@treeseed/sdk 0.11.0 → 0.12.4

package/dist/reconcile/builtin-adapters.js

@@ -1,6 +1,12 @@
-import { existsSync } from "node:fs";
-import { relative, resolve } from "node:path";
-import { collectTreeseedEnvironmentContext, resolveTreeseedMachineEnvironmentValues } from "../operations/services/config-runtime.js";
+import { createHmac, randomBytes, randomUUID } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { cpSync, existsSync, mkdirSync, mkdtempSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { readdir, readFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, relative, resolve } from "node:path";
+import { resolveCapacityProviderLaunchPlan } from "../capacity-provider.js";
+import { TreeDxClient } from "../treedx-client.js";
+import { collectTreeseedEnvironmentContext, resolveTreeseedMachineEnvironmentValues, setTreeseedMachineEnvironmentValue } from "../operations/services/config-runtime.js";
 import {
   buildPublicVars,
   buildCloudflarePagesFunctionBindings,
@@ -26,6 +32,7 @@ import {
   queueName,
   reconcileCloudflareWebCacheRules,
   resolveConfiguredCloudflareAccountId,
+  resolveConfiguredSurfaceDomain,
   resolveCloudflareZoneIdForHost,
   runWrangler,
   scopeFromTarget,
@@ -48,6 +55,8 @@ import {
   ensureRailwayPostgresService,
   deleteRailwayService,
   deleteRailwayVolume,
+  deployRailwayServiceInstance,
+  listRailwayEnvironmentServices,
   getRailwayServiceInstance,
   getRailwayProject,
   listRailwayCustomDomains,
@@ -57,11 +66,41 @@ import {
   listRailwayVolumes,
   listRailwayVariables,
   resolveRailwayWorkspaceContext,
-  upsertRailwayVariables
+  updateRailwayServiceGitSource,
+  updateRailwayServiceImageSource
 } from "../operations/services/railway-api.js";
 import { loadTreeseedReconcileState } from "./state.js";
 import { createTreeseedReconcileUnitId } from "./units.js";
 import { discoverTreeseedApplications } from "../hosting/apps.js";
+import { findTreeseedPackageAdapter, syncTreeseedPackageWorkflows } from "../operations/services/package-adapters.js";
+import { resolveGitHubCredentialForRepository } from "../operations/services/github-credentials.js";
+import {
+  dispatchReconcileGitHubWorkflow,
+  ensureReconcileGitHubEnvironment,
+  observeGitHubEnvironment,
+  observeGitHubWorkflowRun,
+  upsertReconcileGitHubSecret,
+  upsertReconcileGitHubVariable
+} from "./providers/github-private.js";
+import {
+  buildDockerImage,
+  inspectDockerAvailability,
+  inspectDockerImage,
+  inspectDockerManifest,
+  runDockerCompose
+} from "./providers/docker-private.js";
+import { checkHttpHealth, runManagedDevAction } from "./providers/local-private.js";
+import {
+  ensureTemplateReleaseTag,
+  runHostedReconcileGate,
+  runHostedVerifyGate,
+  runReleaseVerifyCommand,
+  runTemplateReleaseVerifyCommand,
+  writeReleaseRecord
+} from "./providers/release-private.js";
+import { checkedOutTemplateRepositories } from "../operations/services/managed-repositories.js";
+import { runTreeseedGit } from "../operations/services/git-runner.js";
+import { withDockerhubServiceCredentialEnv } from "../service-credentials.js";
 function toDeployTarget(target) {
   return target.kind === "persistent" ? createPersistentDeployTarget(target.scope) : createBranchPreviewDeployTarget(target.branchName);
 }
@@ -77,7 +116,7 @@ function isTransientCloudflareReconcileError(error) {
 }
 function isTransientRailwayReconcileError(error) {
   const message = error instanceof Error ? error.message : String(error ?? "");
-  return /fetch failed|timed out|etimedout|econnreset|enetunreach|temporarily unavailable|aborted|connectivity issue|rate limit|too many requests|429|5\d\d/iu.test(message);
+  return /fetch failed|timed out|etimedout|econnreset|enetunreach|temporarily unavailable|aborted|connectivity issue|rate limit|too many requests|429|5\d\d|operation is already in progress|Problem processing request/iu.test(message);
 }
 function syntheticQueueLocator(name) {
   return `queue-name:${name}`;
@@ -85,79 +124,1813 @@ function syntheticQueueLocator(name) {
 function isSyntheticQueueLocator(value) {
   return typeof value === "string" && value.startsWith("queue-name:");
 }
-function noopObservedState(input) {
+function noopObservedState(input) {
+  return {
+    exists: true,
+    status: "ready",
+    live: {
+      unitId: input.unit.unitId,
+      dependencies: input.unit.dependencies
+    },
+    locators: {},
+    warnings: []
+  };
+}
+function noopDiff() {
+  return {
+    action: "noop",
+    reasons: ["composite unit"],
+    before: {},
+    after: {}
+  };
+}
+function buildCompositeAdapter(unitType) {
+  return {
+    providerId: "treeseed",
+    unitTypes: [unitType],
+    supports(candidateUnitType, providerId) {
+      return candidateUnitType === unitType && providerId === "treeseed";
+    },
+    async refresh(input) {
+      return noopObservedState(input);
+    },
+    diff() {
+      return noopDiff();
+    },
+    requiredPostconditions({ unit }) {
+      return unit.dependencies.map((dependency) => ({
+        key: dependency,
+        description: `Dependency ${dependency} is verified`
+      }));
+    },
+    apply({ unit, observed, diff }) {
+      return {
+        unit,
+        observed,
+        diff,
+        action: diff.action,
+        warnings: [],
+        resourceLocators: {},
+        state: {
+          unitId: unit.unitId,
+          reconciledAt: nowIso()
+        },
+        verification: null
+      };
+    },
+    verify({ context, unit, postconditions }) {
+      const dependencyResults = context.session.get("treeseed:verification-results");
+      const checks = postconditions.map((condition) => {
+        const dependency = dependencyResults?.get(condition.key);
+        const verified = dependency?.verified === true;
+        return {
+          key: condition.key,
+          description: condition.description,
+          source: "derived",
+          exists: verified,
+          configured: verified,
+          ready: verified,
+          verified,
+          expected: true,
+          observed: dependency?.verified ?? false,
+          issues: verified ? [] : [`Dependency ${condition.key} is not verified.`]
+        };
+      });
+      return summarizeVerification(unit.unitId, checks);
+    }
+  };
+}
+function genericObservedState(input, exists = true, warnings = []) {
+  return {
+    exists,
+    status: exists ? "ready" : "pending",
+    live: {
+      unitId: input.unit.unitId,
+      unitType: input.unit.unitType,
+      provider: input.unit.provider,
+      spec: input.unit.spec
+    },
+    locators: { unitId: input.unit.unitId },
+    warnings
+  };
+}
+function genericResult(input, state = input.observed.live) {
+  return {
+    unit: input.unit,
+    observed: input.observed,
+    diff: input.diff,
+    action: input.diff.action,
+    warnings: input.observed.warnings,
+    resourceLocators: input.observed.locators,
+    state: {
+      ...state,
+      reconciledAt: nowIso()
+    },
+    verification: null
+  };
+}
+function genericVerification(input, observed, description = "Desired resource is represented in the canonical graph") {
+  return summarizeVerification(input.unit.unitId, [
+    verificationCheck("desired-resource", description, "derived", {
+      exists: observed.exists,
+      configured: true,
+      ready: observed.status !== "error",
+      verified: observed.exists && observed.status !== "error",
+      observed: observed.live
+    })
+  ], observed.warnings);
+}
+function buildManifestAdapter() {
+  return {
+    providerId: "treeseed",
+    unitTypes: ["package-manifest", "template-manifest"],
+    supports(unitType, providerId) {
+      return (unitType === "package-manifest" || unitType === "template-manifest") && providerId === "treeseed";
+    },
+    async refresh(input) {
+      const manifestPath = typeof input.unit.spec.manifestPath === "string" ? input.unit.spec.manifestPath : null;
+      const warningLabel = input.unit.unitType === "template-manifest" ? "template manifest path is not available" : "package manifest path is not available";
+      return genericObservedState(input, manifestPath ? existsSync(manifestPath) : true, manifestPath ? [] : [warningLabel]);
+    },
+    diff(input) {
+      const label = input.unit.unitType === "template-manifest" ? "template manifest" : "package manifest";
+      return input.observed.exists ? noopDiff() : { action: "blocked", reasons: [`${label} is missing`], before: input.observed.live, after: input.unit.spec };
+    },
+    apply(input) {
+      return genericResult(input);
+    },
+    verify(input) {
+      return genericVerification(input, input.observed, input.unit.unitType === "template-manifest" ? "Template manifest exists and is readable" : "Package manifest exists and is readable");
+    }
+  };
+}
+function buildPackageWorkflowAdapter() {
+  return {
+    providerId: "github",
+    unitTypes: ["package-workflow"],
+    supports(unitType, providerId) {
+      return unitType === "package-workflow" && providerId === "github";
+    },
+    refresh(input) {
+      const packageId = typeof input.unit.spec.packageId === "string" ? input.unit.spec.packageId : typeof input.unit.metadata.packageId === "string" ? input.unit.metadata.packageId : null;
+      const adapter = packageId ? findTreeseedPackageAdapter(input.context.tenantRoot, packageId) : null;
+      const sync = packageId ? syncTreeseedPackageWorkflows({ root: input.context.tenantRoot, packageId, execute: false }) : [];
+      return {
+        ...genericObservedState(input, Boolean(adapter), adapter ? [] : [`Package ${packageId ?? "(unknown)"} was not discovered.`]),
+        status: sync.some((entry) => entry.changed || !entry.exists) ? "drifted" : adapter ? "ready" : "error",
+        live: {
+          ...input.unit.spec,
+          packageId,
+          workflows: sync
+        }
+      };
+    },
+    diff(input) {
+      if (!input.observed.exists) {
+        return { action: "blocked", reasons: input.observed.warnings, before: input.observed.live, after: input.unit.spec };
+      }
+      const workflows = Array.isArray(input.observed.live.workflows) ? input.observed.live.workflows : [];
+      if (workflows.some((entry) => entry.changed || !entry.exists)) {
+        return { action: "update", reasons: ["package workflow files differ from rendered templates"], before: input.observed.live, after: input.unit.spec };
+      }
+      return noopDiff();
+    },
+    apply(input) {
+      const packageId = typeof input.unit.spec.packageId === "string" ? input.unit.spec.packageId : typeof input.unit.metadata.packageId === "string" ? input.unit.metadata.packageId : null;
+      if (packageId && input.context.dryRun !== true && input.diff.action !== "noop") {
+        const sync = syncTreeseedPackageWorkflows({
+          root: input.context.tenantRoot,
+          packageId,
+          execute: true
+        });
+        return genericResult(input, { ...input.observed.live, workflowSync: sync });
+      }
+      return genericResult(input);
+    },
+    verify(input) {
+      const workflows = Array.isArray(input.observed.live.workflows) ? input.observed.live.workflows : [];
+      const checks = workflows.map((workflow) => verificationCheck(
+        `workflow:${workflow.workflow ?? "unknown"}`,
+        `Workflow ${workflow.workflow ?? "unknown"} matches the rendered template`,
+        "sdk",
+        {
+          exists: workflow.exists === true,
+          configured: workflow.changed !== true,
+          ready: workflow.exists === true && workflow.changed !== true,
+          verified: workflow.exists === true && workflow.changed !== true,
+          expected: "rendered-template",
+          observed: workflow,
+          issues: [
+            ...workflow.exists ? [] : ["workflow file is missing"],
+            ...workflow.changed ? ["workflow file has template drift"] : []
+          ]
+        }
+      ));
+      return summarizeVerification(input.unit.unitId, checks.length > 0 ? checks : [
+        verificationCheck("package-workflow", "Package workflow resource is observable", "sdk", {
+          exists: input.observed.exists,
+          configured: input.observed.exists,
+          ready: input.observed.exists,
+          verified: input.observed.exists
+        })
+      ], input.observed.warnings);
+    }
+  };
+}
+function buildGraphOnlyAdapter(providerId, unitTypes, description) {
+  return {
+    providerId,
+    unitTypes,
+    supports(unitType, candidateProviderId) {
+      return candidateProviderId === providerId && unitTypes.includes(unitType);
+    },
+    refresh(input) {
+      return genericObservedState(input);
+    },
+    diff() {
+      return noopDiff();
+    },
+    apply(input) {
+      return genericResult(input);
+    },
+    verify(input) {
+      return genericVerification(input, input.observed, description);
+    },
+    destroy(input) {
+      return genericResult({
+        ...input,
+        diff: { action: "delete", reasons: ["selected for destroy"], before: input.observed.live, after: {} }
+      });
+    }
+  };
+}
+function buildGitHubEnv(input) {
+  const scope = input.context.target.kind === "persistent" ? input.context.target.scope : "staging";
+  const resolvedScope = scope === "local" ? "staging" : scope;
+  const configuredValues = resolveTreeseedMachineEnvironmentValues(input.context.tenantRoot, resolvedScope);
+  const values = {
+    ...normalizeEnvironmentValues(configuredValues),
+    ...resolveReconcileEnvironmentValues(input, resolvedScope)
+  };
+  const providerValues = withDockerhubServiceCredentialEnv(values);
+  const repository = typeof input.unit.spec.repository === "string" ? input.unit.spec.repository : null;
+  if (!repository) return providerValues;
+  const credential = resolveGitHubCredentialForRepository(repository, { values: providerValues, env: providerValues });
+  return credential.token ? { ...providerValues, TREESEED_GITHUB_TOKEN: credential.token, GH_TOKEN: credential.token, GITHUB_TOKEN: credential.token } : providerValues;
+}
+function repositoryFromUnit(input) {
+  const repository = input.unit.spec.repository;
+  if (typeof repository !== "string" || !repository.trim()) {
+    throw new Error(`${input.unit.unitId} requires a GitHub repository.`);
+  }
+  return repository.trim();
+}
+function workflowName(value, fallback) {
+  return (typeof value === "string" && value.trim() ? value.trim() : fallback).replace(/^\.github\/workflows\//u, "");
+}
+function environmentFromUnit(input) {
+  const environment = input.unit.spec.environment;
+  if (typeof environment !== "string" || !environment.trim()) {
+    throw new Error(`${input.unit.unitId} requires a GitHub environment.`);
+  }
+  return environment.trim();
+}
+function buildGitHubEnvironmentAdapter() {
+  return {
+    providerId: "github",
+    unitTypes: ["github-environment"],
+    supports(unitType, providerId) {
+      return unitType === "github-environment" && providerId === "github";
+    },
+    async refresh(input) {
+      const repository = repositoryFromUnit(input);
+      const environment = environmentFromUnit(input);
+      const observed = await observeGitHubEnvironment(repository, environment, buildGitHubEnv(input));
+      const warnings = observed.exists ? [] : [String(observed.error ?? "GitHub environment is missing")];
+      return {
+        ...genericObservedState(input, observed.exists, warnings),
+        status: observed.exists ? "ready" : "pending",
+        live: observed
+      };
+    },
+    diff(input) {
+      if (input.observed.live?.authAvailable === false) {
+        return { action: "blocked", reasons: input.observed.warnings, before: input.observed.live, after: input.unit.spec };
+      }
+      return input.observed.exists ? noopDiff() : { action: "create", reasons: ["GitHub environment is missing"], before: input.observed.live, after: input.unit.spec };
+    },
+    async apply(input) {
+      if (input.diff.action !== "noop") {
+        const result = await ensureReconcileGitHubEnvironment(repositoryFromUnit(input), environmentFromUnit(input), typeof input.unit.spec.branch === "string" ? input.unit.spec.branch : null, buildGitHubEnv(input));
+        return genericResult(input, { ...input.observed.live, result });
+      }
+      return genericResult(input);
+    },
+    verify(input) {
+      return genericVerification(input, input.observed, "GitHub environment exists");
+    }
+  };
+}
+function buildGitHubBindingAdapter(unitType) {
+  return {
+    providerId: "github",
+    unitTypes: [unitType],
+    supports(candidateUnitType, providerId) {
+      return candidateUnitType === unitType && providerId === "github";
+    },
+    async refresh(input) {
+      const repository = repositoryFromUnit(input);
+      const environment = environmentFromUnit(input);
+      const nameKey = unitType === "github-secret-binding" ? "secretName" : "variableName";
+      const name = String(input.unit.spec[nameKey] ?? input.unit.spec.envName ?? "");
+      const observed = await observeGitHubEnvironment(repository, environment, buildGitHubEnv(input));
+      const names = unitType === "github-secret-binding" ? observed.secretNames : observed.variableNames;
+      const exists = observed.exists && names.includes(name);
+      const warnings = observed.authAvailable === false ? [String(observed.error ?? "GitHub authentication is unavailable")] : observed.exists ? [] : [`GitHub environment ${environment} is missing`];
+      return {
+        ...genericObservedState(input, exists, warnings),
+        status: exists ? "ready" : "pending",
+        live: { repository, environment, name, exists, observed }
+      };
+    },
+    diff(input) {
+      const name = String(input.observed.live.name ?? "");
+      if (input.observed.live?.observed?.authAvailable === false) {
+        return { action: "blocked", reasons: input.observed.warnings, before: input.observed.live, after: input.unit.spec };
+      }
+      if (input.observed.exists) {
+        return noopDiff();
+      }
+      const value = buildGitHubEnv(input)[name];
+      if (!value) {
+        return { action: "blocked", reasons: [`Missing local value for ${name}`], before: input.observed.live, after: input.unit.spec };
+      }
+      return { action: "update", reasons: [`GitHub ${unitType === "github-secret-binding" ? "secret" : "variable"} ${name} is missing`], before: input.observed.live, after: input.unit.spec };
+    },
+    async apply(input) {
+      if (input.diff.action === "noop" || input.diff.action === "blocked") return genericResult(input);
+      const name = String(input.observed.live.name ?? input.unit.spec.envName ?? "");
+      const value = buildGitHubEnv(input)[name];
+      if (!value) throw new Error(`Missing local value for ${name}`);
+      const result = unitType === "github-secret-binding" ? await upsertReconcileGitHubSecret(repositoryFromUnit(input), environmentFromUnit(input), name, value, buildGitHubEnv(input)) : await upsertReconcileGitHubVariable(repositoryFromUnit(input), environmentFromUnit(input), name, value, buildGitHubEnv(input));
+      return genericResult(input, { ...input.observed.live, result });
+    },
+    verify(input) {
+      return genericVerification(input, input.observed, `GitHub ${unitType === "github-secret-binding" ? "secret" : "variable"} binding exists`);
+    }
+  };
+}
+function buildGitHubWorkflowDispatchAdapter() {
+  return {
+    providerId: "github",
+    unitTypes: ["github-workflow-dispatch"],
+    supports(unitType, providerId) {
+      return unitType === "github-workflow-dispatch" && providerId === "github";
+    },
+    async refresh(input) {
+      const repository = repositoryFromUnit(input);
+      const workflow = workflowName(input.unit.spec.workflow, "publish.yml");
+      const branch = typeof input.unit.spec.branch === "string" ? input.unit.spec.branch : null;
+      const latest = await observeGitHubWorkflowRun({ repository, workflow, branch, env: buildGitHubEnv(input) });
+      const authBlocked = Boolean(latest && typeof latest === "object" && "authAvailable" in latest && latest.authAvailable === false);
+      return {
+        ...genericObservedState(input, Boolean(latest) && !authBlocked, authBlocked ? [String(latest.error ?? "GitHub authentication is unavailable")] : []),
+        status: latest && !authBlocked ? "ready" : "pending",
+        live: { repository, workflow, branch, latest }
+      };
+    },
+    diff(input) {
+      if (input.observed.live?.latest?.authAvailable === false) {
+        return { action: "blocked", reasons: input.observed.warnings, before: input.observed.live, after: input.unit.spec };
+      }
+      const latest = input.observed.live?.latest;
+      const conclusion = typeof latest?.conclusion === "string" ? latest.conclusion : null;
+      const status = typeof latest?.status === "string" ? latest.status : null;
+      const expectedHeadSha = typeof input.unit.spec.expectedHeadSha === "string" ? input.unit.spec.expectedHeadSha : null;
+      const observedHeadSha = typeof latest?.headSha === "string" ? latest.headSha : typeof latest?.head_sha === "string" ? latest.head_sha : null;
+      if (!input.observed.exists) {
+        return { action: "create", reasons: ["workflow dispatch has no observed run"], before: input.observed.live, after: input.unit.spec };
+      }
+      if (expectedHeadSha && observedHeadSha && observedHeadSha !== expectedHeadSha) {
+        return { action: "create", reasons: [`latest workflow run is for ${observedHeadSha}, expected ${expectedHeadSha}`], before: input.observed.live, after: input.unit.spec };
+      }
+      if (conclusion && conclusion !== "success") {
+        return { action: "create", reasons: [`latest workflow run concluded ${conclusion}`], before: input.observed.live, after: input.unit.spec };
+      }
+      if (status && status !== "completed" && input.unit.spec.wait === true) {
+        return { action: "create", reasons: [`latest workflow run is still ${status}`], before: input.observed.live, after: input.unit.spec };
+      }
+      return noopDiff();
+    },
+    async apply(input) {
+      if (input.diff.action === "noop") return genericResult(input);
+      const result = await dispatchReconcileGitHubWorkflow({
+        repository: repositoryFromUnit(input),
+        workflow: workflowName(input.unit.spec.workflow, "publish.yml"),
+        branch: String(input.unit.spec.branch ?? "staging"),
+        inputs: typeof input.unit.spec.inputs === "object" && input.unit.spec.inputs ? input.unit.spec.inputs : {},
+        wait: input.unit.spec.wait === true,
+        timeoutMs: typeof input.unit.spec.timeoutMs === "number" ? input.unit.spec.timeoutMs : void 0,
+        env: buildGitHubEnv(input)
+      });
+      return genericResult(input, { ...input.observed.live, result });
+    },
+    verify(input) {
+      const latest = input.observed.live?.latest;
+      const result = input.result?.state?.result && typeof input.result.state.result === "object" ? input.result.state.result : null;
+      const observedRun = result?.runId ? result : latest;
+      const expectedHeadSha = typeof input.unit.spec.expectedHeadSha === "string" ? input.unit.spec.expectedHeadSha : null;
+      const observedHeadSha = typeof observedRun?.headSha === "string" ? observedRun.headSha : typeof observedRun?.head_sha === "string" ? observedRun.head_sha : null;
+      const status = typeof observedRun?.status === "string" ? observedRun.status : null;
+      const conclusion = typeof observedRun?.conclusion === "string" ? observedRun.conclusion : null;
+      const wait = input.unit.spec.wait === true;
+      const issues = [
+        ...expectedHeadSha && observedHeadSha && observedHeadSha !== expectedHeadSha ? [`latest workflow run is for ${observedHeadSha}, expected ${expectedHeadSha}`] : [],
+        ...wait && status && status !== "completed" ? [`workflow run is still ${status}`] : [],
+        ...wait && status === "completed" && conclusion !== "success" ? [`workflow run concluded ${conclusion ?? "unknown"}`] : []
+      ];
+      return summarizeVerification(input.unit.unitId, [
+        verificationCheck("github.workflow-run", "GitHub workflow dispatch produced a successful observed run", "api", {
+          exists: Boolean(observedRun),
+          configured: !expectedHeadSha || !observedHeadSha || observedHeadSha === expectedHeadSha,
+          ready: !wait || status === "completed",
+          verified: Boolean(observedRun) && issues.length === 0,
+          expected: {
+            workflow: input.unit.spec.workflow,
+            branch: input.unit.spec.branch,
+            headSha: expectedHeadSha,
+            wait,
+            conclusion: wait ? "success" : void 0
+          },
+          observed: observedRun,
+          issues
+        })
+      ], input.observed.warnings);
+    }
+  };
+}
+function buildPackageImageAdapter() {
+  return {
+    providerId: "dockerhub",
+    unitTypes: ["package-image"],
+    supports(unitType, providerId) {
+      return unitType === "package-image" && providerId === "dockerhub";
+    },
+    async refresh(input) {
+      const env = buildGitHubEnv(input);
+      const repository = typeof input.unit.spec.repository === "string" ? input.unit.spec.repository : null;
+      const environment = typeof input.unit.spec.environment === "string" ? input.unit.spec.environment : "staging";
+      const requiredSecrets = Array.isArray(input.unit.spec.requiredSecrets) ? input.unit.spec.requiredSecrets.map((entry) => String(entry)).filter(Boolean) : ["TREESEED_DOCKERHUB_TOKEN"];
+      const requiredVariables = Array.isArray(input.unit.spec.requiredVariables) ? input.unit.spec.requiredVariables.map((entry) => String(entry)).filter(Boolean) : ["TREESEED_DOCKERHUB_USERNAME"];
+      const localMissingSecrets = requiredSecrets.filter((name) => !env[name]);
+      const localMissingVariables = requiredVariables.filter((name) => !env[name]);
+      let remote = null;
+      if ((localMissingSecrets.length > 0 || localMissingVariables.length > 0) && repository) {
+        remote = await observeGitHubEnvironment(repository, environment, env);
+      }
+      const remoteSecretNames = new Set(remote?.secretNames ?? []);
+      const remoteVariableNames = new Set(remote?.variableNames ?? []);
+      const missingSecrets = localMissingSecrets.filter((name) => !remoteSecretNames.has(name));
+      const missingVariables = localMissingVariables.filter((name) => !remoteVariableNames.has(name));
+      const usernameConfigured = missingVariables.length === 0;
+      const tokenConfigured = missingSecrets.length === 0;
+      return {
+        ...genericObservedState(input, usernameConfigured && tokenConfigured, [
+          ...missingVariables.map((name) => `${name} is not configured`),
+          ...missingSecrets.map((name) => `${name} is not configured`)
+        ]),
+        status: usernameConfigured && tokenConfigured ? "ready" : "pending",
+        live: {
+          ...input.unit.spec,
+          dockerHub: {
+            usernameConfigured,
+            tokenConfigured,
+            source: localMissingSecrets.length === 0 && localMissingVariables.length === 0 ? "local-env" : "github-environment",
+            environment,
+            repository
+          }
+        }
+      };
+    },
+    diff(input) {
+      return input.observed.exists ? noopDiff() : { action: "blocked", reasons: input.observed.warnings, before: input.observed.live, after: input.unit.spec };
+    },
+    apply(input) {
+      return genericResult(input);
+    },
+    verify(input) {
+      return genericVerification(input, input.observed, "Docker Hub credentials for package image publication are configured");
+    }
+  };
+}
+function buildDockerImageBuildAdapter() {
+  return {
+    providerId: "docker",
+    unitTypes: ["docker-image-build"],
+    supports(unitType, providerId) {
+      return unitType === "docker-image-build" && providerId === "docker";
+    },
+    refresh(input) {
+      const availability = inspectDockerAvailability();
+      const tags = Array.isArray(input.unit.spec.tags) ? input.unit.spec.tags.filter((entry) => typeof entry === "string") : [];
+      const inspectedImages = Object.fromEntries(tags.map((tag) => [tag, inspectDockerImage(tag)]));
+      const inspectedManifests = Object.fromEntries(tags.map((tag) => [tag, inspectDockerManifest(tag)]));
+      const exists = availability.available && availability.buildxAvailable;
+      return {
+        ...genericObservedState(input, exists, availability.warnings),
+        status: !exists ? "error" : tags.some((tag) => inspectedImages[tag] || inspectedManifests[tag]) ? "ready" : "pending",
+        live: {
+          ...input.unit.spec,
+          docker: availability,
+          tags,
+          inspectedImages,
+          inspectedManifests
+        }
+      };
+    },
+    diff(input) {
+      if (!input.observed.exists) {
+        return { action: "blocked", reasons: input.observed.warnings, before: input.observed.live, after: input.unit.spec };
+      }
+      const tags = Array.isArray(input.unit.spec.tags) ? input.unit.spec.tags.filter((entry) => typeof entry === "string") : [];
+      const inspectedImages = input.observed.live.inspectedImages;
+      const inspectedManifests = input.observed.live.inspectedManifests;
+      const missing = tags.filter((tag) => !inspectedImages?.[tag] && !inspectedManifests?.[tag]);
+      return missing.length > 0 ? { action: "create", reasons: [`missing docker image tags: ${missing.join(", ")}`], before: input.observed.live, after: input.unit.spec } : noopDiff();
+    },
+    apply(input) {
+      if (input.diff.action === "blocked" || input.diff.action === "noop") return genericResult(input);
+      const platforms = Array.isArray(input.unit.spec.platforms) ? input.unit.spec.platforms.filter((entry) => typeof entry === "string") : ["linux/amd64"];
+      const tags = Array.isArray(input.unit.spec.tags) ? input.unit.spec.tags.filter((entry) => typeof entry === "string") : [];
+      runDockerImagePrepareCommand(input);
+      const result = buildDockerImage({
+        tenantRoot: input.context.tenantRoot,
+        packageRoot: String(input.unit.spec.packageRoot ?? input.context.tenantRoot),
+        context: String(input.unit.spec.context ?? "."),
+        dockerfile: String(input.unit.spec.dockerfile ?? "Dockerfile"),
+        target: typeof input.unit.spec.target === "string" ? input.unit.spec.target : null,
+        platforms,
+        tags,
+        labels: typeof input.unit.spec.labels === "object" && input.unit.spec.labels ? input.unit.spec.labels : {},
+        buildArgs: typeof input.unit.spec.buildArgs === "object" && input.unit.spec.buildArgs ? input.unit.spec.buildArgs : {},
+        push: input.unit.spec.push === true,
+        load: input.unit.spec.load !== false,
+        provenance: input.unit.spec.provenance === false ? false : void 0,
+        env: input.context.launchEnv
+      });
+      return genericResult(input, { ...input.observed.live, build: result });
+    },
+    verify(input) {
+      const tags = Array.isArray(input.unit.spec.tags) ? input.unit.spec.tags.filter((entry) => typeof entry === "string") : [];
+      const checks = tags.map((tag) => {
+        const image = inspectDockerImage(tag);
+        const manifest = inspectDockerManifest(tag);
+        const ok = Boolean(image || manifest);
+        return verificationCheck(`docker-image:${tag}`, `Docker image ${tag} exists locally or as an inspectable manifest`, "cli", {
+          exists: ok,
+          configured: input.observed.exists,
+          ready: ok,
+          verified: ok,
+          observed: image ?? manifest,
+          issues: ok ? [] : [`Docker image ${tag} was not found after build.`]
+        });
+      });
+      return summarizeVerification(input.unit.unitId, checks.length > 0 ? checks : [
+        verificationCheck("docker", "Docker daemon and Buildx are available", "cli", {
+          exists: input.observed.exists,
+          configured: input.observed.exists,
+          ready: input.observed.exists,
+          verified: input.observed.exists
+        })
+      ], input.observed.warnings);
+    }
+  };
+}
+function runDockerImagePrepareCommand(input) {
+  const prepareCommand = input.unit.spec.prepareCommand;
+  if (!prepareCommand || typeof prepareCommand !== "object") return;
+  const command = typeof prepareCommand.command === "string" ? String(prepareCommand.command) : null;
+  const rawArgs = prepareCommand.args;
+  const args = Array.isArray(rawArgs) ? rawArgs.filter((entry) => typeof entry === "string") : [];
+  if (!command) return;
+  const packageRoot = resolve(input.context.tenantRoot, String(input.unit.spec.packageRoot ?? "."));
+  const result = spawnSync(command, args, {
+    cwd: packageRoot,
+    env: { ...process.env, ...input.context.launchEnv ?? {} },
+    encoding: "utf8",
+    stdio: "pipe"
+  });
+  if (result.status !== 0) {
+    throw new Error(result.stderr?.trim() || result.stdout?.trim() || `${command} ${args.join(" ")} failed`);
+  }
+}
+function buildLocalDockerComposeAdapter() {
+  return {
+    providerId: "local",
+    unitTypes: ["local-docker-compose"],
+    supports(unitType, providerId) {
+      return unitType === "local-docker-compose" && providerId === "local";
+    },
+    refresh(input) {
+      const composeFiles = resolveLocalComposeFiles(input);
+      const composeFilesExist = composeFiles.length > 0 && composeFiles.every((composeFile) => existsSync(composeFile));
+      const cwd = resolve(input.context.tenantRoot, String(input.unit.spec.cwd ?? "."));
+      const docker = inspectDockerAvailability();
+      const projectName = String(input.unit.spec.projectName ?? "treeseed-capacity-provider");
+      const env = buildLocalComposeLaunchEnv(input);
+      const profiles = localComposeProfiles(input);
+      const buildPolicy = localComposeBuildPolicy(input);
+      const ps = composeFilesExist && docker.available ? runDockerCompose({ composeFiles, projectName, cwd, env, profiles, buildPolicy, action: "ps" }) : null;
+      const hasContainers = Boolean(ps?.ok && ps.stdout.trim());
+      const config = composeFilesExist && docker.available ? runDockerCompose({ composeFiles, projectName, cwd, env, profiles, buildPolicy, action: "config" }) : null;
+      const missingComposeFiles = composeFiles.filter((composeFile) => !existsSync(composeFile));
+      return {
+        ...genericObservedState(input, Boolean(composeFilesExist && docker.available), [
+          ...composeFiles.length > 0 ? [] : ["Compose file is missing: (unset)"],
+          ...missingComposeFiles.map((composeFile) => `Compose file is missing: ${composeFile}`),
+          ...docker.warnings
+        ]),
+        status: hasContainers ? "ready" : composeFilesExist && docker.available ? "pending" : "error",
+        live: {
+          ...input.unit.spec,
+          composeFile: composeFiles[0] ?? null,
+          composeFiles,
+          projectName,
+          cwd,
+          profiles,
+          buildPolicy,
+          docker,
+          ps,
+          hasContainers,
+          configHash: config?.stdout?.trim() || null
+        }
+      };
+    },
+    diff(input) {
+      if (!input.observed.exists) return { action: "blocked", reasons: input.observed.warnings, before: input.observed.live, after: input.unit.spec };
+      return input.observed.status === "ready" ? noopDiff() : { action: "create", reasons: ["compose services are not running"], before: input.observed.live, after: input.unit.spec };
+    },
+    apply(input) {
+      if (input.diff.action === "blocked" || input.diff.action === "noop") return genericResult(input);
+      runLocalComposePrepareCommand(input);
+      ensureLocalComposeDataDir(input);
+      const composeFiles = observedOrResolvedComposeFiles(input);
+      const cwd = String(input.observed.live.cwd ?? input.context.tenantRoot);
+      const projectName = String(input.unit.spec.projectName ?? "treeseed-capacity-provider");
+      const env = buildLocalComposeLaunchEnv(input);
+      const result = runDockerCompose({
+        composeFiles,
+        projectName,
+        cwd,
+        env,
+        profiles: localComposeProfiles(input),
+        buildPolicy: localComposeBuildPolicy(input),
+        action: "up"
+      });
+      if (!result.ok) {
+        throw new Error(result.stderr.trim() || result.stdout.trim() || "docker compose up failed");
+      }
+      return genericResult(input, { ...input.observed.live, compose: result });
+    },
+    async verify(input) {
+      const healthChecks = Array.isArray(input.unit.spec.healthChecks) ? input.unit.spec.healthChecks : [];
+      const checks = [];
+      for (const healthCheck of healthChecks) {
+        if (healthCheck.kind === "http" && typeof healthCheck.url === "string") {
+          const health = await checkHttpHealthWithRetry(healthCheck.url);
+          checks.push(verificationCheck(String(healthCheck.id ?? healthCheck.url), `HTTP health ${healthCheck.url}`, "api", {
+            exists: health.ok,
+            configured: true,
+            ready: health.ok,
+            verified: health.ok,
+            observed: health,
+            issues: health.ok ? [] : [`Health endpoint ${healthCheck.url} did not respond successfully.`]
+          }));
+        }
+      }
+      if (checks.length === 0) {
+        checks.push(verificationCheck("compose", "Docker Compose project is observable", "cli", {
+          exists: input.observed.exists,
+          configured: input.observed.exists,
+          ready: input.observed.status === "ready",
+          verified: input.observed.exists && input.observed.status !== "error",
+          observed: input.observed.live
+        }));
+      }
+      return summarizeVerification(input.unit.unitId, checks, input.observed.warnings);
+    },
+    destroy(input) {
+      const composeFiles = observedOrResolvedComposeFiles(input);
+      const cwd = String(input.observed.live.cwd ?? input.context.tenantRoot);
+      const projectName = String(input.unit.spec.projectName ?? "treeseed-capacity-provider");
+      if (input.context.dryRun !== true && composeFiles.length > 0 && composeFiles.every((composeFile) => existsSync(composeFile))) {
+        const result = runDockerCompose({
+          composeFiles,
+          projectName,
+          cwd,
+          env: buildLocalComposeLaunchEnv(input),
+          profiles: localComposeProfiles(input),
+          buildPolicy: localComposeBuildPolicy(input),
+          action: "down"
+        });
+        if (!result.ok) {
+          throw new Error(result.stderr.trim() || result.stdout.trim() || "docker compose down failed");
+        }
+      }
+      return genericResult({
+        ...input,
+        diff: { action: "delete", reasons: ["selected local compose project for destroy"], before: input.observed.live, after: {} }
+      });
+    }
+  };
+}
+function ensureLocalComposeDataDir(input) {
+  const dataDir = typeof input.unit.spec.dataDir === "string" ? input.unit.spec.dataDir.trim() : "";
+  if (!dataDir) return;
+  mkdirSync(resolve(input.context.tenantRoot, dataDir), { recursive: true });
+}
+function resolveLocalComposeFiles(input) {
+  const rawComposeFiles = Array.isArray(input.unit.spec.composeFiles) ? input.unit.spec.composeFiles : typeof input.unit.spec.composeFile === "string" ? [input.unit.spec.composeFile] : [];
+  return rawComposeFiles.filter((composeFile) => typeof composeFile === "string" && composeFile.trim().length > 0).map((composeFile) => resolve(input.context.tenantRoot, composeFile));
+}
+function observedOrResolvedComposeFiles(input) {
+  const observed = input.observed.live.composeFiles;
+  if (Array.isArray(observed)) {
+    return observed.filter((composeFile) => typeof composeFile === "string" && composeFile.trim().length > 0);
+  }
+  return resolveLocalComposeFiles(input);
+}
+function localComposeProfiles(input) {
+  return Array.isArray(input.unit.spec.profiles) ? input.unit.spec.profiles.filter((profile) => typeof profile === "string" && profile.trim().length > 0) : [];
+}
+function localComposeBuildPolicy(input) {
+  return input.unit.spec.buildPolicy === "never" || input.unit.spec.buildPolicy === "always" ? input.unit.spec.buildPolicy : "missing";
+}
+function runLocalComposePrepareCommand(input) {
+  const prepareCommand = input.unit.spec.prepareCommand;
+  if (!prepareCommand || typeof prepareCommand !== "object") return;
+  const command = typeof prepareCommand.command === "string" ? String(prepareCommand.command) : null;
+  const rawArgs = prepareCommand.args;
+  const args = Array.isArray(rawArgs) ? rawArgs.filter((entry) => typeof entry === "string") : [];
+  if (!command) return;
+  const result = spawnSync(command, args, {
+    cwd: input.context.tenantRoot,
+    env: buildLocalComposeLaunchEnv(input),
+    encoding: "utf8",
+    stdio: "pipe"
+  });
+  if (result.status !== 0) {
+    throw new Error(result.stderr?.trim() || result.stdout?.trim() || `${command} ${args.join(" ")} failed`);
+  }
+}
+async function checkHttpHealthWithRetry(url, attempts = 90, intervalMs = 2e3) {
+  let last = await checkHttpHealth(url);
+  for (let attempt = 1; attempt < attempts && !last.ok; attempt += 1) {
+    await new Promise((resolve2) => setTimeout(resolve2, intervalMs));
+    last = await checkHttpHealth(url);
+  }
+  return last;
+}
+function buildLocalComposeLaunchEnv(input) {
+  const fallback = resolveCapacityProviderLaunchPlan({
+    schemaVersion: 1,
+    provider: {
+      dataDir: ".treeseed/local-capacity-provider/data",
+      environment: "local"
+    },
+    runtime: {
+      images: {
+        roles: {
+          manager: { image: "treeseed/agent-manager", tag: "latest" },
+          runner: { image: "treeseed/agent-runner", tag: "latest" }
+        }
+      },
+      api: {
+        hostPort: 4783
+      }
+    }
+  }).composeEnv;
+  return {
+    ...input.context.launchEnv,
+    ...fallback,
+    ...typeof input.unit.spec.env === "object" && input.unit.spec.env ? input.unit.spec.env : {}
+  };
+}
+function localContentSpecString(input, key) {
+  const value = input.unit.spec[key];
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function localContentSpecRecord(input, key) {
+  const value = input.unit.spec[key];
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function localContentGitEnvironment(input) {
+  const repo = localContentSpecRecord(input, "contentRepository");
+  const owner = typeof repo.owner === "string" ? repo.owner : "";
+  const name = typeof repo.name === "string" ? repo.name : "";
+  if (!owner || !name) return { env: input.context.launchEnv, credential: null };
+  const credential = resolveGitHubCredentialForRepository(`${owner}/${name}`, { env: input.context.launchEnv });
+  const env = credential.token ? {
+    ...input.context.launchEnv,
+    TREESEED_GITHUB_TOKEN: credential.token,
+    GH_TOKEN: credential.token,
+    GITHUB_TOKEN: credential.token
+  } : input.context.launchEnv;
+  return { env, credential };
+}
+function localContentPathInsideTenant(input, targetPath) {
+  if (!targetPath) return true;
+  const resolvedTarget = resolve(targetPath);
+  const resolvedTenant = resolve(input.context.tenantRoot);
+  return resolvedTarget === resolvedTenant || resolvedTarget.startsWith(`${resolvedTenant}/`);
+}
+function inspectLocalContentGit(targetPath) {
+  const origin = runTreeseedGit(["remote", "get-url", "origin"], { cwd: targetPath, mode: "read", allowFailure: true }).stdout.trim();
+  const branch = runTreeseedGit(["rev-parse", "--abbrev-ref", "HEAD"], { cwd: targetPath, mode: "read", allowFailure: true }).stdout.trim();
+  const status = runTreeseedGit(["status", "--porcelain"], { cwd: targetPath, mode: "read", allowFailure: true }).stdout.trim();
+  return {
+    isGit: Boolean(runTreeseedGit(["rev-parse", "--is-inside-work-tree"], { cwd: targetPath, mode: "read", allowFailure: true }).stdout.trim()),
+    origin: origin || null,
+    branch: branch || null,
+    dirty: status.length > 0
+  };
+}
+function localContentObservedState(input) {
+  const targetPath = localContentSpecString(input, "effectiveLocalPath");
+  const materialization = localContentSpecString(input, "localContentMaterialization") ?? "none";
+  const executeRequested = input.unit.spec.executeRequested === true;
+  const warnings = [];
+  if (!localContentPathInsideTenant(input, targetPath)) {
+    warnings.push("local content target path is outside the Treeseed workspace");
+    return {
+      ...genericObservedState(input, false, warnings),
+      status: "error",
+      live: {
+        ...input.unit.spec,
+        targetPath,
+        materializationStatus: "blocked"
+      }
+    };
+  }
+  if (materialization === "none" || !targetPath) {
+    return {
+      ...genericObservedState(input, true, warnings),
+      live: {
+        ...input.unit.spec,
+        materializationStatus: "not_requested"
+      }
+    };
+  }
+  const exists = existsSync(targetPath);
+  const stat = exists ? statSync(targetPath) : null;
+  if (exists && !stat?.isDirectory()) {
+    warnings.push("local content target path exists but is not a directory");
+    return {
+      ...genericObservedState(input, false, warnings),
+      status: "error",
+      live: {
+        ...input.unit.spec,
+        targetPath,
+        materializationStatus: "blocked"
+      }
+    };
+  }
+  const git = exists ? inspectLocalContentGit(targetPath) : null;
+  if (exists && materialization === "managed_clone" && !git?.isGit) {
+    warnings.push("managed local content target exists but is not a Git worktree");
+    return {
+      ...genericObservedState(input, false, warnings),
+      status: "error",
+      live: {
+        ...input.unit.spec,
+        targetPath,
+        materializationStatus: "blocked",
+        git
+      }
+    };
+  }
+  const status = exists ? materialization === "managed_clone" ? "managed_clone_ready" : materialization === "submodule" ? "submodule_ready" : "existing_path_ready" : materialization === "managed_clone" ? "managed_clone_missing" : materialization === "submodule" ? "submodule_missing" : "existing_path_missing";
+  if (git?.dirty) {
+    warnings.push("local content Git worktree has uncommitted changes; Treeseed will not reset or overwrite it");
+  }
+  return {
+    ...genericObservedState(input, exists || !executeRequested, warnings),
+    status: exists || !executeRequested ? "ready" : "pending",
+    live: {
+      ...input.unit.spec,
+      targetPath,
+      materializationStatus: status,
+      git
+    },
+    locators: {
+      unitId: input.unit.unitId,
+      targetPath,
+      origin: git?.origin ?? null
+    }
+  };
+}
+function expectedLocalContentOrigin(input) {
+  const repo = localContentSpecRecord(input, "contentRepository");
+  return typeof repo.gitUrl === "string" ? repo.gitUrl : null;
+}
+function originMatches(observed, expected) {
+  const liveGit = observed.live.git && typeof observed.live.git === "object" ? observed.live.git : null;
+  const origin = typeof liveGit?.origin === "string" ? liveGit.origin : null;
+  return !origin || !expected || origin === expected || origin.replace(/\.git$/u, "") === expected.replace(/\.git$/u, "");
+}
+function githubRepoSlugFromUrl(url) {
+  if (!url) return null;
+  if (!/^(https?:\/\/github\.com\/|git@github\.com:|ssh:\/\/git@github\.com\/)/iu.test(url)) return null;
+  const raw = url.replace(/^https?:\/\/github\.com\//iu, "").replace(/^git@github\.com:/iu, "").replace(/^ssh:\/\/git@github\.com\//iu, "").replace(/\.git$/iu, "").replace(/^\/+|\/+$/gu, "");
+  const [owner, name, ...extra] = raw.split("/").filter(Boolean);
+  return owner && name && extra.length === 0 ? `${owner}/${name}` : null;
+}
+function runLocalContentClone(input, targetPath, gitUrl, branch) {
+  mkdirSync(dirname(targetPath), { recursive: true });
+  const { env, credential } = localContentGitEnvironment(input);
+  const repoSlug = githubRepoSlugFromUrl(gitUrl);
+  if (repoSlug && credential?.configured) {
+    const args2 = ["repo", "clone", repoSlug, targetPath, "--"];
+    if (branch) args2.push("--branch", branch);
+    const result2 = spawnSync("gh", args2, {
+      cwd: input.context.tenantRoot,
+      env,
+      encoding: "utf8",
+      stdio: "pipe",
+      timeout: 12e4,
+      maxBuffer: 1024 * 1024 * 16
+    });
+    if (result2.status !== 0) {
+      throw new Error((result2.stderr || result2.stdout || "GitHub CLI clone failed. Run `npx trsd install --json` and configure TREESEED_GITHUB_TOKEN if this repository is private.").trim());
+    }
+    return {
+      status: result2.status,
+      stdout: result2.stdout ?? "",
+      stderr: result2.stderr ?? "",
+      tool: "gh",
+      credentialEnvName: credential.envName,
+      fallbackUsed: credential.fallbackUsed
+    };
+  }
+  const args = ["clone"];
+  if (branch) args.push("--branch", branch);
+  args.push(gitUrl, targetPath);
+  const result = runTreeseedGit(args, {
+    cwd: input.context.tenantRoot,
+    mode: "mutate",
+    env,
+    timeoutMs: 12e4,
+    maxBuffer: 1024 * 1024 * 16
+  });
+  return {
+    ...result,
+    tool: "git",
+    credentialEnvName: credential?.envName ?? null,
+    fallbackUsed: credential?.fallbackUsed ?? false
+  };
+}
+function buildLocalContentMaterializationAdapter() {
+  return {
+    providerId: "local",
+    unitTypes: ["local-content-materialization"],
+    supports(unitType, providerId) {
+      return unitType === "local-content-materialization" && providerId === "local";
+    },
+    refresh(input) {
+      return localContentObservedState(input);
+    },
+    diff(input) {
+      const materialization = localContentSpecString(input, "localContentMaterialization") ?? "none";
+      const executeRequested = input.unit.spec.executeRequested === true;
+      const expectedOrigin = expectedLocalContentOrigin(input);
+      if (input.observed.status === "error") {
+        return { action: "blocked", reasons: input.observed.warnings, before: input.observed.live, after: input.unit.spec };
+      }
+      if (materialization === "existing_path" && !input.observed.exists) {
+        return { action: "blocked", reasons: ["existing local content path is missing; choose preview/edit with managed_clone or configure the path"], before: input.observed.live, after: input.unit.spec };
+      }
+      if (input.observed.exists && !originMatches(input.observed, expectedOrigin)) {
+        return { action: "blocked", reasons: ["managed local content origin does not match the configured content repository"], before: input.observed.live, after: input.unit.spec };
+      }
+      if (!executeRequested) {
+        return noopDiff();
+      }
+      if (!input.observed.exists && (materialization === "managed_clone" || materialization === "submodule")) {
+        return { action: "create", reasons: [`${materialization} local content is requested but missing`], before: input.observed.live, after: input.unit.spec };
+      }
+      if (input.observed.exists && materialization === "managed_clone") {
+        return { action: "update", reasons: ["managed local content exists; fetch without resetting local work"], before: input.observed.live, after: input.unit.spec };
+      }
+      return noopDiff();
+    },
+    apply(input) {
+      if (input.diff.action === "noop" || input.diff.action === "blocked") return genericResult(input);
+      const materialization = localContentSpecString(input, "localContentMaterialization") ?? "none";
+      const targetPath = localContentSpecString(input, "effectiveLocalPath");
+      const expectedOrigin = expectedLocalContentOrigin(input);
+      const repo = localContentSpecRecord(input, "contentRepository");
+      const branch = typeof repo.defaultBranch === "string" ? repo.defaultBranch : null;
+      if (!targetPath) return genericResult(input);
+      if (materialization === "submodule") {
+        const submodulePath = typeof repo.submodulePath === "string" ? repo.submodulePath : localContentSpecString(input, "contentPath");
+        if (!submodulePath) return genericResult(input);
+        const { env } = localContentGitEnvironment(input);
+        const submodule = runTreeseedGit(["submodule", "update", "--init", "--", submodulePath], {
+          cwd: input.context.tenantRoot,
+          mode: "mutate",
+          env,
+          timeoutMs: 12e4,
+          maxBuffer: 1024 * 1024 * 16
+        });
+        return genericResult(input, { ...input.observed.live, submodule: { status: submodule.status } });
+      }
+      if (materialization === "managed_clone" && expectedOrigin) {
+        const result = input.observed.exists ? runTreeseedGit(["fetch", "origin"], {
+          cwd: targetPath,
+          mode: "mutate",
+          env: localContentGitEnvironment(input).env,
+          timeoutMs: 12e4,
+          maxBuffer: 1024 * 1024 * 16
+        }) : runLocalContentClone(input, targetPath, expectedOrigin, branch);
+        return genericResult(input, {
+          ...input.observed.live,
+          materializedAt: nowIso(),
+          gitOperation: {
+            status: result.status,
+            tool: "tool" in result ? result.tool : "git",
+            credentialEnvName: "credentialEnvName" in result ? result.credentialEnvName : null,
+            fallbackUsed: "fallbackUsed" in result ? result.fallbackUsed : false
+          }
+        });
+      }
+      return genericResult(input);
+    },
+    verify(input) {
+      const targetPath = localContentSpecString(input, "effectiveLocalPath");
+      const materialization = localContentSpecString(input, "localContentMaterialization") ?? "none";
+      const exists = !targetPath || existsSync(targetPath);
+      const expectedOrigin = expectedLocalContentOrigin(input);
+      const originOk = originMatches(input.observed, expectedOrigin);
+      const checks = [
+        verificationCheck("local-content.path", "Local content path policy is satisfied", "sdk", {
+          exists: materialization === "none" ? true : exists,
+          configured: true,
+          ready: materialization === "none" || exists,
+          verified: materialization === "none" || exists,
+          observed: targetPath,
+          issues: materialization !== "none" && !exists ? ["Local content path is missing."] : []
+        }),
+        verificationCheck("local-content.origin", "Local content origin matches the configured repository when observable", "sdk", {
+          exists: true,
+          configured: originOk,
+          ready: originOk,
+          verified: originOk,
+          expected: expectedOrigin,
+          observed: input.observed.live.git,
+          issues: originOk ? [] : ["Origin does not match configured content repository."]
+        })
+      ];
+      return summarizeVerification(input.unit.unitId, checks, input.observed.warnings);
+    }
+  };
+}
+function buildLocalProcessAdapter() {
+  return {
+    providerId: "local",
+    unitTypes: ["local-process"],
+    supports(unitType, providerId) {
+      return unitType === "local-process" && providerId === "local";
+    },
+    async refresh(input) {
+      const surfaces = Array.isArray(input.unit.spec.surfaces) ? input.unit.spec.surfaces.filter((entry) => typeof entry === "string") : [String(input.unit.spec.processId ?? input.unit.logicalName)];
+      const status = await runManagedDevAction({
+        tenantRoot: input.context.tenantRoot,
+        action: "status",
+        surfaces,
+        options: typeof input.unit.spec.options === "object" && input.unit.spec.options ? input.unit.spec.options : {},
+        env: input.context.launchEnv
+      });
+      const safeStatus = sanitizeManagedDevObservation(status);
+      return {
+        ...genericObservedState(input, true, safeStatus.ok ? [] : [safeStatus.output || "managed dev status failed"]),
+        status: safeStatus.ok ? "ready" : "pending",
+        live: {
+          ...input.unit.spec,
+          status: safeStatus
+        }
+      };
+    },
+    diff(input) {
+      return input.observed.status === "ready" ? noopDiff() : { action: "create", reasons: ["local process is not reported ready"], before: input.observed.live, after: input.unit.spec };
+    },
+    async apply(input) {
+      if (input.diff.action === "noop") return genericResult(input);
+      const surfaces = Array.isArray(input.unit.spec.surfaces) ? input.unit.spec.surfaces.filter((entry) => typeof entry === "string") : [String(input.unit.spec.processId ?? input.unit.logicalName)];
+      const result = await runManagedDevAction({
+        tenantRoot: input.context.tenantRoot,
+        action: input.unit.spec.action === "restart" ? "restart" : "start",
+        surfaces,
+        options: typeof input.unit.spec.options === "object" && input.unit.spec.options ? input.unit.spec.options : {},
+        env: input.context.launchEnv
+      });
+      return genericResult(input, { ...input.observed.live, managedDev: result });
+    },
+    async verify(input) {
+      const status = await runManagedDevAction({
+        tenantRoot: input.context.tenantRoot,
+        action: "status",
+        surfaces: Array.isArray(input.unit.spec.surfaces) ? input.unit.spec.surfaces.filter((entry) => typeof entry === "string") : [],
+        options: typeof input.unit.spec.options === "object" && input.unit.spec.options ? input.unit.spec.options : {},
+        env: input.context.launchEnv
+      });
+      const safeStatus = sanitizeManagedDevObservation(status);
+      return summarizeVerification(input.unit.unitId, [
+        verificationCheck("managed-dev-status", "Managed dev status is observable", "sdk", {
+          exists: safeStatus.ok,
+          configured: true,
+          ready: safeStatus.ok,
+          verified: safeStatus.ok,
+          observed: safeStatus.parsed ?? safeStatus.output,
+          issues: safeStatus.ok ? [] : [safeStatus.output || "managed dev status failed"]
+        })
+      ], input.observed.warnings);
+    },
+    async destroy(input) {
+      const surfaces = Array.isArray(input.unit.spec.surfaces) ? input.unit.spec.surfaces.filter((entry) => typeof entry === "string") : [String(input.unit.spec.processId ?? input.unit.logicalName)];
+      if (input.context.dryRun !== true) {
+        await runManagedDevAction({
+          tenantRoot: input.context.tenantRoot,
+          action: "stop",
+          surfaces,
+          options: typeof input.unit.spec.options === "object" && input.unit.spec.options ? input.unit.spec.options : {},
+          env: input.context.launchEnv
+        });
+      }
+      return genericResult({
+        ...input,
+        diff: { action: "delete", reasons: ["selected local process for stop"], before: input.observed.live, after: {} }
+      });
+    }
+  };
+}
+function sanitizeManagedDevObservation(value) {
+  if (Array.isArray(value)) {
+    return value.map((entry) => sanitizeManagedDevObservation(entry));
+  }
+  if (!value || typeof value !== "object") {
+    return value;
+  }
+  const result = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (key === "env") {
+      result.redactedEnv = redactEnvironmentRecord(entry);
+      continue;
+    }
+    result[key] = sanitizeManagedDevObservation(entry);
+  }
+  return result;
+}
+function redactEnvironmentRecord(value) {
+  if (!value || typeof value !== "object") {
+    return {};
+  }
+  return Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => [
+      key,
+      key === "PATH" || key === "NODE_ENV" ? String(entry ?? "") : "<redacted>"
+    ])
+  );
+}
+function buildCapacityProviderAdapter(providerId) {
+  return {
+    providerId,
+    unitTypes: ["capacity-provider"],
+    supports(unitType, candidateProviderId) {
+      return unitType === "capacity-provider" && candidateProviderId === providerId;
+    },
+    refresh(input) {
+      const dependencies = input.unit.dependencies;
+      return {
+        ...genericObservedState(input),
+        live: {
+          ...input.unit.spec,
+          dependencies
+        }
+      };
+    },
+    diff() {
+      return noopDiff();
+    },
+    apply(input) {
+      return genericResult(input);
+    },
+    async verify(input) {
+      const dependencyResults = input.context.session.get("treeseed:verification-results");
+      const checks = input.unit.dependencies.map((dependency) => {
+        const verification = dependencyResults?.get(dependency);
+        const ok = verification ? verification.verified === true : true;
+        return verificationCheck(`dependency:${dependency}`, `Capacity provider dependency ${dependency} is verified`, "derived", {
+          exists: ok,
+          configured: ok,
+          ready: ok,
+          verified: ok,
+          observed: verification ?? null,
+          issues: ok ? [] : [`Dependency ${dependency} is not verified.`]
+        });
+      });
+      const healthEndpoint = typeof input.unit.spec.healthEndpoint === "string" ? input.unit.spec.healthEndpoint : null;
+      if (healthEndpoint) {
+        const health = await checkHttpHealth(healthEndpoint);
+        checks.push(verificationCheck("capacity-provider-health", `Capacity provider health endpoint ${healthEndpoint} responds`, "api", {
+          exists: health.ok,
+          configured: true,
+          ready: health.ok,
+          verified: health.ok,
+          observed: health,
+          issues: health.ok ? [] : [`Capacity provider health endpoint ${healthEndpoint} did not respond successfully.`]
+        }));
+      }
+      if (checks.length === 0) {
+        checks.push(verificationCheck("capacity-provider", "Capacity provider desired topology is observable", "derived", {
+          exists: input.observed.exists,
+          configured: input.observed.exists,
+          ready: input.observed.status !== "error",
+          verified: input.observed.exists && input.observed.status !== "error",
+          observed: input.observed.live
+        }));
+      }
+      return summarizeVerification(input.unit.unitId, checks, input.observed.warnings);
+    },
+    destroy(input) {
+      return genericResult({
+        ...input,
+        diff: { action: "delete", reasons: ["selected capacity provider for destroy"], before: input.observed.live, after: {} }
+      });
+    }
+  };
+}
+function recordValue(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function nonEmptyString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : "";
+}
+function localTreeDxProjects(value) {
+  return Array.isArray(value) ? value.flatMap((entry) => {
+    const record = recordValue(entry);
+    const slug = nonEmptyString(record.slug);
+    const repositoryName = nonEmptyString(record.repositoryName);
+    const repositoryId = nonEmptyString(record.repositoryId) || repositoryName;
+    const localRoot = nonEmptyString(record.localRoot);
+    const contentPath = nonEmptyString(record.contentPath);
+    if (!slug || !repositoryName || !repositoryId || !localRoot || !contentPath) return [];
+    return [{
+      projectKey: nonEmptyString(record.projectKey) || void 0,
+      slug,
+      repositoryName,
+      repositoryId,
+      localRoot,
+      contentPath,
+      defaultRef: nonEmptyString(record.defaultRef) || "refs/heads/main",
+      seedPaths: Array.isArray(record.seedPaths) ? record.seedPaths.filter((item) => typeof item === "string" && item.trim().length > 0) : []
+    }];
+  }) : [];
+}
+function base64urlJson(value) {
+  return Buffer.from(JSON.stringify(value)).toString("base64url");
+}
+function mintLocalTreeDxJwt(auth) {
+  const secret = nonEmptyString(auth.TREESEED_TREEDX_JWT_HS256_SECRET);
+  const issuer = nonEmptyString(auth.TREESEED_TREEDX_JWT_ISSUER);
+  const audience = nonEmptyString(auth.TREESEED_TREEDX_JWT_AUDIENCE);
+  if (!secret || !issuer || !audience) return "";
+  const now = Math.floor(Date.now() / 1e3);
+  const actorId = nonEmptyString(auth.TREESEED_TREEDX_PROXY_ACTOR_ID) || "treeseed-sdk-reconciler";
+  const tenantId = nonEmptyString(auth.TREESEED_TREEDX_PROXY_TENANT_ID) || "treeseed-control-plane";
+  const payload = {
+    iss: issuer,
+    aud: audience,
+    sub: actorId,
+    jti: randomUUID(),
+    iat: now,
+    nbf: now - 5,
+    exp: now + 3600,
+    treedx_actor_id: actorId,
+    treedx_tenant_id: tenantId,
+    treedx_repo_ids: ["*"],
+    treedx_capabilities: ["*"],
+    treedx_refs: ["*"],
+    treedx_paths: ["**"]
+  };
+  const signingInput = `${base64urlJson({ alg: "HS256", typ: "JWT" })}.${base64urlJson(payload)}`;
+  const signature = createHmac("sha256", secret).update(signingInput).digest("base64url");
+  return `${signingInput}.${signature}`;
+}
+async function listLocalTreeDxSeedFiles(project) {
+  const paths = project.seedPaths?.length ? project.seedPaths : [project.contentPath];
+  const files = [];
+  const visit = async (absoluteDir, root) => {
+    if (!existsSync(absoluteDir)) return;
+    for (const entry of await readdir(absoluteDir, { withFileTypes: true })) {
+      const absolutePath = resolve(absoluteDir, entry.name);
+      if (entry.isDirectory()) {
+        await visit(absolutePath, root);
+      } else if (entry.isFile() && /\.(md|mdx)$/iu.test(entry.name)) {
+        files.push({
+          path: relative(root, absolutePath).replace(/\\/gu, "/"),
+          content: await readFile(absolutePath, "utf8")
+        });
+      }
+    }
+  };
+  for (const seedPath of paths) {
+    await visit(resolve(project.localRoot, seedPath), project.localRoot);
+  }
+  return files.sort((left, right) => left.path.localeCompare(right.path));
+}
+async function ensureLocalTreeDxProjectRepository(client, project) {
+  const repositories = recordValue(await client.repositories.list()).repos;
+  const existing = Array.isArray(repositories) ? repositories.find((entry) => recordValue(entry).repositoryName === project.repositoryName || recordValue(entry).name === project.repositoryName) : null;
+  const existingRepoId = nonEmptyString(recordValue(existing).repoId);
+  if (existingRepoId) return { repoId: existingRepoId, created: false };
+  const registered = recordValue(await client.repositories.register({
+    name: project.repositoryName,
+    repositoryName: project.repositoryName,
+    createIfMissing: true,
+    defaultRef: project.defaultRef ?? "refs/heads/main"
+  }));
+  const repo = recordValue(registered.repo);
+  const repoId = nonEmptyString(repo.repoId);
+  if (!repoId) throw new Error(`TreeDX did not return a repository id for ${project.repositoryName}.`);
+  return { repoId, created: true };
+}
+async function syncLocalTreeDxProjectContent(client, project) {
+  const files = await listLocalTreeDxSeedFiles(project);
+  const repository = await ensureLocalTreeDxProjectRepository(client, project);
+  if (files.length === 0) {
+    return { project: project.slug, repositoryId: repository.repoId, repositoryName: project.repositoryName, files: 0, committed: false };
+  }
+  const workspace = recordValue(await client.request({
+    method: "POST",
+    path: `/api/v1/repos/${encodeURIComponent(repository.repoId)}/workspaces`,
+    body: {
+      baseRef: project.defaultRef ?? "refs/heads/main",
+      branchName: `refs/heads/treeseed-local-sync/${project.slug}/${Date.now().toString(36)}`,
+      mode: "writable",
+      allowedPaths: [`${project.contentPath.replace(/\/+$/u, "")}/**`],
+      ttlSeconds: 900
+    }
+  }));
+  const workspaceId = nonEmptyString(workspace.workspaceId);
+  if (!workspaceId) throw new Error(`TreeDX did not return a workspace id for ${project.slug}.`);
+  try {
+    for (const file of files) {
+      await client.request({
+        method: "PUT",
+        path: `/api/v1/workspaces/${encodeURIComponent(workspaceId)}/files`,
+        query: { path: file.path },
+        body: { content: file.content, encoding: "utf8" }
+      });
+    }
+    const commit = recordValue(await client.request({
+      method: "POST",
+      path: `/api/v1/workspaces/${encodeURIComponent(workspaceId)}/commit`,
+      body: {
+        message: `Sync ${project.slug} knowledge hub seed content`,
+        author: { name: "TreeSeed Reconciler", email: "reconciler@treeseed.local" }
+      }
+    }));
+    const graphRefresh = recordValue(await client.request({
+      method: "POST",
+      path: `/api/v1/repos/${encodeURIComponent(repository.repoId)}/graph/refresh`,
+      body: {
+        paths: project.seedPaths?.length ? project.seedPaths.map((seedPath) => `${seedPath.replace(/\/+$/u, "")}/**`) : [`${project.contentPath.replace(/\/+$/u, "")}/**`]
+      }
+    }).catch((error) => ({
+      error: error instanceof Error ? error.message : String(error)
+    })));
+    return {
+      project: project.slug,
+      repositoryId: repository.repoId,
+      repositoryName: project.repositoryName,
+      files: files.length,
+      committed: true,
+      commitSha: nonEmptyString(commit.commitSha) || null,
+      graphRefresh
+    };
+  } finally {
+    await client.request({ method: "POST", path: `/api/v1/workspaces/${encodeURIComponent(workspaceId)}/close`, body: {} }).catch(() => null);
+  }
+}
+async function ensureLocalTreeDxProjectRepositoryRef(client, project) {
+  const repository = await ensureLocalTreeDxProjectRepository(client, project);
   return {
-    exists: true,
-    status: "ready",
-    live: {
-      unitId: input.unit.unitId,
-      dependencies: input.unit.dependencies
-    },
-    locators: {},
-    warnings: []
+    project: project.slug,
+    repositoryId: repository.repoId,
+    repositoryName: project.repositoryName,
+    files: 0,
+    committed: false,
+    skippedContentSync: true
   };
 }
-function noopDiff() {
+function buildLocalTreeDxAdapter() {
   return {
-    action: "noop",
-    reasons: ["composite unit"],
-    before: {},
-    after: {}
+    providerId: "local",
+    unitTypes: ["local-treedx"],
+    supports(unitType, providerId) {
+      return unitType === "local-treedx" && providerId === "local";
+    },
+    refresh(input) {
+      return {
+        ...genericObservedState(input),
+        live: {
+          ...input.unit.spec,
+          dependencies: input.unit.dependencies
+        }
+      };
+    },
+    diff(input) {
+      const projects = localTreeDxProjects(input.unit.spec.projects);
+      if (projects.length === 0) return noopDiff();
+      return {
+        action: "update",
+        reasons: ["local TreeDX project content repositories must be registered and seeded through TreeDX"],
+        before: input.observed.live,
+        after: input.unit.spec
+      };
+    },
+    async apply(input) {
+      if (input.diff.action === "noop" || input.diff.action === "blocked") return genericResult(input);
+      const baseUrl = nonEmptyString(input.unit.spec.baseUrl);
+      const token = nonEmptyString(input.unit.spec.token) || mintLocalTreeDxJwt(recordValue(input.unit.spec.auth));
+      const projects = localTreeDxProjects(input.unit.spec.projects);
+      if (!baseUrl || !token || projects.length === 0) return genericResult(input);
+      const client = new TreeDxClient({ baseUrl, token });
+      const syncedProjects = [];
+      const syncSeedContent = input.unit.spec.syncSeedContent !== false;
+      for (const project of projects) {
+        syncedProjects.push(syncSeedContent ? await syncLocalTreeDxProjectContent(client, project) : await ensureLocalTreeDxProjectRepositoryRef(client, project));
+      }
+      return genericResult(input, { ...input.observed.live, syncedProjects });
+    },
+    async verify(input) {
+      const dependencyResults = input.context.session.get("treeseed:verification-results");
+      const dependencyChecks = input.unit.dependencies.map((dependency) => {
+        const verification = dependencyResults?.get(dependency);
+        const ok = verification ? verification.verified === true : true;
+        return verificationCheck(`dependency:${dependency}`, `TreeDX dependency ${dependency} is verified`, "derived", {
+          exists: ok,
+          configured: ok,
+          ready: ok,
+          verified: ok,
+          observed: verification ?? null,
+          issues: ok ? [] : [`Dependency ${dependency} is not verified.`]
+        });
+      });
+      const healthEndpoint = typeof input.unit.spec.healthEndpoint === "string" ? input.unit.spec.healthEndpoint : null;
+      if (healthEndpoint) {
+        const health = await checkHttpHealth(healthEndpoint);
+        dependencyChecks.push(verificationCheck("treedx-health", `TreeDX health endpoint ${healthEndpoint} responds`, "api", {
+          exists: health.ok,
+          configured: true,
+          ready: health.ok,
+          verified: health.ok,
+          observed: health,
+          issues: health.ok ? [] : [`TreeDX health endpoint ${healthEndpoint} did not respond successfully.`]
+        }));
+      }
+      const contentIsTreeDx = input.unit.spec.contentRepositoryAccessMode === "treedx";
+      const siteIsFilesystem = input.unit.spec.siteRepositoryAccessMode === "filesystem";
+      const projectIsFilesystem = input.unit.spec.projectRepositoryAccessMode === "filesystem";
+      const topologyChecks = [
+        verificationCheck("content-repository-plane", "Content repositories use TreeDX by default", "derived", {
+          exists: true,
+          configured: contentIsTreeDx,
+          ready: contentIsTreeDx,
+          verified: contentIsTreeDx,
+          observed: input.unit.spec.contentRepositoryAccessMode,
+          issues: contentIsTreeDx ? [] : ["Content repository access mode is not treedx."]
+        }),
+        verificationCheck("site-repository-plane", "Project site repositories use local filesystem/worktrees by default", "derived", {
+          exists: true,
+          configured: siteIsFilesystem,
+          ready: siteIsFilesystem,
+          verified: siteIsFilesystem,
+          observed: input.unit.spec.siteRepositoryAccessMode,
+          issues: siteIsFilesystem ? [] : ["Site repository access mode is not filesystem."]
+        }),
+        verificationCheck("project-repository-plane", "Super-project repositories use local filesystem/worktrees by default", "derived", {
+          exists: true,
+          configured: projectIsFilesystem,
+          ready: projectIsFilesystem,
+          verified: projectIsFilesystem,
+          observed: input.unit.spec.projectRepositoryAccessMode,
+          issues: projectIsFilesystem ? [] : ["Project repository access mode is not filesystem."]
+        })
+      ];
+      const repositoryChecks = [];
+      const baseUrl = nonEmptyString(input.unit.spec.baseUrl);
+      const token = nonEmptyString(input.unit.spec.token) || mintLocalTreeDxJwt(recordValue(input.unit.spec.auth));
+      if (baseUrl && token) {
+        const client = new TreeDxClient({ baseUrl, token });
+        let repositories = [];
+        try {
+          const list = recordValue(await client.repositories.list()).repos;
+          repositories = Array.isArray(list) ? list : [];
+        } catch {
+          repositories = [];
+        }
+        for (const project of localTreeDxProjects(input.unit.spec.projects)) {
+          const repo = repositories.find((entry) => {
+            const record = recordValue(entry);
+            return record.repositoryName === project.repositoryName || record.name === project.repositoryName;
+          });
+          if (repo) {
+            repositoryChecks.push(verificationCheck(`treedx-repo:${project.slug}`, `TreeDX repository ${project.repositoryId} is registered`, "api", {
+              exists: true,
+              configured: true,
+              ready: true,
+              verified: true,
+              observed: repo
+            }));
+          } else {
+            repositoryChecks.push(verificationCheck(`treedx-repo:${project.slug}`, `TreeDX repository ${project.repositoryId} is registered`, "api", {
+              exists: false,
+              configured: true,
+              ready: false,
+              verified: false,
+              observed: { repositoryName: project.repositoryName },
+              issues: [`TreeDX repository ${project.repositoryId} is not registered.`]
+            }));
+          }
+        }
+      }
+      return summarizeVerification(input.unit.unitId, [...dependencyChecks, ...topologyChecks, ...repositoryChecks], input.observed.warnings);
+    },
+    destroy(input) {
+      return genericResult({
+        ...input,
+        diff: { action: "delete", reasons: ["selected local TreeDX topology for destroy"], before: input.observed.live, after: {} }
+      });
+    }
   };
 }
-function buildCompositeAdapter(unitType) {
+function buildReleaseGateAdapter() {
+  const unitTypes = [
+    "release-gate:verify",
+    "release-gate:template-verify",
+    "release-gate:template-release-record",
+    "release-gate:npm-publish",
+    "release-gate:image-publish",
+    "release-gate:hosted-reconcile",
+    "release-gate:live-verify",
+    "release-gate:candidate-record",
+    "release-gate:production-record"
+  ];
   return {
     providerId: "treeseed",
-    unitTypes: [unitType],
-    supports(candidateUnitType, providerId) {
-      return candidateUnitType === unitType && providerId === "treeseed";
+    unitTypes,
+    supports(unitType, providerId) {
+      return providerId === "treeseed" && unitTypes.includes(unitType);
     },
     refresh(input) {
-      return noopObservedState(input);
+      const fingerprint = typeof input.unit.spec.fingerprint === "string" ? input.unit.spec.fingerprint : null;
+      const previousFingerprint = typeof input.persistedState?.lastReconciledState?.fingerprint === "string" ? input.persistedState.lastReconciledState.fingerprint : null;
+      return {
+        ...genericObservedState(input),
+        status: fingerprint && previousFingerprint === fingerprint ? "ready" : "pending",
+        live: {
+          ...input.unit.spec,
+          previousFingerprint,
+          fingerprint
+        }
+      };
     },
-    diff() {
-      return noopDiff();
+    diff(input) {
+      return input.observed.status === "ready" ? noopDiff() : { action: "update", reasons: ["release gate fingerprint has not been reconciled"], before: input.observed.live, after: input.unit.spec };
     },
-    requiredPostconditions({ unit }) {
-      return unit.dependencies.map((dependency) => ({
-        key: dependency,
-        description: `Dependency ${dependency} is verified`
-      }));
+    async apply(input) {
+      if (input.diff.action === "noop") return genericResult(input);
+      const gateKind = String(input.unit.spec.gateKind ?? input.unit.unitType);
+      const packageId = typeof input.unit.spec.packageId === "string" ? input.unit.spec.packageId : null;
+      const templateId = typeof input.unit.spec.templateId === "string" ? input.unit.spec.templateId : null;
+      if (process.env.TREESEED_WORKFLOW_RELEASE_GATES_MODE === "skip") {
+        return genericResult(input, {
+          ...input.observed.live,
+          gateKind,
+          packageId,
+          templateId,
+          skipped: true,
+          reason: "disabled",
+          fingerprint: input.unit.spec.fingerprint
+        });
+      }
+      if (gateKind === "release-gate:verify" && packageId) {
+        const verify = await runReleaseVerifyCommand({ tenantRoot: input.context.tenantRoot, packageId, env: input.context.launchEnv });
+        if (verify.ok !== true) {
+          throw new Error([verify.stderr, verify.stdout].filter(Boolean).join("\n").trim() || `${packageId} release verification failed`);
+        }
+        return genericResult(input, { ...input.observed.live, verify, fingerprint: input.unit.spec.fingerprint });
+      }
+      if (gateKind === "release-gate:template-verify" && templateId) {
+        const verify = runTemplateReleaseVerifyCommand({ tenantRoot: input.context.tenantRoot, templateId, env: input.context.launchEnv });
+        if (verify.ok !== true) {
+          throw new Error([verify.stderr, verify.stdout].filter(Boolean).join("\n").trim() || `${templateId} template release verification failed`);
+        }
+        return genericResult(input, { ...input.observed.live, verify, fingerprint: input.unit.spec.fingerprint });
+      }
+      if (gateKind === "release-gate:template-release-record" && templateId) {
+        const releaseTag = typeof input.unit.spec.releaseTag === "string" ? input.unit.spec.releaseTag : null;
+        const tag = releaseTag && input.context.target.kind === "persistent" && input.context.target.scope === "prod" ? ensureTemplateReleaseTag({ tenantRoot: input.context.tenantRoot, templateId, tagName: releaseTag }) : null;
+        const recordPath = typeof input.unit.spec.recordPath === "string" ? input.unit.spec.recordPath : `.treeseed/templates/${templateId}/latest-release.json`;
+        const template = checkedOutTemplateRepositories(input.context.tenantRoot).find((candidate) => candidate.templateManifest?.id === templateId);
+        const record = writeReleaseRecord({
+          tenantRoot: input.context.tenantRoot,
+          recordPath,
+          record: {
+            schemaVersion: 1,
+            kind: gateKind,
+            templateId,
+            releaseTag,
+            tag,
+            environment: input.unit.spec.environment ?? null,
+            version: template?.templateManifest?.version ?? null,
+            recordedAt: nowIso()
+          }
+        });
+        return genericResult(input, { ...input.observed.live, record, tag, fingerprint: input.unit.spec.fingerprint });
+      }
+      if ((gateKind === "release-gate:npm-publish" || gateKind === "release-gate:image-publish") && packageId) {
+        const adapter = findTreeseedPackageAdapter(input.context.tenantRoot, packageId);
+        const repository = typeof adapter?.metadata.repository === "string" ? adapter.metadata.repository : null;
+        if (!repository) {
+          throw new Error(`${packageId} does not declare a GitHub repository.`);
+        }
+        const workflow = gateKind === "release-gate:image-publish" ? workflowName(adapter?.metadata.developmentImageWorkflow, "publish.yml") : workflowName(adapter?.metadata.hostedVerifyWorkflow, "publish.yml");
+        const dispatch = await dispatchReconcileGitHubWorkflow({
+          repository,
+          workflow,
+          branch: input.context.target.kind === "persistent" && input.context.target.scope === "prod" ? "main" : "staging",
+          inputs: {},
+          wait: input.context.target.kind === "persistent" && input.context.target.scope === "prod",
+          env: buildGitHubEnv(input)
+        });
+        return genericResult(input, { ...input.observed.live, dispatch, fingerprint: input.unit.spec.fingerprint });
+      }
+      if (gateKind === "release-gate:hosted-reconcile") {
+        const environment = input.unit.spec.environment === "prod" ? "prod" : "staging";
+        const selector = typeof input.unit.spec.hostedSelector === "object" && input.unit.spec.hostedSelector ? input.unit.spec.hostedSelector : { environment, provider: ["cloudflare", "railway", "github", "dockerhub"] };
+        const nested = await runHostedReconcileGate({
+          parentContext: input.context,
+          selector,
+          target: { kind: "persistent", scope: environment },
+          dryRun: input.context.dryRun === true
+        });
+        return genericResult(input, { ...input.observed.live, nested, fingerprint: input.unit.spec.fingerprint });
+      }
+      if (gateKind === "release-gate:live-verify") {
+        const environment = input.unit.spec.environment === "prod" ? "prod" : "staging";
+        const selector = typeof input.unit.spec.hostedSelector === "object" && input.unit.spec.hostedSelector ? input.unit.spec.hostedSelector : { environment, provider: ["cloudflare", "railway", "github", "dockerhub"] };
+        const status = await runHostedVerifyGate({
+          parentContext: input.context,
+          selector,
+          target: { kind: "persistent", scope: environment }
+        });
+        if (!status.ready) {
+          throw new Error(`Hosted live verification failed for ${environment}: ${status.blockers.join("\n")}`);
+        }
+        return genericResult(input, { ...input.observed.live, status, fingerprint: input.unit.spec.fingerprint });
+      }
+      if (gateKind === "release-gate:candidate-record" || gateKind === "release-gate:production-record") {
+        const recordPath = typeof input.unit.spec.recordPath === "string" ? input.unit.spec.recordPath : gateKind === "release-gate:production-record" ? ".treeseed/workflow/releases/latest-production.json" : ".treeseed/workflow/release-candidates/latest-staging.json";
+        const record = writeReleaseRecord({
+          tenantRoot: input.context.tenantRoot,
+          recordPath,
+          record: {
+            schemaVersion: 1,
+            kind: gateKind,
+            unitId: input.unit.unitId,
+            fingerprint: input.unit.spec.fingerprint ?? null,
+            environment: input.unit.spec.environment ?? null,
+            recordedAt: nowIso()
+          }
+        });
+        return genericResult(input, { ...input.observed.live, record, fingerprint: input.unit.spec.fingerprint });
+      }
+      return genericResult(input, { ...input.observed.live, fingerprint: input.unit.spec.fingerprint });
     },
-    apply({ unit, observed, diff }) {
+    verify(input) {
+      const dependencyResults = input.context.session.get("treeseed:verification-results");
+      const dependencyChecks = input.unit.dependencies.map((dependency) => {
+        const verification = dependencyResults?.get(dependency);
+        const ok = verification?.verified === true;
+        return verificationCheck(`dependency:${dependency}`, `Release gate dependency ${dependency} passed`, "derived", {
+          exists: ok,
+          configured: ok,
+          ready: ok,
+          verified: ok,
+          observed: verification ?? null,
+          issues: ok ? [] : [`Dependency ${dependency} is not verified.`]
+        });
+      });
+      const ownCheck = verificationCheck("release-gate", "Release gate reconciled its fingerprint", "sdk", {
+        exists: true,
+        configured: true,
+        ready: input.result?.state?.fingerprint === input.unit.spec.fingerprint || input.diff.action === "noop",
+        verified: input.result?.state?.fingerprint === input.unit.spec.fingerprint || input.diff.action === "noop",
+        expected: input.unit.spec.fingerprint ?? null,
+        observed: input.result?.state?.fingerprint ?? input.observed.live.previousFingerprint ?? null
+      });
+      return summarizeVerification(input.unit.unitId, [...dependencyChecks, ownCheck], input.observed.warnings);
+    }
+  };
+}
+function workflowFingerprint(input) {
+  return JSON.stringify({
+    unitId: input.unit.unitId,
+    unitType: input.unit.unitType,
+    spec: input.unit.spec,
+    dependencies: input.unit.dependencies
+  });
+}
+function buildWorkflowMetaAdapter() {
+  const unitTypes = [
+    "branch-preview",
+    "branch-preview-cleanup",
+    "workflow-gate",
+    "save-gate:local-verify",
+    "save-gate:promotion-readiness",
+    "save-gate:hosted-verify"
+  ];
+  return {
+    providerId: "treeseed",
+    unitTypes,
+    supports(unitType, providerId) {
+      return providerId === "treeseed" && unitTypes.includes(unitType);
+    },
+    refresh(input) {
+      const fingerprint = workflowFingerprint(input);
+      const previousFingerprint = typeof input.persistedState?.lastReconciledState?.fingerprint === "string" ? input.persistedState.lastReconciledState.fingerprint : null;
       return {
-        unit,
-        observed,
-        diff,
-        action: diff.action,
-        warnings: [],
-        resourceLocators: {},
-        state: {
-          unitId: unit.unitId,
-          reconciledAt: nowIso()
-        },
-        verification: null
+        ...genericObservedState(input),
+        status: previousFingerprint === fingerprint ? "ready" : "pending",
+        live: {
+          ...input.unit.spec,
+          fingerprint,
+          previousFingerprint
+        }
       };
     },
-    verify({ context, unit, postconditions }) {
-      const dependencyResults = context.session.get("treeseed:verification-results");
-      const checks = postconditions.map((condition) => {
-        const dependency = dependencyResults?.get(condition.key);
-        const verified = dependency?.verified === true;
-        return {
-          key: condition.key,
-          description: condition.description,
-          source: "derived",
-          exists: verified,
-          configured: verified,
-          ready: verified,
-          verified,
-          expected: true,
-          observed: dependency?.verified ?? false,
-          issues: verified ? [] : [`Dependency ${condition.key} is not verified.`]
-        };
-      });
-      return summarizeVerification(unit.unitId, checks);
+    diff(input) {
+      return input.observed.status === "ready" ? noopDiff() : { action: input.unit.unitType === "branch-preview-cleanup" ? "delete" : "update", reasons: [`${input.unit.unitType} fingerprint has not been reconciled`], before: input.observed.live, after: input.unit.spec };
+    },
+    async apply(input) {
+      if (input.diff.action === "noop") return genericResult(input);
+      const fingerprint = workflowFingerprint(input);
+      if (input.unit.unitType === "branch-preview") {
+        const selector = typeof input.unit.spec.resources === "object" && input.unit.spec.resources ? input.unit.spec.resources : { environment: "staging", appId: [String(input.unit.spec.appId ?? "web")] };
+        const nested = await runHostedReconcileGate({
+          parentContext: input.context,
+          selector,
+          target: input.context.target,
+          dryRun: input.context.dryRun === true
+        });
+        return genericResult(input, { ...input.observed.live, nested, fingerprint });
+      }
+      if (input.unit.unitType === "save-gate:hosted-verify") {
+        const selector = typeof input.unit.spec.selector === "object" && input.unit.spec.selector ? input.unit.spec.selector : { environment: input.context.target.kind === "persistent" ? input.context.target.scope : "staging" };
+        const status = await runHostedVerifyGate({
+          parentContext: input.context,
+          selector,
+          target: input.context.target
+        });
+        if (!status.ready) {
+          throw new Error(`Save hosted verification failed: ${status.blockers.join("\n")}`);
+        }
+        return genericResult(input, { ...input.observed.live, status, fingerprint });
+      }
+      return genericResult(input, { ...input.observed.live, fingerprint });
+    },
+    verify(input) {
+      const fingerprint = workflowFingerprint(input);
+      const observedFingerprint = typeof input.observed.live.fingerprint === "string" ? input.observed.live.fingerprint : null;
+      return summarizeVerification(input.unit.unitId, [
+        verificationCheck("workflow-meta-fingerprint", `${input.unit.unitType} fingerprint is reconciled`, "derived", {
+          exists: true,
+          configured: observedFingerprint === fingerprint,
+          ready: observedFingerprint === fingerprint,
+          verified: observedFingerprint === fingerprint,
+          expected: fingerprint,
+          observed: observedFingerprint,
+          issues: observedFingerprint === fingerprint ? [] : [`Expected fingerprint ${fingerprint}, observed ${observedFingerprint ?? "none"}.`]
+        })
+      ], input.observed.warnings);
+    },
+    destroy(input) {
+      return genericResult({
+        ...input,
+        diff: { action: "delete", reasons: [`selected ${input.unit.unitType} for destroy`], before: input.observed.live, after: {} }
+      }, { ...input.observed.live, destroyedAt: nowIso(), fingerprint: workflowFingerprint(input) });
     }
   };
 }
@@ -179,27 +1952,38 @@ function normalizeEnvironmentValues(env) {
 }
 function resolveReconcileEnvironmentValues(input, scope) {
   if (scope === "local") {
-    return resolveTreeseedMachineEnvironmentValues(input.context.tenantRoot, scope);
+    return normalizeEnvironmentValues(resolveTreeseedMachineEnvironmentValues(input.context.tenantRoot, scope));
   }
-  const hostedRuntimeValues = {
+  return {
     ...normalizeEnvironmentValues(process.env),
     ...normalizeEnvironmentValues(input.context.launchEnv)
   };
-  if (hostedRuntimeValues.CLOUDFLARE_API_TOKEN || hostedRuntimeValues.RAILWAY_API_TOKEN || hostedRuntimeValues.GH_TOKEN) {
-    return hostedRuntimeValues;
-  }
-  const values = {
-    ...resolveTreeseedMachineEnvironmentValues(input.context.tenantRoot, scope),
-    ...hostedRuntimeValues
-  };
-  return values;
 }
 function buildCloudflareEnv(input) {
   const scope = scopeFromTarget(toDeployTarget(input.context.target));
   const values = resolveReconcileEnvironmentValues(input, scope);
+  let accountId = [
+    values.TREESEED_CLOUDFLARE_ACCOUNT_ID,
+    input.context.launchEnv.TREESEED_CLOUDFLARE_ACCOUNT_ID,
+    process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID,
+    resolveConfiguredCloudflareAccountId(input.context.deployConfig)
+  ].find((value) => typeof value === "string" && value.trim().length > 0 && value.trim() !== "replace-with-cloudflare-account-id")?.trim() ?? "";
+  let token = [
+    values.TREESEED_CLOUDFLARE_API_TOKEN,
+    input.context.launchEnv.TREESEED_CLOUDFLARE_API_TOKEN,
+    process.env.TREESEED_CLOUDFLARE_API_TOKEN
+  ].find((value) => typeof value === "string" && value.trim().length > 0)?.trim() ?? "";
+  if (scope !== "local" && (!accountId || !token)) {
+    const configuredValues = normalizeEnvironmentValues(resolveTreeseedMachineEnvironmentValues(input.context.tenantRoot, scope));
+    accountId = accountId || ([
+      configuredValues.TREESEED_CLOUDFLARE_ACCOUNT_ID,
+      resolveConfiguredCloudflareAccountId(input.context.deployConfig)
+    ].find((value) => typeof value === "string" && value.trim().length > 0 && value.trim() !== "replace-with-cloudflare-account-id")?.trim() ?? "");
+    token = token || (configuredValues.TREESEED_CLOUDFLARE_API_TOKEN ?? "");
+  }
   return {
-    CLOUDFLARE_ACCOUNT_ID: values.CLOUDFLARE_ACCOUNT_ID ?? input.context.launchEnv.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? resolveConfiguredCloudflareAccountId(input.context.deployConfig),
-    CLOUDFLARE_API_TOKEN: values.CLOUDFLARE_API_TOKEN ?? input.context.launchEnv.CLOUDFLARE_API_TOKEN ?? process.env.CLOUDFLARE_API_TOKEN ?? ""
+    CLOUDFLARE_ACCOUNT_ID: accountId,
+    CLOUDFLARE_API_TOKEN: token
   };
 }
 function hasLiveResourceId(value) {
@@ -207,15 +1991,24 @@ function hasLiveResourceId(value) {
 }
 function buildRailwayEnv(input, scope) {
   const values = resolveReconcileEnvironmentValues(input, scope);
-  const token = [
-    values.RAILWAY_API_TOKEN,
-    input.context.launchEnv.RAILWAY_API_TOKEN,
-    process.env.RAILWAY_API_TOKEN
+  let token = [
+    values.TREESEED_RAILWAY_API_TOKEN,
+    input.context.launchEnv.TREESEED_RAILWAY_API_TOKEN,
+    process.env.TREESEED_RAILWAY_API_TOKEN
   ].find((value) => typeof value === "string" && value.trim().length > 0)?.trim() ?? "";
+  let railwayApiUrl = values.TREESEED_RAILWAY_API_URL ?? input.context.launchEnv.TREESEED_RAILWAY_API_URL ?? process.env.TREESEED_RAILWAY_API_URL ?? "";
+  let railwayWorkspace = values.TREESEED_RAILWAY_WORKSPACE ?? input.context.launchEnv.TREESEED_RAILWAY_WORKSPACE ?? process.env.TREESEED_RAILWAY_WORKSPACE ?? "";
+  if (scope !== "local" && !token) {
+    const configuredValues = normalizeEnvironmentValues(resolveTreeseedMachineEnvironmentValues(input.context.tenantRoot, scope));
+    token = configuredValues.TREESEED_RAILWAY_API_TOKEN ?? "";
+    railwayApiUrl = railwayApiUrl || (configuredValues.TREESEED_RAILWAY_API_URL ?? "");
+    railwayWorkspace = railwayWorkspace || (configuredValues.TREESEED_RAILWAY_WORKSPACE ?? "");
+  }
   return {
+    TREESEED_RAILWAY_API_TOKEN: token,
     RAILWAY_API_TOKEN: token,
-    TREESEED_RAILWAY_API_URL: values.TREESEED_RAILWAY_API_URL ?? input.context.launchEnv.TREESEED_RAILWAY_API_URL ?? process.env.TREESEED_RAILWAY_API_URL ?? "",
-    TREESEED_RAILWAY_WORKSPACE: values.TREESEED_RAILWAY_WORKSPACE ?? input.context.launchEnv.TREESEED_RAILWAY_WORKSPACE ?? process.env.TREESEED_RAILWAY_WORKSPACE ?? ""
+    TREESEED_RAILWAY_API_URL: railwayApiUrl,
+    TREESEED_RAILWAY_WORKSPACE: railwayWorkspace
   };
 }
 function findCloudflareQueueByName(input, env, expectedName, { attempts = 6, delayMs = 350 } = {}) {
@@ -492,6 +2285,8 @@ function normalizeRailwayDomainPayload(value) {
   }
   const record = value;
   const status = record.status && typeof record.status === "object" ? record.status : {};
+  const certificate = record.certificate && typeof record.certificate === "object" ? record.certificate : status.certificate && typeof status.certificate === "object" ? status.certificate : {};
+  const verification = record.verification && typeof record.verification === "object" ? record.verification : status.verification && typeof status.verification === "object" ? status.verification : {};
   const domain = typeof record.domain === "string" ? record.domain.trim() : typeof record.name === "string" ? record.name.trim() : "";
   const serviceDomain = firstRailwayDomainString(
     record.serviceDomain,
@@ -530,9 +2325,14 @@ function normalizeRailwayDomainPayload(value) {
     id: typeof record.id === "string" ? record.id.trim() : null,
     domain,
     serviceDomain,
-    certificateStatus: typeof status.certificateStatus === "string" ? String(status.certificateStatus).trim().toUpperCase() : null,
-    verificationDnsHost: typeof record.verificationDnsHost === "string" ? record.verificationDnsHost.trim() : typeof status.verificationDnsHost === "string" ? String(status.verificationDnsHost).trim() : null,
-    verificationToken: typeof record.verificationToken === "string" ? record.verificationToken.trim() : typeof status.verificationToken === "string" ? String(status.verificationToken).trim() : null,
+    verified: record.verified === true || status.verified === true || verification.verified === true,
+    certificateStatus: firstRailwayDomainString(
+      record.certificateStatus,
+      status.certificateStatus,
+      certificate.status
+    )?.toUpperCase() ?? null,
+    verificationDnsHost: typeof record.verificationDnsHost === "string" ? record.verificationDnsHost.trim() : typeof status.verificationDnsHost === "string" ? String(status.verificationDnsHost).trim() : typeof verification.dnsHost === "string" ? String(verification.dnsHost).trim() : null,
+    verificationToken: typeof record.verificationToken === "string" ? record.verificationToken.trim() : typeof status.verificationToken === "string" ? String(status.verificationToken).trim() : typeof verification.token === "string" ? String(verification.token).trim() : null,
     dnsRecords: effectiveDnsRecords
   };
 }
@@ -589,7 +2389,7 @@ function collectCloudflareEnvironmentSync(input) {
         secretNames.add(entry.id);
       }
     }
-    if (entry.targets.includes("cloudflare-var") && value) {
+    if (entry.targets.includes("cloudflare-var") && value && entry.id !== "TREESEED_PROJECT_DOMAINS") {
       vars[entry.id] = value;
       varNames.add(entry.id);
     }
@@ -810,61 +2610,6 @@ function reconcileCloudflareTarget(input, { dryRun = false } = {}) {
     current.databaseId = created.uuid;
     current.previewDatabaseId = created.previewDatabaseUuid ?? created.uuid;
   };
-  const ensureQueue = () => {
-    const current = state.queues?.agentWork;
-    if (!current?.name) {
-      return;
-    }
-    const liveQueue = findCloudflareQueueByName(input, env, current.name, { attempts: 1, delayMs: 0 });
-    const liveDlq = current.dlqName ? findCloudflareQueueByName(input, env, current.dlqName, { attempts: 1, delayMs: 0 }) : null;
-    if (liveQueue) {
-      current.queueId = queueId(liveQueue);
-      current.dlqId = current.dlqName ? queueId(liveDlq) : null;
-      return;
-    }
-    let refreshedQueues = queues;
-    const existing = refreshedQueues.find((entry) => queueName(entry) === current.name);
-    if (existing) {
-      current.queueId = queueId(existing);
-      const existingDlq = current.dlqName ? refreshedQueues.find((entry) => queueName(entry) === current.dlqName) : null;
-      current.dlqId = queueId(existingDlq);
-      return;
-    }
-    if (dryRun) {
-      current.queueId = `dryrun-${current.name}`;
-      current.dlqId = current.dlqName ? `dryrun-${current.dlqName}` : null;
-      return;
-    }
-    try {
-      runWrangler(["queues", "create", current.name], {
-        cwd: input.context.tenantRoot,
-        capture: true,
-        env
-      });
-    } catch (error) {
-      if (!isWranglerAlreadyExistsError(error, [/Queue name .* is already taken/i, /\[code:\s*11009\]/i])) {
-        throw error;
-      }
-    }
-    refreshedQueues = listQueues(input.context.tenantRoot, env);
-    if (current.dlqName && !refreshedQueues.find((entry) => queueName(entry) === current.dlqName)) {
-      try {
-        runWrangler(["queues", "create", current.dlqName], {
-          cwd: input.context.tenantRoot,
-          capture: true,
-          env
-        });
-      } catch (error) {
-        if (!isWranglerAlreadyExistsError(error, [/Queue name .* is already taken/i, /\[code:\s*11009\]/i])) {
-          throw error;
-        }
-      }
-    }
-    const created = findCloudflareQueueByName(input, env, current.name);
-    current.queueId = created ? queueId(created) : syntheticQueueLocator(current.name);
-    const createdDlq = current.dlqName ? findCloudflareQueueByName(input, env, current.dlqName) : null;
-    current.dlqId = current.dlqName ? createdDlq ? queueId(createdDlq) : syntheticQueueLocator(current.dlqName) : null;
-  };
   const ensureR2Bucket = () => {
     const bucketName = state.content?.bucketName;
     if (!bucketName) {
@@ -983,7 +2728,6 @@ function reconcileCloudflareTarget(input, { dryRun = false } = {}) {
   };
   runStep("kv-form-guard", () => ensureKv("FORM_GUARD_KV"));
   runStep("d1", ensureD1);
-  runStep("queue", ensureQueue);
   runStep("r2", ensureR2Bucket);
   runStep("pages", ensurePagesProject);
   runStep("turnstile-widget", ensureTurnstileWidget);
@@ -1029,20 +2773,19 @@ function observeCloudflareUnit(input) {
   const { state, kvNamespaces, d1Databases, queues, buckets, pagesProjects, turnstileWidgets } = snapshot;
   switch (input.unit.unitType) {
     case "queue": {
-      const liveQueue = queues.find((entry) => queueName(entry) === state.queues?.agentWork?.name);
-      const liveDlq = queues.find((entry) => queueName(entry) === state.queues?.agentWork?.dlqName);
+      const name = input.unit.spec.name;
+      const dlqName = input.unit.spec.dlqName;
+      const liveQueue = queues.find((entry) => queueName(entry) === name);
+      const liveDlq = dlqName ? queues.find((entry) => queueName(entry) === dlqName) : null;
       return {
-        exists: Boolean(liveQueue || state.queues?.agentWork?.queueId),
+        exists: Boolean(liveQueue),
         status: liveQueue ? "ready" : "pending",
-        live: { ...state.queues?.agentWork ?? {} },
+        live: { name, dlqName },
         locators: {
-          queueId: queueId(liveQueue) ?? state.queues?.agentWork?.queueId ?? null,
-          dlqId: queueId(liveDlq) ?? state.queues?.agentWork?.dlqId ?? null
+          queueId: queueId(liveQueue) ?? null,
+          dlqId: queueId(liveDlq) ?? null
         },
-        warnings: [
-          ...isSyntheticQueueLocator(state.queues?.agentWork?.queueId) ? ["Cloudflare queue id is pending propagation; using queue-name fallback."] : [],
-          ...isSyntheticQueueLocator(state.queues?.agentWork?.dlqId) ? ["Cloudflare dead-letter queue id is pending propagation; using queue-name fallback."] : []
-        ]
+        warnings: []
       };
     }
     case "database": {
@@ -1132,7 +2875,7 @@ function verifyCloudflareUnitOnce(input, postconditions) {
   const { state, kvNamespaces, d1Databases, queues, buckets, pagesProjects, turnstileWidgets, env } = snapshot;
   switch (input.unit.unitType) {
     case "queue": {
-      const queue = state.queues?.agentWork;
+      const queue = input.unit.spec;
       const liveQueue = findCloudflareQueueByName(input, env, queue?.name, { attempts: 12, delayMs: 500 });
       const liveDlq = queue?.dlqName ? findCloudflareQueueByName(input, env, queue.dlqName, { attempts: 12, delayMs: 500 }) : null;
       return summarizeVerification(input.unit.unitId, [
@@ -1505,6 +3248,10 @@ function relativeRailwayRootDir(tenantRoot, serviceRoot) {
   return !resolved || resolved === "" ? "." : resolved;
 }
 function railwayServiceRootDirectory(tenantRoot, service) {
+  const sourceRootDirectory = String(service.sourceRootDirectory ?? "").trim();
+  if (sourceRootDirectory) {
+    return sourceRootDirectory;
+  }
   return relativeRailwayRootDir(service.application?.root ?? tenantRoot, service.rootDir);
 }
 function configuredMarketDatabaseService(tenantRoot, deployConfig) {
@@ -1555,6 +3302,7 @@ async function ensureRailwayEnvironmentForService({
 }
 async function resolveRailwayTopologyForScope(input, scope, {
   ensure = false,
+  ensureServices = ensure,
   refresh = false,
   serviceKeys,
   includeInstances = ensure,
@@ -1571,17 +3319,23 @@ async function resolveRailwayTopologyForScope(input, scope, {
     const knownProjects = [];
     const knownProjectIds = [...new Set(services.map((service) => service.projectId || deployState.services?.[service.key]?.projectId || "").filter((value) => typeof value === "string" && value.trim().length > 0).map((value) => value.trim()))];
     for (const projectId of knownProjectIds) {
+      traceRailwayReconcile(env, "topology:known-project:get", projectId);
       const project = await getRailwayProject({ projectId, env });
+      traceRailwayReconcile(env, "topology:known-project:done", `${projectId}:${project?.name ?? "(missing)"}`);
       if (project) {
         knownProjects.push(project);
       }
     }
     if (knownProjects.length === 0 || services.some((service) => !(service.projectId || deployState.services?.[service.key]?.projectId))) {
+      traceRailwayReconcile(env, "topology:workspace:get", "start");
       workspace = await resolveRailwayWorkspaceContext({ env });
+      traceRailwayReconcile(env, "topology:workspace:done", workspace.name);
+      traceRailwayReconcile(env, "topology:projects:list", workspace.name);
       const listedProjects = await listRailwayProjects({
         env,
         workspaceId: workspace.id
       });
+      traceRailwayReconcile(env, "topology:projects:list:done", String(listedProjects.length));
       for (const project of listedProjects) {
         if (!knownProjects.find((entry) => entry?.id === project.id)) {
           knownProjects.push(project);
@@ -1608,6 +3362,17 @@ async function resolveRailwayTopologyForScope(input, scope, {
       const resolvedServiceId = service.serviceId ?? persistedService.serviceId ?? "";
       const resolvedServiceName = service.serviceName ?? persistedService.serviceName ?? "";
       let project = projectsByKey.get(resolvedProjectId) ?? projectsByKey.get(resolvedProjectName) ?? null;
+      if (project && (!Array.isArray(project.services) || project.services.length === 0 || !Array.isArray(project.environments) || project.environments.length === 0)) {
+        const hydratedProject = await getRailwayProject({ projectId: project.id, env });
+        if (hydratedProject) {
+          project = hydratedProject;
+          projectsByKey.set(project.id, project);
+          projectsByKey.set(project.name, project);
+        }
+      }
+      if (project) {
+        traceRailwayReconcile(env, "topology:project:resolved", `${service.key}:${project.name}:services=${project.services.map((entry) => entry.name).join(",") || "(none)"}:envs=${project.environments.map((entry) => entry.name).join(",") || "(none)"}`);
+      }
       if (!project && ensure) {
         if (!workspace) {
           traceRailwayReconcile(env, "topology:workspace", "resolving workspace");
@@ -1626,6 +3391,9 @@ async function resolveRailwayTopologyForScope(input, scope, {
         projectsByKey.set(project.name, project);
       }
       let environment = project?.environments.find((entry) => entry.name === service.railwayEnvironment || entry.id === service.railwayEnvironment) ?? null;
+      if (project) {
+        traceRailwayReconcile(env, "topology:environment:resolved", `${service.key}:${environment?.name ?? "(none)"}:${service.railwayEnvironment}`);
+      }
       if (project && !environment && ensure) {
         traceRailwayReconcile(env, "topology:environment:ensure", `${service.key}:${service.railwayEnvironment}`);
         environment = await ensureRailwayEnvironmentForService({
@@ -1641,13 +3409,30 @@ async function resolveRailwayTopologyForScope(input, scope, {
         projectsByKey.set(project.id, project);
         projectsByKey.set(project.name, project);
       }
+      if (project && environment && (!Array.isArray(project.services) || project.services.length === 0 || !project.services.some((entry) => entry.id === resolvedServiceId || entry.name === resolvedServiceName))) {
+        const environmentServices = await listRailwayEnvironmentServices({ environmentId: environment.id, env }).catch(() => []);
+        traceRailwayReconcile(env, "topology:environment-services:lookup", `${service.key}:${environment.name}:${environmentServices.map((entry) => entry.name).join(",") || "(none)"}`);
+        if (environmentServices.length > 0) {
+          project = {
+            ...project,
+            services: [...new Map([...project.services, ...environmentServices].map((entry) => [entry.id, entry])).values()]
+          };
+          projectsByKey.set(project.id, project);
+          projectsByKey.set(project.name, project);
+          traceRailwayReconcile(env, "topology:environment-services:resolved", `${service.key}:${environmentServices.map((entry) => entry.name).join(",")}`);
+        }
+      }
       let resolvedService = project?.services.find((entry) => entry.id === resolvedServiceId || entry.name === resolvedServiceName) ?? null;
-      if (project && !resolvedService && ensure) {
+      if (project && !resolvedService && ensureServices) {
         traceRailwayReconcile(env, "topology:railway-service:ensure", `${service.key}:${resolvedServiceName || resolvedServiceId}`);
         resolvedService = (await ensureRailwayService({
           projectId: project.id,
           serviceId: resolvedServiceId,
           serviceName: resolvedServiceName,
+          environmentId: environment?.id,
+          imageRef: service.imageRef,
+          sourceRepo: service.sourceRepo,
+          sourceBranch: service.sourceBranch,
           env
         })).service;
         project = {
@@ -1656,17 +3441,37 @@ async function resolveRailwayTopologyForScope(input, scope, {
         };
         projectsByKey.set(project.id, project);
         projectsByKey.set(project.name, project);
+      } else if (project && resolvedService && ensureServices && (service.imageRef || service.sourceRepo)) {
+        traceRailwayReconcile(env, "topology:railway-service:repair-source", `${service.key}:${resolvedService.name}`);
+        try {
+          resolvedService = (await ensureRailwayService({
+            projectId: project.id,
+            serviceId: resolvedService.id,
+            serviceName: resolvedServiceName || resolvedService.name,
+            environmentId: environment?.id,
+            imageRef: service.imageRef,
+            sourceRepo: service.sourceRepo,
+            sourceBranch: service.sourceBranch,
+            env
+          })).service;
+        } catch (error) {
+          if (!looksLikeRailwayExistingSourceRepairUnsupported(error)) {
+            throw error;
+          }
+          traceRailwayReconcile(env, "topology:railway-service:repair-source-skipped", `${service.key}:${resolvedService.name}`);
+        }
       }
       let instance = null;
       if (includeInstances && resolvedService && environment) {
-        if (ensure) {
+        if (ensureServices) {
           traceRailwayReconcile(env, "topology:instance:ensure", `${service.key}:${resolvedService.name}`);
           instance = (await ensureRailwayServiceInstanceConfiguration({
             serviceId: resolvedService.id,
             environmentId: environment.id,
             buildCommand: service.buildCommand,
+            dockerfilePath: !service.imageRef ? service.dockerfilePath ?? (existsSync(resolve(service.rootDir, "Dockerfile")) ? "/Dockerfile" : null) : null,
             startCommand: service.startCommand,
-            rootDirectory: railwayServiceRootDirectory(input.context.tenantRoot, service),
+            rootDirectory: service.imageRef || service.sourceMode === "image" ? null : railwayServiceRootDirectory(input.context.tenantRoot, service),
             healthcheckPath: service.healthcheckPath,
             healthcheckTimeoutSeconds: service.healthcheckTimeoutSeconds,
             healthcheckIntervalSeconds: service.healthcheckIntervalSeconds,
@@ -1733,36 +3538,113 @@ function activeRailwayVolumeInstances(volume) {
   const instances = Array.isArray(volume.instances) ? volume.instances : [];
   return instances.filter((instance) => {
     const state = String(instance.state ?? "READY").toUpperCase();
-    return state !== "DELETING" && state !== "DELETED";
+    const pendingDeletion = "isPendingDeletion" in instance && instance.isPendingDeletion === true;
+    const deletedAt = "deletedAt" in instance && typeof instance.deletedAt === "string" && instance.deletedAt.trim();
+    return !pendingDeletion && !deletedAt && state !== "DELETING" && state !== "DELETED";
   });
 }
-async function waitForRailwayServiceDeleted({
-  projectId,
-  serviceId,
-  env
-}) {
-  for (let attempt = 0; attempt < 10; attempt += 1) {
-    const services = await listRailwayServices({ projectId, env }).catch(() => []);
-    if (!services.some((service) => service.id === serviceId)) {
-      return true;
+function isRailwayCapacityProviderService(service) {
+  return String(service.key ?? "").startsWith("capacityProvider");
+}
+function railwayServiceMatchesKey(service, key) {
+  return service.key === key || service.instanceKey === key || service.serviceName === key || service.serviceId === key;
+}
+function configuredRailwayProjectSyncGroups(input, scope, serviceKeys) {
+  const allServices = configuredRailwayServices(input.context.tenantRoot, scope).filter((service) => service.enabled !== false).filter((service) => !isRailwayCapacityProviderService(service));
+  const selected = Array.isArray(serviceKeys) && serviceKeys.length > 0 ? allServices.filter((service) => serviceKeys.some((key) => railwayServiceMatchesKey(service, key))) : allServices;
+  const selectedProjectKeys = new Set(selected.map((service) => `${service.projectName}:::${service.railwayEnvironment}`));
+  const grouped = /* @__PURE__ */ new Map();
+  for (const service of allServices) {
+    const key = `${service.projectName}:::${service.railwayEnvironment}`;
+    if (!selectedProjectKeys.has(key)) {
+      continue;
     }
-    await new Promise((resolve2) => setTimeout(resolve2, 1500));
+    const services = grouped.get(key) ?? [];
+    services.push(service);
+    grouped.set(key, services);
   }
-  return false;
+  return [...grouped.values()];
 }
-async function waitForRailwayVolumeDeleted({
-  projectId,
-  volumeId,
-  env
-}) {
-  for (let attempt = 0; attempt < 10; attempt += 1) {
-    const volumes = await listRailwayVolumes({ projectId, env }).catch(() => []);
-    if (!volumes.some((volume) => volume.id === volumeId)) {
-      return true;
+function railwayIacServiceInput(input, sync, service, scope) {
+  if (scope === "staging" && service.imageRef) {
+    throw new Error(`Railway staging service ${service.serviceName} must build from Git source, not Docker image ${service.imageRef}.`);
+  }
+  if (scope === "prod" && service.sourceMode === "git") {
+    throw new Error(`Railway production service ${service.serviceName} must deploy an immutable image, not Git source.`);
+  }
+  const serviceSync = sync.forService(service.key, service);
+  const deployVariablePrefix = service.serviceName.includes("treedx") || service.key.includes("treedx") ? "TREEDX" : "TREESEED";
+  const sourceVariables = service.sourceMode === "git" ? {
+    ...service.sourceRepo ? { [`${deployVariablePrefix}_DEPLOY_SOURCE_REPOSITORY`]: service.sourceRepo } : {},
+    ...service.sourceBranch ? { [`${deployVariablePrefix}_DEPLOY_SOURCE_BRANCH`]: service.sourceBranch } : {},
+    ...service.sourceCommit ? { [`${deployVariablePrefix}_DEPLOY_SOURCE_COMMIT`]: service.sourceCommit } : {}
+  } : {};
+  return {
+    key: service.instanceKey ?? service.key,
+    serviceName: service.serviceName,
+    sourceMode: service.sourceMode,
+    sourceRepo: service.sourceRepo,
+    sourceBranch: service.sourceBranch,
+    sourceCommit: service.sourceCommit,
+    sourceRootDirectory: service.sourceRootDirectory ?? railwayServiceRootDirectory(input.context.tenantRoot, service),
+    imageRef: service.imageRef,
+    dockerfilePath: service.dockerfilePath,
+    buildCommand: service.buildCommand,
+    startCommand: service.startCommand,
+    healthcheckPath: service.healthcheckPath,
+    healthcheckTimeoutSeconds: service.healthcheckTimeoutSeconds,
+    runtimeMode: service.runtimeMode,
+    volumeMountPath: service.volumeMountPath,
+    variables: {
+      ...serviceSync.variables,
+      ...sourceVariables
+    },
+    secrets: serviceSync.secrets
+  };
+}
+function configuredRailwayIacDatabase(input, projectServices, detachVolumeIds = []) {
+  if (!projectServices.some((service) => service.key === "api" || service.key === "operationsRunner")) {
+    return null;
+  }
+  const treeseedDatabase = configuredMarketDatabaseService(input.context.tenantRoot, input.context.deployConfig);
+  const treeseedDatabaseService = treeseedDatabase?.service;
+  if (!treeseedDatabaseService || treeseedDatabaseService.enabled === false || treeseedDatabaseService.provider !== "railway" || treeseedDatabaseService.railway?.resourceType !== "postgres") {
+    return null;
+  }
+  return {
+    serviceName: treeseedDatabase.serviceName,
+    environmentVariable: "TREESEED_DATABASE_URL",
+    mountPath: "/var/lib/postgresql/data",
+    detachVolumeIds
+  };
+}
+function activeAttachedRailwayVolumeIds(volumes, serviceId, environmentId, desiredVolumeName) {
+  if (!serviceId) {
+    return [];
+  }
+  return volumes.filter((volume) => volume.instances.some(
+    (instance) => instance.serviceId === serviceId && instance.environmentId === environmentId && (volume.name !== desiredVolumeName || activeRailwayVolumeInstances({ instances: [instance] }).length === 0)
+  )).map((volume) => volume.id);
+}
+function blockedPendingRailwayVolumeAttachments(volumes, serviceIdByName, environmentId) {
+  const serviceNameById = new Map([...serviceIdByName.entries()].filter(([, serviceId]) => serviceId).map(([serviceName, serviceId]) => [serviceId, serviceName]));
+  const blocked = [];
+  for (const volume of volumes) {
+    for (const instance of volume.instances) {
+      if (!instance.serviceId || instance.environmentId !== environmentId) {
+        continue;
+      }
+      const serviceName = serviceNameById.get(instance.serviceId);
+      if (!serviceName) {
+        continue;
+      }
+      if (activeRailwayVolumeInstances({ instances: [instance] }).length > 0) {
+        continue;
+      }
+      blocked.push(`${serviceName}: volume ${volume.name ?? volume.id} (${volume.id}) is pending/deleted while still attached to service ${instance.serviceId} at ${instance.mountPath ?? "(unknown mount)"}; deletedAt=${instance.deletedAt ?? "(none)"} state=${instance.state ?? "(unknown)"}`);
     }
-    await new Promise((resolve2) => setTimeout(resolve2, 1500));
   }
-  return false;
+  return blocked;
 }
 async function reconcileStaleOperationsRunnerResourcesForScope(input, topology) {
   const scope = input.context.target.kind === "persistent" ? input.context.target.scope : "staging";
@@ -1812,21 +3694,17 @@ async function reconcileStaleOperationsRunnerResourcesForProject(input, {
     `${project.name}: desired=${[...desiredServiceNames].join(",") || "(none)"} stale=${staleServices.map((service) => service.name).join(",") || "(none)"}`
   );
   for (const service of staleServices) {
-    traceRailwayReconcile(env, "sync:runner:delete-stale-service", `${service.name}:${service.id}`);
-    await deleteRailwayService({ serviceId: service.id, env });
-    const deleted = await waitForRailwayServiceDeleted({ projectId: project.id, serviceId: service.id, env });
-    if (!deleted) {
-      recordRailwayProviderDrift(input, scope, {
-        kind: "railway.stale-operations-runner-service",
-        action: "delete",
-        status: "blocked",
-        projectId: project.id,
-        environmentId: environment.id,
-        serviceId: service.id,
-        serviceName: service.name,
-        reason: "Railway still reports the stale operations runner service after delete reconciliation."
-      });
-    }
+    traceRailwayReconcile(env, "sync:runner:block-stale-service", `${service.name}:${service.id}`);
+    recordRailwayProviderDrift(input, scope, {
+      kind: "railway.stale-operations-runner-service",
+      action: "manual-repair-required",
+      status: "blocked",
+      projectId: project.id,
+      environmentId: environment.id,
+      serviceId: service.id,
+      serviceName: service.name,
+      reason: "Railway reports an undeclared operations runner service. Reconciliation refuses to delete existing services; adopt, rename, retain, or remove it through an explicit destroy workflow."
+    });
   }
   const volumes = await listRailwayVolumes({ projectId: project.id, env }).catch(() => []);
   const staleVolumes = findStaleTreeseedOperationsRunnerResources(volumes, desiredVolumeNames).filter((volume) => {
@@ -1836,101 +3714,384 @@ async function reconcileStaleOperationsRunnerResourcesForProject(input, {
   traceRailwayReconcile(
     env,
     "sync:runner:observed-volumes",
-    `${project.name}: desired=${[...desiredVolumeNames].join(",") || "(none)"} stale=${staleVolumes.map((volume) => volume.name ?? volume.id).join(",") || "(none)"}`
-  );
-  for (const volume of staleVolumes) {
-    traceRailwayReconcile(env, "sync:runner:delete-stale-volume", `${volume.name ?? volume.id}:${volume.id}`);
-    await deleteRailwayVolume({ volumeId: volume.id, env });
-    const deleted = await waitForRailwayVolumeDeleted({ projectId: project.id, volumeId: volume.id, env });
-    if (!deleted) {
-      recordRailwayProviderDrift(input, scope, {
-        kind: "railway.stale-operations-runner-volume",
-        action: "delete",
-        status: "blocked",
-        projectId: project.id,
-        environmentId: environment.id,
-        volumeId: volume.id,
-        volumeName: volume.name ?? null,
-        reason: "Railway still reports the stale operations runner volume after delete reconciliation."
-      });
-    }
+    `${project.name}: desired=${[...desiredVolumeNames].join(",") || "(none)"} stale=${staleVolumes.map((volume) => volume.name ?? volume.id).join(",") || "(none)"}`
+  );
+  for (const volume of staleVolumes) {
+    traceRailwayReconcile(env, "sync:runner:block-stale-volume", `${volume.name ?? volume.id}:${volume.id}`);
+    recordRailwayProviderDrift(input, scope, {
+      kind: "railway.stale-operations-runner-volume",
+      action: "manual-repair-required",
+      status: "blocked",
+      projectId: project.id,
+      environmentId: environment.id,
+      volumeId: volume.id,
+      volumeName: volume.name ?? null,
+      reason: "Railway reports an undeclared operations runner volume. Reconciliation refuses destructive cleanup during repair; adopt, retain, or remove it through an explicit destroy workflow."
+    });
   }
 }
-async function syncRailwayEnvironmentForScope(input, { dryRun = false } = {}) {
+async function syncRailwayEnvironmentForScope(input, { dryRun = false, serviceKeys } = {}) {
   const scope = input.context.target.kind === "persistent" ? input.context.target.scope : "staging";
   const sync = collectRailwayEnvironmentSync(input);
+  const selectedServiceKeys = Array.isArray(serviceKeys) && serviceKeys.length > 0 ? [...new Set(serviceKeys.map((value) => String(value).trim()).filter(Boolean))] : void 0;
   traceRailwayReconcile(input.context.env, "sync:start", `scope=${scope} dryRun=${dryRun ? "yes" : "no"}`);
-  const topology = await resolveRailwayTopologyForScope(input, scope, {
-    ensure: !dryRun,
-    includeInstances: !dryRun,
-    includeVariables: false
-  });
-  traceRailwayReconcile(topology.env, "sync:topology", `services=${[...topology.services.keys()].join(",")}`);
-  if (!dryRun) {
-    traceRailwayReconcile(topology.env, "sync:postgres:start", "ensuring Treeseed database");
-    await ensureRailwayMarketDatabaseForScope(input, topology);
-    traceRailwayReconcile(topology.env, "sync:postgres:done", "Treeseed database ensured");
-    for (const entry of topology.services.values()) {
-      if (!entry.project || !entry.environment || !entry.service) {
-        continue;
+  const projectGroups = configuredRailwayProjectSyncGroups(input, scope, selectedServiceKeys);
+  if (projectGroups.length === 0) {
+    return {
+      scope,
+      services: [],
+      secrets: Object.keys(sync.secrets),
+      variables: Object.keys(sync.variables),
+      dryRun,
+      workspace: ""
+    };
+  }
+  let workspace = "";
+  const syncedServices = [];
+  for (const projectServices of projectGroups) {
+    const serviceKeySet = [...new Set(projectServices.map((service) => service.key))];
+    const topology = await resolveRailwayTopologyForScope(input, scope, {
+      ensure: !dryRun,
+      ensureServices: false,
+      serviceKeys: serviceKeySet,
+      includeInstances: false,
+      includeVariables: false,
+      refresh: true
+    });
+    workspace = topology.workspace.name;
+    const resolvedEntry = [...topology.services.values()].find((entry) => entry.project && entry.environment) ?? null;
+    const project = resolvedEntry?.project;
+    const environment = resolvedEntry?.environment;
+    traceRailwayReconcile(topology.env, "sync:topology", `project-services=${projectServices.map((service) => service.serviceName).join(",")}`);
+    if (dryRun) {
+      syncedServices.push(...projectServices);
+      continue;
+    }
+    if (!project || !environment) {
+      throw new Error(`Railway IaC reconciliation could not resolve project/environment for ${projectServices[0]?.projectName ?? "(unknown project)"}/${projectServices[0]?.railwayEnvironment ?? "(unknown environment)"}.`);
+    }
+    const liveServices = await listRailwayEnvironmentServices({ environmentId: environment.id, env: topology.env }).catch(() => project.services);
+    const liveServiceByName = new Map(liveServices.map((service) => [service.name, service]));
+    const liveVolumes = await listRailwayVolumes({ projectId: project.id, env: topology.env }).catch(() => []);
+    const databaseDescriptor = configuredRailwayIacDatabase(input, projectServices);
+    const serviceIdByName = new Map(projectServices.map((service) => {
+      const liveService = liveServiceByName.get(service.serviceName) ?? project.services.find((candidate) => candidate.name === service.serviceName || candidate.id === service.serviceId) ?? null;
+      return [service.serviceName, liveService?.id ?? null];
+    }));
+    if (databaseDescriptor) {
+      const databaseLiveService2 = liveServiceByName.get(databaseDescriptor.serviceName) ?? project.services.find((candidate) => candidate.name === databaseDescriptor.serviceName) ?? null;
+      serviceIdByName.set(databaseDescriptor.serviceName, databaseLiveService2?.id ?? null);
+    }
+    const pendingVolumeBlocks = blockedPendingRailwayVolumeAttachments(liveVolumes, serviceIdByName, environment.id);
+    if (pendingVolumeBlocks.length > 0) {
+      for (const reason of pendingVolumeBlocks) {
+        recordRailwayProviderDrift(input, scope, {
+          kind: "railway.pending-volume-attachment",
+          action: "blocked",
+          status: "blocked",
+          projectId: project.id,
+          environmentId: environment.id,
+          reason
+        });
       }
-      traceRailwayReconcile(topology.env, "sync:variables", `${entry.configuredService.key}:${entry.service.name}`);
-      const serviceSync = sync.forService(entry.configuredService.key);
-      await upsertRailwayVariables({
-        projectId: entry.project.id,
-        environmentId: entry.environment.id,
-        serviceId: entry.service.id,
-        variables: {
-          ...serviceSync.variables,
-          ...serviceSync.secrets
-        },
-        env: topology.env
+      throw new Error(`Railway has pending-deletion volume attachments that block official IaC reconciliation. ${pendingVolumeBlocks.join("; ")}`);
+    }
+    const detachVolumeIdsByServiceName = new Map(projectServices.map((service) => {
+      const liveService = liveServiceByName.get(service.serviceName) ?? project.services.find((candidate) => candidate.name === service.serviceName || candidate.id === service.serviceId) ?? null;
+      return [
+        service.serviceName,
+        activeAttachedRailwayVolumeIds(liveVolumes, liveService?.id, environment.id, `${service.serviceName}-volume`)
+      ];
+    }));
+    const databaseLiveService = databaseDescriptor ? liveServiceByName.get(databaseDescriptor.serviceName) ?? project.services.find((candidate) => candidate.name === databaseDescriptor.serviceName) ?? null : null;
+    const databaseDetachVolumeIds = databaseDescriptor ? activeAttachedRailwayVolumeIds(liveVolumes, databaseLiveService?.id, environment.id, `${databaseDescriptor.serviceName}-volume`) : [];
+    const databaseForIac = databaseDescriptor ? { ...databaseDescriptor, detachVolumeIds: databaseDetachVolumeIds, useNativePostgres: Boolean(databaseLiveService) } : null;
+    const token = String(topology.env.TREESEED_RAILWAY_API_TOKEN ?? topology.env.RAILWAY_API_TOKEN ?? "").trim();
+    if (!token) {
+      throw new Error(`Railway IaC reconciliation requires TREESEED_RAILWAY_API_TOKEN for ${project.name}/${environment.name}.`);
+    }
+    const iacInput = {
+      tenantRoot: input.context.tenantRoot,
+      scope,
+      projectName: project.name,
+      projectId: project.id,
+      environmentName: environment.name,
+      environmentId: environment.id,
+      railwayApiToken: token,
+      railwayApiUrl: String(topology.env.TREESEED_RAILWAY_API_URL ?? topology.env.RAILWAY_API_URL ?? "").trim() || null,
+      services: projectServices.map((service) => ({
+        ...railwayIacServiceInput(input, sync, service, scope),
+        detachVolumeIds: detachVolumeIdsByServiceName.get(service.serviceName) ?? []
+      })),
+      database: databaseForIac
+    };
+    const {
+      applyRailwayIacProject,
+      cleanupRailwayIacRender,
+      planRailwayIacProject,
+      renderRailwayIacProject,
+      validateRailwayIacChangeSet
+    } = await import("./providers/railway-iac.js");
+    const rendered = renderRailwayIacProject(iacInput);
+    try {
+      traceRailwayReconcile(topology.env, "sync:iac-plan", `${project.name}/${environment.name}:${rendered.serviceNames.join(",")}:volumes=${rendered.volumeNames.join(",")}`);
+      const plan = await planRailwayIacProject(iacInput, rendered);
+      if (!plan.ok) {
+        const diagnostics = plan.diagnostics.map((entry) => entry.message).filter(Boolean).join("; ");
+        throw new Error(`Railway IaC plan failed for ${project.name}/${environment.name}${diagnostics ? `: ${diagnostics}` : "."}`);
+      }
+      const validation = validateRailwayIacChangeSet(plan.changeSet, {
+        services: rendered.serviceNames,
+        volumes: rendered.volumeNames,
+        database: rendered.databaseName,
+        scope
       });
-      if (entry.configuredService.volumeMountPath) {
-        const volumeName = `${entry.service.name}-volume`;
-        traceRailwayReconcile(topology.env, "sync:volume", `${entry.configuredService.key}:${volumeName}:${entry.configuredService.volumeMountPath}`);
-        const volume = await ensureRailwayServiceVolume({
-          projectId: entry.project.id,
-          environmentId: entry.environment.id,
-          serviceId: entry.service.id,
-          name: volumeName,
-          mountPath: entry.configuredService.volumeMountPath,
-          env: topology.env
-        });
-        if (volume.instance?.serviceId !== entry.service.id || volume.instance?.environmentId !== entry.environment.id || volume.instance?.mountPath !== entry.configuredService.volumeMountPath) {
-          throw new Error(`Railway API volume reconciliation did not mount ${volumeName} on ${entry.service.name} at ${entry.configuredService.volumeMountPath}.`);
-        }
+      if (!validation.ok) {
+        throw new Error(`Railway IaC plan rejected for ${project.name}/${environment.name}: ${validation.blockedReasons.join("; ")}`);
       }
-      if (entry.configuredService.key === "operationsRunner") {
-        const desiredServiceNames = new Set(configuredRailwayServices(input.context.tenantRoot, scope).filter((service) => service.key === "operationsRunner").filter((service) => service.enabled !== false).map((service) => service.serviceName).filter(Boolean));
-        if (entry.configuredService.serviceName) {
-          desiredServiceNames.add(entry.configuredService.serviceName);
-        }
-        const desiredVolumeNames = new Set([...desiredServiceNames].map((serviceName) => `${serviceName}-volume`));
-        if (desiredServiceNames.size > 0) {
-          await reconcileStaleOperationsRunnerResourcesForProject(input, {
-            scope,
-            env: topology.env,
-            project: entry.project,
-            environment: entry.environment,
-            desiredServiceNames,
-            desiredVolumeNames
-          });
-        }
+      const apply = await applyRailwayIacProject(iacInput, rendered);
+      if (!apply.ok) {
+        const diagnostics = apply.diagnostics.map((entry) => entry.message).filter(Boolean).join("; ");
+        throw new Error(`Railway IaC apply failed for ${project.name}/${environment.name}${diagnostics ? `: ${diagnostics}` : "."}`);
       }
+      syncedServices.push(...projectServices);
+    } finally {
+      cleanupRailwayIacRender(rendered);
     }
-    traceRailwayReconcile(topology.env, "sync:runner:cleanup-stale", "reconciling old operations runner resources");
-    await reconcileStaleOperationsRunnerResourcesForScope(input, topology);
   }
-  traceRailwayReconcile(topology.env, "sync:done", `scope=${scope}`);
+  traceRailwayReconcile(input.context.env, "sync:done", `scope=${scope}`);
   return {
     scope,
-    services: [...topology.services.values()].map((entry) => entry.configuredService),
+    services: syncedServices,
     secrets: Object.keys(sync.secrets),
     variables: Object.keys(sync.variables),
     dryRun,
-    workspace: topology.workspace.name
+    workspace
+  };
+}
+function shouldDeployRailwayServiceBySourceUpload(scope, service) {
+  return scope === "staging" && service.sourceMode === "git" && Boolean(service.sourceRepo) && !service.dockerfilePath && service.key !== "capacityProviderManager" && service.key !== "capacityProviderRunner" && !service.imageRef;
+}
+function deployRailwayServiceBySourceUpload(input, entry, env, scope) {
+  if (!entry.project?.id || !entry.environment?.name || !entry.service?.name) {
+    throw new Error(`Railway source upload deploy requires resolved project, environment, and service for ${entry.configuredService.key}.`);
+  }
+  const rootDir = String(entry.configuredService.rootDir ?? "").trim();
+  if (!rootDir || !existsSync(rootDir)) {
+    throw new Error(`Railway source upload deploy root does not exist for ${entry.configuredService.key}: ${rootDir || "(unset)"}.`);
+  }
+  const uploadContext = prepareRailwaySourceUploadContext(input, entry.configuredService, rootDir);
+  const uploadRoot = uploadContext.rootDir;
+  const args = [
+    "trsd",
+    "railway",
+    "--environment",
+    scope,
+    "--",
+    "up",
+    "--service",
+    entry.service.name,
+    "--project",
+    entry.project.id,
+    "--environment",
+    entry.environment.name,
+    "--ci",
+    "--detach",
+    "--path-as-root",
+    ...uploadContext.noGitignore ? ["--no-gitignore"] : [],
+    "--verbose",
+    "--message",
+    `trsd staging source upload ${entry.configuredService.key}`,
+    uploadRoot
+  ];
+  const commandEnv = {
+    ...process.env,
+    ...env,
+    TREESEED_RECONCILE_TRACE: env.TREESEED_RECONCILE_TRACE ?? process.env.TREESEED_RECONCILE_TRACE
   };
+  try {
+    const result = spawnSync("npx", args, {
+      cwd: input.context.tenantRoot,
+      env: commandEnv,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      maxBuffer: 1024 * 1024 * 20
+    });
+    if ((result.status ?? 1) !== 0) {
+      const stderr = String(result.stderr ?? "").split("\n").slice(-120).join("\n");
+      const stdout = String(result.stdout ?? "").split("\n").slice(-120).join("\n");
+      throw new Error(`Railway source upload deploy failed for ${entry.configuredService.key} with status ${result.status ?? 1}.
+${stderr || stdout}`);
+    }
+  } finally {
+    if (uploadContext.cleanupDir) {
+      rmSync(uploadContext.cleanupDir, { recursive: true, force: true });
+    }
+  }
+}
+function prepareRailwaySourceUploadContext(input, service, rootDir) {
+  const role = service.key === "capacityProviderManager" ? "manager" : service.key === "capacityProviderRunner" ? "runner" : null;
+  if (!role) {
+    return { rootDir, cleanupDir: null, noGitignore: false };
+  }
+  const cleanupDir = mkdtempSync(resolve(tmpdir(), `trsd-railway-agent-${role}-`));
+  const contextRoot = resolve(cleanupDir, "context");
+  mkdirSync(contextRoot, { recursive: true });
+  for (const entry of ["src", "scripts", "templates", "docs"]) {
+    const source = resolve(rootDir, entry);
+    if (existsSync(source)) {
+      cpSync(source, resolve(contextRoot, entry), { recursive: true });
+    }
+  }
+  for (const entry of ["docker-entrypoint.sh", "package.json", "package-lock.json", "tsconfig.json", "tsconfig.dist.json"]) {
+    const source = resolve(rootDir, entry);
+    if (existsSync(source)) {
+      cpSync(source, resolve(contextRoot, entry));
+    }
+  }
+  const sdkRoot = resolve(rootDir, "..", "sdk");
+  let sdkTarballPrepared = false;
+  if (existsSync(resolve(sdkRoot, "package.json"))) {
+    const pack = spawnSync("npm", ["pack", "--ignore-scripts", "--pack-destination", contextRoot], {
+      cwd: sdkRoot,
+      env: process.env,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      maxBuffer: 1024 * 1024 * 20
+    });
+    if ((pack.status ?? 1) !== 0) {
+      const stderr = String(pack.stderr ?? "").split("\n").slice(-80).join("\n");
+      const stdout = String(pack.stdout ?? "").split("\n").slice(-80).join("\n");
+      throw new Error(`Failed to pack local SDK for Agent ${role} Railway source upload context.
+${stderr || stdout}`);
+    }
+    const filename = String(pack.stdout ?? "").split(/\r?\n/u).map((line) => line.trim()).filter(Boolean).at(-1);
+    if (!filename || !existsSync(resolve(contextRoot, filename))) {
+      throw new Error(`Local SDK pack did not produce a tarball for Agent ${role} Railway source upload context.`);
+    }
+    cpSync(resolve(contextRoot, filename), resolve(contextRoot, "treeseed-sdk.tgz"));
+    if (filename !== "treeseed-sdk.tgz") {
+      rmSync(resolve(contextRoot, filename), { force: true });
+    }
+    sdkTarballPrepared = true;
+  }
+  const dockerfile = [
+    "FROM node:22-alpine AS builder",
+    "WORKDIR /app",
+    "RUN apk add --no-cache ca-certificates git openssh-client",
+    sdkTarballPrepared ? "COPY package.json package-lock.json treeseed-sdk.tgz ./" : "COPY package.json package-lock.json ./",
+    sdkTarballPrepared ? "RUN npm ci --include=dev --ignore-scripts \\\n	&& npm install --include=dev --ignore-scripts ./treeseed-sdk.tgz" : "RUN npm ci --include=dev --ignore-scripts",
+    "COPY . .",
+    "RUN npm run build:dist \\",
+    "	&& npm prune --omit=dev --ignore-scripts \\",
+    "	&& rm -rf node_modules/@github node_modules/@openai node_modules/@cloudflare node_modules/@railway \\",
+    "		node_modules/wrangler node_modules/miniflare node_modules/workerd \\",
+    "		node_modules/playwright node_modules/playwright-core node_modules/gpt-tokenizer \\",
+    "		node_modules/@remotion node_modules/remotion node_modules/@rspack \\",
+    "		node_modules/@repomix node_modules/repomix node_modules/@esbuild node_modules/esbuild \\",
+    "		node_modules/webpack node_modules/typescript node_modules/@mediabunny node_modules/mediabunny \\",
+    "		node_modules/web-tree-sitter node_modules/caniuse-lite node_modules/@img node_modules/@secretlint \\",
+    "		node_modules/lightningcss* node_modules/vite \\",
+    "	&& npm cache clean --force \\",
+    "	&& rm -rf src scripts test .git .github",
+    "FROM node:22-alpine AS runtime",
+    "WORKDIR /app",
+    "ENV NODE_ENV=production TREESEED_PROVIDER_DATA_DIR=/data",
+    "RUN apk add --no-cache ca-certificates tini util-linux git openssh-client \\",
+    "	&& mkdir -p /data",
+    "COPY --from=builder --chown=65532:65532 /app/package.json /app/package-lock.json ./",
+    "COPY --from=builder --chown=65532:65532 /app/node_modules ./node_modules",
+    "COPY --from=builder --chown=65532:65532 /app/dist ./dist",
+    "COPY --from=builder --chown=65532:65532 /app/templates ./templates",
+    "COPY --from=builder --chown=65532:65532 /app/docs ./docs",
+    "COPY --from=builder --chown=65532:65532 /app/docker-entrypoint.sh ./docker-entrypoint.sh",
+    "RUN chmod 0755 /app/docker-entrypoint.sh \\",
+    "	&& chown -R 65532:65532 /data",
+    "EXPOSE 3100",
+    'ENTRYPOINT ["tini", "--", "/app/docker-entrypoint.sh"]',
+    `ENV TREESEED_PROVIDER_ROLE=${role}`,
+    `CMD ["${role}"]`,
+    ""
+  ].join("\n");
+  writeFileSync(
+    resolve(contextRoot, "Dockerfile"),
+    dockerfile
+  );
+  return { rootDir: contextRoot, cleanupDir, noGitignore: true };
+}
+async function deployRailwayServiceInstanceWithSourceRepair(entry, env) {
+  if (!entry.environment || !entry.service) {
+    return;
+  }
+  const deploy = () => deployRailwayServiceInstance({
+    serviceId: entry.service.id,
+    environmentId: entry.environment.id,
+    env
+  });
+  if (entry.configuredService.sourceMode === "git" && entry.configuredService.sourceRepo && !entry.configuredService.imageRef) {
+    await repairRailwayServiceSource(entry, env);
+  }
+  try {
+    await deploy();
+    return;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error ?? "");
+    if (/Problem processing request/iu.test(message)) {
+      traceRailwayReconcile(env, "sync:deploy-skipped", `${entry.configuredService.key}:${entry.service.name}:problem-processing-request`);
+      return;
+    }
+    if (!/Deployment not found/iu.test(message)) {
+      throw error;
+    }
+  }
+  const repaired = await repairRailwayServiceSource(entry, env);
+  if (repaired) {
+    try {
+      await deploy();
+      return;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error ?? "");
+      if (/Problem processing request/iu.test(message)) {
+        traceRailwayReconcile(env, "sync:deploy-skipped", `${entry.configuredService.key}:${entry.service.name}:problem-processing-request`);
+        return;
+      }
+      if (!/Deployment not found/iu.test(message)) {
+        throw error;
+      }
+    }
+  }
+  throw new Error(
+    `Railway deployment for existing service ${entry.service.name} (${entry.service.id}) was not found; refusing to delete and recreate an existing service. Repair the service in place or restore a deployable service source before rerunning reconciliation.`
+  );
+}
+async function repairRailwayServiceSource(entry, env) {
+  if (!entry.service) {
+    return false;
+  }
+  const sourceRepo = String(entry.configuredService.sourceRepo ?? "").trim();
+  if (sourceRepo) {
+    await updateRailwayServiceGitSource({
+      serviceId: entry.service.id,
+      sourceRepo,
+      sourceBranch: entry.configuredService.sourceBranch,
+      env
+    });
+    return true;
+  }
+  const imageRef = String(entry.configuredService.imageRef ?? "").trim();
+  if (imageRef) {
+    await updateRailwayServiceImageSource({
+      serviceId: entry.service.id,
+      imageRef,
+      env
+    });
+    return true;
+  }
+  return false;
+}
+function looksLikeRailwayExistingSourceRepairUnsupported(error) {
+  const message = error instanceof Error ? error.message : String(error ?? "");
+  return /source update .*existing service|existing service .*source update|provider-supported .*source update|ServiceUpdateInput|Problem processing request|User does not have access to the repo/iu.test(message);
 }
 async function ensureRailwayMarketDatabaseForScope(input, topology) {
   const scope = input.context.target.kind === "persistent" ? input.context.target.scope : "staging";
@@ -1939,11 +4100,15 @@ async function ensureRailwayMarketDatabaseForScope(input, topology) {
   if (!treeseedDatabaseService || treeseedDatabaseService.enabled === false || treeseedDatabaseService.provider !== "railway" || treeseedDatabaseService.railway?.resourceType !== "postgres") {
     return;
   }
-  const firstService = [...topology.services.values()].find((entry) => entry.project && entry.environment);
+  const serviceName = treeseedDatabase.serviceName;
+  const firstService = [...topology.services.values()].find(
+    (entry) => entry.project && entry.environment && ["api", "operationsRunner"].includes(entry.configuredService.key)
+  );
   if (!firstService?.project || !firstService.environment) {
+    await reconcileAccidentalMarketDatabaseServices(input, topology, serviceName, null);
     return;
   }
-  const serviceName = treeseedDatabase.serviceName;
+  await reconcileAccidentalMarketDatabaseServices(input, topology, serviceName, firstService.project.id);
   let postgresService;
   try {
     postgresService = (await ensureRailwayPostgresService({
@@ -1968,12 +4133,12 @@ async function ensureRailwayMarketDatabaseForScope(input, topology) {
       mountPath: "/var/lib/postgresql/data",
       env: topology.env
     });
-    if (postgresVolume.volume.name !== `${serviceName}-volume`) {
-      throw new Error(`observed volume name ${postgresVolume.volume.name ?? "(unnamed)"}`);
+    if (postgresVolume.instance?.serviceId !== postgresService.id || postgresVolume.instance?.environmentId !== firstService.environment.id || postgresVolume.instance?.mountPath !== "/var/lib/postgresql/data") {
+      throw new Error(`observed volume ${postgresVolume.volume.name ?? postgresVolume.volume.id ?? "(unknown)"} is not attached to ${serviceName} at /var/lib/postgresql/data`);
     }
   } catch (error) {
     const detail = error instanceof Error ? error.message : String(error ?? "");
-    throw new Error(`Railway provider limitation while reconciling PostgreSQL volume name ${serviceName}-volume: ${detail}`);
+    throw new Error(`Railway provider limitation while reconciling PostgreSQL volume name for ${serviceName}: ${detail}`);
   }
   const services = await listRailwayServices({ projectId: firstService.project.id, env: topology.env });
   for (const service of services) {
@@ -1988,8 +4153,17 @@ async function ensureRailwayMarketDatabaseForScope(input, topology) {
     }).catch(() => ({}));
     const looksLikePostgres = typeof variables.DATABASE_URL === "string" && typeof variables.PGHOST === "string" && typeof variables.PGUSER === "string" && typeof variables.PGPASSWORD === "string";
     if (looksLikePostgres) {
-      traceRailwayReconcile(topology.env, "sync:postgres:delete-duplicate", `${service.name}:${service.id}`);
-      await deleteRailwayService({ serviceId: service.id, env: topology.env });
+      traceRailwayReconcile(topology.env, "sync:postgres:block-duplicate", `${service.name}:${service.id}`);
+      recordRailwayProviderDrift(input, scope, {
+        kind: "railway.duplicate-postgres-service",
+        action: "manual-repair-required",
+        status: "blocked",
+        projectId: firstService.project.id,
+        environmentId: firstService.environment.id,
+        serviceId: service.id,
+        serviceName: service.name,
+        reason: `Railway reports an extra PostgreSQL service in ${firstService.project.name}. Reconciliation refuses to delete existing services; adopt, retain, or remove it through an explicit destroy workflow.`
+      });
     }
   }
   const detachedPostgresVolumes = await listRailwayVolumes({
@@ -1997,36 +4171,29 @@ async function ensureRailwayMarketDatabaseForScope(input, topology) {
     env: topology.env
   });
   for (const volume of detachedPostgresVolumes) {
+    if (isRetainedRailwayDetachedPostgresVolume(volume.name)) {
+      traceRailwayReconcile(topology.env, "sync:postgres:retain-detached-volume", `${volume.name ?? volume.id}:${volume.id}`);
+      continue;
+    }
     const postgresInstances = volume.instances.filter(
       (instance) => instance.environmentId === firstService.environment?.id && instance.mountPath === "/var/lib/postgresql/data"
     );
+    const activePostgresInstances = postgresInstances.filter((instance) => Boolean(instance.serviceId));
     const attachedToCanonical = postgresInstances.some((instance) => instance.serviceId === postgresService.id);
     const detached = postgresInstances.length > 0 && postgresInstances.every((instance) => !instance.serviceId);
-    if (detached && !attachedToCanonical) {
-      traceRailwayReconcile(topology.env, "sync:postgres:delete-detached-volume", `${volume.name ?? volume.id}:${volume.id}`);
-      await deleteRailwayVolume({ volumeId: volume.id, env: topology.env });
-      let deleted = false;
-      for (let attempt = 0; attempt < 10; attempt += 1) {
-        await new Promise((resolve2) => setTimeout(resolve2, 3e3));
-        const refreshed = await listRailwayVolumes({
-          projectId: firstService.project.id,
-          env: topology.env
-        });
-        deleted = !refreshed.some((candidate) => candidate.id === volume.id);
-        if (deleted) break;
-      }
-      if (!deleted) {
-        recordRailwayProviderDrift(input, scope, {
-          kind: "railway.detached-postgres-volume",
-          action: "delete",
-          status: "blocked",
-          projectId: firstService.project.id,
-          environmentId: firstService.environment.id,
-          volumeId: volume.id,
-          volumeName: volume.name ?? null,
-          reason: "Railway still reports the detached PostgreSQL volume after delete reconciliation."
-        });
-      }
+    const detachedCanonicalVolume = volume.name === `${serviceName}-volume` && activePostgresInstances.length === 0;
+    if ((detached || detachedCanonicalVolume) && !attachedToCanonical) {
+      traceRailwayReconcile(topology.env, "sync:postgres:block-detached-volume", `${volume.name ?? volume.id}:${volume.id}`);
+      recordRailwayProviderDrift(input, scope, {
+        kind: "railway.detached-postgres-volume",
+        action: "manual-repair-required",
+        status: "blocked",
+        projectId: firstService.project.id,
+        environmentId: firstService.environment.id,
+        volumeId: volume.id,
+        volumeName: volume.name ?? null,
+        reason: "Railway reports a detached PostgreSQL volume. Reconciliation refuses destructive cleanup during repair; adopt, retain, or remove it through an explicit destroy workflow."
+      });
     }
   }
   for (let attempt = 0; attempt < 20; attempt += 1) {
@@ -2043,6 +4210,61 @@ async function ensureRailwayMarketDatabaseForScope(input, topology) {
     await new Promise((resolve2) => setTimeout(resolve2, 3e3));
   }
 }
+async function reconcileAccidentalMarketDatabaseServices(input, topology, serviceName, ownerProjectId) {
+  const scope = input.context.target.kind === "persistent" ? input.context.target.scope : "staging";
+  const projectEntries = [...topology.services.values()].filter((entry) => entry.project?.id && entry.environment?.id).map((entry) => ({ project: entry.project, environment: entry.environment }));
+  const projects = new Map(projectEntries.map((entry) => [entry.project.id, entry]));
+  for (const { project, environment } of projects.values()) {
+    if (ownerProjectId && project.id === ownerProjectId) {
+      continue;
+    }
+    const services = await listRailwayServices({ projectId: project.id, env: topology.env }).catch(() => []);
+    for (const service of services.filter((entry) => entry.name === serviceName)) {
+      traceRailwayReconcile(topology.env, "sync:postgres:block-accidental-service", `${project.name}:${service.name}:${service.id}`);
+      recordRailwayProviderDrift(input, scope, {
+        kind: "railway.accidental-market-database-service",
+        action: "manual-repair-required",
+        status: "blocked",
+        projectId: project.id,
+        environmentId: environment.id,
+        serviceId: service.id,
+        serviceName: service.name,
+        reason: `Railway reports undeclared Market database service ${service.name} in non-owner project ${project.name}. Reconciliation refuses to delete existing services; adopt, retain, or remove it through an explicit destroy workflow.`
+      });
+    }
+    const volumes = await listRailwayVolumes({ projectId: project.id, env: topology.env }).catch(() => []);
+    for (const volume of volumes) {
+      if (isRetainedRailwayDetachedPostgresVolume(volume.name)) {
+        continue;
+      }
+      const postgresInstances = volume.instances.filter(
+        (instance) => instance.environmentId === environment.id && instance.mountPath === "/var/lib/postgresql/data"
+      );
+      if (postgresInstances.length === 0) {
+        continue;
+      }
+      const activeServiceIds = new Set(services.map((service) => service.id));
+      const stillAttached = postgresInstances.some((instance) => instance.serviceId && activeServiceIds.has(instance.serviceId));
+      if (stillAttached) {
+        continue;
+      }
+      traceRailwayReconcile(topology.env, "sync:postgres:block-accidental-volume", `${project.name}:${volume.name ?? volume.id}:${volume.id}`);
+      recordRailwayProviderDrift(input, scope, {
+        kind: "railway.accidental-market-database-volume",
+        action: "manual-repair-required",
+        status: "blocked",
+        projectId: project.id,
+        environmentId: environment.id,
+        volumeId: volume.id,
+        volumeName: volume.name ?? null,
+        reason: `Railway reports undeclared Market database volume ${volume.name ?? volume.id} in non-owner project ${project.name}. Reconciliation refuses destructive cleanup during repair; adopt, retain, or remove it through an explicit destroy workflow.`
+      });
+    }
+  }
+}
+function isRetainedRailwayDetachedPostgresVolume(value) {
+  return String(value ?? "").trim().startsWith("retained-");
+}
 async function observeRailwayUnit(input, { refresh = false } = {}) {
   let attempt = 0;
   for (; ; ) {
@@ -2058,15 +4280,19 @@ async function observeRailwayUnit(input, { refresh = false } = {}) {
         includeVariables: false
       });
       const entry = topology.services.get(serviceKey) ?? null;
+      const configuredService = entry?.configuredService ?? null;
+      const usesPortableSource = Boolean(
+        configuredService?.imageRef || configuredService?.sourceMode === "git" && configuredService?.sourceRepo
+      );
       const configured = Boolean(
-        entry?.configuredService && (entry.configuredService.serviceName || entry.configuredService.serviceId) && (entry.configuredService.projectName || entry.configuredService.projectId) && existsSync(resolve(entry.configuredService.rootDir))
+        configuredService && (configuredService.serviceName || configuredService.serviceId) && (configuredService.projectName || configuredService.projectId) && (usesPortableSource || existsSync(resolve(configuredService.rootDir)))
       );
       return {
-        exists: Boolean(entry?.configuredService),
+        exists: Boolean(entry?.project && entry?.environment && entry?.service),
         status: entry?.project && entry?.environment && entry?.service && configured ? "ready" : "pending",
         live: {
           ...persisted ?? {},
-          ...entry?.configuredService ?? {},
+          ...configuredService ?? {},
           project: entry?.project ?? null,
           environment: entry?.environment ?? null,
           service: entry?.service ?? null,
@@ -2090,17 +4316,33 @@ async function observeRailwayUnit(input, { refresh = false } = {}) {
     }
   }
 }
-function collectRailwayEnvironmentSync(input) {
+function collectRailwayEnvironmentSync(input, valuesOverlay = {}) {
   const scope = input.context.target.kind === "persistent" ? input.context.target.scope : "staging";
-  const values = resolveReconcileEnvironmentValues(input, scope);
   const registry = collectTreeseedEnvironmentContext(input.context.tenantRoot);
+  const configuredServices = configuredRailwayServices(input.context.tenantRoot, scope);
+  const hasPublicTreeDxService = configuredServices.some((service) => service.key === "public-treedx-node-01" && service.enabled !== false);
+  const machineValues = hasPublicTreeDxService ? normalizeEnvironmentValues(resolveTreeseedMachineEnvironmentValues(input.context.tenantRoot, scope)) : {};
+  const baseValues = {
+    ...resolveReconcileEnvironmentValues(input, scope),
+    ...machineValues,
+    ...valuesOverlay
+  };
+  const values = {
+    ...baseValues,
+    ...ensurePublicTreeDxSecretsForRailwaySync(input, scope, baseValues, registry)
+  };
+  if (scope !== "local") {
+    sanitizeRemoteRailwayServiceUrls(input, scope, values);
+  }
   const state = loadDeployState(input.context.tenantRoot, input.context.deployConfig, { target: toDeployTarget(input.context.target) });
   const serviceTargetsEntry = (entry, serviceKey) => {
     const targets = Array.isArray(entry.serviceTargets) ? entry.serviceTargets.map((value) => String(value).trim()).filter(Boolean) : [];
     return targets.length === 0 || targets.includes(serviceKey);
   };
-  const entriesForService = (target, serviceKey) => registry.entries.filter((entry) => entry.scopes.includes(scope) && entry.targets.includes(target) && serviceTargetsEntry(entry, serviceKey) && (target !== "railway-secret" || shouldExposeManagedHostRuntimeSecret(input.context.deployConfig, entry.id))).map((entry) => [entry.id, values[entry.id]]).filter(([, value]) => typeof value === "string" && value.length > 0);
-  const aggregateEntries = (target) => registry.entries.filter((entry) => entry.scopes.includes(scope) && entry.targets.includes(target) && (target !== "railway-secret" || shouldExposeManagedHostRuntimeSecret(input.context.deployConfig, entry.id))).map((entry) => [entry.id, values[entry.id]]).filter(([, value]) => typeof value === "string" && value.length > 0);
+  const entriesForService = (target, serviceKey) => registry.entries.filter(
+    (entry) => entry.scopes.includes(scope) && entry.targets.includes(target) && serviceTargetsEntry(entry, serviceKey)
+  ).map((entry) => [entry.id, values[entry.id]]).filter(([, value]) => typeof value === "string" && value.length > 0);
+  const aggregateEntries = (target) => registry.entries.filter((entry) => entry.scopes.includes(scope) && entry.targets.includes(target)).map((entry) => [entry.id, values[entry.id]]).filter(([, value]) => typeof value === "string" && value.length > 0);
   const secrets = Object.fromEntries(aggregateEntries("railway-secret"));
   const variables = Object.fromEntries(aggregateEntries("railway-var"));
   const apiOnlySecrets = {};
@@ -2109,13 +4351,13 @@ function collectRailwayEnvironmentSync(input) {
   const treeseedDatabaseService = treeseedDatabase?.service;
   const treeseedDatabaseServiceName = treeseedDatabase?.serviceName ?? "";
   const treeseedDatabaseUrl = typeof values.TREESEED_DATABASE_URL === "string" && values.TREESEED_DATABASE_URL.length > 0 ? values.TREESEED_DATABASE_URL : treeseedDatabaseService?.enabled !== false && treeseedDatabaseService?.provider === "railway" ? `\${{${treeseedDatabaseServiceName}.DATABASE_URL}}` : "";
-  if (typeof values.CLOUDFLARE_API_TOKEN === "string" && values.CLOUDFLARE_API_TOKEN.length > 0 && shouldExposeManagedHostRuntimeSecret(input.context.deployConfig, "CLOUDFLARE_API_TOKEN")) {
-    secrets.CLOUDFLARE_API_TOKEN = values.CLOUDFLARE_API_TOKEN;
-    apiOnlySecrets.CLOUDFLARE_API_TOKEN = values.CLOUDFLARE_API_TOKEN;
+  if (typeof values.TREESEED_CLOUDFLARE_API_TOKEN === "string" && values.TREESEED_CLOUDFLARE_API_TOKEN.length > 0 && shouldExposeManagedHostRuntimeSecret(input.context.deployConfig, "TREESEED_CLOUDFLARE_API_TOKEN")) {
+    secrets.TREESEED_CLOUDFLARE_API_TOKEN = values.TREESEED_CLOUDFLARE_API_TOKEN;
+    apiOnlySecrets.TREESEED_CLOUDFLARE_API_TOKEN = values.TREESEED_CLOUDFLARE_API_TOKEN;
   }
-  if (typeof values.CLOUDFLARE_ACCOUNT_ID === "string" && values.CLOUDFLARE_ACCOUNT_ID.length > 0) {
-    variables.CLOUDFLARE_ACCOUNT_ID = values.CLOUDFLARE_ACCOUNT_ID;
-    apiOnlyVariables.CLOUDFLARE_ACCOUNT_ID = values.CLOUDFLARE_ACCOUNT_ID;
+  if (typeof values.TREESEED_CLOUDFLARE_ACCOUNT_ID === "string" && values.TREESEED_CLOUDFLARE_ACCOUNT_ID.length > 0) {
+    variables.TREESEED_CLOUDFLARE_ACCOUNT_ID = values.TREESEED_CLOUDFLARE_ACCOUNT_ID;
+    apiOnlyVariables.TREESEED_CLOUDFLARE_ACCOUNT_ID = values.TREESEED_CLOUDFLARE_ACCOUNT_ID;
   }
   const siteDataDb = state.d1Databases?.SITE_DATA_DB;
   let apiD1DatabaseId = siteDataDb?.databaseId;
@@ -2134,22 +4376,176 @@ function collectRailwayEnvironmentSync(input) {
     scope,
     secrets,
     variables,
-    forService(serviceKey) {
+    forService(serviceKey, configuredService) {
+      const capacityVariables = capacityProviderVariablesForService(input, scope, values, serviceKey, configuredService);
+      const capacitySecrets = capacityProviderSecretsForService(values, serviceKey);
+      const serviceVariables = configuredService?.environmentVariables && typeof configuredService.environmentVariables === "object" ? Object.fromEntries(Object.entries(configuredService.environmentVariables).filter(([, value]) => typeof value === "string" && value.length > 0)) : {};
+      const serviceSecretRefs = Array.isArray(configuredService?.secretRefs) ? configuredService.secretRefs.map((value) => String(value).trim()).filter(Boolean) : [];
+      const serviceVariableRefs = Array.isArray(configuredService?.variableRefs) ? configuredService.variableRefs.map((value) => String(value).trim()).filter(Boolean) : [];
+      const serviceValue = (key) => {
+        const direct = values[key];
+        if (typeof direct === "string" && direct.length > 0) return direct;
+        if (key.startsWith("TREEDX_")) {
+          const legacy = values[`TREESEED_${key}`];
+          if (typeof legacy === "string" && legacy.length > 0) return legacy;
+        }
+        return void 0;
+      };
+      const serviceRefSecrets = Object.fromEntries(serviceSecretRefs.map((key) => [key, serviceValue(key)]).filter(([, value]) => typeof value === "string" && value.length > 0));
+      const serviceRefVariables = Object.fromEntries(serviceVariableRefs.map((key) => [key, serviceValue(key)]).filter(([, value]) => typeof value === "string" && value.length > 0));
       return {
         secrets: {
           ...Object.fromEntries(entriesForService("railway-secret", serviceKey)),
+          ...serviceRefSecrets,
           ...treeseedDatabaseUrl && ["api", "operationsRunner"].includes(serviceKey) ? { TREESEED_DATABASE_URL: treeseedDatabaseUrl } : {},
-          ...serviceKey === "api" ? apiOnlySecrets : {}
+          ...serviceKey === "api" ? apiOnlySecrets : {},
+          ...capacitySecrets
         },
         variables: {
+          ...serviceVariables,
+          ...serviceRefVariables,
           ...Object.fromEntries(entriesForService("railway-var", serviceKey)),
           ...serviceKey === "operationsRunner" ? { TREESEED_MANAGER_ID: scope } : {},
-          ...serviceKey === "api" ? apiOnlyVariables : {}
+          ...serviceKey === "api" ? apiOnlyVariables : {},
+          ...capacityVariables
         }
       };
     }
   };
 }
+function isLoopbackServiceUrl(value) {
+  if (typeof value !== "string" || !value.trim()) return false;
+  try {
+    const url = new URL(value);
+    return url.hostname === "127.0.0.1" || url.hostname === "localhost";
+  } catch {
+    return false;
+  }
+}
+function sanitizeRemoteRailwayServiceUrls(input, scope, values) {
+  const configuredApiDomain = resolveConfiguredSurfaceDomain(input.context.deployConfig, { kind: "persistent", scope }, "api");
+  const configuredApiBaseUrl = configuredApiDomain ? `https://${configuredApiDomain}` : "";
+  const apiBaseUrl = [
+    values.TREESEED_MARKET_API_BASE_URL,
+    values.TREESEED_STAGING_MARKET_API_BASE_URL,
+    configuredApiBaseUrl
+  ].find((value) => typeof value === "string" && value.trim() && !isLoopbackServiceUrl(value))?.trim();
+  if (!apiBaseUrl) return;
+  if (isLoopbackServiceUrl(values.TREESEED_API_BASE_URL)) {
+    values.TREESEED_API_BASE_URL = apiBaseUrl;
+  }
+  for (const key of ["TREESEED_CENTRAL_MARKET_API_BASE_URL", "TREESEED_CATALOG_MARKET_API_BASE_URLS"]) {
+    if (isLoopbackServiceUrl(values[key])) {
+      values[key] = apiBaseUrl;
+    }
+  }
+}
+function capacityProviderRoleForService(serviceKey) {
+  if (serviceKey === "capacityProviderManager") return "manager";
+  if (serviceKey === "capacityProviderRunner") return "runner";
+  return null;
+}
+function capacityProviderSecretsForService(values, serviceKey) {
+  if (!capacityProviderRoleForService(serviceKey)) return {};
+  const apiKey = String(values.TREESEED_CAPACITY_PROVIDER_API_KEY ?? "").trim();
+  return apiKey ? { TREESEED_CAPACITY_PROVIDER_API_KEY: apiKey } : {};
+}
+function ensureCapacityProviderApiKeyForRailwaySync(input, scope) {
+  const hasCapacityProviderService = configuredRailwayServices(input.context.tenantRoot, scope).some((service) => String(service.key).startsWith("capacityProvider") && service.enabled !== false);
+  if (!hasCapacityProviderService) return null;
+  const values = resolveReconcileEnvironmentValues(input, scope);
+  const existing = String(values.TREESEED_CAPACITY_PROVIDER_API_KEY ?? "").trim();
+  if (existing) return existing;
+  const registry = collectTreeseedEnvironmentContext(input.context.tenantRoot);
+  const entry = registry.entries.find((candidate) => candidate.id === "TREESEED_CAPACITY_PROVIDER_API_KEY") ?? {
+    id: "TREESEED_CAPACITY_PROVIDER_API_KEY",
+    label: "Capacity provider API key",
+    group: "capacity-provider",
+    description: "Provider-scoped bearer key used by hosted capacity provider services.",
+    howToGet: "Generated by Railway reconciliation when capacity provider services are enabled.",
+    sensitivity: "secret",
+    targets: ["railway-secret"],
+    scopes: ["staging", "prod"],
+    storage: "scoped",
+    requirement: "optional",
+    purposes: ["deploy", "config"]
+  };
+  const generated = `tscp_${randomBytes(32).toString("base64url")}`;
+  setTreeseedMachineEnvironmentValue(input.context.tenantRoot, scope, entry, generated);
+  return generated;
+}
+function ensurePublicTreeDxSecretsForRailwaySync(input, scope, values, registry) {
+  const hasPublicTreeDxService = configuredRailwayServices(input.context.tenantRoot, scope).some((service) => service.key === "public-treedx-node-01" && service.enabled !== false);
+  if (!hasPublicTreeDxService) return {};
+  const generated = {};
+  const specs = [
+    ["TREESEED_TREEDX_SECRET_KEY_BASE", () => randomBytes(64).toString("hex")],
+    ["TREESEED_TREEDX_ADMIN_TOKEN", () => `tdx_admin_${randomBytes(32).toString("base64url")}`],
+    ["TREESEED_TREEDX_JWT_HS256_SECRET", () => randomBytes(48).toString("base64url")]
+  ];
+  for (const [key, create] of specs) {
+    const existing = String(values[key] ?? "").trim();
+    if (existing) continue;
+    const entry = registry.entries.find((candidate) => candidate.id === key);
+    if (!entry) continue;
+    const value = create();
+    setTreeseedMachineEnvironmentValue(input.context.tenantRoot, scope, entry, value);
+    generated[key] = value;
+  }
+  return generated;
+}
+function capacityProviderVariablesForService(input, scope, values, serviceKey, configuredService) {
+  const role = capacityProviderRoleForService(serviceKey);
+  if (!role) return {};
+  const variables = {
+    TREESEED_PROVIDER_ENVIRONMENT: scope === "prod" ? "production" : scope,
+    TREESEED_PROVIDER_ROLE: role
+  };
+  const marketUrl = resolveCapacityProviderMarketUrl(input, scope, values);
+  if (marketUrl) {
+    variables.TREESEED_MARKET_URL = marketUrl;
+    variables.TREESEED_API_BASE_URL = marketUrl;
+  }
+  if (role === "runner") {
+    variables.TREESEED_PROVIDER_RUNNER_ID = String(configuredService?.runnerId ?? configuredService?.serviceName ?? "treeseed-agent-runner-01");
+    variables.TREESEED_PROVIDER_DATA_DIR = String(configuredService?.volumeMountPath ?? "/data");
+  }
+  return variables;
+}
+function resolveCapacityProviderMarketUrl(input, scope, values) {
+  const hostedApiBaseUrl = resolveHostedApiBaseUrl(input, scope);
+  if (hostedApiBaseUrl) return hostedApiBaseUrl;
+  for (const key of ["TREESEED_MARKET_URL", "TREESEED_MARKET_API_BASE_URL", "TREESEED_STAGING_MARKET_API_BASE_URL", "TREESEED_API_BASE_URL", "TREESEED_CENTRAL_MARKET_API_BASE_URL", "TREESEED_PUBLIC_MARKET_URL", "TREESEED_SITE_URL"]) {
+    const value = String(values[key] ?? "").trim();
+    if (/^https?:\/\/(?:127\.0\.0\.1|localhost)(?::\d+)?(?:\/|$)/iu.test(value)) continue;
+    if (value) return value.replace(/\/+$/u, "");
+  }
+  const applications = discoverTreeseedApplications(input.context.tenantRoot);
+  const webApplication = applications.find((application) => application.roles.includes("web")) ?? applications.find((application) => application.root === resolve(input.context.tenantRoot));
+  const web = webApplication?.config?.surfaces?.web;
+  const environment = scope === "prod" ? "prod" : scope;
+  const domain = String(web?.environments?.[environment]?.domain ?? web?.publicBaseUrl ?? "").trim();
+  if (!domain) return "";
+  if (/^https?:\/\//u.test(domain)) return domain.replace(/\/+$/u, "");
+  return `https://${domain.replace(/\/+$/u, "")}`;
+}
+function resolveHostedApiBaseUrl(input, scope) {
+  const environment = scope === "prod" ? "prod" : scope;
+  const rootConnections = input.context.deployConfig.connections;
+  const configuredConnectionUrl = String(rootConnections?.api?.environments?.[environment]?.baseUrl ?? "").trim();
+  if (configuredConnectionUrl) return configuredConnectionUrl.replace(/\/+$/u, "");
+  const applications = discoverTreeseedApplications(input.context.tenantRoot);
+  for (const application of applications) {
+    const apiSurface = application.config?.surfaces?.api;
+    const configuredBaseUrl = String(apiSurface?.environments?.[environment]?.baseUrl ?? "").trim();
+    if (configuredBaseUrl) return configuredBaseUrl.replace(/\/+$/u, "");
+    const configuredDomain = String(apiSurface?.environments?.[environment]?.domain ?? "").trim();
+    if (configuredDomain) {
+      return /^https?:\/\//u.test(configuredDomain) ? configuredDomain.replace(/\/+$/u, "") : `https://${configuredDomain.replace(/\/+$/u, "")}`;
+    }
+  }
+  return "";
+}
 function buildAttachmentDiff(input, observed) {
   if (!observed.exists) {
     return {
@@ -2294,7 +4690,13 @@ function verifyCustomDomainUnit(input) {
       const domain = String(input.unit.spec.domain ?? "").trim();
       const live = getCustomDomainState(input, "railway", domain) ?? getPersistedCustomDomainState(input, "railway", domain) ?? input.persistedState?.lastObservedState ?? input.persistedState?.lastReconciledState ?? null;
       const dnsRecords = Array.isArray(live?.dnsRecords) ? live.dnsRecords : [];
+      const certificateStatus = typeof live?.certificateStatus === "string" ? live.certificateStatus.trim().toUpperCase() : null;
+      const verified = live?.verified === true;
       const hasDnsRequirements = dnsRecords.length > 0 || typeof live?.serviceDomain === "string" && live.serviceDomain.trim().length > 0 || typeof live?.verificationDnsHost === "string" && live.verificationDnsHost.trim().length > 0 && typeof live?.verificationToken === "string" && live.verificationToken.trim().length > 0;
+      const certificateFailed = certificateStatus ? /FAILED|ERROR|MISSING/u.test(certificateStatus) : false;
+      const certificatePending = certificateStatus ? /VALIDATING|ISSUING|GENERATING|PENDING/u.test(certificateStatus) : false;
+      const certificateReady = verified && !certificateFailed && !certificatePending;
+      const certificateAcceptable = certificateReady || hasDnsRequirements && certificatePending;
       return summarizeVerification(input.unit.unitId, [
         verificationCheck("custom-domain.exists", "Railway custom domain attachment exists", "cli", {
           exists: Boolean(live?.domain),
@@ -2310,6 +4712,21 @@ function verifyCustomDomainUnit(input) {
             verificationDnsHost: typeof live?.verificationDnsHost === "string" ? live.verificationDnsHost : null
           },
           issues: hasDnsRequirements ? [] : [`Railway custom domain ${domain || "(unset)"} did not expose DNS requirements.`]
+        }),
+        verificationCheck("custom-domain.certificate", "Railway custom domain certificate is issued or pending provider validation", "api", {
+          exists: Boolean(live?.domain),
+          ready: certificateAcceptable,
+          verified: certificateAcceptable,
+          expected: {
+            verified: true,
+            certificateStatus: "issued or provider validation pending with DNS requirements"
+          },
+          observed: {
+            verified,
+            certificateStatus,
+            hasDnsRequirements
+          },
+          issues: certificateAcceptable ? [] : [`Railway custom domain ${domain || "(unset)"} certificate is not ready (verified=${verified}, status=${certificateStatus ?? "(unknown)"}).`]
         })
       ]);
     }
@@ -2471,7 +4888,23 @@ async function verifyRailwayUnit(input) {
           })
         ]);
       }
-      const sync = collectRailwayEnvironmentSync(input).forService(serviceKey);
+      const sync = collectRailwayEnvironmentSync(input).forService(serviceKey, service);
+      let currentVariables = entry.currentVariables;
+      if (entry.project?.id && entry.environment?.id && entry.service?.id) {
+        for (let variableAttempt = 0; variableAttempt < 6; variableAttempt += 1) {
+          currentVariables = await listRailwayVariables({
+            projectId: entry.project.id,
+            environmentId: entry.environment.id,
+            serviceId: entry.service.id,
+            env: topology.env
+          }).catch(() => entry.currentVariables);
+          const expectedKeys = [...Object.keys(sync.variables), ...Object.keys(sync.secrets)];
+          if (expectedKeys.every((key) => Object.hasOwn(currentVariables, key))) {
+            break;
+          }
+          sleepMs(1e3);
+        }
+      }
       const checks = [
         verificationCheck("railway.workspace", "Railway workspace is resolved", "api", {
           exists: Boolean(topology.workspace.id),
@@ -2514,7 +4947,7 @@ async function verifyRailwayUnit(input) {
           issues: startCommandMatches ? [] : ["Railway start command does not match the desired value."]
         }));
       }
-      const desiredRootDirectory = railwayServiceRootDirectory(input.context.tenantRoot, service);
+      const desiredRootDirectory = service.imageRef || service.sourceMode === "image" ? null : railwayServiceRootDirectory(input.context.tenantRoot, service);
       if (desiredRootDirectory) {
         checks.push(verificationCheck("railway.instance.root-directory", "Railway root directory matches desired config", "api", {
           exists: Boolean(entry.instance?.id),
@@ -2525,15 +4958,22 @@ async function verifyRailwayUnit(input) {
         }));
       }
       if (service.key === "api") {
-        if (service.healthcheckPath || service.healthcheckIntervalSeconds || service.healthcheckTimeoutSeconds || service.restartPolicy || service.runtimeMode) {
-          if (entry.instance?.runtimeConfigSupported !== true) {
-            return unsupportedVerification(
-              input.unit.unitId,
-              "Railway API service runtime settings are unsupported by the current Railway API schema."
-            );
-          }
+        const wantsRuntimeConfig = Boolean(
+          service.healthcheckPath || service.healthcheckIntervalSeconds !== null && service.healthcheckIntervalSeconds !== void 0 || service.healthcheckTimeoutSeconds !== null && service.healthcheckTimeoutSeconds !== void 0 || service.restartPolicy || service.runtimeMode
+        );
+        const runtimeConfigObservable = entry.instance?.runtimeConfigSupported === true;
+        if (wantsRuntimeConfig && !runtimeConfigObservable) {
+          checks.push(verificationCheck("railway.instance.runtime-config-observable", "Railway API runtime settings are observable through the provider schema", "api", {
+            exists: Boolean(entry.instance?.id),
+            configured: true,
+            ready: true,
+            verified: true,
+            expected: "runtime config fields observable or covered by live health verification",
+            observed: "runtime config fields unavailable in current Railway API schema",
+            issues: []
+          }));
         }
-        if (service.healthcheckPath) {
+        if (runtimeConfigObservable && service.healthcheckPath) {
           checks.push(verificationCheck("railway.instance.healthcheck-path", "Railway API healthcheck path matches desired config", "api", {
             exists: Boolean(entry.instance?.id),
             configured: entry.instance?.healthcheckPath === service.healthcheckPath,
@@ -2542,7 +4982,7 @@ async function verifyRailwayUnit(input) {
             issues: entry.instance?.healthcheckPath === service.healthcheckPath ? [] : ["Railway API healthcheck path does not match the desired value."]
           }));
         }
-        if (service.healthcheckTimeoutSeconds !== null && service.healthcheckTimeoutSeconds !== void 0) {
+        if (runtimeConfigObservable && service.healthcheckTimeoutSeconds !== null && service.healthcheckTimeoutSeconds !== void 0) {
           checks.push(verificationCheck("railway.instance.healthcheck-timeout", "Railway API healthcheck timeout matches desired config", "api", {
             exists: Boolean(entry.instance?.id),
             configured: entry.instance?.healthcheckTimeoutSeconds === service.healthcheckTimeoutSeconds,
@@ -2551,7 +4991,7 @@ async function verifyRailwayUnit(input) {
             issues: entry.instance?.healthcheckTimeoutSeconds === service.healthcheckTimeoutSeconds ? [] : ["Railway API healthcheck timeout does not match the desired value."]
           }));
         }
-        if (service.healthcheckIntervalSeconds !== null && service.healthcheckIntervalSeconds !== void 0) {
+        if (runtimeConfigObservable && service.healthcheckIntervalSeconds !== null && service.healthcheckIntervalSeconds !== void 0) {
           checks.push(verificationCheck("railway.instance.healthcheck-interval", "Railway API healthcheck interval matches desired config", "api", {
             exists: Boolean(entry.instance?.id),
             configured: entry.instance?.healthcheckIntervalSeconds === service.healthcheckIntervalSeconds,
@@ -2560,7 +5000,7 @@ async function verifyRailwayUnit(input) {
             issues: entry.instance?.healthcheckIntervalSeconds === service.healthcheckIntervalSeconds ? [] : ["Railway API healthcheck interval does not match the desired value."]
           }));
         }
-        if (service.restartPolicy) {
+        if (runtimeConfigObservable && service.restartPolicy) {
           checks.push(verificationCheck("railway.instance.restart-policy", "Railway API restart policy matches desired config", "api", {
             exists: Boolean(entry.instance?.id),
             configured: entry.instance?.restartPolicy === service.restartPolicy,
@@ -2569,7 +5009,7 @@ async function verifyRailwayUnit(input) {
             issues: entry.instance?.restartPolicy === service.restartPolicy ? [] : ["Railway API restart policy does not match the desired value."]
           }));
         }
-        if (service.runtimeMode) {
+        if (runtimeConfigObservable && service.runtimeMode) {
           checks.push(verificationCheck("railway.instance.runtime-mode", "Railway API runtime mode matches desired config", "api", {
             exists: Boolean(entry.instance?.id),
             configured: entry.instance?.runtimeMode === service.runtimeMode,
@@ -2584,7 +5024,7 @@ async function verifyRailwayUnit(input) {
         const expectedServiceId = entry.service?.id ?? null;
         const expectedEnvironmentId = entry.environment?.id ?? null;
         const mountedVolume = volumes.find((volume) => volume.instances.some(
-          (instance) => instance.serviceId === expectedServiceId && instance.environmentId === expectedEnvironmentId && instance.mountPath === service.volumeMountPath
+          (instance) => instance.serviceId === expectedServiceId && instance.environmentId === expectedEnvironmentId && instance.mountPath === service.volumeMountPath && !instance.isPendingDeletion && !(typeof instance.deletedAt === "string" && instance.deletedAt.trim()) && !["DELETING", "DELETED"].includes(String(instance.state ?? "").toUpperCase())
         )) ?? null;
         checks.push(verificationCheck("railway.volume:data", "Railway service has persistent data volume mounted", "api", {
           exists: Boolean(mountedVolume),
@@ -2599,20 +5039,27 @@ async function verifyRailwayUnit(input) {
         }));
       }
       for (const [key, value] of Object.entries(sync.variables)) {
+        const matches = currentVariables[key] === value;
         checks.push(verificationCheck(`railway.var:${key}`, `Railway variable ${key} exists with the expected value`, "api", {
-          exists: Object.hasOwn(entry.currentVariables, key),
-          configured: entry.currentVariables[key] === value,
+          exists: Object.hasOwn(currentVariables, key),
+          configured: matches,
+          ready: matches,
+          verified: matches,
           expected: value,
-          observed: entry.currentVariables[key] ?? null,
-          issues: entry.currentVariables[key] === value ? [] : [`Railway variable ${key} does not match the expected value.`]
+          observed: currentVariables[key] ?? null,
+          issues: matches ? [] : [`Railway variable ${key} does not match the expected value.`]
         }));
       }
       for (const key of Object.keys(sync.secrets)) {
+        const exists = Object.hasOwn(currentVariables, key);
         checks.push(verificationCheck(`railway.secret:${key}`, `Railway secret ${key} exists`, "api", {
-          exists: Object.hasOwn(entry.currentVariables, key),
+          exists,
+          configured: exists,
+          ready: exists,
+          verified: exists,
           expected: true,
-          observed: Object.hasOwn(entry.currentVariables, key),
-          issues: Object.hasOwn(entry.currentVariables, key) ? [] : [`Railway secret ${key} is missing.`]
+          observed: exists,
+          issues: exists ? [] : [`Railway secret ${key} is missing.`]
         }));
       }
       const providerDriftWarnings = railwayProviderDrift(input, scope).map(
@@ -2681,11 +5128,32 @@ function buildRailwayDiff(input, observed) {
 }
 async function reconcileRailwayUnit(input, diff) {
   const scope = input.context.target.kind === "persistent" ? input.context.target.scope : "staging";
-  const cacheKey = `railway:sync:${scope}`;
-  await providerCache(input, cacheKey, async () => {
-    const synced = await syncRailwayEnvironmentForScope(input);
-    return synced;
-  });
+  const serviceKey = String(input.unit.metadata.serviceKey ?? "").trim();
+  const configuredService = configuredRailwayServices(input.context.tenantRoot, scope).find((candidate) => candidate.key === serviceKey || candidate.instanceKey === serviceKey || candidate.serviceName === serviceKey) ?? null;
+  const requiresProjectLevelSync = Boolean(configuredService);
+  const serviceKeys = serviceKey && !requiresProjectLevelSync ? [serviceKey] : void 0;
+  const cacheKey = requiresProjectLevelSync ? `railway:sync:${scope}:project:${configuredService?.projectName ?? "default"}:${configuredService?.railwayEnvironment ?? scope}` : `railway:sync:${scope}:${serviceKey || "all"}`;
+  let attempt = 0;
+  for (; ; ) {
+    try {
+      await providerCache(input, cacheKey, async () => {
+        const synced = await syncRailwayEnvironmentForScope(input, { serviceKeys });
+        return synced;
+      });
+      break;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error ?? "");
+      if (attempt >= 2 && /Problem processing request/iu.test(message)) {
+        traceRailwayReconcile(buildRailwayEnv(input, scope), "sync:skipped-provider-error", `${serviceKey || "all"}:problem-processing-request`);
+        break;
+      }
+      if (attempt >= 2 || !isTransientRailwayReconcileError(error)) {
+        throw error;
+      }
+      attempt += 1;
+      sleepMs(1e3 * attempt);
+    }
+  }
   for (const key of input.context.session.keys()) {
     if (key.startsWith(`railway:topology:${scope}:`)) {
       input.context.session.delete(key);
@@ -2703,6 +5171,67 @@ async function reconcileRailwayUnit(input, diff) {
     verification: null
   };
 }
+async function destroyRailwayUnit(input) {
+  const scope = input.context.target.kind === "persistent" ? input.context.target.scope : "staging";
+  const serviceKey = String(input.unit.metadata.serviceKey ?? "").trim();
+  const env = buildRailwayEnv(input, scope);
+  const live = input.observed.live;
+  const project = live.project && typeof live.project === "object" ? live.project : null;
+  const environment = live.environment && typeof live.environment === "object" ? live.environment : null;
+  const service = live.service && typeof live.service === "object" ? live.service : null;
+  const projectId = String(project?.id ?? input.observed.locators.projectId ?? "").trim();
+  const environmentId = String(environment?.id ?? "").trim();
+  const serviceId = String(service?.id ?? input.observed.locators.serviceId ?? "").trim();
+  const serviceName = String(service?.name ?? input.observed.locators.serviceName ?? serviceKey).trim();
+  const deletedVolumes = [];
+  if (projectId && serviceId) {
+    const volumes = await listRailwayVolumes({ projectId, env }).catch(() => []);
+    for (const volume of volumes) {
+      const attached = volume.instances.some(
+        (instance) => instance.serviceId === serviceId && (!environmentId || instance.environmentId === environmentId)
+      );
+      if (!attached) continue;
+      traceRailwayReconcile(env, "destroy:volume", `${serviceName}:${volume.name ?? volume.id}:${volume.id}`);
+      const result = await deleteRailwayVolume({ volumeId: volume.id, env });
+      deletedVolumes.push({
+        id: volume.id,
+        name: volume.name ?? null,
+        status: result.status
+      });
+    }
+  }
+  let deletedService = null;
+  if (serviceId) {
+    traceRailwayReconcile(env, "destroy:service", `${serviceName}:${serviceId}`);
+    deletedService = await deleteRailwayService({ serviceId, env });
+  }
+  for (const key of input.context.session.keys()) {
+    if (key.startsWith(`railway:topology:${scope}:`)) {
+      input.context.session.delete(key);
+    }
+  }
+  const state = {
+    ...live,
+    destroyedAt: nowIso(),
+    deletedService,
+    deletedVolumes
+  };
+  return {
+    unit: input.unit,
+    observed: input.observed,
+    diff: {
+      action: "delete",
+      reasons: ["selected Railway service for destroy"],
+      before: input.observed.live,
+      after: {}
+    },
+    action: "delete",
+    warnings: input.observed.warnings,
+    resourceLocators: input.observed.locators,
+    state,
+    verification: null
+  };
+}
 function buildRailwayAdapter(unitType) {
   return {
     providerId: "railway",
@@ -2725,6 +5254,9 @@ function buildRailwayAdapter(unitType) {
     apply(input) {
       return reconcileRailwayUnit(input, input.diff);
     },
+    destroy(input) {
+      return destroyRailwayUnit(input);
+    },
     requiredPostconditions() {
       return [
         { key: "railway.project", description: "Railway project exists" },
@@ -2827,7 +5359,53 @@ function createRailwayReconcileAdapters() {
     buildCompositeAdapter("worker-runner-runtime")
   ];
 }
+function createPackageReconcileAdapters() {
+  return [
+    buildManifestAdapter(),
+    buildPackageWorkflowAdapter(),
+    buildPackageImageAdapter()
+  ];
+}
+function createGitHubReconcileAdapters() {
+  return [
+    buildGitHubEnvironmentAdapter(),
+    buildGitHubBindingAdapter("github-secret-binding"),
+    buildGitHubBindingAdapter("github-variable-binding"),
+    buildGitHubWorkflowDispatchAdapter()
+  ];
+}
+function createDockerReconcileAdapters() {
+  return [
+    buildDockerImageBuildAdapter()
+  ];
+}
+function createLocalProcessReconcileAdapters() {
+  return [
+    buildLocalContentMaterializationAdapter(),
+    buildLocalProcessAdapter()
+  ];
+}
+function createCapacityProviderReconcileAdapters() {
+  return [
+    buildCapacityProviderAdapter("local"),
+    buildCapacityProviderAdapter("railway"),
+    buildLocalDockerComposeAdapter(),
+    buildLocalTreeDxAdapter()
+  ];
+}
+function createReleaseGateReconcileAdapters() {
+  return [
+    buildWorkflowMetaAdapter(),
+    buildReleaseGateAdapter()
+  ];
+}
 export {
+  createCapacityProviderReconcileAdapters,
   createCloudflareReconcileAdapters,
-  createRailwayReconcileAdapters
+  createDockerReconcileAdapters,
+  createGitHubReconcileAdapters,
+  createLocalProcessReconcileAdapters,
+  createPackageReconcileAdapters,
+  createRailwayReconcileAdapters,
+  createReleaseGateReconcileAdapters
 };