@treeseed/sdk 0.12.58 → 0.12.60

package/dist/hosting/graph.js

@@ -83,7 +83,7 @@ function publicTreeDxSourcePolicy(input, config, launchEnv) {
       imageRef,
       imageTagRef: "TREESEED_PUBLIC_TREEDX_IMAGE_REF"
     };
-    const serviceName = input.environment === "prod" ? "public-treedx-node-production-01" : "public-treedx-node-01";
+    const serviceName = "public-treedx-node-01";
     assertApiRailwaySourcePolicy(input.environment, { key: serviceName, serviceName, ...policy2 });
     return policy2;
   }
@@ -176,8 +176,7 @@ function railwaySourcePolicy(input, serviceKey, service, imageRef) {
   const configuredSource = service.railway?.source && typeof service.railway.source === "object" && !Array.isArray(service.railway.source) ? service.railway.source : {};
   const configuredMode = typeof service.railway?.sourceMode === "string" ? service.railway.sourceMode : null;
   const baseServiceName = service.railway?.serviceName ?? null;
-  const configuredEnvironmentServiceName = service.environments?.[input.environment]?.railwayServiceName;
-  const serviceName = typeof configuredEnvironmentServiceName === "string" && configuredEnvironmentServiceName.trim() ? configuredEnvironmentServiceName.trim() : input.environment === "prod" && ["api", "operationsRunner"].includes(serviceKey) && baseServiceName ? `${baseServiceName}-production` : baseServiceName;
+  const serviceName = baseServiceName;
   const repository = typeof service.railway?.sourceRepo === "string" ? service.railway.sourceRepo : typeof configuredSource.repository === "string" ? configuredSource.repository : typeof configuredSource.repo === "string" ? configuredSource.repo : readPackageRepository(resolveRailwayServiceSourceRoot(input, serviceKey, service)) ?? readPackageRepository(input.tenantRoot) ?? apiRailwayDefaultSourceRepo({ key: serviceKey, serviceName });
   const dockerfilePath = service.railway?.dockerfilePath ?? apiRailwayDefaultDockerfilePath({ key: serviceKey, serviceName });
   const apiPackageSourceEligible = ["api", "operationsRunner"].includes(serviceKey);
@@ -384,9 +383,8 @@ function buildProfileFromDeployConfig(input) {
     const imageRefEnv = railwayImageRefEnvForService(serviceKey);
     const imageRef = service.railway?.imageRef ?? (input.environment === "prod" && imageRefEnv ? launchEnv[imageRefEnv] ?? null : null) ?? defaultRailwayImageRefForService(serviceKey, input.environment) ?? null;
     const sourcePolicy = railwaySourcePolicy(input, serviceKey, service, imageRef);
-    const environmentConfig = service.environments?.[input.environment];
     const baseServiceName = service.railway?.serviceName ?? null;
-    const effectiveServiceName = environmentConfig?.railwayServiceName ?? (input.environment === "prod" && ["api", "operationsRunner"].includes(serviceKey) && baseServiceName ? `${baseServiceName}-production` : baseServiceName);
+    const effectiveServiceName = baseServiceName;
     services.push({
       id: serviceKey,
       label: placement === "runner-capacity" ? "Runner Capacity" : serviceKey === "api" ? "API Runtime" : serviceKey,
@@ -472,7 +470,7 @@ function buildProfileFromDeployConfig(input) {
     const treeDxSourcePolicy = publicTreeDxSourcePolicy(input, config, launchEnv);
     const treeDxNodeUnits = Array.from({ length: treeDxNodePool.bootstrapCount }, (_, offset) => {
       const nodeIndex = offset + 1;
-      const serviceName = indexedName(input.environment === "prod" ? "public-treedx-node-production" : "public-treedx-node", nodeIndex);
+      const serviceName = indexedName("public-treedx-node", nodeIndex);
       return {
         id: serviceName,
         label: `Public TreeDX node ${String(nodeIndex).padStart(2, "0")}`,

package/dist/operations/services/deploy.js

@@ -2584,7 +2584,7 @@ function configuredRailwayDestroyTargets(tenantRoot, deployConfig, scope) {
     services.push({
       key: "treeseedDatabase",
       projectName: deployConfig.services?.api?.railway?.projectName ?? identity.deploymentKey,
-      serviceName: `${baseName.replace(/-(staging|prod|production)$/u, "")}-${normalizedScope === "prod" ? "prod" : normalizedScope}`,
+      serviceName: baseName.replace(/-(staging|prod|production)$/u, ""),
       railwayEnvironment: normalizeRailwayEnvironmentName(normalizedScope),
       domain: null,
       volumeMountPath: null,

package/dist/operations/services/deployment-readiness.js

@@ -143,8 +143,8 @@ function collectTreeseedDeploymentReadiness(options) {
     checks.push(check("hosting:api:healthcheckPath", api.config?.healthcheckPath, "/healthz", "API healthcheck path is /healthz.", "Set services.api.railway.healthcheckPath to /healthz.", "healthcheckPath"));
   }
   if (railwayApi) {
-    const expectedServiceName = environment === "prod" ? "treeseed-api-production" : "treeseed-api";
-    checks.push(check("railway-config:api:serviceName", railwayApi.serviceName, expectedServiceName, "Railway API service uses the environment-isolated canonical name.", `Set the API service identity to ${expectedServiceName} for ${environment}.`, "serviceName"));
+    const expectedServiceName = "treeseed-api";
+    checks.push(check("railway-config:api:serviceName", railwayApi.serviceName, expectedServiceName, "Railway API service uses the project-wide canonical name.", `Set the API service identity to ${expectedServiceName} for every environment.`, "serviceName"));
     checks.push(check("railway-config:api:rootDirectory", relRoot(tenantRoot, railwayApi.rootDir), expectedApiRailwayRoot, "Railway API effective rootDirectory points at the API app.", "Set services.api.railway.rootDir relative to the owning API manifest.", "rootDirectory"));
   }
   if (!runner) {
@@ -177,8 +177,8 @@ function collectTreeseedDeploymentReadiness(options) {
     checks.push(check("hosting:operationsRunner:volumeMountPath", runner.config?.volumeMountPath, "/data", "Runner volume mount path is stable.", "Set services.operationsRunner.railway.volumeMountPath to /data.", "volumeMountPath"));
   }
   if (railwayRunner) {
-    const expectedServiceName = environment === "prod" ? "treeseed-api-operations-runner-production-01" : "treeseed-api-operations-runner-01";
-    checks.push(check("railway-config:operationsRunner:serviceName", railwayRunner.serviceName, expectedServiceName, "Railway runner service instance uses the environment-isolated canonical name.", `Set the runner service identity to ${expectedServiceName} for ${environment}.`, "serviceName"));
+    const expectedServiceName = "treeseed-api-operations-runner-01";
+    checks.push(check("railway-config:operationsRunner:serviceName", railwayRunner.serviceName, expectedServiceName, "Railway runner uses the project-wide canonical service name.", `Set the runner service identity to ${expectedServiceName} for every environment.`, "serviceName"));
     checks.push(check("railway-config:operationsRunner:rootDirectory", relRoot(tenantRoot, railwayRunner.rootDir), expectedRunnerRailwayRoot, "Railway runner effective rootDirectory points at the API app.", "Set services.operationsRunner.railway.rootDir relative to the owning API manifest.", "rootDirectory"));
   }
   if (!database) {

package/dist/operations/services/live-hosted-service-checks.js

@@ -15,7 +15,8 @@ import {
 import {
   configuredRailwayServices,
   findStaleTreeseedOperationsRunnerResources,
-  isTreeseedOperationsRunnerResourceName
+  isTreeseedOperationsRunnerResourceName,
+  railwayLegacyAliasMigrationPolicy
 } from "./railway-deploy.js";
 import { discoverTreeseedApplications } from "../../hosting/apps.js";
 import {
@@ -241,6 +242,7 @@ async function collectRailwayObservations(options) {
     const configuredServices = configuredRailwayServices(options.tenantRoot, options.target, options.env).filter((entry) => serviceMatchesAppSelection(entry, options.tenantRoot, options.appId, applications)).filter((entry) => serviceIsSelected(selectedServiceKeys, entry.key));
     const siblingTarget = options.target === "staging" ? "prod" : options.target === "prod" ? "staging" : null;
     const configuredSiblingServices = siblingTarget ? configuredRailwayServices(options.tenantRoot, siblingTarget, options.env, { identityOnly: true }).filter((entry) => entry.enabled !== false).filter((entry) => entry.key === "operationsRunner") : [];
+    const retainedMigrationAliases = options.target === "staging" ? railwayLegacyAliasMigrationPolicy("staging", configuredServices).retainedResourceNames : [];
     if (selectedServiceKeys.size === 0 || selectedServiceKeys.has("api") || selectedServiceKeys.has("operationsRunner")) {
       for (const descriptor of treeseedDatabaseDescriptors(options.tenantRoot, options)) {
         await verifyRailwayPostgresTopology({ descriptor, configuredServices, projects, options, issues });
@@ -286,14 +288,18 @@ async function collectRailwayObservations(options) {
         inspectedRunnerScopes.add(runnerScope);
         const desiredRunnerNames = /* @__PURE__ */ new Set([
           ...configuredServices.filter((entry) => entry.key === "operationsRunner").filter((entry) => entry.projectId ? entry.projectId === project.id : entry.projectName === project.name).filter((entry) => normalizeRailwayEnvironmentName(entry.railwayEnvironment) === normalizeRailwayEnvironmentName(environment.name)).map((entry) => entry.serviceName).filter(Boolean),
-          ...configuredSiblingServices.filter((entry) => entry.projectId ? entry.projectId === project.id : entry.projectName === project.name).map((entry) => entry.serviceName).filter((name) => Boolean(name) && isTreeseedOperationsRunnerResourceName(name))
+          ...configuredSiblingServices.filter((entry) => entry.projectId ? entry.projectId === project.id : entry.projectName === project.name).map((entry) => entry.serviceName).filter((name) => Boolean(name) && isTreeseedOperationsRunnerResourceName(name)),
+          ...retainedMigrationAliases.filter((name) => isTreeseedOperationsRunnerResourceName(name) && !name.endsWith("-volume"))
         ]);
         const desiredRunnerServiceIds = new Set(services.filter((entry) => desiredRunnerNames.has(entry.name)).map((entry) => entry.id));
         for (const staleService of findStaleTreeseedOperationsRunnerResources(services, desiredRunnerNames)) {
           issues.push(`${staleService.name}: stale operations runner Railway service remains in project ${project.name}.`);
         }
         const volumes2 = await listRailwayVolumes({ projectId: project.id, env: options.env, fetchImpl: options.fetchImpl }).catch(() => []);
-        const desiredRunnerVolumeNames = new Set([...desiredRunnerNames].map((name) => `${name}-volume`));
+        const desiredRunnerVolumeNames = /* @__PURE__ */ new Set([
+          ...[...desiredRunnerNames].map((name) => `${name}-volume`),
+          ...retainedMigrationAliases.filter((name) => name.endsWith("-volume"))
+        ]);
         for (const staleVolume of findStaleTreeseedOperationsRunnerResources(volumes2, desiredRunnerVolumeNames)) {
           const activeInstances = activeRailwayVolumeInstances(staleVolume);
           const relevant = staleVolume.instances.length === 0 || activeInstances.length > 0;

package/dist/operations/services/railway-deploy.d.ts

@@ -60,6 +60,11 @@ export declare function waitForRailwayManagedDeploymentsSettled(tenantRoot: any,
     message: string;
 }>;
 export declare function configuredRailwayServices(tenantRoot: any, scope: any, envOverlay?: {}, options?: {}): unknown[];
+export declare function legacyEnvironmentSpecificRailwayResourceNames(services: ReturnType<typeof configuredRailwayServices>): string[];
+export declare function railwayLegacyAliasMigrationPolicy(scope: 'staging' | 'prod', services: ReturnType<typeof configuredRailwayServices>): {
+    retainedResourceNames: string[];
+    allowedResourceDeletions: string[];
+};
 export declare function configuredRailwayScheduledJobs(tenantRoot: any, scope: any, { phase }?: {
     phase?: string | undefined;
 }): any[];

package/dist/operations/services/railway-deploy.js

@@ -686,7 +686,7 @@ function configuredRailwayServicesForConfig(tenantRoot, scope, deployConfig, app
     const publicBaseUrl = service.environments?.[normalizedScope]?.baseUrl ?? service.publicBaseUrl ?? (serviceKey === "api" ? configuredApiPublicBaseUrl(deployConfig, normalizedScope) : null);
     const environmentConfig = service.environments?.[normalizedScope];
     const baseServiceName = service.railway?.serviceName ?? (serviceKey === "workerRunner" ? deriveRailwayWorkerRunnerServiceName(identity.deploymentKey) : `${identity.deploymentKey}-${railwayServiceNameSuffix(serviceKey)}`);
-    const configuredServiceName = environmentConfig?.railwayServiceName ?? (normalizedScope === "prod" && ["api", "operationsRunner"].includes(serviceKey) ? `${serviceKey === "operationsRunner" ? String(baseServiceName).replace(/-\d+$/u, "") : baseServiceName}-production` : baseServiceName);
+    const configuredServiceName = baseServiceName;
     const configuredRunnerPool = service.railway?.runnerPool && typeof service.railway.runnerPool === "object" ? service.railway.runnerPool : null;
     const runnerPool = serviceKey === "operationsRunner" || serviceKey === "capacityProviderRunner" ? {
       bootstrapCount: Math.max(1, Number.parseInt(String(configuredRunnerPool?.bootstrapCount ?? (serviceKey === "capacityProviderRunner" ? 1 : OPERATIONS_RUNNER_BOOTSTRAP_COUNT)), 10) || (serviceKey === "capacityProviderRunner" ? 1 : OPERATIONS_RUNNER_BOOTSTRAP_COUNT)),
@@ -797,7 +797,7 @@ function configuredPublicTreeDxRailwayServices({ tenantRoot, scope, deployConfig
   const baseImageRef = envValue("TREESEED_PUBLIC_TREEDX_IMAGE_REF", imageRefEnv) || "treeseed/treedx";
   return Array.from({ length: bootstrapCount }, (_, offset) => {
     const index = offset + 1;
-    const serviceName = scope === "prod" ? `public-treedx-node-production-${String(index).padStart(2, "0")}` : `${PUBLIC_TREEDX_NODE_SERVICE_KEY_PREFIX}${String(index).padStart(2, "0")}`;
+    const serviceName = `${PUBLIC_TREEDX_NODE_SERVICE_KEY_PREFIX}${String(index).padStart(2, "0")}`;
     const service = {
       key: serviceName,
       serviceName,
@@ -985,6 +985,31 @@ function configuredRailwayServices(tenantRoot, scope, envOverlay = {}, options =
   ));
   return [...direct, ...nested];
 }
+function legacyEnvironmentSpecificRailwayResourceNames(services) {
+  const aliases = /* @__PURE__ */ new Set();
+  for (const service of services) {
+    let alias = null;
+    if (service.key === "api") {
+      alias = `${service.serviceName}-production`;
+    } else if (service.key === "operationsRunner") {
+      alias = service.serviceName.replace(/-(\d+)$/u, "-production-$1");
+    } else {
+      const treeDxMatch = service.serviceName.match(/^public-treedx-node-(\d+)$/u);
+      if (treeDxMatch?.[1]) alias = `public-treedx-node-production-${treeDxMatch[1]}`;
+    }
+    if (!alias || alias === service.serviceName) continue;
+    aliases.add(alias);
+    if (service.volumeMountPath) aliases.add(`${alias}-volume`);
+  }
+  return [...aliases];
+}
+function railwayLegacyAliasMigrationPolicy(scope, services) {
+  const aliases = legacyEnvironmentSpecificRailwayResourceNames(services);
+  return {
+    retainedResourceNames: scope === "staging" ? aliases : [],
+    allowedResourceDeletions: scope === "prod" ? aliases : []
+  };
+}
 function configuredRailwayScheduledJobs(tenantRoot, scope, { phase = "deploy" } = {}) {
   if (!shouldManageRailwaySchedules(scope, phase)) {
     return [];
@@ -1823,7 +1848,9 @@ export {
   findStaleTreeseedOperationsRunnerResources,
   isTreeseedOperationsRunnerResourceName,
   isUsableRailwayToken,
+  legacyEnvironmentSpecificRailwayResourceNames,
   parseRailwayJsonOutput,
+  railwayLegacyAliasMigrationPolicy,
   railwayServiceRuntimeStartCommand,
   resolveRailwayAuthToken,
   resolveRailwayDeploymentProfile,

package/dist/operations/services/railway-source-policy.js

@@ -28,7 +28,7 @@ function assertApiRailwaySourcePolicy(scope, service) {
   const label = service.serviceName ?? service.key ?? "Railway service";
   if (normalizedScope === "staging") {
     const issues = [
-      /-production(?:-|$)/u.test(String(service.serviceName ?? "")) ? "serviceName must use the staging-only identity" : null,
+      /-production(?:-|$)/u.test(String(service.serviceName ?? "")) ? "serviceName must use the project-wide canonical identity" : null,
       service.sourceMode === "git" ? null : "sourceMode must be git",
       service.imageRef ? "imageRef must be empty" : null,
       service.sourceRepo ? null : "sourceRepo must be set",
@@ -43,7 +43,7 @@ function assertApiRailwaySourcePolicy(scope, service) {
   }
   if (normalizedScope === "prod") {
     const issues = [
-      /-production(?:-|$)/u.test(String(service.serviceName ?? "")) ? null : "serviceName must use a production-only identity",
+      /-production(?:-|$)/u.test(String(service.serviceName ?? "")) ? "serviceName must use the project-wide canonical identity" : null,
       service.sourceMode === "image" ? null : "sourceMode must be image",
       isImmutableRailwayImageRef(service.imageRef) ? null : "imageRef must be an immutable released image tag",
       service.sourceRepo ? "sourceRepo must be empty" : null,

package/dist/operations/services/repository-save-orchestrator.js

@@ -944,9 +944,10 @@ async function runGitDependencySmoke(node, options, reference) {
   void reference;
 }
 async function runNpmInstallWithRetry(node, options, gitDependencyRefreshSpecs = []) {
-  if (shouldSkipNetworkInstall()) {
-    emitProgress(options, node, "install", "Skipped npm install because network install mode is disabled.");
-    return { status: "skipped", attempts: 0, reason: "disabled" };
+  if (shouldSkipNetworkInstall() || options.deferPushUntilVerified === true) {
+    const reason = options.deferPushUntilVerified === true ? "atomic-save" : "disabled";
+    emitProgress(options, node, "install", `Skipped npm install because ${reason === "atomic-save" ? "atomic save validates local lock metadata before publishing commits" : "network install mode is disabled"}.`);
+    return { status: "skipped", attempts: 0, reason };
   }
   let lastError = null;
   const packageJson = node.packageJson ?? (existsSync(resolve(node.path, "package.json")) ? readJson(resolve(node.path, "package.json")) : null);
@@ -1030,9 +1031,10 @@ async function validateRepositoryLockfile(node, options) {
   }
   const { command, args } = lockfileValidationCommand(node, options);
   const commandText = `${command} ${args.join(" ")}`;
-  if (shouldSkipNetworkInstall()) {
-    emitProgress(options, node, "lockfile", `Skipped ${commandText} because network install mode is disabled.`);
-    return { status: "skipped", command: commandText, issues: [], error: "disabled" };
+  if (shouldSkipNetworkInstall() || options.deferPushUntilVerified === true) {
+    const reason = options.deferPushUntilVerified === true ? "atomic-save" : "disabled";
+    emitProgress(options, node, "lockfile", `Validated lockfile structure without ${commandText} because ${reason === "atomic-save" ? "upstream commits are intentionally unpublished" : "network install mode is disabled"}.`);
+    return { status: "passed", command: "treeseed structural lockfile validation", issues: [], error: null };
   }
   try {
     runCapturedCommand(node, options, "lockfile", command, args, { timeoutMs: lockfileValidationTimeoutMs(node, options), emitOutputOnSuccess: false });
@@ -1773,8 +1775,9 @@ async function saveOneRepository(node, options, state) {
     return value && typeof value === "object" && !Array.isArray(value) ? Object.keys(value) : [];
   }));
   const gitDependencyRefreshReferences = [...state.finalizedReferences.values()].filter((reference) => reference.mode === "dev-git-commit" && directDependencyNames.has(reference.packageName));
+  const deferredGitDependencyValidation = options.deferPushUntilVerified === true && gitDependencyRefreshReferences.length > 0;
   const lockfileGitDependenciesSynced = syncDirectGitDependencyLockfileEntries(node, options, gitDependencyRefreshReferences);
-  if (!isRootWorkspaceRepository(node, options) && (lockfileGitDependenciesSynced || gitDependencyRefreshReferences.length > 0 && !existsSync(resolve(node.path, "package-lock.json")))) {
+  if (!isRootWorkspaceRepository(node, options) && (lockfileGitDependenciesSynced || gitDependencyRefreshReferences.length > 0 && !existsSync(resolve(node.path, "package-lock.json"))) && !deferredGitDependencyValidation) {
     validateStandaloneGitDependencyLockfile(node, options);
   }
   const gitDependencyRefreshSpecs = lockfileGitDependenciesSynced ? [] : gitDependencyRefreshReferences.map((reference) => `${reference.packageName}@${reference.installSpec ?? reference.spec}`);
@@ -1809,7 +1812,7 @@ async function saveOneRepository(node, options, state) {
   } else if (node.kind === "project" && (dependencyChanged || node.path === options.root && submodulesChanged) && hasNpmLockfile(node.path)) {
     report.install = await runNpmInstallWithRetry(node, options, gitDependencyRefreshSpecs);
   }
-  if (!isRootWorkspaceRepository(node, options) && hasNpmLockfile(node.path) && (packageNeedsVersion || dependencyChanged)) {
+  if (!isRootWorkspaceRepository(node, options) && hasNpmLockfile(node.path) && (packageNeedsVersion || dependencyChanged) && !deferredGitDependencyValidation) {
     validateStandaloneGitDependencyLockfile(node, options);
   }
   if (hasNpmLockfile(node.path) && (node.kind === "project" || packageNeedsVersion || dependencyChanged || submodulesChanged)) {

package/dist/reconcile/builtin-adapters.js

@@ -43,6 +43,7 @@ import {
   configuredRailwayServices,
   findStaleTreeseedOperationsRunnerResources,
   isTreeseedOperationsRunnerResourceName,
+  railwayLegacyAliasMigrationPolicy,
   validateRailwayDeployPrerequisites
 } from "../operations/services/railway-deploy.js";
 import { shouldExposeManagedHostRuntimeSecret } from "../operations/services/managed-host-security.js";
@@ -3996,7 +3997,12 @@ async function syncRailwayEnvironmentForScope(input, { planOnly = false, service
       })),
       database: databaseForIac
     };
-    const siblingResourceNames = configuredRailwaySiblingResourceNames(input, scope, project.name);
+    const aliasMigration = railwayLegacyAliasMigrationPolicy(scope, projectServices);
+    const siblingResourceNames = [
+      ...configuredRailwaySiblingResourceNames(input, scope, project.name),
+      ...aliasMigration.retainedResourceNames
+    ];
+    const { allowedResourceDeletions } = aliasMigration;
     const {
       applyRailwayIacProject,
       cleanupRailwayIacRender,
@@ -4023,7 +4029,8 @@ async function syncRailwayEnvironmentForScope(input, { planOnly = false, service
         serviceSourceRefs: Object.fromEntries(effectiveIacInput.services.map((service) => [
           service.serviceName,
           service.sourceMode === "git" && service.sourceRepo ? `github:${service.sourceRepo}:${service.sourceBranch ?? ""}:${service.sourceRootDirectory ?? ""}:${service.sourceCommit ?? ""}` : service.sourceMode === "image" && service.imageRef ? `image:${service.imageRef}` : null
-        ]))
+        ])),
+        allowedResourceDeletions
       });
       if (!validation.ok && effectiveIacInput.database && !effectiveIacInput.database.useNativePostgres && railwayIacPlanDeletesResource(plan.changeSet, effectiveIacInput.database.serviceName)) {
         traceRailwayReconcile(topology.env, "sync:iac-native-postgres-adopt", `${project.name}/${environment.name}:${effectiveIacInput.database.serviceName}`);
@@ -4050,7 +4057,8 @@ async function syncRailwayEnvironmentForScope(input, { planOnly = false, service
           serviceSourceRefs: Object.fromEntries(effectiveIacInput.services.map((service) => [
             service.serviceName,
             service.sourceMode === "git" && service.sourceRepo ? `github:${service.sourceRepo}:${service.sourceBranch ?? ""}:${service.sourceRootDirectory ?? ""}:${service.sourceCommit ?? ""}` : service.sourceMode === "image" && service.imageRef ? `image:${service.imageRef}` : null
-          ]))
+          ])),
+          allowedResourceDeletions
         });
       }
       const retainedResources = selectRailwayIacRetainedResources(plan, siblingResourceNames);
@@ -4077,7 +4085,8 @@ async function syncRailwayEnvironmentForScope(input, { planOnly = false, service
           serviceSourceRefs: Object.fromEntries(effectiveIacInput.services.map((service) => [
             service.serviceName,
             service.sourceMode === "git" && service.sourceRepo ? `github:${service.sourceRepo}:${service.sourceBranch ?? ""}:${service.sourceRootDirectory ?? ""}:${service.sourceCommit ?? ""}` : service.sourceMode === "image" && service.imageRef ? `image:${service.imageRef}` : null
-          ]))
+          ])),
+          allowedResourceDeletions
         });
       }
       if (!validation.ok) {

package/dist/reconcile/providers/railway-iac.d.ts

@@ -66,6 +66,7 @@ export declare function validateRailwayIacChangeSet(changeSet: RailwayChangeSet
     scope: string;
     serviceSourceModes?: Record<string, string | null | undefined>;
     serviceSourceRefs?: Record<string, string | null | undefined>;
+    allowedResourceDeletions?: string[];
 }): RailwayIacValidationResult;
 export declare function planRailwayIacProject(input: TreeseedRailwayIacProjectInput, rendered?: TreeseedRailwayIacRenderResult): Promise<RailwayIacPlanResponse>;
 export declare function applyRailwayIacProject(input: TreeseedRailwayIacProjectInput, rendered?: TreeseedRailwayIacRenderResult): Promise<RailwayIacApplyResponse>;

package/dist/reconcile/providers/railway-iac.js

@@ -255,10 +255,11 @@ function validateRailwayIacChangeSet(changeSet, desiredNames) {
   const blockedReasons = [];
   const destructiveChanges = [];
   const desired = /* @__PURE__ */ new Set([...desiredNames.services, ...desiredNames.volumes, ...desiredNames.database ? [desiredNames.database] : []]);
+  const allowedResourceDeletions = new Set(desiredNames.allowedResourceDeletions ?? []);
   const created = new Set((changeSet?.changes ?? []).filter((change) => change.kind === "resource.create").map((change) => changeName(change)));
   for (const change of changeSet?.changes ?? []) {
     const name = changeName(change);
-    const serviceName = name.replace(/^(service|database)\./u, "");
+    const serviceName = name.replace(/^(service|database|volume)\./u, "");
     const sourceMode = desiredNames.serviceSourceModes?.[name] ?? desiredNames.serviceSourceModes?.[serviceName] ?? null;
     const sourceRef = desiredNames.serviceSourceRefs?.[name] ?? desiredNames.serviceSourceRefs?.[serviceName] ?? null;
     const sourceChanged = change.kind === "resource.update" && isRailwaySourceChange(change);
@@ -269,7 +270,9 @@ function validateRailwayIacChangeSet(changeSet, desiredNames) {
     const apiPolicyService = isApiRailwaySourcePolicyService({ serviceName });
     if (change.kind === "resource.delete") {
       destructiveChanges.push(change.summary);
-      blockedReasons.push(`Railway IaC plan would delete resource ${name || change.summary}; hosting reconciliation only updates or creates resources. Use the explicit destroy workflow for deletions.`);
+      if (!allowedResourceDeletions.has(name) && !allowedResourceDeletions.has(serviceName)) {
+        blockedReasons.push(`Railway IaC plan would delete resource ${name || change.summary}; hosting reconciliation only deletes explicitly recognized obsolete aliases. Use the explicit destroy workflow for other deletions.`);
+      }
       if (desired.has(name) && !created.has(name)) {
         blockedReasons.push(`Railway IaC plan would delete desired resource ${name}.`);
       }

package/dist/workflow/operations.d.ts

@@ -1144,6 +1144,10 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
             cached: boolean;
         }[];
     };
+    productionImageRefs: {
+        persisted: Record<string, string>;
+        readiness: import("../workflow-support.js").TreeseedDeploymentReadinessReport;
+    };
     backMerge: {
         packages: {
             status: string;

package/dist/workflow/operations.js

@@ -17,6 +17,7 @@ import {
   applyTreeseedSafeRepairs,
   assertTreeseedCommandEnvironment,
   checkTreeseedProviderConnections,
+  collectTreeseedEnvironmentContext,
   collectTreeseedConfigContext,
   collectTreeseedConfigSeedValues,
   collectTreeseedPrintEnvReport,
@@ -33,6 +34,7 @@ import {
   resolveTreeseedRemoteSession,
   rotateTreeseedMachineKey,
   setTreeseedRemoteSession,
+  setTreeseedMachineEnvironmentValue,
   writeTreeseedMachineConfig
 } from "../operations/services/config-runtime.js";
 import { formatTreeseedDependencyFailureDetails, installTreeseedDependencies } from "../managed-dependencies.js";
@@ -746,6 +748,20 @@ function productionReleaseImageRefVersions(root, selectedVersions) {
   }
   return versions;
 }
+function persistProductionReleaseImageRefs(root, releaseImageRefs) {
+  const registry = collectTreeseedEnvironmentContext(root);
+  const entries = new Map(registry.entries.map((entry) => [entry.id, entry]));
+  const persisted = {};
+  for (const [id, value] of Object.entries(releaseImageRefs)) {
+    const entry = entries.get(id) ?? { id, storage: "scoped", sensitivity: "plain" };
+    if (entry.sensitivity === "secret") {
+      workflowError("release", "validation_failed", `Production release image ref ${id} must be a non-secret environment value.`);
+    }
+    setTreeseedMachineEnvironmentValue(root, "prod", entry, value);
+    persisted[id] = value;
+  }
+  return persisted;
+}
 function stableVersionLine(version) {
   const match = version.match(/^(\d+\.\d+)\.\d+(?:-[0-9A-Za-z.-]+)?$/u);
   return match?.[1] ?? null;
@@ -2225,7 +2241,7 @@ function runReleaseNpmInstall(repoDir, options = {}) {
   if (shouldSkipReleaseInstall()) {
     return { status: "skipped", reason: "disabled" };
   }
-  const args = repoDir === options.workspaceRoot ? ["install", "--package-lock-only", "--ignore-scripts", "--no-audit", "--no-fund"] : ["install", "--package-lock-only", "--ignore-scripts", "--workspaces=false", "--no-audit", "--no-fund"];
+  const args = repoDir === options.workspaceRoot ? ["install", "--package-lock-only", "--ignore-scripts", "--workspaces=false", "--no-audit", "--no-fund"] : ["install", "--package-lock-only", "--ignore-scripts", "--workspaces=false", "--no-audit", "--no-fund"];
   const spawnCommand = npmCommandForWorkflowSpawn(args);
   let lastDetail = "";
   for (let attempt = 1; attempt <= 10; attempt += 1) {
@@ -4722,7 +4738,7 @@ async function workflowSave(helpers, input) {
               verifyMode: normalizeSaveVerifyMode(effectiveInput.verify === false ? "skip" : effectiveInput.verifyMode),
               commitMessageMode: effectiveInput.commitMessageMode ?? "auto",
               workflowRunId: workflowRun.runId,
-              deferPushUntilVerified: false,
+              deferPushUntilVerified: true,
               onProgress: (line, stream) => helpers.write(line, stream),
               onWaveSaved: branch === STAGING_BRANCH && shouldUseHostedSaveCi(effectiveInput, branch, saveLane) ? async ({ nodes, reports, rootRepo: waveRootRepo }) => {
                 const nonRootReportsForWave = reports.filter((repo, index) => nodes[index]?.id !== ".");
@@ -5695,10 +5711,12 @@ ${currentBlockers.map((entry) => `- ${entry}`).join("\n")}`, {
           { root, runId: workflowRun.runId, onProgress: (line, stream) => helpers.write(line, stream) }
         )) : (skipJournalStep(root, workflowRun.runId, "hosted-ci", { skippedReason: "ci off" }), { status: "skipped", reason: "ci off" });
         const workspaceLinks = await executeJournalStep(root, workflowRun.runId, "workspace-link-restore", () => ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto"));
-        for (const repo of checkedOutStagePromotionRepos(root)) {
-          syncBranchWithOrigin(repo.dir, STAGING_BRANCH);
+        if (!managedWorkflowWorktreeMetadata(root)) {
+          for (const repo of checkedOutStagePromotionRepos(root)) {
+            syncBranchWithOrigin(repo.dir, STAGING_BRANCH);
+          }
+          syncBranchWithOrigin(repoRoot(root), STAGING_BRANCH);
         }
-        syncBranchWithOrigin(repoRoot(root), STAGING_BRANCH);
         const cleanup = cleanupMode === "success" ? await executeJournalStep(root, workflowRun.runId, "cleanup-source", () => cleanupStageSourceBranches(root, featureBranch, typedManifest)) : (skipJournalStep(root, workflowRun.runId, "cleanup-source", { skippedReason: "manual cleanup selected" }), { status: "skipped", reason: "manual cleanup selected" });
         const payload = {
           ...basePayload,
@@ -6000,6 +6018,7 @@ ${blockers.join("\n")}`, {
           },
           { id: "verify-published-artifacts", description: "Verify immutable registry artifacts exist after publish workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "production-package-deploy-workflows", description: "Wait for production package deploy workflows before live verification", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
+          { id: "persist-production-image-refs", description: "Persist released production image refs and verify deployment readiness", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "release-root", description: `Release market ${plannedRelease.rootVersion}`, repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           { id: "publish-wait", description: "Wait for production release workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "release-back-merge", description: "Back-merge production release history into staging", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
@@ -6132,6 +6151,26 @@ ${rendered}`);
             onProgress: (line, stream) => helpers.write(line, stream)
           }).then((workflowGates) => ({ workflowGates }));
         });
+        const productionImageRefs = await executeJournalStep(root, workflowRun.runId, "persist-production-image-refs", async () => {
+          const persisted = persistProductionReleaseImageRefs(root, releaseImageRefs);
+          if (helpers.context.env) {
+            Object.assign(helpers.context.env, persisted);
+            Object.assign(process.env, persisted);
+          }
+          const readiness = await withContextEnv(persisted, () => collectTreeseedDeploymentReadiness({
+            tenantRoot: root,
+            environment: "prod",
+            appId: singleSelectedWorkflowAppId(plannedRelease.applicationSelection)
+          }));
+          const failures = readiness.checks.filter((check) => check.status === "failed").map((check) => `${check.id}: ${check.message}${check.remediation ? ` Remediation: ${check.remediation}` : ""}`);
+          if (failures.length > 0) {
+            workflowError("release", "hosted_live_verification_failed", `Production readiness failed after persisting released image refs:
+${failures.join("\n")}`, {
+              details: { releaseImageRefs: persisted, readiness }
+            });
+          }
+          return { persisted, readiness };
+        });
         const rootRelease = await executeJournalStep(root, workflowRun.runId, "release-root", () => {
           const rootInstall = runReleaseNpmInstall(root, { workspaceRoot: root });
           const changelog = updateReleaseChangelog(repoRoot(root), {
@@ -6205,6 +6244,7 @@ ${rendered}`);
           publishWait: publishWait.workflowGates,
           publishedArtifacts,
           productionPackageDeployWorkflows,
+          productionImageRefs,
           backMerge,
           workspaceLinks,
           releasedCommit: String(rootRelease.commit.commitSha ?? ""),

package/dist/workflow/runs.js

@@ -435,6 +435,18 @@ function collectSaveExpectedHeads(journal) {
   }
   return heads;
 }
+function collectStageExpectedHeads(journal) {
+  const heads = {};
+  const promotion = stringRecord(journal.steps.find((step) => step.id === "promote-to-staging")?.data);
+  const results = Array.isArray(promotion?.results) ? promotion.results : [];
+  for (const entry of results) {
+    const repo = stringRecord(entry);
+    if (typeof repo?.name === "string" && typeof repo.commitSha === "string" && repo.verified === true) {
+      heads[repo.name] = repo.commitSha;
+    }
+  }
+  return heads;
+}
 function classifyWorkflowRunJournal(journal, options = {}) {
   const reasons = [];
   const now = options.now ?? nowIso();
@@ -516,6 +528,15 @@ function classifyWorkflowRunJournal(journal, options = {}) {
       }
     }
   }
+  if (journal.command === "stage" && options.currentHeads) {
+    const expectedHeads = collectStageExpectedHeads(journal);
+    for (const [name, expectedHead] of Object.entries(expectedHeads)) {
+      const currentHead = options.currentHeads[name];
+      if (currentHead && currentHead !== expectedHead) {
+        reasons.push(`${name} head changed from staged candidate ${expectedHead} to ${currentHead}`);
+      }
+    }
+  }
   return {
     state: reasons.length > 0 ? "stale" : "resumable",
     reasons: reasons.length > 0 ? reasons : releaseGateOnlyCompletion ? ["release commits already exist; remaining release gates can be rechecked"] : ["workflow run can be resumed"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.12.58",
+  "version": "0.12.60",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {