymentIdentity(state, env);
+  assertDeploymentDirectoryIdentity(resolved, state);
   return { directory: resolved, state, env };
 }
 function operationToStateOperation(operation, fallback) {
@@ -1523,6 +2529,14 @@ async function commitRecoveredState(directory, previous, next) {
   await removeOperationRecord(directory, previous.incompleteOperation?.id);
   await writeState(directory, next);
 }
+async function commitPreMutationRecovery(directory, state, message) {
+  const restoredEnv = parseEnv(await readText(deploymentPaths(directory).env));
+  const recovered = stateFromEnv(directory, restoredEnv, state.mode, state.lastSuccessfulOperation, await imageDigest(restoredEnv.OR3_IMAGE));
+  recovered.rollback = state.rollback;
+  recovered.lastError = message;
+  await commitRecoveredState(directory, state, recovered);
+  return recovered;
+}
 async function recoverCommand(directory) {
   await ensureDocker();
   const loaded = await loadManaged(directory);
@@ -1532,6 +2546,14 @@ async function recoverCommand(directory) {
     return;
   }
   try {
+    if (pending.phase === "prepared") {
+      if (pending.operation === "backup" || pending.operation === "update" || pending.operation === "adopt") {
+        await cleanupJournaledPartialBackup(loaded.directory, pending.backupId, pending.backupPath);
+      }
+      if (pending.operation === "restore" || pending.operation === "rollback") {
+        await cleanupJournaledPartialBackup(loaded.directory, pending.previousBackupId, pending.previousBackupPath);
+      }
+    }
     if (pending.operation === "credentials-reset") {
       const nextEnv = pending.credentialReset?.nextEnv;
       if (!nextEnv)
@@ -1543,95 +2565,69 @@ async function recoverCommand(directory) {
       return;
     }
     if (pending.operation === "restore" || pending.operation === "rollback") {
-      if (!pending.backupId)
-        throw new Error(`The incomplete ${pending.operation} has no recorded backup ID.`);
-      const backupPath = await resolveBackup(loaded.directory, pending.backupId);
-      const manifest = await readManifest(backupPath);
-      const backupEnv = parseEnv(await readText(join(backupPath, "config.env")));
-      if (backupEnv.OR3_VERSION !== manifest.appVersion || backupEnv.OR3_IMAGE !== manifest.image) {
-        throw new Error(`Backup ${manifest.backupId} configuration does not match its manifest.`);
+      if (pending.phase === "prepared" || pending.phase === "snapshot-created") {
+        await startProject(loaded.directory, loaded.state.mode, loaded.env);
+        loaded.state.lastError = undefined;
+        await clearPending(loaded.directory, loaded.state);
+        console.log(`Recovered the incomplete ${pending.operation} before data replacement. OR3 ${loaded.state.appVersion} is deeply healthy.`);
+        return;
       }
-      if (pending.targetVersion && pending.targetVersion !== manifest.appVersion || pending.targetImage && pending.targetImage !== manifest.image || pending.targetImageDigest && pending.targetImageDigest !== manifest.imageDigest) {
-        throw new Error(`Backup ${manifest.backupId} does not match the recorded ${pending.operation} target.`);
+      if (!pending.previousBackupPath && !pending.previousBackupId) {
+        throw new Error(`The incomplete ${pending.operation} has no verified pre-mutation snapshot. Refusing to replay a target that may have been partially restored; inspect the deployment and restore an authenticated backup explicitly.`);
       }
-      assertBackupMatchesDeployment(manifest, backupEnv, loaded.state, loaded.env);
-      await pullAndRequireImage(manifest.image, manifest.imageDigest, `Backup ${manifest.backupId}`);
-      await restoreBackupData(loaded.directory, loaded.state, loaded.env, backupPath);
-      const restoredEnv = parseEnv(await readText(deploymentPaths(loaded.directory).env));
-      const restored = stateFromEnv(loaded.directory, restoredEnv, loaded.state.mode, "restore", await imageDigest(restoredEnv.OR3_IMAGE));
-      restored.lastError = undefined;
-      await commitRecoveredState(loaded.directory, loaded.state, restored);
-      console.log(`Recovered the incomplete ${pending.operation} operation from backup ${manifest.backupId}. OR3 ${restored.appVersion} is deeply healthy.`);
+      const previous = await restorePreMutationSnapshot(loaded.directory, loaded.state, loaded.env);
+      const recovered2 = await commitPreMutationRecovery(loaded.directory, loaded.state, `Interrupted ${pending.operation} was rolled back to pre-mutation snapshot ${previous.manifest.backupId}.`);
+      console.log(`Recovered the incomplete ${pending.operation} by restoring pre-mutation snapshot ${previous.manifest.backupId}. OR3 ${recovered2.appVersion} is deeply healthy.`);
       return;
     }
     if (pending.operation === "update") {
-      const oldDeployment = loaded.env.OR3_VERSION === loaded.state.appVersion && loaded.env.OR3_IMAGE === loaded.state.image;
-      if (oldDeployment) {
+      if (pending.phase === "prepared" || pending.phase === "snapshot-created") {
         await pullAndRequireImage(loaded.state.image, loaded.state.imageDigest, "Current deployment");
         await startProject(loaded.directory, loaded.state.mode, loaded.env);
-        const recovered2 = stateFromEnv(loaded.directory, loaded.env, loaded.state.mode, loaded.state.lastSuccessfulOperation, await imageDigest(loaded.env.OR3_IMAGE));
-        recovered2.rollback = loaded.state.rollback;
-        recovered2.lastError = undefined;
-        await commitRecoveredState(loaded.directory, loaded.state, recovered2);
-        console.log(`Recovered the incomplete update before the replacement was applied. OR3 ${recovered2.appVersion} is deeply healthy.`);
+        const recovered3 = stateFromEnv(loaded.directory, loaded.env, loaded.state.mode, loaded.state.lastSuccessfulOperation, await imageDigest(loaded.env.OR3_IMAGE));
+        recovered3.rollback = loaded.state.rollback;
+        recovered3.lastError = undefined;
+        await commitRecoveredState(loaded.directory, loaded.state, recovered3);
+        console.log(`Recovered the incomplete update before the replacement was applied. OR3 ${recovered3.appVersion} is deeply healthy.`);
         return;
       }
-      if (!pending.backupId || loaded.env.OR3_VERSION !== pending.targetVersion || loaded.env.OR3_IMAGE !== pending.targetImage) {
-        throw new Error("The incomplete update has an unknown .env version/image. Refusing to guess which image or data should be live.");
-      }
-      const backupPath = await resolveBackup(loaded.directory, pending.backupId);
-      const manifest = await readManifest(backupPath);
-      const backupEnv = parseEnv(await readText(join(backupPath, "config.env")));
-      if (backupEnv.OR3_VERSION !== manifest.appVersion || backupEnv.OR3_IMAGE !== manifest.image) {
-        throw new Error(`Backup ${manifest.backupId} configuration does not match its manifest.`);
-      }
-      assertBackupMatchesDeployment(manifest, backupEnv, loaded.state, loaded.env);
-      if (pending.targetVersion !== PACKAGE_VERSION) {
-        throw new Error(`This interrupted update targets OR3 ${pending.targetVersion}. Run \`npx --yes @or3/cloud@${pending.targetVersion} recover\` so the image and generated assets match.`);
-      }
-      try {
-        if (pending.targetImageDigest)
-          await pullAndRequireImage(pending.targetImage, pending.targetImageDigest, `OR3 ${pending.targetVersion}`);
-        await copyAssets(loaded.directory, loaded.state.mode);
-        await startProject(loaded.directory, loaded.state.mode, loaded.env);
-      } catch (replacementError) {
-        await restoreBackupData(loaded.directory, loaded.state, loaded.env, backupPath);
-        const restoredEnv = parseEnv(await readText(deploymentPaths(loaded.directory).env));
-        const restored = stateFromEnv(loaded.directory, restoredEnv, loaded.state.mode, loaded.state.lastSuccessfulOperation, await imageDigest(restoredEnv.OR3_IMAGE));
-        restored.rollback = loaded.state.rollback;
-        restored.lastError = `Interrupted update was restored: ${redact(replacementError instanceof Error ? replacementError.message : String(replacementError), secretValues(restoredEnv))}`;
-        await commitRecoveredState(loaded.directory, loaded.state, restored);
-        console.log(`Recovered the incomplete update by restoring backup ${manifest.backupId}. OR3 ${restored.appVersion} is deeply healthy.`);
-        return;
+      if (!pending.backupPath && !pending.backupId) {
+        throw new Error("The incomplete update has no verified pre-update snapshot. Refusing to guess which image or data should be live.");
       }
-      const updated = stateFromEnv(loaded.directory, loaded.env, loaded.state.mode, "update", await imageDigest(loaded.env.OR3_IMAGE));
-      updated.rollback = {
-        appVersion: loaded.state.appVersion,
-        image: loaded.state.image,
-        imageDigest: loaded.state.imageDigest,
-        backupId: pending.backupId,
-        createdAt: now()
-      };
-      updated.lastError = undefined;
-      await commitRecoveredState(loaded.directory, loaded.state, updated);
-      console.log(`Recovered the incomplete update. OR3 ${updated.appVersion} is deeply healthy.`);
+      const previous = await restorePreMutationSnapshot(loaded.directory, loaded.state, loaded.env);
+      const recovered2 = await commitPreMutationRecovery(loaded.directory, loaded.state, `Interrupted update was rolled back to pre-update snapshot ${previous.manifest.backupId}.`);
+      console.log(`Recovered the incomplete update by restoring pre-update snapshot ${previous.manifest.backupId}. OR3 ${recovered2.appVersion} is deeply healthy.`);
       return;
     }
     if (pending.operation === "adopt") {
       if (!pending.backupId)
         throw new Error("The incomplete adoption has no source backup ID. Refusing to claim that data was transferred.");
       const sourceBackupPath = await resolveBackup(loaded.directory, pending.backupId);
-      const sourceManifest = await readManifest(sourceBackupPath);
+      const sourceManifest = await readManifest(sourceBackupPath, loaded.directory);
       if (sourceManifest.mode !== loaded.state.mode || sourceManifest.appVersion !== loaded.state.appVersion || sourceManifest.image !== loaded.state.image || sourceManifest.imageDigest !== loaded.state.imageDigest) {
         throw new Error(`Source backup ${sourceManifest.backupId} does not match the managed adoption target.`);
       }
       await stopProject(loaded.directory, loaded.state.mode);
       await restoreVolumeArchive(loaded.directory, loaded.state.mode, loaded.env, sourceBackupPath);
     }
+    if (pending.operation === "backup" && pending.initialAppRunning === false) {
+      loaded.state.lastError = undefined;
+      await clearPending(loaded.directory, loaded.state);
+      console.log("Recovered the incomplete backup operation and preserved the intentionally stopped OR3 service.");
+      return;
+    }
     await pullAndRequireImage(loaded.state.image, loaded.state.imageDigest, "Current deployment");
     await startProject(loaded.directory, loaded.state.mode, loaded.env);
-    const digest = await imageDigest(loaded.env.OR3_IMAGE);
-    const recovered = stateFromEnv(loaded.directory, loaded.env, loaded.state.mode, operationToStateOperation(pending.operation, loaded.state.lastSuccessfulOperation), digest);
+    let recoveredEnv = loaded.env;
+    if ((pending.operation === "init" || pending.operation === "adopt") && loaded.env.OR3_BASIC_AUTH_BOOTSTRAP_EMAIL && loaded.env.OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD && loaded.env.OR3_ADMIN_PASSWORD) {
+      await provisionManagedCredentials(loaded.state.mode === "public" ? new URL(`https://${loaded.env.OR3_PUBLIC_DOMAIN}`) : new URL(`http://127.0.0.1:${loaded.env.OR3_PORT}`), loaded.env.OR3_BASIC_AUTH_BOOTSTRAP_EMAIL, loaded.env.OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD, loaded.env.OR3_ADMIN_USERNAME, loaded.env.OR3_ADMIN_PASSWORD);
+      recoveredEnv = withoutProvisioningCredentials(loaded.env);
+      await writeSecure(deploymentPaths(loaded.directory).env, serializeEnv(recoveredEnv));
+      await stopProject(loaded.directory, loaded.state.mode);
+      await startProject(loaded.directory, loaded.state.mode, recoveredEnv);
+    }
+    const digest = await imageDigest(recoveredEnv.OR3_IMAGE);
+    const recovered = stateFromEnv(loaded.directory, recoveredEnv, loaded.state.mode, operationToStateOperation(pending.operation, loaded.state.lastSuccessfulOperation), digest);
     recovered.rollback = loaded.state.rollback;
     recovered.lastError = undefined;
     await commitRecoveredState(loaded.directory, loaded.state, recovered);
@@ -1649,7 +2645,9 @@ async function recoverCommand(directory) {
         const sourceModeValue = sourceMode(pending.sourceDirectory, sourceEnv);
         if (sourceModeValue === "public")
           sourceFiles.push("-f", join(pending.sourceDirectory, "compose.public.yaml"));
-        await restartSource(pending.sourceDirectory, sourceFiles, secretValues(sourceEnv));
+        if (pending.sourceInitiallyRunning !== false) {
+          await restartSource(pending.sourceDirectory, sourceFiles, secretValues(sourceEnv));
+        }
       } catch (recovery) {
         loaded.state.lastError += ` Original deployment recovery failed: ${recovery instanceof Error ? recovery.message : String(recovery)}`;
       }
@@ -1667,16 +2665,23 @@ async function backupCreateCommand(directory) {
   await ensureDocker();
   const loaded = await loadManaged(directory);
   assertNoPending(loaded.state);
+  const backupId = id("backup");
+  const initialAppRunning = await projectServiceRunning(loaded.directory, loaded.state.mode);
   const pending = {
-    id: id("backup"),
+    id: id("backup-operation"),
     operation: "backup",
     startedAt: now(),
-    message: "Creating a stopped-volume backup"
+    message: "Creating a stopped-volume backup",
+    backupId,
+    backupPath: backupDirectory(loaded.directory, backupId),
+    initialAppRunning,
+    phase: "prepared"
   };
   await markPending(loaded.directory, loaded.state, pending);
   try {
-    const result = await createBackup(loaded.directory, loaded.state, loaded.env);
+    const result = await createBackup(loaded.directory, loaded.state, loaded.env, { backupId, initiallyRunning: initialAppRunning });
     await clearPending(loaded.directory, loaded.state);
+    await pruneBackups(loaded.directory, loaded.state, BACKUP_RETENTION_KEEP, false);
     console.log(`Backup ${result.backupId} created at ${result.backupDir}`);
     console.log(`SHA-256: ${result.manifest.dataSha256}`);
   } catch (error) {
@@ -1712,23 +2717,31 @@ async function backupPruneCommand(directory, flags) {
 }
 async function backupExportCommand(directory, backupId, destination) {
   const backupPath = await resolveBackup(directory, backupId);
-  const manifest = await readManifest(backupPath);
+  const manifest = await readManifest(backupPath, directory);
   const dest = resolve(destination);
   const source = resolve(backupPath);
+  const deploymentRoot = await realpath(directory);
   if (source === dest || dest.startsWith(`${source}${sep}`)) {
     throw new Error("Choose a destination directory different from the backup itself.");
   }
   if (await fileExists(dest))
     throw new Error(`Destination ${dest} already exists. Choose a new empty destination so an export can never merge with unrelated files.`);
   await mkdir(dirname(dest), { recursive: true, mode: 448 });
+  const canonicalDestination = join(await realpath(dirname(dest)), basename(dest));
+  if (canonicalDestination === deploymentRoot || canonicalDestination.startsWith(`${deploymentRoot}${sep}`)) {
+    throw new Error("Backup exports must live outside the managed deployment directory so `remove --purge-data` can never delete the remaining copy.");
+  }
   await mkdir(dest, { mode: 448 });
   try {
+    if (await realpath(dest) !== canonicalDestination) {
+      throw new Error("Backup export destination changed while it was being created. Refusing to write an export through an unexpected path.");
+    }
     await chmod(dest, 448);
-    for (const file of ["data.tgz", "config.env", "manifest.json"]) {
+    for (const file of ["data.tgz", "config.env", "manifest.json", "manifest.auth"]) {
       await copySecure(join(backupPath, file), join(dest, file));
     }
     if (manifest.managedAssetSha256) {
-      for (const name of managedAssetNames(manifest.mode)) {
+      for (const name of managedAssetNamesForInventory(manifest.mode, manifest.managedAssetInventoryVersion)) {
         await copySecure(join(backupPath, "managed-assets", name), join(dest, "managed-assets", name));
       }
     }
@@ -1742,7 +2755,7 @@ async function backupExportCommand(directory, backupId, destination) {
         throw new Error(`Exported config.env checksum mismatch for ${manifest.backupId}.`);
       }
     }
-    await readManifest(dest);
+    await readManifest(dest, directory);
     const destinationDevice = (await stat(dest)).dev;
     await mkdir(deploymentPaths(directory).exports, { recursive: true, mode: 448 });
     const receipt = {
@@ -1756,9 +2769,9 @@ async function backupExportCommand(directory, backupId, destination) {
     };
     await writeSecure(join(deploymentPaths(directory).exports, `${manifest.backupId}.json`), `${JSON.stringify(receipt, null, 2)}
 `);
-    let bytes = (await stat(join(dest, "data.tgz"))).size + (await stat(join(dest, "config.env"))).size + (await stat(join(dest, "manifest.json"))).size;
+    let bytes = (await stat(join(dest, "data.tgz"))).size + (await stat(join(dest, "config.env"))).size + (await stat(join(dest, "manifest.json"))).size + (await stat(join(dest, "manifest.auth"))).size;
     if (manifest.managedAssetSha256) {
-      for (const name of managedAssetNames(manifest.mode)) {
+      for (const name of managedAssetNamesForInventory(manifest.mode, manifest.managedAssetInventoryVersion)) {
         bytes += (await stat(join(dest, "managed-assets", name))).size;
       }
     }
@@ -1813,10 +2826,14 @@ async function updateCommand(directory, flags) {
   }
   if (targetVersion === state.appVersion)
     throw new Error(`The deployment is already on OR3 ${targetVersion}.`);
-  const targetImage = imageFor(targetVersion);
-  const targetDigest = await pullImage(targetImage);
-  await assertSupportedHostArchitecture(targetImage);
+  const targetImageTag = imageFor(targetVersion);
+  const targetDigest = await pullImage(targetImageTag, expectedImageDigest(targetVersion));
+  await assertSupportedHostArchitecture(targetImageTag);
+  await assertImageReleaseIdentity(targetImageTag, targetVersion);
+  const targetImage = imageAtDigest(targetImageTag, targetDigest);
   const oldEnv = { ...env };
+  const targetDeploymentId = env.OR3_DEPLOYMENT_ID ?? state.deploymentId ?? id("deployment");
+  const backupId = id("backup");
   const pending = {
     id: id("update"),
     operation: "update",
@@ -1824,18 +2841,48 @@ async function updateCommand(directory, flags) {
     message: `Updating from ${state.appVersion} to ${targetVersion}`,
     targetVersion,
     targetImage,
-    targetImageDigest: targetDigest
+    targetImageDigest: targetDigest,
+    targetDeploymentId,
+    backupId,
+    backupPath: backupDirectory(loaded.directory, backupId),
+    phase: "prepared"
   };
   await markPending(loaded.directory, state, pending);
   try {
-    const backup = await createBackup(loaded.directory, state, env);
-    await updatePending(loaded.directory, state, { backupId: backup.backupId });
-    const nextEnv = { ...env, OR3_VERSION: targetVersion, OR3_IMAGE: targetImage };
+    const backup = await createBackup(loaded.directory, state, env, { restartAfter: false, backupId });
+    await updatePending(loaded.directory, state, {
+      backupId: backup.backupId,
+      backupPath: backup.backupDir,
+      backupDataSha256: backup.manifest.dataSha256,
+      backupConfigSha256: backup.manifest.configSha256,
+      phase: "snapshot-created"
+    });
+    const operator = await prepareVerifiedDashboardOperator(loaded.directory, targetVersion);
+    if (env.OR3_DASHBOARD_UPDATES_ENABLED === "true" && !operator && !process.env.OR3_DASHBOARD_UPDATE_JOB_ID) {
+      await removeDashboardOperator(loaded.directory, state.mode);
+    }
+    const nextEnv = {
+      ...withoutDashboardOperator(env),
+      OR3_VERSION: targetVersion,
+      OR3_IMAGE: targetImage,
+      OR3_DEPLOYMENT_ID: targetDeploymentId,
+      ...operator ?? {}
+    };
     const previousRootOwnership = await managedVolumeRootOwnership(targetImage, state.volumeName);
     const migrateLegacyVolume = previousRootOwnership.uid !== MANAGED_RUNTIME_UID || previousRootOwnership.gid !== MANAGED_RUNTIME_GID;
+    const recreateDataVolume = updateRequiresVolumeRecreation(state, env);
+    await updatePending(loaded.directory, state, {
+      phase: "target-mutating",
+      previousRootOwnership,
+      recreateDataVolume
+    });
     try {
-      await stopProject(loaded.directory, state.mode);
-      if (migrateLegacyVolume) {
+      if (recreateDataVolume) {
+        await removeManagedDataVolumeForRecreation(loaded.directory, state);
+      } else {
+        await stopProject(loaded.directory, state.mode);
+      }
+      if (migrateLegacyVolume && !recreateDataVolume) {
         await setManagedVolumeRootOwnership(targetImage, state.volumeName, {
           uid: MANAGED_RUNTIME_UID,
           gid: MANAGED_RUNTIME_GID
@@ -1843,31 +2890,26 @@ async function updateCommand(directory, flags) {
       }
       await writeSecure(deploymentPaths(loaded.directory).env, serializeEnv(nextEnv));
       await copyAssets(loaded.directory, state.mode);
-      if (migrateLegacyVolume) {
+      if (migrateLegacyVolume || recreateDataVolume) {
         await restoreVolumeArchive(loaded.directory, state.mode, nextEnv, backup.backupDir);
       }
       await startProject(loaded.directory, state.mode, nextEnv);
     } catch (error) {
-      await writeSecure(deploymentPaths(loaded.directory).env, serializeEnv(oldEnv));
+      await updatePending(loaded.directory, state, { phase: "restoring-previous" });
       try {
-        await stopProject(loaded.directory, state.mode).catch(() => {
-          return;
-        });
-        if (migrateLegacyVolume) {
+        if (!recreateDataVolume)
+          await stopProject(loaded.directory, state.mode).catch(() => {
+            return;
+          });
+        if (migrateLegacyVolume && !recreateDataVolume) {
           await setManagedVolumeRootOwnership(targetImage, state.volumeName, previousRootOwnership);
         }
-        await restoreBackupData(loaded.directory, state, oldEnv, backup.backupDir);
+        await restoreBackupData(loaded.directory, state, oldEnv, backup.backupDir, { recreateDataVolume });
       } catch (restoreError) {
         throw new Error(`Update to ${targetVersion} failed, and automatic backup restoration also failed: ${restoreError instanceof Error ? restoreError.message : String(restoreError)}. Original update error: ${error instanceof Error ? error.message : String(error)}`);
       }
-      const oldDigest = await imageDigest(state.image);
-      state.imageDigest = oldDigest;
-      state.lastError = `Update to ${targetVersion} failed and was restored: ${redact(error instanceof Error ? error.message : String(error), secretValues(oldEnv))}`;
-      const operationId = pending.id;
-      delete state.incompleteOperation;
-      await removeOperationRecord(loaded.directory, operationId);
-      await writeState(loaded.directory, state);
-      throw new Error(state.lastError);
+      const recovered = await commitPreMutationRecovery(loaded.directory, state, `Update to ${targetVersion} failed and was restored: ${redact(error instanceof Error ? error.message : String(error), secretValues(oldEnv))}`);
+      throw new Error(recovered.lastError);
     }
     const digest = await requireImageDigest(targetImage, targetDigest, `OR3 ${targetVersion}`);
     state.rollback = {
@@ -1880,9 +2922,12 @@ async function updateCommand(directory, flags) {
     state.appVersion = targetVersion;
     state.image = targetImage;
     state.imageDigest = digest;
+    state.deploymentId = targetDeploymentId;
+    state.deploymentRoot = resolve(loaded.directory);
     state.lastSuccessfulOperation = "update";
     state.lastError = undefined;
     await clearPending(loaded.directory, state);
+    await pruneBackups(loaded.directory, state, BACKUP_RETENTION_KEEP, false);
     console.log(`OR3 updated to ${targetVersion}. Image digest: ${digest}`);
     console.log(`Rollback point: ${backup.backupId}. Keep it until login, chat, and file checks pass.`);
   } catch (error) {
@@ -1894,11 +2939,52 @@ async function updateCommand(directory, flags) {
   }
 }
 async function resolveBackup(directory, value) {
+  if (!isAbsolute(value) && !BACKUP_ID_PATTERN.test(value)) {
+    throw new Error(`Backup ID "${value}" is invalid. Use an OR3-generated backup ID or an absolute external backup path.`);
+  }
   const candidate = isAbsolute(value) ? value : backupDirectory(directory, value);
   if (!await fileExists(join(candidate, "manifest.json")))
     throw new Error(`Backup ${value} was not found in ${deploymentPaths(directory).backups}.`);
   return resolve(candidate);
 }
+async function recordedBackupPath(directory, pending, previous = false) {
+  const path = previous ? pending.previousBackupPath : pending.backupPath;
+  const backupId = previous ? pending.previousBackupId : pending.backupId;
+  const resolved = path ? resolve(path) : backupId ? await resolveBackup(directory, backupId) : undefined;
+  if (!resolved || !await fileExists(join(resolved, "manifest.json"))) {
+    throw new Error(`The incomplete ${pending.operation} has no readable ${previous ? "pre-mutation" : "target"} backup source.`);
+  }
+  const manifest = await readManifest(resolved, directory);
+  if (!previous) {
+    if (pending.backupDataSha256 && pending.backupDataSha256 !== manifest.dataSha256) {
+      throw new Error(`The recorded target backup at ${resolved} no longer has its expected data checksum.`);
+    }
+    if (pending.backupConfigSha256 && pending.backupConfigSha256 !== manifest.configSha256) {
+      throw new Error(`The recorded target backup at ${resolved} no longer has its expected configuration checksum.`);
+    }
+  }
+  return { path: resolved, manifest };
+}
+async function createPreMutationSnapshot(directory, state, env, backupId) {
+  return await createBackup(directory, state, env, { restartAfter: false, backupId });
+}
+async function restorePreMutationSnapshot(directory, state, env) {
+  const pending = state.incompleteOperation;
+  if (!pending)
+    throw new Error("No incomplete operation is available to restore.");
+  const previous = await recordedBackupPath(directory, pending, true);
+  await updatePending(directory, state, { phase: "restoring-previous" });
+  if (pending.recreateDataVolume) {
+    await restoreBackupData(directory, state, env, previous.path, { recreateDataVolume: true });
+    return previous;
+  }
+  if (pending.previousRootOwnership) {
+    await pullAndRequireImage(state.image, state.imageDigest, "Previous deployment");
+    await setManagedVolumeRootOwnership(state.image, state.volumeName, pending.previousRootOwnership);
+  }
+  await restoreBackupData(directory, state, env, previous.path);
+  return previous;
+}
 async function restoreCommand(directory, flags, positionals) {
   if (!boolFlag(flags, "yes"))
     throw new Error("Restore replaces live data. Re-run with --yes after confirming the backup and data-loss boundary.");
@@ -1909,12 +2995,14 @@ async function restoreCommand(directory, flags, positionals) {
   if (!backupValue)
     throw new Error("restore requires a backup ID or path.");
   const backupPath = await resolveBackup(loaded.directory, backupValue);
-  const manifest = await readManifest(backupPath);
+  const manifest = await readManifest(backupPath, loaded.directory);
+  assertRestorableManagedAssets(manifest);
   const backupEnv = parseEnv(await readText(join(backupPath, "config.env")));
   if (backupEnv.OR3_VERSION !== manifest.appVersion || backupEnv.OR3_IMAGE !== manifest.image) {
     throw new Error(`Backup ${manifest.backupId} configuration does not match its manifest.`);
   }
   assertBackupMatchesDeployment(manifest, backupEnv, loaded.state, loaded.env);
+  const recreateDataVolume = restoreRequiresVolumeRecreation(loaded.env, backupEnv);
   if (manifest.imageDigest)
     await pullAndRequireImage(manifest.image, manifest.imageDigest, `Backup ${manifest.backupId}`);
   await assertSupportedHostArchitecture(manifest.image);
@@ -1925,13 +3013,30 @@ async function restoreCommand(directory, flags, positionals) {
     startedAt: now(),
     message: `Restoring backup ${manifest.backupId}`,
     backupId: manifest.backupId,
+    backupPath,
+    backupDataSha256: manifest.dataSha256,
+    backupConfigSha256: manifest.configSha256,
     targetVersion: manifest.appVersion,
     targetImage: manifest.image,
-    targetImageDigest: manifest.imageDigest
+    targetImageDigest: manifest.imageDigest,
+    recreateDataVolume,
+    phase: "prepared"
   };
   await markPending(loaded.directory, loaded.state, pending);
   try {
-    await restoreBackupData(loaded.directory, loaded.state, loaded.env, backupPath);
+    const previousBackupId = id("backup-before-restore");
+    await updatePending(loaded.directory, loaded.state, {
+      previousBackupId,
+      previousBackupPath: backupDirectory(loaded.directory, previousBackupId)
+    });
+    const previous = await createPreMutationSnapshot(loaded.directory, loaded.state, loaded.env, previousBackupId);
+    await updatePending(loaded.directory, loaded.state, {
+      previousBackupId: previous.backupId,
+      previousBackupPath: previous.backupDir,
+      phase: "snapshot-created"
+    });
+    await updatePending(loaded.directory, loaded.state, { phase: "target-mutating" });
+    await restoreBackupData(loaded.directory, loaded.state, loaded.env, backupPath, { recreateDataVolume });
     const restoredEnv = parseEnv(await readText(deploymentPaths(loaded.directory).env));
     const digest = await imageDigest(restoredEnv.OR3_IMAGE);
     const nextState = stateFromEnv(loaded.directory, restoredEnv, loaded.state.mode, "restore", digest);
@@ -1940,8 +3045,33 @@ async function restoreCommand(directory, flags, positionals) {
     await writeState(loaded.directory, nextState);
     console.log(`Restored ${manifest.backupId}. Verify sign-in, a conversation, and a previously uploaded file.`);
   } catch (error) {
-    loaded.state.lastError = redact(error instanceof Error ? error.message : String(error), secretValues(loaded.env));
-    await writeState(loaded.directory, loaded.state);
+    const original = redact(error instanceof Error ? error.message : String(error), secretValues(loaded.env));
+    const phase = loaded.state.incompleteOperation?.phase;
+    const targetMayHaveMutated = phase === "target-mutating" || phase === "restoring-previous" || phase === "starting-target";
+    if (targetMayHaveMutated && (loaded.state.incompleteOperation?.previousBackupPath || loaded.state.incompleteOperation?.previousBackupId)) {
+      let recoveredMessage;
+      try {
+        const previous = await restorePreMutationSnapshot(loaded.directory, loaded.state, loaded.env);
+        recoveredMessage = `Restore of ${manifest.backupId} failed and the pre-restore snapshot ${previous.manifest.backupId} was restored: ${original}`;
+        await commitPreMutationRecovery(loaded.directory, loaded.state, recoveredMessage);
+      } catch (recoveryError) {
+        const recovery = redact(recoveryError instanceof Error ? recoveryError.message : String(recoveryError), secretValues(loaded.env));
+        loaded.state.lastError = `Restore of ${manifest.backupId} failed, and automatic restoration of the pre-restore snapshot also failed: ${recovery}. Original restore error: ${original}`;
+        await writeState(loaded.directory, loaded.state);
+        throw new Error(loaded.state.lastError);
+      }
+      throw new Error(recoveredMessage);
+    }
+    try {
+      await startProject(loaded.directory, loaded.state.mode, loaded.env);
+      loaded.state.lastError = `Restore of ${manifest.backupId} stopped before data replacement: ${original}`;
+      await clearPending(loaded.directory, loaded.state);
+    } catch (restartError) {
+      const restart = redact(restartError instanceof Error ? restartError.message : String(restartError), secretValues(loaded.env));
+      loaded.state.lastError = `Restore of ${manifest.backupId} stopped before data replacement, but the original deployment could not restart: ${restart}. Original restore error: ${original}`;
+      await writeState(loaded.directory, loaded.state);
+      throw new Error(loaded.state.lastError);
+    }
     throw error;
   }
 }
@@ -1955,7 +3085,8 @@ async function rollbackCommand(directory, flags) {
   if (!point)
     throw new Error("No immediate rollback point is recorded for this deployment.");
   const backupPath = await resolveBackup(loaded.directory, point.backupId);
-  const manifest = await readManifest(backupPath);
+  const manifest = await readManifest(backupPath, loaded.directory);
+  assertRestorableManagedAssets(manifest);
   if (manifest.appVersion !== point.appVersion || manifest.image !== point.image || manifest.imageDigest !== point.imageDigest) {
     throw new Error(`Rollback point ${point.backupId} no longer matches its recorded image/version. Refusing to mutate the deployment.`);
   }
@@ -1964,6 +3095,7 @@ async function rollbackCommand(directory, flags) {
     throw new Error(`Backup ${manifest.backupId} configuration does not match its manifest.`);
   }
   assertBackupMatchesDeployment(manifest, backupEnv, loaded.state, loaded.env);
+  const recreateDataVolume = restoreRequiresVolumeRecreation(loaded.env, backupEnv);
   await pullAndRequireImage(point.image, point.imageDigest, "Rollback");
   await assertSupportedHostArchitecture(point.image);
   await assertRestoreFreeSpace(loaded.directory, loaded.state, loaded.env, manifest, backupPath);
@@ -1973,13 +3105,30 @@ async function rollbackCommand(directory, flags) {
     startedAt: now(),
     message: `Rolling back to ${point.appVersion}`,
     backupId: point.backupId,
+    backupPath,
+    backupDataSha256: manifest.dataSha256,
+    backupConfigSha256: manifest.configSha256,
     targetVersion: point.appVersion,
     targetImage: point.image,
-    targetImageDigest: point.imageDigest
+    targetImageDigest: point.imageDigest,
+    recreateDataVolume,
+    phase: "prepared"
   };
   await markPending(loaded.directory, loaded.state, pending);
   try {
-    await restoreBackupData(loaded.directory, loaded.state, loaded.env, backupPath);
+    const previousBackupId = id("backup-before-rollback");
+    await updatePending(loaded.directory, loaded.state, {
+      previousBackupId,
+      previousBackupPath: backupDirectory(loaded.directory, previousBackupId)
+    });
+    const previous = await createPreMutationSnapshot(loaded.directory, loaded.state, loaded.env, previousBackupId);
+    await updatePending(loaded.directory, loaded.state, {
+      previousBackupId: previous.backupId,
+      previousBackupPath: previous.backupDir,
+      phase: "snapshot-created"
+    });
+    await updatePending(loaded.directory, loaded.state, { phase: "target-mutating" });
+    await restoreBackupData(loaded.directory, loaded.state, loaded.env, backupPath, { recreateDataVolume });
     const restoredEnv = parseEnv(await readText(deploymentPaths(loaded.directory).env));
     const nextState = stateFromEnv(loaded.directory, restoredEnv, loaded.state.mode, "restore", await imageDigest(restoredEnv.OR3_IMAGE));
     nextState.rollback = undefined;
@@ -1987,8 +3136,33 @@ async function rollbackCommand(directory, flags) {
     await writeState(loaded.directory, nextState);
     console.log(`Rolled back to OR3 ${nextState.appVersion}. Verify sign-in, chat, and file access.`);
   } catch (error) {
-    loaded.state.lastError = redact(error instanceof Error ? error.message : String(error), secretValues(loaded.env));
-    await writeState(loaded.directory, loaded.state);
+    const original = redact(error instanceof Error ? error.message : String(error), secretValues(loaded.env));
+    const phase = loaded.state.incompleteOperation?.phase;
+    const targetMayHaveMutated = phase === "target-mutating" || phase === "restoring-previous" || phase === "starting-target";
+    if (targetMayHaveMutated && (loaded.state.incompleteOperation?.previousBackupPath || loaded.state.incompleteOperation?.previousBackupId)) {
+      let recoveredMessage;
+      try {
+        const previous = await restorePreMutationSnapshot(loaded.directory, loaded.state, loaded.env);
+        recoveredMessage = `Rollback to ${point.appVersion} failed and the pre-rollback snapshot ${previous.manifest.backupId} was restored: ${original}`;
+        await commitPreMutationRecovery(loaded.directory, loaded.state, recoveredMessage);
+      } catch (recoveryError) {
+        const recovery = redact(recoveryError instanceof Error ? recoveryError.message : String(recoveryError), secretValues(loaded.env));
+        loaded.state.lastError = `Rollback to ${point.appVersion} failed, and automatic restoration of the pre-rollback snapshot also failed: ${recovery}. Original rollback error: ${original}`;
+        await writeState(loaded.directory, loaded.state);
+        throw new Error(loaded.state.lastError);
+      }
+      throw new Error(recoveredMessage);
+    }
+    try {
+      await startProject(loaded.directory, loaded.state.mode, loaded.env);
+      loaded.state.lastError = `Rollback to ${point.appVersion} stopped before data replacement: ${original}`;
+      await clearPending(loaded.directory, loaded.state);
+    } catch (restartError) {
+      const restart = redact(restartError instanceof Error ? restartError.message : String(restartError), secretValues(loaded.env));
+      loaded.state.lastError = `Rollback to ${point.appVersion} stopped before data replacement, but the original deployment could not restart: ${restart}. Original rollback error: ${original}`;
+      await writeState(loaded.directory, loaded.state);
+      throw new Error(loaded.state.lastError);
+    }
     throw error;
   }
 }
@@ -2016,7 +3190,7 @@ async function doctorCommand(directory) {
     failures.push(error instanceof Error ? error.message : String(error));
     console.log("✗ Managed state or .env is missing/invalid");
   }
-  for (const file of [paths.env, paths.state]) {
+  for (const file of [paths.env, paths.state, join(resolved, ".or3-initial-credentials")]) {
     if (!existsSync(file))
       continue;
     const mode = (await stat(file)).mode & 511;
@@ -2057,6 +3231,53 @@ async function doctorCommand(directory) {
         failures.push(error instanceof Error ? error.message : String(error));
         console.log("✗ Deep health is not passing");
       }
+      try {
+        const operatorEnabled = env.OR3_DASHBOARD_UPDATES_ENABLED === "true";
+        const operatorContainer = await run("docker", [
+          "ps",
+          "-aq",
+          "--filter",
+          `label=com.docker.compose.project=${state.composeProject}`,
+          "--filter",
+          "label=com.docker.compose.service=or3-operator"
+        ], resolved);
+        if (!operatorContainer.ok)
+          throw new Error(`Could not inspect the dashboard operator service. ${operatorContainer.stderr.trim()}`);
+        const containerId = operatorContainer.stdout.trim();
+        if (!operatorEnabled) {
+          if (containerId)
+            throw new Error("A dashboard operator container exists even though the bridge is disabled.");
+          console.log("✓ Dashboard operator is disabled with no orphaned service");
+        } else {
+          if (!containerId)
+            throw new Error("Dashboard updates are enabled but the operator container is missing.");
+          const inspected = await run("docker", ["inspect", containerId]);
+          if (!inspected.ok)
+            throw new Error(`Could not inspect dashboard operator container ${containerId}.`);
+          const container = JSON.parse(inspected.stdout)?.[0];
+          if (container.Config?.Image !== env.OR3_OPERATOR_IMAGE)
+            throw new Error("Dashboard operator runtime image does not match the digest-qualified managed environment.");
+          if (state.deploymentId && container.Config?.Labels?.["io.or3.cloud.deployment-id"] !== state.deploymentId) {
+            throw new Error("Dashboard operator deployment identity does not match managed state.");
+          }
+          const destinations = new Set(container.Mounts?.map((mount) => mount.Destination));
+          for (const destination of ["/var/run/docker.sock", "/deployment", "/run/or3-operator"]) {
+            if (!destinations.has(destination))
+              throw new Error(`Dashboard operator is missing its required ${destination} mount.`);
+          }
+          const ipcDirectory = await stat(paths.operatorIpc);
+          const operatorSocket = await stat(join(paths.operatorIpc, "operator.sock"));
+          const operatorUid = Number(env.OR3_OPERATOR_UID);
+          const operatorGid = Number(env.OR3_OPERATOR_GID);
+          if ((ipcDirectory.mode & 511) !== 456 || ipcDirectory.uid !== operatorUid || ipcDirectory.gid !== operatorGid || !operatorSocket.isSocket() || (operatorSocket.mode & 511) !== 432 || operatorSocket.uid !== operatorUid || operatorSocket.gid !== operatorGid) {
+            throw new Error("Dashboard operator IPC ownership boundary has unexpected owners, types, or modes.");
+          }
+          console.log("✓ Dashboard operator image, identity, mounts, and IPC modes are valid");
+        }
+      } catch (error) {
+        failures.push(error instanceof Error ? error.message : String(error));
+        console.log("✗ Dashboard operator boundary is invalid");
+      }
     }
     if (state.mode === "public" && state.domain) {
       try {
@@ -2076,7 +3297,22 @@ async function doctorCommand(directory) {
         console.log(`✗ DNS: ${state.domain} does not resolve`);
       }
       for (const port of [80, 443]) {
-        console.log(await portAvailable(port) ? `⚠ Port ${port} is not listening (Caddy may be stopped)` : `✓ Port ${port} is in use by a local service; verify it is Caddy`);
+        const mapping = await run("docker", composeArgs(resolved, state.mode, ["port", "caddy", String(port)]), resolved);
+        if (!mapping.ok || !mapping.stdout.trim().split(/\r?\n/).some((line) => line.trim().endsWith(`:${port}`))) {
+          failures.push(`Caddy does not publish TCP ${port} through the selected Docker daemon.`);
+          console.log(`✗ Caddy does not publish TCP ${port}`);
+        } else {
+          console.log(`✓ Caddy publishes TCP ${port}`);
+        }
+      }
+      try {
+        const response = await verificationFetch(new URL(`https://${state.domain}`));
+        if (response.status !== 200)
+          throw new Error(`Public HTTPS root returned HTTP ${response.status}; redirects are not accepted.`);
+        console.log("✓ Public HTTPS root returns HTTP 200 without redirects");
+      } catch (error) {
+        failures.push(error instanceof Error ? error.message : String(error));
+        console.log("✗ Public HTTPS root is unreachable or redirects");
       }
       console.log("ℹ Firewall: allow TCP 80/443 (and optional UDP 443) in your existing nftables or UFW rules; OR3 did not modify them.");
     }
@@ -2086,6 +3322,358 @@ async function doctorCommand(directory) {
   }
   console.log("OR3 Cloud doctor passed.");
 }
+function validateVerificationHealth(value) {
+  const health = value;
+  if (!health || health.status !== "ok" || health.providers?.auth?.provider !== "basic-auth" || health.providers?.sync?.provider !== "sqlite" || health.providers?.storage?.provider !== "fs") {
+    throw new Error("Public deep health does not report the managed Basic Auth + SQLite + filesystem profile.");
+  }
+  return health;
+}
+async function verificationFetch(url, init = {}) {
+  return fetch(url, {
+    ...init,
+    redirect: "manual",
+    signal: AbortSignal.timeout(20000)
+  });
+}
+async function verificationJson(baseUrl, path, options = {}) {
+  const method = options.method ?? (options.body === undefined ? "GET" : "POST");
+  const response = await verificationFetch(new URL(path, baseUrl), {
+    method,
+    headers: {
+      accept: "application/json",
+      ...options.body === undefined ? {} : { "content-type": "application/json" },
+      ...options.cookie ? { cookie: options.cookie } : {},
+      ...method === "GET" ? {} : { origin: baseUrl.origin }
+    },
+    ...options.body === undefined ? {} : { body: JSON.stringify(options.body) }
+  });
+  if (response.status !== 200) {
+    const detail = (await response.text().catch(() => "")).slice(0, 300);
+    throw new Error(`${response.url} returned HTTP ${response.status}${detail ? `: ${detail}` : ""}`);
+  }
+  return response.json();
+}
+function sameOriginVerificationUrl(baseUrl, value, label) {
+  if (typeof value !== "string")
+    throw new Error(`Filesystem storage did not return a ${label} URL.`);
+  const url = new URL(value, baseUrl);
+  if (url.origin !== baseUrl.origin) {
+    throw new Error(`Filesystem storage returned a cross-origin ${label} URL. Refusing to send the verification session to ${url.origin}.`);
+  }
+  return url;
+}
+function assertVerificationGrant(value, expectedMethod, label) {
+  if (value.method !== undefined && value.method !== expectedMethod) {
+    throw new Error(`Filesystem storage returned unexpected ${label} method ${String(value.method)}.`);
+  }
+  if (value.headers !== undefined && (!value.headers || typeof value.headers !== "object" || Array.isArray(value.headers) || Object.keys(value.headers).length > 0)) {
+    throw new Error(`Filesystem storage returned unexpected ${label} headers.`);
+  }
+}
+async function verificationCredentials(directory, flags, env) {
+  const passwordFile = stringFlag(flags, "verification-password-file");
+  if (flags["verification-email"] !== undefined && !stringFlag(flags, "verification-email")) {
+    throw new Error("--verification-email requires a value.");
+  }
+  if (flags["verification-password-file"] !== undefined && !passwordFile) {
+    throw new Error("--verification-password-file requires a path.");
+  }
+  const configuredEmail = stringFlag(flags, "verification-email")?.trim() || env.OR3_MANAGED_OWNER_EMAIL || env.OR3_BASIC_AUTH_BOOTSTRAP_EMAIL;
+  let initialCredentials = {};
+  if (!configuredEmail || !passwordFile && !env.OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD) {
+    const initialCredentialsPath = join(directory, ".or3-initial-credentials");
+    if (await fileExists(initialCredentialsPath)) {
+      initialCredentials = parseEnv(await readOwnerOnlyText(initialCredentialsPath, "The initial credentials file"));
+    }
+  }
+  const email = configuredEmail || initialCredentials.OR3_BASIC_AUTH_BOOTSTRAP_EMAIL;
+  if (!email)
+    throw new Error("A current owner email is required for verification.");
+  validateEmail(email);
+  const password = passwordFile ? (await readOwnerOnlyText(resolve(passwordFile), "The verification password file")).trim() : env.OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD || initialCredentials.OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD;
+  if (!password) {
+    throw new Error("A current owner password is required. Pass --verification-password-file after changing the bootstrap password.");
+  }
+  if (password.includes("\x00") || /\r|\n/.test(password))
+    throw new Error("The verification password file must contain exactly one password line.");
+  return { email, password };
+}
+async function verifyPublicApplication(baseUrl, credentials) {
+  const root = await verificationFetch(baseUrl);
+  if (root.status !== 200)
+    throw new Error(`${baseUrl} returned HTTP ${root.status}; redirects are not accepted during verification.`);
+  const health = validateVerificationHealth(await verificationJson(baseUrl, "/api/health?deep=true"));
+  const { email, password } = credentials;
+  const signIn = await verificationFetch(new URL("/api/basic-auth/sign-in", baseUrl), {
+    method: "POST",
+    headers: { accept: "application/json", "content-type": "application/json", origin: baseUrl.origin },
+    body: JSON.stringify({ email, password })
+  });
+  if (signIn.status !== 200)
+    throw new Error(`Public Basic Auth sign-in returned HTTP ${signIn.status}.`);
+  const responseHeaders = signIn.headers;
+  const setCookies = responseHeaders.getSetCookie?.() ?? [signIn.headers.get("set-cookie")].filter((value) => Boolean(value));
+  const cookie = setCookies.map((value) => value.split(";", 1)[0]).join("; ");
+  if (!cookie)
+    throw new Error("Public Basic Auth sign-in did not set a session cookie.");
+  try {
+    const session = await verificationJson(baseUrl, "/api/auth/session", { cookie });
+    if (session.session?.user?.email !== email || !session.session?.workspace?.id) {
+      throw new Error("Public session hydration did not return the verification user and workspace.");
+    }
+    const workspaceId = String(session.session.workspace.id);
+    const pull = await verificationJson(baseUrl, "/api/sync/pull", {
+      cookie,
+      body: { scope: { workspaceId }, cursor: 0, limit: 1, tables: ["messages"] }
+    });
+    if (!Array.isArray(pull.changes) || typeof pull.nextCursor !== "number") {
+      throw new Error("Public SQLite sync pull returned an invalid response.");
+    }
+    const probeBytes = Buffer.concat([
+      Buffer.from("89504e470d0a1a0a0000000d49484452000000010000000108060000001f15c489", "hex"),
+      randomBytes(8)
+    ]);
+    const hash = `sha256:${createHash("sha256").update(probeBytes).digest("hex")}`;
+    let storageId;
+    let metadataAttempted = false;
+    try {
+      const presign = await verificationJson(baseUrl, "/api/storage/presign-upload", {
+        cookie,
+        body: {
+          workspace_id: workspaceId,
+          hash,
+          mime_type: "image/png",
+          size_bytes: probeBytes.length,
+          disposition: "inline"
+        }
+      });
+      storageId = typeof presign.storageId === "string" && presign.storageId.trim() ? presign.storageId : undefined;
+      if (!storageId)
+        throw new Error("Filesystem storage did not return a non-empty storage ID.");
+      assertVerificationGrant(presign, "PUT", "upload");
+      const upload = await verificationFetch(sameOriginVerificationUrl(baseUrl, presign.url, "upload"), {
+        method: "PUT",
+        headers: { "content-type": "image/png", cookie },
+        body: probeBytes
+      });
+      if (!upload.ok)
+        throw new Error(`Filesystem verification upload returned HTTP ${upload.status}.`);
+      await verificationJson(baseUrl, "/api/storage/commit", {
+        cookie,
+        body: {
+          workspace_id: workspaceId,
+          hash,
+          storage_id: storageId,
+          storage_provider_id: "fs",
+          mime_type: "image/png",
+          size_bytes: probeBytes.length,
+          name: "or3-production-verification.png",
+          kind: "image"
+        }
+      });
+      const metadataCreatedAt = Date.now();
+      const metadataOpId = randomUUID();
+      metadataAttempted = true;
+      const pushed = await verificationJson(baseUrl, "/api/sync/push", {
+        cookie,
+        body: {
+          scope: { workspaceId },
+          ops: [{
+            id: `or3-verification-${metadataOpId}`,
+            tableName: "file_meta",
+            operation: "put",
+            pk: hash,
+            payload: {
+              hash,
+              kind: "image",
+              mime_type: "image/png",
+              size_bytes: probeBytes.length,
+              storage_id: storageId,
+              name: "or3-production-verification.png",
+              deleted: false,
+              created_at: metadataCreatedAt,
+              updated_at: metadataCreatedAt,
+              clock: metadataCreatedAt
+            },
+            stamp: {
+              deviceId: "or3-cloud-verification",
+              opId: metadataOpId,
+              hlc: `${String(metadataCreatedAt).padStart(13, "0")}:0000:or3-cloud-verification`,
+              clock: metadataCreatedAt
+            },
+            createdAt: metadataCreatedAt,
+            attempts: 0,
+            status: "pending"
+          }]
+        }
+      });
+      if (pushed.results?.[0]?.success !== true) {
+        throw new Error(`Filesystem verification metadata sync failed: ${JSON.stringify(pushed)}`);
+      }
+      const downloadGrant = await verificationJson(baseUrl, "/api/storage/presign-download", {
+        cookie,
+        body: { workspace_id: workspaceId, hash, storage_id: storageId, disposition: "attachment" }
+      });
+      assertVerificationGrant(downloadGrant, "GET", "download");
+      const download = await verificationFetch(sameOriginVerificationUrl(baseUrl, downloadGrant.url, "download"), { headers: { cookie } });
+      if (!download.ok || !Buffer.from(await download.arrayBuffer()).equals(probeBytes)) {
+        throw new Error("Filesystem verification download did not match the uploaded probe.");
+      }
+    } finally {
+      if (storageId) {
+        try {
+          await verificationJson(baseUrl, "/api/storage/delete", {
+            cookie,
+            body: { workspace_id: workspaceId, hash, storage_id: storageId }
+          });
+        } finally {
+          if (metadataAttempted) {
+            const metadataDeleteAt = Date.now();
+            const metadataDeleteOpId = randomUUID();
+            const deleted = await verificationJson(baseUrl, "/api/sync/push", {
+              cookie,
+              body: {
+                scope: { workspaceId },
+                ops: [{
+                  id: `or3-verification-${metadataDeleteOpId}`,
+                  tableName: "file_meta",
+                  operation: "delete",
+                  pk: hash,
+                  payload: { hash },
+                  stamp: {
+                    deviceId: "or3-cloud-verification",
+                    opId: metadataDeleteOpId,
+                    hlc: `${String(metadataDeleteAt).padStart(13, "0")}:0000:or3-cloud-verification`,
+                    clock: metadataDeleteAt
+                  },
+                  createdAt: metadataDeleteAt,
+                  attempts: 0,
+                  status: "pending"
+                }]
+              }
+            });
+            if (deleted.results?.[0]?.success !== true) {
+              throw new Error(`Filesystem verification metadata cleanup failed: ${JSON.stringify(deleted)}`);
+            }
+          }
+        }
+      }
+    }
+    return health;
+  } finally {
+    await verificationJson(baseUrl, "/api/basic-auth/sign-out", {
+      cookie,
+      method: "POST"
+    });
+  }
+}
+function responseCookie(response, label) {
+  const headers = response.headers;
+  const values = headers.getSetCookie?.() ?? [response.headers.get("set-cookie")].filter((value) => Boolean(value));
+  const cookie = values.map((value) => value.split(";", 1)[0]).join("; ");
+  if (!cookie)
+    throw new Error(`${label} did not set a session cookie.`);
+  return cookie;
+}
+async function provisionManagedCredentialsOnce(baseUrl, email, password, adminUsername = email, adminPassword = password) {
+  const appSignIn = await verificationFetch(new URL("/api/basic-auth/sign-in", baseUrl), {
+    method: "POST",
+    headers: { accept: "application/json", "content-type": "application/json", origin: baseUrl.origin },
+    body: JSON.stringify({ email, password })
+  });
+  if (appSignIn.status !== 200)
+    throw new Error(`Managed owner provisioning returned HTTP ${appSignIn.status}.`);
+  const appCookie = responseCookie(appSignIn, "Managed owner provisioning");
+  try {
+    const session = await verificationJson(baseUrl, "/api/auth/session", { cookie: appCookie });
+    if (session.session?.user?.email !== email || !session.session?.workspace?.id) {
+      throw new Error("Managed owner provisioning did not create the expected account and workspace.");
+    }
+  } finally {
+    await verificationJson(baseUrl, "/api/basic-auth/sign-out", { cookie: appCookie, method: "POST" });
+  }
+  const adminSignIn = await verificationFetch(new URL("/api/admin/auth/login", baseUrl), {
+    method: "POST",
+    headers: { accept: "application/json", "content-type": "application/json", origin: baseUrl.origin },
+    body: JSON.stringify({ username: adminUsername, password: adminPassword })
+  });
+  if (adminSignIn.status !== 200)
+    throw new Error(`Managed admin provisioning returned HTTP ${adminSignIn.status}.`);
+  const adminCookie = responseCookie(adminSignIn, "Managed admin provisioning");
+  await verificationJson(baseUrl, "/api/admin/auth/logout", { cookie: adminCookie, method: "POST" });
+}
+async function provisionManagedCredentials(baseUrl, email, password, adminUsername = email, adminPassword = password) {
+  const deadline = Date.now() + 60000;
+  let lastError;
+  do {
+    try {
+      await provisionManagedCredentialsOnce(baseUrl, email, password, adminUsername, adminPassword);
+      return;
+    } catch (error) {
+      lastError = error;
+      await new Promise((resolveDelay) => setTimeout(resolveDelay, 2000));
+    }
+  } while (Date.now() < deadline);
+  throw new Error(`Managed credential provisioning did not become ready within 60 seconds: ${lastError instanceof Error ? lastError.message : String(lastError)}`);
+}
+async function verifyCommand(directory, flags, positionals) {
+  if (positionals.length)
+    throw new Error("verify accepts no positional arguments.");
+  if (flags.public !== undefined && !boolFlag(flags, "public"))
+    throw new Error("--public does not accept a value.");
+  await ensureDocker();
+  const loaded = await loadManaged(directory);
+  assertDeploymentDirectoryIdentity(directory, loaded.state);
+  assertNoPending(loaded.state);
+  if (boolFlag(flags, "public") && loaded.state.mode !== "public") {
+    throw new Error("--public requires a managed public deployment.");
+  }
+  if (loaded.env.OR3_VERSION !== loaded.state.appVersion || loaded.env.OR3_IMAGE !== loaded.state.image) {
+    throw new Error("Managed state and .env version/image do not match.");
+  }
+  const digest = await imageDigest(loaded.state.image);
+  if (digest !== loaded.state.imageDigest) {
+    throw new Error(`Managed image digest differs from state. Expected ${loaded.state.imageDigest}, found ${digest}.`);
+  }
+  await waitForDeepHealth(loaded.directory, loaded.state.mode, secretValues(loaded.env));
+  const baseUrl = new URL(loaded.state.mode === "public" ? `https://${loaded.state.domain}` : `http://127.0.0.1:${loaded.state.port}`);
+  await verifyPublicApplication(baseUrl, await verificationCredentials(loaded.directory, flags, loaded.env));
+  const databaseCheck = await run("docker", [
+    ...composeArgs(loaded.directory, loaded.state.mode, ["exec", "-T", "or3", ...containerNodeCommand(VERIFY_DATABASES_SCRIPT)])
+  ], loaded.directory);
+  if (!databaseCheck.ok)
+    throw new Error(`SQLite integrity or runtime proxy verification failed. ${databaseCheck.stderr.trim()}`);
+  const databases = JSON.parse(databaseCheck.stdout.trim());
+  if (databases.length !== 2 || databases.some((entry) => entry.quickCheck !== "ok" || entry.tables < 1)) {
+    throw new Error("SQLite verification did not confirm both managed databases.");
+  }
+  const services = loaded.state.mode === "public" ? ["or3", "caddy"] : ["or3"];
+  const logs = await run("docker", composeArgs(loaded.directory, loaded.state.mode, [
+    "logs",
+    "--no-color",
+    "--since",
+    "10m",
+    "--tail",
+    "250",
+    ...services
+  ]), loaded.directory);
+  if (!logs.ok)
+    throw new Error(`Could not read bounded deployment logs. ${logs.stderr.trim()}`);
+  const serious = `${logs.stdout}
+${logs.stderr}`.split(/\r?\n/).filter((line) => /\b(?:fatal|panic|oomkilled)\b|unhandled (?:rejection|exception)|out of memory/i.test(line));
+  if (serious.length)
+    throw new Error(`Recent deployment logs contain serious errors:
+${redact(serious.slice(-20).join(`
+`), secretValues(loaded.env))}`);
+  console.log(`✓ OR3 ${loaded.state.appVersion} image digest matches managed state`);
+  console.log(`✓ ${baseUrl.origin} root and deep health return HTTP 200 without redirects`);
+  console.log("✓ Basic Auth sign-in, session hydration, and SQLite sync pull passed");
+  console.log("✓ Filesystem storage write/read/delete probe passed");
+  console.log("✓ auth.sqlite and sync.sqlite quick_check passed with managed ownership");
+  console.log("✓ Recent bounded logs contain no fatal, panic, unhandled, or OOM events");
+  console.log("OR3 production verification passed.");
+}
 async function readSourceVolume(sourceDirectory) {
   const composeResult = await run("docker", [
     "compose",
@@ -2141,6 +3729,9 @@ function assertSupportedSource(sourceDirectory, sourceEnv, providers) {
   if (sourceEnv.SSR_AUTH_ENABLED === "false" || sourceEnv.OR3_GUEST_ACCESS_ENABLED === "true") {
     throw new Error("V1 project does not require authenticated access; adoption expects the supported authenticated profile.");
   }
+  if (sourceEnv.OR3_AUTH_REGISTRATION_MODE !== "invite_only" || sourceEnv.OR3_AUTH_AUTO_PROVISION !== "false") {
+    throw new Error("V1 project does not use the managed invite-only registration policy. Adoption refuses to carry open registration into OR3 Cloud.");
+  }
   if (sourceEnv.OR3_SYNC_PROVIDER !== "sqlite" || sourceEnv.OR3_STORAGE_FS_ROOT === undefined || sourceEnv.NUXT_PUBLIC_STORAGE_PROVIDER !== "fs") {
     throw new Error("V1 project is not the supported Basic Auth + SQLite + filesystem profile.");
   }
@@ -2201,6 +3792,9 @@ async function adoptCommand(positionals, flags) {
   const release = JSON.parse(await readText(join(sourceDirectory, "or3-release.json")));
   if (!release.or3Version || !isVersion(release.or3Version))
     throw new Error("V1 release metadata does not contain a usable OR3 version.");
+  if (release.or3Version !== PACKAGE_VERSION) {
+    throw new Error(`V1 is on OR3 ${release.or3Version}, but this CLI ships managed assets for ${PACKAGE_VERSION}. Run the matching @or3/cloud version or perform a qualified host CLI update before adoption.`);
+  }
   const sourceEnv = parseEnv(await readText(join(sourceDirectory, ".env")));
   const providers = await readText(join(sourceDirectory, "or3.providers.generated.ts"));
   assertSupportedSource(sourceDirectory, sourceEnv, providers);
@@ -2225,15 +3819,17 @@ async function adoptCommand(positionals, flags) {
   ], sourceDirectory);
   if (!sourceConfig.ok)
     throw new Error(`The V1 Compose configuration is invalid. ${redact(sourceConfig.stderr, secretValues(sourceEnv))}`);
-  const image = imageFor(release.or3Version);
+  const sourceImage = imageFor(release.or3Version);
   if (sourceEnv.OR3_VERSION && sourceEnv.OR3_VERSION !== release.or3Version) {
     throw new Error(`V1 OR3_VERSION ${sourceEnv.OR3_VERSION} does not match or3-release.json ${release.or3Version}.`);
   }
-  if (sourceEnv.OR3_IMAGE && sourceEnv.OR3_IMAGE !== image) {
-    throw new Error(`V1 OR3_IMAGE ${sourceEnv.OR3_IMAGE} does not match the published image for ${release.or3Version}.`);
+  const digest = await pullImage(sourceImage, expectedImageDigest(release.or3Version));
+  await assertSupportedHostArchitecture(sourceImage);
+  await assertImageReleaseIdentity(sourceImage, release.or3Version);
+  const image = imageAtDigest(sourceImage, digest);
+  if (sourceEnv.OR3_IMAGE && sourceEnv.OR3_IMAGE !== sourceImage && sourceEnv.OR3_IMAGE !== image) {
+    throw new Error(`V1 OR3_IMAGE ${sourceEnv.OR3_IMAGE} does not match the authenticated image for ${release.or3Version}.`);
   }
-  await pullImage(image);
-  await assertSupportedHostArchitecture(image);
   const sourceVolume = await readSourceVolume(sourceDirectory);
   const email = sourceEnv.OR3_BASIC_AUTH_BOOTSTRAP_EMAIL;
   const password = sourceEnv.OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD;
@@ -2245,15 +3841,40 @@ async function adoptCommand(positionals, flags) {
   if (mode === "public" && [80, 443].includes(sourcePort))
     throw new Error("V1 public deployment uses a Caddy port for OR3; adoption requires a separate OR3 port.");
   assertSupportedSourceCompose(sourceConfig.stdout, sourceVolume, sourcePort);
+  const sourceInitiallyRunning = await sourceServiceRunning(sourceDirectory, sourceComposeFiles);
+  const targetNames = composeProjectNames(targetDirectory);
+  await assertDockerProjectAbsent(targetNames.project);
+  for (const volume of [targetNames.volume, ...mode === "public" ? [targetNames.caddyData, targetNames.caddyConfig] : []]) {
+    const existing = await run("docker", ["volume", "inspect", volume]);
+    if (existing.ok)
+      throw new Error(`Docker volume ${volume} already exists. Choose a new adoption target directory.`);
+    if (existing.exitCode !== 1 || !/no such volume/i.test(`${existing.stdout}
+${existing.stderr}`)) {
+      throw new Error(`Could not confirm whether Docker volume ${volume} exists. Refusing adoption until Docker returns an explicit not-found result. ${existing.stderr.trim()}`);
+    }
+  }
   await mkdir(targetDirectory, { recursive: true, mode: 448 });
+  await chmod(targetDirectory, 448);
   await mkdir(deploymentPaths(targetDirectory).operations, { recursive: true, mode: 448 });
   await mkdir(deploymentPaths(targetDirectory).backups, { recursive: true, mode: 448 });
+  const operator = await prepareVerifiedDashboardOperator(targetDirectory, release.or3Version);
   await copyAssets(targetDirectory, mode);
   const copiedSecrets = {};
   for (const key of SECRET_KEYS)
     if (sourceEnv[key])
       copiedSecrets[key] = sourceEnv[key];
-  const targetEnv = buildEnv({ mode, version: release.or3Version, directory: targetDirectory, email, password, domain, port: sourcePort, secrets: copiedSecrets });
+  const targetEnv = buildEnv({
+    mode,
+    version: release.or3Version,
+    directory: targetDirectory,
+    image,
+    email,
+    password,
+    domain,
+    port: sourcePort,
+    secrets: copiedSecrets,
+    dashboardOperator: operator
+  });
   for (const key of ALLOWED_ENV_KEYS)
     if (sourceEnv[key] !== undefined)
       targetEnv[key] = sourceEnv[key];
@@ -2271,50 +3892,50 @@ async function adoptCommand(positionals, flags) {
     OR3_PUBLIC_DOMAIN: domain ?? "localhost",
     OR3_ALLOWED_ORIGINS: mode === "public" ? `https://${domain}` : `http://127.0.0.1:${sourcePort}`,
     OR3_FORCE_HTTPS: mode === "public" ? "true" : "false",
-    OR3_TRUST_PROXY: mode === "public" ? "true" : "false"
+    OR3_TRUST_PROXY: mode === "public" ? "true" : "false",
+    OR3_AUTH_REGISTRATION_MODE: "invite_only",
+    OR3_AUTH_AUTO_PROVISION: "false",
+    OR3_GUEST_ACCESS_ENABLED: "false"
   });
-  const targetNames = composeProjectNames(targetDirectory);
-  for (const volume of [targetNames.volume, ...mode === "public" ? [targetNames.caddyData, targetNames.caddyConfig] : []]) {
-    const existing = await run("docker", ["volume", "inspect", volume]);
-    if (existing.ok)
-      throw new Error(`Docker volume ${volume} already exists. Choose a new adoption target directory.`);
-  }
   await writeSecure(deploymentPaths(targetDirectory).env, serializeEnv(targetEnv));
   await writeSecure(join(targetDirectory, ".or3-initial-credentials"), serializeInitialCredentials({
     bootstrapEmail: email,
     bootstrapPassword: password,
-    adminUsername: email,
-    adminPassword: password
+    adminUsername: targetEnv.OR3_ADMIN_USERNAME,
+    adminPassword: targetEnv.OR3_ADMIN_PASSWORD
   }));
-  const digest = await imageDigest(image);
   const state = stateFromEnv(targetDirectory, targetEnv, mode, "adopt", digest);
+  const sourceBackupId = id("backup-adopt-source");
+  const sourceBackupDir = backupDirectory(targetDirectory, sourceBackupId);
   await markPending(targetDirectory, state, {
     id: id("adopt"),
     operation: "adopt",
     startedAt: now(),
     message: `Adopting ${sourceDirectory}`,
-    sourceDirectory
+    sourceDirectory,
+    sourceInitiallyRunning,
+    backupId: sourceBackupId,
+    backupPath: sourceBackupDir,
+    phase: "prepared"
   });
   let sourceStopAttempted = false;
-  let sourceBackupDir;
   try {
     sourceStopAttempted = true;
     const sourceStop = await run("docker", [...sourceComposeArgs(sourceDirectory, sourceComposeFiles), "stop"], sourceDirectory);
     if (!sourceStop.ok)
       throw new Error(`Could not stop the V1 deployment. ${redact(sourceStop.stderr, secretValues(sourceEnv))}`);
-    if (!await portAvailable(Number(targetEnv.OR3_PORT)))
+    const localDockerDaemon = await dockerDaemonIsLocal();
+    if (localDockerDaemon && !await portAvailable(Number(targetEnv.OR3_PORT)))
       throw new Error(`Port ${targetEnv.OR3_PORT} is still in use after stopping the V1 deployment.`);
-    if (mode === "public") {
+    if (mode === "public" && localDockerDaemon) {
       for (const publicPort of [80, 443]) {
         if (!await portAvailable(publicPort))
           throw new Error(`Public port ${publicPort} is still in use after stopping the V1 deployment.`);
       }
     }
-    const sourceBackupId = id("adopt-source");
-    sourceBackupDir = backupDirectory(targetDirectory, sourceBackupId);
     await mkdir(sourceBackupDir, { recursive: true, mode: 448 });
     await copySecure(join(sourceDirectory, ".env"), join(sourceBackupDir, "config.env"));
-    await archiveExternalVolume(image, sourceVolume, sourceBackupDir);
+    await archiveExternalVolume(sourceImage, sourceVolume, sourceBackupDir);
     const sourceManifest = {
       schemaVersion: 1,
       backupId: sourceBackupId,
@@ -2332,11 +3953,19 @@ async function adoptCommand(positionals, flags) {
       caddyConfigVolume: sourceEnv.OR3_CADDY_CONFIG_VOLUME,
       port: sourcePort
     };
-    await writeSecure(join(sourceBackupDir, "manifest.json"), `${JSON.stringify(sourceManifest, null, 2)}
-`);
-    await updatePending(targetDirectory, state, { backupId: sourceBackupId });
+    const sourceManifestContents = `${JSON.stringify(sourceManifest, null, 2)}
+`;
+    await writeSecure(join(sourceBackupDir, "manifest.json"), sourceManifestContents);
+    await writeBackupAuthentication(targetDirectory, sourceBackupDir, sourceManifestContents);
+    await readManifest(sourceBackupDir, targetDirectory);
+    await updatePending(targetDirectory, state, { phase: "snapshot-created" });
     await restoreVolumeArchive(targetDirectory, mode, targetEnv, sourceBackupDir);
     await startProject(targetDirectory, mode, targetEnv);
+    await provisionManagedCredentials(mode === "public" ? new URL(`https://${domain}`) : new URL(`http://127.0.0.1:${sourcePort}`), email, password, targetEnv.OR3_ADMIN_USERNAME, targetEnv.OR3_ADMIN_PASSWORD);
+    const runtimeEnv = withoutProvisioningCredentials(targetEnv);
+    await writeSecure(deploymentPaths(targetDirectory).env, serializeEnv(runtimeEnv));
+    await stopProject(targetDirectory, mode);
+    await startProject(targetDirectory, mode, runtimeEnv);
     await clearPending(targetDirectory, state);
     console.log(`Adopted ${sourceDirectory} into ${targetDirectory} at OR3 ${release.or3Version}.`);
     console.log(`Source backup: ${sourceBackupDir}`);
@@ -2346,7 +3975,7 @@ async function adoptCommand(positionals, flags) {
       return;
     });
     let sourceRecoveryError = "";
-    if (sourceStopAttempted) {
+    if (sourceStopAttempted && sourceInitiallyRunning) {
       try {
         await restartSource(sourceDirectory, sourceComposeFiles, secretValues(sourceEnv));
       } catch (recovery) {
@@ -2361,27 +3990,58 @@ ${sourceRecoveryError ? "The original V1 deployment needs manual recovery. " : "
 }
 async function resolveResetPasswords(flags) {
   const ownerPassword = stringFlag(flags, "owner-password");
+  const ownerPasswordFile = stringFlag(flags, "owner-password-file");
   const adminPassword = stringFlag(flags, "admin-password");
-  if (ownerPassword !== undefined || adminPassword !== undefined) {
-    if (ownerPassword === undefined || adminPassword === undefined) {
-      throw new Error("Use both --owner-password and --admin-password together so a reset never applies one credential without the other.");
+  const adminPasswordFile = stringFlag(flags, "admin-password-file");
+  if (flags["owner-password"] !== undefined && ownerPassword === undefined)
+    throw new Error("--owner-password requires a value.");
+  if (flags["admin-password"] !== undefined && adminPassword === undefined)
+    throw new Error("--admin-password requires a value.");
+  if (flags["owner-password-file"] !== undefined && !ownerPasswordFile)
+    throw new Error("--owner-password-file requires a path.");
+  if (flags["admin-password-file"] !== undefined && !adminPasswordFile)
+    throw new Error("--admin-password-file requires a path.");
+  if (ownerPassword !== undefined && ownerPasswordFile)
+    throw new Error("Use either --owner-password or --owner-password-file, not both.");
+  if (adminPassword !== undefined && adminPasswordFile)
+    throw new Error("Use either --admin-password or --admin-password-file, not both.");
+  const suppliedOwner = ownerPassword ?? (ownerPasswordFile ? (await readText(resolve(ownerPasswordFile))).trim() : undefined);
+  const suppliedAdmin = adminPassword ?? (adminPasswordFile ? (await readText(resolve(adminPasswordFile))).trim() : undefined);
+  if (suppliedOwner !== undefined || suppliedAdmin !== undefined) {
+    if (suppliedOwner === undefined || suppliedAdmin === undefined) {
+      throw new Error("Supply both owner and admin passwords so a reset never applies one credential without the other.");
     }
-    validatePassword(ownerPassword);
-    validatePassword(adminPassword);
-    return { ownerPassword, adminPassword };
+    validatePassword(suppliedOwner);
+    validatePassword(suppliedAdmin);
+    return { ownerPassword: suppliedOwner, adminPassword: suppliedAdmin };
   }
   if (!input.isTTY || !output.isTTY) {
-    throw new Error("--owner-password and --admin-password are required in a non-interactive session. Credentials are never generated automatically.");
+    throw new Error("--owner-password-file and --admin-password-file are required in a non-interactive session. Credentials are never generated automatically.");
   }
-  const prompt = readline.createInterface({ input, output });
+  const owner = (await maskedQuestion("New owner (basic auth) password: ")).trim();
+  validatePassword(owner);
+  const admin = (await maskedQuestion("New admin password: ")).trim();
+  validatePassword(admin);
+  return { ownerPassword: owner, adminPassword: admin };
+}
+async function maskedQuestion(question) {
+  let muted = false;
+  const maskedOutput = new Writable({
+    write(chunk, _encoding, callback) {
+      if (!muted)
+        output.write(chunk);
+      callback();
+    }
+  });
+  const prompt = readline.createInterface({ input, output: maskedOutput, terminal: true });
   try {
-    const owner = (await prompt.question("New owner (basic auth) password: ")).trim();
-    validatePassword(owner);
-    const admin = (await prompt.question("New admin password: ")).trim();
-    validatePassword(admin);
-    return { ownerPassword: owner, adminPassword: admin };
+    const answer = prompt.question(question);
+    muted = true;
+    return await answer;
   } finally {
     prompt.close();
+    output.write(`
+`);
   }
 }
 function buildCredentialsResetScript(input2) {
@@ -2449,24 +4109,32 @@ try {
 credentials.username = adminUsername;
 credentials.password_hash_bcrypt = adminHash;
 credentials.updated_at = new Date().toISOString();
-try {
-  fs.writeFileSync(adminCredentialsPath, JSON.stringify(credentials, null, 2) + '\\n', { mode: 0o600 });
-} catch (error) {
-  console.error('OR3 credentials reset failed: could not update the admin credentials file at ' + adminCredentialsPath + '. Nothing was changed. ' + (error && error.message ? error.message : String(error)));
-  process.exit(1);
-}
+const atomicWrite = (target, contents) => {
+  const temporary = target + '.reset-' + process.pid + '-' + Date.now();
+  const descriptor = fs.openSync(temporary, 'w', 0o600);
+  try {
+    fs.writeFileSync(descriptor, contents, 'utf8');
+    fs.fsyncSync(descriptor);
+  } finally {
+    fs.closeSync(descriptor);
+  }
+  fs.renameSync(temporary, target);
+  const directory = fs.openSync(path.dirname(target), 'r');
+  try { fs.fsyncSync(directory); } finally { fs.closeSync(directory); }
+};
 try {
   db.transaction(() => {
     db.prepare('UPDATE basic_auth_accounts SET password_hash = ?, token_version = token_version + 1, updated_at = ? WHERE id = ?').run(ownerHash, now, account.id);
     db.prepare('UPDATE basic_auth_sessions SET revoked_at = COALESCE(revoked_at, ?), rotation_grace_until = NULL, rotation_grace_refresh_token = NULL WHERE account_id = ?').run(now, account.id);
+    atomicWrite(adminCredentialsPath, JSON.stringify(credentials, null, 2) + '\\n');
   })();
 } catch (error) {
   if (previousCredentials !== null) {
-    try { fs.writeFileSync(adminCredentialsPath, previousCredentials, { mode: 0o600 }); } catch {}
+    try { atomicWrite(adminCredentialsPath, previousCredentials); } catch {}
   } else {
     try { fs.rmSync(adminCredentialsPath, { force: true }); } catch {}
   }
-  console.error('OR3 credentials reset failed: the authentication database rejected the update. Any partial change was rolled back. ' + (error && error.message ? error.message : String(error)));
+  console.error('OR3 credentials reset failed: the atomic database/file update did not complete. Replay is safe through the managed recovery journal. ' + (error && error.message ? error.message : String(error)));
   process.exit(1);
 }
 db.close();
@@ -2474,7 +4142,7 @@ console.log('credentials-reset: owner hash, sessions, and admin credentials upda
 `;
 }
 function credentialResetValues(env) {
-  const ownerEmail = env.OR3_BASIC_AUTH_BOOTSTRAP_EMAIL;
+  const ownerEmail = env.OR3_MANAGED_OWNER_EMAIL || env.OR3_BASIC_AUTH_BOOTSTRAP_EMAIL;
   const ownerPassword = env.OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD;
   const adminUsername = env.OR3_ADMIN_USERNAME;
   const adminPassword = env.OR3_ADMIN_PASSWORD;
@@ -2500,43 +4168,57 @@ Promise.all([
 `;
 async function runCredentialsResetScript(directory, mode, values) {
   const script = buildCredentialsResetScript(values);
+  const resetEnvironment = {
+    ...composeProcessEnv(directory),
+    OR3_RESET_OWNER_EMAIL: values.ownerEmail,
+    OR3_RESET_OWNER_PASSWORD: values.ownerPassword,
+    OR3_RESET_ADMIN_USERNAME: values.adminUsername,
+    OR3_RESET_ADMIN_PASSWORD: values.adminPassword
+  };
   const result = await run("docker", [
     ...composeArgs(directory, mode, [
       "exec",
       "-T",
       "-e",
-      `OR3_RESET_OWNER_EMAIL=${values.ownerEmail}`,
+      "OR3_RESET_OWNER_EMAIL",
       "-e",
-      `OR3_RESET_OWNER_PASSWORD=${values.ownerPassword}`,
+      "OR3_RESET_OWNER_PASSWORD",
       "-e",
-      `OR3_RESET_ADMIN_USERNAME=${values.adminUsername}`,
+      "OR3_RESET_ADMIN_USERNAME",
       "-e",
-      `OR3_RESET_ADMIN_PASSWORD=${values.adminPassword}`,
+      "OR3_RESET_ADMIN_PASSWORD",
       "or3",
       ...containerNodeCommand(script)
     ])
-  ], directory);
+  ], directory, resetEnvironment);
   if (!result.ok)
     throw new Error(`${result.command}
 ${redact(result.stderr, [values.ownerPassword, values.adminPassword])}`);
 }
 async function verifyCredentialsInsideContainer(directory, mode, values) {
+  const resetEnvironment = {
+    ...composeProcessEnv(directory),
+    OR3_RESET_OWNER_EMAIL: values.ownerEmail,
+    OR3_RESET_OWNER_PASSWORD: values.ownerPassword,
+    OR3_RESET_ADMIN_USERNAME: values.adminUsername,
+    OR3_RESET_ADMIN_PASSWORD: values.adminPassword
+  };
   const result = await run("docker", [
     ...composeArgs(directory, mode, [
       "exec",
       "-T",
       "-e",
-      `OR3_RESET_OWNER_EMAIL=${values.ownerEmail}`,
+      "OR3_RESET_OWNER_EMAIL",
       "-e",
-      `OR3_RESET_OWNER_PASSWORD=${values.ownerPassword}`,
+      "OR3_RESET_OWNER_PASSWORD",
       "-e",
-      `OR3_RESET_ADMIN_USERNAME=${values.adminUsername}`,
+      "OR3_RESET_ADMIN_USERNAME",
       "-e",
-      `OR3_RESET_ADMIN_PASSWORD=${values.adminPassword}`,
+      "OR3_RESET_ADMIN_PASSWORD",
       "or3",
       ...containerNodeCommand(CREDENTIALS_VERIFY_SCRIPT)
     ])
-  ], directory);
+  ], directory, resetEnvironment);
   if (!result.ok)
     throw new Error(`Credential verification inside the OR3 container failed. ${redact(result.stderr, [values.ownerPassword, values.adminPassword])}`);
 }
@@ -2548,18 +4230,12 @@ async function applyCredentialReset(directory, state, nextEnv) {
     await startProject(directory, state.mode, nextEnv);
   }
   await runCredentialsResetScript(directory, state.mode, values);
-  await writeSecure(deploymentPaths(directory).env, serializeEnv(nextEnv));
+  const runtimeEnv = withoutProvisioningCredentials(nextEnv);
+  await writeSecure(deploymentPaths(directory).env, serializeEnv(runtimeEnv));
   const initialCredentials = join(directory, ".or3-initial-credentials");
-  if (await fileExists(initialCredentials)) {
-    await writeSecure(initialCredentials, serializeInitialCredentials({
-      bootstrapEmail: values.ownerEmail,
-      bootstrapPassword: values.ownerPassword,
-      adminUsername: values.adminUsername,
-      adminPassword: values.adminPassword
-    }));
-  }
+  await rm(initialCredentials, { force: true });
   await stopProject(directory, state.mode);
-  await startProject(directory, state.mode, nextEnv);
+  await startProject(directory, state.mode, runtimeEnv);
   await verifyCredentialsInsideContainer(directory, state.mode, values);
 }
 async function credentialsResetCommand(directory, flags) {
@@ -2569,15 +4245,16 @@ async function credentialsResetCommand(directory, flags) {
   const loaded = await loadManaged(directory);
   assertDeploymentDirectoryIdentity(directory, loaded.state);
   assertNoPending(loaded.state);
-  const ownerEmail = loaded.env.OR3_BASIC_AUTH_BOOTSTRAP_EMAIL;
+  const ownerEmail = loaded.env.OR3_MANAGED_OWNER_EMAIL || loaded.env.OR3_BASIC_AUTH_BOOTSTRAP_EMAIL;
   const adminUsername = loaded.env.OR3_ADMIN_USERNAME;
   if (!ownerEmail)
-    throw new Error("OR3_BASIC_AUTH_BOOTSTRAP_EMAIL is missing from .env, so the owner account cannot be reset.");
+    throw new Error("The managed owner email is missing from .env, so the owner account cannot be reset.");
   if (!adminUsername)
     throw new Error("OR3_ADMIN_USERNAME is missing from .env, so the admin password cannot be reset.");
   const { ownerPassword, adminPassword } = await resolveResetPasswords(flags);
   const nextEnv = {
     ...loaded.env,
+    OR3_MANAGED_OWNER_EMAIL: ownerEmail,
     OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD: ownerPassword,
     OR3_ADMIN_PASSWORD: adminPassword,
     OR3_ADMIN_JWT_SECRET: randomSecret()
@@ -2594,7 +4271,7 @@ async function credentialsResetCommand(directory, flags) {
     await applyCredentialReset(loaded.directory, loaded.state, nextEnv);
     await clearPending(loaded.directory, loaded.state);
     console.log("Owner and admin credentials are now separate. The old owner password and all app sessions were revoked.");
-    console.log("Admin session cookies were invalidated by rotating OR3_ADMIN_JWT_SECRET. New passwords were written only to protected files; sign in again with them.");
+    console.log("Admin session cookies were invalidated by rotating OR3_ADMIN_JWT_SECRET. New passwords persist only as account hashes; sign in again with them.");
   } catch (error) {
     loaded.state.lastError = redact(error instanceof Error ? error.message : String(error), secretValues(nextEnv));
     await writeState(loaded.directory, loaded.state);
@@ -2744,8 +4421,12 @@ async function assertPurgeHasVerifiedExport(directory, backups, nowMs) {
     const receipt = await readBackupExportReceipt(directory, backup.backupId);
     if (!receipt || !await fileExists(receipt.destination))
       continue;
+    const deploymentRoot = await realpath(directory);
     try {
-      const exported = await readManifest(receipt.destination);
+      const canonicalDestination = await realpath(receipt.destination);
+      if (canonicalDestination === deploymentRoot || canonicalDestination.startsWith(`${deploymentRoot}${sep}`))
+        continue;
+      const exported = await readManifest(receipt.destination, directory);
       const sourceDevice = (await stat(backup.path)).dev;
       const destinationDevice = (await stat(receipt.destination)).dev;
       if (sourceDevice !== destinationDevice && receipt.destinationDevice === destinationDevice && exported.backupId === backup.backupId && exported.dataSha256 === receipt.dataSha256 && exported.dataSha256 === backup.dataSha256 && exported.configSha256 === receipt.configSha256)
@@ -2770,13 +4451,19 @@ async function removeCommand(directory, flags) {
   }
   const exportReceipt = await assertPurgeHasVerifiedExport(directory, await enumerateBackups(directory), Date.now());
   const volumes = purgeVolumesFromState(state);
-  const managedFiles = [".env", ".or3-cloud", "compose.yaml", ...state.mode === "public" ? ["compose.public.yaml", "Caddyfile"] : [], ".or3-initial-credentials"];
+  const managedFiles = [
+    ".env",
+    ".or3-cloud",
+    ...managedAssetNames(state.mode),
+    ".or3-initial-credentials"
+  ];
   console.log("Removing exactly these targets:");
   for (const volume of volumes)
     console.log(`  docker volume ${volume}`);
   for (const file of managedFiles)
     console.log(`  ${join(directory, file)}`);
   await compose(directory, state.mode, ["down"]);
+  await assertPurgeHasVerifiedExport(directory, await enumerateBackups(directory), Date.now());
   for (const volume of volumes) {
     const result = await run("docker", ["volume", "rm", volume], directory);
     if (!result.ok)
@@ -2797,6 +4484,30 @@ async function probeDeepHealth(directory, mode) {
     return "degraded";
   return "unreachable";
 }
+var MUTATING_COMMANDS = new Set([
+  "init",
+  "update",
+  "backup",
+  "verify",
+  "restore",
+  "rollback",
+  "credentials",
+  "recover",
+  "adopt",
+  "start",
+  "stop",
+  "restart",
+  "remove"
+]);
+function mutationDirectory(command, positionals, flags) {
+  if (command === "init")
+    return resolve(process.cwd(), positionals[0] ?? "or3-cloud");
+  if (command === "adopt") {
+    const sourceDirectory = requireStringFlag(flags, "from");
+    return resolve(process.cwd(), positionals[0] ?? `${basename(sourceDirectory)}-managed`);
+  }
+  return process.cwd();
+}
 async function main(argv = process.argv.slice(2)) {
   const [command = "help", ...rest] = argv;
   if (command === "--help" || command === "help")
@@ -2808,37 +4519,46 @@ async function main(argv = process.argv.slice(2)) {
     if (parsed.flags.help)
       return help();
     assertCommandFlags(command, parsed.flags);
-    if (command === "init")
-      return await initCommand(parsed.positionals, parsed.flags);
-    if (command === "update")
-      return await updateCommand(process.cwd(), parsed.flags);
-    if (command === "backup")
-      return await backupCommand(process.cwd(), parsed.positionals, parsed.flags);
-    if (command === "restore")
-      return await restoreCommand(process.cwd(), parsed.flags, parsed.positionals);
-    if (command === "rollback")
-      return await rollbackCommand(process.cwd(), parsed.flags);
-    if (command === "credentials")
-      return await credentialsCommand(process.cwd(), parsed.positionals, parsed.flags);
-    if (command === "doctor")
-      return await doctorCommand(process.cwd());
-    if (command === "recover")
-      return await recoverCommand(process.cwd());
-    if (command === "adopt")
-      return await adoptCommand(parsed.positionals, parsed.flags);
-    if (command === "status")
-      return await statusCommand(process.cwd());
-    if (command === "logs")
-      return await logsCommand(process.cwd(), parsed.flags, parsed.positionals);
-    if (command === "start")
-      return await startCommand(process.cwd());
-    if (command === "stop")
-      return await stopCommand(process.cwd());
-    if (command === "restart")
-      return await restartCommand(process.cwd());
-    if (command === "remove")
-      return await removeCommand(process.cwd(), parsed.flags);
-    throw new Error(`Unknown command "${command}". Run npx @or3/cloud --help.`);
+    assertCommandPositionals(command, parsed.positionals);
+    const dispatch = async () => {
+      if (command === "init")
+        return await initCommand(parsed.positionals, parsed.flags);
+      if (command === "update")
+        return await updateCommand(process.cwd(), parsed.flags);
+      if (command === "backup")
+        return await backupCommand(process.cwd(), parsed.positionals, parsed.flags);
+      if (command === "restore")
+        return await restoreCommand(process.cwd(), parsed.flags, parsed.positionals);
+      if (command === "rollback")
+        return await rollbackCommand(process.cwd(), parsed.flags);
+      if (command === "credentials")
+        return await credentialsCommand(process.cwd(), parsed.positionals, parsed.flags);
+      if (command === "doctor")
+        return await doctorCommand(process.cwd());
+      if (command === "verify")
+        return await verifyCommand(process.cwd(), parsed.flags, parsed.positionals);
+      if (command === "recover")
+        return await recoverCommand(process.cwd());
+      if (command === "adopt")
+        return await adoptCommand(parsed.positionals, parsed.flags);
+      if (command === "status")
+        return await statusCommand(process.cwd());
+      if (command === "logs")
+        return await logsCommand(process.cwd(), parsed.flags, parsed.positionals);
+      if (command === "start")
+        return await startCommand(process.cwd());
+      if (command === "stop")
+        return await stopCommand(process.cwd());
+      if (command === "restart")
+        return await restartCommand(process.cwd());
+      if (command === "remove")
+        return await removeCommand(process.cwd(), parsed.flags);
+      throw new Error(`Unknown command "${command}". Run npx @or3/cloud --help.`);
+    };
+    if (MUTATING_COMMANDS.has(command)) {
+      return await withDeploymentLease(mutationDirectory(command, parsed.positionals, parsed.flags), command, dispatch);
+    }
+    return await dispatch();
   } catch (error) {
     console.error(`
 OR3 Cloud failed: ${redact(error instanceof Error ? error.message : String(error))}`);
@@ -2850,13 +4570,18 @@ if (invokedAsCli || process.argv[1] && resolve(process.argv[1]) === resolve(file
   await main();
 }
 export {
+  withoutProvisioningCredentials,
+  validateVerificationHealth,
   validatePassword,
+  updateRequiresVolumeRecreation,
   supportedImageArchitectures,
   stateFromEnv,
   snapshotManagedAssets,
   serializeInitialCredentials,
   serializeEnv,
   selectPruneTargets,
+  sameOriginVerificationUrl,
+  restoreRequiresVolumeRecreation,
   restoreManagedAssets,
   requiredArchiveSpace,
   redact,
@@ -2869,12 +4594,15 @@ export {
   checkResolvedLoopbackBinding,
   buildEnv,
   buildCredentialsResetScript,
+  assertVerificationGrant,
   assertSupportedSourceCompose,
   assertSupportedSource,
   assertSupportedArchitecture,
   assertRemovableArtifactName,
   assertPurgeBackupFreshness,
+  assertImageReleaseLabels,
   assertEnoughFreeSpace,
+  assertCommandPositionals,
   assertCommandFlags,
   assertBackupMatchesDeployment,
   PACKAGE_VERSION,