refactor!: remove the per-backend capability gating

.dap/review/engineering.md

@@ -51,9 +51,10 @@ Refines `D1`. This repository implements the same behaviour more than once by de
   interface. Shared orchestration (engine, compose) must reach it through that
   interface; a diff that leaks Docker-specific behaviour into shared code is a
   finding, because the interface is what keeps a second backend possible.
-- A capability flag on `Capabilities()` (`ServiceNameDNS`, for instance) is the
-  legitimate way to encode divergence. A silent assumption that all backends behave like
-  Docker is not.
+- A backend that cannot satisfy a compose feature must be refused explicitly — at plan
+  time, or at the gate that needs it. A silent assumption that all backends behave like
+  Docker is not the legitimate way to encode divergence, and neither is silently
+  degrading to a weaker guarantee than the compose condition asks for.
 
 ## R3. Destructive recreate
 

CHANGELOG.md

@@ -9,6 +9,33 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 
+- **BREAKING — `runtime.Capabilities` is cut from six fields to three.** The struct
+  described where a backend diverged from Docker; every field's only `false` case was
+  the Apple backend and `runtime/docker` reported all of them `true`, so most of what
+  it gated was unreachable. What survives is the three behaviours whose absence the
+  orchestrator cannot fully detect at the point of use: `Healthchecks` (a service may
+  inherit its healthcheck from the image, which the compose file cannot see),
+  `ExitCodes` (a backend that reports no exit code reports zero, which is
+  indistinguishable from a clean exit) and `ServiceNameDNS` (broken name resolution
+  surfaces inside the container, never at `Up` time). Removed fields:
+  `NamespaceSharing` and `SharedVolumes`, where a backend that cannot
+  honour the request fails loudly from the primitive itself, so the plan-time refusal
+  was UX rather than correctness; and `RestartPolicies`, which gated a
+  `WarnRestartPolicyIgnoredOnBackend` event that was never implemented.
+- **BREAKING — `compose.Plan.Validate(caps runtime.Capabilities)`** drops its
+  `backendName` parameter, and `Orchestrator.BackendName` and the `NewOrchestrator`
+  parameter that set it are gone: the Engine passed `""` at all three call sites and
+  the field's only reader was an error message, so it never carried information.
+  `Validate` refuses the two backend-gated `depends_on` conditions —
+  `service_healthy` without `Healthchecks` and `service_completed_successfully`
+  without `ExitCodes`. `compose.UnsupportedFeatureOnBackendError` loses its `Backend` field
+  and `compose.VolumeSharedAcrossServicesError` is removed with the refusal that
+  produced it. The `/etc/hosts` post-start patch behind `ServiceNameDNS` is unchanged
+  and still runs on a backend that reports no service-name DNS.
+- **BREAKING — three `runtime` error types with no remaining producer are removed:**
+  `runtime.BuilderUnavailableError` and `runtime.UnsupportedOptionError` (constructed
+  only by the Apple backend) and `runtime.ExecFailedError`, which has had no producer
+  since well before the backend removals.
 - **BREAKING — the Apple Containers backend is removed.** `runtime/applecontainer`
   and the `applecontainer-bridge` Swift package (reached through a cgo shim) are
   deleted, along with the `--runtime applecontainer` CLI value: `--runtime` now
@@ -58,6 +85,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `design/compose-native-health.md`; all three remain readable in git
   history at tag `v0.4.3`.
 
+### Changed
+
+- **compose (native)** — the `service_healthy` gate no longer passes when the backend
+  reports no health status for a service that declares an explicit healthcheck test.
+  `runtime.HealthStatus` documents `HealthNone` as ambiguous — the image declared no
+  `HEALTHCHECK`, or the backend does not surface health at all — and the gate reads it
+  as "no healthcheck" so healthcheck-less projects still come up. That reading is
+  wrong when the service names a real test command itself. `Orchestrator.waitFor`
+  keeps polling and fails with an explicit error rather than starting dependents
+  before the check ever succeeded. This is a second line of defence, not a
+  replacement for `Capabilities.Healthchecks`: the capability refuses a backend that
+  honestly reports it cannot do healthchecks, while the gate also catches one that
+  claims the capability and then reports nothing. Docker is unaffected — it reports
+  `starting` / `healthy` / `unhealthy` for any container with a healthcheck.
+  Only an explicit, non-`NONE` test command counts as declaring one: `disable: true`,
+  compose's inline `test: ["NONE"]`, and an empty test (where the image's own
+  `HEALTHCHECK` applies) all keep the permissive fallback, so no valid project blocks
+  on its own gate.
+
 ## [0.4.2] - 2026-08-23
 
 ### Fixed

compose/errors.go

@@ -62,49 +62,6 @@ func sortFields(in []UnsupportedField) []UnsupportedField {
 	return out
 }
 
-// UnsupportedFeatureOnBackendError is returned by Plan.Validate when
-// the project uses a compose feature the active backend cannot
-// satisfy — e.g. depends_on.condition: service_healthy against a
-// backend whose Capabilities().Healthchecks is false.
-//
-// Distinct from UnsupportedFieldError (which lists fields we never
-// implement) because the gating is backend-specific and may flip if
-// the backend gains the capability later.
-type UnsupportedFeatureOnBackendError struct {
-	Backend    string // backend display name (e.g. "docker")
-	Capability string // Capabilities struct field name (e.g. "Healthchecks")
-	Service    string // service that triggered the refusal
-	Detail     string // one-sentence explanation
-}
-
-func (e *UnsupportedFeatureOnBackendError) Error() string {
-	if e.Service != "" {
-		return fmt.Sprintf(
-			"compose: service %q uses %s, which the %s backend does not support: %s",
-			e.Service, e.Capability, e.Backend, e.Detail,
-		)
-	}
-	return fmt.Sprintf(
-		"compose: project uses %s, which the %s backend does not support: %s",
-		e.Capability, e.Backend, e.Detail,
-	)
-}
-
-// VolumeSharedAcrossServicesError is returned by Plan.Validate when
-// the project mounts a single named volume into 2+ services and the
-// active backend's Capabilities().SharedVolumes is false.
-type VolumeSharedAcrossServicesError struct {
-	Volume   string
-	Services []string // sorted
-}
-
-func (e *VolumeSharedAcrossServicesError) Error() string {
-	return fmt.Sprintf(
-		"compose: volume %q is mounted into %d services (%s); the active backend does not allow shared volumes",
-		e.Volume, len(e.Services), strings.Join(e.Services, ", "),
-	)
-}
-
 // PartialUpError signals that Up brought some services online and
 // then failed before completing. Returned with the names of the
 // services that did and didn't start so the caller (Engine.Up) can
@@ -156,3 +113,29 @@ type CycleError struct {
 func (e *CycleError) Error() string {
 	return fmt.Sprintf("compose: depends_on cycle: %s", strings.Join(e.Cycle, " -> "))
 }
+
+// UnsupportedFeatureOnBackendError is returned by Plan.Validate when
+// the project uses a compose feature the active backend cannot
+// satisfy, as advertised by runtime.Capabilities.
+//
+// Distinct from UnsupportedFieldError (which lists fields we never
+// implement) because the gating is backend-specific and may flip if
+// the backend gains the capability later.
+type UnsupportedFeatureOnBackendError struct {
+	Capability string // Capabilities struct field name (e.g. "ExitCodes")
+	Service    string // service that triggered the refusal
+	Detail     string // one-sentence explanation
+}
+
+func (e *UnsupportedFeatureOnBackendError) Error() string {
+	if e.Service != "" {
+		return fmt.Sprintf(
+			"compose: service %q uses %s, which the active backend does not support: %s",
+			e.Service, e.Capability, e.Detail,
+		)
+	}
+	return fmt.Sprintf(
+		"compose: project uses %s, which the active backend does not support: %s",
+		e.Capability, e.Detail,
+	)
+}

compose/graph.go

@@ -133,14 +133,6 @@ func findCycle(deps map[string]map[string]struct{}, remaining map[string]struct{
 	}
 }
 
-// isServiceNetworkMode reports whether the value of `network_mode:`
-// references another service's namespace (`service:<name>`). The
-// orchestrator surfaces the dep edge here so topo-sort respects the
-// ordering even though compose-go doesn't model it under DependsOn.
-func isServiceNetworkMode(nm string) bool {
-	return serviceRefTarget(nm) != ""
-}
-
 // serviceRefTarget returns the service name a `service:<name>`
 // namespace-mode value points at, or "" when the value is anything
 // else (empty, "host", "none", "container:<id>", ...).