refactor(fleet-control): isolate the Wrangler CLI behind a PlainWorke…

.changeset/bounded-attachment-scans.md

@@ -0,0 +1,5 @@
+---
+'@proofoftech/fleet-control': patch
+---
+
+Harden account-wide D1 and R2 attachment scans with a request-bounded, page-independent resumable engine. Rechecked inventory drift, malformed provider metadata, non-string or repeated dispatch cursors, and page or item overflows now fail closed instead of allowing an incomplete absence proof.

.changeset/bounded-cleanup-receipts.md

@@ -0,0 +1,14 @@
+---
+'@proofoftech/fleet-control': minor
+---
+
+Add token-driven bounded no-export cleanup with durable operation-keyed terminal receipts. `advanceCleanupDeployment()` performs at most one bounded scan chunk or one action group per call; the terminal call persists an immutable receipt, releases the deployment's ownership claims, and deletes the fleet row in one D1 batch. Receipts survive same-key reprovisioning and force decommission; read them with `readCleanupReceipt()` and garbage-collect them explicitly with `pruneCleanupReceipts()` (database-time cutoff, stable order, limit 1..1,000). `cleanupDeploymentArtifacts()` and the default failed-provision rollback drain this engine on capable stacks.
+
+- **BEHAVIOR CHANGE:** No-export cleanup is narrowed to deployments that provably never authorized a candidate invocation. New records persist an invocation-authority carrier on their first durable write, and every candidate-invoking dispatch (external candidate upload, first maintenance request, version override, promotion) commits an authorization timestamp durably before the provider call. Authorized rows, legacy carrier-less rows at `application-resources-deployed` through `maintenance-armed`, and rows with external staging evidence now refuse toward export-backed decommissioning; trusted plain deployments keep no-export cleanup through `worker-deployed`.
+- **BEHAVIOR CHANGE:** Workers for Platforms and external-artifact deployments always refuse no-export cleanup: every current candidate binds the deployment D1, and no reviewed no-data profile exists.
+- **BEHAVIOR CHANGE:** A failed provision whose rollback admitted the bounded engine is durably `cleanup-advancing`. `provisionDeployment()` refuses to resume it with a fixed redirect to cleanup; complete the cleanup (receipt) and reprovision fresh. Previously the row kept its provisioning phase and could be retried as provisioning.
+- **BEHAVIOR CHANGE:** External-candidate and WFP failed-provision rollback no longer tears the deployment down. The engine refuses before any mutation, the row keeps its phase and stays provisioning-retryable, and teardown routes to export-backed decommissioning.
+- **BEHAVIOR CHANGE:** Cleanup completion releases the deployment's ownership claims; decommission claim behavior is unchanged. Force decommission releases current claims on capable stores, refuses during an active bounded cleanup, and on legacy lease implementations without `deleteReleasingClaims` deletes the row and leaves claims for later reconciliation. Force does not delete the ordinary Worker script or application R2, so do not reprovision the same names until residual physical resources are confirmed removed; provisioning fails closed on ownership mismatch.
+- **BEHAVIOR CHANGE:** `auditFleetDrift()` treats a deployment under active bounded cleanup as its own reconciliation authority: no expectation-based, orphan, or record-level findings (including `incomplete-provisioning`) while the cleanup intent is active.
+
+Add `ProvisionDeploymentOptions.failureCleanup: 'drain' | 'bounded'` (default `'drain'`); with `'bounded'` the rollback performs at most one bounded advance and surfaces the resumable outcome through the new `ProvisioningError.cleanup` field.

.changeset/bounded-decommission.md

@@ -0,0 +1,9 @@
+---
+'@proofoftech/fleet-control': minor
+---
+
+Add token-driven bounded normal decommissioning for at-least-once control-plane Worker workflows. Fleet D1 owns scan progress. Each call performs at most one bounded scan chunk; only an exact matching verify may immediately consume that result through its single same-lease resource action. Other calls perform at most one lifecycle or resource action group.
+
+Persist an immutable database-export receipt authority before the first D1 scan or export. Retries after artifact commit or Fleet state-write loss converge on the same filesystem or R2 receipt; authority changes and byte collisions preserve the committed winner and fail closed. Custom bounded backends must expose the paired receipt authority and export capability. Queue-driven bounded decommissioning requires Workers Paid because its bounded multi-R2 read groups can exceed the Free plan external-subrequest limit.
+
+Add a root-only bounded backend-switch advance API that uses the same durable token and receipt guarantees. It binds teardown to one immutable switch snapshot and captured entry subphase, advances at most one release, R2 resource, scan chunk, or D1 action group per call, and preserves legacy recovery after a shell-less deployment reaches export authorization. A pending ordinary Worker requires lossless exact-version inspection, authoritative secret-name inventory, and its persisted Durable Object namespace identities. Custom switch providers must expose the bounded scan, receipt, database, residual, delete, and conditional pending-artifact inspection capabilities required by the durable state they resume.

.changeset/bounded-fleet-audit.md

@@ -0,0 +1,21 @@
+---
+'@proofoftech/fleet-control': minor
+---
+
+Add a bounded, resumable fleet drift audit API with a durable, provider-neutral operation store. `advanceFleetAudit()` performs at most one bounded stage chunk per call — one global-stage slice of up to `maxItemsPerCall` items (1..2,000, default 500), or exactly one Fleet record's inspection and re-arm — against a `FleetOperationStore`; `D1FleetOperationStore` implements that port over the existing Fleet D1 binding with account-and-kind-scoped leases, lease-fenced guarded batches, and audit generation pinning. Call `start` with an operation id, the audited records, and `staleAfterMs`, then re-enqueue only the pending token each call returns. Start requires at most 10,000 records whose canonical bytes total at most 16 MiB, with each record within the 96 KiB staged-row byte bound and the per-record structure bounds: plain JSON data (no `undefined`-valued properties, dates, class instances, or cycles) within depth 64, 8,192 nodes, and 4 KiB per string value or object key. Every record must satisfy the deployment identifier grammar, and an explicit generation must be a positive safe integer. Every such refusal has a fixed message and precedes every durable effect. The `staleAfterMs` and operation-id refusals also occur before the lease; after the lease row is written, the foreign-kind, no-finalized-generation, and `auditClock`-sample refusals write nothing else. These accepted inputs are intentionally narrower than `auditFleetDrift()`, which does not require that identifier grammar, an explicit generation, or the bounded path's row and structure bounds. Read the findings back page by page with `readFleetAuditFindingsPage()` once the operation is terminal. Each page comes back in ordinal order whatever order the store's page arrived in and carries `nextAfterOrdinal`, the cursor to pass back as `afterOrdinal` on the next call — absent only on an empty page, which is legal only when `done` is set. The reader verifies the page rather than trusting it: a page that is empty while unfinished, or that is not the contiguous ordinal run following the cursor, refuses with `fleet operation state is malformed`. `abandonFleetAuditOperation()` unblocks a stuck running operation and releases any pin an already-terminal one still holds.
+
+- `auditFleetDrift()` keeps its exact signature, refusal message, finding vocabulary, finding order, provider interaction order, return value, and stop behavior. It now drains the same decomposed stages in memory, and a frozen golden baseline (findings and the full store/backend/resolver call log) pins all of that.
+- **HARDENING:** the bounded engine never persists the raw diagnostic bytes a one-shot audit composes call-locally. The three resolvers, the inspection, the re-arm, and the segmented multi-duty `maintenance-stale` composition durably record a fixed template alone; any finding detail, composed by the engine or passed through from the pinned inventory generation, that fails a non-throwing credential-substring and control-byte gate persists a fixed withheld-detail fallback instead of aborting the operation.
+- An audit start pins exactly one finalized `@proofoftech/fleet-control` R3 inventory generation and keeps it through completion, so a finding page stays interpretable against the exact generation it was computed from; only explicit result garbage collection, terminal failure, or abandonment releases it. A replayed start never re-resolves "latest": it reuses the persisted generation.
+- Every finding or fact must fit the staged-row envelope: a 16 KiB JSON-serialized payload, 4 KiB per string, and the codec's depth and node bounds. The coordinator detects an excess before the store sees the row, fails the whole operation with the durable `emission-bound-exceeded` reason, and releases the pin. One record's whole per-call emission set (its findings plus the cross-record ownership facts it newly claims) must also fit inside the one guarded D1 batch its `per-record` call commits — a ceiling of 99 rows: 99 emitted rows plus the one run-record update is exactly the 100-statement budget and is accepted, while 100 or more emitted rows fail. A record whose live inspection alone would emit 100 rows fails with the same reason rather than emitting a partial finding set.
+- The bounded path differs from the drain in exactly four classes: every resolver, inspection, and re-arm failure and every multi-duty `maintenance-stale` finding persists one of the six fixed detail-template families where the drain composes the raw diagnostic; any unsafe finding detail, composed or passed through, becomes the fixed withheld-detail fallback; concurrent mutation can cause either a re-arm refusal on a Fleet reread mismatch or inspection-derived findings against later provider truth, with the bounded path's typically older snapshot making both more likely; and `emission-bound-exceeded` (from the staged-row envelope or the 99-row ceiling) and `generation-unavailable` are terminal whole-operation failures with no drain counterpart, while `auditFleetDrift()` completes and returns its full finding array over the identical world and clocks. Every other output is proven byte-for-byte equivalent to the drain under identical frozen worlds and clocks. The four-class claim also assumes `backendFor`, `specFor`, and `maintenanceSecretFor` are functions of record *value*: the bounded path hands them canonical snapshots rebuilt from the staged rows, never the caller's own objects, so an identity- or prototype-keyed resolver diverges from the drain in a fifth way this list does not cover.
+- Per-call cost is not free: every advance call that runs a stage chunk re-reads the pinned generation in full and re-pages the accumulated `record` rows; a record-processing `per-record` call additionally re-pages the accumulated `fact` rows. Each stage-running call also structurally re-parses every accumulated `record` row through three plain-data traversals. That three is this coordinator's own ingress only: against the D1 store each of those same rows additionally costs a `JSON.parse` of the stored payload and the staged-row codec's own bounded-plain pass, so the real per-row constant factor is higher than three. `finding` rows are never re-paged. A stale token, a `start`, and a `finalize` call read neither.
+- Aggregate cost: one bounded audit spans `1 + records + Σ max(1, ⌈stage_i / maxItemsPerCall⌉)` stage-running calls, for a `maxItemsPerCall` held constant across the operation — the option is per-call, so varying it between calls changes the count: one per-record-to-finalize transition, one processing call per record, and at least one call per global stage. The sum runs over the eleven global stages rather than over distinct sources: `deployment-gaps`, `namespace-expectations`, and `r2-expected` each chunk the audited-record array independently, so that one array is walked by three separate stage runs. Every such call re-reads O(G) generation rows and re-pages and structurally re-parses O(R) accumulated `record` rows. In the records-dominated case, this is O(records) full generation re-reads, O(records²/1,000) accumulated-row page reads, O(records²) billed rows read, and O(records²) structural `FleetRecord` re-parses at three plain-data traversals each, the dominant CPU term. This checkpoint's in-memory suite measured roughly 0.25 ms per record-row re-parse and roughly 0.5 s for one `per-record` call over 1,001 accumulated rows. Multiplying the first figure by that row count accounts for about half the second; the remainder is the call's fixed cost: the pinned-generation re-read, both row pagings, and the record's own provider step. Read the per-row rate as the 0.25-to-0.5 ms band those two figures bracket rather than as a single constant, and as an order of magnitude from in-memory fakes rather than a production measurement. A late per-record call at the 10,000-record ceiling therefore spends seconds of isolate CPU re-parsing before its provider work. The per-call guarantee covers bounded provider work and bounded emission, not bounded CPU or bounded rows read. See the fleet control guide for the full envelope.
+
+The operation store rejects invalid row-page selectors before schema work. Invalid public selectors use input-specific errors; malformed durable records retain `FleetOperationStateError`.
+
+`stageRows` rejects conflicting immutable staged payloads within its current batch. `commitProgress` refuses conflicting immutable payloads and missing item-update targets without advancing progress or retaining sibling mutations from that batch. Exact restaging remains idempotent. Replaying an uncertain commit requires the same intended run record and row payloads; composing a new transition requires reading persisted progress first. Database errors propagate to the trusted caller. Lease expiry can still leave earlier staged rows while the progress update refuses, so immutable retry payloads remain a caller obligation.
+
+`failOperation` accepts at most one item update. Terminal transitions refuse operation IDs belonging to another operation kind. Row-watermark refusals preserve sibling rows, and noncontiguous caller inserts below a claimed watermark refuse before SQL. See `FleetOperationLease` for the operation-store contract.
+
+The new `readFleetAuditFindingsPage()` resolves to the exported `FleetAuditFindingsPage` type, a `done`-discriminated result: `{findings, done: true, nextAfterOrdinal?}` or `{findings, done: false, nextAfterOrdinal}`. No existing public export changes shape, and the Worker subpath is unchanged.