@rallycry/conveyor-k3 0.1.11 → 0.1.13

package/dist/index.js

@@ -21,8 +21,61 @@ function buildConveyorSocketOptions(auth) {
   };
 }
 
+// src/daemon/control-endpoint.ts
+import { lookup as dnsLookup } from "dns";
+import { existsSync, readFileSync } from "fs";
+import { Agent } from "https";
+var CONTROL_FILE = "/etc/conveyor-vm/control.json";
+var CONTROL_ALIAS_IP = /^192\.168\.5\.24[0-7]$/;
+function readControlFile(path) {
+  try {
+    return readFileSync(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+function controlAlias(apiUrl, text) {
+  if (!text) return void 0;
+  let hostname;
+  let aliases;
+  try {
+    hostname = new URL(apiUrl).hostname.toLowerCase();
+    aliases = JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+  if (typeof aliases !== "object" || aliases === null || Array.isArray(aliases)) return void 0;
+  const alias = aliases[hostname];
+  return typeof alias === "string" && CONTROL_ALIAS_IP.test(alias) ? { hostname, alias } : void 0;
+}
+function controlPlaneRoute(apiUrl, readFile3 = readControlFile, fileExists = existsSync) {
+  if (!fileExists(CONTROL_FILE)) return void 0;
+  let skipAlias = false;
+  let usedAlias = false;
+  const lookup = (hostname, options, callback) => {
+    const target = skipAlias ? void 0 : controlAlias(apiUrl, readFile3(CONTROL_FILE));
+    usedAlias = target !== void 0 && hostname.toLowerCase() === target.hostname;
+    if (!target || !usedAlias) {
+      dnsLookup(hostname, options, callback);
+      return;
+    }
+    if (options.all) {
+      const addresses = [{ address: target.alias, family: 4 }];
+      callback(null, addresses);
+    } else callback(null, target.alias, 4);
+  };
+  return {
+    agent: new Agent({ lookup }),
+    // After a failure through the alias, try DNS; after a failure through DNS,
+    // try the alias again. A lasting fault in either route costs one attempt.
+    failed: () => {
+      skipAlias = usedAlias;
+    }
+  };
+}
+
 // src/daemon/device-proof.ts
-import { lstatSync, readFileSync } from "fs";
+import { lstatSync, readFileSync as readFileSync2 } from "fs";
 import { createPrivateKey, randomBytes, sign } from "crypto";
 var DEVICE_KEY_PATH = "/etc/conveyor/device-key.pem";
 function privateDeviceKey(path, ownerUid) {
@@ -37,7 +90,7 @@ function privateDeviceKey(path, ownerUid) {
     throw new Error("Conveyor device key must be a regular file.");
   if ((stat.mode & 511) !== 384 || stat.uid !== ownerUid)
     throw new Error("Conveyor device key must be owned by root with mode 0600.");
-  const pem = readFileSync(path, "utf8");
+  const pem = readFileSync2(path, "utf8");
   if (Buffer.byteLength(pem) > 16 * 1024) throw new Error("Conveyor device key is too large.");
   const key = createPrivateKey(pem);
   if (key.asymmetricKeyType !== "ed25519")
@@ -48,7 +101,7 @@ function createClusterProof(apiUrl, clusterToken, key) {
   const origin = new URL(apiUrl).origin;
   const timestamp = Date.now();
   const nonce = randomBytes(32).toString("base64url");
-  const message = `conveyor-device-v1
+  const message2 = `conveyor-device-v1
 ${origin}
 ${clusterToken}
 ${timestamp}
@@ -56,7 +109,7 @@ ${nonce}`;
   return {
     timestamp,
     nonce,
-    signature: sign(null, Buffer.from(message, "utf8"), key).toString("base64url")
+    signature: sign(null, Buffer.from(message2, "utf8"), key).toString("base64url")
   };
 }
 function deviceClusterAuth(apiUrl, clusterToken, keyPath = DEVICE_KEY_PATH, ownerUid = 0) {
@@ -434,104 +487,104 @@ ZodError.create = (issues) => {
 
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
-  let message;
+  let message2;
   switch (issue.code) {
     case ZodIssueCode.invalid_type:
       if (issue.received === ZodParsedType.undefined) {
-        message = "Required";
+        message2 = "Required";
       } else {
-        message = `Expected ${issue.expected}, received ${issue.received}`;
+        message2 = `Expected ${issue.expected}, received ${issue.received}`;
       }
       break;
     case ZodIssueCode.invalid_literal:
-      message = `Invalid literal value, expected ${JSON.stringify(issue.expected, util.jsonStringifyReplacer)}`;
+      message2 = `Invalid literal value, expected ${JSON.stringify(issue.expected, util.jsonStringifyReplacer)}`;
       break;
     case ZodIssueCode.unrecognized_keys:
-      message = `Unrecognized key(s) in object: ${util.joinValues(issue.keys, ", ")}`;
+      message2 = `Unrecognized key(s) in object: ${util.joinValues(issue.keys, ", ")}`;
       break;
     case ZodIssueCode.invalid_union:
-      message = `Invalid input`;
+      message2 = `Invalid input`;
       break;
     case ZodIssueCode.invalid_union_discriminator:
-      message = `Invalid discriminator value. Expected ${util.joinValues(issue.options)}`;
+      message2 = `Invalid discriminator value. Expected ${util.joinValues(issue.options)}`;
       break;
     case ZodIssueCode.invalid_enum_value:
-      message = `Invalid enum value. Expected ${util.joinValues(issue.options)}, received '${issue.received}'`;
+      message2 = `Invalid enum value. Expected ${util.joinValues(issue.options)}, received '${issue.received}'`;
       break;
     case ZodIssueCode.invalid_arguments:
-      message = `Invalid function arguments`;
+      message2 = `Invalid function arguments`;
       break;
     case ZodIssueCode.invalid_return_type:
-      message = `Invalid function return type`;
+      message2 = `Invalid function return type`;
       break;
     case ZodIssueCode.invalid_date:
-      message = `Invalid date`;
+      message2 = `Invalid date`;
       break;
     case ZodIssueCode.invalid_string:
       if (typeof issue.validation === "object") {
         if ("includes" in issue.validation) {
-          message = `Invalid input: must include "${issue.validation.includes}"`;
+          message2 = `Invalid input: must include "${issue.validation.includes}"`;
           if (typeof issue.validation.position === "number") {
-            message = `${message} at one or more positions greater than or equal to ${issue.validation.position}`;
+            message2 = `${message2} at one or more positions greater than or equal to ${issue.validation.position}`;
           }
         } else if ("startsWith" in issue.validation) {
-          message = `Invalid input: must start with "${issue.validation.startsWith}"`;
+          message2 = `Invalid input: must start with "${issue.validation.startsWith}"`;
         } else if ("endsWith" in issue.validation) {
-          message = `Invalid input: must end with "${issue.validation.endsWith}"`;
+          message2 = `Invalid input: must end with "${issue.validation.endsWith}"`;
         } else {
           util.assertNever(issue.validation);
         }
       } else if (issue.validation !== "regex") {
-        message = `Invalid ${issue.validation}`;
+        message2 = `Invalid ${issue.validation}`;
       } else {
-        message = "Invalid";
+        message2 = "Invalid";
       }
       break;
     case ZodIssueCode.too_small:
       if (issue.type === "array")
-        message = `Array must contain ${issue.exact ? "exactly" : issue.inclusive ? `at least` : `more than`} ${issue.minimum} element(s)`;
+        message2 = `Array must contain ${issue.exact ? "exactly" : issue.inclusive ? `at least` : `more than`} ${issue.minimum} element(s)`;
       else if (issue.type === "string")
-        message = `String must contain ${issue.exact ? "exactly" : issue.inclusive ? `at least` : `over`} ${issue.minimum} character(s)`;
+        message2 = `String must contain ${issue.exact ? "exactly" : issue.inclusive ? `at least` : `over`} ${issue.minimum} character(s)`;
       else if (issue.type === "number")
-        message = `Number must be ${issue.exact ? `exactly equal to ` : issue.inclusive ? `greater than or equal to ` : `greater than `}${issue.minimum}`;
+        message2 = `Number must be ${issue.exact ? `exactly equal to ` : issue.inclusive ? `greater than or equal to ` : `greater than `}${issue.minimum}`;
       else if (issue.type === "bigint")
-        message = `Number must be ${issue.exact ? `exactly equal to ` : issue.inclusive ? `greater than or equal to ` : `greater than `}${issue.minimum}`;
+        message2 = `Number must be ${issue.exact ? `exactly equal to ` : issue.inclusive ? `greater than or equal to ` : `greater than `}${issue.minimum}`;
       else if (issue.type === "date")
-        message = `Date must be ${issue.exact ? `exactly equal to ` : issue.inclusive ? `greater than or equal to ` : `greater than `}${new Date(Number(issue.minimum))}`;
+        message2 = `Date must be ${issue.exact ? `exactly equal to ` : issue.inclusive ? `greater than or equal to ` : `greater than `}${new Date(Number(issue.minimum))}`;
       else
-        message = "Invalid input";
+        message2 = "Invalid input";
       break;
     case ZodIssueCode.too_big:
       if (issue.type === "array")
-        message = `Array must contain ${issue.exact ? `exactly` : issue.inclusive ? `at most` : `less than`} ${issue.maximum} element(s)`;
+        message2 = `Array must contain ${issue.exact ? `exactly` : issue.inclusive ? `at most` : `less than`} ${issue.maximum} element(s)`;
       else if (issue.type === "string")
-        message = `String must contain ${issue.exact ? `exactly` : issue.inclusive ? `at most` : `under`} ${issue.maximum} character(s)`;
+        message2 = `String must contain ${issue.exact ? `exactly` : issue.inclusive ? `at most` : `under`} ${issue.maximum} character(s)`;
       else if (issue.type === "number")
-        message = `Number must be ${issue.exact ? `exactly` : issue.inclusive ? `less than or equal to` : `less than`} ${issue.maximum}`;
+        message2 = `Number must be ${issue.exact ? `exactly` : issue.inclusive ? `less than or equal to` : `less than`} ${issue.maximum}`;
       else if (issue.type === "bigint")
-        message = `BigInt must be ${issue.exact ? `exactly` : issue.inclusive ? `less than or equal to` : `less than`} ${issue.maximum}`;
+        message2 = `BigInt must be ${issue.exact ? `exactly` : issue.inclusive ? `less than or equal to` : `less than`} ${issue.maximum}`;
       else if (issue.type === "date")
-        message = `Date must be ${issue.exact ? `exactly` : issue.inclusive ? `smaller than or equal to` : `smaller than`} ${new Date(Number(issue.maximum))}`;
+        message2 = `Date must be ${issue.exact ? `exactly` : issue.inclusive ? `smaller than or equal to` : `smaller than`} ${new Date(Number(issue.maximum))}`;
       else
-        message = "Invalid input";
+        message2 = "Invalid input";
       break;
     case ZodIssueCode.custom:
-      message = `Invalid input`;
+      message2 = `Invalid input`;
       break;
     case ZodIssueCode.invalid_intersection_types:
-      message = `Intersection results could not be merged`;
+      message2 = `Intersection results could not be merged`;
       break;
     case ZodIssueCode.not_multiple_of:
-      message = `Number must be a multiple of ${issue.multipleOf}`;
+      message2 = `Number must be a multiple of ${issue.multipleOf}`;
       break;
     case ZodIssueCode.not_finite:
-      message = "Number must be finite";
+      message2 = "Number must be finite";
       break;
     default:
-      message = _ctx.defaultError;
+      message2 = _ctx.defaultError;
       util.assertNever(issue);
   }
-  return { message };
+  return { message: message2 };
 };
 var en_default = errorMap;
 
@@ -657,8 +710,8 @@ var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 (function(errorUtil2) {
-  errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
-  errorUtil2.toString = (message) => typeof message === "string" ? message : message?.message;
+  errorUtil2.errToObj = (message2) => typeof message2 === "string" ? { message: message2 } : message2 || {};
+  errorUtil2.toString = (message2) => typeof message2 === "string" ? message2 : message2?.message;
 })(errorUtil || (errorUtil = {}));
 
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
@@ -710,16 +763,16 @@ function processCreateParams(params) {
   if (errorMap2)
     return { errorMap: errorMap2, description };
   const customMap = (iss, ctx) => {
-    const { message } = params;
+    const { message: message2 } = params;
     if (iss.code === "invalid_enum_value") {
-      return { message: message ?? ctx.defaultError };
+      return { message: message2 ?? ctx.defaultError };
     }
     if (typeof ctx.data === "undefined") {
-      return { message: message ?? required_error ?? ctx.defaultError };
+      return { message: message2 ?? required_error ?? ctx.defaultError };
     }
     if (iss.code !== "invalid_type")
       return { message: ctx.defaultError };
-    return { message: message ?? invalid_type_error ?? ctx.defaultError };
+    return { message: message2 ?? invalid_type_error ?? ctx.defaultError };
   };
   return { errorMap: customMap, description };
 }
@@ -845,14 +898,14 @@ var ZodType = class {
     const result = await (isAsync(maybeAsyncResult) ? maybeAsyncResult : Promise.resolve(maybeAsyncResult));
     return handleResult(ctx, result);
   }
-  refine(check, message) {
+  refine(check, message2) {
     const getIssueProperties = (val) => {
-      if (typeof message === "string" || typeof message === "undefined") {
-        return { message };
-      } else if (typeof message === "function") {
-        return message(val);
+      if (typeof message2 === "string" || typeof message2 === "undefined") {
+        return { message: message2 };
+      } else if (typeof message2 === "function") {
+        return message2(val);
       } else {
-        return message;
+        return message2;
       }
     };
     return this._refinement((val, ctx) => {
@@ -1388,11 +1441,11 @@ var ZodString = class _ZodString extends ZodType {
     }
     return { status: status.value, value: input.data };
   }
-  _regex(regex, validation, message) {
+  _regex(regex, validation, message2) {
     return this.refinement((data) => regex.test(data), {
       validation,
       code: ZodIssueCode.invalid_string,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
   _addCheck(check) {
@@ -1401,37 +1454,37 @@ var ZodString = class _ZodString extends ZodType {
       checks: [...this._def.checks, check]
     });
   }
-  email(message) {
-    return this._addCheck({ kind: "email", ...errorUtil.errToObj(message) });
+  email(message2) {
+    return this._addCheck({ kind: "email", ...errorUtil.errToObj(message2) });
   }
-  url(message) {
-    return this._addCheck({ kind: "url", ...errorUtil.errToObj(message) });
+  url(message2) {
+    return this._addCheck({ kind: "url", ...errorUtil.errToObj(message2) });
   }
-  emoji(message) {
-    return this._addCheck({ kind: "emoji", ...errorUtil.errToObj(message) });
+  emoji(message2) {
+    return this._addCheck({ kind: "emoji", ...errorUtil.errToObj(message2) });
   }
-  uuid(message) {
-    return this._addCheck({ kind: "uuid", ...errorUtil.errToObj(message) });
+  uuid(message2) {
+    return this._addCheck({ kind: "uuid", ...errorUtil.errToObj(message2) });
   }
-  nanoid(message) {
-    return this._addCheck({ kind: "nanoid", ...errorUtil.errToObj(message) });
+  nanoid(message2) {
+    return this._addCheck({ kind: "nanoid", ...errorUtil.errToObj(message2) });
   }
-  cuid(message) {
-    return this._addCheck({ kind: "cuid", ...errorUtil.errToObj(message) });
+  cuid(message2) {
+    return this._addCheck({ kind: "cuid", ...errorUtil.errToObj(message2) });
   }
-  cuid2(message) {
-    return this._addCheck({ kind: "cuid2", ...errorUtil.errToObj(message) });
+  cuid2(message2) {
+    return this._addCheck({ kind: "cuid2", ...errorUtil.errToObj(message2) });
   }
-  ulid(message) {
-    return this._addCheck({ kind: "ulid", ...errorUtil.errToObj(message) });
+  ulid(message2) {
+    return this._addCheck({ kind: "ulid", ...errorUtil.errToObj(message2) });
   }
-  base64(message) {
-    return this._addCheck({ kind: "base64", ...errorUtil.errToObj(message) });
+  base64(message2) {
+    return this._addCheck({ kind: "base64", ...errorUtil.errToObj(message2) });
   }
-  base64url(message) {
+  base64url(message2) {
     return this._addCheck({
       kind: "base64url",
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
   jwt(options) {
@@ -1461,8 +1514,8 @@ var ZodString = class _ZodString extends ZodType {
       ...errorUtil.errToObj(options?.message)
     });
   }
-  date(message) {
-    return this._addCheck({ kind: "date", message });
+  date(message2) {
+    return this._addCheck({ kind: "date", message: message2 });
   }
   time(options) {
     if (typeof options === "string") {
@@ -1478,14 +1531,14 @@ var ZodString = class _ZodString extends ZodType {
       ...errorUtil.errToObj(options?.message)
     });
   }
-  duration(message) {
-    return this._addCheck({ kind: "duration", ...errorUtil.errToObj(message) });
+  duration(message2) {
+    return this._addCheck({ kind: "duration", ...errorUtil.errToObj(message2) });
   }
-  regex(regex, message) {
+  regex(regex, message2) {
     return this._addCheck({
       kind: "regex",
       regex,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
   includes(value, options) {
@@ -1496,46 +1549,46 @@ var ZodString = class _ZodString extends ZodType {
       ...errorUtil.errToObj(options?.message)
     });
   }
-  startsWith(value, message) {
+  startsWith(value, message2) {
     return this._addCheck({
       kind: "startsWith",
       value,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
-  endsWith(value, message) {
+  endsWith(value, message2) {
     return this._addCheck({
       kind: "endsWith",
       value,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
-  min(minLength, message) {
+  min(minLength, message2) {
     return this._addCheck({
       kind: "min",
       value: minLength,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
-  max(maxLength, message) {
+  max(maxLength, message2) {
     return this._addCheck({
       kind: "max",
       value: maxLength,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
-  length(len, message) {
+  length(len, message2) {
     return this._addCheck({
       kind: "length",
       value: len,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
   /**
    * Equivalent to `.min(1)`
    */
-  nonempty(message) {
-    return this.min(1, errorUtil.errToObj(message));
+  nonempty(message2) {
+    return this.min(1, errorUtil.errToObj(message2));
   }
   trim() {
     return new _ZodString({
@@ -1728,19 +1781,19 @@ var ZodNumber = class _ZodNumber extends ZodType {
     }
     return { status: status.value, value: input.data };
   }
-  gte(value, message) {
-    return this.setLimit("min", value, true, errorUtil.toString(message));
+  gte(value, message2) {
+    return this.setLimit("min", value, true, errorUtil.toString(message2));
   }
-  gt(value, message) {
-    return this.setLimit("min", value, false, errorUtil.toString(message));
+  gt(value, message2) {
+    return this.setLimit("min", value, false, errorUtil.toString(message2));
   }
-  lte(value, message) {
-    return this.setLimit("max", value, true, errorUtil.toString(message));
+  lte(value, message2) {
+    return this.setLimit("max", value, true, errorUtil.toString(message2));
   }
-  lt(value, message) {
-    return this.setLimit("max", value, false, errorUtil.toString(message));
+  lt(value, message2) {
+    return this.setLimit("max", value, false, errorUtil.toString(message2));
   }
-  setLimit(kind, value, inclusive, message) {
+  setLimit(kind, value, inclusive, message2) {
     return new _ZodNumber({
       ...this._def,
       checks: [
@@ -1749,7 +1802,7 @@ var ZodNumber = class _ZodNumber extends ZodType {
           kind,
           value,
           inclusive,
-          message: errorUtil.toString(message)
+          message: errorUtil.toString(message2)
         }
       ]
     });
@@ -1760,68 +1813,68 @@ var ZodNumber = class _ZodNumber extends ZodType {
       checks: [...this._def.checks, check]
     });
   }
-  int(message) {
+  int(message2) {
     return this._addCheck({
       kind: "int",
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  positive(message) {
+  positive(message2) {
     return this._addCheck({
       kind: "min",
       value: 0,
       inclusive: false,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  negative(message) {
+  negative(message2) {
     return this._addCheck({
       kind: "max",
       value: 0,
       inclusive: false,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  nonpositive(message) {
+  nonpositive(message2) {
     return this._addCheck({
       kind: "max",
       value: 0,
       inclusive: true,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  nonnegative(message) {
+  nonnegative(message2) {
     return this._addCheck({
       kind: "min",
       value: 0,
       inclusive: true,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  multipleOf(value, message) {
+  multipleOf(value, message2) {
     return this._addCheck({
       kind: "multipleOf",
       value,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  finite(message) {
+  finite(message2) {
     return this._addCheck({
       kind: "finite",
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  safe(message) {
+  safe(message2) {
     return this._addCheck({
       kind: "min",
       inclusive: true,
       value: Number.MIN_SAFE_INTEGER,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     })._addCheck({
       kind: "max",
       inclusive: true,
       value: Number.MAX_SAFE_INTEGER,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
   get minValue() {
@@ -1944,19 +1997,19 @@ var ZodBigInt = class _ZodBigInt extends ZodType {
     });
     return INVALID;
   }
-  gte(value, message) {
-    return this.setLimit("min", value, true, errorUtil.toString(message));
+  gte(value, message2) {
+    return this.setLimit("min", value, true, errorUtil.toString(message2));
   }
-  gt(value, message) {
-    return this.setLimit("min", value, false, errorUtil.toString(message));
+  gt(value, message2) {
+    return this.setLimit("min", value, false, errorUtil.toString(message2));
   }
-  lte(value, message) {
-    return this.setLimit("max", value, true, errorUtil.toString(message));
+  lte(value, message2) {
+    return this.setLimit("max", value, true, errorUtil.toString(message2));
   }
-  lt(value, message) {
-    return this.setLimit("max", value, false, errorUtil.toString(message));
+  lt(value, message2) {
+    return this.setLimit("max", value, false, errorUtil.toString(message2));
   }
-  setLimit(kind, value, inclusive, message) {
+  setLimit(kind, value, inclusive, message2) {
     return new _ZodBigInt({
       ...this._def,
       checks: [
@@ -1965,7 +2018,7 @@ var ZodBigInt = class _ZodBigInt extends ZodType {
           kind,
           value,
           inclusive,
-          message: errorUtil.toString(message)
+          message: errorUtil.toString(message2)
         }
       ]
     });
@@ -1976,43 +2029,43 @@ var ZodBigInt = class _ZodBigInt extends ZodType {
       checks: [...this._def.checks, check]
     });
   }
-  positive(message) {
+  positive(message2) {
     return this._addCheck({
       kind: "min",
       value: BigInt(0),
       inclusive: false,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  negative(message) {
+  negative(message2) {
     return this._addCheck({
       kind: "max",
       value: BigInt(0),
       inclusive: false,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  nonpositive(message) {
+  nonpositive(message2) {
     return this._addCheck({
       kind: "max",
       value: BigInt(0),
       inclusive: true,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  nonnegative(message) {
+  nonnegative(message2) {
     return this._addCheck({
       kind: "min",
       value: BigInt(0),
       inclusive: true,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  multipleOf(value, message) {
+  multipleOf(value, message2) {
     return this._addCheck({
       kind: "multipleOf",
       value,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
   get minValue() {
@@ -2135,18 +2188,18 @@ var ZodDate = class _ZodDate extends ZodType {
       checks: [...this._def.checks, check]
     });
   }
-  min(minDate, message) {
+  min(minDate, message2) {
     return this._addCheck({
       kind: "min",
       value: minDate.getTime(),
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  max(maxDate, message) {
+  max(maxDate, message2) {
     return this._addCheck({
       kind: "max",
       value: maxDate.getTime(),
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
   get minDate() {
@@ -2378,26 +2431,26 @@ var ZodArray = class _ZodArray extends ZodType {
   get element() {
     return this._def.type;
   }
-  min(minLength, message) {
+  min(minLength, message2) {
     return new _ZodArray({
       ...this._def,
-      minLength: { value: minLength, message: errorUtil.toString(message) }
+      minLength: { value: minLength, message: errorUtil.toString(message2) }
     });
   }
-  max(maxLength, message) {
+  max(maxLength, message2) {
     return new _ZodArray({
       ...this._def,
-      maxLength: { value: maxLength, message: errorUtil.toString(message) }
+      maxLength: { value: maxLength, message: errorUtil.toString(message2) }
     });
   }
-  length(len, message) {
+  length(len, message2) {
     return new _ZodArray({
       ...this._def,
-      exactLength: { value: len, message: errorUtil.toString(message) }
+      exactLength: { value: len, message: errorUtil.toString(message2) }
     });
   }
-  nonempty(message) {
-    return this.min(1, message);
+  nonempty(message2) {
+    return this.min(1, message2);
   }
 };
 ZodArray.create = (schema, params) => {
@@ -2540,17 +2593,17 @@ var ZodObject = class _ZodObject extends ZodType {
   get shape() {
     return this._def.shape();
   }
-  strict(message) {
+  strict(message2) {
     errorUtil.errToObj;
     return new _ZodObject({
       ...this._def,
       unknownKeys: "strict",
-      ...message !== void 0 ? {
+      ...message2 !== void 0 ? {
         errorMap: (issue, ctx) => {
           const defaultError = this._def.errorMap?.(issue, ctx).message ?? ctx.defaultError;
           if (issue.code === "unrecognized_keys")
             return {
-              message: errorUtil.errToObj(message).message ?? defaultError
+              message: errorUtil.errToObj(message2).message ?? defaultError
             };
           return {
             message: defaultError
@@ -3306,23 +3359,23 @@ var ZodSet = class _ZodSet extends ZodType {
       return finalizeSet(elements);
     }
   }
-  min(minSize, message) {
+  min(minSize, message2) {
     return new _ZodSet({
       ...this._def,
-      minSize: { value: minSize, message: errorUtil.toString(message) }
+      minSize: { value: minSize, message: errorUtil.toString(message2) }
     });
   }
-  max(maxSize, message) {
+  max(maxSize, message2) {
     return new _ZodSet({
       ...this._def,
-      maxSize: { value: maxSize, message: errorUtil.toString(message) }
+      maxSize: { value: maxSize, message: errorUtil.toString(message2) }
     });
   }
-  size(size, message) {
-    return this.min(size, message).max(size, message);
+  size(size, message2) {
+    return this.min(size, message2).max(size, message2);
   }
-  nonempty(message) {
-    return this.min(1, message);
+  nonempty(message2) {
+    return this.min(1, message2);
   }
 };
 ZodSet.create = (valueType, params) => {
@@ -4109,7 +4162,7 @@ var coerce = {
 };
 var NEVER = INVALID;
 
-// ../shared/dist/chunk-PVMC53P5.js
+// ../shared/dist/chunk-VSUBG7GR.js
 var DEFAULT_SONNET_MODEL = "claude-sonnet-5-5";
 var DEFAULT_OPUS_MODEL = "claude-opus-5-5";
 var DEFAULT_HAIKU_MODEL = "claude-haiku-4-5-20251001";
@@ -4600,6 +4653,11 @@ var DeleteTaskFileRequestSchema = external_exports.object({
   sessionId: external_exports.string(),
   fileId: external_exports.string()
 });
+var SetTaskFileShowcaseRequestSchema = external_exports.object({
+  sessionId: external_exports.string(),
+  fileId: external_exports.string(),
+  showcase: external_exports.boolean()
+});
 var GetTaskRequestSchema = external_exports.object({
   sessionId: external_exports.string(),
   taskSlugOrId: external_exports.string()
@@ -4648,7 +4706,11 @@ var ConfirmFileUploadRequestSchema = external_exports.object({
   fileId: external_exports.string(),
   title: external_exports.string().max(500).optional(),
   /** Glossary tag names (or ids) this file is an example of. */
-  tags: external_exports.array(external_exports.string().min(1).max(MAX_FILE_TAG_LENGTH)).max(MAX_FILE_TAGS).optional()
+  tags: external_exports.array(external_exports.string().min(1).max(MAX_FILE_TAG_LENGTH)).max(MAX_FILE_TAGS).optional(),
+  /** Mark the file as the card's showcase (the deliverable). */
+  showcase: external_exports.boolean().optional(),
+  /** Id of an older file on the same card this upload replaces. */
+  supersedes: external_exports.string().min(1).max(64).optional()
 });
 var UpdateTaskStatusRequestSchema = external_exports.object({
   sessionId: external_exports.string(),
@@ -4718,7 +4780,8 @@ var DiscoveredPortSchema = external_exports.object({
   port: external_exports.number().int().min(1).max(65535),
   label: external_exports.string().min(1).max(64).optional(),
   protocol: external_exports.enum(["http", "tcp"]).optional(),
-  detectedAt: external_exports.string()
+  detectedAt: external_exports.string(),
+  hidden: external_exports.boolean().optional()
 });
 var ReportDiscoveredPortsRequestSchema = external_exports.object({
   sessionId: external_exports.string(),
@@ -4865,7 +4928,11 @@ var SubmitCodeReviewResultRequestSchema = external_exports.object({
 var CycleCodingAgentKeyRequestSchema = external_exports.object({
   sessionId: external_exports.string(),
   rateLimitType: external_exports.string(),
-  resetsAt: external_exports.string().optional()
+  resetsAt: external_exports.string().optional(),
+  // The key the pod is actually running (CONVEYOR_CODING_AGENT_KEY_ID). Wins
+  // over the session's attribution stamp after owner validation; optional so
+  // older agents keep the session fallback.
+  codingAgentKeyId: external_exports.string().optional()
 });
 var PostChildChatMessageRequestSchema = external_exports.object({
   sessionId: external_exports.string(),
@@ -5183,6 +5250,9 @@ var CreateProjectTaskRequestSchema = external_exports.object({
   status: external_exports.string().optional(),
   // Assign to a sub-project board. Validated to belong to `projectId` in the handler.
   subProjectId: external_exports.string().nullable().optional(),
+  // Priority value. Resolved to the project's configured Priority row in the
+  // handler, which rejects an unconfigured value before the card is written.
+  priorityValue: external_exports.number().int().positive().optional(),
   requestingUserId: external_exports.string().optional()
 });
 var SetProjectTaskParentRequestSchema = external_exports.object({
@@ -5212,6 +5282,9 @@ var UpdateProjectTaskRequestSchema = external_exports.object({
   // Story-point value, or null to clear. Resolved to the project's configured
   // StoryPoint row in the handler, which rejects an unconfigured value.
   storyPointValue: external_exports.number().int().positive().nullable().optional(),
+  // Priority value, or null to clear. Resolved to the project's configured
+  // Priority row in the handler, which rejects an unconfigured value.
+  priorityValue: external_exports.number().int().positive().nullable().optional(),
   assignedUserId: external_exports.string().nullish(),
   // Move to a different sub-project board, or null to move to the parent board.
   // Validated to belong to `projectId` in the handler.
@@ -5228,9 +5301,9 @@ var UpdateProjectTaskRequestSchema = external_exports.object({
   onHold: external_exports.boolean().optional(),
   requestingUserId: external_exports.string().optional()
 }).strict().refine(
-  (v) => v.title !== void 0 || v.description !== void 0 || v.plan !== void 0 || v.status !== void 0 || v.risk !== void 0 || v.storyPointValue !== void 0 || v.assignedUserId !== void 0 || v.subProjectId !== void 0 || v.githubBranch !== void 0 || v.onHold !== void 0,
+  (v) => v.title !== void 0 || v.description !== void 0 || v.plan !== void 0 || v.status !== void 0 || v.risk !== void 0 || v.storyPointValue !== void 0 || v.priorityValue !== void 0 || v.assignedUserId !== void 0 || v.subProjectId !== void 0 || v.githubBranch !== void 0 || v.onHold !== void 0,
   {
-    message: "update_task requires at least one field to change (title, description, plan, status, risk, storyPointValue, assignedUserId, subProjectId, githubBranch, or onHold)"
+    message: "update_task requires at least one field to change (title, description, plan, status, risk, storyPointValue, priorityValue, assignedUserId, subProjectId, githubBranch, or onHold)"
   }
 );
 var TransitionProjectTaskStatusRequestSchema = external_exports.object({
@@ -5273,11 +5346,12 @@ var QueryProjectGcpLogsRequestSchema = external_exports.object({
   sqlInstances: external_exports.array(external_exports.string().min(1).max(200)).max(25).optional(),
   allServices: external_exports.boolean().optional(),
   search: external_exports.string().max(256).optional(),
-  filter: external_exports.string().max(1e3).optional(),
+  filter: external_exports.string().max(2e3).optional(),
   startTime: external_exports.string().optional(),
   endTime: external_exports.string().optional(),
   limit: external_exports.number().int().min(1).max(200).optional().default(50),
-  pageToken: external_exports.string().max(4096).optional()
+  pageToken: external_exports.string().max(4096).optional(),
+  full: external_exports.boolean().optional()
 });
 var QueryProjectGrafanaLogsRequestSchema = external_exports.object({
   projectId: external_exports.string(),
@@ -5478,43 +5552,6 @@ var GetProjectTaskDependenciesRequestSchema = external_exports.object({
   projectId: external_exports.string(),
   taskId: external_exports.string()
 });
-var ListProjectTaskFilesRequestSchema = external_exports.object({
-  projectId: external_exports.string(),
-  taskId: external_exports.string()
-});
-var GetProjectAttachmentRequestSchema = external_exports.object({
-  projectId: external_exports.string(),
-  taskId: external_exports.string(),
-  fileId: external_exports.string(),
-  /** Byte offset into text content (paging large logs/JSON). Default 0. */
-  offset: external_exports.number().int().nonnegative().optional(),
-  /** Max bytes of text content to return from `offset`. Server default applies. */
-  maxBytes: external_exports.number().int().positive().optional()
-});
-var DeleteProjectTaskFileRequestSchema = external_exports.object({
-  projectId: external_exports.string(),
-  taskId: external_exports.string(),
-  fileId: external_exports.string(),
-  requestingUserId: external_exports.string().optional()
-});
-var RequestProjectFileUploadRequestSchema = external_exports.object({
-  projectId: external_exports.string(),
-  taskId: external_exports.string(),
-  fileName: external_exports.string().min(1).max(255),
-  mimeType: external_exports.string().min(1).max(128),
-  fileSize: external_exports.number().int().positive().max(MAX_FILE_SIZE_BYTES),
-  requestingUserId: external_exports.string().optional()
-});
-var ConfirmProjectFileUploadRequestSchema = external_exports.object({
-  projectId: external_exports.string(),
-  taskId: external_exports.string(),
-  fileId: external_exports.string(),
-  /** When set, the attachment is also posted to the task chat with this text. */
-  comment: external_exports.string().max(2e3).optional(),
-  /** Glossary tag names (or ids) this file is an example of. */
-  tags: external_exports.array(external_exports.string().min(1).max(MAX_FILE_TAG_LENGTH)).max(MAX_FILE_TAGS).optional(),
-  requestingUserId: external_exports.string().optional()
-});
 var CreateProjectPullRequestRequestSchema = external_exports.object({
   projectId: external_exports.string(),
   taskId: external_exports.string(),
@@ -5621,6 +5658,54 @@ var GetProjectAnalyticsSummaryRequestSchema = external_exports.object({
   rangeDays: external_exports.number().int().min(1).max(GET_ANALYTICS_SUMMARY_MAX_RANGE_DAYS).optional(),
   campaign: external_exports.string().max(200).optional()
 });
+var ListProjectTaskFilesRequestSchema = external_exports.object({
+  projectId: external_exports.string(),
+  taskId: external_exports.string()
+});
+var GetProjectAttachmentRequestSchema = external_exports.object({
+  projectId: external_exports.string(),
+  taskId: external_exports.string(),
+  fileId: external_exports.string(),
+  /** Byte offset into text content (paging large logs/JSON). Default 0. */
+  offset: external_exports.number().int().nonnegative().optional(),
+  /** Max bytes of text content to return from `offset`. Server default applies. */
+  maxBytes: external_exports.number().int().positive().optional()
+});
+var DeleteProjectTaskFileRequestSchema = external_exports.object({
+  projectId: external_exports.string(),
+  taskId: external_exports.string(),
+  fileId: external_exports.string(),
+  requestingUserId: external_exports.string().optional()
+});
+var SetProjectTaskFileShowcaseRequestSchema = external_exports.object({
+  projectId: external_exports.string(),
+  taskId: external_exports.string(),
+  fileId: external_exports.string(),
+  showcase: external_exports.boolean(),
+  requestingUserId: external_exports.string().optional()
+});
+var RequestProjectFileUploadRequestSchema = external_exports.object({
+  projectId: external_exports.string(),
+  taskId: external_exports.string(),
+  fileName: external_exports.string().min(1).max(255),
+  mimeType: external_exports.string().min(1).max(128),
+  fileSize: external_exports.number().int().positive().max(MAX_FILE_SIZE_BYTES),
+  requestingUserId: external_exports.string().optional()
+});
+var ConfirmProjectFileUploadRequestSchema = external_exports.object({
+  projectId: external_exports.string(),
+  taskId: external_exports.string(),
+  fileId: external_exports.string(),
+  /** When set, the attachment is also posted to the task chat with this text. */
+  comment: external_exports.string().max(2e3).optional(),
+  /** Glossary tag names (or ids) this file is an example of. */
+  tags: external_exports.array(external_exports.string().min(1).max(MAX_FILE_TAG_LENGTH)).max(MAX_FILE_TAGS).optional(),
+  /** The card's showcase (its deliverable); always posts to chat, even with no `comment`. */
+  showcase: external_exports.boolean().optional(),
+  /** Id of an older file on the same card this upload replaces. */
+  supersedes: external_exports.string().min(1).max(64).optional(),
+  requestingUserId: external_exports.string().optional()
+});
 var RequestWorkspaceRecycleRequestSchema = external_exports.object({
   sessionId: external_exports.string(),
   reason: external_exports.string().max(2e3)
@@ -6189,6 +6274,7 @@ function isArtifactRegistryHost(host) {
   return bare.endsWith(".pkg.dev") || bare === "gcr.io" || bare.endsWith(".gcr.io");
 }
 var CONTAINERD_K8S_NAMESPACE = "k8s.io";
+var CONVEYOR_CONTENT_HASH_LABEL = "com.rallycry.conveyor.content-hash";
 var LOCAL_BAKE_ROOT_COMMANDS = [
   {
     name: "import",
@@ -6201,6 +6287,16 @@ var LOCAL_BAKE_ROOT_COMMANDS = [
     takesImageArgs: true
   }
 ];
+var PERSONAL_LOCAL_REGISTRY_NAMESPACE = "conveyor-system";
+var PERSONAL_LOCAL_REGISTRY_NAME = "conveyor-registry";
+var PERSONAL_LOCAL_REGISTRY_PORT = 5e3;
+var PERSONAL_LOCAL_REGISTRY_HOST = `${PERSONAL_LOCAL_REGISTRY_NAME}.${PERSONAL_LOCAL_REGISTRY_NAMESPACE}.svc.cluster.local:${PERSONAL_LOCAL_REGISTRY_PORT}`;
+var PERSONAL_LOCAL_REGISTRY_NODE_ENDPOINT = `http://127.0.0.1:${PERSONAL_LOCAL_REGISTRY_PORT}`;
+var BAKE_COMPONENT_LABEL = "claudespace.rallycry.com/component";
+var BAKE_COMPONENT_PREBAKE = "prebake";
+var BAKE_COMPONENT_STATE_BAKE = "state-bake";
+var BAKE_COMPONENT_VALUES = [BAKE_COMPONENT_PREBAKE, BAKE_COMPONENT_STATE_BAKE];
+var PERSONAL_BAKE_NAMESPACE = "conveyor-bakes";
 var MS_PER_DAY = 24 * 60 * 60 * 1e3;
 var POSTGRES_ENV = {
   POSTGRES_HOST_AUTH_METHOD: "trust",
@@ -6519,6 +6615,8 @@ var REPORT_CARD_TYPES = surfaceTypes("report");
 var DECISION_CARD_TYPES = surfaceTypes("decision");
 
 // src/daemon/connection.ts
+var REDIAL_FIRST_MS = 5e3;
+var REDIAL_MAX_MS = 5 * 6e4;
 function unwrap(ack, what) {
   if (!ack?.ok || ack.data === void 0) {
     throw new Error(`${what} failed: ${ack?.error ?? "no response"}`);
@@ -6528,6 +6626,8 @@ function unwrap(ack, what) {
 var ClusterConnection = class {
   socket = null;
   config;
+  redialDelayMs = REDIAL_FIRST_MS;
+  redialTimer = null;
   /** Called when Conveyor says the desired state changed. */
   onSyncRequested = null;
   /** Called when Conveyor asks the machine to remove itself. */
@@ -6552,9 +6652,18 @@ var ClusterConnection = class {
         reject(error instanceof Error ? error : new Error(String(error)));
         return;
       }
-      const socket = io(this.config.apiUrl, buildConveyorSocketOptions(auth));
+      const route = controlPlaneRoute(
+        this.config.apiUrl,
+        this.config.readControlFile,
+        this.config.controlFileExists
+      );
+      const socket = io(this.config.apiUrl, {
+        ...buildConveyorSocketOptions(auth),
+        ...route ? { transportOptions: { websocket: { agent: route.agent } } } : {}
+      });
       this.socket = socket;
       socket.on("connect", () => {
+        this.redialDelayMs = REDIAL_FIRST_MS;
         if (!settled) {
           settled = true;
           resolve();
@@ -6568,10 +6677,14 @@ var ClusterConnection = class {
           settled = true;
           reject(err);
         }
+        if (!isAuthFailure) route?.failed();
       });
       socket.on("disconnect", (reason) => {
         process.stderr.write(`[conveyor-k3] disconnected: ${reason}
 `);
+        if (reason === "io server disconnect" && this.config.reconnectWhenReplaced) {
+          this.redial(socket);
+        }
       });
       socket.on(PERSONAL_CLUSTER_EVENTS.syncRequested, () => {
         this.onSyncRequested?.();
@@ -6633,7 +6746,20 @@ var ClusterConnection = class {
     } catch {
     }
   }
+  /** Dial again after the server closed the socket, waiting longer each time. */
+  redial(socket) {
+    if (this.redialTimer) return;
+    const delay = this.redialDelayMs;
+    this.redialDelayMs = Math.min(delay * 2, REDIAL_MAX_MS);
+    this.redialTimer = setTimeout(() => {
+      this.redialTimer = null;
+      if (this.socket === socket && !socket.connected) socket.connect();
+    }, delay);
+    this.redialTimer.unref?.();
+  }
   disconnect() {
+    if (this.redialTimer) clearTimeout(this.redialTimer);
+    this.redialTimer = null;
     this.socket?.disconnect();
     this.socket = null;
   }
@@ -6939,31 +7065,6 @@ function countPinnedWanted(inventory, wantedImages) {
 
 // src/lib/registries.ts
 import { parse, stringify } from "yaml";
-function parseRegistries(raw) {
-  if (!raw || raw.trim().length === 0) return {};
-  const parsed = parse(raw);
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
-  return parsed;
-}
-function configuredAuthHosts(file) {
-  return Object.entries(file.configs ?? {}).filter(([, entry]) => Boolean(entry?.auth)).map(([host]) => host).sort();
-}
-function missingAuthHosts(file, requiredHosts) {
-  const configured = new Set(configuredAuthHosts(file));
-  return requiredHosts.filter((host) => !configured.has(host)).sort();
-}
-function upsertRegistryAuth(file, host, auth) {
-  assertRegistryHost(host);
-  const next = { ...file };
-  const configs = { ...next.configs ?? {} };
-  const existing = configs[host] ?? {};
-  configs[host] = { ...existing, auth };
-  next.configs = configs;
-  return next;
-}
-function serializeRegistries(file) {
-  return stringify(file);
-}
 
 // src/lib/paths.ts
 var ETC_CONVEYOR = "/etc/conveyor";
@@ -6971,11 +7072,16 @@ var ENV_FILE = `${ETC_CONVEYOR}/k3.env`;
 var TUNNEL_ENV_FILE = `${ETC_CONVEYOR}/k3-tunnel.env`;
 var STATE_DIR = "/var/lib/conveyor-k3";
 var STATE_FILE = `${STATE_DIR}/state.json`;
+var LOCAL_REGISTRY_DATA_DIR = `${STATE_DIR}/registry`;
+var LOCAL_REGISTRY_MIRROR_RESTART_FILE = `${STATE_DIR}/registry-mirror-restart`;
 var RANCHER_DIR = "/etc/rancher/k3s";
 var K3S_OWNER_CONFIG = `${RANCHER_DIR}/config.yaml`;
 var K3S_CONFIG_DROPIN_DIR = `${RANCHER_DIR}/config.yaml.d`;
 var K3S_CONFIG_DROPIN = `${K3S_CONFIG_DROPIN_DIR}/50-conveyor-k3.yaml`;
 var REGISTRIES_FILE = `${RANCHER_DIR}/registries.yaml`;
+var K3S_CERTS_D = "/var/lib/rancher/k3s/agent/etc/containerd/certs.d";
+var K3S_CONTAINERD_DIR = "/var/lib/rancher/k3s/agent/containerd";
+var JOURNALD_DROPIN = "/etc/systemd/journald.conf.d/50-conveyor-k3.conf";
 var CLOUDFLARED_DIR = "/etc/cloudflared";
 var CA_POOL_PATH = `${CLOUDFLARED_DIR}/conveyor-k3-server-ca.crt`;
 var SYSTEMD_DIR = "/etc/systemd/system";
@@ -6989,10 +7095,64 @@ var OWNED_FILES = [
   TUNNEL_ENV_FILE,
   K3S_CONFIG_DROPIN,
   CA_POOL_PATH,
+  JOURNALD_DROPIN,
   ...ALL_UNITS.map((unit) => `${SYSTEMD_DIR}/${unit}`)
 ];
 var RUNNERS_SUDOERS_FILE = "/etc/sudoers.d/conveyor-k3-runners";
 
+// src/lib/registries.ts
+function parseRegistries(raw) {
+  if (!raw || raw.trim().length === 0) return {};
+  const parsed = parse(raw);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+  return parsed;
+}
+function configuredAuthHosts(file) {
+  return Object.entries(file.configs ?? {}).filter(([, entry]) => Boolean(entry?.auth)).map(([host]) => host).sort();
+}
+function missingAuthHosts(file, requiredHosts) {
+  const configured = new Set(configuredAuthHosts(file));
+  return requiredHosts.filter((host) => !configured.has(host)).sort();
+}
+function upsertRegistryAuth(file, host, auth) {
+  assertRegistryHost(host);
+  const next = { ...file };
+  const configs = { ...next.configs ?? {} };
+  const existing = configs[host] ?? {};
+  configs[host] = { ...existing, auth };
+  next.configs = configs;
+  return next;
+}
+function mirrorEndpoints(file, host) {
+  const entry = file.mirrors?.[host];
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) return [];
+  const endpoint = entry.endpoint;
+  return Array.isArray(endpoint) ? endpoint.filter((value) => typeof value === "string") : [];
+}
+function upsertRegistryMirror(file, host, endpoints) {
+  assertRegistryHost(host);
+  return { ...file, mirrors: { ...file.mirrors ?? {}, [host]: { endpoint: [...endpoints] } } };
+}
+function removeRegistryMirror(file, host) {
+  if (!file.mirrors || !Object.hasOwn(file.mirrors, host)) return file;
+  const { [host]: _removed, ...mirrors } = file.mirrors;
+  const next = { ...file, mirrors };
+  if (Object.keys(mirrors).length === 0) delete next.mirrors;
+  return next;
+}
+function serializeRegistries(file) {
+  return stringify(file);
+}
+async function writeRegistriesWithBackup(fs, raw, next, now) {
+  let backupPath = null;
+  if (raw !== null) {
+    backupPath = `${REGISTRIES_FILE}.bak-${now.toISOString().replace(/[:.]/g, "-")}`;
+    await fs.writeFile(backupPath, raw, 384);
+  }
+  await fs.writeFile(REGISTRIES_FILE, serializeRegistries(next), 384);
+  return backupPath;
+}
+
 // src/lib/state.ts
 var EMPTY_STATE = {
   appliedDesiredStateVersion: 0,
@@ -7015,6 +7175,9 @@ async function writeState(fs, state) {
   await fs.writeFile(STATE_FILE, `${JSON.stringify(state, null, 2)}
 `, 384);
 }
+function managesK3s(desired, state) {
+  return desired.isolation === void 0 || state.k3sInstalledByConveyor === true;
+}
 
 // src/lib/k3s-config.ts
 var IMAGE_GC_HIGH = "image-gc-high-threshold";
@@ -7028,6 +7191,15 @@ var K3S_INSTALL_EXEC = [
   `--${WRITE_KUBECONFIG_MODE}`,
   KUBECONFIG_MODE
 ].join(" ");
+function bareToken(token) {
+  let bare = token.trim();
+  if (bare.endsWith("\\")) bare = bare.slice(0, -1).trim();
+  const quote = bare[0];
+  if (bare.length >= 2 && (quote === "'" || quote === '"') && bare.endsWith(quote)) {
+    bare = bare.slice(1, -1);
+  }
+  return bare;
+}
 function ownerConfiguredKubeletFlags(ownerConfig) {
   const found = /* @__PURE__ */ new Set();
   if (!ownerConfig) return found;
@@ -7053,7 +7225,7 @@ function ownerImageGcHighThreshold(ownerConfig) {
   const value = Number.parseInt(match[2] ?? "", 10);
   return Number.isInteger(value) && value >= 0 && value <= 100 ? value : null;
 }
-function renderK3sDropIn(kubelet, ownerConfig) {
+function renderK3sDropIn(kubelet, ownerConfig, options = {}) {
   const ownerFlags = ownerConfiguredKubeletFlags(ownerConfig);
   const ownerKeys = ownerConfiguredKeys(ownerConfig);
   const args = [];
@@ -7072,22 +7244,24 @@ function renderK3sDropIn(kubelet, ownerConfig) {
     const memory = assertQuantity(kubelet.systemReserved.memory, "reserveMemory");
     add(SYSTEM_RESERVED, `cpu=${cpu},memory=${memory}`);
   }
-  const lines = [
+  const lines2 = [
     "# Managed by Conveyor (@rallycry/conveyor-k3). Do not edit.",
     "# Your own /etc/rancher/k3s/config.yaml is never modified; k3s merges both.",
     "# `kubelet-arg+` and `disable+` append rather than replacing a list you set."
   ];
-  lines.push("disable+:");
-  for (const component of K3S_DISABLED_COMPONENTS) lines.push(`  - ${component}`);
+  if (options.disableComponents !== false) {
+    lines2.push("disable+:");
+    for (const component of K3S_DISABLED_COMPONENTS) lines2.push(`  - ${component}`);
+  }
   if (ownerKeys.has(WRITE_KUBECONFIG_MODE)) {
     skipped.push(WRITE_KUBECONFIG_MODE);
   } else {
-    lines.push(`${WRITE_KUBECONFIG_MODE}: "${KUBECONFIG_MODE}"`);
+    lines2.push(`${WRITE_KUBECONFIG_MODE}: "${KUBECONFIG_MODE}"`);
   }
   if (args.length > 0) {
-    lines.push("kubelet-arg+:", ...args);
+    lines2.push("kubelet-arg+:", ...args);
   }
-  return { content: [...lines, ""].join("\n"), skipped };
+  return { content: [...lines2, ""].join("\n"), skipped };
 }
 var renderKubeletDropIn = renderK3sDropIn;
 
@@ -7136,86 +7310,668 @@ function findDisallowedKinds(manifest) {
   return disallowed;
 }
 
-// src/daemon/reconcile.ts
+// src/daemon/cluster-ops.ts
+async function kubectlApply(exec, manifest) {
+  await runOrThrow(exec, "k3s", ["kubectl", "apply", "-f", "-"], {
+    stdin: manifest,
+    timeoutMs: 6e4
+  });
+}
 function mayDisrupt(runningConveyorPods) {
   return runningConveyorPods === 0;
 }
 function busyReason(runningConveyorPods) {
   return runningConveyorPods === null ? "the number of running Conveyor pods could not be read" : `${runningConveyorPods} Conveyor pod(s) are running`;
 }
-async function kubectlApply(exec, manifest) {
-  await runOrThrow(exec, "k3s", ["kubectl", "apply", "-f", "-"], {
-    stdin: manifest,
-    timeoutMs: 6e4
-  });
+
+// src/daemon/local-registry-upkeep.ts
+import { createHash } from "crypto";
+
+// src/lib/local-registry.ts
+var LOCAL_REGISTRY_IMAGE = "docker.io/library/registry:3.1.2@sha256:c87f33837722a100572e95d7dc4bf539fc42cf68202b13c3bc03c0ff54c3a649";
+var LOCAL_REGISTRY_CONFIG = "/etc/distribution/config.yml";
+var LOCAL_REGISTRY_GC_JOB = "conveyor-registry-gc";
+var LOCAL_REGISTRY_SELECTOR = { "app.kubernetes.io/name": PERSONAL_LOCAL_REGISTRY_NAME };
+var MANAGED_BY = { "app.kubernetes.io/managed-by": "conveyor-k3" };
+var DATA_MOUNT = "/var/lib/registry";
+var REGISTRY_ENV = [
+  { name: "REGISTRY_STORAGE_DELETE_ENABLED", value: "true" },
+  { name: "OTEL_TRACES_EXPORTER", value: "none" }
+];
+var CONTAINER_SECURITY = {
+  allowPrivilegeEscalation: false,
+  readOnlyRootFilesystem: true,
+  capabilities: { drop: ["ALL"] }
+};
+var VOLUME_MOUNTS = [
+  { name: "data", mountPath: DATA_MOUNT },
+  { name: "tmp", mountPath: "/tmp" }
+];
+var VOLUMES = [
+  { name: "data", hostPath: { path: LOCAL_REGISTRY_DATA_DIR, type: "Directory" } },
+  { name: "tmp", emptyDir: { sizeLimit: "64Mi" } }
+];
+var POD_BASE = {
+  automountServiceAccountToken: false,
+  enableServiceLinks: false,
+  securityContext: { seccompProfile: { type: "RuntimeDefault" } },
+  volumes: VOLUMES
+};
+function registryNetworkPolicy(metadata) {
+  return {
+    apiVersion: "networking.k8s.io/v1",
+    kind: "NetworkPolicy",
+    metadata,
+    spec: {
+      podSelector: { matchLabels: LOCAL_REGISTRY_SELECTOR },
+      policyTypes: ["Ingress"],
+      ingress: [
+        {
+          from: [
+            {
+              namespaceSelector: {},
+              podSelector: {
+                matchExpressions: [
+                  { key: BAKE_COMPONENT_LABEL, operator: "In", values: [...BAKE_COMPONENT_VALUES] }
+                ]
+              }
+            }
+          ],
+          ports: [{ protocol: "TCP", port: PERSONAL_LOCAL_REGISTRY_PORT }]
+        }
+      ]
+    }
+  };
 }
-async function reconcileKubelet(ctx, desired, result) {
-  const ownerConfig = await ctx.fs.readFile(K3S_OWNER_CONFIG);
-  const rendered = renderK3sDropIn(desired.kubelet, ownerConfig);
-  result.skippedKubeletFlags = rendered.skipped;
-  result.effectiveImageGcHighThreshold = rendered.skipped.includes("image-gc-high-threshold") ? ownerImageGcHighThreshold(ownerConfig) : desired.kubelet.imageGcHighThreshold;
-  for (const flag of rendered.skipped) {
-    result.warnings.push(
-      `Left \`${flag}\` to your own /etc/rancher/k3s/config.yaml \u2014 Conveyor does not override a setting you chose.`
-    );
-  }
-  const current = await ctx.fs.readFile(K3S_CONFIG_DROPIN);
-  if (rendered.content === null) {
-    if (current !== null) await ctx.fs.removeFile(K3S_CONFIG_DROPIN);
-    return;
-  }
-  if (current === rendered.content) return;
-  await ctx.fs.ensureDir(K3S_CONFIG_DROPIN.slice(0, K3S_CONFIG_DROPIN.lastIndexOf("/")));
-  await ctx.fs.writeFile(K3S_CONFIG_DROPIN, rendered.content, 420);
-  if (!mayDisrupt(ctx.runningConveyorPods)) {
-    result.warnings.push(
-      `Kubelet settings changed but ${busyReason(ctx.runningConveyorPods)} \u2014 the restart is deferred until the machine is idle.`
-    );
-    return;
+function renderLocalRegistryManifests() {
+  const metadata = {
+    name: PERSONAL_LOCAL_REGISTRY_NAME,
+    namespace: PERSONAL_LOCAL_REGISTRY_NAMESPACE,
+    labels: { ...LOCAL_REGISTRY_SELECTOR, ...MANAGED_BY }
+  };
+  const deployment = {
+    apiVersion: "apps/v1",
+    kind: "Deployment",
+    metadata,
+    spec: {
+      replicas: 1,
+      // One pod owns the data directory at a time.
+      strategy: { type: "Recreate" },
+      selector: { matchLabels: LOCAL_REGISTRY_SELECTOR },
+      template: {
+        metadata: { labels: metadata.labels },
+        spec: {
+          ...POD_BASE,
+          containers: [
+            {
+              name: "registry",
+              image: LOCAL_REGISTRY_IMAGE,
+              imagePullPolicy: "IfNotPresent",
+              env: REGISTRY_ENV,
+              ports: [
+                {
+                  name: "registry",
+                  containerPort: PERSONAL_LOCAL_REGISTRY_PORT,
+                  // Loopback only: the node's containerd is the one client
+                  // that comes in through this port.
+                  hostPort: PERSONAL_LOCAL_REGISTRY_PORT,
+                  hostIP: "127.0.0.1",
+                  protocol: "TCP"
+                }
+              ],
+              readinessProbe: {
+                httpGet: { path: "/v2/", port: PERSONAL_LOCAL_REGISTRY_PORT },
+                periodSeconds: 10
+              },
+              resources: {
+                requests: { cpu: "50m", memory: "64Mi" },
+                limits: { memory: "512Mi" }
+              },
+              securityContext: CONTAINER_SECURITY,
+              volumeMounts: VOLUME_MOUNTS
+            }
+          ]
+        }
+      }
+    }
+  };
+  const service = {
+    apiVersion: "v1",
+    kind: "Service",
+    metadata,
+    spec: {
+      type: "ClusterIP",
+      selector: LOCAL_REGISTRY_SELECTOR,
+      ports: [
+        {
+          name: "registry",
+          port: PERSONAL_LOCAL_REGISTRY_PORT,
+          targetPort: PERSONAL_LOCAL_REGISTRY_PORT,
+          protocol: "TCP"
+        }
+      ]
+    }
+  };
+  const items = [deployment, service, registryNetworkPolicy(metadata)];
+  return `${JSON.stringify({ apiVersion: "v1", kind: "List", items }, null, 2)}
+`;
+}
+function renderRegistryGcJob() {
+  const labels = { "app.kubernetes.io/name": LOCAL_REGISTRY_GC_JOB, ...MANAGED_BY };
+  const job = {
+    apiVersion: "batch/v1",
+    kind: "Job",
+    metadata: { name: LOCAL_REGISTRY_GC_JOB, namespace: PERSONAL_LOCAL_REGISTRY_NAMESPACE, labels },
+    spec: {
+      backoffLimit: 0,
+      activeDeadlineSeconds: 600,
+      // A Job left by a daemon that died mid-sweep goes on its own.
+      ttlSecondsAfterFinished: 600,
+      template: {
+        metadata: { labels },
+        spec: {
+          ...POD_BASE,
+          restartPolicy: "Never",
+          containers: [
+            {
+              name: "garbage-collect",
+              image: LOCAL_REGISTRY_IMAGE,
+              imagePullPolicy: "IfNotPresent",
+              args: ["garbage-collect", LOCAL_REGISTRY_CONFIG],
+              env: REGISTRY_ENV,
+              resources: {
+                requests: { cpu: "100m", memory: "128Mi" },
+                limits: { memory: "1Gi" }
+              },
+              securityContext: CONTAINER_SECURITY,
+              volumeMounts: VOLUME_MOUNTS
+            }
+          ]
+        }
+      }
+    }
+  };
+  return `${JSON.stringify(job, null, 2)}
+`;
+}
+function mirrorHostsTomlPaths(host) {
+  const colon = host.lastIndexOf(":");
+  const escaped = colon > 0 ? `${host.slice(0, colon)}_${host.slice(colon + 1)}_` : host;
+  return [.../* @__PURE__ */ new Set([escaped, host])].map((dir) => `${K3S_CERTS_D}/${dir}/hosts.toml`);
+}
+async function mirrorLoaded(readFile3) {
+  for (const path of mirrorHostsTomlPaths(PERSONAL_LOCAL_REGISTRY_HOST)) {
+    const content = await readFile3(path);
+    if (content?.includes(PERSONAL_LOCAL_REGISTRY_NODE_ENDPOINT)) return true;
   }
-  const restart = await ctx.exec("systemctl", ["restart", "k3s"], { timeoutMs: 12e4 });
-  if (restart.exitCode === 0) {
-    result.restartedK3s = true;
-  } else {
-    result.warnings.push(
-      `Could not restart k3s to apply new kubelet settings: ${restart.stderr.trim().slice(0, 200)}`
-    );
+  return false;
+}
+async function registryAnswers(fetchImpl = fetch) {
+  try {
+    const response = await fetchImpl(`${PERSONAL_LOCAL_REGISTRY_NODE_ENDPOINT}/v2/`, {
+      signal: AbortSignal.timeout(2e3)
+    });
+    await response.body?.cancel();
+    return response.status === 200;
+  } catch {
+    return false;
   }
 }
-async function reconcilePriorityClass(ctx, desired, result) {
-  const name = assertK8sName(desired.priorityClass.name, "priorityClass.name");
-  const read = await ctx.exec("k3s", [
-    "kubectl",
+async function localRegistryReady(ports) {
+  const [answers, mirrored] = await Promise.all([
+    registryAnswers(ports.fetch),
+    mirrorLoaded(ports.readFile)
+  ]);
+  return answers && mirrored;
+}
+
+// src/daemon/registry-gc-lock.ts
+var REGISTRY_GC_MARK = "conveyor.rallycry.com/registry-gc";
+var REGISTRY_GC_MARK_TTL_MS = 20 * 6e4;
+function inRegistryNamespace(exec, args, timeoutMs = 3e4) {
+  return exec("k3s", ["kubectl", "-n", PERSONAL_LOCAL_REGISTRY_NAMESPACE, ...args], { timeoutMs });
+}
+async function readRegistryDeployment(exec) {
+  const result = await inRegistryNamespace(exec, [
     "get",
-    "priorityclass",
-    name,
+    "deployment",
+    PERSONAL_LOCAL_REGISTRY_NAME,
+    "--ignore-not-found",
     "-o",
-    "jsonpath={.value}"
+    "json"
   ]);
-  if (read.exitCode !== 0) return;
-  const existingValue = Number.parseInt(read.stdout.trim(), 10);
-  if (existingValue === desired.priorityClass.value) return;
-  if (!mayDisrupt(ctx.runningConveyorPods)) {
-    result.warnings.push(
-      `The \`${name}\` PriorityClass has value ${existingValue}, but Conveyor needs ${desired.priorityClass.value}. The value is immutable, so it must be recreated \u2014 deferred because ${busyReason(ctx.runningConveyorPods)}.`
-    );
-    return;
-  }
-  const removed = await ctx.exec("k3s", ["kubectl", "delete", "priorityclass", name]);
-  if (removed.exitCode !== 0) {
-    result.warnings.push(
-      `Could not replace the \`${name}\` PriorityClass (value ${existingValue}, needs ${desired.priorityClass.value}): ${removed.stderr.trim().slice(0, 160)}`
-    );
-    return;
+  if (result.exitCode !== 0) return null;
+  if (result.stdout.trim().length === 0) return { exists: false, replicas: null, mark: null };
+  try {
+    const deployment = JSON.parse(result.stdout);
+    const replicas = deployment.spec?.replicas;
+    const mark = deployment.metadata?.annotations?.[REGISTRY_GC_MARK];
+    return {
+      exists: true,
+      replicas: typeof replicas === "number" ? replicas : null,
+      mark: typeof mark === "string" ? mark : null
+    };
+  } catch {
+    return null;
   }
+}
+function processAlive(pid) {
   try {
-    await kubectlApply(ctx.exec, desired.rbacManifest);
-    result.recreatedPriorityClass = true;
+    process.kill(pid, 0);
+    return true;
   } catch (error) {
-    result.warnings.push(
-      `The \`${name}\` PriorityClass was removed to change its value but could not be recreated: ${error instanceof Error ? error.message : String(error)}. No build can start on this machine until it exists \u2014 run \`conveyor-k3 sync\`.`
-    );
+    return error.code === "EPERM";
+  }
+}
+function newGcMark(now) {
+  return `${process.pid}@${new Date(now).toISOString()}`;
+}
+function gcMarkIsLive(mark, now, alive = processAlive) {
+  const match = mark ? /^(\d+)@(.+)$/.exec(mark) : null;
+  if (!match?.[1] || !match[2]) return false;
+  const started = Date.parse(match[2]);
+  return !Number.isNaN(started) && now - started < REGISTRY_GC_MARK_TTL_MS && alive(Number(match[1]));
+}
+async function setGcMark(exec, mark) {
+  await runOrThrow(
+    exec,
+    "k3s",
+    [
+      "kubectl",
+      "-n",
+      PERSONAL_LOCAL_REGISTRY_NAMESPACE,
+      "annotate",
+      "deployment",
+      PERSONAL_LOCAL_REGISTRY_NAME,
+      `${REGISTRY_GC_MARK}=${mark}`,
+      "--overwrite"
+    ],
+    { timeoutMs: 3e4 }
+  );
+}
+async function clearGcMark(exec) {
+  const result = await inRegistryNamespace(exec, [
+    "annotate",
+    "deployment",
+    PERSONAL_LOCAL_REGISTRY_NAME,
+    `${REGISTRY_GC_MARK}-`
+  ]);
+  return result.exitCode === 0;
+}
+async function deleteSweepJob(exec) {
+  const result = await inRegistryNamespace(
+    exec,
+    [
+      "delete",
+      "job",
+      LOCAL_REGISTRY_GC_JOB,
+      "--ignore-not-found",
+      "--cascade=foreground",
+      "--wait=true"
+    ],
+    12e4
+  );
+  return result.exitCode === 0;
+}
+
+// src/daemon/local-registry-upkeep.ts
+function nowDate() {
+  return /* @__PURE__ */ new Date();
+}
+function mirrorConfigured(raw) {
+  const endpoints = mirrorEndpoints(parseRegistries(raw), PERSONAL_LOCAL_REGISTRY_HOST);
+  return endpoints.length === 1 && endpoints[0] === PERSONAL_LOCAL_REGISTRY_NODE_ENDPOINT;
+}
+async function applyUnlessCollecting(ctx) {
+  const deployment = await readRegistryDeployment(ctx.exec);
+  if (!deployment) throw new Error("the registry's Deployment could not be read");
+  if (gcMarkIsLive(deployment.mark, (ctx.now ?? nowDate)().getTime(), ctx.isAlive)) return false;
+  if (deployment.mark !== null && !await deleteSweepJob(ctx.exec)) {
+    throw new Error("a stopped cleanup's Job could not be deleted, so the registry stays stopped");
+  }
+  await kubectlApply(ctx.exec, renderLocalRegistryManifests());
+  if (deployment.mark !== null) await clearGcMark(ctx.exec);
+  return true;
+}
+async function deployLocalRegistry(ctx) {
+  await ctx.fs.ensureDir(LOCAL_REGISTRY_DATA_DIR, 448);
+  const applied = await applyUnlessCollecting(ctx);
+  const raw = await ctx.fs.readFile(REGISTRIES_FILE);
+  if (mirrorConfigured(raw)) return { applied, mirrorWritten: false, backupPath: null };
+  const next = upsertRegistryMirror(parseRegistries(raw), PERSONAL_LOCAL_REGISTRY_HOST, [
+    PERSONAL_LOCAL_REGISTRY_NODE_ENDPOINT
+  ]);
+  const backupPath = await writeRegistriesWithBackup(ctx.fs, raw, next, (ctx.now ?? nowDate)());
+  return { applied, mirrorWritten: true, backupPath };
+}
+async function readMirrorState(fs) {
+  const raw = await fs.readFile(REGISTRIES_FILE);
+  const fingerprint = createHash("sha256").update(raw ?? "").digest("hex");
+  if (!mirrorConfigured(raw)) return { state: "absent", fingerprint };
+  if (await mirrorLoaded((path) => fs.readFile(path))) return { state: "loaded", fingerprint };
+  const tried = (await fs.readFile(LOCAL_REGISTRY_MIRROR_RESTART_FILE))?.trim() === fingerprint;
+  return { state: tried ? "tried" : "owed", fingerprint };
+}
+async function registryMirrorPending(fs) {
+  return (await readMirrorState(fs)).state === "owed";
+}
+async function loadRegistryMirror(ctx) {
+  const { state, fingerprint } = await readMirrorState(ctx.fs);
+  if (state === "tried") {
+    return {
+      restarted: false,
+      warning: `k3s restarted but did not load the local image registry's mirror, so pods cannot pull from that registry. Conveyor restarts k3s for it again only after /etc/rancher/k3s/registries.yaml changes. Check that k3s reads that file and keeps its data in the default directory: the mirror should appear under ${K3S_CERTS_D}.`
+    };
+  }
+  if (state !== "owed") return { restarted: false, warning: null };
+  if (!mayDisrupt(ctx.runningConveyorPods)) {
+    return {
+      restarted: false,
+      warning: `The local image registry needs a k3s restart to load its mirror, but ${busyReason(ctx.runningConveyorPods)} \u2014 the restart is deferred until the machine is idle.`
+    };
+  }
+  const restart = await ctx.exec("systemctl", ["restart", "k3s"], { timeoutMs: 12e4 });
+  if (restart.exitCode !== 0) {
+    return {
+      restarted: false,
+      warning: `Could not restart k3s to load the local image registry mirror: ${restart.stderr.trim().slice(0, 200)}`
+    };
   }
+  await ctx.fs.writeFile(LOCAL_REGISTRY_MIRROR_RESTART_FILE, `${fingerprint}
+`, 384);
+  return { restarted: true, warning: null };
+}
+
+// src/lib/isolation.ts
+var EGRESS_POLICY_NAME = "conveyor-k3-egress";
+var MANAGED_BY2 = { "app.kubernetes.io/managed-by": "conveyor-k3" };
+var NON_ROUTABLE_IPV4 = [
+  "0.0.0.0/8",
+  "10.0.0.0/8",
+  "100.64.0.0/10",
+  "127.0.0.0/8",
+  "169.254.0.0/16",
+  "172.16.0.0/12",
+  "192.0.0.0/24",
+  "192.0.2.0/24",
+  "192.88.99.0/24",
+  "192.168.0.0/16",
+  "198.18.0.0/15",
+  "198.51.100.0/24",
+  "203.0.113.0/24",
+  "224.0.0.0/4",
+  "240.0.0.0/4"
+];
+var KUBE_DNS = { namespace: "kube-system", labels: { "k8s-app": "kube-dns" } };
+var PSA_PREFIX = "pod-security.kubernetes.io";
+function psaLabels(level) {
+  const advisory = level === "baseline" ? "restricted" : level;
+  return {
+    [`${PSA_PREFIX}/enforce`]: level,
+    [`${PSA_PREFIX}/warn`]: advisory,
+    [`${PSA_PREFIX}/audit`]: advisory
+  };
+}
+var PSA_LABEL_KEYS = Object.keys(psaLabels("baseline"));
+function ipv4Value(address) {
+  const parts = address.split(".");
+  if (parts.length !== 4) return null;
+  let value = 0;
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part)) return null;
+    const octet = Number(part);
+    if (octet > 255) return null;
+    value = value * 256 + octet;
+  }
+  return value;
+}
+function inNonRoutableRange(address) {
+  const value = ipv4Value(address);
+  if (value === null) return false;
+  return NON_ROUTABLE_IPV4.some((cidr) => {
+    const [base = "", bits = "32"] = cidr.split("/");
+    const start = ipv4Value(base) ?? 0;
+    return value >= start && value < start + 2 ** (32 - Number(bits));
+  });
+}
+function hostAddressExceptions(addresses) {
+  const kept = /* @__PURE__ */ new Set();
+  for (const raw of addresses) {
+    const address = raw.trim();
+    if (ipv4Value(address) === null || inNonRoutableRange(address)) continue;
+    kept.add(`${address}/32`);
+  }
+  return [...kept].sort();
+}
+function renderEgressNetworkPolicy(namespace, hostAddresses) {
+  const policy = {
+    apiVersion: "networking.k8s.io/v1",
+    kind: "NetworkPolicy",
+    metadata: {
+      name: EGRESS_POLICY_NAME,
+      namespace: assertK8sName(namespace, "namespace"),
+      labels: MANAGED_BY2
+    },
+    spec: {
+      podSelector: {},
+      policyTypes: ["Egress"],
+      egress: [
+        {
+          to: [
+            {
+              namespaceSelector: {
+                matchLabels: { "kubernetes.io/metadata.name": KUBE_DNS.namespace }
+              },
+              podSelector: { matchLabels: KUBE_DNS.labels }
+            }
+          ],
+          ports: [
+            { protocol: "UDP", port: 53 },
+            { protocol: "TCP", port: 53 }
+          ]
+        },
+        {
+          // kube-router enforces after the Service's DNAT, so the registry is
+          // reached by its pods' labels, never by the service range.
+          to: [
+            {
+              namespaceSelector: {
+                matchLabels: { "kubernetes.io/metadata.name": PERSONAL_LOCAL_REGISTRY_NAMESPACE }
+              },
+              podSelector: { matchLabels: LOCAL_REGISTRY_SELECTOR }
+            }
+          ],
+          ports: [{ protocol: "TCP", port: PERSONAL_LOCAL_REGISTRY_PORT }]
+        },
+        {
+          to: [
+            {
+              ipBlock: {
+                cidr: "0.0.0.0/0",
+                except: [...NON_ROUTABLE_IPV4, ...hostAddressExceptions(hostAddresses)]
+              }
+            }
+          ]
+        }
+      ]
+    }
+  };
+  return `${JSON.stringify(policy, null, 2)}
+`;
+}
+var DISABLE_KEY = /(?:^|[\s{,])(["']?)disable-network-policy\1\s*:([^,}]*)/g;
+var DISABLE_FLAGS = /* @__PURE__ */ new Set(["--disable-network-policy", "-disable-network-policy"]);
+var FALSE_VALUES = /* @__PURE__ */ new Set(["false", "no", "off", "n", "f", "0"]);
+function setsTrue(raw) {
+  const value = bareToken(raw).trim().toLowerCase();
+  return !FALSE_VALUES.has(value);
+}
+function uncommented(line) {
+  return /^\s*#/.test(line) ? "" : line.replace(/\s#.*$/, "");
+}
+function configSetsKey(text) {
+  return text.split("\n").map(uncommented).some((line) => [...line.matchAll(DISABLE_KEY)].some((match) => setsTrue(match[2] ?? "")));
+}
+function unitLines(unitText) {
+  const lines2 = [];
+  let pending = "";
+  for (const raw of unitText.split("\n")) {
+    const line = raw.trimEnd();
+    if (/^\s*[#;]/.test(line)) continue;
+    if (line.endsWith("\\")) {
+      pending += `${line.slice(0, -1)} `;
+      continue;
+    }
+    lines2.push(pending + line);
+    pending = "";
+  }
+  return pending ? [...lines2, pending] : lines2;
+}
+function flagSetIn(line) {
+  return line.split(/\s+/).some((raw) => {
+    const token = bareToken(raw).replace(/^["']+|["']+$/g, "");
+    const [name = "", ...value] = token.split("=");
+    return DISABLE_FLAGS.has(name) && (value.length === 0 || setsTrue(value.join("=")));
+  });
+}
+function networkPolicyControllerDisabled(sources) {
+  if (sources.configs.some((text) => text !== null && configSetsKey(text))) return true;
+  return unitLines(sources.unitText).some(flagSetIn);
+}
+
+// src/daemon/isolation-probes.ts
+var CONTROLLER_DISABLED_WARNING = "k3s runs with its network policy controller disabled, so the egress policy Conveyor applies here is not enforced. Remove disable-network-policy from the k3s config or unit and restart k3s. Until then this server is not isolated; Conveyor checks again within 10 minutes.";
+var CONTROLLER_UNKNOWN_WARNING = "Could not read the k3s unit or its config files to check that its network policy controller is on, so this server does not count as isolated. Check `systemctl cat k3s.service` and /etc/rancher/k3s; Conveyor checks again within 10 minutes.";
+var NODE_ADDRESSES_JSONPATH = '{range .items[*]}{range .status.addresses[?(@.type=="InternalIP")]}{.address}{"\\n"}{end}{range .status.addresses[?(@.type=="ExternalIP")]}{.address}{"\\n"}{end}{end}';
+var API_ENDPOINTS_JSONPATH = "{.items[*].endpoints[*].addresses[*]}";
+var IPV4_ON_INTERFACE = /\binet (\d{1,3}(?:\.\d{1,3}){3})(?:\/| peer )/g;
+async function stdoutOf(exec, bin, args) {
+  const run = await exec(bin, args, { timeoutMs: 1e4 }).catch(() => null);
+  return run && run.exitCode === 0 ? run.stdout : null;
+}
+async function readK3sConfigs(ctx) {
+  const listed = await stdoutOf(ctx.exec, "find", [
+    "-L",
+    K3S_CONFIG_DROPIN_DIR,
+    "-maxdepth",
+    "1",
+    "-type",
+    "f",
+    "(",
+    "-iname",
+    "*.yaml",
+    "-o",
+    "-iname",
+    "*.yml",
+    ")"
+  ]);
+  if (listed === null) return null;
+  const paths = listed.split("\n").map((path) => path.trim()).filter(Boolean).sort();
+  const dropIns = await Promise.all(paths.map((path) => ctx.fs.readFile(path)));
+  if (dropIns.some((text) => text === null)) return null;
+  return [await ctx.fs.readFile(K3S_OWNER_CONFIG), ...dropIns];
+}
+async function controllerProblem(ctx) {
+  const unitText = await stdoutOf(ctx.exec, "systemctl", ["cat", "k3s.service"]);
+  const configs = unitText === null ? null : await readK3sConfigs(ctx);
+  if (unitText === null || configs === null) return CONTROLLER_UNKNOWN_WARNING;
+  return networkPolicyControllerDisabled({ configs, unitText }) ? CONTROLLER_DISABLED_WARNING : null;
+}
+async function readHostAddresses(exec) {
+  const nodes = await stdoutOf(exec, "k3s", [
+    "kubectl",
+    "get",
+    "nodes",
+    "-o",
+    `jsonpath=${NODE_ADDRESSES_JSONPATH}`
+  ]);
+  const interfaces = await stdoutOf(exec, "ip", ["-o", "-4", "addr", "show"]);
+  const api = await stdoutOf(exec, "k3s", [
+    "kubectl",
+    "get",
+    "endpointslices",
+    "-n",
+    "default",
+    "-l",
+    "kubernetes.io/service-name=kubernetes",
+    "-o",
+    `jsonpath=${API_ENDPOINTS_JSONPATH}`
+  ]);
+  if (nodes === null || interfaces === null || api === null) return null;
+  const onInterfaces = [...interfaces.matchAll(IPV4_ON_INTERFACE)].map((match) => match[1] ?? "");
+  return [...nodes.split(/\s+/), ...onInterfaces, ...api.split(/\s+/)].filter(Boolean);
+}
+async function recheckIsolation(ctx, reconciled) {
+  if (reconciled?.applied !== true) return { isolation: reconciled, warnings: [] };
+  const problem = await controllerProblem(ctx);
+  return problem ? { isolation: { applied: false }, warnings: [problem] } : { isolation: reconciled, warnings: [] };
+}
+
+// src/daemon/prune-namespaces.ts
+var POOL_NAMESPACE_PREFIX = "claudespace-";
+var WORKSPACE_MANAGER_ROLE = "conveyor-workspace-manager";
+var MAX_NAMESPACE_DELETES_PER_RUN = 5;
+var KUBECTL_TIMEOUT = "--request-timeout=10s";
+var EXEC_OPTIONS = { timeoutMs: 15e3 };
+function kubectl(exec, args) {
+  return exec("k3s", ["kubectl", ...args, KUBECTL_TIMEOUT], EXEC_OPTIONS).catch(() => null);
+}
+function candidateNamespaces(listing, wanted) {
+  const names = [];
+  for (const line of listing.split("\n")) {
+    const [name, phase] = line.trim().split(/\s+/);
+    if (!name?.startsWith(POOL_NAMESPACE_PREFIX) || wanted.has(name)) continue;
+    if (phase === "Terminating") continue;
+    try {
+      names.push(assertK8sName(name, "namespace"));
+    } catch {
+    }
+  }
+  return names;
+}
+async function isEmptyConveyorNamespace(exec, namespace) {
+  const role = await kubectl(exec, [
+    "get",
+    "role",
+    WORKSPACE_MANAGER_ROLE,
+    "-n",
+    namespace,
+    "-o",
+    "name"
+  ]);
+  if (role?.exitCode !== 0) return false;
+  const pods = await kubectl(exec, ["get", "pods", "-n", namespace, "-o", "name"]);
+  return pods?.exitCode === 0 && pods.stdout.trim() === "";
+}
+async function pruneStaleNamespaces(ctx, desired, result) {
+  if (desired.namespaces.length === 0) return;
+  const listed = await kubectl(ctx.exec, [
+    "get",
+    "namespaces",
+    "-o",
+    'jsonpath={range .items[*]}{.metadata.name}{" "}{.status.phase}{"\\n"}{end}'
+  ]);
+  if (listed?.exitCode !== 0) return;
+  const wanted = new Set(desired.namespaces.map((namespace) => namespace.name));
+  let deletes = 0;
+  for (const namespace of candidateNamespaces(listed.stdout, wanted)) {
+    if (deletes >= MAX_NAMESPACE_DELETES_PER_RUN) return;
+    if (!await isEmptyConveyorNamespace(ctx.exec, namespace)) continue;
+    deletes += 1;
+    const removed = await kubectl(ctx.exec, ["delete", "namespace", namespace, "--wait=false"]);
+    if (removed?.exitCode === 0) {
+      result.prunedNamespaces.push(namespace);
+    } else {
+      result.warnings.push(
+        `Could not remove the unused namespace ${namespace}: ${(removed?.stderr ?? "no answer from k3s").trim().slice(0, 160)}`
+      );
+    }
+  }
+}
+
+// src/daemon/namespace-upkeep.ts
+function message(error) {
+  return error instanceof Error ? error.message : String(error);
 }
 function renderLimitRange(namespace, limits) {
   const ns = assertK8sName(namespace, "namespace");
@@ -7249,56 +8005,522 @@ async function reconcileNamespaces(ctx, desired, result) {
       await kubectlApply(ctx.exec, renderLimitRange(namespace.name, namespace.limitRange));
     } catch (error) {
       result.warnings.push(
-        `Could not apply resource defaults to ${namespace.name} (${namespace.projectName}): ${error instanceof Error ? error.message : String(error)}`
+        `Could not apply resource defaults to ${namespace.name} (${namespace.projectName}): ${message(error)}`
       );
     }
   }
 }
-async function step(result, label, run) {
+async function ensureBakeNamespace(ctx, desired) {
+  const found = await ctx.exec(
+    "k3s",
+    ["kubectl", "get", "namespace", PERSONAL_BAKE_NAMESPACE],
+    KUBECTL_TIMEOUT2
+  );
+  if (found.exitCode !== 0) {
+    await runOrThrow(
+      ctx.exec,
+      "k3s",
+      ["kubectl", "create", "namespace", PERSONAL_BAKE_NAMESPACE],
+      KUBECTL_TIMEOUT2
+    );
+  }
+  const limitRange = desired.namespaces[0]?.limitRange;
+  if (limitRange) {
+    await kubectlApply(ctx.exec, renderLimitRange(PERSONAL_BAKE_NAMESPACE, limitRange));
+  }
+}
+function knownStance(isolation) {
+  const { podSecurity, egress, ...rest } = { ...isolation };
+  const extra = Object.keys(rest);
+  if (podSecurity === "baseline" && egress === "no-private" && extra.length === 0) return null;
+  const named = `Pod Security "${String(podSecurity).slice(0, 40)}", egress "${String(egress).slice(0, 40)}"`;
+  return extra.length === 0 ? named : `${named}, and ${extra.slice(0, 3).join(", ").slice(0, 80)}`;
+}
+var KUBECTL_TIMEOUT2 = { timeoutMs: 3e4 };
+var RECHECK = "Conveyor checks again within 10 minutes.";
+async function isolateNamespace(ctx, namespace, isolation, fail) {
+  const ns = assertK8sName(namespace, "namespace");
+  const labels = Object.entries(psaLabels(isolation.podSecurity)).map(
+    ([key, value]) => `${key}=${value}`
+  );
+  const labelled = await ctx.exec(
+    "k3s",
+    ["kubectl", "label", "namespace", ns, "--overwrite", ...labels],
+    KUBECTL_TIMEOUT2
+  );
+  if (labelled.exitCode !== 0) {
+    fail(
+      `Could not apply Pod Security labels to ${ns}: ${labelled.stderr.trim().slice(0, 200)} ${RECHECK}`
+    );
+  }
+  if (isolation.hostAddresses === null) return;
   try {
-    await run();
+    await kubectlApply(ctx.exec, renderEgressNetworkPolicy(ns, isolation.hostAddresses));
   } catch (error) {
-    result.warnings.push(`${label}: ${error instanceof Error ? error.message : String(error)}`);
+    fail(`Could not apply the egress policy to ${ns}: ${message(error).slice(0, 200)} ${RECHECK}`);
   }
 }
-async function reconcile(ctx, desired) {
-  const result = {
-    appliedVersion: desired.version,
-    warnings: [],
-    restartedK3s: false,
-    skippedKubeletFlags: [],
-    effectiveImageGcHighThreshold: null,
-    recreatedPriorityClass: false
-  };
-  const disallowedKinds = findDisallowedKinds(desired.rbacManifest);
-  if (disallowedKinds.length > 0) {
+async function reconcileIsolation(ctx, desired, result) {
+  try {
+    await ensureBakeNamespace(ctx, desired);
+  } catch (error) {
     result.warnings.push(
-      `Conveyor sent a cluster manifest containing disallowed kind(s) ${disallowedKinds.join(", ")} \u2014 refused. RBAC and PriorityClass steps skipped; this should never happen, report it.`
+      `Could not prepare the bake namespace ${PERSONAL_BAKE_NAMESPACE}: ${message(error)}`
     );
-  } else {
-    await step(result, "Could not apply RBAC", () => kubectlApply(ctx.exec, desired.rbacManifest));
-    await step(
-      result,
-      "Could not reconcile the PriorityClass",
-      () => reconcilePriorityClass(ctx, desired, result)
+  }
+  const isolation = desired.isolation;
+  if (!isolation) {
+    result.isolation = void 0;
+    return;
+  }
+  const unknown = knownStance(isolation);
+  if (unknown) {
+    result.warnings.push(
+      `Conveyor asks for pod isolation this version of conveyor-k3 does not know (${unknown}), so nothing was changed and this server does not count as isolated. Run \`sudo conveyor-k3 update\`.`
     );
+    result.isolation = { applied: false };
+    return;
   }
-  await step(
-    result,
-    "Could not apply namespace defaults",
-    () => reconcileNamespaces(ctx, desired, result)
+  let applied = true;
+  const fail = (warning) => {
+    applied = false;
+    result.warnings.push(warning);
+  };
+  const problem = await controllerProblem(ctx);
+  if (problem) fail(problem);
+  const hostAddresses = await readHostAddresses(ctx.exec);
+  if (hostAddresses === null) {
+    fail(
+      `Could not read every address this server answers on, so the egress policies in place were left as they are and this server does not count as isolated. ${RECHECK}`
+    );
+  }
+  for (const namespace of desired.namespaces) {
+    await isolateNamespace(ctx, namespace.name, { podSecurity: "baseline", hostAddresses }, fail);
+  }
+  await isolateNamespace(
+    ctx,
+    PERSONAL_BAKE_NAMESPACE,
+    { podSecurity: "privileged", hostAddresses },
+    fail
   );
-  await step(
-    result,
-    "Could not apply kubelet settings",
-    () => reconcileKubelet(ctx, desired, result)
+  result.isolation = { applied };
+}
+
+// src/daemon/registry-tags.ts
+var REPO_NAME = /^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$/;
+var TAG_NAME = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$/;
+var LEG_TAG = /^current-([0-9a-f]{16})-(?:amd64|arm64)$/;
+var DIGEST = /^sha256:[0-9a-f]{64}$/;
+var PAGE_SIZE = 100;
+var MAX_REPOSITORIES = 1e3;
+var MAX_TAGS = 5e3;
+var REQUEST_TIMEOUT_MS = 15e3;
+var MANIFEST_ACCEPT = [
+  "application/vnd.oci.image.index.v1+json",
+  "application/vnd.docker.distribution.manifest.list.v2+json",
+  "application/vnd.oci.image.manifest.v1+json",
+  "application/vnd.docker.distribution.manifest.v2+json"
+].join(", ");
+function stringList(value) {
+  return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+async function getJson(fetchImpl, path) {
+  const response = await fetchImpl(`${PERSONAL_LOCAL_REGISTRY_NODE_ENDPOINT}${path}`, {
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+  });
+  if (!response.ok) {
+    await response.body?.cancel();
+    throw new Error(`The local registry answered ${response.status} to GET ${path}`);
+  }
+  return { body: await response.json(), hasNext: response.headers.has("link") };
+}
+async function listPaged(fetchImpl, path, key, limit) {
+  const names = [];
+  let last;
+  while (names.length < limit) {
+    const query = `n=${PAGE_SIZE}${last ? `&last=${encodeURIComponent(last)}` : ""}`;
+    const { body, hasNext } = await getJson(fetchImpl, `${path}?${query}`);
+    const page = stringList(body?.[key]);
+    names.push(...page);
+    if (!hasNext || page.length === 0) return { names, complete: true };
+    last = page.at(-1);
+  }
+  return { names: names.slice(0, limit), complete: false };
+}
+async function readManifest(fetchImpl, repo, reference, method) {
+  const response = await fetchImpl(
+    `${PERSONAL_LOCAL_REGISTRY_NODE_ENDPOINT}/v2/${repo}/manifests/${reference}`,
+    {
+      method,
+      headers: { Accept: MANIFEST_ACCEPT },
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    }
   );
-  return result;
+  const digest = response.headers.get("docker-content-digest");
+  if (!response.ok || !digest || !DIGEST.test(digest)) {
+    await response.body?.cancel();
+    return null;
+  }
+  if (method === "HEAD") return { digest, children: [] };
+  const body = await response.json();
+  const children = (body?.manifests ?? []).map((entry) => entry.digest).filter((child) => typeof child === "string" && DIGEST.test(child));
+  return { digest, children };
+}
+function isSupersededLeg(tag, retain) {
+  const match = LEG_TAG.exec(tag);
+  return match?.[1] !== void 0 && !retain.has(match[1]);
+}
+async function planRepository(fetchImpl, repo, retain) {
+  const listed = await listPaged(fetchImpl, `/v2/${repo}/tags/list`, "tags", MAX_TAGS);
+  if (!listed.complete) return { skip: `it has more than ${MAX_TAGS} tags` };
+  const tags = listed.names.filter((tag) => TAG_NAME.test(tag));
+  const legs = tags.filter((tag) => isSupersededLeg(tag, retain));
+  const kept = tags.filter((tag) => !isSupersededLeg(tag, retain));
+  if (legs.length === 0) return { deletions: [], kept: kept.length };
+  const keep = /* @__PURE__ */ new Set();
+  for (const tag of kept) {
+    const manifest = await readManifest(fetchImpl, repo, tag, "GET");
+    if (!manifest) return { skip: `the tag ${tag} it keeps could not be read` };
+    keep.add(manifest.digest);
+    for (const child of manifest.children) keep.add(child);
+  }
+  const byDigest = /* @__PURE__ */ new Map();
+  for (const tag of legs) {
+    const manifest = await readManifest(fetchImpl, repo, tag, "HEAD");
+    if (!manifest || keep.has(manifest.digest)) continue;
+    byDigest.set(manifest.digest, [...byDigest.get(manifest.digest) ?? [], tag]);
+  }
+  const deletions = [...byDigest].map(([digest, names]) => ({ repo, digest, tags: names }));
+  return { deletions, kept: kept.length };
+}
+async function planTagCleanup(fetchImpl, retain) {
+  const catalog = await listPaged(fetchImpl, "/v2/_catalog", "repositories", MAX_REPOSITORIES);
+  const repos = catalog.names.filter(
+    (repo) => repo.startsWith("personal-") && REPO_NAME.test(repo)
+  );
+  const plan = { deletions: [], keptTags: 0, skippedRepos: [] };
+  for (const repo of repos) {
+    const planned = await planRepository(fetchImpl, repo, retain).catch((error) => ({
+      skip: `its tags could not be read (${error instanceof Error ? error.message : String(error)})`
+    }));
+    if ("skip" in planned) {
+      plan.skippedRepos.push({ repo, reason: planned.skip });
+      continue;
+    }
+    plan.deletions.push(...planned.deletions);
+    plan.keptTags += planned.kept;
+  }
+  return plan;
+}
+async function deleteManifest(fetchImpl, deletion) {
+  const response = await fetchImpl(
+    `${PERSONAL_LOCAL_REGISTRY_NODE_ENDPOINT}/v2/${deletion.repo}/manifests/${deletion.digest}`,
+    { method: "DELETE", signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) }
+  );
+  await response.body?.cancel();
+  return response.status === 202 || response.status === 404;
+}
+
+// src/daemon/registry-gc.ts
+var HOUR_MS = 60 * 6e4;
+var REGISTRY_GC_INTERVAL_MS = 20 * HOUR_MS;
+var REGISTRY_GC_SIZE_BYTES = 20 * 1024 ** 3;
+var REGISTRY_GC_SIZE_INTERVAL_MS = 6 * HOUR_MS;
+var BAKE_OBJECT_STALE_MS = 6 * HOUR_MS;
+function lines(text) {
+  return text.split("\n").filter((line) => line.trim().length > 0);
+}
+var inNamespace = inRegistryNamespace;
+function defaultSleep(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+async function bakeActivity(exec, now) {
+  const pods = await exec(
+    "k3s",
+    [
+      "kubectl",
+      "get",
+      "pods",
+      "--all-namespaces",
+      "-l",
+      CONVEYOR_POD_SELECTOR,
+      // A pod still pulling its image needs the registry as much as a running one.
+      "--field-selector=status.phase!=Succeeded,status.phase!=Failed",
+      "-o",
+      "name"
+    ],
+    { timeoutMs: 3e4 }
+  );
+  if (pods.exitCode !== 0) return "the Conveyor pods could not be listed";
+  const podCount = lines(pods.stdout).length;
+  if (podCount > 0) return `${podCount} Conveyor pod(s) are on the machine`;
+  const bakes = await exec(
+    "k3s",
+    [
+      "kubectl",
+      "get",
+      "jobs,secrets,configmaps",
+      "--all-namespaces",
+      "-l",
+      `${BAKE_COMPONENT_LABEL} in (${BAKE_COMPONENT_VALUES.join(",")})`,
+      "-o",
+      'jsonpath={range .items[*]}{.metadata.creationTimestamp}{"\\n"}{end}'
+    ],
+    { timeoutMs: 3e4 }
+  );
+  if (bakes.exitCode !== 0) return "the bake objects could not be listed";
+  const inFlight = lines(bakes.stdout).some((stamp) => {
+    const created = Date.parse(stamp.trim());
+    return Number.isNaN(created) || now - created < BAKE_OBJECT_STALE_MS;
+  });
+  return inFlight ? "a bake is in flight" : null;
+}
+async function pollUntil(check, timeoutMs, intervalMs, sleep2) {
+  for (let waited = 0; waited < timeoutMs; waited += intervalMs) {
+    if (await check()) return true;
+    await sleep2(intervalMs);
+  }
+  return await check();
+}
+async function registryPodsGone(exec) {
+  const result = await inNamespace(exec, [
+    "get",
+    "pods",
+    "-l",
+    `app.kubernetes.io/name=${PERSONAL_LOCAL_REGISTRY_NAME}`,
+    "-o",
+    "name"
+  ]);
+  return result.exitCode === 0 && lines(result.stdout).length === 0;
+}
+async function gcJobState(exec) {
+  const result = await inNamespace(exec, [
+    "get",
+    "job",
+    LOCAL_REGISTRY_GC_JOB,
+    "-o",
+    "jsonpath={.status.succeeded},{.status.failed}"
+  ]);
+  if (result.exitCode !== 0) return null;
+  const [succeeded, failed] = result.stdout.trim().split(",");
+  if (Number(succeeded) > 0) return "succeeded";
+  return Number(failed) > 0 ? "failed" : null;
+}
+async function waitForGcJob(exec, sleep2) {
+  for (let waited = 0; waited <= 11 * 6e4; waited += 5e3) {
+    const state = await gcJobState(exec);
+    if (state) return state;
+    await sleep2(5e3);
+  }
+  return null;
+}
+async function releaseRegistry(ports, mark) {
+  const { exec } = ports;
+  const now = (ports.now ?? Date.now)();
+  const current = await readRegistryDeployment(exec);
+  if (current?.mark !== mark && gcMarkIsLive(current?.mark ?? null, now, ports.isAlive)) return;
+  if (!await deleteSweepJob(exec)) {
+    ports.log(
+      "Left the local image registry stopped: its cleanup Job could not be deleted. The next hourly pass tries again."
+    );
+    return;
+  }
+  await clearGcMark(exec);
+  const restored = await inNamespace(exec, [
+    "scale",
+    "deployment",
+    PERSONAL_LOCAL_REGISTRY_NAME,
+    "--replicas=1"
+  ]);
+  if (restored.exitCode !== 0) {
+    ports.log(
+      `Could not scale the local image registry back up; the next hourly pass restores it: ${restored.stderr.trim().slice(0, 200)}`
+    );
+  }
+}
+async function collectBlobs(ports) {
+  const { exec } = ports;
+  const sleep2 = ports.sleep ?? defaultSleep;
+  if (!await deleteSweepJob(exec)) throw new Error("a previous cleanup Job could not be deleted");
+  const mark = newGcMark((ports.now ?? Date.now)());
+  await setGcMark(exec, mark);
+  try {
+    const scaled = await inNamespace(exec, [
+      "scale",
+      "deployment",
+      PERSONAL_LOCAL_REGISTRY_NAME,
+      "--replicas=0"
+    ]);
+    if (scaled.exitCode !== 0) throw new Error("the registry could not be scaled to zero");
+    if (!await pollUntil(() => registryPodsGone(exec), 12e4, 2e3, sleep2)) {
+      throw new Error("the registry pod did not stop within 2 minutes");
+    }
+    const held = await readRegistryDeployment(exec);
+    if (held?.replicas !== 0 || held.mark !== mark) {
+      throw new Error(
+        "the registry was started again by another process, so the sweep did not run"
+      );
+    }
+    await kubectlApply(exec, renderRegistryGcJob());
+    const state = await waitForGcJob(exec, sleep2);
+    if (state !== "succeeded") throw new Error(`garbage-collect ${state ?? "did not finish"}`);
+  } finally {
+    await releaseRegistry(ports, mark);
+  }
+}
+async function readRetainList(ports) {
+  const desired = await ports.requestDesiredState().catch(() => null);
+  if (!desired) return "the settings could not be fetched from Conveyor";
+  if (desired.localRegistry?.enabled !== true) return "the local image registry is off";
+  return desired.localRegistry.retainHashes ?? "Conveyor did not send the list of bakes to keep";
+}
+async function registryBlocker(ports, now) {
+  const deployment = await readRegistryDeployment(ports.exec);
+  if (!deployment) return "the local image registry could not be read";
+  if (!deployment.exists) return "the local image registry is not deployed yet";
+  if (gcMarkIsLive(deployment.mark, now, ports.isAlive))
+    return "another registry cleanup is running";
+  return await bakeActivity(ports.exec, now);
+}
+async function collectRegistryGarbage(ports, options) {
+  const skip = (reason) => ({
+    skipped: reason,
+    deletions: [],
+    blobsCollected: false
+  });
+  const now = ports.now ?? Date.now;
+  const fetchImpl = ports.fetch ?? fetch;
+  const retain = await readRetainList(ports);
+  if (typeof retain === "string") return skip(retain);
+  const blocked = await registryBlocker(ports, now());
+  if (blocked) return skip(blocked);
+  const plan = await planTagCleanup(fetchImpl, new Set(retain));
+  for (const skipped of plan.skippedRepos) {
+    ports.log(`Left ${skipped.repo} alone: ${skipped.reason}.`);
+  }
+  if (options.dryRun) return { deletions: plan.deletions, blobsCollected: false };
+  const late2 = await bakeActivity(ports.exec, now());
+  if (late2) return skip(late2);
+  const deletions = [];
+  for (const deletion of plan.deletions) {
+    if (await deleteManifest(fetchImpl, deletion)) deletions.push(deletion);
+    else ports.log(`Could not delete ${deletion.repo}@${deletion.digest}.`);
+  }
+  await collectBlobs(ports);
+  return { deletions, blobsCollected: true };
+}
+async function registryDataBytes(exec) {
+  const result = await exec("du", ["-s", "--block-size=1", LOCAL_REGISTRY_DATA_DIR], {
+    timeoutMs: 12e4
+  });
+  if (result.exitCode !== 0) return null;
+  const bytes = Number.parseInt(result.stdout.trim().split(/\s+/)[0] ?? "", 10);
+  return Number.isFinite(bytes) ? bytes : null;
+}
+async function registryGcDue(exec, lastGcAt, maintenanceHour, now = /* @__PURE__ */ new Date()) {
+  const last = lastGcAt ? Date.parse(lastGcAt) : Number.NaN;
+  const since = Number.isNaN(last) ? Number.POSITIVE_INFINITY : now.getTime() - last;
+  if (now.getHours() === maintenanceHour && since >= REGISTRY_GC_INTERVAL_MS) return true;
+  if (since < REGISTRY_GC_SIZE_INTERVAL_MS) return false;
+  const bytes = await registryDataBytes(exec);
+  return bytes !== null && bytes >= REGISTRY_GC_SIZE_BYTES;
 }
 
 // src/daemon/telemetry.ts
 import { statfs } from "fs/promises";
 
+// src/vm/capacity.ts
+var GIB = 1024 ** 3;
+var MIB = 1024 ** 2;
+var CONTROL_RELAY_SLOTS = 6;
+var CAPACITY_BOUNDS = {
+  relaySlots: { min: 16, max: 192, flag: "relay-slots" },
+  relayMaxGiB: { min: 1, max: 16, flag: "relay-max-gib" },
+  diskMiBps: { min: 25, max: 2e3, flag: "disk-mbps" },
+  diskIops: { min: 500, max: 5e4, flag: "disk-iops" }
+};
+var LEGACY_CAPACITY_LIMITS = Object.freeze({
+  schema: 1,
+  profile: "default",
+  relaySlots: 16,
+  reservedRelaySlots: 0,
+  relayMaxBytes: GIB,
+  diskBytesPerSecond: 100 * MIB,
+  diskIops: 2e3
+});
+var KEYS = Object.keys(CAPACITY_BOUNDS);
+var PROFILES = /* @__PURE__ */ new Set(["default", "server", "custom"]);
+function parseCapacityLimits(value) {
+  if (value === void 0) return { ...LEGACY_CAPACITY_LIMITS };
+  const limits = typeof value === "object" && value !== null ? value : {};
+  const within = (key, min, max) => Number.isSafeInteger(limits[key]) && limits[key] >= min && limits[key] <= max;
+  const bounds = CAPACITY_BOUNDS;
+  if (limits.schema !== 1 || !PROFILES.has(limits.profile) || !within("relaySlots", bounds.relaySlots.min, bounds.relaySlots.max) || limits.reservedRelaySlots !== 0 && limits.reservedRelaySlots !== CONTROL_RELAY_SLOTS || !within("relayMaxBytes", bounds.relayMaxGiB.min * GIB, bounds.relayMaxGiB.max * GIB) || !within("diskBytesPerSecond", bounds.diskMiBps.min * MIB, bounds.diskMiBps.max * MIB) || !within("diskIops", bounds.diskIops.min, bounds.diskIops.max))
+    throw new Error("The VM capacity limits in the host network policy are invalid.");
+  return {
+    schema: 1,
+    profile: limits.profile,
+    relaySlots: limits.relaySlots,
+    reservedRelaySlots: limits.reservedRelaySlots,
+    relayMaxBytes: limits.relayMaxBytes,
+    diskBytesPerSecond: limits.diskBytesPerSecond,
+    diskIops: limits.diskIops
+  };
+}
+
+// src/daemon/local-images.ts
+var MAX_LOCAL_IMAGES = 64;
+var MAX_INSPECTIONS_PER_BEAT = 4;
+var CONTENT_HASH = /^[0-9a-f]{16}$/;
+function isImageRef(ref) {
+  try {
+    assertImageRef(ref);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function inspectContentHash(exec, imageId) {
+  const result = await exec("crictl", ["inspecti", "-o", "json", imageId], {
+    timeoutMs: 5e3,
+    maxOutputBytes: 256 * 1024
+  }).catch(() => null);
+  if (!result || result.exitCode !== 0) return void 0;
+  try {
+    const label = JSON.parse(result.stdout).info?.imageSpec?.config?.Labels?.[CONVEYOR_CONTENT_HASH_LABEL];
+    return typeof label === "string" && CONTENT_HASH.test(label) ? label : null;
+  } catch {
+    return void 0;
+  }
+}
+async function reportLocalImages(exec, inventory, wantedImages, cache) {
+  if (!inventory) return void 0;
+  const wanted = new Set(wantedImages);
+  const held = inventory.images.flatMap(
+    (image) => (image.repoTags ?? []).filter((ref) => ref.startsWith("localhost/") && isImageRef(ref)).map((ref) => ({ ref, imageId: image.id }))
+  );
+  held.sort(
+    (a, b) => Number(wanted.has(b.ref)) - Number(wanted.has(a.ref)) || (a.ref < b.ref ? -1 : a.ref > b.ref ? 1 : 0)
+  );
+  const reported = held.slice(0, MAX_LOCAL_IMAGES);
+  const live = new Set(reported.map((entry) => entry.imageId));
+  for (const id of [...cache.keys()]) if (!live.has(id)) cache.delete(id);
+  const images = [];
+  let inspections = 0;
+  for (const entry of reported) {
+    let contentHash = cache.get(entry.imageId);
+    if (contentHash === void 0 && inspections < MAX_INSPECTIONS_PER_BEAT) {
+      inspections += 1;
+      contentHash = await inspectContentHash(exec, entry.imageId);
+      if (contentHash !== void 0) cache.set(entry.imageId, contentHash);
+    }
+    images.push({ ...entry, contentHash: contentHash ?? null });
+  }
+  return images;
+}
+
 // src/commands/runners.ts
 var STAGING_FILE = `${RUNNERS_SUDOERS_FILE}.staged`;
 async function detectRunnerUsers(exec) {
@@ -7334,6 +8556,21 @@ function ungrantedRunnersWarning(users) {
 var GRANTED_COMMAND_NAMES = LOCAL_BAKE_ROOT_COMMANDS.map((command) => command.name);
 
 // src/daemon/telemetry.ts
+var LOCAL_REGISTRY_WARN_AFTER_MS = 10 * 6e4;
+async function reportLocalRegistry(ports, watch, now = Date.now()) {
+  if (!watch) return { fields: {}, warnings: [] };
+  const ready = await localRegistryReady({ readFile: ports.readFile, fetch: ports.fetch });
+  const paused = (watch.pausedUntil ?? 0) > now;
+  watch.notReadySince = ready || paused ? null : watch.notReadySince ?? now;
+  const stuckMs = watch.notReadySince === null ? 0 : now - watch.notReadySince;
+  return {
+    fields: { localRegistry: { host: PERSONAL_LOCAL_REGISTRY_HOST, ready } },
+    warnings: stuckMs >= LOCAL_REGISTRY_WARN_AFTER_MS ? [
+      `The local image registry has not been ready for ${Math.floor(stuckMs / 6e4)} minutes, so shadow bakes cannot use it yet. Check its pod with \`k3s kubectl -n conveyor-system get pods -l app.kubernetes.io/name=conveyor-registry\`. If the pod is running, k3s has not loaded the registry's mirror yet: it restarts k3s for that only while no Conveyor pod runs.`
+    ] : []
+  };
+}
+var VM_CAPACITY_FILE = "/etc/conveyor-vm/capacity.json";
 async function versionOf(exec, bin, args) {
   const result = await exec(bin, args, { timeoutMs: 1e4 }).catch(() => null);
   if (!result || result.exitCode !== 0) return null;
@@ -7366,16 +8603,26 @@ async function readNodeAllocatable(exec) {
   const [cpu, memory] = result.stdout.trim().split(/\s+/);
   return { allocatableCpu: cpu ?? null, allocatableMemory: memory ?? null };
 }
-async function readDisk() {
+async function measureK3sStore(exec) {
+  const result = await exec("du", ["-sx", "-B1", K3S_CONTAINERD_DIR], {
+    timeoutMs: 6e4,
+    maxOutputBytes: 1024 * 1024
+  }).catch(() => null);
+  const match = result?.stdout.match(/^\s*(\d+)\s/);
+  if (!match?.[1]) return null;
+  const bytes = Number(match[1]);
+  return Number.isSafeInteger(bytes) ? bytes : null;
+}
+async function readDisk(k3sStoreBytes) {
   try {
     const stats = await statfs(STATE_DIR);
     return {
       totalBytes: Number(stats.blocks) * Number(stats.bsize),
       freeBytes: Number(stats.bavail) * Number(stats.bsize),
-      k3sStoreBytes: 0
+      k3sStoreBytes
     };
   } catch {
-    return { totalBytes: 0, freeBytes: 0, k3sStoreBytes: 0 };
+    return { totalBytes: 0, freeBytes: 0, k3sStoreBytes };
   }
 }
 function summarizeImages(inventory, wantedImages) {
@@ -7398,14 +8645,33 @@ function imageGcPressureWarning(disk, highThreshold) {
   if (usedPercent < highThreshold) return null;
   return `Kubelet image garbage collection is active: the disk is ${usedPercent}% full and the image-gc-high-threshold is ${highThreshold}%. Images that no container is running are removed within 5 minutes, a freshly baked one included. Free disk space, or raise image-gc-high-threshold.`;
 }
+async function readVmCapacity(ports) {
+  const text = await ports.readFile(VM_CAPACITY_FILE);
+  if (text === null) return void 0;
+  try {
+    const { schema: _schema, ...capacity } = parseCapacityLimits(JSON.parse(text));
+    return capacity;
+  } catch {
+    return void 0;
+  }
+}
 async function collectHeartbeat(ports, state, inventory) {
   const registries = parseRegistries(await ports.readFile(REGISTRIES_FILE));
-  const disk = await readDisk();
+  const disk = await readDisk(state.k3sStoreBytes ?? null);
   const gcWarning = imageGcPressureWarning(disk, state.imageGcHighThreshold);
+  const vmCapacity = await readVmCapacity(ports);
+  const localImages = await reportLocalImages(
+    ports.exec,
+    inventory,
+    state.wantedImages,
+    state.localImageHashes ?? /* @__PURE__ */ new Map()
+  );
+  const registry = await reportLocalRegistry(ports, state.localRegistry);
   const runnerUsers = await detectRunnerUsers(ports.exec);
   const ungranted = ungrantedRunnerUsers(runnerUsers, await ports.readFile(RUNNERS_SUDOERS_FILE));
   return {
     publicWebProxy: (await ports.readFile("/etc/conveyor-vm/public-web"))?.trim() === "enabled",
+    ...vmCapacity ? { vmCapacity } : {},
     cliVersion: state.cliVersion,
     k3sVersion: await versionOf(ports.exec, "k3s", ["--version"]),
     cloudflaredVersion: await versionOf(ports.exec, "cloudflared", ["--version"]),
@@ -7421,42 +8687,262 @@ async function collectHeartbeat(ports, state, inventory) {
     lastWarmAt: state.lastWarmAt,
     lastUpdateAt: state.lastUpdateAt,
     ...runnerUsers.length > 0 ? { runnerUsers } : {},
-    localWarnings: [
+    ...localImages ? { localImages } : {},
+    ...registry.fields,
+    ...state.isolation ? { isolation: state.isolation } : {},
+    localWarnings: withinHeartbeatBounds([
       ...state.localWarnings,
       ...gcWarning ? [gcWarning] : [],
-      ...ungranted.length > 0 ? [ungrantedRunnersWarning(ungranted)] : []
-    ]
+      ...ungranted.length > 0 ? [ungrantedRunnersWarning(ungranted)] : [],
+      ...registry.warnings
+    ])
+  };
+}
+var HEARTBEAT_LIST_MAX = 64;
+var HEARTBEAT_STRING_MAX = 512;
+function withinHeartbeatBounds(warnings) {
+  return warnings.slice(0, HEARTBEAT_LIST_MAX).map(
+    (warning) => warning.length > HEARTBEAT_STRING_MAX ? `${warning.slice(0, HEARTBEAT_STRING_MAX - 1)}\u2026` : warning
+  );
+}
+async function readPodIdentities(exec) {
+  const result = await exec(
+    "k3s",
+    [
+      "kubectl",
+      "get",
+      "pods",
+      "-A",
+      "-l",
+      CONVEYOR_POD_SELECTOR,
+      "--request-timeout=5s",
+      "--no-headers",
+      "-o",
+      "custom-columns=NS:.metadata.namespace,NAME:.metadata.name,UID:.metadata.uid"
+    ],
+    { timeoutMs: 7e3, maxOutputBytes: 65536 }
+  );
+  if (result.exitCode !== 0) return [];
+  const rows = result.stdout.trim().split("\n").filter(Boolean);
+  if (rows.length > 100) return [];
+  return rows.flatMap((row) => {
+    const [namespace, name, uid, extra] = row.trim().split(/\s+/);
+    return !extra && [namespace, name, uid].every((s) => s && /^[a-zA-Z0-9][a-zA-Z0-9.-]{0,252}$/.test(s)) ? [{ namespace, name, uid }] : [];
+  });
+}
+
+// src/daemon/registry-upkeep-clock.ts
+function errorText(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function collect(ports, now) {
+  const { exec, log, requestDesiredState, fetch: fetch2, sleep: sleep2, isAlive, watch } = ports;
+  if (watch) watch.pausedUntil = now.getTime() + REGISTRY_GC_MARK_TTL_MS;
+  try {
+    const outcome = await collectRegistryGarbage(
+      { exec, log, requestDesiredState, fetch: fetch2, sleep: sleep2, isAlive },
+      { dryRun: false }
+    );
+    if (outcome.skipped) return outcome.skipped;
+    log(
+      `Registry garbage collection removed ${outcome.deletions.length} superseded image manifest(s) and their unreferenced layers.`
+    );
+    return null;
+  } finally {
+    if (watch) {
+      watch.pausedUntil = null;
+      watch.notReadySince = null;
+    }
+  }
+}
+async function runRegistryUpkeep(ports, lastGcAt, maintenanceHour) {
+  const now = (ports.now ?? (() => /* @__PURE__ */ new Date()))();
+  try {
+    await deployLocalRegistry({
+      exec: ports.exec,
+      fs: ports.fs,
+      runningConveyorPods: null,
+      now: ports.now,
+      isAlive: ports.isAlive
+    });
+    if (await registryMirrorPending(ports.fs) && mayDisrupt(await countRunningConveyorPods(ports.exec))) {
+      await ports.reconcile();
+    }
+    if (!await registryGcDue(ports.exec, lastGcAt, maintenanceHour, now)) return lastGcAt;
+  } catch (error) {
+    ports.log(`Local image registry upkeep failed: ${errorText(error)}`);
+    return lastGcAt;
+  }
+  try {
+    const skipped = await collect(ports, now);
+    if (skipped) {
+      ports.log(`Registry garbage collection skipped: ${skipped}.`);
+      return lastGcAt;
+    }
+  } catch (error) {
+    ports.log(`Registry garbage collection failed: ${errorText(error)}`);
+  }
+  return now.toISOString();
+}
+
+// src/daemon/reconcile.ts
+function ownerRestartWarning(change) {
+  return `${change} Conveyor did not install this server's k3s, so it never restarts it: run \`sudo systemctl restart k3s\` when no build runs.`;
+}
+async function reconcileKubelet(ctx, desired, result, managed) {
+  const ownerConfig = await ctx.fs.readFile(K3S_OWNER_CONFIG);
+  const rendered = renderK3sDropIn(desired.kubelet, ownerConfig, { disableComponents: managed });
+  result.skippedKubeletFlags = rendered.skipped;
+  result.effectiveImageGcHighThreshold = rendered.skipped.includes("image-gc-high-threshold") ? ownerImageGcHighThreshold(ownerConfig) : desired.kubelet.imageGcHighThreshold;
+  for (const flag of rendered.skipped) {
+    result.warnings.push(
+      `Left \`${flag}\` to your own /etc/rancher/k3s/config.yaml \u2014 Conveyor does not override a setting you chose.`
+    );
+  }
+  const current = await ctx.fs.readFile(K3S_CONFIG_DROPIN);
+  if (rendered.content === null) {
+    if (current !== null) await ctx.fs.removeFile(K3S_CONFIG_DROPIN);
+    return;
+  }
+  if (current === rendered.content) return;
+  await ctx.fs.ensureDir(K3S_CONFIG_DROPIN.slice(0, K3S_CONFIG_DROPIN.lastIndexOf("/")));
+  await ctx.fs.writeFile(K3S_CONFIG_DROPIN, rendered.content, 420);
+  if (!managed) {
+    result.warnings.push(ownerRestartWarning("Kubelet settings changed."));
+    return;
+  }
+  if (!mayDisrupt(ctx.runningConveyorPods)) {
+    result.warnings.push(
+      `Kubelet settings changed but ${busyReason(ctx.runningConveyorPods)} \u2014 the restart is deferred until the machine is idle.`
+    );
+    return;
+  }
+  const restart = await ctx.exec("systemctl", ["restart", "k3s"], { timeoutMs: 12e4 });
+  if (restart.exitCode === 0) {
+    result.restartedK3s = true;
+  } else {
+    result.warnings.push(
+      `Could not restart k3s to apply new kubelet settings: ${restart.stderr.trim().slice(0, 200)}`
+    );
+  }
+}
+async function reconcilePriorityClass(ctx, desired, result) {
+  const name = assertK8sName(desired.priorityClass.name, "priorityClass.name");
+  const read = await ctx.exec("k3s", [
+    "kubectl",
+    "get",
+    "priorityclass",
+    name,
+    "-o",
+    "jsonpath={.value}"
+  ]);
+  if (read.exitCode !== 0) return;
+  const existingValue = Number.parseInt(read.stdout.trim(), 10);
+  if (existingValue === desired.priorityClass.value) return;
+  if (!mayDisrupt(ctx.runningConveyorPods)) {
+    result.warnings.push(
+      `The \`${name}\` PriorityClass has value ${existingValue}, but Conveyor needs ${desired.priorityClass.value}. The value is immutable, so it must be recreated \u2014 deferred because ${busyReason(ctx.runningConveyorPods)}.`
+    );
+    return;
+  }
+  const removed = await ctx.exec("k3s", ["kubectl", "delete", "priorityclass", name]);
+  if (removed.exitCode !== 0) {
+    result.warnings.push(
+      `Could not replace the \`${name}\` PriorityClass (value ${existingValue}, needs ${desired.priorityClass.value}): ${removed.stderr.trim().slice(0, 160)}`
+    );
+    return;
+  }
+  try {
+    await kubectlApply(ctx.exec, desired.rbacManifest);
+    result.recreatedPriorityClass = true;
+  } catch (error) {
+    result.warnings.push(
+      `The \`${name}\` PriorityClass was removed to change its value but could not be recreated: ${error instanceof Error ? error.message : String(error)}. No build can start on this machine until it exists \u2014 run \`conveyor-k3 sync\`.`
+    );
+  }
+}
+async function step(result, label, run) {
+  try {
+    await run();
+  } catch (error) {
+    result.warnings.push(`${label}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function reconcile(ctx, desired) {
+  const result = {
+    appliedVersion: desired.version,
+    warnings: [],
+    restartedK3s: false,
+    skippedKubeletFlags: [],
+    effectiveImageGcHighThreshold: null,
+    recreatedPriorityClass: false,
+    prunedNamespaces: []
   };
-}
-async function readPodIdentities(exec) {
-  const result = await exec(
-    "k3s",
-    [
-      "kubectl",
-      "get",
-      "pods",
-      "-A",
-      "-l",
-      CONVEYOR_POD_SELECTOR,
-      "--request-timeout=5s",
-      "--no-headers",
-      "-o",
-      "custom-columns=NS:.metadata.namespace,NAME:.metadata.name,UID:.metadata.uid"
-    ],
-    { timeoutMs: 7e3, maxOutputBytes: 65536 }
+  const disallowedKinds = findDisallowedKinds(desired.rbacManifest);
+  const manifestAccepted = disallowedKinds.length === 0;
+  if (disallowedKinds.length > 0) {
+    result.warnings.push(
+      `Conveyor sent a cluster manifest containing disallowed kind(s) ${disallowedKinds.join(", ")} \u2014 refused. RBAC and PriorityClass steps skipped; this should never happen, report it.`
+    );
+  } else {
+    await step(result, "Could not apply RBAC", () => kubectlApply(ctx.exec, desired.rbacManifest));
+    await step(
+      result,
+      "Could not reconcile the PriorityClass",
+      () => reconcilePriorityClass(ctx, desired, result)
+    );
+  }
+  await step(
+    result,
+    "Could not apply namespace defaults",
+    () => reconcileNamespaces(ctx, desired, result)
   );
-  if (result.exitCode !== 0) return [];
-  const rows = result.stdout.trim().split("\n").filter(Boolean);
-  if (rows.length > 100) return [];
-  return rows.flatMap((row) => {
-    const [namespace, name, uid, extra] = row.trim().split(/\s+/);
-    return !extra && [namespace, name, uid].every((s) => s && /^[a-zA-Z0-9][a-zA-Z0-9.-]{0,252}$/.test(s)) ? [{ namespace, name, uid }] : [];
-  });
+  await step(
+    result,
+    "Could not apply pod isolation",
+    () => reconcileIsolation(ctx, desired, result)
+  );
+  if (desired.isolation && result.isolation === void 0) result.isolation = { applied: false };
+  if (manifestAccepted) {
+    await step(
+      result,
+      "Could not remove unused namespaces",
+      () => pruneStaleNamespaces(ctx, desired, result)
+    );
+  }
+  const registry = desired.localRegistry?.enabled === true;
+  const managed = managesK3s(desired, await readState(ctx.fs).catch(() => ({})));
+  if (registry) {
+    await step(result, "Could not reconcile the local image registry", async () => {
+      await deployLocalRegistry(ctx);
+    });
+  }
+  await step(
+    result,
+    "Could not apply kubelet settings",
+    () => reconcileKubelet(ctx, desired, result, managed)
+  );
+  if (registry && !result.restartedK3s) {
+    await step(result, "Could not load the local image registry mirror", async () => {
+      if (!managed) {
+        if (await registryMirrorPending(ctx.fs))
+          result.warnings.push(ownerRestartWarning("The local image registry's mirror is new."));
+        return;
+      }
+      const loaded = await loadRegistryMirror(ctx);
+      result.restartedK3s = loaded.restarted;
+      if (loaded.warning) result.warnings.push(loaded.warning);
+    });
+  }
+  return result;
 }
 
 // src/daemon/runner.ts
-var HOUR_MS = 60 * 6e4;
-var DAY_MS = 24 * HOUR_MS;
+var HOUR_MS2 = 60 * 6e4;
+var DAY_MS = 24 * HOUR_MS2;
+var STORE_MEASURE_INTERVAL_MS = 55 * 6e4;
+var ISOLATION_RETRY_FIRST_MS = 6e4;
+var ISOLATION_RETRY_MAX_MS = 10 * 6e4;
 var DISK_PRESSURE_FREE_FRACTION = 0.2;
 var STRANDED_PRUNE_BYTES = 20 * 1024 ** 3;
 function flattenWanted(desired) {
@@ -7493,10 +8979,26 @@ var ClusterDaemon = class {
    * the next reconcile silently clear them.
    */
   warmWarnings = [];
+  /** Content hash labels by image id, so each image is inspected once. */
+  localImageHashes = /* @__PURE__ */ new Map();
+  /** How long the in-cluster registry has been not ready, across beats. */
+  registryWatch = { notReadySince: null };
+  /**
+   * Whether pod isolation is in force, from the last reconcile; undefined
+   * while desired state does not ask for it. Every heartbeat checks it again
+   * against k3s's own settings before reporting it.
+   */
+  isolation = void 0;
   timers = [];
+  /** When the last store walk started, so one that failed is not retried on every reconcile. */
+  storeWalkStartedAt = 0;
   /** Serializes reconcile against itself — a sync nudge during a reconcile
    *  must queue, not interleave two kubectl applies of the same manifests. */
   reconciling = null;
+  /** The run queued behind the running one, until it starts. At most one waits. */
+  queuedRun = null;
+  /** The next reconcile while pod isolation is not applied; `dueAt` 0 = none. */
+  isolationRetry = { delayMs: ISOLATION_RETRY_FIRST_MS, dueAt: 0 };
   constructor(ports) {
     this.ports = ports;
   }
@@ -7513,7 +9015,7 @@ var ClusterDaemon = class {
       }, PERSONAL_CLUSTER_HEARTBEAT_INTERVAL_MS),
       setInterval(() => {
         void this.warmAndPruneIfDue();
-      }, HOUR_MS),
+      }, HOUR_MS2),
       setInterval(() => {
         void this.syncAndReconcile();
       }, DAY_MS)
@@ -7532,10 +9034,27 @@ var ClusterDaemon = class {
   }
   /** Fetch the desired state and converge to it. Queued, never concurrent. */
   syncAndReconcile() {
-    const run = (this.reconciling ?? Promise.resolve()).then(() => this.runReconcile());
+    if (this.queuedRun) return this.queuedRun;
+    const run = (this.reconciling ?? Promise.resolve()).then(() => {
+      this.queuedRun = null;
+      return this.runReconcile();
+    });
+    this.queuedRun = run;
     this.reconciling = run.catch(() => void 0);
     return run;
   }
+  /** Reconcile again later while pod isolation is not applied; stop once it is. */
+  scheduleIsolationRetry() {
+    if (this.isolation?.applied !== false) {
+      this.isolationRetry = { delayMs: ISOLATION_RETRY_FIRST_MS, dueAt: 0 };
+      return;
+    }
+    const { delayMs } = this.isolationRetry;
+    this.isolationRetry = {
+      delayMs: Math.min(delayMs * 2, ISOLATION_RETRY_MAX_MS),
+      dueAt: Date.now() + delayMs
+    };
+  }
   async runReconcile() {
     try {
       this.desired = await this.ports.connection.requestDesiredState();
@@ -7551,13 +9070,21 @@ var ClusterDaemon = class {
       this.desired
     );
     this.warnings = result.warnings;
+    this.isolation = result.isolation;
+    this.scheduleIsolationRetry();
     for (const warning of result.warnings) this.ports.log(warning);
+    if (result.prunedNamespaces.length > 0) {
+      this.ports.log(
+        `Removed ${result.prunedNamespaces.length} empty namespace(s) of projects this machine no longer serves: ${result.prunedNamespaces.join(", ")}.`
+      );
+    }
     this.effectiveImageGcHigh = result.effectiveImageGcHighThreshold;
     const state = this.state ?? await readState(this.ports.fs);
     this.state = { ...state, appliedDesiredStateVersion: result.appliedVersion };
     await writeState(this.ports.fs, this.state);
     await this.warm();
     await this.pruneIfDue();
+    await this.measureStoreIfDue();
   }
   /**
    * The hourly clock: warm, re-pin, and reclaim if the pile justifies it.
@@ -7570,6 +9097,45 @@ var ClusterDaemon = class {
   async warmAndPruneIfDue() {
     await this.warm();
     await this.pruneIfDue();
+    await this.measureStoreIfDue();
+    if (this.desired?.localRegistry?.enabled !== true) return;
+    const lastRegistryGcAt = await runRegistryUpkeep(
+      {
+        exec: this.ports.exec,
+        fs: this.ports.fs,
+        log: this.ports.log,
+        requestDesiredState: () => this.ports.connection.requestDesiredState(),
+        reconcile: () => this.syncAndReconcile(),
+        watch: this.registryWatch,
+        fetch: this.ports.fetch
+      },
+      this.state?.lastRegistryGcAt ?? null,
+      this.desired.maintenance.hour
+    );
+    if (lastRegistryGcAt === (this.state?.lastRegistryGcAt ?? null)) return;
+    const state = this.state ?? await readState(this.ports.fs);
+    this.state = { ...state, lastRegistryGcAt };
+    await writeState(this.ports.fs, this.state);
+  }
+  /**
+   * Measure k3s's containerd store when the last measurement is old enough,
+   * and keep the result for the heartbeat. After a prune, so the number it
+   * reports is what the prune left. A failed measurement keeps the last one.
+   */
+  async measureStoreIfDue() {
+    const measured = this.state?.k3sStoreMeasuredAt ? Date.parse(this.state.k3sStoreMeasuredAt) : 0;
+    const last = Math.max(measured, this.storeWalkStartedAt);
+    if (Date.now() - last < STORE_MEASURE_INTERVAL_MS) return;
+    this.storeWalkStartedAt = Date.now();
+    const bytes = await measureK3sStore(this.ports.exec);
+    if (bytes === null) return;
+    const state = this.state ?? await readState(this.ports.fs);
+    this.state = { ...state, k3sStoreBytes: bytes, k3sStoreMeasuredAt: (/* @__PURE__ */ new Date()).toISOString() };
+    await writeState(this.ports.fs, this.state);
+  }
+  /** The store size the heartbeat reports: the last measurement, null before one. */
+  get measuredStoreBytes() {
+    return this.state?.k3sStoreBytes ?? null;
   }
   /** Pre-pull the wanted refs. Silent on success; that is the normal case. */
   async warm() {
@@ -7674,8 +9240,18 @@ var ClusterDaemon = class {
   async buildHeartbeat() {
     const { wantedImages, authRequiredHosts } = this.desired ? flattenWanted(this.desired) : { wantedImages: [], authRequiredHosts: [] };
     const inventory = await readImageInventory(this.ports.exec).catch(() => null);
+    const registryOn = this.desired?.localRegistry?.enabled === true;
+    if (!registryOn) this.registryWatch.notReadySince = null;
+    const isolation = await recheckIsolation(
+      { exec: this.ports.exec, fs: this.ports.fs },
+      this.isolation
+    );
     return await collectHeartbeat(
-      { exec: this.ports.exec, readFile: (path) => this.ports.fs.readFile(path) },
+      {
+        exec: this.ports.exec,
+        readFile: (path) => this.ports.fs.readFile(path),
+        fetch: this.ports.fetch
+      },
       {
         cliVersion: this.ports.cliVersion,
         appliedDesiredStateVersion: this.state?.appliedDesiredStateVersion ?? 0,
@@ -7684,8 +9260,12 @@ var ClusterDaemon = class {
         lastPruneAt: this.state?.lastPruneAt ?? null,
         lastWarmAt: this.state?.lastWarmAt ?? null,
         lastUpdateAt: this.state?.lastUpdateAt ?? null,
-        localWarnings: [...this.warnings, ...this.warmWarnings],
-        imageGcHighThreshold: this.effectiveImageGcHigh
+        localWarnings: [...this.warnings, ...this.warmWarnings, ...isolation.warnings],
+        imageGcHighThreshold: this.effectiveImageGcHigh,
+        localImageHashes: this.localImageHashes,
+        ...registryOn ? { localRegistry: this.registryWatch } : {},
+        ...isolation.isolation ? { isolation: isolation.isolation } : {},
+        k3sStoreBytes: this.measuredStoreBytes
       },
       inventory
     );
@@ -7709,6 +9289,10 @@ var ClusterDaemon = class {
     return this.beating;
   }
   async runBeat() {
+    if (this.isolationRetry.dueAt > 0 && Date.now() >= this.isolationRetry.dueAt) {
+      this.isolationRetry.dueAt = 0;
+      void this.syncAndReconcile();
+    }
     try {
       const workloads = await this.ports.connection.sendHeartbeat({
         ...await this.buildHeartbeat(),
@@ -7833,8 +9417,9 @@ var nodeFileSystem = {
   async removeFile(path) {
     await rm(path, { force: true });
   },
-  async ensureDir(path) {
+  async ensureDir(path, mode) {
     await mkdir(path, { recursive: true });
+    if (mode !== void 0) await chmod(path, mode);
   }
 };
 function createMemoryFileSystem(seed = {}) {
@@ -7856,13 +9441,17 @@ function createMemoryFileSystem(seed = {}) {
       removed.push(path);
       return Promise.resolve();
     },
-    ensureDir: () => Promise.resolve()
+    ensureDir: (path, mode) => {
+      if (mode !== void 0) modes.set(path, mode);
+      return Promise.resolve();
+    }
   };
 }
 
 // src/verbs.ts
 var VERBS = [
   "vm",
+  "host",
   "setup",
   "start",
   "stop",
@@ -7895,14 +9484,22 @@ function parseArgs(argv) {
   }
   return { verb, positional, flags };
 }
-var HELP = `conveyor-k3 \u2014 managed personal compute for Conveyor
+var HELP = `conveyor-k3 \u2014 Personal Compute for Conveyor
 
 Usage: conveyor-k3 <command> [options]
 
-Commands:
-  vm                    Manage isolated compute on macOS or Linux.
-                        Run conveyor-k3 vm for host lifecycle commands.
-  setup                 Install and enrol this machine. Safe to re-run.
+One product, two runtimes. Pick the one that fits the machine:
+
+On your computer or server:
+  vm                    Personal computer runtime: an isolated VM on macOS or
+                        Linux. Run conveyor-k3 vm for its commands.
+  host                  Dedicated server runtime: k3s and the daemon on this
+                        Linux machine, with no VM. Root only. Run
+                        conveyor-k3 host for its commands.
+
+Inside a linked machine (the VM guest, or the server itself):
+  setup                 VM guest only: install and enrol this machine. Safe
+                        to re-run. On a server, use conveyor-k3 host setup.
   start                 Start the tunnel and the daemon.
   stop                  Stop both, and tell Conveyor at once so your next
                         build goes straight to project compute.
@@ -7917,16 +9514,24 @@ Commands:
                           --username <user>
                           --password-stdin      read the password from stdin
                           --no-restart          skip the required k3s restart
+  registry gc           Delete superseded shadow-bake images from the image
+                        registry inside this cluster. Runs daily on its own,
+                        and only while no Conveyor pod or bake is running.
+                          --dry-run             list what it would delete
   runners list          Which GitHub Actions runners this machine hosts, and
                         whether each may import a locally baked image.
   runners grant <user>\u2026 Let those runner users import a locally baked image
                         into this node and pin it. Writes one file under
                         /etc/sudoers.d, checked with visudo first. Needed only
                         when a project has Bake Locally turned on.
-  uninstall             Remove Conveyor's units, environment, and state. Your
-                        k3s config, registries.yaml, and workloads are left
-                        alone.
-                          --purge-k3s --yes     also remove k3s itself
+  uninstall             VM guest only: remove Conveyor's units, environment,
+                        state, and image registry. Your k3s config, your own
+                        registries.yaml entries, your workloads, and the
+                        registry's data are left alone. On a server, use
+                        conveyor-k3 host uninstall: it also removes the
+                        device key.
+                          --purge-k3s --yes     also remove k3s itself and the
+                                                registry's data
   daemon                Run in the foreground (what the systemd unit calls).
 
 Options:
@@ -7945,17 +9550,12 @@ async function registryAdd(ports, options) {
     );
   }
   const raw = await ports.fs.readFile(REGISTRIES_FILE);
-  const parsed = parseRegistries(raw);
-  let backupPath = null;
-  if (raw !== null) {
-    backupPath = `${REGISTRIES_FILE}.bak-${ports.now().toISOString().replace(/[:.]/g, "-")}`;
-    await ports.fs.writeFile(backupPath, raw, 384);
-  }
   const auth = { username: options.username, password: options.password };
-  await ports.fs.writeFile(
-    REGISTRIES_FILE,
-    serializeRegistries(upsertRegistryAuth(parsed, host, auth)),
-    384
+  const backupPath = await writeRegistriesWithBackup(
+    ports.fs,
+    raw,
+    upsertRegistryAuth(parseRegistries(raw), host, auth),
+    ports.now()
   );
   if (options.noRestart) {
     ports.log(`Added credentials for ${host}. Restart k3s to pick them up: systemctl restart k3s`);
@@ -7994,24 +9594,115 @@ function renderRegistryAuthSummary(missing) {
 }
 
 // src/commands/uninstall.ts
+async function removeLocalRegistry(ports) {
+  const removed = await ports.exec(
+    "k3s",
+    [
+      "kubectl",
+      "-n",
+      PERSONAL_LOCAL_REGISTRY_NAMESPACE,
+      "delete",
+      "deployment,service,networkpolicy",
+      PERSONAL_LOCAL_REGISTRY_NAME,
+      "--ignore-not-found"
+    ],
+    { timeoutMs: 12e4 }
+  );
+  if (removed.exitCode !== 0) {
+    ports.log(
+      `Could not remove the local image registry from the cluster: ${removed.stderr.trim().slice(0, 200)}`
+    );
+  }
+  const raw = await ports.fs.readFile(REGISTRIES_FILE);
+  const parsed = parseRegistries(raw);
+  if (mirrorEndpoints(parsed, PERSONAL_LOCAL_REGISTRY_HOST).length === 0) return;
+  const backup = await writeRegistriesWithBackup(
+    ports.fs,
+    raw,
+    removeRegistryMirror(parsed, PERSONAL_LOCAL_REGISTRY_HOST),
+    (ports.now ?? (() => /* @__PURE__ */ new Date()))()
+  );
+  ports.log(
+    `Removed the local image registry's mirror from ${REGISTRIES_FILE} (backup: ${backup}).`
+  );
+}
+async function removeIsolation(ports) {
+  const [key, value] = Object.entries(MANAGED_BY2)[0] ?? [];
+  const removed = await ports.exec(
+    "k3s",
+    ["kubectl", "delete", "networkpolicy", "-A", "-l", `${key}=${value}`, "--ignore-not-found"],
+    { timeoutMs: 12e4 }
+  );
+  if (removed.exitCode !== 0) {
+    ports.log(
+      `Could not remove Conveyor's network policies: ${removed.stderr.trim().slice(0, 200)}`
+    );
+  }
+  const listed = await ports.exec("k3s", [
+    "kubectl",
+    "get",
+    "namespaces",
+    "-o",
+    "jsonpath={.items[*].metadata.name}"
+  ]);
+  if (listed.exitCode !== 0) {
+    ports.log(
+      `Could not list namespaces to remove Conveyor's Pod Security labels: ${listed.stderr.trim().slice(0, 200)}`
+    );
+    return;
+  }
+  const namespaces = listed.stdout.split(/\s+/).filter((name) => name.startsWith("claudespace-") || name === PERSONAL_BAKE_NAMESPACE);
+  for (const namespace of namespaces) {
+    const unlabelled = await ports.exec("k3s", [
+      "kubectl",
+      "label",
+      "namespace",
+      namespace,
+      ...PSA_LABEL_KEYS.map((labelKey) => `${labelKey}-`)
+    ]);
+    if (unlabelled.exitCode !== 0) {
+      ports.log(
+        `Could not remove Conveyor's Pod Security labels from ${namespace}: ${unlabelled.stderr.trim().slice(0, 200)}`
+      );
+    }
+  }
+}
 async function uninstall(ports, options = {}) {
   const result = { stoppedUnits: [], removedFiles: [], purgedK3s: false };
+  if (options.purgeK3s && !options.confirmed) {
+    throw new Error(
+      "--purge-k3s removes k3s, everything running on it, and the local image registry's data. Re-run with --yes if that is what you want."
+    );
+  }
   for (const unit of ALL_UNITS) {
     await ports.exec("systemctl", ["disable", "--now", unit]);
     result.stoppedUnits.push(unit);
   }
+  await removeLocalRegistry(ports);
+  await removeIsolation(ports);
   for (const path of OWNED_FILES) {
     await ports.fs.removeFile(path);
     result.removedFiles.push(path);
   }
-  await ports.exec("rm", ["-rf", STATE_DIR]);
+  await ports.exec("find", [
+    STATE_DIR,
+    "-mindepth",
+    "1",
+    "-maxdepth",
+    "1",
+    "!",
+    "-path",
+    LOCAL_REGISTRY_DATA_DIR,
+    "-exec",
+    "rm",
+    "-rf",
+    "--",
+    "{}",
+    "+"
+  ]);
   await ports.exec("systemctl", ["daemon-reload"]);
+  await ports.exec("systemctl", ["restart", "systemd-journald"]).catch(() => void 0);
   if (options.purgeK3s) {
-    if (!options.confirmed) {
-      throw new Error(
-        "--purge-k3s removes k3s and everything running on it. Re-run with --yes if that is what you want."
-      );
-    }
     const purge = await ports.exec("/usr/local/bin/k3s-uninstall.sh", [], {
       timeoutMs: 10 * 6e4
     });
@@ -8021,10 +9712,18 @@ async function uninstall(ports, options = {}) {
         "k3s-uninstall.sh did not complete. k3s is still installed; remove it by hand if you want it gone."
       );
     }
+    await ports.exec("rm", ["-rf", STATE_DIR]);
   }
-  ports.log("Removed Conveyor's units, environment files, and state.");
-  ports.log("Your k3s config, registries.yaml, and workloads were not touched.");
+  ports.log("Removed Conveyor's units, environment files, state, and local image registry.");
+  ports.log(
+    "Your k3s config, your own registries.yaml entries, and your workloads were not touched."
+  );
   if (options.purgeK3s && result.purgedK3s) ports.log("k3s was removed.");
+  if (!options.purgeK3s) {
+    ports.log(
+      `The local image registry's data is still at ${LOCAL_REGISTRY_DATA_DIR}. Delete that directory to reclaim its disk space.`
+    );
+  }
   if (!options.serverInitiated) {
     ports.log(
       "Now click Disconnect in your Conveyor profile so the tunnel and DNS record are removed too."
@@ -8036,23 +9735,17 @@ async function uninstall(ports, options = {}) {
 // src/commands/update.ts
 var CLOUDFLARED_UPDATED_EXIT = 11;
 function readExecStart(unit) {
-  const lines = unit.split("\n");
-  const start = lines.findIndex((line) => line.trimStart().startsWith("ExecStart="));
+  const lines2 = unit.split("\n");
+  const start = lines2.findIndex((line) => line.trimStart().startsWith("ExecStart="));
   if (start < 0) return "";
   const collected = [];
-  for (let index = start; index < lines.length; index += 1) {
-    const line = lines[index] ?? "";
+  for (let index = start; index < lines2.length; index += 1) {
+    const line = lines2[index] ?? "";
     collected.push(line);
     if (!line.trimEnd().endsWith("\\")) break;
   }
   return collected.join(" ");
 }
-function bareToken(token) {
-  let bare = token.trim();
-  if (bare.endsWith("\\")) bare = bare.slice(0, -1).trim();
-  if (bare.length >= 2 && bare.startsWith("'") && bare.endsWith("'")) bare = bare.slice(1, -1);
-  return bare;
-}
 function parseForeignExecFlags(execStart) {
   const ours = new Set(K3S_INSTALL_EXEC.split(/\s+/).filter((token) => token.startsWith("--")));
   const foreign = [];
@@ -8072,6 +9765,12 @@ async function foreignK3sExecFlags(exec) {
   return parseForeignExecFlags(readExecStart(unit.stdout));
 }
 function decideK3sUpgrade(input) {
+  if (input.managesK3s === false) {
+    return {
+      upgrade: false,
+      reason: "Conveyor did not install this server's k3s, so its owner upgrades it"
+    };
+  }
   if (!input.autoUpgradeK3s) {
     return { upgrade: false, reason: "automatic k3s upgrades are turned off for this machine" };
   }
@@ -8183,12 +9882,75 @@ function meetsK3sMinimum(version) {
 // src/vm/network.ts
 import { networkInterfaces } from "os";
 import { resolve4 as systemResolve4, resolveSrv as systemResolveSrv } from "dns/promises";
+
+// src/vm/endpoints.ts
+var CONTROL_PLANE_HOSTS = ["api.conveyor.rallycryapp.com", "conveyor-api.rallycryapp.com"];
+var DEFAULT_ENDPOINTS = [
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "registry.npmjs.org",
+  // Font Awesome Pro tarballs through Conveyor's Artifact Registry cache.
+  "us-central1-npm.pkg.dev",
+  // Tiptap Pro packages, which every claudespace bake installs.
+  "registry.tiptap.dev",
+  // The Python venv a pod builds at runtime.
+  "pypi.org",
+  "files.pythonhosted.org",
+  "bun.sh",
+  "get.k3s.io",
+  "update.k3s.io",
+  "github.com",
+  "api.github.com",
+  "raw.githubusercontent.com",
+  "release-assets.githubusercontent.com",
+  "objects.githubusercontent.com",
+  "ghcr.io",
+  "pkg-containers.githubusercontent.com",
+  // The crane image that shadow bakes' state-bake and publish Jobs run. gcr.io
+  // serves its blobs from the same host (/artifacts-downloads), on Google's
+  // shared frontend addresses like us-central1-npm.pkg.dev.
+  "gcr.io",
+  // The first shadow bake on a VM builds the toolchain base inside it; base
+  // reuse never crosses machines. These are the hosts that build downloads
+  // from. Several sit on shared CDN addresses.
+  // Plain HTTP too: the first apt-get runs before ca-certificates exists.
+  "deb.debian.org",
+  "www.postgresql.org",
+  "apt.postgresql.org",
+  "cli.github.com",
+  "johnvansickle.com",
+  "astral.sh",
+  // uv downloads CPython from here.
+  "releases.astral.sh",
+  "opencode.ai",
+  "cdn.playwright.dev",
+  "playwright.download.prss.microsoft.com",
+  "registry-1.docker.io",
+  "auth.docker.io",
+  "production.cloudflare.docker.com",
+  "production.cloudfront.docker.com",
+  "api.cloudflare.com",
+  "conveyor.rallycryapp.com",
+  "conveyor-api.rallycryapp.com",
+  "api.conveyor.rallycryapp.com",
+  "api.anthropic.com",
+  "api.openai.com",
+  "chatgpt.com"
+].map((host) => ({
+  host,
+  ports: host.endsWith(".ubuntu.com") || host === "deb.debian.org" ? [80, 443] : [443]
+}));
+
+// src/vm/network.ts
 var WORKER_SUBNET = "192.168.5.0/24";
 var WORKER_IP = "192.168.5.15";
 var MAX_NETWORK_ENDPOINTS = 100;
 var MAX_PORTS_PER_ENDPOINT = 16;
 var MAX_NETWORK_FORWARDS = 100;
 var MAX_CLOUDFLARE_EDGE_ADDRESSES = 4;
+var MAX_CONTROL_ALIASES = 8;
+var ARGOTUNNEL = /^(?:us-)?region[12]\.v2\.argotunnel\.com$/;
 var DOMAIN = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i;
 function parseIPv4(address) {
   const parts = address.split(".");
@@ -8255,6 +10017,36 @@ function validatePorts(ports, host) {
 function syntheticIp(index) {
   return `192.168.5.${100 + index}`;
 }
+function pinAddresses(name, answers, localAddresses) {
+  if (!Array.isArray(answers) || answers.length === 0) {
+    throw new Error(`No IPv4 address resolved for ${name}`);
+  }
+  const uniqueAnswers = [...new Set(answers)];
+  const unsafe = uniqueAnswers.find(
+    (address) => !isGloballyRoutableIPv4(address) || localAddresses.has(address)
+  );
+  if (unsafe) {
+    throw new Error(`Refusing unsafe IPv4 answer for ${name}: ${unsafe}`);
+  }
+  return ARGOTUNNEL.test(name) ? uniqueAnswers.slice(0, MAX_CLOUDFLARE_EDGE_ADDRESSES) : uniqueAnswers.slice(0, 1);
+}
+function forwardCount(entries) {
+  return entries.reduce((sum, entry) => sum + entry.ports.length, 0);
+}
+function controlAliases(hosts) {
+  return CONTROL_PLANE_HOSTS.slice(0, MAX_CONTROL_ALIASES).flatMap((name, index) => {
+    const host = hosts.find((entry) => entry.name === name && entry.ports.includes(443));
+    return host ? [
+      {
+        name,
+        guestIp: `192.168.5.${240 + index}`,
+        address: host.address,
+        ports: [443],
+        reserve: "control"
+      }
+    ] : [];
+  });
+}
 async function resolveNetwork(endpoints, lookup = systemResolve4) {
   if (!Array.isArray(endpoints) || endpoints.length > MAX_NETWORK_ENDPOINTS) {
     throw new Error(`Too many network endpoints (maximum ${MAX_NETWORK_ENDPOINTS})`);
@@ -8278,28 +10070,27 @@ async function resolveNetwork(endpoints, lookup = systemResolve4) {
   const localAddresses = localIPv4Addresses();
   const hosts = [];
   for (const [name, ports] of merged) {
-    const answers = await lookup(name);
-    if (!Array.isArray(answers) || answers.length === 0) {
-      throw new Error(`No IPv4 address resolved for ${name}`);
-    }
-    const uniqueAnswers = [...new Set(answers)];
-    const unsafe = uniqueAnswers.find(
-      (address) => !isGloballyRoutableIPv4(address) || localAddresses.has(address)
-    );
-    if (unsafe) {
-      throw new Error(`Refusing unsafe IPv4 answer for ${name}: ${unsafe}`);
-    }
-    const addresses = /^(?:us-)?region[12]\.v2\.argotunnel\.com$/.test(name) ? uniqueAnswers.slice(0, MAX_CLOUDFLARE_EDGE_ADDRESSES) : uniqueAnswers.slice(0, 1);
-    for (const address of addresses) {
-      hosts.push({ name, guestIp: syntheticIp(hosts.length), address, ports });
+    const tunnel = ARGOTUNNEL.test(name);
+    for (const address of pinAddresses(name, await lookup(name), localAddresses)) {
+      hosts.push({
+        name,
+        guestIp: syntheticIp(hosts.length),
+        address,
+        ports,
+        ...tunnel ? { reserve: "control" } : {}
+      });
     }
   }
-  return { hosts, srv: cloudflaredSrvRecords(hosts) };
+  const control = controlAliases(hosts);
+  if (forwardCount(hosts) + forwardCount(control) > MAX_NETWORK_FORWARDS) {
+    throw new Error(`Too many network forwarding rules (maximum ${MAX_NETWORK_FORWARDS})`);
+  }
+  return { hosts, srv: cloudflaredSrvRecords(hosts), ...control.length > 0 ? { control } : {} };
 }
 function cloudflaredSrvRecords(hosts) {
   const targets = [
     ...new Map(
-      hosts.filter((host) => /^(?:us-)?region[12]\.v2\.argotunnel\.com$/.test(host.name)).map((host) => [host.name, host])
+      hosts.filter((host) => ARGOTUNNEL.test(host.name)).map((host) => [host.name, host])
     ).values()
   ];
   if (targets.length === 0) return [];
@@ -8508,6 +10299,28 @@ while True:
                 udp.sendto(response, peer)
 `;
 
+// src/vm/instance-name.ts
+var VM_NAME = "conveyor";
+var DEFAULT_INSTANCE = "default";
+var NAMED_INSTANCE = /^(?=.{1,12}$)[a-z](?:-?[a-z0-9])*$/;
+function isNamedInstance(value) {
+  return typeof value === "string" && NAMED_INSTANCE.test(value) && value !== DEFAULT_INSTANCE && value !== VM_NAME;
+}
+function parseInstanceName(value) {
+  if (value === void 0 || value === DEFAULT_INSTANCE) return DEFAULT_INSTANCE;
+  if (value === true) throw new Error("Use --instance=<name>.");
+  if (value === VM_NAME)
+    throw new Error(`"${VM_NAME}" is reserved for the default VM. Omit --instance to use it.`);
+  if (!isNamedInstance(value))
+    throw new Error(
+      "Use an instance name of 1-12 lowercase letters, digits, or single hyphens, starting with a letter."
+    );
+  return value;
+}
+function vmNameFor(instance) {
+  return instance === DEFAULT_INSTANCE ? VM_NAME : instance;
+}
+
 // src/vm/public-web.ts
 import { resolve4 } from "dns/promises";
 import { networkInterfaces as networkInterfaces2 } from "os";
@@ -8515,6 +10328,65 @@ var PUBLIC_WEB_IP = "192.168.5.250";
 var PUBLIC_WEB_PORT = 3128;
 var PUBLIC_WEB_URL = `http://${PUBLIC_WEB_IP}:${PUBLIC_WEB_PORT}`;
 
+// src/vm/qemu-forwards.ts
+var ENDPOINT_IP = /^192\.168\.5\.(?:1\d\d)$/;
+var CONTROL_ALIAS_IP2 = /^192\.168\.5\.24[0-7]$/;
+var PINNED_IPV4 = /^(?:[1-9]?\d|1\d\d|2[0-4]\d|25[0-5])(?:\.(?:[1-9]?\d|1\d\d|2[0-4]\d|25[0-5])){3}$/;
+function assertPort(port) {
+  if (!Number.isInteger(port) || port < 1 || port > 65535)
+    throw new Error("Invalid guest forwarding port");
+}
+function validateForwards(forwards) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const forward of forwards) {
+    assertPort(forward.port);
+    const key = `${forward.guestIp}:${forward.port}`;
+    if (seen.has(key)) throw new Error("Duplicate QEMU guest forwarding rule");
+    seen.add(key);
+    if (!isGloballyRoutableIPv4(forward.address) || !PINNED_IPV4.test(forward.address))
+      throw new Error("Invalid pinned forwarding address");
+  }
+}
+function forwardsOf(entries, guestIps, control) {
+  return entries.flatMap((host) => {
+    if (!guestIps.test(host.guestIp) || control && host.reserve !== "control")
+      throw new Error("Invalid pinned forwarding address");
+    return host.ports.map((port) => ({
+      guestIp: host.guestIp,
+      address: host.address,
+      port,
+      ...host.reserve === "control" ? { reserve: "control" } : {}
+    }));
+  });
+}
+function qemuForwards(network) {
+  const forwards = [
+    ...forwardsOf(network.hosts, ENDPOINT_IP, false),
+    ...forwardsOf(network.control ?? [], CONTROL_ALIAS_IP2, true)
+  ];
+  if (forwards.length > MAX_NETWORK_FORWARDS) throw new Error("Too many QEMU forwarding rules");
+  validateForwards(forwards);
+  return forwards;
+}
+function restrictedUsernet(network, forwards, ncPath) {
+  const guestForwards = forwards.map(
+    (forward) => `guestfwd=tcp:${forward.guestIp}:${forward.port}-cmd:${ncPath} -4 -n -w 60 ${forward.address} ${forward.port}${forward.reserve === "control" ? " control" : ""}`
+  );
+  return [
+    "user",
+    "id=net0",
+    `net=${WORKER_SUBNET}`,
+    `dhcpstart=${WORKER_IP}`,
+    "restrict=on",
+    "ipv6=off",
+    `hostfwd=tcp:127.0.0.1:${network.sshPort}-:22`,
+    ...guestForwards,
+    ...network.publicWeb === true ? [
+      `guestfwd=tcp:${PUBLIC_WEB_IP}:${PUBLIC_WEB_PORT}-cmd:${ncPath} -4 -n -w 60 public-web ${PUBLIC_WEB_PORT}`
+    ] : []
+  ].join(",");
+}
+
 // src/vm/qemu-policy.ts
 var ALLOWED_PROBES = new Set(
   [
@@ -8568,9 +10440,7 @@ var REQUIRED_CONTROLS = [
   "drive:cidata"
 ];
 var DISALLOWED_CONTROLS = /* @__PURE__ */ new Set(["-sandbox", "-no-user-config", "-nodefaults"]);
-var BOOT_DISK_BPS = "104857600";
-var BOOT_DISK_IOPS = "2000";
-function assertPort(port, field) {
+function assertPort2(port, field) {
   if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error(`Invalid ${field}`);
 }
 function isProbe(args) {
@@ -8691,10 +10561,11 @@ function validateDrive(value, context) {
     }
     assertFields(fields, { file: /.+/, if: "none", discard: "on", id: "boot-disk" }, "boot drive");
     assertInstancePath(path, "disk", context);
-    return {
-      kind: "boot",
-      value: `${value},bps=${BOOT_DISK_BPS},iops=${BOOT_DISK_IOPS}`
+    const disk = context.disk ?? {
+      bps: LEGACY_CAPACITY_LIMITS.diskBytesPerSecond,
+      iops: LEGACY_CAPACITY_LIMITS.diskIops
     };
+    return { kind: "boot", value: `${value},bps=${disk.bps},iops=${disk.iops}` };
   }
   if (fields.get("id") === "cdrom0") {
     assertFields(
@@ -8739,38 +10610,6 @@ function parseOriginalUsernet(value, sshPort) {
     "Lima QEMU user network"
   );
 }
-function restrictedUsernet(network, forwards, ncPath) {
-  const guestForwards = forwards.map(
-    (forward) => `guestfwd=tcp:${forward.guestIp}:${forward.port}-cmd:${ncPath} -4 -n -w 60 ${forward.address} ${forward.port}`
-  );
-  return [
-    "user",
-    "id=net0",
-    `net=${WORKER_SUBNET}`,
-    `dhcpstart=${WORKER_IP}`,
-    "restrict=on",
-    "ipv6=off",
-    `hostfwd=tcp:127.0.0.1:${network.sshPort}-:22`,
-    ...guestForwards,
-    ...network.publicWeb === true ? [
-      `guestfwd=tcp:${PUBLIC_WEB_IP}:${PUBLIC_WEB_PORT}-cmd:${ncPath} -4 -n -w 60 public-web ${PUBLIC_WEB_PORT}`
-    ] : []
-  ].join(",");
-}
-function validateForwards(forwards) {
-  const seen = /* @__PURE__ */ new Set();
-  for (const forward of forwards) {
-    assertPort(forward.port, "guest forwarding port");
-    const key = `${forward.guestIp}:${forward.port}`;
-    if (seen.has(key)) throw new Error("Duplicate QEMU guest forwarding rule");
-    seen.add(key);
-    if (!/^192\.168\.5\.(?:1\d\d)$/.test(forward.guestIp) || !isGloballyRoutableIPv4(forward.address) || !/^(?:[1-9]?\d|1\d\d|2[0-4]\d|25[0-5])(?:\.(?:[1-9]?\d|1\d\d|2[0-4]\d|25[0-5])){3}$/.test(
-      forward.address
-    )) {
-      throw new Error("Invalid pinned forwarding address");
-    }
-  }
-}
 function fixedControl(control, expected) {
   return (value) => {
     if (value !== expected) throw new Error(`Unexpected QEMU ${control}`);
@@ -8803,7 +10642,7 @@ var SIMPLE_VALIDATORS = {
   "-parallel": fixedControl("-parallel", "none"),
   "-serial": fixedControl("serial", "chardev:char-serial"),
   "-qmp": fixedControl("qmp", "chardev:char-qmp"),
-  "-name": fixedControl("name", "lima-conveyor"),
+  "-name": (value, { vmName = VM_NAME }) => fixedControl("name", `lima-${vmName}`)(value, {}),
   "-pidfile": (value, context) => {
     assertInstancePath(value, "qemu.pid", context);
     return { value, control: "pidfile" };
@@ -8874,15 +10713,16 @@ function assertCompleteProfile(state) {
     throw new Error("QEMU PCI serial device and chardev must appear together");
   }
 }
-function rewriteQemuArgs(args, network, ncPath = "/usr/bin/nc", context = {}) {
+function rewriteQemuArgs(args, network, ncPath = "/usr/bin/nc", hostContext = {}) {
   if (isProbe(args)) return [...args];
-  assertPort(network.sshPort, "SSH port");
+  assertPort2(network.sshPort, "SSH port");
   if (!TRUSTED_NC_PATH.test(ncPath)) throw new Error("Invalid netcat path");
-  const forwards = network.hosts.flatMap(
-    (host) => host.ports.map((port) => ({ guestIp: host.guestIp, address: host.address, port }))
-  );
-  if (forwards.length > MAX_NETWORK_FORWARDS) throw new Error("Too many QEMU forwarding rules");
-  validateForwards(forwards);
+  const forwards = qemuForwards(network);
+  const limits = parseCapacityLimits(network.limits);
+  const context = {
+    ...hostContext,
+    disk: { bps: limits.diskBytesPerSecond, iops: limits.diskIops }
+  };
   const output = [];
   const state = {
     controls: /* @__PURE__ */ new Set(),
@@ -8922,15 +10762,79 @@ function rewriteQemuArgs(args, network, ncPath = "/usr/bin/nc", context = {}) {
 }
 
 // src/vm/memory-budget.ts
-function maximumGuestMemoryGiB(hostBytes) {
+var RELAY_RSS_ALLOWANCE_MIB = 128;
+var BASE_RELAY_SLOTS = 16;
+function relayAllowanceGiB(relaySlots = BASE_RELAY_SLOTS) {
+  return Math.max(0, relaySlots - BASE_RELAY_SLOTS) * RELAY_RSS_ALLOWANCE_MIB / 1024;
+}
+function maximumGuestMemoryGiBWithin(budgetGiB, relaySlots = BASE_RELAY_SLOTS) {
+  const guestBudget = budgetGiB - relayAllowanceGiB(relaySlots);
+  if (!Number.isFinite(guestBudget) || guestBudget <= 0) return 0;
+  return Math.max(0, Math.floor(Math.min(guestBudget - 1, guestBudget / 1.25)));
+}
+function maximumGuestMemoryGiB(hostBytes, relaySlots = BASE_RELAY_SLOTS) {
   if (!Number.isFinite(hostBytes) || hostBytes <= 0) return 0;
-  const budget = hostBytes / 1024 ** 3 * 0.75;
-  return Math.max(0, Math.floor(Math.min(budget - 1, budget / 1.25)));
+  return maximumGuestMemoryGiBWithin(hostBytes / 1024 ** 3 * 0.75, relaySlots);
+}
+
+// src/vm/host-state.ts
+import { access, chmod as chmod2, lstat, mkdir as mkdir2, readFile as readFile2, rename, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import { homedir, uptime } from "os";
+import { join } from "path";
+import { setTimeout as sleep } from "timers/promises";
+function vmProfile() {
+  const profile = process.env.CONVEYOR_VM_TEST_PROFILE;
+  if (profile !== void 0 && !/^acceptance-[a-z0-9-]{1,32}$/.test(profile)) {
+    throw new Error("Test VM profiles must match acceptance-[a-z0-9-]{1,32}.");
+  }
+  return profile;
+}
+function instancesBase() {
+  const profile = vmProfile();
+  return join(
+    homedir(),
+    ".local",
+    "share",
+    profile ? `conveyor-k3-${profile}-vms` : "conveyor-k3-vms"
+  );
+}
+function hostPaths(instance = DEFAULT_INSTANCE) {
+  const name = parseInstanceName(instance);
+  if (name !== DEFAULT_INSTANCE) return pathsForRoot(join(instancesBase(), name), name);
+  const profile = vmProfile();
+  return pathsForRoot(
+    join(homedir(), ".local", "share", profile ? `conveyor-k3-${profile}` : "conveyor-k3-vm")
+  );
+}
+function pathsForRoot(root, instance = DEFAULT_INSTANCE) {
+  const vmName = vmNameFor(parseInstanceName(instance));
+  const instanceDir = join(root, "lima", vmName);
+  return {
+    root,
+    limaHome: join(root, "lima"),
+    state: join(root, "state.json"),
+    network: join(root, "network.json"),
+    template: join(root, "conveyor.yaml"),
+    wrapper: join(root, "qemu-wrapper"),
+    wrapperJs: join(root, "vm-qemu.js"),
+    applied: join(root, "applied-network.json"),
+    guard: join(root, "guard-state.json"),
+    startRequest: join(root, "start-request.json"),
+    policyTransaction: join(root, "policy-transaction.json"),
+    lock: join(root, "operation.lock"),
+    /** Written by an owner stop, so a supervising service does not restart the VM. */
+    stopIntent: join(root, "stop-intent.json"),
+    instance,
+    vmName,
+    instanceDir,
+    limaConfig: join(instanceDir, "lima.yaml")
+  };
 }
 export {
   ClusterConnection,
   ClusterDaemon,
   CommandError,
+  DEFAULT_INSTANCE,
   HELP,
   K3S_DISABLED_COMPONENTS,
   K3S_INSTALL_EXEC,
@@ -8941,15 +10845,18 @@ export {
   countRunningConveyorPods,
   createMemoryFileSystem,
   decideK3sUpgrade,
+  hostPaths,
   isGloballyRoutableIPv4,
   isVerb,
   maximumGuestMemoryGiB,
+  maximumGuestMemoryGiBWithin,
   meetsK3sMinimum,
   missingAuthHosts,
   nodeFileSystem,
   ownerConfiguredKeys,
   ownerConfiguredKubeletFlags,
   parseArgs,
+  parseInstanceName,
   parseK3sVersion,
   parseRegistries,
   pruneStrandedImages,