@tridha643/hestia 1.2.0 → 1.3.1

package/dist/daemon.js

@@ -6947,7 +6947,7 @@ var require_public_api = __commonJS((exports) => {
 // packages/engine/src/daemon/main.ts
 import { chmodSync as chmodSync6, rmSync as rmSync11 } from "fs";
 import { randomBytes } from "crypto";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 
 // packages/session-broker-core/src/limits.ts
 var MAX_HTTP_BODY_BYTES = 4 * 1024 * 1024;
@@ -7893,7 +7893,7 @@ function parsePidfile(source, path) {
   if (pidfile.schemaVersion !== undefined && pidfile.schemaVersion !== STATE_SCHEMA_VERSION) {
     throw new HestiaError("state-corrupt", `invalid pidfile ${path}: unsupported schemaVersion`, { path });
   }
-  if (typeof pidfile.name !== "string" || !Number.isInteger(pidfile.pid) || typeof pidfile.startTime !== "string" || typeof pidfile.logPath !== "string") {
+  if (typeof pidfile.name !== "string" || !Number.isSafeInteger(pidfile.pid) || pidfile.pid <= 0 || typeof pidfile.startTime !== "string" || typeof pidfile.logPath !== "string") {
     throw new HestiaError("state-corrupt", `invalid pidfile ${path}: missing process identity`, { path });
   }
   if (pidfile.schemaVersion === STATE_SCHEMA_VERSION && typeof pidfile.specFingerprint !== "string") {
@@ -7911,12 +7911,25 @@ function removePidfile(worktreeRoot, name) {
   rmSync2(pidfilePath(worktreeRoot, name), { force: true });
 }
 function listPidfiles(dir) {
+  const scan = scanPidfiles(dir);
+  if (scan.errors[0] !== undefined)
+    throw scan.errors[0];
+  return scan.pidfiles;
+}
+function scanPidfiles(dir) {
   if (!existsSync(dir))
-    return [];
-  return readdirSync(dir).filter((f) => f.endsWith(".json")).map((f) => {
-    const path = join(dir, f);
-    return parsePidfile(readFileSync(path, "utf8"), path);
-  });
+    return { pidfiles: [], errors: [] };
+  const pidfiles = [];
+  const errors = [];
+  for (const file of readdirSync(dir).filter((candidate) => candidate.endsWith(".json"))) {
+    const path = join(dir, file);
+    try {
+      pidfiles.push(parsePidfile(readFileSync(path, "utf8"), path));
+    } catch (error) {
+      errors.push(error);
+    }
+  }
+  return { pidfiles, errors };
 }
 function procSpecFingerprint(spec) {
   const env = Object.entries(spec.env ?? {}).sort(([left], [right]) => left.localeCompare(right));
@@ -7929,23 +7942,28 @@ function procSpecFingerprint(spec) {
     backend: spec.backend ?? "proc",
     resolver: spec.varlock ? "varlock" : "direct",
     inspectorPort: spec.inspectorPort ?? null,
+    healthPath: spec.healthPath ?? null,
     configPath: spec.configPath ?? null,
     originService: spec.originService ?? null,
     originEndpoint: spec.originEndpoint ?? null
   });
   return createHash2("sha256").update(canonical).digest("hex");
 }
-function readProcessStartTime(pid, env) {
+function probeProcessStartTime(pid, env) {
   try {
     const out = execFileSync("ps", ["-o", "lstart=", "-p", String(pid)], {
       encoding: "utf8",
       env
     }).trim();
-    return out === "" ? null : out;
+    return { status: "ok", value: out === "" ? null : out };
   } catch {
-    return null;
+    return { status: "error" };
   }
 }
+function readProcessStartTime(pid, env) {
+  const result = probeProcessStartTime(pid, env);
+  return result.status === "ok" ? result.value : null;
+}
 function startTimeOf(pid) {
   return readProcessStartTime(pid, { ...process.env, LC_ALL: "C", LANG: "C" });
 }
@@ -8009,30 +8027,40 @@ function plausibleProcessLocales(canonicalStartTime, recordedStartTime) {
   });
   return [...new Set(plausible)];
 }
-function legacyLocalizedStartTimeMatches(pid, canonicalStartTime, recordedStartTime) {
+function probeLegacyLocalizedStartTime(pid, canonicalStartTime, recordedStartTime) {
   const cacheKey = `${pid}\x00${canonicalStartTime}\x00${recordedStartTime}`;
   const cached = legacyStartTimeMatches.get(cacheKey);
   if (cached !== undefined)
-    return cached;
+    return cached ? "live" : "dead";
   let matched = false;
+  let readFailed = false;
   for (const locale of plausibleProcessLocales(canonicalStartTime, recordedStartTime)) {
-    const localized = readProcessStartTime(pid, {
+    const read = probeProcessStartTime(pid, {
       ...process.env,
       LC_ALL: locale,
       LANG: locale
     });
-    if (localized !== null && processStartTimeMatches(localized, recordedStartTime)) {
+    if (read.status === "error") {
+      readFailed = true;
+      continue;
+    }
+    if (read.value !== null && processStartTimeMatches(read.value, recordedStartTime)) {
       matched = true;
       break;
     }
   }
+  if (!matched && readFailed)
+    return "unknown";
   if (legacyStartTimeMatches.size >= 512) {
     const oldest = legacyStartTimeMatches.keys().next().value;
     if (oldest !== undefined)
       legacyStartTimeMatches.delete(oldest);
   }
   legacyStartTimeMatches.set(cacheKey, matched);
-  return matched;
+  return matched ? "live" : "dead";
+}
+function legacyLocalizedStartTimeMatches(pid, canonicalStartTime, recordedStartTime) {
+  return probeLegacyLocalizedStartTime(pid, canonicalStartTime, recordedStartTime) === "live";
 }
 function processStartTimeMatches(current, recorded) {
   if (current === recorded)
@@ -8054,6 +8082,27 @@ function isLive(pf) {
     return true;
   return current !== null && legacyLocalizedStartTimeMatches(pf.pid, current, pf.startTime);
 }
+function probeProcessIdentity(pf) {
+  try {
+    process.kill(pf.pid, 0);
+  } catch (error) {
+    return error.code === "ESRCH" ? "dead" : "unknown";
+  }
+  let current;
+  try {
+    current = execFileSync("ps", ["-o", "lstart=", "-p", String(pf.pid)], {
+      encoding: "utf8",
+      env: { ...process.env, LC_ALL: "C", LANG: "C" }
+    }).trim();
+  } catch {
+    return "unknown";
+  }
+  if (current === "")
+    return "dead";
+  if (processStartTimeMatches(current, pf.startTime))
+    return "live";
+  return probeLegacyLocalizedStartTime(pf.pid, current, pf.startTime);
+}
 
 // packages/engine/src/proc/lock.ts
 var RETRY_MS = 100;
@@ -8208,6 +8257,13 @@ function readMirrorState(project) {
   chmodSync3(p, 384);
   return record;
 }
+function readMirrorStateSafe(project) {
+  try {
+    return { status: "ok", record: readMirrorState(project) };
+  } catch (error) {
+    return { status: "error", error };
+  }
+}
 function clearState(worktreeRoot, project) {
   const p = statePath(worktreeRoot);
   if (existsSync2(p))
@@ -8221,7 +8277,7 @@ function clearState(worktreeRoot, project) {
 import { existsSync as existsSync21, rmSync as rmSync10 } from "fs";
 import { execFile as execFile10 } from "child_process";
 import { promisify as promisify9 } from "util";
-import { join as join24, resolve as resolve2 } from "path";
+import { join as join25, resolve as resolve3 } from "path";
 import { createHash as createHash7 } from "crypto";
 import { resolve4, resolve6, resolveCname } from "dns/promises";
 
@@ -8543,6 +8599,27 @@ import { existsSync as existsSync4, readFileSync as readFileSync6 } from "fs";
 import { join as join6 } from "path";
 var WORKLOAD_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 var BINDING = /^(?:main|[1-9][0-9]{0,4})\/(?:tcp|udp)$/;
+var ENVIRONMENT_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function parseEnvironment(value, path) {
+  if (value === undefined)
+    return {};
+  const environment = {};
+  for (const [name, rawValue] of Object.entries(table(value, path))) {
+    if (!ENVIRONMENT_KEY.test(name))
+      throw new Error(`${path} has invalid environment key ${JSON.stringify(name)}`);
+    if (typeof rawValue === "string") {
+      environment[name] = rawValue;
+      continue;
+    }
+    const fileValue = table(rawValue, `${path}.${name}`);
+    knownKeys(fileValue, ["file"], `${path}.${name}`);
+    if (typeof fileValue.file !== "string" || !/^\.hestia\//.test(fileValue.file) || fileValue.file.includes("..")) {
+      throw new Error(`${path}.${name}.file must be a path below .hestia/`);
+    }
+    environment[name] = { file: fileValue.file };
+  }
+  return environment;
+}
 function emptyConfig() {
   return { version: 1, workloads: {} };
 }
@@ -8602,7 +8679,19 @@ function parseRepositoryWorkloadConfig(source, path) {
       if (!WORKLOAD_NAME.test(name))
         throw new Error(`invalid workload name ${JSON.stringify(name)}`);
       const workload = table(rawWorkload, `workloads.${name}`);
-      knownKeys(workload, ["source", "compose_service", "dockerfile", "command", "wrangler_config", "port", "endpoints"], `workloads.${name}`);
+      knownKeys(workload, [
+        "source",
+        "compose_service",
+        "dockerfile",
+        "command",
+        "wrangler_config",
+        "port",
+        "cwd",
+        "varlock",
+        "health_path",
+        "env",
+        "endpoints"
+      ], `workloads.${name}`);
       if (!["compose", "dockerfile", "proc", "wrangler"].includes(workload.source)) {
         throw new Error(`workloads.${name}.source must be compose, dockerfile, proc, or wrangler`);
       }
@@ -8618,6 +8707,18 @@ function parseRepositoryWorkloadConfig(source, path) {
           throw new Error(`workloads.${name}.${key} must be a string`);
         }
       }
+      if (workload.cwd !== undefined && typeof workload.cwd !== "string") {
+        throw new Error(`workloads.${name}.cwd must be a string`);
+      }
+      if (workload.varlock !== undefined && typeof workload.varlock !== "boolean") {
+        throw new Error(`workloads.${name}.varlock must be a boolean`);
+      }
+      if (workload.health_path !== undefined && (typeof workload.health_path !== "string" || !workload.health_path.startsWith("/"))) {
+        throw new Error(`workloads.${name}.health_path must start with /`);
+      }
+      if (workload.health_path !== undefined && workload.port === "none") {
+        throw new Error(`workloads.${name}.health_path requires a port`);
+      }
       if (sourceKind === "compose" && typeof workload.compose_service !== "string") {
         throw new Error(`workloads.${name}.compose_service is required for compose`);
       }
@@ -8631,6 +8732,10 @@ function parseRepositoryWorkloadConfig(source, path) {
         command: workload.command,
         wranglerConfig: workload.wrangler_config,
         port: workload.port,
+        cwd: workload.cwd,
+        varlock: workload.varlock,
+        healthPath: workload.health_path,
+        env: parseEnvironment(workload.env, `workloads.${name}.env`),
         endpoints: parseEndpoints(workload.endpoints, `workloads.${name}.endpoints`)
       };
     }
@@ -8689,7 +8794,12 @@ function sameEndpoint(left, right) {
   return left.binding === right.binding && left.kind === right.kind && left.local === right.local;
 }
 function cloneWorkload(workload) {
-  return { ...workload, command: workload.command?.slice(), endpoints: { ...workload.endpoints } };
+  return {
+    ...workload,
+    command: workload.command?.slice(),
+    env: { ...workload.env },
+    endpoints: { ...workload.endpoints }
+  };
 }
 function mergeConfigLayers(repository, machine) {
   const workloads = {};
@@ -8715,6 +8825,10 @@ function mergeConfigLayers(repository, machine) {
       conflicts.push(`machine workload ${name} cannot replace committed source ${committed.source} with ${overlay.source}`);
       continue;
     }
+    committed.cwd = overlay.cwd ?? committed.cwd;
+    committed.varlock = overlay.varlock ?? committed.varlock;
+    committed.healthPath = overlay.healthPath ?? committed.healthPath;
+    committed.env = { ...committed.env, ...overlay.env };
     for (const [alias, endpoint] of Object.entries(overlay.endpoints)) {
       const existing = committed.endpoints[alias];
       if (existing !== undefined && !sameEndpoint(existing, endpoint)) {
@@ -8993,7 +9107,7 @@ async function composeUp(ctx, services) {
 async function composeDown(ctx, destroy) {
   const rest = ["down", "--remove-orphans"];
   if (destroy)
-    rest.push("-v");
+    rest.push("-v", "--rmi", "local");
   await docker(ctx, rest);
 }
 async function composePs(ctx) {
@@ -9074,7 +9188,7 @@ function allocatePort() {
     });
   });
 }
-function psSnapshot() {
+function tryPsSnapshot() {
   try {
     const out = execFileSync2("ps", ["-A", "-o", "pid=,pgid=,ppid="], {
       encoding: "utf8",
@@ -9089,11 +9203,10 @@ function psSnapshot() {
     }
     return rows;
   } catch {
-    return [];
+    return null;
   }
 }
-function processTree(rootPid) {
-  const rows = psSnapshot();
+function processTreeFromSnapshot(rootPid, rows) {
   const byParent = new Map;
   for (const r of rows) {
     const list = byParent.get(r.ppid) ?? [];
@@ -9116,6 +9229,9 @@ function processTree(rootPid) {
   }
   return tree;
 }
+function processTree(rootPid) {
+  return processTreeFromSnapshot(rootPid, tryPsSnapshot() ?? []);
+}
 function parseLsof(out) {
   const listeners = [];
   let pid = 0;
@@ -9152,12 +9268,12 @@ async function allListeners() {
       return parseLsof(stdout);
     } catch (err) {
       const e = err;
-      if (typeof e.stdout === "string" && e.code !== "ENOENT") {
+      if (typeof e.stdout === "string" && e.code === 1 && (e.stderr ?? "").trim() === "") {
         tool = "lsof";
         return parseLsof(e.stdout);
       }
-      if (tool === "lsof")
-        return [];
+      if (e.code !== "ENOENT")
+        throw err;
     }
   }
   try {
@@ -9166,16 +9282,24 @@ async function allListeners() {
     });
     tool = "ss";
     return parseSs(stdout);
-  } catch {
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      throw error;
     throw new HestiaError("ownership-tool-missing", "neither lsof nor ss is available \u2014 cannot verify port ownership " + "(required: tools like next dev silently bind a different port when " + "theirs is taken, so a bare listen-check would report the wrong port healthy)");
   }
 }
 async function inspectPort(rootPid, port) {
-  const members = new Set(processTree(rootPid).map((r) => r.pid));
+  const firstSnapshot = tryPsSnapshot();
+  if (firstSnapshot === null)
+    throw new Error("Port ownership process-tree inspection failed: ps unavailable");
+  const members = new Set(processTreeFromSnapshot(rootPid, firstSnapshot).map((r) => r.pid));
   const listeners = await allListeners();
   const owner = listeners.find((l) => l.port === port);
   if (owner !== undefined && !members.has(owner.pid)) {
-    for (const member of processTree(rootPid))
+    const secondSnapshot = tryPsSnapshot();
+    if (secondSnapshot === null)
+      throw new Error("Port ownership process-tree recheck failed: ps unavailable");
+    for (const member of processTreeFromSnapshot(rootPid, secondSnapshot))
       members.add(member.pid);
   }
   return {
@@ -9237,19 +9361,32 @@ async function stopProcTree(t, graceMs = GRACE_MS) {
 
 // packages/engine/src/proc/resolver.ts
 import { existsSync as existsSync6 } from "fs";
-import { join as join8 } from "path";
-function detectVarlock(worktreeRoot) {
-  const schema = join8(worktreeRoot, ".env.schema");
-  const bin = join8(worktreeRoot, "node_modules", ".bin", "varlock");
-  return existsSync6(schema) && existsSync6(bin) ? bin : null;
+import { dirname as dirname3, join as join8, resolve as resolve2 } from "path";
+function detectVarlock(worktreeRoot, workingDirectory = worktreeRoot) {
+  const root = resolve2(worktreeRoot);
+  const cwd = resolve2(workingDirectory);
+  if (!existsSync6(join8(cwd, ".env.schema")))
+    return null;
+  let directory = cwd;
+  for (;; ) {
+    const bin = join8(directory, "node_modules", ".bin", "varlock");
+    if (existsSync6(bin))
+      return bin;
+    if (directory === root)
+      return null;
+    const parent = dirname3(directory);
+    if (parent === directory || !parent.startsWith(root))
+      return null;
+    directory = parent;
+  }
 }
 function wrapWithVarlock(bin, argv) {
   return [bin, "run", "--no-redact-stdout", "--", ...argv];
 }
-function requireVarlock(worktreeRoot) {
-  const bin = detectVarlock(worktreeRoot);
+function requireVarlock(worktreeRoot, workingDirectory = worktreeRoot) {
+  const bin = detectVarlock(worktreeRoot, workingDirectory);
   if (bin === null) {
-    throw new HestiaError("varlock-missing", `--varlock requires both ${join8(worktreeRoot, ".env.schema")} and a local ` + `node_modules/.bin/varlock in the worktree`);
+    throw new HestiaError("varlock-missing", `--varlock requires ${join8(workingDirectory, ".env.schema")} and a local ` + `node_modules/.bin/varlock between that directory and the worktree root`);
   }
   return bin;
 }
@@ -9281,7 +9418,7 @@ function spawnOnce(argv, cwd, env, logPath, attempt) {
   closeSync2(openProcAttemptLog(logPath, attempt));
   const relaySpec = Buffer.from(JSON.stringify({ argv, cwd, env, logPath })).toString("base64");
   const relayFd = openSync2(logPath, "a", 384);
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const child = spawn(process.execPath, [PROC_RELAY_ENTRYPOINT], {
       cwd,
       env: { ...process.env, [RELAY_SPEC_ENV]: relaySpec },
@@ -9295,7 +9432,7 @@ function spawnOnce(argv, cwd, env, logPath, attempt) {
     child.once("spawn", () => {
       closeSync2(relayFd);
       child.unref();
-      resolve2(child.pid);
+      resolve3(child.pid);
     });
   });
 }
@@ -9312,18 +9449,22 @@ async function startProc(worktreeRoot, spec, stackEnv, mirrorPidfile2) {
   const cwd = spec.cwd ? join9(worktreeRoot, spec.cwd) : worktreeRoot;
   const wantPort = spec.port !== "none";
   const readyTimeoutMs = spec.readyTimeoutMs ?? READY_TIMEOUT_MS;
-  const varlockBin = spec.varlock ? requireVarlock(worktreeRoot) : null;
+  const varlockBin = spec.varlock ? requireVarlock(worktreeRoot, cwd) : null;
   let lastFailure = "";
   for (let attempt = 1;attempt <= MAX_ATTEMPTS; attempt++) {
     const port = wantPort ? await allocatePort() : undefined;
     let argv = port === undefined ? spec.argv : substitutePort(spec.argv, port);
     if (varlockBin !== null)
       argv = wrapWithVarlock(varlockBin, argv);
+    const resolvedSpecEnvironment = port === undefined ? spec.env : Object.fromEntries(Object.entries(spec.env ?? {}).map(([name, value]) => [
+      name,
+      substitutePort([value], port)[0]
+    ]));
     const env = {
       ...process.env,
       ...stackEnv,
       ...port !== undefined ? { PORT: String(port), [`HESTIA_${envKey(spec.name)}_PORT`]: String(port) } : {},
-      ...spec.env
+      ...resolvedSpecEnvironment
     };
     const pid = await spawnOnce(argv, cwd, env, logPath, attempt);
     const startTime = startTimeOf(pid) ?? "";
@@ -9343,7 +9484,7 @@ async function startProc(worktreeRoot, spec, stackEnv, mirrorPidfile2) {
     };
     writePidfile(worktreeRoot, pf);
     mirrorPidfile2?.(pf);
-    const outcome = await waitUntilReady(pf, port, readyTimeoutMs);
+    const outcome = await waitUntilReady(pf, port, readyTimeoutMs, spec.healthPath);
     const record = {
       name: spec.name,
       backend: pf.backend,
@@ -9379,7 +9520,7 @@ async function startProc(worktreeRoot, spec, stackEnv, mirrorPidfile2) {
         continue;
       case "timeout": {
         record.state = "unhealthy";
-        const bound = outcome.memberPorts.length > 0 ? `it is listening on port(s) ${outcome.memberPorts.join(", ")} instead` : `it never opened a listening socket (if it isn't a server, use --no-port)`;
+        const bound = outcome.healthPending ? `it owned port ${port}, but ${spec.healthPath} never returned a 2xx response` : outcome.memberPorts.length > 0 ? `it is listening on port(s) ${outcome.memberPorts.join(", ")} instead` : `it never opened a listening socket (if it isn't a server, use --no-port)`;
         return {
           record,
           pidfile: pf,
@@ -9390,33 +9531,46 @@ async function startProc(worktreeRoot, spec, stackEnv, mirrorPidfile2) {
   }
   throw new HestiaError("port-allocation-failed", `could not hold a port for "${spec.name}" after ${MAX_ATTEMPTS} attempts (${lastFailure})`);
 }
-async function waitUntilReady(pf, port, timeoutMs) {
+async function waitUntilReady(pf, port, timeoutMs, healthPath) {
   const deadline = Date.now() + timeoutMs;
   if (port === undefined) {
     await new Promise((r) => setTimeout(r, NO_PORT_GRACE_MS));
     return isLive(pf) ? { kind: "ready" } : { kind: "exited" };
   }
   let memberPorts = [];
+  let ownershipProven = false;
   while (Date.now() < deadline) {
     if (!isLive(pf))
       return { kind: "exited" };
-    const view = await inspectPort(pf.pgid, port);
-    memberPorts = view.memberPorts;
-    if (view.ownerIsMember)
-      return { kind: "ready" };
-    if (view.owner !== undefined) {
-      return { kind: "stolen", byPid: view.owner.pid };
+    if (!ownershipProven) {
+      const view = await inspectPort(pf.pgid, port);
+      memberPorts = view.memberPorts;
+      if (view.ownerIsMember)
+        ownershipProven = true;
+      else if (view.owner !== undefined)
+        return { kind: "stolen", byPid: view.owner.pid };
+    }
+    if (ownershipProven) {
+      if (healthPath === undefined)
+        return { kind: "ready" };
+      try {
+        const response = await fetch(`http://127.0.0.1:${port}${healthPath}`);
+        if (response.ok)
+          return { kind: "ready" };
+      } catch {}
     }
     await new Promise((r) => setTimeout(r, POLL_MS2));
   }
-  return { kind: "timeout", memberPorts };
+  return {
+    kind: "timeout",
+    memberPorts,
+    healthPending: healthPath !== undefined && ownershipProven
+  };
 }
 
 // packages/engine/src/router/local-http-router.ts
-import { execFile as execFile7 } from "child_process";
 import { Agent, createServer as createServer2, request as httpRequest } from "http";
 import { createConnection, createServer as createNetServer } from "net";
-import { promisify as promisify6 } from "util";
 import { existsSync as existsSync14, readFileSync as readFileSync14, readdirSync as readdirSync5 } from "fs";
 import { chmodSync as chmodSync5, lstatSync, mkdirSync as mkdirSync7, rmSync as rmSync9 } from "fs";
 import { tmpdir } from "os";
@@ -9630,7 +9784,7 @@ function resolveLocalRouteHostnames(records, config = readHestiaMachineConfig().
 import { execFile as execFile6, spawnSync } from "child_process";
 import { existsSync as existsSync12, readFileSync as readFileSync12, rmSync as rmSync7, statSync } from "fs";
 import { promisify as promisify5 } from "util";
-import { dirname as dirname4, join as join15 } from "path";
+import { dirname as dirname5, join as join15 } from "path";
 
 // packages/engine/src/daemon/ensure.ts
 import { closeSync as closeSync3, openSync as openSync3 } from "fs";
@@ -9693,12 +9847,12 @@ function resolveMaxStacks() {
   }
   return { maxStacks: DEFAULT_MAX_STACKS, warnings };
 }
-var dockerProbe = (project) => new Promise((resolve2) => {
+var dockerProbe = (project) => new Promise((resolve3) => {
   execFile5("docker", ["ps", "-q", "--filter", `label=${LABELS.stack}=${project}`], { timeout: DOCKER_PROBE_TIMEOUT_MS }, (err, stdout) => {
     if (err)
-      resolve2(null);
+      resolve3(null);
     else
-      resolve2(stdout.trim() === "" ? "dead" : "live");
+      resolve3(stdout.trim() === "" ? "dead" : "live");
   });
 });
 
@@ -9929,7 +10083,7 @@ async function releaseSharedForProject(port, project, service) {
 import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync11, rmSync as rmSync6 } from "fs";
 import { execFileSync as execFileSync3 } from "child_process";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join13 } from "path";
+import { dirname as dirname4, join as join13 } from "path";
 import { fileURLToPath } from "url";
 var LAUNCHD_LABEL = "dev.hestia.daemon";
 function launchAgentsDir() {
@@ -9939,7 +10093,7 @@ function plistPath() {
   return join13(launchAgentsDir(), `${LAUNCHD_LABEL}.plist`);
 }
 function daemonMainPath() {
-  const bundled = join13(dirname3(fileURLToPath(import.meta.url)), "daemon.js");
+  const bundled = join13(dirname4(fileURLToPath(import.meta.url)), "daemon.js");
   if (existsSync11(bundled))
     return bundled;
   return fileURLToPath(new URL("./main.ts", import.meta.url));
@@ -9976,10 +10130,10 @@ function kickstart() {
 }
 
 // packages/engine/src/daemon/routes.ts
-var HESTIAD_PROTOCOL_VERSION = 5;
+var HESTIAD_PROTOCOL_VERSION = 6;
 var MAX_JSON_BODY_BYTES = 16 * 1024;
 var MAX_LOG_STREAMS = 16;
-var MAX_LOG_TAIL = 200;
+var MAX_LOG_TAIL = 2000;
 function admissionIdentity(identity2) {
   if (typeof identity2 !== "string")
     return identity2;
@@ -10016,14 +10170,14 @@ class Admission {
     const first = await this.#locked(() => this.#try(identity2, holder));
     if (first.granted || waitMs <= 0)
       return first;
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       const waiter = {
         identity: identity2,
         holder,
-        resolve: resolve2,
+        resolve: resolve3,
         timer: setTimeout(() => {
           this.#queue = this.#queue.filter((candidate) => candidate !== waiter);
-          resolve2({ granted: false, live: first.live });
+          resolve3({ granted: false, live: first.live });
         }, waitMs)
       };
       this.#queue.push(waiter);
@@ -10085,11 +10239,11 @@ class Admission {
     return { granted: false, live: occupancy.live };
   }
   async#pump() {
-    if (this.#queue.length === 0)
-      return;
     const { maxStacks } = resolveMaxStacks();
     const occupancy = await this.ledger.occupancy();
     this.#cache(occupancy);
+    if (this.#queue.length === 0)
+      return;
     let used = occupancy.live.length + occupancy.reserved.length;
     const granted = [];
     for (const waiter of this.#queue) {
@@ -10716,8 +10870,86 @@ async function updateSharedHostname(name, mutate) {
   });
 }
 
-// packages/engine/src/router/local-http-router.ts
+// packages/engine/src/router/origin-liveness.ts
+import { execFile as execFile7 } from "child_process";
+import { promisify as promisify6 } from "util";
 var pexec6 = promisify6(execFile7);
+async function probeDockerOrigin(target, port) {
+  try {
+    const service = target.service;
+    const args = [
+      "ps",
+      "--no-trunc",
+      "--format",
+      "{{.ID}}\t{{.Ports}}",
+      "--filter",
+      `label=dev.hestia.stack=${target.project}`,
+      "--filter",
+      `label=com.docker.compose.service=${service.name}`
+    ];
+    const { stdout } = await pexec6("docker", args, { timeout: 2000 });
+    const matches = stdout.split(`
+`).some((line) => {
+      const [id, ports = ""] = line.split("\t");
+      const identityMatches = service.containerId === undefined || id?.startsWith(service.containerId);
+      return identityMatches && new RegExp(`(?:127\\.0\\.0\\.1|0\\.0\\.0\\.0):${port}->`).test(ports);
+    });
+    return matches ? "live" : "dead";
+  } catch {
+    return "unknown";
+  }
+}
+async function probeProcOrigin(service, port) {
+  if (service.pid === undefined || service.startTime === undefined)
+    return "dead";
+  if (!Number.isSafeInteger(service.pid) || service.pid <= 0 || typeof service.startTime !== "string") {
+    throw new Error("Route origin has an invalid process identity");
+  }
+  const identity2 = probeProcessIdentity({ pid: service.pid, startTime: service.startTime });
+  if (identity2 !== "live")
+    return identity2;
+  try {
+    return (await inspectPort(service.pid, port)).ownerIsMember ? "live" : "dead";
+  } catch {
+    return "unknown";
+  }
+}
+async function probeLocalRouterTarget(target) {
+  const service = target.service;
+  const port = service?.publishedPort;
+  if (service === undefined || port === undefined || service.backend === "tunnel")
+    return "dead";
+  return service.backend === "docker" ? await probeDockerOrigin(target, port) : await probeProcOrigin(service, port);
+}
+async function verifyLocalRouterTarget(target) {
+  const port = target.service?.publishedPort;
+  try {
+    return port !== undefined && await probeLocalRouterTarget(target) === "live" ? port : null;
+  } catch {
+    return null;
+  }
+}
+async function verifyStackServiceOrigin(record, service, publishedPort = service.publishedPort) {
+  return await verifyLocalRouterTarget({
+    project: record.project,
+    service: { ...service, publishedPort }
+  }) !== null;
+}
+function resolveSharedContractOrigin(mirror, contractService) {
+  const endpoint = mirror.endpoints.find((candidate) => (candidate.alias ?? candidate.name) === contractService);
+  const service = mirror.services.find((candidate) => candidate.name === (endpoint?.workload ?? endpoint?.name));
+  const binding = service?.bindings?.find((candidate) => `${candidate.target}/${candidate.protocol}` === endpoint?.binding);
+  const publishedPort = binding?.publishedPort ?? service?.publishedPort;
+  return service === undefined || service.backend === "tunnel" || publishedPort === undefined ? undefined : { ...service, publishedPort };
+}
+async function probeSharedHolderOrigin(mirror, contractService) {
+  const service = resolveSharedContractOrigin(mirror, contractService);
+  if (service === undefined)
+    return "unknown";
+  return await probeLocalRouterTarget({ project: mirror.project, service });
+}
+
+// packages/engine/src/router/local-http-router.ts
 var ROUTE_REFRESH_MS = 1000;
 var MAX_MIRROR_BYTES = 2 * 1024 * 1024;
 var MAX_REQUEST_HEADER_BYTES = 64 * 1024;
@@ -10800,55 +11032,6 @@ function forwardedHeaders(request, originPort) {
     headers["x-forwarded-for"] = remote;
   return headers;
 }
-async function verifyDockerRouteTarget(target, port) {
-  try {
-    const service = target.service;
-    const args = [
-      "ps",
-      "--no-trunc",
-      "--format",
-      "{{.ID}}\t{{.Ports}}",
-      "--filter",
-      `label=dev.hestia.stack=${target.project}`,
-      "--filter",
-      `label=com.docker.compose.service=${service.name}`
-    ];
-    const { stdout } = await pexec6("docker", args, { timeout: 2000 });
-    return stdout.split(`
-`).some((line) => {
-      const [id, ports = ""] = line.split("\t");
-      const identityMatches = service.containerId === undefined || id?.startsWith(service.containerId);
-      return identityMatches && new RegExp(`(?:127\\.0\\.0\\.1|0\\.0\\.0\\.0):${port}->`).test(ports);
-    });
-  } catch {
-    return false;
-  }
-}
-async function verifyLocalRouterTarget(target) {
-  const service = target.service;
-  const port = service?.publishedPort;
-  if (service === undefined || port === undefined || service.backend === "tunnel")
-    return null;
-  if (service.backend === "docker") {
-    return await verifyDockerRouteTarget(target, port) ? port : null;
-  }
-  if (service.pid === undefined || service.startTime === undefined)
-    return null;
-  if (!isLive({ pid: service.pid, startTime: service.startTime }))
-    return null;
-  try {
-    return (await inspectPort(service.pid, port)).ownerIsMember ? port : null;
-  } catch {
-    return null;
-  }
-}
-async function verifyStackServiceOrigin(record, service, publishedPort = service.publishedPort) {
-  return await verifyLocalRouterTarget({
-    hostname: "",
-    project: record.project,
-    service: { ...service, publishedPort }
-  }) !== null;
-}
 function targetIdentity(target) {
   const service = target.service;
   return [
@@ -10936,27 +11119,27 @@ class HestiaLocalHttpRouter {
   #sharedRoutes = new Map;
   #timer;
   async start() {
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       this.#server.once("error", reject);
       this.#server.listen(0, "127.0.0.1", () => {
         this.#server.off("error", reject);
-        resolve2();
+        resolve3();
       });
     });
     prepareGatewaySocket(this.socketPath);
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       this.#unixServer.once("error", reject);
       this.#unixServer.listen(this.socketPath, () => {
         this.#unixServer.off("error", reject);
         chmodSync5(this.socketPath, 384);
-        resolve2();
+        resolve3();
       });
     });
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       this.#frontServer.once("error", reject);
       this.#frontServer.listen(0, "127.0.0.1", () => {
         this.#frontServer.off("error", reject);
-        resolve2();
+        resolve3();
       });
     });
     await this.refreshRoutes();
@@ -11045,14 +11228,12 @@ class HestiaLocalHttpRouter {
       let target;
       if (holder !== undefined) {
         const stack = records.find((record) => record.project === holder.project);
-        const endpoint = stack?.endpoints.find((candidate2) => (candidate2.alias ?? candidate2.name) === holder.service);
-        const service = stack?.services.find((candidate2) => candidate2.name === (endpoint?.workload ?? endpoint?.name));
-        const binding = service?.bindings?.find((candidate2) => `${candidate2.target}/${candidate2.protocol}` === endpoint?.binding);
-        const publishedPort = binding?.publishedPort ?? service?.publishedPort;
+        const service = stack === undefined ? undefined : resolveSharedContractOrigin(stack, holder.service);
         const candidate = {
           hostname,
           project: holder.project,
-          service: service === undefined || service.backend === "tunnel" || publishedPort === undefined ? undefined : { ...service, publishedPort }
+          sharedHolder: holder.project,
+          service
         };
         const previous = this.#sharedRoutes.get(hostname)?.find((entry) => entry.name === shared.name)?.target;
         target = previous !== undefined && targetIdentity(previous) === targetIdentity(candidate) ? previous : candidate;
@@ -11154,7 +11335,10 @@ Connection: close\r
         };
       }
       if (entry.target?.service?.publishedPort === undefined) {
-        return { status: 503, message: "Hestia route origin unavailable" };
+        return {
+          status: 503,
+          message: `Hestia route origin unavailable \u2014 held by ${entry.target?.project ?? "unknown"}`
+        };
       }
       return { target: entry.target };
     }
@@ -11176,7 +11360,8 @@ Connection: close\r
     const target = match.target;
     const port = target.service.publishedPort;
     if (await verifyLocalRouterTarget(target) !== port) {
-      return sendRouterResponse(response, 503, "Hestia route origin unavailable");
+      const suffix = target.sharedHolder === undefined ? "" : ` \u2014 held by ${target.sharedHolder}`;
+      return sendRouterResponse(response, 503, `Hestia route origin unavailable${suffix}`);
     }
     const proxy = httpRequest({
       hostname: "127.0.0.1",
@@ -11198,7 +11383,8 @@ Connection: close\r
     proxy.on("error", (error) => {
       if (!response.headersSent) {
         const ownershipFailure = error instanceof OriginOwnershipError;
-        sendRouterResponse(response, ownershipFailure ? 503 : 502, ownershipFailure ? "Hestia route origin unavailable" : "Hestia route origin failed");
+        const suffix = target.sharedHolder === undefined ? "" : ` \u2014 held by ${target.sharedHolder}`;
+        sendRouterResponse(response, ownershipFailure ? 503 : 502, ownershipFailure ? `Hestia route origin unavailable${suffix}` : "Hestia route origin failed");
       } else
         response.destroy();
     });
@@ -11276,16 +11462,54 @@ Connection: close\r
   }
 }
 
+// packages/engine/src/configured-workload-environment.ts
+import { readFileSync as readFileSync15 } from "fs";
+import { join as join18 } from "path";
+var ENDPOINT_TEMPLATE = /\$\{endpoint:([^}]+)\.(host|port|url)\}/g;
+function endpointTemplateValue(endpoint, field) {
+  const value = endpoint[field];
+  if (value === undefined) {
+    throw new HestiaError("config-invalid", `endpoint template requests ${endpoint.name}.${field}, but that endpoint has no ${field}`);
+  }
+  return String(value);
+}
+function resolveEndpointTemplate(template, record) {
+  const resolved = template.replace(ENDPOINT_TEMPLATE, (_match, endpointName, field) => {
+    const endpoint = record.endpoints.find((candidate) => candidate.name === endpointName);
+    if (endpoint === undefined) {
+      throw new HestiaError("config-invalid", `endpoint template references ${JSON.stringify(endpointName)} before that endpoint is available`);
+    }
+    return endpointTemplateValue(endpoint, field);
+  });
+  if (resolved.includes("${endpoint:")) {
+    throw new HestiaError("config-invalid", `malformed endpoint template ${JSON.stringify(template)}`);
+  }
+  return resolved;
+}
+function readIgnoredEnvironmentFile(worktreeRoot, file) {
+  try {
+    return readFileSync15(join18(worktreeRoot, file), "utf8").replace(/\r?\n$/, "");
+  } catch (error) {
+    throw new HestiaError("config-invalid", `cannot read configured environment file ${file}: ${error.message}`, { path: join18(worktreeRoot, file) });
+  }
+}
+function resolveConfiguredEnvironment(worktreeRoot, configured, record) {
+  return Object.fromEntries(Object.entries(configured).map(([name, value]) => {
+    const raw = typeof value === "string" ? value : readIgnoredEnvironmentFile(worktreeRoot, value.file);
+    return [name, resolveEndpointTemplate(raw, record)];
+  }));
+}
+
 // packages/engine/src/wrangler/adapter.ts
-import { existsSync as existsSync15, readFileSync as readFileSync15, statSync as statSync2 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync16, statSync as statSync2 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname5, join as join18, relative as relative3 } from "path";
+import { dirname as dirname6, join as join19, relative as relative3 } from "path";
 import { connect } from "net";
 function privateRegistryDir(worktreeRoot) {
-  return join18(worktreeRoot, ".hestia", "wrangler-registry");
+  return join19(worktreeRoot, ".hestia", "wrangler-registry");
 }
 function globalRegistryDir() {
-  return process.env.WRANGLER_REGISTRY_PATH ?? join18(homedir3(), ".wrangler", "config", "registry");
+  return process.env.WRANGLER_REGISTRY_PATH ?? join19(homedir3(), ".wrangler", "config", "registry");
 }
 var HEARTBEAT_FRESH_MS = 60000;
 function tcpConnectable(address, timeoutMs = 500) {
@@ -11293,15 +11517,15 @@ function tcpConnectable(address, timeoutMs = 500) {
   const port = Number(portStr);
   if (!host || !Number.isFinite(port))
     return Promise.resolve(false);
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const sock = connect({ host, port, timeout: timeoutMs });
     sock.once("connect", () => {
       sock.destroy();
-      resolve2(true);
+      resolve3(true);
     });
     const dead = () => {
       sock.destroy();
-      resolve2(false);
+      resolve3(false);
     };
     sock.once("error", dead);
     sock.once("timeout", dead);
@@ -11314,14 +11538,14 @@ async function preflightForeignSessions(workers) {
   for (const w of workers) {
     if (w.name === null)
       continue;
-    const entryPath = join18(dir, w.name);
+    const entryPath = join19(dir, w.name);
     if (!existsSync15(entryPath))
       continue;
     const freshMs = Date.now() - statSync2(entryPath).mtimeMs;
     let live = freshMs < HEARTBEAT_FRESH_MS;
     if (!live) {
       try {
-        const entry = JSON.parse(readFileSync15(entryPath, "utf8"));
+        const entry = JSON.parse(readFileSync16(entryPath, "utf8"));
         live = entry.debugPortAddress ? await tcpConnectable(entry.debugPortAddress) : false;
       } catch {
         live = false;
@@ -11342,14 +11566,14 @@ async function planWorkers(worktreeRoot, opts) {
     throw new HestiaError("no-workers-found", opts.filter.length > 0 ? `no wrangler configs match --workers=${opts.filter.join(",")}` : `no wrangler.{jsonc,json,toml} found in ${worktreeRoot}`);
   }
   const wranglerBinFor = (configPath) => {
-    let dir = dirname5(configPath);
+    let dir = dirname6(configPath);
     for (;; ) {
-      const candidate = join18(dir, "node_modules", ".bin", "wrangler");
+      const candidate = join19(dir, "node_modules", ".bin", "wrangler");
       if (existsSync15(candidate))
         return candidate;
       if (dir === worktreeRoot)
         return null;
-      const parent = dirname5(dir);
+      const parent = dirname6(dir);
       if (parent === dir)
         return null;
       dir = parent;
@@ -11381,6 +11605,7 @@ async function planWorkers(worktreeRoot, opts) {
       throw new HestiaError("wrangler-missing", `no local wrangler for ${relative3(worktreeRoot, w.configPath)} ` + `(searched node_modules/.bin from the config dir up to the worktree ` + `root) \u2014 hestia never uses a global install`);
     }
     const inspectorPort = await allocatePort();
+    const workerCwd = dirname6(w.configPath);
     specs.push({
       name: w.name,
       argv: [
@@ -11398,9 +11623,10 @@ async function planWorkers(worktreeRoot, opts) {
         WRANGLER_REGISTRY_PATH: registry,
         MINIFLARE_REGISTRY_PATH: registry
       },
+      cwd: relative3(worktreeRoot, workerCwd),
       port: "auto",
       signal: "int",
-      varlock: opts.varlock,
+      varlock: opts.varlock && detectVarlock(worktreeRoot, workerCwd) !== null,
       backend: "wrangler",
       inspectorPort,
       configPath: w.configPath
@@ -11441,14 +11667,14 @@ import { execFile as execFile8 } from "child_process";
 import { promisify as promisify7 } from "util";
 import { existsSync as existsSync17 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 var pexec7 = promisify7(execFile8);
 var BIN = "cloudflared";
 function cloudflaredHome() {
-  return process.env.HESTIA_CLOUDFLARED_HOME ?? join19(homedir4(), ".cloudflared");
+  return process.env.HESTIA_CLOUDFLARED_HOME ?? join20(homedir4(), ".cloudflared");
 }
 function credFilePath(uuid) {
-  return process.env.TUNNEL_CRED_FILE ?? join19(cloudflaredHome(), `${uuid}.json`);
+  return process.env.TUNNEL_CRED_FILE ?? join20(cloudflaredHome(), `${uuid}.json`);
 }
 async function run(args, timeoutMs = 30000) {
   try {
@@ -11485,8 +11711,8 @@ async function adoptTunnel(name) {
 
 // packages/engine/src/tunnel/ingress.ts
 import { createHash as createHash6 } from "crypto";
-import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync17 } from "fs";
+import { join as join21 } from "path";
 var LABEL_MAX = 63;
 var HASH_LEN = 6;
 function hostnameFor(tunnelName, branch, service, zone) {
@@ -11506,12 +11732,12 @@ function inferZone(baseRules) {
   return zones.size === 1 ? [...zones][0] : undefined;
 }
 function importBaseRules(uuid, name) {
-  const p = join20(cloudflaredHome(), "config.yml");
+  const p = join21(cloudflaredHome(), "config.yml");
   if (!existsSync18(p))
     return [];
   let parsed;
   try {
-    parsed = $parse(readFileSync16(p, "utf8"));
+    parsed = $parse(readFileSync17(p, "utf8"));
   } catch {
     return [];
   }
@@ -11576,16 +11802,16 @@ function assertDisjoint(base, dynamic, shared) {
 import {
   existsSync as existsSync19,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync17,
+  readFileSync as readFileSync18,
   readdirSync as readdirSync7
 } from "fs";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 
 // packages/engine/src/tunnel/orphans.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 function hestiaTunnelMarker(uuid) {
-  return join21(hestiaHome(), "tunnel", uuid);
+  return join22(hestiaHome(), "tunnel", uuid);
 }
 function parseLocalHestiaConnectors(psOutput, marker) {
   const rows = [];
@@ -11706,13 +11932,13 @@ async function quickTunnelUrl(metricsPort, timeoutMs) {
 var CONNECTOR = "connector";
 var READY_TIMEOUT_MS2 = 30000;
 function tunnelDir(uuid) {
-  return join22(hestiaHome(), "tunnel", uuid);
+  return join23(hestiaHome(), "tunnel", uuid);
 }
 function configPath(uuid) {
-  return join22(tunnelDir(uuid), "config.yml");
+  return join23(tunnelDir(uuid), "config.yml");
 }
 function adoptedMarker(uuid) {
-  return join22(tunnelDir(uuid), "adopted.json");
+  return join23(tunnelDir(uuid), "adopted.json");
 }
 function isAdopted(uuid) {
   return existsSync19(adoptedMarker(uuid));
@@ -11723,7 +11949,7 @@ function readAdopted(uuid) {
     return null;
   let marker;
   try {
-    marker = JSON.parse(readFileSync17(p, "utf8"));
+    marker = JSON.parse(readFileSync18(p, "utf8"));
   } catch {
     marker = {};
   }
@@ -11731,14 +11957,14 @@ function readAdopted(uuid) {
     return { uuid, name: marker.name, credFile: marker.credFile, reconstructed: false };
   }
   let name;
-  const stacksDir = join22(hestiaHome(), "stacks");
+  const stacksDir = join23(hestiaHome(), "stacks");
   if (existsSync19(stacksDir)) {
     for (const project of readdirSync7(stacksDir)) {
-      const sp = join22(stacksDir, project, "stack.json");
+      const sp = join23(stacksDir, project, "stack.json");
       if (!existsSync19(sp))
         continue;
       try {
-        const record = parseStackRecord(readFileSync17(sp, "utf8"), sp);
+        const record = parseStackRecord(readFileSync18(sp, "utf8"), sp);
         if (record.tunnel?.uuid === uuid) {
           name = record.tunnel.name;
           break;
@@ -11754,24 +11980,24 @@ function readAdopted(uuid) {
   };
 }
 function listAdopted() {
-  const root = join22(hestiaHome(), "tunnel");
+  const root = join23(hestiaHome(), "tunnel");
   if (!existsSync19(root))
     return [];
   return readdirSync7(root).filter((uuid) => isAdopted(uuid));
 }
 function collectDynamicRules(uuid) {
-  const stacksDir = join22(hestiaHome(), "stacks");
+  const stacksDir = join23(hestiaHome(), "stacks");
   const rules = [];
   const dropped = [];
   if (!existsSync19(stacksDir))
     return { rules, dropped };
   for (const project of readdirSync7(stacksDir)) {
-    const p = join22(stacksDir, project, "stack.json");
+    const p = join23(stacksDir, project, "stack.json");
     if (!existsSync19(p))
       continue;
     let record;
     try {
-      record = parseStackRecord(readFileSync17(p, "utf8"), p);
+      record = parseStackRecord(readFileSync18(p, "utf8"), p);
     } catch {
       continue;
     }
@@ -11815,7 +12041,7 @@ async function reconcileTunnel(ref, opts) {
     if (reapedGroups > 0) {
       warnings.push(`reaped ${reapedGroups} orphan hestia connector process group(s) for this tunnel`);
     }
-    const currentConfig = existsSync19(cfgPath) ? readFileSync17(cfgPath, "utf8") : null;
+    const currentConfig = existsSync19(cfgPath) ? readFileSync18(cfgPath, "utf8") : null;
     if (live && currentConfig === nextConfig) {
       return { restarted: false, metricsPort: pf.port, ready: true, warnings };
     }
@@ -11968,7 +12194,7 @@ async function* composeLogLines(project, service, options = {}) {
     args.push("--follow");
   args.push(service);
   const child = spawn3("docker", args, { stdio: ["ignore", "pipe", "pipe"] });
-  const completion = new Promise((resolve2) => child.once("close", resolve2));
+  const completion = new Promise((resolve3) => child.once("close", resolve3));
   let stderr = "";
   let spawnErrorMessage;
   child.stderr.setEncoding("utf8");
@@ -12059,12 +12285,12 @@ function readLastLineEventsBeforeOffset(path, count, endOffset) {
 function waitForLogPoll(signal) {
   if (signal?.aborted)
     return Promise.resolve();
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const timer = setTimeout(done, LOG_POLL_MS);
     function done() {
       clearTimeout(timer);
       signal?.removeEventListener("abort", done);
-      resolve2();
+      resolve3();
     }
     signal?.addEventListener("abort", done, { once: true });
   });
@@ -12167,10 +12393,10 @@ class BoundedLogMergeQueue {
   }
   async push(item, signal) {
     while (!this.#closed && !signal?.aborted && this.#items.length >= this.capacity) {
-      await new Promise((resolve2) => {
+      await new Promise((resolve3) => {
         const done = () => {
           signal?.removeEventListener("abort", done);
-          resolve2();
+          resolve3();
         };
         this.#capacityWaiters.push(done);
         signal?.addEventListener("abort", done, { once: true });
@@ -12193,7 +12419,7 @@ class BoundedLogMergeQueue {
     }
     if (this.#closed)
       return Promise.resolve({ done: true });
-    return new Promise((resolve2) => this.#waiters.push(resolve2));
+    return new Promise((resolve3) => this.#waiters.push(resolve3));
   }
   close() {
     if (this.#closed)
@@ -12305,12 +12531,47 @@ async function* streamStackLogs(record, options = {}) {
   }
 }
 // packages/engine/src/daemon/shared-arbiter.ts
+var ORIGIN_DEAD_RELEASE_STRIKES = 3;
+function probeMirrorProcessOccupancy(mirror) {
+  const identities = [];
+  let malformed = false;
+  for (const service of [...mirror.services, ...mirror.auxiliary ?? []].filter((candidate) => candidate.backend === "proc" || candidate.backend === "wrangler")) {
+    if (service.pid === undefined && service.startTime === undefined)
+      continue;
+    if (!Number.isSafeInteger(service.pid) || service.pid <= 0 || typeof service.startTime !== "string") {
+      malformed = true;
+      continue;
+    }
+    identities.push({ pid: service.pid, startTime: service.startTime });
+  }
+  const pidfileScan = scanPidfiles(mirrorProcsDir(mirror.project));
+  malformed ||= pidfileScan.errors.length > 0;
+  identities.push(...pidfileScan.pidfiles.filter((pidfile) => pidfile.backend !== "tunnel").map((pidfile) => ({ pid: pidfile.pid, startTime: pidfile.startTime })));
+  let unknown = false;
+  for (const identityRecord of identities) {
+    const identity2 = probeProcessIdentity(identityRecord);
+    if (identity2 === "live")
+      return "live";
+    if (identity2 === "unknown")
+      unknown = true;
+  }
+  if (unknown)
+    return "unknown";
+  if (malformed)
+    throw new Error("Shared holder mirror has an invalid process identity");
+  return "dead";
+}
+
 class SharedArbiter {
-  onChange;
   #mutex = Promise.resolve();
   #polls = new Map;
-  constructor(onChange) {
-    this.onChange = onChange;
+  #deadOriginStrikes = new Map;
+  #onChange;
+  #probeHolderOrigin;
+  constructor(onChangeOrOptions) {
+    const options = typeof onChangeOrOptions === "function" ? { onChange: onChangeOrOptions } : onChangeOrOptions;
+    this.#onChange = options?.onChange;
+    this.#probeHolderOrigin = options?.probeHolderOrigin ?? probeSharedHolderOrigin;
   }
   #locked(fn) {
     const next = this.#mutex.then(fn, fn);
@@ -12319,7 +12580,7 @@ class SharedArbiter {
   }
   async#notify() {
     try {
-      await this.onChange?.();
+      await this.#onChange?.();
     } catch {}
   }
   #result(record, granted) {
@@ -12342,7 +12603,8 @@ class SharedArbiter {
         delete next.holder;
         return next;
       }
-      if (readMirrorState(head.project) === null)
+      const mirror = readMirrorStateSafe(head.project);
+      if (mirror.status === "ok" && mirror.record === null)
         continue;
       return {
         ...record,
@@ -12400,11 +12662,11 @@ class SharedArbiter {
     }
     if (waitMs <= 0)
       return this.#result(outcome.record, false);
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       const key = `${name}\x00${requester.project}`;
       const polls = this.#polls.get(key) ?? [];
       const poll = {
-        resolve: resolve2,
+        resolve: resolve3,
         timer: setTimeout(() => {
           const remaining = (this.#polls.get(key) ?? []).filter((candidate) => candidate !== poll);
           if (remaining.length === 0)
@@ -12412,7 +12674,7 @@ class SharedArbiter {
           else
             this.#polls.set(key, remaining);
           const record = readSharedHostname(name);
-          resolve2(record === null ? { granted: false, queued: [] } : this.#result(record, record.holder?.project === requester.project));
+          resolve3(record === null ? { granted: false, queued: [] } : this.#result(record, record.holder?.project === requester.project));
         }, waitMs)
       };
       polls.push(poll);
@@ -12494,35 +12756,135 @@ class SharedArbiter {
   }
   async sweep(occupied) {
     let changed = false;
+    const releases = [];
     for (const record of listSharedHostnames()) {
-      const holderDead = record.holder !== undefined && !occupied.has(record.holder.project) && readMirrorState(record.holder.project) === null;
-      const deadWaiters = (record.queue ?? []).filter((waiter) => readMirrorState(waiter.project) === null);
-      if (!holderDead && deadWaiters.length === 0)
+      const holder = record.holder;
+      const holderMirror = holder === undefined ? undefined : readMirrorStateSafe(holder.project);
+      const deadWaiterProjects = new Set((record.queue ?? []).flatMap((waiter) => {
+        const mirror = readMirrorStateSafe(waiter.project);
+        return mirror.status === "ok" && mirror.record === null ? [waiter.project] : [];
+      }));
+      const deadWaiters = (record.queue ?? []).filter((waiter) => deadWaiterProjects.has(waiter.project));
+      let releaseReason;
+      if (holder !== undefined && holderMirror !== undefined) {
+        const holderKey = `${holder.project}\x00${holder.at}`;
+        const holderOccupied = occupied.has(holder.project);
+        if (holderMirror.status === "error") {
+          if (this.#recordDeadStrike(record.name, holderKey))
+            releaseReason = "stack-dead";
+        } else {
+          try {
+            const mirror = holderMirror.record;
+            if (mirror === null) {
+              if (!holderOccupied)
+                releaseReason = "stack-gone";
+              else
+                this.#deadOriginStrikes.delete(record.name);
+            } else {
+              const protectedState = mirror.state === "starting" || mirror.state === "queued";
+              if (!protectedState && mirror.starter !== undefined && (typeof mirror.starter !== "object" || mirror.starter === null || !Number.isSafeInteger(mirror.starter.pid) || mirror.starter.pid <= 0 || typeof mirror.starter.startTime !== "string")) {
+                throw new Error("Shared holder mirror has an invalid starter identity");
+              }
+              const starterLiveness = protectedState || mirror.starter === undefined ? "dead" : probeProcessIdentity(mirror.starter);
+              const protectedStartup = protectedState || starterLiveness === "live";
+              if (protectedStartup) {
+                this.#deadOriginStrikes.delete(record.name);
+              } else if (starterLiveness === "unknown") {
+                this.#retainStrikeForHolder(record.name, holderKey);
+              } else if (!holderOccupied) {
+                const contractOrigin = resolveSharedContractOrigin(mirror, holder.service);
+                if (contractOrigin === undefined) {
+                  const processOccupancy = probeMirrorProcessOccupancy(mirror);
+                  if (processOccupancy === "live") {
+                    this.#deadOriginStrikes.delete(record.name);
+                  } else if (processOccupancy === "unknown") {
+                    this.#retainStrikeForHolder(record.name, holderKey);
+                  } else if (this.#recordDeadStrike(record.name, holderKey)) {
+                    releaseReason = "stack-dead";
+                  }
+                } else {
+                  const origin = await this.#probeHolderOrigin(mirror, holder.service);
+                  if (origin === "live") {
+                    this.#deadOriginStrikes.delete(record.name);
+                  } else if (origin === "dead") {
+                    if (this.#recordDeadStrike(record.name, holderKey))
+                      releaseReason = "stack-dead";
+                  } else {
+                    this.#retainStrikeForHolder(record.name, holderKey);
+                  }
+                }
+              } else {
+                const origin = await this.#probeHolderOrigin(mirror, holder.service);
+                if (origin === "live") {
+                  this.#deadOriginStrikes.delete(record.name);
+                } else if (origin === "dead") {
+                  if (this.#recordDeadStrike(record.name, holderKey))
+                    releaseReason = "origin-dead";
+                } else {
+                  this.#retainStrikeForHolder(record.name, holderKey);
+                }
+              }
+            }
+          } catch {
+            if (this.#recordDeadStrike(record.name, holderKey))
+              releaseReason = "stack-dead";
+          }
+        }
+      } else {
+        this.#deadOriginStrikes.delete(record.name);
+      }
+      if (releaseReason === undefined && deadWaiters.length === 0)
         continue;
+      let released = false;
       const updated = await this.#locked(() => updateSharedHostname(record.name, (candidate) => {
         const pruned = {
           ...candidate,
-          queue: (candidate.queue ?? []).filter((waiter) => readMirrorState(waiter.project) !== null)
+          queue: (candidate.queue ?? []).filter((waiter) => {
+            if (!deadWaiterProjects.has(waiter.project))
+              return true;
+            const freshMirror = readMirrorStateSafe(waiter.project);
+            return freshMirror.status === "error" || freshMirror.record !== null;
+          })
         };
-        const currentHolderDead = pruned.holder !== undefined && !occupied.has(pruned.holder.project) && readMirrorState(pruned.holder.project) === null;
-        return currentHolderDead ? this.#grantNext(pruned) : pruned;
+        const holderMatches = releaseReason !== undefined && pruned.holder?.project === holder?.project && pruned.holder?.at === holder?.at;
+        if (!holderMatches)
+          return pruned;
+        released = true;
+        return this.#grantNext(pruned);
       }));
       if (updated === null)
         continue;
-      changed = true;
+      changed ||= released || deadWaiters.length > 0;
+      if (released && holder !== undefined && releaseReason !== undefined) {
+        releases.push({ name: record.name, project: holder.project, reason: releaseReason });
+        this.#deadOriginStrikes.delete(record.name);
+      }
       if (updated.holder !== undefined && updated.holder.project !== record.holder?.project) {
         this.#wake(updated.name, updated.holder.project, this.#result(updated, true));
       }
     }
     if (changed)
       await this.#notify();
+    return releases;
+  }
+  #recordDeadStrike(name, holderKey) {
+    const previous = this.#deadOriginStrikes.get(name);
+    const strikes = previous?.holderKey === holderKey ? previous.strikes + 1 : 1;
+    this.#deadOriginStrikes.set(name, { holderKey, strikes });
+    return strikes >= ORIGIN_DEAD_RELEASE_STRIKES;
+  }
+  #retainStrikeForHolder(name, holderKey) {
+    const previous = this.#deadOriginStrikes.get(name);
+    if (previous?.holderKey !== holderKey) {
+      this.#deadOriginStrikes.set(name, { holderKey, strikes: 0 });
+    }
   }
 }
 // packages/engine/src/daemon/fleet-monitor.ts
 import { execFile as execFile9 } from "child_process";
 import { promisify as promisify8 } from "util";
-import { existsSync as existsSync20, readFileSync as readFileSync18, readdirSync as readdirSync8 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync19, readdirSync as readdirSync8 } from "fs";
+import { join as join24 } from "path";
 var pexec8 = promisify8(execFile9);
 var DEFAULT_REFRESH_MS = 1000;
 var DEFAULT_HEARTBEAT_MS = 15000;
@@ -12553,8 +12915,8 @@ class LatestFleetChannel {
     }
     if (this.#closed)
       return Promise.resolve({ value: undefined, done: true });
-    return new Promise((resolve2) => {
-      this.#waiter = resolve2;
+    return new Promise((resolve3) => {
+      this.#waiter = resolve3;
     });
   }
   close() {
@@ -12569,13 +12931,13 @@ class LatestFleetChannel {
 function readManagedMirrors() {
   const records = [];
   const warnings = [];
-  const stacksDirectory = join23(hestiaHome(), "stacks");
+  const stacksDirectory = join24(hestiaHome(), "stacks");
   if (!existsSync20(stacksDirectory))
     return { records, warnings };
   for (const project of readdirSync8(stacksDirectory).sort()) {
-    const path = join23(stacksDirectory, project, "stack.json");
+    const path = join24(stacksDirectory, project, "stack.json");
     try {
-      const source = readFileSync18(path);
+      const source = readFileSync19(path);
       if (source.byteLength > MAX_MIRROR_BYTES2) {
         warnings.push(`Fleet mirror too large for ${project}`);
         continue;
@@ -13051,7 +13413,7 @@ async function assertHestiaStateIgnored(worktreeRoot) {
   try {
     await pexec9("git", ["-C", worktreeRoot, "check-ignore", "-q", ".hestia/"], { timeout: 5000 });
   } catch {
-    throw new HestiaError("state-not-ignored", `.hestia is not ignored in ${worktreeRoot}; add the line ".hestia/" to ${join24(worktreeRoot, ".gitignore")}`, { remedy: `.hestia/`, path: join24(worktreeRoot, ".gitignore") });
+    throw new HestiaError("state-not-ignored", `.hestia is not ignored in ${worktreeRoot}; add the line ".hestia/" to ${join25(worktreeRoot, ".gitignore")}`, { remedy: `.hestia/`, path: join25(worktreeRoot, ".gitignore") });
   }
 }
 async function prepareCompose(worktreeRoot, project, repo, branch, opts, configuredBaseFile) {
@@ -13068,7 +13430,7 @@ async function prepareCompose(worktreeRoot, project, repo, branch, opts, configu
     services
   });
   ensureDir(hestiaDir(worktreeRoot));
-  const overridePath = join24(hestiaDir(worktreeRoot), OVERRIDE_FILE);
+  const overridePath = join25(hestiaDir(worktreeRoot), OVERRIDE_FILE);
   writeAtomicTextFile(overridePath, yaml);
   return {
     ctx: {
@@ -13101,7 +13463,7 @@ function writeDockerfileComposeModel(worktreeRoot, workloads, conventionalCompos
     ...conventionalComposeFile === undefined ? {} : { include: [{ path: conventionalComposeFile }] },
     services
   };
-  const path = join24(hestiaDir(worktreeRoot), DOCKERFILE_COMPOSE_FILE);
+  const path = join25(hestiaDir(worktreeRoot), DOCKERFILE_COMPOSE_FILE);
   writeAtomicTextFile(path, $stringify(model));
   return path;
 }
@@ -13121,9 +13483,9 @@ function freshRecord(project, repoId, repo, branch, worktree) {
   };
 }
 function assertCurrentStackIdentity(record, current) {
-  const path = join24(hestiaDir(current.worktreeRoot), "stack.json");
+  const path = join25(hestiaDir(current.worktreeRoot), "stack.json");
   assertMutableStackRecord(record, path);
-  const matches = record.repoId === current.repoId && record.repo === current.repo && record.branch === current.branch && resolve2(record.worktree) === resolve2(current.worktreeRoot) && record.project === projectName(current.repoId, current.repo, current.branch, current.worktreeRoot);
+  const matches = record.repoId === current.repoId && record.repo === current.repo && record.branch === current.branch && resolve3(record.worktree) === resolve3(current.worktreeRoot) && record.project === projectName(current.repoId, current.repo, current.branch, current.worktreeRoot);
   if (!matches) {
     throw new HestiaError("stack-identity-changed", `this checkout no longer matches stack ${record.project}; run hestia down before starting or changing it`, {
       recorded: {
@@ -13301,7 +13663,7 @@ function matchesExpectedStack(record, expected) {
   return record !== null && (record.repoId === undefined || record.repoId === expected.repoId) && record.worktree === expected.worktree && record.createdAt === expected.createdAt;
 }
 function projectMutationRoot(project) {
-  return join24(hestiaHome(), "project-locks", project);
+  return join25(hestiaHome(), "project-locks", project);
 }
 async function assertNamedTunnelDns(hostname, tunnelUuid) {
   const expected = `${tunnelUuid}.cfargotunnel.com`;
@@ -13558,12 +13920,25 @@ class ComposeEngine {
           }
         }
       }
+      applyConfiguredEndpoints(record, configuredWorkloads);
+      if (opts?.workers || configuredWorkers.length > 0) {
+        const configuredFilters = configuredWorkers.map(([name, workload]) => workload.wranglerConfig ?? name);
+        const explicitFilters = Array.isArray(opts?.workers) ? opts.workers : [];
+        await this.#upWorkers(worktreeRoot, record, configuredWorkloads, {
+          ...opts,
+          workers: opts?.workers === true ? true : [...new Set([...explicitFilters, ...configuredFilters])]
+        });
+      }
+      applyConfiguredEndpoints(record, configuredWorkloads);
       for (const [name, workload] of configuredProcs) {
-        const command = workload.command;
         const configuredSpec = {
           name,
-          argv: command,
+          argv: workload.command,
+          cwd: workload.cwd,
+          env: resolveConfiguredEnvironment(worktreeRoot, workload.env, record),
           port: workload.port ?? "auto",
+          varlock: workload.varlock,
+          healthPath: workload.healthPath,
           backend: "proc"
         };
         const clash = record.services.find((service) => service.name === name && service.backend === "docker");
@@ -13584,19 +13959,11 @@ class ComposeEngine {
         }
         const result = await startProc(worktreeRoot, configuredSpec, record.env, (pidfile2) => mirrorPidfile(record.project, pidfile2));
         recordProc(record, result.record);
+        applyConfiguredEndpoints(record, configuredWorkloads);
         writeState(worktreeRoot, record);
         if (result.error !== undefined)
           throw result.error;
       }
-      if (opts?.workers || configuredWorkers.length > 0) {
-        const configuredFilters = configuredWorkers.map(([name, workload]) => workload.wranglerConfig ?? name);
-        const explicitFilters = Array.isArray(opts?.workers) ? opts.workers : [];
-        await this.#upWorkers(worktreeRoot, record, {
-          ...opts,
-          workers: opts?.workers === true ? true : [...new Set([...explicitFilters, ...configuredFilters])]
-        });
-      }
-      applyConfiguredEndpoints(record, configuredWorkloads);
       record.state = "up";
       delete record.starter;
       setTunnelDirty(syncExposures(record));
@@ -13604,17 +13971,27 @@ class ComposeEngine {
       return record;
     }));
   }
-  async#upWorkers(worktreeRoot, record, opts) {
+  async#upWorkers(worktreeRoot, record, configuredWorkloads, opts) {
     const plan = await planWorkers(worktreeRoot, {
       filter: Array.isArray(opts.workers) ? opts.workers : [],
       allowRemote: opts.allowRemote ?? false,
       force: opts.force ?? false,
-      varlock: !opts.noVarlock && detectVarlock(worktreeRoot) !== null
+      varlock: !opts.noVarlock
     });
     for (const w of plan.warnings)
       process.stderr.write(`warning: ${w}
 `);
     for (const spec of plan.specs) {
+      const configured = Object.entries(configuredWorkloads).find(([name, workload]) => workload.source === "wrangler" && (name === spec.name || workload.wranglerConfig !== undefined && resolve3(worktreeRoot, workload.wranglerConfig) === spec.configPath))?.[1];
+      if (configured !== undefined && configured.source === "wrangler") {
+        spec.cwd = configured.cwd ?? spec.cwd;
+        spec.varlock = configured.varlock ?? spec.varlock;
+        spec.healthPath = configured.healthPath;
+        spec.env = {
+          ...spec.env,
+          ...resolveConfiguredEnvironment(worktreeRoot, configured.env, record)
+        };
+      }
       const clash = record.services.find((s) => s.name === spec.name && s.backend === "docker");
       if (clash !== undefined) {
         throw new HestiaError("name-conflict", `worker "${spec.name}" collides with a compose service name`);
@@ -13908,13 +14285,13 @@ class ComposeEngine {
       const composeFile = record?.composeFile ?? tryLoadConfig(worktreeRoot)?.composeFile;
       if (composeFile !== undefined) {
         const project2 = record?.project ?? projectName(repoId, repo, branch, worktreeRoot);
-        const overrideFile = record?.overrideFile ?? join24(hestiaDir(worktreeRoot), OVERRIDE_FILE);
+        const overrideFile = record?.overrideFile ?? join25(hestiaDir(worktreeRoot), OVERRIDE_FILE);
         if (existsSync21(overrideFile)) {
           await composeDown({ project: project2, baseFile: composeFile, overrideFile, cwd: worktreeRoot }, opts?.destroy ?? false);
         } else if (record?.composeFile !== undefined) {
           const rest = ["compose", "-p", project2, "down", "--remove-orphans"];
           if (opts?.destroy)
-            rest.push("-v");
+            rest.push("-v", "--rmi", "local");
           await pexec9("docker", rest, { timeout: 180000 });
         }
       }
@@ -13971,7 +14348,7 @@ class ComposeEngine {
       try {
         const rest = ["compose", "-p", project, "down", "--remove-orphans"];
         if (opts?.destroy)
-          rest.push("-v");
+          rest.push("-v", "--rmi", "local");
         await pexec9("docker", rest, { timeout: 180000 });
       } catch (err) {
         if (fresh?.composeFile !== undefined) {
@@ -13982,7 +14359,7 @@ class ComposeEngine {
     };
     if (record !== null && existsSync21(record.worktree)) {
       const info = await getRepoInfo(record.worktree);
-      const identityMatches = resolve2(info.worktreeRoot) === resolve2(record.worktree) && (record.repoId === undefined ? record.repo === info.repo : record.repoId === info.repoId);
+      const identityMatches = resolve3(info.worktreeRoot) === resolve3(record.worktree) && (record.repoId === undefined ? record.repo === info.repo : record.repoId === info.repoId);
       const localRecord = readState(record.worktree);
       if (identityMatches && localRecord?.project === record.project) {
         await this.down(record.worktree, opts);
@@ -14141,7 +14518,7 @@ class ComposeEngine {
         const alias = selection.endpoint.alias ?? selection.endpoint.name;
         const authority = internalEndpointAuthority(record.project, alias);
         const name = `aux-quick-${createHash7("sha256").update(alias).digest("hex").slice(0, 10)}`;
-        const quickCfg = join24(hestiaDir(worktreeRoot), `quick-${name}.yml`);
+        const quickCfg = join25(hestiaDir(worktreeRoot), `quick-${name}.yml`);
         writeAtomicTextFile(quickCfg, `ingress:
   - service: ${JSON.stringify(`unix:${publicGatewaySocketPath()}`)}
 ` + `    originRequest:
@@ -14512,9 +14889,28 @@ class ComposeEngine {
 var engine = new ComposeEngine;
 
 // packages/engine/src/daemon/duties.ts
-var SWEEP_INTERVAL_MS = 15000;
+var DEFAULT_SWEEP_INTERVAL_MS = 15000;
+var MAX_TIMER_INTERVAL_MS = 2147483647;
+function resolveSweepIntervalMs() {
+  const value = process.env.HESTIA_SWEEP_INTERVAL_MS;
+  if (value === undefined)
+    return { intervalMs: DEFAULT_SWEEP_INTERVAL_MS, warnings: [] };
+  const parsed = Number(value);
+  if (Number.isInteger(parsed) && parsed >= 100 && parsed <= MAX_TIMER_INTERVAL_MS) {
+    return { intervalMs: parsed, warnings: [] };
+  }
+  return {
+    intervalMs: DEFAULT_SWEEP_INTERVAL_MS,
+    warnings: [
+      `invalid HESTIA_SWEEP_INTERVAL_MS=${JSON.stringify(value)} \u2014 using default ${DEFAULT_SWEEP_INTERVAL_MS}`
+    ]
+  };
+}
 function startDuties(admission, opts) {
   const log = opts?.log ?? ((line) => console.error(line));
+  const cadence = opts?.intervalMs === undefined ? resolveSweepIntervalMs() : { intervalMs: opts.intervalMs, warnings: [] };
+  for (const warning of cadence.warnings)
+    log(`sweep: ${warning}`);
   let running = false;
   const tick = async () => {
     if (running)
@@ -14529,7 +14925,10 @@ function startDuties(admission, opts) {
       if (opts?.shared !== undefined) {
         try {
           const state = admission.healthSnapshot();
-          await opts.shared.sweep(new Set([...state.live, ...state.reserved]));
+          const releases = await opts.shared.sweep(new Set([...state.live, ...state.reserved]));
+          for (const release of releases) {
+            log(`sweep: auto-released shared hostname "${release.name}" \u2014 holder ` + `${release.project} ${release.reason}, granting queue head`);
+          }
         } catch (err) {
           log(`sweep: shared-hostname sweep failed: ${err.message}`);
         }
@@ -14567,7 +14966,7 @@ function startDuties(admission, opts) {
       running = false;
     }
   };
-  const timer = setInterval(tick, opts?.intervalMs ?? SWEEP_INTERVAL_MS);
+  const timer = setInterval(tick, cadence.intervalMs);
   tick();
   return () => clearInterval(timer);
 }
@@ -14629,11 +15028,11 @@ async function main() {
         port: "none",
         backend: "proc"
       }),
-      logPath: join25(root, "daemon.log"),
+      logPath: join26(root, "daemon.log"),
       signal: "term",
       backend: "proc"
     });
-    writeAtomicJsonFile(join25(root, "daemon.json"), {
+    writeAtomicJsonFile(join26(root, "daemon.json"), {
       schemaVersion: STATE_SCHEMA_VERSION,
       pid: process.pid,
       port: server.port,
@@ -14649,7 +15048,7 @@ async function main() {
       fleet.stop();
       localRouter.stop();
       removePidfile(root, PIDFILE_NAME2);
-      rmSync11(join25(root, "daemon.json"), { force: true });
+      rmSync11(join26(root, "daemon.json"), { force: true });
       server.stop(true);
       process.exit(0);
     };
@@ -14664,4 +15063,4 @@ async function main() {
 }
 main();
 
-//# debugId=E5997ABC0405B8AE64756E2164756E21
+//# debugId=928DC10BC59C1FF964756E2164756E21