Closes #47. Each is independent; none blocked the #22 merge.

- applyPin's read guard is narrowed to Deno.errors.NotFound. It used to
  swallow every read failure, so the drive-under-mounted-root refusal
  reached the operator only because hostFs.read throws synchronously,
  before the catch could attach — an async refactor with no intent behind
  it silently turned the named refusal into no-image-line on the write
  path the guard exists to protect. Only a genuinely absent file is "not
  here" now; the refusal survives the shape of the call.
- composeEligibility resolves and stats the env files. They went to the
  host CLI as --env-file raw and unchecked while the same label got a
  normalising function (wantedEnvFiles) for the stack page, and compose
  exits non-zero on an --env-file it cannot open exactly as it does on a
  missing -f. Everything projectArgs puts on the command line is checked
  now, with the missing env file getting its own verdict.
- effectiveHostRoot takes HostStrategy | null rather than string | null.
  Everything rides on one string equality, and against `string` renaming
  a union member leaves the comparison compiling and always-false. Same
  trade as deleting `dir` from CommitLines: make it structural.
- README says what OPSDECK_HOST_ROOT=/ does NOT fix. The probe proves
  every candidate — direct included — with an `sh -c`, so with no POSIX
  shell on PATH the strategy stays unset and compose validate, the
  compose updater and a pin's git commit fail with "host command
  execution unavailable" while the stack pages work.
- composeEligibility's docstring records that every verdict is graceful:
  a non-null reason routes to the engine-API updater, so the working
  directory stat #22 added narrows eligibility without failing a run.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

@@ -55,1 +52,3 @@
-them.
+that cannot exist. That fixes the _paths_, and reads genuinely work after it;
+anything that runs a command on the host still does not. Host exec proves each
+candidate (`chroot`, two `nsenter` variants, then spawning directly) by running

@@ -85,2 +94,3 @@
   p: ComposeProject,
-  ctx: { host: { strategy: string | null }; paths: { hostRoot: string } },
+  ctx: {
+    host: { strategy: HostStrategy | null };

@@ -91,3 +102,1 @@
-  // validated AND stat'd with the config files: compose is addressed with
-  // --project-directory, and a directory that is not there fails the real
-  // update just as surely as a missing -f file.
+  // reads the exact path that guard would write. Everything projectArgs

@@ -94,3 +110,3 @@
   const hostRoot = effectiveHostRoot(ctx);
   const onHost = new Map<string, string>();
-  for (const path of [p.workingDir, ...p.configFiles]) {
+  for (const path of [p.workingDir, ...p.configFiles, ...p.envFiles]) {

@@ -200,0 +224,4 @@
+  }
+});
+
+Deno.test("a file that is genuinely absent is still skipped", async () => {

@@ -52,0 +62,4 @@
+ * one project label that is not uniform across a project's containers:
+ * compose records it only on containers created by an invocation that passed
+ * `--env-file`, so recreating one service without it (the API updater does
+ * exactly that) leaves the project split. containers[0] is raw

@@ -52,0 +85,4 @@
+function projectEnvFiles(stack: StackInfo): string[] {
+  const out: string[] = [];
+  const byName = [...stack.containers].sort((a, b) =>
+    a.name.localeCompare(b.name)

@@ -94,0 +157,4 @@
+  //
+  // "Here" is the load-bearing word: this guard answers for the callers that
+  // CHOOSE between compose and the engine API (the update and recreate
+  // actions). The pin actions build the same argv through composeConfigArgs

@@ -36,2 +38,3 @@
 
-Deno.test("composeProject reads labels from the first container", () => {
+Deno.test("composeProject reads the project labels off the first container", () => {
+  // configFiles and workingDir only — the env-file label is per-container and

@@ -200,0 +241,4 @@
+      (e: Error) => e,
+    );
+    assert(
+      err instanceof Deno.errors.IsADirectory,

@@ -52,0 +85,4 @@
+function projectEnvFiles(stack: StackInfo): string[] {
+  const out: string[] = [];
+  const byName = [...stack.containers].sort((a, b) =>
+    a.name.localeCompare(b.name)

@@ -52,0 +89,4 @@
+  );
+  for (const c of byName) {
+    for (const path of splitLabel(c.labels?.[ENV_FILE_LABEL] ?? "")) {
+      if (!out.includes(path)) out.push(path);

@@ -83,0 +133,4 @@
+ * Two of the three stats are behaviour changes, and the env files are the
+ * bigger one. A stack whose workingDir is gone but whose compose files are
+ * still there was eligible before and is not now. A stack with an env file
+ * that is gone used to reach compose and die on its own

@@ -52,0 +96,4 @@
+ * `up -d` starts a project's services inside one — and a precedence
+ * decision must not move with locale or ICU data.
+ */
+function projectEnvFiles(stack: StackInfo): string[] {

@@ -52,0 +88,4 @@
+ * `--env-file` is the deploy in force. It fixes what containers[0] got wrong
+ * — a newest container that lost the label falls through to the next one
+ * that has it — without ever putting a path on the command line that no
+ * live deploy asked for. Within the one label compose's own comma order is

@@ -52,0 +102,4 @@
+    if (!splitLabel(c.labels?.[ENV_FILE_LABEL] ?? "").length) continue;
+    const better = !newest ||
+      c.createdAt > newest.createdAt ||
+      (c.createdAt === newest.createdAt && c.name < newest.name);

@@ -83,0 +159,4 @@
+ * the operator has every reason to delete, and once they do, this returns a
+ * reason on every update forever while all the live services are fine.
+ * projectEnvFiles is what supplies both; the graceful path is only graceful
+ * because the set it stats is one live deploy's.

@@ -56,0 +56,4 @@
+through it. With a `sh.exe` on `PATH` (Git for Windows with the Unix tools,
+MSYS2) that test passes and host commands run against the Windows `docker` CLI;
+with no `sh` at all it fails, the strategy stays unset, and everything that
+shells out — compose validation, the compose updater, and the git commit a pin

@@ -50,0 +71,4 @@
+ *
+ * /containers/json answers created-descending and engine.ts never sorts
+ * within a project, so the first container is the newest, at the daemon's
+ * own resolution. That order is the same trust configFiles and workingDir

@@ -50,0 +95,4 @@
+ *
+ * The honest cost: a newest container that LOST the label by accident (a
+ * partial `up -d` without `--env-file`) reads identically to a deliberate
+ * drop, and this rule answers "none" for both — nothing in the labels

@@ -508,3 +512,2 @@
       await h.step("validate", async () => {
-        const files = (first?.configFiles ?? "").split(",").map((f) => f.trim())
-          .filter(Boolean);
+        const files = splitLabel(first?.configFiles ?? "");

@@ -600,0 +604,4 @@
+    // the same container every compose invocation is addressed from — a
+    // one-off's own config_files/working_dir labels must not put files on
+    // this page that no deploy uses (see answeringContainer)
+    const first = answeringContainer(stack);