[catinspace-au]

A published Compose install runs fixed containers and reads no instance index. Fetcher sources added in the console never ran.

• apps.yaml gains shared_instance, and dfe-fetcher declares config.sources. On a docker target, one container runs every instance from dfe-fetcher/fetcher.yaml. instance_id is bound to dfe-fetcher. No index is written.
• Source saves compile with their org. Saves and the deploy repo's overlay write check reject instances whose sources clash with a running one or whose org, output or extraEnv differs. Every writer passes that check.
• A render keeps running instances and reports new instances it cannot run. It removes the index, instance directories and env files left by a per-instance render. It names each container to remove.
• The fetcher's restart paths drop config.sources because reloads now start, stop and rebuild sources.
• A per-source app without shared_instance runs one container per source. Where no deployer reads the index, DFE_ENGINE_DEPLOYMENT_HOSTED_INSTANCES names the instances that run. Other sources or instances are rejected with a message naming them and the dfe-docker docs page.
• DFE_ENGINE_DEPLOYMENT_APPLY_COMMAND and DFE_ENGINE_DEPLOYMENT_CREDENTIAL_COMMAND hold a deployer's own restart and password commands. Published installs have no Makefile, so make apply and make creds were wrong there.
• QueryClient in HTTP mode sends a bearer token or API key, like the dfe CLI. Credentials with a control character are rejected without quoting them. It sent no credentials before, so every auth-enabled engine answered 401.
• QueryOptions.store is gone because nothing read it. The API still accepts bodies that send it and ignores the field.
• Two comments no longer name an engine HPA or an Argo PostSync hook.
• The archiver's default destination moves from /tmp to file:///var/lib/dfe-archiver/archive, where the chart mounts the archive volume.