@crvouga/dev-fleet 0.1.0 → 0.2.0

package/src/cli/fleet-sync-enrollment.ts

@@ -1,6 +1,5 @@
-import { readFile, mkdir, writeFile, rename, rm } from 'node:fs/promises';
-import { randomUUID } from 'node:crypto';
-import { loadConfig } from '../config';
+import { mkdir, rm } from 'node:fs/promises';
+import { loadRoster } from './roster';
 import { enrolledRoster } from '../definition';
 import { FleetUsageError } from '../errors';
 import { dirname } from 'node:path';
@@ -10,6 +9,7 @@ import { matchComputers } from '../tailnet-matching';
 import { sshArgs, sshFailure } from '../ssh';
 import { ensurePrivateRoot } from '../machine/state';
 import type { FleetNode, Runner } from '../types';
+import { STATE_ROSTER, readRosterText, writeRosterText } from '../state/roster';
 
 /** Interactive enrollment/resume only. Existing paths and explicit identities
  * are preserved. Tailnet candidates never enter the declared membership.
@@ -20,7 +20,7 @@ export async function enrollManager(path: string, run: Runner): Promise<void> {
   const saved =
     original === null
       ? []
-      : enrolledRoster(canonical, await loadConfig(path)).nodes;
+      : enrolledRoster(canonical, await loadRoster(path)).nodes;
   const nodes: FleetNode[] = canonical.workers.map((node) => ({
     id: node.id,
     ssh: node.ssh,
@@ -55,8 +55,6 @@ export async function enrollManager(path: string, run: Runner): Promise<void> {
   process.stderr.write(
     `Enrolling verified SSH connections for canonical targets:\n${enrolled.map((node) => `  ${node.id} → ${node.ssh}; device ${enrollmentIdentity(node)}`).join('\n')}\nMissing targets remain visible and are never replaced by discovered peers.\n`
   );
-  await ensurePrivateRoot(dirname(path));
-  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
   await persistEnrollment(path, original, merged);
 }
 
@@ -95,13 +93,8 @@ function ambiguous(ids: string[], matches: Map<string, FleetNode[]>): boolean {
     ids.length > 1 || (ids.length === 1 && matches.get(ids[0]!)?.length !== 1)
   );
 }
-async function existingEnrollment(path: string): Promise<string | null> {
-  try {
-    return await readFile(path, 'utf8');
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null;
-    throw error;
-  }
+function existingEnrollment(path: string): Promise<string | null> {
+  return readRosterText(path);
 }
 export function mergeEnrollment(
   saved: FleetNode[],
@@ -123,22 +116,25 @@ async function persistEnrollment(
   original: string | null,
   nodes: FleetNode[]
 ): Promise<void> {
-  const lock = `${path}.enroll.lock`;
-  await mkdir(lock, { mode: 0o700 });
-  const temporary = `${path}.${randomUUID()}.tmp`;
-  try {
+  const write = async (): Promise<void> => {
     if ((await existingEnrollment(path)) !== original)
       throw new FleetUsageError(
         'Enrollment changed during approval. Inspect it and rerun; no connection was overwritten.'
       );
-    await writeFile(
-      temporary,
-      JSON.stringify({ version: 1, nodes }, null, 2) + '\n',
-      { flag: 'wx', mode: 0o600 }
+    await writeRosterText(
+      path,
+      JSON.stringify({ version: 1, nodes }, null, 2) + '\n'
     );
-    await rename(temporary, path);
+  };
+  // The fleet state serializes its own writers; a roster file needs a lock.
+  if (path === STATE_ROSTER) return write();
+  await ensurePrivateRoot(dirname(path));
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+  const lock = `${path}.enroll.lock`;
+  await mkdir(lock, { mode: 0o700 });
+  try {
+    await write();
   } finally {
-    await rm(temporary, { force: true });
     await rm(lock, { recursive: true });
   }
 }

package/src/cli/fleet-sync-forward.ts

@@ -91,7 +91,7 @@ export function managerCommand(
           revision,
           ...forwardedFlags(options, undefined),
         ]
-      : ['personal', 'fleet-sync', ...forwardedFlags(options, revision)];
+      : ['devfleet', 'fleet-sync', ...forwardedFlags(options, revision)];
   const color = process.stdout.isTTY && !process.env['NO_COLOR'];
   // A login shell gives the manager's normal PATH (mise, Docker, Tailscale).
   const script = `export ${NO_FORWARD_ENV}=1${color ? ' FORCE_COLOR=1' : ''}; exec ${args.map(shellQuote).join(' ')}`;

package/src/cli/fleet-sync-manager.ts

@@ -11,6 +11,11 @@ import { enrollManagerMonitoring } from './fleet-sync-monitoring';
 import { installConfig } from '../fleet-config';
 import { machineProviders } from '../t3/providers';
 import { providerNames } from '../t3/names-check';
+import macos from '../../ansible/macos/policy.json';
+import { ansibleCommand } from '../platform/ansible';
+import { PACKAGE_ROOT } from '../package-info';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
 
 /** The manager converges itself locally (never over SSH) before any worker:
  * it must be the declared manager, stay awake on AC power, and host every
@@ -32,7 +37,8 @@ export async function convergeManager(
   if (identity.status === 'pass') {
     // Launchers and scheduled jobs on the manager read the installed copy.
     if (input.apply) installConfig();
-    checks.push(await managerPower(run));
+    checks.push(await managerPower(run, input.workspace));
+    checks.push(await managerDocker(run));
     checks.push(await machineProviders(id, input.workspace, input.apply));
     checks.push(await providerNames(id, input.workspace, input.apply));
     if (input.apply) {
@@ -170,12 +176,22 @@ export async function managerIdentity(id: string, run: Runner): Promise<Check> {
       };
 }
 
-/** Workers depend on the manager's services, so it never sleeps on AC power. */
-export async function managerPower(run: Runner): Promise<Check> {
+/** Workers depend on the manager's services, so it never sleeps on AC power.
+ * Measures every setting `ansible/macos/manager.yml` declares, from the same
+ * policy file the playbook applies.
+ */
+export async function managerPower(
+  run: Runner,
+  workspace = '.'
+): Promise<Check> {
   const result = await run(['pmset', '-g', 'custom']);
   const ac = result.ok ? (result.stdout.split('AC Power:')[1] ?? '') : '';
-  const sleep = /^\s*sleep\s+(\d+)/m.exec(ac)?.[1];
-  return sleep === '0'
+  const observed = (key: string) =>
+    new RegExp(`^\\s*${key}\\s+(\\S+)`, 'm').exec(ac)?.[1];
+  const drifted = Object.entries(macos.pmset)
+    .filter(([key, value]) => observed(key) !== value)
+    .map(([key]) => key);
+  return drifted.length === 0
     ? {
         id: 'manager:power',
         status: 'pass',
@@ -184,10 +200,50 @@ export async function managerPower(run: Runner): Promise<Check> {
     : {
         id: 'manager:power',
         status: 'fail',
-        summary: 'MANAGER_SLEEPS_ON_POWER',
+        summary: drifted.includes('sleep')
+          ? 'MANAGER_SLEEPS_ON_POWER'
+          : `MANAGER_POWER_POLICY_DRIFT ${drifted.join(' ')}`,
         remedy: {
-          action:
-            'Workers lose the CLI proxy and Beszel hub while the manager sleeps. Apply the manager power policy once: ansible-playbook -K ansible/macos/manager.yml',
+          action: `Workers lose the CLI proxy and Beszel hub while the manager sleeps. Apply the manager power policy once, as an administrator: cd ${workspace} && ${ansibleCommand().join(' ')} -K ansible/macos/manager.yml`,
         },
       };
 }
+
+/** The Docker Desktop release `mise.toml` pins, as the engine names itself. */
+export function pinnedDockerDesktop(root = PACKAGE_ROOT): string {
+  const { vars } = Bun.TOML.parse(
+    readFileSync(join(root, 'mise.toml'), 'utf8')
+  ) as { vars: Record<string, string> };
+  return `Docker Desktop ${vars['docker_desktop_version']} (${vars['docker_desktop_build']})`;
+}
+
+/** The manager's services run in Docker Desktop, which no playbook installs
+ * and which updates itself: the pinned release is measured, and a different
+ * one warns instead of failing the run.
+ */
+export async function managerDocker(
+  run: Runner,
+  pinned = pinnedDockerDesktop()
+): Promise<Check> {
+  const result = await run(
+    ['docker', 'version', '--format', '{{.Server.Platform.Name}}'],
+    { timeoutMs: 20_000 }
+  );
+  const observed = result.ok ? result.stdout.trim() : '';
+  if (observed === pinned)
+    return {
+      id: 'manager:docker',
+      status: 'pass',
+      summary: `The manager runs the pinned ${pinned}.`,
+    };
+  return {
+    id: 'manager:docker',
+    status: 'warn',
+    summary: observed
+      ? 'MANAGER_DOCKER_DESKTOP_DRIFT'
+      : 'MANAGER_DOCKER_DESKTOP_UNOBSERVED',
+    remedy: {
+      action: `The manager's services are tested on ${pinned}. Install that release and turn off its automatic updates, or expect differences; fleet-sync does not install or replace Docker Desktop.`,
+    },
+  };
+}

package/src/cli/fleet-sync-monitoring.ts

@@ -2,7 +2,7 @@ import type { FleetNode, Runner, Check } from '../types';
 import type { FleetDefinition } from '../definition';
 import { hubUrl, roleOf } from '../topology';
 import { discoverTailnet } from '../tailscale';
-import { BESZEL_FLEET_IDENTITY, hubAccess } from '../monitoring/hub-access';
+import { fleetIdentity, hubAccess } from '../monitoring/hub-access';
 import { enrollBeszel } from '../monitoring/enroll';
 import { verifyBeszel } from '../monitoring/beszel';
 import { installRemoteAgent } from '../monitoring/remote';
@@ -142,15 +142,15 @@ async function hubReachable(hub: string, run: Runner): Promise<boolean> {
   return probe.ok;
 }
 
-const REMEDIES: Record<string, string> = {
-  BESZEL_ACCOUNT_REQUIRED: `The hub rejected the fleet login ${BESZEL_FLEET_IDENTITY}. A new hub on the manager creates it on first start from BESZEL_FLEET_AUTH; an older hub needs it once, by its superuser, as a verified users record with that Vault password. Never paste the password on a command line.`,
+const remedies = (): Record<string, string> => ({
+  BESZEL_ACCOUNT_REQUIRED: `The hub rejected the fleet login ${fleetIdentity()}. A new hub on the manager creates it on first start from BESZEL_FLEET_AUTH; an older hub needs it once, by its superuser, as a verified users record with that Vault password. Never paste the password on a command line.`,
   BESZEL_HUB_UNREACHABLE:
     'The hub runs on the manager; keep it awake and Docker Desktop running, then rerun fleet-sync from the manager so it converges the hub first.',
   BESZEL_NODE_TAILNET_REQUIRED:
     'The worker is not visible on the tailnet. Sign it in to Tailscale and record its tailscaleId in the local roster, then rerun fleet-sync.',
   BESZEL_NOT_ENROLLED:
     'Only workers declared in fleet.json run the agent over SSH; fleet-sync installs the manager’s own agent locally after its hub.',
-};
+});
 function unavailable(code: string): Check[] {
   return [
     {
@@ -159,7 +159,7 @@ function unavailable(code: string): Check[] {
       summary: code,
       remedy: {
         action:
-          REMEDIES[code] ??
+          remedies()[code] ??
           "Verify the manager's private hub is running and the manager has BESZEL_FLEET_AUTH through existing Vault authorization. The normal hub account must access these systems. Inspect duplicate registration/host conflicts before retry; no token or raw response is printed.",
       },
     },

package/src/cli/fleet-sync-output.ts

@@ -30,7 +30,10 @@ const COLUMNS: { title: string; matches: (id: string) => boolean }[] = [
   },
   {
     title: 'LINK',
-    matches: (id) => ['t3:manager-endpoint', 't3:paired-access'].includes(id),
+    matches: (id) =>
+      ['t3:manager-endpoint', 't3:manager-origin', 't3:paired-access'].includes(
+        id
+      ),
   },
   {
     title: 'PROXY',

package/src/cli/fleet-sync-remote.ts

@@ -11,7 +11,8 @@ import { saveReport } from './fleet-sync-report';
 import { synchronizeMonitoring } from './fleet-sync-monitoring';
 import { convergeManager } from './fleet-sync-manager';
 import { FleetUsageError } from '../errors';
-import { loadConfig, selectNodes } from '../config';
+import { selectNodes } from '../config';
+import { loadRoster } from './roster';
 import { enrolledRoster } from '../definition';
 import type { FleetDefinition } from '../definition';
 import { fleet as definition } from '../fleet-config';
@@ -19,23 +20,27 @@ import { synchronizeManager } from '../manager-sync';
 import { inspectBootstrap } from '../manager-sync';
 import { prepareBootstrap, bootstrapRemote } from '../remote-bootstrap';
 import { machineRoot } from './fleet-sync';
-import type { Runner } from '../types';
-import type { DeployNode } from '../manager-sync';
+import type { Check, Runner } from '../types';
+import type { DeployNode, ManagerReport } from '../manager-sync';
 import type { FleetSyncOptions } from './fleet-sync';
 import type { Settings } from './settings';
 import type { CommandOutcome } from './contracts';
 
+/** `settle` runs once the fleet's result is known and before it is reported:
+ * it records the result and returns the check that says so.
+ */
 export async function selected(
   options: FleetSyncOptions,
   settings: Settings,
-  run: Runner
+  run: Runner,
+  settle?: (report: ManagerReport) => Promise<Check>
 ): Promise<CommandOutcome> {
   if (!options.revision)
     throw new FleetUsageError('An approved source revision is required.');
   const canonical = definition;
   let roster;
   try {
-    roster = enrolledRoster(canonical, await loadConfig(settings.config));
+    roster = enrolledRoster(canonical, await loadRoster(settings.config));
   } catch {
     return enrollmentRequired(canonical, options.revision);
   }
@@ -89,6 +94,7 @@ export async function selected(
     run,
     deployWithMonitoring(payload, canonical, run, ui)
   ).finally(() => ui.progress.stop());
+  if (settle) report.checks.push(await settle(report));
   return outcome(report, planFingerprint, started);
 }
 

package/src/cli/fleet-sync-state.ts

@@ -0,0 +1,86 @@
+import type { Enrollment } from '../machine/state';
+import { replicaCheck } from '../state/check';
+import { storeEnrollment } from '../state/enrollment';
+import { adoptEarlier } from '../state/legacy';
+import { databasePath, stateRoot } from '../state/paths';
+import { writeDocument } from '../state/store';
+import { pending, push, type Standing, type StateContext } from '../state/sync';
+import type { Check } from '../types';
+
+/** What one fleet-sync run records in the fleet state: the revision it was
+ * approved for and the configuration it runs with, then what it applied, then
+ * an upload so the bucket holds all of it.
+ */
+export interface RunRecord {
+  /** Before any machine changes: this revision is the approved one. */
+  approve(): void;
+  /** Once the result is known. The check says whether the bucket holds it. */
+  settle(converged: boolean): Promise<Check>;
+  /** For a run that stopped before its result: its approval is still uploaded. */
+  abandon(): Promise<void>;
+}
+
+export function runRecord(
+  previous: Enrollment | null,
+  revision: string,
+  state: {
+    context: StateContext;
+    standing: Standing;
+    env?: NodeJS.ProcessEnv;
+    /** The configuration this run reads from a project's fleet.json. Stored
+     * so that a run started anywhere else (the schedule, a hand-off from a
+     * worker, a replacement manager) uses the one last applied.
+     */
+    definition?: string;
+  }
+): RunRecord {
+  const env = state.env ?? process.env;
+  const approval: Enrollment = {
+    ...previous,
+    version: 1,
+    id: 'manager',
+    approvedRevision: revision,
+  };
+  let settled = false;
+  /** Uploads only what this run changed; otherwise the bucket stands as it
+   * did when the run started.
+   */
+  const publish = (): Promise<Standing> =>
+    pending(state.context)
+      ? push(state.context)
+      : Promise.resolve(state.standing);
+  return {
+    approve: () => {
+      storeEnrollment(approval, env);
+      if (state.definition === undefined) return;
+      adoptEarlier(env);
+      writeDocument(
+        databasePath(stateRoot(env)),
+        'definition',
+        state.definition
+      );
+    },
+    async settle(converged) {
+      settled = true;
+      if (converged)
+        storeEnrollment(
+          {
+            ...approval,
+            appliedRevision: revision,
+            ...(previous?.appliedRevision &&
+            previous.appliedRevision !== revision
+              ? { previousRevision: previous.appliedRevision }
+              : {}),
+          },
+          env
+        );
+      // The fleet converged either way: a bucket problem is reported, not fatal.
+      return replicaCheck(await publish().catch(() => 'unreachable' as const), {
+        advisory: true,
+      });
+    },
+    async abandon() {
+      if (!settled) await publish().catch(() => undefined);
+    },
+  };
+}

package/src/cli/fleet-sync.ts

@@ -1,5 +1,9 @@
 import { localCheckoutRevision } from '../machine/local-source';
-import { fleet as canonicalDefinition } from '../fleet-config';
+import {
+  definitionSource,
+  fleet as canonicalDefinition,
+  reloadFleet,
+} from '../fleet-config';
 import { managerFailure } from '../manager-failure';
 import { managerText, stdoutColor } from './fleet-sync-output';
 import { managerSchedule, type ScheduleAction } from './fleet-sync-schedule';
@@ -9,12 +13,20 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { existsSync, renameSync } from 'node:fs';
 import {
-  readEnrollment,
   isRevision,
-  saveEnrollment,
   withMachineLock,
   ensurePrivateRoot,
+  type Enrollment,
 } from '../machine/state';
+import { loadEnrollment } from '../state/enrollment';
+import { legacyHome } from '../state/paths';
+import {
+  DIVERGED_REMEDY,
+  refresh,
+  stateContext,
+  type Standing,
+} from '../state/sync';
+import { runRecord } from './fleet-sync-state';
 import { runCommand } from '../runner';
 import type { Runner } from '../types';
 import type { Settings } from './settings';
@@ -23,15 +35,14 @@ import { FleetUsageError } from '../errors';
 import { FleetLockError } from '../machine/lock-error';
 import { selected } from './fleet-sync-remote';
 import { managerIdentity } from './fleet-sync-manager';
-import { trackedScript } from '../remote-bootstrap';
-import { rehome } from './fleet-sync-checkout';
+import { managerRunScript, rehome } from './fleet-sync-checkout';
+import { packageInfo } from '../package-info';
 import {
   forwardingDisabled,
   forwardToManager,
   type ForwardSpawn,
 } from './fleet-sync-forward';
 
-declare const PERSONAL_SOURCE_REVISION: string | null;
 export interface FleetSyncOptions {
   revision?: string;
   dryRun?: boolean;
@@ -69,9 +80,29 @@ export async function fleetSync(
   if (!(await onManager(run)))
     return offManager(options, settings, run, forward);
   if (options.schedule === 'status') return scheduleStatus(settings, run);
-  const root = machineRoot();
+  return managerSync(options, settings, {
+    run,
+    root: machineRoot(),
+    restart: () => fleetSync(options, settings, run, forward),
+  });
+}
+
+export interface ManagerSync {
+  run: Runner;
+  /** This machine's run lock and caches. */
+  root: string;
+  /** Starts the request over once the fleet state has been replaced. */
+  restart: () => Promise<CommandOutcome>;
+}
+
+/** fleet-sync on the machine already known to be the manager. */
+export async function managerSync(
+  options: FleetSyncOptions,
+  settings: Settings,
+  { run, root, restart }: ManagerSync
+): Promise<CommandOutcome> {
   await ensurePrivateRoot(root);
-  const state = await readEnrollment(root);
+  const state = await loadEnrollment(legacyHome() ? root : null);
   const revision = await selectedRevision(
     options.revision,
     state?.approvedRevision,
@@ -81,61 +112,100 @@ export async function fleetSync(
   if (!isRevision(revision))
     return actionRequired(
       'FLEET_REVISION_REQUIRED',
-      'Select an approved full SHA with --revision, or use a published package containing clean source provenance.'
+      'No revision to converge to. Run the published dev-fleet package (it names the commit it was built from), or select a full commit SHA with --revision.'
     );
   if (options.schedule)
     return scheduleRequest(options, revision, settings, run);
   const rehomed = await rehome(
     options,
-    { revision, workspace: settings.workspace },
+    { revision, workspace: settings.workspace, root },
     run
   );
-  if (rehomed) return rehomed;
-  const request = { ...options, revision };
-  if (request.dryRun) return selected(request, settings, run);
-  // Applies without a confirmation prompt; --dry-run is the preview.
-  request.apply = true;
-  request.yes = true;
-  if (interactive(options)) {
-    await enrollManager(settings.config, run);
-    // Needed to hand each node its own Vault token; nodes report any gap.
-    await authorizeManager({ interactive: true }, run);
-    request.interactiveAuthorization = true;
+  if (rehomed === 'unavailable')
+    return actionRequired(
+      'FLEET_SOURCE_UNAVAILABLE',
+      `Revision ${revision} could not be taken from ${canonicalDefinition.source.repository}, so nothing was changed. Check the network and Git access to it, and that the revision is pushed there; fleet-sync never converges from the package or working tree it was started in.`,
+      revision
+    );
+  if (rehomed !== 'here') return rehomed;
+  if (options.dryRun) return selected({ ...options, revision }, settings, run);
+  // The bucket is the source of truth: a run starts from its version of the
+  // configuration, the roster and the approval, not from a stale local copy.
+  const fresh = await refresh(stateContext(run));
+  if (fresh.standing === 'diverged')
+    return actionRequired('FLEET_STATE_DIVERGED', DIVERGED_REMEDY, revision);
+  if (fresh.replaced) {
+    // Everything read so far came from the stale copy, the manager's own
+    // identity included.
+    reloadFleet();
+    return restart();
   }
-  return applyLocked(root, state, request, { settings, run });
+  return authorizeAndApply(root, state, options, {
+    settings,
+    run,
+    revision,
+    standing: fresh.standing,
+  });
 }
 
-/** Records the approved revision, converges, then records what was applied. */
+interface ApplyContext {
+  settings: Settings;
+  run: Runner;
+  revision: string;
+  /** How the fleet state stood with the bucket when this run started. */
+  standing: Standing;
+}
+
+/** Applies without a confirmation prompt; --dry-run is the preview. */
+async function authorizeAndApply(
+  root: string,
+  state: Enrollment | null,
+  options: FleetSyncOptions,
+  context: ApplyContext
+): Promise<CommandOutcome> {
+  const { settings, run, revision } = context;
+  const request = { ...options, revision, apply: true, yes: true };
+  if (!interactive(options)) return applyLocked(root, state, request, context);
+  await enrollManager(settings.config, run);
+  // Needed to hand each node its own Vault token; nodes report any gap.
+  await authorizeManager({ interactive: true }, run);
+  return applyLocked(
+    root,
+    state,
+    { ...request, interactiveAuthorization: true },
+    context
+  );
+}
+
+/** Records the approved revision, converges, records what was applied, then
+ * uploads the fleet state: the report says whether the bucket holds it.
+ */
 function applyLocked(
   root: string,
-  state: Awaited<ReturnType<typeof readEnrollment>>,
+  state: Enrollment | null,
   request: FleetSyncOptions & { revision: string },
-  context: { settings: Settings; run: Runner }
+  context: ApplyContext
 ): Promise<CommandOutcome> {
-  const { revision } = request;
-  const { settings, run } = context;
+  const { settings, run, revision } = context;
+  const record = runRecord(state, revision, {
+    context: stateContext(run),
+    standing: context.standing,
+    ...(definitionSource().kind === 'file'
+      ? { definition: JSON.stringify(canonicalDefinition, null, 2) + '\n' }
+      : {}),
+  });
   return withMachineLock(root, async () => {
-    const approval = {
-      ...state,
-      version: 1 as const,
-      id: 'manager',
-      approvedRevision: revision,
-    };
-    await saveEnrollment(root, approval);
-    const result = await selected(
-      { ...request, rolledOut: state?.appliedRevision === revision },
-      settings,
-      run
-    );
-    if (result.exitCode === 0)
-      await saveEnrollment(root, {
-        ...approval,
-        appliedRevision: revision,
-        ...(state?.appliedRevision && state.appliedRevision !== revision
-          ? { previousRevision: state.appliedRevision }
-          : {}),
-      });
-    return result;
+    record.approve();
+    try {
+      return await selected(
+        { ...request, rolledOut: state?.appliedRevision === revision },
+        settings,
+        run,
+        (report) => record.settle(report.ok)
+      );
+    } finally {
+      await record.abandon();
+    }
   }).catch((error: unknown) => {
     if (error instanceof FleetLockError)
       return actionRequired(
@@ -175,12 +245,7 @@ async function offManager(
       revision ?? null
     );
   const runScript = revision
-    ? await trackedScript(
-        settings.workspace,
-        revision,
-        'bootstrap/fleet-manager-run.sh',
-        run
-      )
+    ? await managerRunScript(settings.workspace, revision, run)
     : null;
   return forwardToManager(definition, options, revision, {
     spawn: forward,
@@ -242,10 +307,11 @@ function interactive(options: FleetSyncOptions): boolean {
   );
 }
 
+/** The commit an installed package was published from: the version of
+ * dev-fleet you run is the revision the fleet moves to.
+ */
 function packageRevision(): string | undefined {
-  return typeof PERSONAL_SOURCE_REVISION === 'string'
-    ? PERSONAL_SOURCE_REVISION
-    : undefined;
+  return packageInfo().revision ?? undefined;
 }
 
 async function scheduleRequest(

package/src/cli/fleet.ts

@@ -89,15 +89,17 @@ async function register(
   options: CliOptions
 ): Promise<CommandOutcome> {
   const node = nodeFromOptions(options);
-  const config = await addNode(settings.config, node, options.apply === true);
+  const added = await addNode(settings.config, node, options.apply === true);
   return result({
     version: 1,
     command: 'add',
     ok: true,
     applied: options.apply === true,
     path: settings.config,
+    // How the fleet state stands with the bucket after this change.
+    ...(added.standing ? { state: added.standing } : {}),
     node,
-    nodes: config.nodes,
+    nodes: added.roster.nodes,
     next: options.apply
       ? 'Run fleet-nodes --onboard, then fleet-status --json.'
       : 'Review this preview, then repeat with --apply --yes.',