9e9b418a92
tracker-policy-pr / check-pr (pull_request) Successful in 13s
test / integration-docker (pull_request) Successful in 38s
test / unit (pull_request) Successful in 40s
lint / lint (push) Successful in 50s
test / integration-firecracker (pull_request) Successful in 3m22s
test / coverage (pull_request) Successful in 19s
test / publish-infra (pull_request) Has been skipped
merge_bottles_runtime sees resolved bottles, where a bottle that never mentioned the key is indistinguishable from one that set it false. With "later replaces" semantics, `--bottle with-containers --bottle claude-dev` silently dropped the capability — the second bottle's default clobbered it. OR instead: composing bottles adds capabilities, it does not remove them. The file-based extends path still sees raw keys, so an explicit `nested_containers: false` in a child continues to turn it back off. Also surface the flag in the launch summary, where its absence was the only reason the clobber went unnoticed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>