@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"testing"
@@ -12,6 +13,8 @@ import (
 	runtimev0 "github.com/codefly-dev/core/generated/go/codefly/services/runtime/v0"
 	"github.com/codefly-dev/core/resources"
 	runners "github.com/codefly-dev/core/runners/base"
+	dockerrun "github.com/codefly-dev/core/runners/dockerrun"
+	"github.com/codefly-dev/core/shared"
 	"github.com/stretchr/testify/require"
 )
 
@@ -208,3 +211,137 @@ func TestDestroyStopsRealUvicornWithoutStop(t *testing.T) {
 	require.False(t, running, "uvicorn must be gone before Destroy reports success")
 	require.False(t, serves(runtime.port), "the listener must be gone before Destroy reports success")
 }
+
+// unstoppableEnv refuses to shut down, the state Destroy deliberately leaves
+// reachable for a retry — and therefore the state in which a late Start still
+// has somewhere to launch a process.
+type unstoppableEnv struct {
+	runners.RunnerEnvironment
+	processes int
+}
+
+func (unstoppableEnv) Shutdown(context.Context) error {
+	return errors.New("environment will not shut down")
+}
+
+func (e *unstoppableEnv) NewProcess(string, ...string) (runners.Proc, error) {
+	e.processes++
+	return &fakeProc{}, nil
+}
+
+func TestStartAfterFailedDestroyCannotLaunchReplacement(t *testing.T) {
+	ctx := context.Background()
+	runtime, _, _ := destroyRuntime(t)
+	env := &unstoppableEnv{}
+	runtime.runnerEnvironment = env
+
+	resp, err := runtime.Destroy(ctx, &runtimev0.DestroyRequest{})
+	require.NoError(t, err)
+	require.Equal(t, runtimev0.DestroyStatus_ERROR, resp.GetStatus().GetState())
+	require.NotNil(t, runtime.runnerEnvironment,
+		"a failed shutdown must keep the environment reachable for a retry")
+
+	start, err := runtime.Start(ctx, &runtimev0.StartRequest{})
+	require.NoError(t, err)
+	require.Equal(t, runtimev0.StartStatus_ERROR, start.GetStatus().GetState())
+	require.Zero(t, env.processes, "no replacement process may be launched after Destroy")
+	require.Nil(t, currentRunner(runtime))
+}
+
+// TestInitReopensLifecycleAfterDestroy pins the other half of that contract: a
+// deliberate Init is a new lifecycle, so Start works again rather than being
+// refused forever by a runtime nobody can revive.
+func TestInitReopensLifecycleAfterDestroy(t *testing.T) {
+	ctx := context.Background()
+	runtime, _, _ := destroyRuntime(t)
+
+	_, err := runtime.Destroy(ctx, &runtimev0.DestroyRequest{})
+	require.NoError(t, err)
+
+	runtime.runnerMu.Lock()
+	require.True(t, runtime.destroyed)
+	runtime.runnerMu.Unlock()
+
+	// Init fails well before it would need a real environment; what matters is
+	// that it reopened the lifecycle on its way through.
+	_, _ = runtime.Init(ctx, &runtimev0.InitRequest{RuntimeContext: resources.NewRuntimeContextNative()})
+
+	runtime.runnerMu.Lock()
+	defer runtime.runnerMu.Unlock()
+	require.False(t, runtime.destroyed, "Init must reopen the lifecycle it is starting")
+}
+
+func TestResolveRuntimeImageHonorsOverride(t *testing.T) {
+	runtime := NewRuntime(NewService())
+
+	image, err := runtime.resolveRuntimeImage()
+	require.NoError(t, err)
+	require.Equal(t, runtimeImage, image)
+
+	runtime.FastAPI.Settings.RuntimeImage = "ghcr.io/acme/python:1.2.3"
+	image, err = runtime.resolveRuntimeImage()
+	require.NoError(t, err)
+	require.Equal(t, "ghcr.io/acme/python", image.Name)
+	require.Equal(t, "1.2.3", image.Tag,
+		"Destroy must reach for the image the service actually runs, not the default")
+
+	runtime.FastAPI.Settings.RuntimeImage = "ghcr.io/acme/python:latest"
+	_, err = runtime.resolveRuntimeImage()
+	require.Error(t, err, "an unpinned override stays rejected")
+}
+
+// TestDestroyRemovesContainerBeforeClearingCache is the container half of the
+// ordering contract. cacheLocation is the directory Init bind-mounts the venv
+// and the uv cache out of, so wiping it while the container is up deletes the
+// interpreter under the running service. runnerEnvironment is deliberately nil:
+// that is the shape `codefly` shutdown reaches when Init never ran in this
+// process, and the only path on which Destroy reaches the container by name.
+func TestDestroyRemovesContainerBeforeClearingCache(t *testing.T) {
+	ctx := context.Background()
+
+	// Docker on macOS only bind-mounts shared paths, and the per-user temp dir
+	// is not one — keep the mount inside the repo, as the lifecycle tests do.
+	cache, err := os.MkdirTemp("testdata", "destroy-cache-")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = os.RemoveAll(cache) })
+	cache = shared.MustSolvePath(cache)
+
+	runtime := NewRuntime(NewService())
+	runtime.Location = t.TempDir()
+	runtime.Logger = runtime.Wool
+	runtime.Base.Runtime.RuntimeContext = resources.NewRuntimeContextContainer()
+	runtime.Identity = &resources.ServiceIdentity{
+		Name:          fmt.Sprintf("destroy-order-%d", time.Now().UnixMilli()),
+		Module:        "mod",
+		Workspace:     "test",
+		WorkspacePath: runtime.Location,
+	}
+	runtime.Environment = shared.Must(resources.LocalEnvironment().Proto())
+	runtime.cacheLocation = cache
+
+	env, err := dockerrun.NewDockerEnvironment(ctx, runtimeImage, t.TempDir(), runtime.Base.Runtime.UniqueWithWorkspace())
+	if err != nil {
+		t.Skipf("docker is not available: %v", err)
+	}
+	env.WithPause()
+	env.WithMount(cache, "/cache")
+	require.NoError(t, env.Init(ctx))
+	t.Cleanup(func() { _ = env.Shutdown(context.Background()) })
+
+	proc, err := env.NewProcess("sh", "-c", "while true; do touch /cache/heartbeat; sleep 0.05; done")
+	require.NoError(t, err)
+	require.NoError(t, proc.Start(ctx))
+	require.Eventually(t, func() bool {
+		entries, readErr := os.ReadDir(cache)
+		return readErr == nil && len(entries) > 0
+	}, 30*time.Second, 100*time.Millisecond, "the container must be writing into the mounted cache")
+
+	require.Nil(t, runtime.runnerEnvironment)
+	resp, err := runtime.Destroy(ctx, &runtimev0.DestroyRequest{})
+	require.NoError(t, err)
+	require.Equal(t, runtimev0.DestroyStatus_SUCCESS, resp.GetStatus().GetState(), resp.GetStatus().GetMessage())
+
+	entries, err := os.ReadDir(cache)
+	require.NoError(t, err)
+	require.Empty(t, entries, "the container must be gone before the cache it mounts is wiped")
+}
@@ -83,6 +83,12 @@ type Runtime struct {
 	grpcPort uint16
 
 	cacheLocation string
+
+	// destroyed marks the runtime as torn down, guarded by runnerMu. Destroy
+	// cannot stop a Start that is already on its way — the watcher's debounce
+	// can still fire one after StopWatcher — so Start consults this rather
+	// than launching a process against resources Destroy is removing.
+	destroyed bool
 }
 
 func NewRuntime(svc *Service) *Runtime {
@@ -138,19 +144,27 @@ func (s *Runtime) DockerEnvPath() string {
 	return path.Join(s.Location, ".cache/container/.venv")
 }
 
+// resolveRuntimeImage returns the image the service runs in: the settings
+// override when one is set, else the codefly-built default. Strict pinning —
+// :latest and untagged refs are rejected so builds stay reproducible.
+func (s *Runtime) resolveRuntimeImage() (*resources.DockerImage, error) {
+	override := s.FastAPI.Settings.RuntimeImage
+	if override == "" {
+		return runtimeImage, nil
+	}
+	parsed, err := resources.ParsePinnedImage(override)
+	if err != nil {
+		return nil, s.Wool.Wrapf(err, "invalid docker-image override in service.codefly.yaml")
+	}
+	s.Wool.Info("using docker-image override (not recommended)", wool.Field("image", parsed.FullName()))
+	return parsed, nil
+}
+
 func (s *Runtime) CreateRunnerEnvironment(ctx context.Context) error {
 	s.Wool.Debug("creating runner environment in", wool.DirField(s.Identity.WorkspacePath))
-	// Resolve the runtime image: settings override (if any) takes priority,
-	// else fall back to the codefly-built default. Strict pinning — we
-	// reject :latest and untagged refs so builds stay reproducible.
-	image := runtimeImage
-	if override := s.FastAPI.Settings.RuntimeImage; override != "" {
-		parsed, perr := resources.ParsePinnedImage(override)
-		if perr != nil {
-			return s.Wool.Wrapf(perr, "invalid docker-image override in service.codefly.yaml")
-		}
-		s.Wool.Info("using docker-image override (not recommended)", wool.Field("image", parsed.FullName()))
-		image = parsed
+	image, err := s.resolveRuntimeImage()
+	if err != nil {
+		return err
 	}
 
 	switch {
@@ -260,6 +274,12 @@ func (s *Runtime) Init(ctx context.Context, req *runtimev0.InitRequest) (*runtim
 
 	s.Base.Runtime.LogInitRequest(req)
 
+	// Init opens a new lifecycle, so a runtime torn down earlier accepts work
+	// again — otherwise Init would succeed and every later Start refuse.
+	s.runnerMu.Lock()
+	s.destroyed = false
+	s.runnerMu.Unlock()
+
 	if err := s.SetRuntimeContext(ctx, req.RuntimeContext); err != nil {
 		return s.Base.Runtime.InitError(err)
 	}
@@ -378,6 +398,10 @@ func (s *Runtime) Start(ctx context.Context, req *runtimev0.StartRequest) (*runt
 
 	s.Base.Runtime.LogStartRequest(req)
 
+	if s.destroyed {
+		return s.Base.Runtime.StartError(s.Wool.NewError("service has been destroyed (Init must run before it can start again)"))
+	}
+
 	inputs := startInputs(req)
 
 	if s.runner != nil {
@@ -769,7 +793,10 @@ func withOverrides(envs []*resources.EnvironmentVariable, overrides map[string]s
 // earlier one fails, so one stubborn resource cannot strand the rest, and the
 // environment is forgotten only once it is actually down — a caller retrying
 // after a failure must still be able to reach it.
-func (s *Runtime) endExecution(ctx context.Context) error {
+//
+// It reports whether the owned environment was actually shut down, which in
+// container mode is what tells Destroy the container is already gone.
+func (s *Runtime) endExecution(ctx context.Context) (bool, error) {
 	// Cancel the watcher and let its Start goroutine's deferred close of Events
 	// run exactly once — never close Events here, or it races that goroutine
 	// into a "close of closed channel" panic.
@@ -779,18 +806,20 @@ func (s *Runtime) endExecution(ctx context.Context) error {
 	if err := s.stopRunner(ctx); err != nil {
 		errs = append(errs, s.Wool.Wrapf(err, "cannot stop the fastapi app"))
 	}
+	released := false
 	if s.runnerEnvironment != nil {
 		if err := s.runnerEnvironment.Shutdown(ctx); err != nil {
 			errs = append(errs, s.Wool.Wrapf(err, "cannot shut down the runner environment"))
 		} else {
 			// A shut-down environment cannot serve another process — a docker
 			// one has closed its client — so drop it and let a later Init build
 			// a fresh one rather than hand Code and the REPL a dead handle.
+			released = true
 			s.runnerEnvironment = nil
 			s.FastAPI.Service.ActiveEnv = nil
 		}
 	}
-	return errors.Join(errs...)
+	return released, errors.Join(errs...)
 }
 
 // Stop releases the execution resources and keeps everything on disk, so a
@@ -803,7 +832,7 @@ func (s *Runtime) Stop(ctx context.Context, req *runtimev0.StopRequest) (*runtim
 	defer s.runnerMu.Unlock()
 
 	s.Wool.Debug("stopping service")
-	if err := s.endExecution(ctx); err != nil {
+	if _, err := s.endExecution(ctx); err != nil {
 		return s.Base.Runtime.StopError(err)
 	}
 	return s.Base.Runtime.StopResponse()
@@ -823,31 +852,34 @@ func (s *Runtime) Destroy(ctx context.Context, req *runtimev0.DestroyRequest) (*
 	var errs []error
 
 	s.runnerMu.Lock()
-	if err := s.endExecution(ctx); err != nil {
+	s.destroyed = true
+	released, err := s.endExecution(ctx)
+	if err != nil {
 		errs = append(errs, err)
 	}
+	cacheLocation := s.cacheLocation
 	s.runnerMu.Unlock()
 
-	// Only once execution has ended: a process still running against the cache
-	// repopulates what this removes, and is reading the venv being pulled out
-	// from under it. An empty location means Init never claimed one — there is
-	// nothing owned to clear, and EmptyDir rejects the empty path as an error.
-	if s.cacheLocation != "" {
-		s.Wool.Debug("removing cache")
-		if err := shared.EmptyDir(ctx, s.cacheLocation); err != nil {
-			errs = append(errs, s.Wool.Wrapf(err, "cannot remove cache"))
+	// A container outlives the agent that started it, so a Destroy whose
+	// runtime holds no environment — a fresh agent, or an Init that never ran —
+	// still has to reach it by name. Shutting the owned environment down has
+	// already removed it, and reaching for docker again there would only invent
+	// a way for a finished teardown to fail.
+	if s.Base.Runtime.IsContainerRuntime() && !released {
+		if err := s.destroyContainerByIdentity(ctx); err != nil {
+			errs = append(errs, err)
 		}
 	}
 
-	if s.Base.Runtime.IsContainerRuntime() {
-		// A container outlives the agent that started it, so a Destroy whose
-		// runtime never held one still has to reach it by name.
-		s.Wool.Debug("running in container")
-		dockerEnv, err := dockerrun.NewDockerEnvironment(ctx, runtimeImage, s.Service.SourceLocation, s.Base.Runtime.UniqueWithWorkspace())
-		if err != nil {
-			errs = append(errs, s.Wool.Wrapf(err, "cannot reach the container environment"))
-		} else if err := dockerEnv.Shutdown(ctx); err != nil {
-			errs = append(errs, s.Wool.Wrapf(err, "cannot shut down the container environment"))
+	// Last, and only once nothing is executing any more. In container mode the
+	// venv and the uv cache are bind-mounted out of this directory, so wiping
+	// it while the container is still up pulls the interpreter out from under
+	// the running service. An empty location means Init never claimed one —
+	// nothing owned to clear, and EmptyDir rejects the empty path as an error.
+	if cacheLocation != "" {
+		s.Wool.Debug("removing cache")
+		if err := shared.EmptyDir(ctx, cacheLocation); err != nil {
+			errs = append(errs, s.Wool.Wrapf(err, "cannot remove cache"))
 		}
 	}
 
@@ -857,6 +889,27 @@ func (s *Runtime) Destroy(ctx context.Context, req *runtimev0.DestroyRequest) (*
 	return s.Base.Runtime.DestroyResponse()
 }
 
+// destroyContainerByIdentity removes the service's container by the name it is
+// registered under, for a Destroy holding no environment of its own.
+func (s *Runtime) destroyContainerByIdentity(ctx context.Context) error {
+	s.Wool.Debug("running in container")
+	image, err := s.resolveRuntimeImage()
+	if err != nil {
+		// The container is found by name, never by image, so an override this
+		// agent cannot parse must not be what leaves it running.
+		s.Wool.Warn("cannot resolve the runtime image, falling back to the default", wool.ErrField(err))
+		image = runtimeImage
+	}
+	dockerEnv, err := dockerrun.NewDockerEnvironment(ctx, image, s.Service.SourceLocation, s.Base.Runtime.UniqueWithWorkspace())
+	if err != nil {
+		return s.Wool.Wrapf(err, "cannot reach the container environment")
+	}
+	if err := dockerEnv.Shutdown(ctx); err != nil {
+		return s.Wool.Wrapf(err, "cannot shut down the container environment")
+	}
+	return nil
+}
+
 func (s *Runtime) EventHandler(event code.Change) error {
 	if strings.Contains(event.Path, "api.json") {
 		return nil