@intentius/chant-lexicon-fly 0.44.14 → 0.46.0

package/dist/codegen/docs.d.ts

@@ -12,12 +12,6 @@
  * Machines, Storage, Networking, Secrets).
  */
 export declare function serviceFromType(resourceType: string): string;
-/**
- * The reference doc URL for a fly resource type. The Machines API (flaps) is
- * documented at docs.machines.dev, tagged by resource; resources flaps does not
- * own (public IPs, certificates) link to the matching fly.io docs page.
- */
-export declare function resourceTypeUrl(resourceType: string): string;
 /**
  * Generate documentation for the fly Machines lexicon.
  */

package/dist/codegen/docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAsBH;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAiB5D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAkB5D;AAsED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA0DjF"}
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAiB5D;AA2DD;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBjF"}

package/dist/describe-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAoB,MAAM,0BAA0B,CAAC;AAEtG,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAqBL,KAAK,OAAO,EAIb,MAAM,2BAA2B,CAAC;AAcnC,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,gDAAgD;IAChD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAeD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,IAAI,GAAE,OAA0B,EAChC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,iBAAiB,CAAC,CA4R5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,OAAO,CAC3B,OAAO,EAAE,wBAAwB,GAAG;IAClC,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CACjD,EACD,IAAI,GAAE,OAA0B,EAChC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,SAAS,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAkCrD"}
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAoB,MAAM,0BAA0B,CAAC;AAItG,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAqBL,KAAK,OAAO,EAIb,MAAM,2BAA2B,CAAC;AAcnC,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,gDAAgD;IAChD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAeD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,IAAI,GAAE,OAA0B,EAChC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,iBAAiB,CAAC,CAiS5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,OAAO,CAC3B,OAAO,EAAE,wBAAwB,GAAG;IAClC,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CACjD,EACD,IAAI,GAAE,OAA0B,EAChC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,SAAS,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAkCrD"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "1fbfc95ed68886ffc1c484f80d7391106fd7a1179c7450a1ad9fbd79560aa1d4",
+    "manifest.json": "87eb08737e0b05d0dff013f5a3474cf9da153f6727ee8d15f637ce7f286031a4",
     "meta.json": "e46e65ba7544fafc6dbb3fd48b841904b5ae6f7cb4d517a940ed68b01626c097",
     "types/index.d.ts": "a76090adb6eda33a2c07a074183299a59e953b48dd3f2020d7ef11278d59341e",
     "rules/guest-sizing.ts": "bc749d218df8f3cc3d8fbe388205ae96e6b204ae0d6d77e8bf82cb936cc53ff6",
@@ -15,5 +15,5 @@
     "skills/chant-fly-ops.md": "b8eef6504e203133e6a35c83aabb08404eec95060705395515a0046d42269cf1",
     "skills/chant-fly-sprites.md": "89ba52db63a71a17eab483d99233a4ae67f5d34920445010e750f81c95200b4e"
   },
-  "composite": "98afa1b841bc5430ae0e7eda44c408696adbe088a3c658d63cef009eebaf6e89"
+  "composite": "6e0ad16fc43da2edad2bc8bfa9a6a42ced592d6b8871914af192c11099fdb8ee"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "fly",
-  "version": "0.44.14",
+  "version": "0.46.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Fly"
 }

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAkD,MAAM,0BAA0B,CAAC;AAuB9G;;;;GAIG;AACH,eAAO,MAAM,SAAS,EAAE,aA+RvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAkD,MAAM,0BAA0B,CAAC;AAuB9G;;;;GAIG;AACH,eAAO,MAAM,SAAS,EAAE,aA6SvB,CAAC"}

package/dist/teardown.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Env teardown for the fly lexicon (chant #1222) — both halves of the
+ * `teardownOwned` / `executeTeardown` capability pair, over the applier's own
+ * flaps primitives (op/activities/fly-apply.ts).
+ *
+ * Selection follows the two-tier ownership convention (#743, D2):
+ *
+ *   - Machines carry the primary marker in `config.metadata`
+ *     (`managed-by: chant` + `chant-stack` + `chant-env`), so a machine is a
+ *     candidate exactly when its own metadata reads back the requested
+ *     stack + env identity.
+ *   - The app is the boundary for everything metadata-less (volumes, IPs,
+ *     certificates, secrets). An app becomes a candidate only when it has at
+ *     least one machine and EVERY machine in it carries the requested
+ *     identity — an app also hosting a foreign or other-env machine is never
+ *     deleted whole; only its matching machines are.
+ *
+ * Enumeration lists apps via `GET /v1/apps` (mudflaps serves it as-is; real
+ * flaps wants `?org_slug=`, appended from FLY_ORG / FLY_ORG_SLUG when set)
+ * and each app's machines. An unlistable app is a hole (#1089) — unknown,
+ * never absent.
+ *
+ * Execution deletes machines first (lease → destroy → wait, the applier's
+ * `destroyMachine`) and apps last (`deleteApp`, which takes the app-scoped
+ * volumes/IPs/certs with it). Before every delete the live side is re-read
+ * and the identity re-verified; already-gone is `deleted` (teardown is
+ * idempotent), an identity mismatch is `not-prunable`, never a delete.
+ */
+import type { TeardownCandidate, TeardownEnumeration, TeardownExecution } from "@intentius/chant/lexicon";
+import { type OwnershipMarker } from "@intentius/chant/ownership";
+import { type FlyHttp, type WaitOpts } from "./op/activities/fly-apply.js";
+export interface FlyTeardownOptions {
+    environment: string;
+    marker: OwnershipMarker;
+}
+/** Injection seam for tests: scripted http, explicit endpoint, shrunk waits. */
+export interface FlyTeardownDeps {
+    http?: FlyHttp;
+    endpoint?: string;
+    wait?: WaitOpts;
+}
+/**
+ * Enumerate the env's marker-matching machines and whole-app boundaries — the
+ * fly half of `chant lifecycle teardown <env>` planning.
+ */
+export declare function teardownOwned(options: FlyTeardownOptions, deps?: FlyTeardownDeps): Promise<TeardownEnumeration>;
+/**
+ * Delete the handed-over candidates: machines first, apps last. One outcome
+ * per candidate, always.
+ */
+export declare function executeTeardown(options: FlyTeardownOptions & {
+    candidates: TeardownCandidate[];
+}, deps?: FlyTeardownDeps): Promise<TeardownExecution>;
+//# sourceMappingURL=teardown.d.ts.map

package/dist/teardown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teardown.d.ts","sourceRoot":"","sources":["../src/teardown.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EAGlB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAEjF,OAAO,EAQL,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,2BAA2B,CAAC;AAQnC,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AA2BD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,kBAAkB,EAC3B,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CA8C9B;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,kBAAkB,GAAG;IAAE,UAAU,EAAE,iBAAiB,EAAE,CAAA;CAAE,EACjE,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,iBAAiB,CAAC,CAuB5B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-fly",
-  "version": "0.44.14",
+  "version": "0.46.0",
   "type": "module",
   "files": [
     "src/",
@@ -57,7 +57,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.44.14",
+    "@intentius/chant": "^0.46.0",
     "typescript": "^5.9.3"
   },
   "description": "Fly.io Machines lexicon for chant — declarative IaC in TypeScript",

package/src/codegen/docs.ts

@@ -12,20 +12,6 @@ import { docsPipeline, writeDocsSite, type DocsConfig } from "@intentius/chant/c
 
 const pkgDir = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
 
-/**
- * The curated top-level fly resources (#741), in the order they read best in a
- * reference table. Property types (MachineConfig, MachineGuest, ...) are grouped
- * separately by the pipeline and are not repeated here.
- */
-const RESOURCES: Array<{ className: string; resourceType: string }> = [
-  { className: "App", resourceType: "Fly::Machines::App" },
-  { className: "Machine", resourceType: "Fly::Machines::Machine" },
-  { className: "Volume", resourceType: "Fly::Machines::Volume" },
-  { className: "IPAddress", resourceType: "Fly::Machines::IPAddress" },
-  { className: "Certificate", resourceType: "Fly::Machines::Certificate" },
-  { className: "Secret", resourceType: "Fly::Machines::Secret" },
-];
-
 /**
  * Group a fly resource type into a service bucket for the reference sidebar.
  * fly type names are `Fly::Machines::<Kind>`, so the middle segment is always
@@ -51,31 +37,6 @@ export function serviceFromType(resourceType: string): string {
   }
 }
 
-/**
- * The reference doc URL for a fly resource type. The Machines API (flaps) is
- * documented at docs.machines.dev, tagged by resource; resources flaps does not
- * own (public IPs, certificates) link to the matching fly.io docs page.
- */
-export function resourceTypeUrl(resourceType: string): string {
-  const kind = resourceType.split("::")[2] ?? resourceType;
-  switch (kind) {
-    case "App":
-      return "https://docs.machines.dev/#tag/apps";
-    case "Machine":
-      return "https://docs.machines.dev/#tag/machines";
-    case "Volume":
-      return "https://docs.machines.dev/#tag/volumes";
-    case "Secret":
-      return "https://docs.machines.dev/#tag/secrets";
-    case "IPAddress":
-      return "https://fly.io/docs/networking/services/";
-    case "Certificate":
-      return "https://fly.io/docs/networking/custom-domains-with-fly/";
-    default:
-      return "https://docs.machines.dev/";
-  }
-}
-
 const overview = `The **Fly Machines** lexicon defines Fly.io apps and machines using chant's declarative TypeScript syntax. Resources are serialized to the JSON create bodies the Machines API ("flaps") accepts, so the applier can POST them straight through and the mudflaps emulator can round-trip them offline.
 
 This lexicon is generated from Fly's published [Machines API OpenAPI spec](https://docs.machines.dev/openapi.json).
@@ -133,17 +94,6 @@ Every serialized machine carries the \`managed-by: chant\` ownership marker in \
 
 The output is applied against flaps directly (or the mudflaps emulator offline). Endpoint and auth come from \`FLY_FLAPS_BASE_URL\` and \`FLY_API_TOKEN\`.`;
 
-const resourcesPage = `The fly lexicon ships ${RESOURCES.length} top-level resources. Each maps to a Machines API create body; follow the reference link for the underlying API shape.
-
-| Resource | Type | Service | Machines API |
-|----------|------|---------|--------------|
-${RESOURCES.map(
-  (r) =>
-    `| \`${r.className}\` | \`${r.resourceType}\` | ${serviceFromType(r.resourceType)} | [reference](${resourceTypeUrl(r.resourceType)}) |`,
-).join("\n")}
-
-Property types such as \`MachineConfig\`, \`MachineGuest\`, \`MachineService\`, \`MachinePort\`, and \`MachineMount\` are authored inline on a resource and are documented alongside the resources they belong to.`;
-
 /**
  * Generate documentation for the fly Machines lexicon.
  */
@@ -159,42 +109,6 @@ export async function generateDocs(options?: { verbose?: boolean }): Promise<voi
     overview,
     outputFormat,
     serviceFromType,
-    extraPages: [
-      {
-        slug: "resources",
-        title: "Resource Reference",
-        description: "The fly resource types and their Machines API documentation links",
-        content: resourcesPage,
-      },
-      {
-        slug: "pseudo-params",
-        title: "Pseudo-parameters",
-        description: "Environment-resolved values: Fly.Region, Fly.OrgSlug, Fly.AppName",
-        content: `Pseudo-parameters stand in for values that vary by environment. Reference them instead of hard-coding, and the serializer resolves each from an environment variable at build time.
-
-| Pseudo-parameter | Environment variable | Fallback |
-|------------------|----------------------|----------|
-| \`Fly.Region\` | \`FLY_REGION\` | \`iad\` |
-| \`Fly.OrgSlug\` | \`FLY_ORG\`, then \`FLY_ORG_SLUG\` | \`personal\` |
-| \`Fly.AppName\` | \`FLY_APP_NAME\` | \`app\` |
-
-\`\`\`typescript
-import { App, Machine, MachineConfig, MachineGuest, Fly } from "@intentius/chant-lexicon-fly";
-
-const app = new App({ name: "my-app", org_slug: Fly.OrgSlug });
-
-const web = new Machine({
-  region: Fly.Region,
-  config: new MachineConfig({
-    image: "flyio/hellofly:latest",
-    guest: new MachineGuest({ cpu_kind: "shared", cpus: 1, memory_mb: 256 }),
-  }),
-});
-\`\`\`
-
-With \`FLY_REGION=lhr\` set, \`region\` serializes to \`"lhr"\`; unset, it falls back to \`"iad"\`.`,
-      },
-    ],
   };
 
   const result = docsPipeline(config);

package/src/describe-resources.test.ts

@@ -259,5 +259,31 @@ describeObservationConformance({
           fakeHttp([liveMachine("web", "nginx:1")]),
         ),
     },
+    {
+      // Marker identity (#1222): machines carry the metadata channel and
+      // surface stack/env verbatim; the app's `owned` verdict is inferred at
+      // the boundary and carries no marker of its own — absent, not guessed.
+      name: "a stack/env-stamped machine surfaces its marker; the app surfaces none",
+      declared: ["app", "web"],
+      expectPresent: ["app", "web"],
+      expectMarker: { web: { stack: "shop", env: "prod" } },
+      expectNoMarker: ["app"],
+      run: () =>
+        describeResources(
+          { environment: "prod", buildOutput: PLAN, entityNames: ["app", "web"], entities: ENTS, endpoint: ENDPOINT },
+          fakeHttp([
+            {
+              id: "m-web",
+              name: "web",
+              state: "started",
+              instance_id: "INST0",
+              config: {
+                image: "nginx:1",
+                metadata: { ...OWNED_META, "chant-stack": "shop", "chant-env": "prod" },
+              },
+            },
+          ]),
+        ),
+    },
   ],
 });

package/src/describe-resources.ts

@@ -29,6 +29,8 @@
 
 import type { ObservationResult, ResourceMetadata, UnobservedEntity } from "@intentius/chant/lexicon";
 import { normalizeObservation, observation, unobservedAll } from "@intentius/chant/observation";
+import { readOwnership } from "@intentius/chant/ownership";
+import { FLY_METADATA_OWNERSHIP_KEYS } from "./ownership";
 import {
   buildChangeSet,
   renderChangeSet,
@@ -311,6 +313,11 @@ export async function describeResources(
         physicalId: m.id,
         status: m.state,
         ownership: isOwned ? "owned" : "foreign",
+        // Marker identity (#1222): machines are the one fly type carrying the
+        // metadata channel, so only they surface stack/env. Apps and the
+        // boundary types (volumes/ips/certs) get their verdict inferred at the
+        // app boundary and carry no marker of their own — absent, not guessed.
+        marker: readOwnership(m.config?.metadata, FLY_METADATA_OWNERSHIP_KEYS),
         attributes: pruneUndefined({
           app,
           machineName: m.name,

package/src/import/roundtrip.test.ts

@@ -49,7 +49,7 @@ describe("roundtrip: declared entities → serialize → parse → generate →
       ["app", app],
       ["web", web],
     ]);
-    const planA = JSON.parse(flySerializer.serialize(entities));
+    const planA = JSON.parse(flySerializer.serialize(entities) as string);
 
     // 2. Parse the plan and generate TypeScript.
     const ir = parser.parse(JSON.stringify(planA));
@@ -67,7 +67,7 @@ describe("roundtrip: declared entities → serialize → parse → generate →
 
     // 4. Re-serialize the regenerated entities.
     const regenerated = new Map<string, any>(Object.entries(mod));
-    const planB = JSON.parse(flySerializer.serialize(regenerated));
+    const planB = JSON.parse(flySerializer.serialize(regenerated) as string);
 
     // The bodies survive the round-trip. Entity keys differ (variable names are
     // camelCased from the resource name), so compare the create bodies by kind.

package/src/plugin.ts

@@ -299,6 +299,20 @@ export { app, web };
     return describeResources(options);
   },
 
+  // Env teardown (#1222): enumeration + execution over the machine marker
+  // (`managed-by` + `chant-stack` + `chant-env`) and the app boundary (#743).
+  // Machines are destroyed first, whole apps last — an app hosting any machine
+  // outside the requested identity is never deleted whole. See ./teardown.ts.
+  async teardownOwned(options) {
+    const { teardownOwned } = await import("./teardown");
+    return teardownOwned(options);
+  },
+
+  async executeTeardown(options) {
+    const { executeTeardown } = await import("./teardown");
+    return executeTeardown(options);
+  },
+
   // Live export (cloud → code): read live flaps state and regenerate App/Machine
   // TypeScript. Strips server-written fields to the authored shape; honors the
   // `owned` filter (machine marker; app-boundary inference for the marker-less

package/src/serializer.test.ts

@@ -11,7 +11,7 @@ function stack(...entries: Array<[string, unknown]>): Map<string, Declarable> {
 
 describe("fly serializer", () => {
   it("serializes an empty map to valid JSON", () => {
-    const result = flySerializer.serialize(new Map());
+    const result = flySerializer.serialize(new Map()) as string;
     expect(typeof result).toBe("string");
     expect(JSON.parse(result)).toEqual({});
   });
@@ -27,7 +27,7 @@ describe("fly serializer", () => {
       new App({ name: "my-app", org_slug: "acme" }),
     ]);
 
-    const out = JSON.parse(flySerializer.serialize(entities));
+    const out = JSON.parse(flySerializer.serialize(entities) as string);
     expect(out.web).toEqual({
       endpoint: "/v1/apps",
       method: "POST",
@@ -36,7 +36,7 @@ describe("fly serializer", () => {
   });
 
   it("falls back to the entity name for app_name when no explicit name", () => {
-    const out = JSON.parse(flySerializer.serialize(stack(["billing", new App({ org_slug: "acme" })])));
+    const out = JSON.parse(flySerializer.serialize(stack(["billing", new App({ org_slug: "acme" })])) as string);
     expect(out.billing.body.app_name).toBe("billing");
   });
 
@@ -57,7 +57,7 @@ describe("fly serializer", () => {
       ],
     );
 
-    const out = JSON.parse(flySerializer.serialize(entities));
+    const out = JSON.parse(flySerializer.serialize(entities) as string);
     expect(out.api.endpoint).toBe("/v1/apps/my-app/machines");
     expect(out.api.method).toBe("POST");
     expect(out.api.body.name).toBe("api-1");
@@ -79,7 +79,7 @@ describe("fly serializer", () => {
       ],
     );
 
-    const out = JSON.parse(flySerializer.serialize(entities));
+    const out = JSON.parse(flySerializer.serialize(entities) as string);
     // No user metadata → marker still present.
     expect(out.bare.body.config.metadata["managed-by"]).toBe("chant");
     // User metadata is preserved and the marker is merged in.
@@ -94,7 +94,7 @@ describe("fly serializer", () => {
     );
 
     const out = JSON.parse(
-      flySerializer.serialize(entities, undefined, { ownership: { stack: "billing", env: "prod" } }),
+      flySerializer.serialize(entities, undefined, { ownership: { stack: "billing", env: "prod" } }) as string,
     );
     const meta = out.api.body.config.metadata;
     expect(meta["managed-by"]).toBe("chant");
@@ -110,7 +110,7 @@ describe("fly serializer", () => {
         new Machine({ name: "api-1", region: "iad", config: new MachineConfig({ image: "nginx" }) }),
       ],
     );
-    const body = JSON.parse(flySerializer.serialize(entities)).api.body;
+    const body = JSON.parse(flySerializer.serialize(entities) as string).api.body;
     // Only fields present on flaps CreateMachineRequest / MachineConfig.
     expect(Object.keys(body).sort()).toEqual(["config", "name", "region"]);
     expect(Object.keys(body.config.guest ?? {})).toEqual([]);
@@ -123,7 +123,7 @@ describe("fly serializer", () => {
       ["app", new App({ name: "my-app" })],
       ["data", new Volume({ name: "data", region: "iad", size_gb: 10, encrypted: true })],
     );
-    const out = JSON.parse(flySerializer.serialize(entities));
+    const out = JSON.parse(flySerializer.serialize(entities) as string);
     expect(out.data).toEqual({
       endpoint: "/v1/apps/my-app/volumes",
       method: "POST",
@@ -138,7 +138,7 @@ describe("fly serializer", () => {
       ["app", new App({ name: "my-app" })],
       ["ip", new IPAddress({ type: "shared_v4", region: "iad", org_slug: "acme", service_name: "web", network: "default" })],
     );
-    const out = JSON.parse(flySerializer.serialize(entities));
+    const out = JSON.parse(flySerializer.serialize(entities) as string);
     expect(out.ip).toEqual({
       endpoint: "/v1/apps/my-app/ip_assignments",
       method: "POST",
@@ -151,7 +151,7 @@ describe("fly serializer", () => {
       ["app", new App({ name: "my-app" })],
       ["cert", new Certificate({ hostname: "example.com" })],
     );
-    const out = JSON.parse(flySerializer.serialize(entities));
+    const out = JSON.parse(flySerializer.serialize(entities) as string);
     expect(out.cert).toEqual({
       endpoint: "/v1/apps/my-app/certificates",
       method: "POST",
@@ -164,7 +164,7 @@ describe("fly serializer", () => {
       ["app", new App({ name: "my-app" })],
       ["db-password", new Secret({ value: "s3cret" })],
     );
-    const out = JSON.parse(flySerializer.serialize(entities));
+    const out = JSON.parse(flySerializer.serialize(entities) as string);
     expect(out["db-password"]).toEqual({
       endpoint: "/v1/apps/my-app/secrets/db-password",
       method: "POST",
@@ -195,7 +195,7 @@ describe("fly serializer pseudo-parameters", () => {
       ["app", new App({ name: "my-app" })],
       ["web", new Machine({ region: Fly.Region, config: new MachineConfig({ image: "nginx" }) })],
     );
-    const body = JSON.parse(flySerializer.serialize(entities)).web.body;
+    const body = JSON.parse(flySerializer.serialize(entities) as string).web.body;
     expect(body.region).toBe("lhr");
   });
 
@@ -205,28 +205,28 @@ describe("fly serializer pseudo-parameters", () => {
       ["app", new App({ name: "my-app" })],
       ["web", new Machine({ region: Fly.Region, config: new MachineConfig({ image: "nginx" }) })],
     );
-    const body = JSON.parse(flySerializer.serialize(entities)).web.body;
+    const body = JSON.parse(flySerializer.serialize(entities) as string).web.body;
     expect(body.region).toBe("iad");
   });
 
   it("resolves Fly.OrgSlug from FLY_ORG (preferred over FLY_ORG_SLUG)", () => {
     process.env.FLY_ORG = "acme";
     process.env.FLY_ORG_SLUG = "ignored";
-    const out = JSON.parse(flySerializer.serialize(stack(["app", new App({ name: "my-app", org_slug: Fly.OrgSlug })])));
+    const out = JSON.parse(flySerializer.serialize(stack(["app", new App({ name: "my-app", org_slug: Fly.OrgSlug })])) as string);
     expect(out.app.body.org_slug).toBe("acme");
   });
 
   it("resolves Fly.OrgSlug from FLY_ORG_SLUG when FLY_ORG is unset", () => {
     delete process.env.FLY_ORG;
     process.env.FLY_ORG_SLUG = "beta-org";
-    const out = JSON.parse(flySerializer.serialize(stack(["app", new App({ name: "my-app", org_slug: Fly.OrgSlug })])));
+    const out = JSON.parse(flySerializer.serialize(stack(["app", new App({ name: "my-app", org_slug: Fly.OrgSlug })])) as string);
     expect(out.app.body.org_slug).toBe("beta-org");
   });
 
   it("falls back to personal for Fly.OrgSlug when no org env var is set", () => {
     delete process.env.FLY_ORG;
     delete process.env.FLY_ORG_SLUG;
-    const out = JSON.parse(flySerializer.serialize(stack(["app", new App({ name: "my-app", org_slug: Fly.OrgSlug })])));
+    const out = JSON.parse(flySerializer.serialize(stack(["app", new App({ name: "my-app", org_slug: Fly.OrgSlug })])) as string);
     expect(out.app.body.org_slug).toBe("personal");
   });
 });

package/src/teardown.test.ts

@@ -0,0 +1,253 @@
+/**
+ * Env teardown over a scripted flaps (chant #1222) — the fly halves of the
+ * teardownOwned / executeTeardown capability pair, mirroring the injected-HTTP
+ * style of fly-apply.test.ts and describe-resources.test.ts: a stateful fake
+ * answers app/machine reads and records mutations, so the lease → destroy →
+ * wait path and the app-boundary rules run for real.
+ */
+
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { teardownOwned, executeTeardown } from "./teardown";
+import type { FlyHttp } from "./op/activities/fly-apply";
+
+const ENDPOINT = "http://localhost:4280";
+const MARKER = { stack: "shop", env: "dev" };
+const NO_WAIT = { intervalMs: 0, deadlineMs: 5_000 };
+
+const savedOrg = { FLY_ORG: process.env.FLY_ORG, FLY_ORG_SLUG: process.env.FLY_ORG_SLUG };
+beforeEach(() => {
+  delete process.env.FLY_ORG;
+  delete process.env.FLY_ORG_SLUG;
+});
+afterEach(() => {
+  if (savedOrg.FLY_ORG === undefined) delete process.env.FLY_ORG; else process.env.FLY_ORG = savedOrg.FLY_ORG;
+  if (savedOrg.FLY_ORG_SLUG === undefined) delete process.env.FLY_ORG_SLUG; else process.env.FLY_ORG_SLUG = savedOrg.FLY_ORG_SLUG;
+});
+
+type FakeMachine = { id: string; name: string; state: string; instance_id: string; config?: { metadata?: Record<string, string> } };
+
+function machine(
+  name: string,
+  metadata: Record<string, string> | undefined,
+  extra: Partial<FakeMachine> = {},
+): FakeMachine {
+  return {
+    id: extra.id ?? `m-${name}`,
+    name,
+    state: extra.state ?? "started",
+    instance_id: "INST0",
+    config: { ...(metadata !== undefined ? { metadata } : {}) },
+  };
+}
+
+const MINE = { "managed-by": "chant", "chant-stack": "shop", "chant-env": "dev" };
+const OTHER_ENV = { "managed-by": "chant", "chant-stack": "shop", "chant-env": "prod" };
+const OTHER_STACK = { "managed-by": "chant", "chant-stack": "blog", "chant-env": "dev" };
+
+/**
+ * A stateful scripted flaps: `apps` maps app name to its machines; deletes
+ * mutate the state, so the app-boundary re-check after a destroy sees what a
+ * real flaps would. An app mapped to the string "boom" fails its machine list.
+ */
+function scriptedFlaps(apps: Record<string, FakeMachine[] | "boom">): { http: FlyHttp; log: string[] } {
+  const log: string[] = [];
+  const http: FlyHttp = async (method, url) => {
+    log.push(`${method} ${url}`);
+    if (method === "GET" && /\/v1\/apps(\?[^/]*)?$/.test(url)) {
+      return { status: 200, text: JSON.stringify({ apps: Object.keys(apps).map((name) => ({ name })) }) };
+    }
+    if (/\/machines\/[^/]+\/lease$/.test(url)) {
+      return { status: 200, text: JSON.stringify({ status: "success", data: { nonce: "N" } }) };
+    }
+    if (method === "GET" && /\/machines\/[^/]+\/wait\?/.test(url)) {
+      return { status: 200, text: JSON.stringify({ ok: true }) };
+    }
+    let m = url.match(/\/v1\/apps\/([^/?]+)\/machines\/([^/?]+)$/);
+    if (m && method === "DELETE") {
+      const held = apps[m[1]];
+      if (Array.isArray(held)) apps[m[1]] = held.filter((mm) => mm.id !== m![2]);
+      return { status: 200, text: "{}" };
+    }
+    m = url.match(/\/v1\/apps\/([^/?]+)\/machines$/);
+    if (m && method === "GET") {
+      const held = apps[m[1]];
+      if (held === "boom") return { status: 500, text: "machine list exploded" };
+      if (held === undefined) return { status: 404, text: "no such app" };
+      return { status: 200, text: JSON.stringify(held) };
+    }
+    m = url.match(/\/v1\/apps\/([^/?]+)$/);
+    if (m && method === "DELETE") {
+      if (apps[m[1]] === undefined) return { status: 404, text: "gone" };
+      delete apps[m[1]];
+      return { status: 200, text: "{}" };
+    }
+    return { status: 500, text: `unscripted: ${method} ${url}` };
+  };
+  return { http, log };
+}
+
+describe("teardownOwned — marker machines + the app boundary (#743)", () => {
+  test("machines carrying this stack+env are candidates; an all-matching app is one too", async () => {
+    const { http } = scriptedFlaps({
+      mine: [machine("web", MINE), machine("worker", MINE)],
+      mixed: [machine("ok", MINE), machine("foreign", { role: "db" })],
+    });
+    const enumeration = await teardownOwned({ environment: "dev", marker: MARKER }, { http, endpoint: ENDPOINT });
+
+    expect(enumeration.candidates.map((c) => `${c.type === "Fly::Machines::App" ? "app" : "machine"}:${c.name}`).sort()).toEqual([
+      "app:mine",
+      "machine:mine/web",
+      "machine:mine/worker",
+      "machine:mixed/ok",
+    ]);
+    for (const candidate of enumeration.candidates) {
+      expect(candidate.marker).toEqual(MARKER);
+    }
+    const web = enumeration.candidates.find((c) => c.name === "mine/web")!;
+    expect(web.physicalId).toBe("m-web");
+    expect(enumeration.holes ?? []).toEqual([]);
+  });
+
+  test("another env's and another stack's machines are never candidates", async () => {
+    const { http } = scriptedFlaps({
+      mine: [machine("web", MINE), machine("prod-twin", OTHER_ENV), machine("their", OTHER_STACK)],
+    });
+    const enumeration = await teardownOwned({ environment: "dev", marker: MARKER }, { http, endpoint: ENDPOINT });
+    // Only the matching machine — and no whole-app candidate, because the app
+    // hosts machines outside the requested identity.
+    expect(enumeration.candidates.map((c) => c.name)).toEqual(["mine/web"]);
+  });
+
+  test("terminal machines are ignored, and do not block the app boundary", async () => {
+    const { http } = scriptedFlaps({
+      mine: [machine("web", MINE), machine("old", { role: "db" }, { state: "destroyed" })],
+    });
+    const enumeration = await teardownOwned({ environment: "dev", marker: MARKER }, { http, endpoint: ENDPOINT });
+    expect(enumeration.candidates.map((c) => c.name).sort()).toEqual(["mine", "mine/web"]);
+  });
+
+  test("an app whose machine list fails is a hole, and the others still enumerate (#1089)", async () => {
+    const { http } = scriptedFlaps({
+      broken: "boom",
+      mine: [machine("web", MINE)],
+    });
+    const enumeration = await teardownOwned({ environment: "dev", marker: MARKER }, { http, endpoint: ENDPOINT });
+    expect(enumeration.candidates.map((c) => c.name).sort()).toEqual(["mine", "mine/web"]);
+    expect(enumeration.holes).toHaveLength(1);
+    expect(enumeration.holes![0].name).toBe("broken");
+    expect(enumeration.holes![0].reason).toBe("read-failed");
+  });
+
+  test("FLY_ORG is passed as org_slug on the app list (real flaps requires it)", async () => {
+    process.env.FLY_ORG = "acme";
+    const { http, log } = scriptedFlaps({});
+    await teardownOwned({ environment: "dev", marker: MARKER }, { http, endpoint: ENDPOINT });
+    expect(log[0]).toBe(`GET ${ENDPOINT}/v1/apps?org_slug=acme`);
+  });
+});
+
+describe("executeTeardown — machines first, apps last", () => {
+  test("destroys the machines (lease → destroy → wait), then deletes the app", async () => {
+    const state: Record<string, FakeMachine[] | "boom"> = {
+      mine: [machine("web", MINE), machine("worker", MINE)],
+    };
+    const { http, log } = scriptedFlaps(state);
+    const execution = await executeTeardown(
+      {
+        environment: "dev",
+        marker: MARKER,
+        candidates: [
+          { name: "mine", type: "Fly::Machines::App", marker: MARKER },
+          { name: "mine/web", type: "Fly::Machines::Machine", physicalId: "m-web", marker: MARKER },
+          { name: "mine/worker", type: "Fly::Machines::Machine", physicalId: "m-worker", marker: MARKER },
+        ],
+      },
+      { http, endpoint: ENDPOINT, wait: NO_WAIT },
+    );
+
+    expect(execution.outcomes.map((o) => ({ name: o.name, outcome: o.outcome }))).toEqual([
+      { name: "mine/web", outcome: "deleted" },
+      { name: "mine/worker", outcome: "deleted" },
+      { name: "mine", outcome: "deleted" },
+    ]);
+    const deletes = log.filter((l) => l.startsWith("DELETE") && !l.endsWith("/lease"));
+    expect(deletes).toEqual([
+      `DELETE ${ENDPOINT}/v1/apps/mine/machines/m-web`,
+      `DELETE ${ENDPOINT}/v1/apps/mine/machines/m-worker`,
+      `DELETE ${ENDPOINT}/v1/apps/mine`,
+    ]);
+    expect(state.mine).toBeUndefined();
+  });
+
+  test("an app hosting a machine outside the requested identity is never deleted whole", async () => {
+    const { http, log } = scriptedFlaps({
+      mine: [machine("foreign", { role: "db" })],
+    });
+    const execution = await executeTeardown(
+      {
+        environment: "dev",
+        marker: MARKER,
+        candidates: [{ name: "mine", type: "Fly::Machines::App", marker: MARKER }],
+      },
+      { http, endpoint: ENDPOINT, wait: NO_WAIT },
+    );
+    expect(execution.outcomes[0].outcome).toBe("not-prunable");
+    expect(execution.outcomes[0].detail).toContain("outside the requested identity");
+    expect(log.filter((l) => l.startsWith("DELETE"))).toEqual([]);
+  });
+
+  test("an already-absent machine and an already-absent app are deleted (idempotent)", async () => {
+    const { http } = scriptedFlaps({ mine: [] });
+    const execution = await executeTeardown(
+      {
+        environment: "dev",
+        marker: MARKER,
+        candidates: [
+          { name: "mine/web", type: "Fly::Machines::Machine", physicalId: "m-web", marker: MARKER },
+          { name: "gone-app", type: "Fly::Machines::App", marker: MARKER },
+        ],
+      },
+      { http, endpoint: ENDPOINT, wait: NO_WAIT },
+    );
+    expect(execution.outcomes.map((o) => ({ name: o.name, outcome: o.outcome, detail: o.detail }))).toEqual([
+      { name: "mine/web", outcome: "deleted", detail: "already absent" },
+      { name: "gone-app", outcome: "deleted", detail: "already absent" },
+    ]);
+  });
+
+  test("a machine re-stamped since planning is not-prunable, never destroyed", async () => {
+    const { http, log } = scriptedFlaps({
+      mine: [machine("web", OTHER_STACK)],
+    });
+    const execution = await executeTeardown(
+      {
+        environment: "dev",
+        marker: MARKER,
+        candidates: [{ name: "mine/web", type: "Fly::Machines::Machine", physicalId: "m-web", marker: MARKER }],
+      },
+      { http, endpoint: ENDPOINT, wait: NO_WAIT },
+    );
+    expect(execution.outcomes[0].outcome).toBe("not-prunable");
+    expect(log.filter((l) => l.startsWith("DELETE"))).toEqual([]);
+  });
+
+  test("a refused delete is a failed outcome carrying the server's message", async () => {
+    const inner = scriptedFlaps({ mine: [machine("web", MINE)] });
+    const http: FlyHttp = async (method, url, body, headers, signal) => {
+      if (method === "DELETE" && /\/machines\/m-web$/.test(url)) {
+        return { status: 500, text: "flaps had a bad day" };
+      }
+      return inner.http(method, url, body, headers, signal);
+    };
+    const execution = await executeTeardown(
+      {
+        environment: "dev",
+        marker: MARKER,
+        candidates: [{ name: "mine/web", type: "Fly::Machines::Machine", physicalId: "m-web", marker: MARKER }],
+      },
+      { http, endpoint: ENDPOINT, wait: NO_WAIT },
+    );
+    expect(execution.outcomes[0].outcome).toBe("failed");
+    expect(execution.outcomes[0].detail).toContain("flaps had a bad day");
+  });
+});

package/src/teardown.ts

@@ -0,0 +1,263 @@
+/**
+ * Env teardown for the fly lexicon (chant #1222) — both halves of the
+ * `teardownOwned` / `executeTeardown` capability pair, over the applier's own
+ * flaps primitives (op/activities/fly-apply.ts).
+ *
+ * Selection follows the two-tier ownership convention (#743, D2):
+ *
+ *   - Machines carry the primary marker in `config.metadata`
+ *     (`managed-by: chant` + `chant-stack` + `chant-env`), so a machine is a
+ *     candidate exactly when its own metadata reads back the requested
+ *     stack + env identity.
+ *   - The app is the boundary for everything metadata-less (volumes, IPs,
+ *     certificates, secrets). An app becomes a candidate only when it has at
+ *     least one machine and EVERY machine in it carries the requested
+ *     identity — an app also hosting a foreign or other-env machine is never
+ *     deleted whole; only its matching machines are.
+ *
+ * Enumeration lists apps via `GET /v1/apps` (mudflaps serves it as-is; real
+ * flaps wants `?org_slug=`, appended from FLY_ORG / FLY_ORG_SLUG when set)
+ * and each app's machines. An unlistable app is a hole (#1089) — unknown,
+ * never absent.
+ *
+ * Execution deletes machines first (lease → destroy → wait, the applier's
+ * `destroyMachine`) and apps last (`deleteApp`, which takes the app-scoped
+ * volumes/IPs/certs with it). Before every delete the live side is re-read
+ * and the identity re-verified; already-gone is `deleted` (teardown is
+ * idempotent), an identity mismatch is `not-prunable`, never a delete.
+ */
+
+import type {
+  TeardownCandidate,
+  TeardownEnumeration,
+  TeardownExecution,
+  TeardownHole,
+  TeardownOutcome,
+} from "@intentius/chant/lexicon";
+import { readOwnership, type OwnershipMarker } from "@intentius/chant/ownership";
+import { FLY_METADATA_OWNERSHIP_KEYS } from "./ownership";
+import {
+  resolveEndpoint,
+  defaultFlyHttp,
+  listMachines,
+  destroyMachine,
+  deleteApp,
+  type ApplyCtx,
+  type FlapsMachine,
+  type FlyHttp,
+  type WaitOpts,
+} from "./op/activities/fly-apply";
+
+const APP_TYPE = "Fly::Machines::App";
+const MACHINE_TYPE = "Fly::Machines::Machine";
+
+/** Live machine states that mean the machine is gone or on its way out. */
+const TERMINAL_STATES = new Set(["destroyed", "destroying"]);
+
+export interface FlyTeardownOptions {
+  environment: string;
+  marker: OwnershipMarker;
+}
+
+/** Injection seam for tests: scripted http, explicit endpoint, shrunk waits. */
+export interface FlyTeardownDeps {
+  http?: FlyHttp;
+  endpoint?: string;
+  wait?: WaitOpts;
+}
+
+/** True when a machine's own metadata reads back exactly the requested identity. */
+function matchesMarker(machine: FlapsMachine, marker: OwnershipMarker): boolean {
+  const read = readOwnership(machine.config?.metadata, FLY_METADATA_OWNERSHIP_KEYS);
+  return read !== undefined && read.stack === marker.stack && read.env === marker.env;
+}
+
+/** Machines that are actually live — terminal ones are already gone. */
+function liveMachines(machines: FlapsMachine[]): FlapsMachine[] {
+  return machines.filter((m) => !TERMINAL_STATES.has(m.state));
+}
+
+/** `GET /v1/apps`, with `?org_slug=` appended when the env names an org. */
+async function listApps(
+  ctx: ApplyCtx,
+  http: FlyHttp,
+  signal?: AbortSignal,
+): Promise<string[]> {
+  const org = process.env.FLY_ORG || process.env.FLY_ORG_SLUG;
+  const url = `${ctx.base}/v1/apps${org ? `?org_slug=${encodeURIComponent(org)}` : ""}`;
+  const res = await http("GET", url, undefined, undefined, signal);
+  if (res.status >= 300) throw new Error(`app list failed (${res.status}): ${res.text}`);
+  const body = JSON.parse(res.text) as { apps?: Array<{ name?: string }> };
+  return (body.apps ?? []).map((a) => a.name).filter((n): n is string => typeof n === "string" && n.length > 0);
+}
+
+/**
+ * Enumerate the env's marker-matching machines and whole-app boundaries — the
+ * fly half of `chant lifecycle teardown <env>` planning.
+ */
+export async function teardownOwned(
+  options: FlyTeardownOptions,
+  deps: FlyTeardownDeps = {},
+): Promise<TeardownEnumeration> {
+  const http = deps.http ?? defaultFlyHttp();
+  const ctx: ApplyCtx = { base: resolveEndpoint({ ...(deps.endpoint ? { endpoint: deps.endpoint } : {}) }) };
+
+  const candidates: TeardownCandidate[] = [];
+  const holes: TeardownHole[] = [];
+
+  const apps = await listApps(ctx, http); // a failed app list throws — core turns it into a whole-lexicon hole
+
+  for (const app of apps) {
+    let machines: FlapsMachine[];
+    try {
+      machines = liveMachines(await listMachines(ctx, app, http));
+    } catch (err) {
+      holes.push({
+        name: app,
+        type: APP_TYPE,
+        reason: "read-failed",
+        detail: err instanceof Error ? err.message : String(err),
+      });
+      continue;
+    }
+
+    const matching = machines.filter((m) => matchesMarker(m, options.marker));
+    for (const m of matching) {
+      candidates.push({
+        name: `${app}/${m.name}`,
+        type: MACHINE_TYPE,
+        physicalId: m.id,
+        marker: readOwnership(m.config?.metadata, FLY_METADATA_OWNERSHIP_KEYS)!,
+      });
+    }
+
+    // The app boundary: whole-app delete only when every live machine carries
+    // the requested identity. Its marker is read back off its machines — the
+    // only channel an app has (#743).
+    if (machines.length > 0 && matching.length === machines.length) {
+      candidates.push({
+        name: app,
+        type: APP_TYPE,
+        marker: readOwnership(matching[0].config?.metadata, FLY_METADATA_OWNERSHIP_KEYS)!,
+      });
+    }
+  }
+
+  return { candidates, ...(holes.length > 0 ? { holes } : {}) };
+}
+
+/**
+ * Delete the handed-over candidates: machines first, apps last. One outcome
+ * per candidate, always.
+ */
+export async function executeTeardown(
+  options: FlyTeardownOptions & { candidates: TeardownCandidate[] },
+  deps: FlyTeardownDeps = {},
+): Promise<TeardownExecution> {
+  const http = deps.http ?? defaultFlyHttp();
+  const ctx: ApplyCtx = { base: resolveEndpoint({ ...(deps.endpoint ? { endpoint: deps.endpoint } : {}) }) };
+
+  const outcomes: TeardownOutcome[] = [];
+
+  for (const candidate of options.candidates.filter((c) => c.type === MACHINE_TYPE)) {
+    outcomes.push(await destroyMachineCandidate(ctx, candidate, options.marker, http, deps.wait));
+  }
+  for (const candidate of options.candidates.filter((c) => c.type === APP_TYPE)) {
+    outcomes.push(await deleteAppCandidate(ctx, candidate, options.marker, http));
+  }
+  for (const candidate of options.candidates) {
+    if (candidate.type === MACHINE_TYPE || candidate.type === APP_TYPE) continue;
+    outcomes.push({
+      name: candidate.name,
+      type: candidate.type,
+      outcome: "not-prunable",
+      detail: `fly teardown deletes machines and apps; ${candidate.type} is app-scoped and goes with its app`,
+    });
+  }
+
+  return { outcomes };
+}
+
+async function destroyMachineCandidate(
+  ctx: ApplyCtx,
+  candidate: TeardownCandidate,
+  marker: OwnershipMarker,
+  http: FlyHttp,
+  wait?: WaitOpts,
+): Promise<TeardownOutcome> {
+  const base = {
+    name: candidate.name,
+    type: candidate.type,
+    ...(candidate.physicalId ? { physicalId: candidate.physicalId } : {}),
+  };
+  const slash = candidate.name.indexOf("/");
+  if (slash <= 0) {
+    return { ...base, outcome: "not-prunable", detail: "machine candidate name is not app/machine-shaped" };
+  }
+  const app = candidate.name.slice(0, slash);
+  const machineName = candidate.name.slice(slash + 1);
+
+  let machines: FlapsMachine[];
+  try {
+    machines = await listMachines(ctx, app, http);
+  } catch (err) {
+    return { ...base, outcome: "failed", detail: err instanceof Error ? err.message : String(err) };
+  }
+
+  const live = liveMachines(machines).find((m) =>
+    candidate.physicalId ? m.id === candidate.physicalId : m.name === machineName,
+  );
+  if (!live) {
+    return { ...base, outcome: "deleted", detail: "already absent" };
+  }
+  // Re-verify right before destroying — a delete is not undoable.
+  if (!matchesMarker(live, marker)) {
+    return {
+      ...base,
+      outcome: "not-prunable",
+      detail: "the live machine no longer carries the requested marker identity",
+    };
+  }
+
+  try {
+    await destroyMachine(ctx, app, live.id, http, undefined, wait ?? {});
+  } catch (err) {
+    return { ...base, outcome: "failed", detail: err instanceof Error ? err.message : String(err) };
+  }
+  return { ...base, outcome: "deleted" };
+}
+
+async function deleteAppCandidate(
+  ctx: ApplyCtx,
+  candidate: TeardownCandidate,
+  marker: OwnershipMarker,
+  http: FlyHttp,
+): Promise<TeardownOutcome> {
+  const base = { name: candidate.name, type: candidate.type };
+  const app = candidate.name;
+
+  // The boundary re-check: an app that (still, or again) hosts any machine
+  // outside the requested identity is not deleted whole. Machines this same
+  // execution just destroyed are gone by now — destroyMachine waits.
+  let machines: FlapsMachine[];
+  try {
+    machines = liveMachines(await listMachines(ctx, app, http));
+  } catch (err) {
+    return { ...base, outcome: "failed", detail: err instanceof Error ? err.message : String(err) };
+  }
+  const foreign = machines.filter((m) => !matchesMarker(m, marker));
+  if (foreign.length > 0) {
+    return {
+      ...base,
+      outcome: "not-prunable",
+      detail: `the app hosts ${foreign.length} machine(s) outside the requested identity`,
+    };
+  }
+
+  try {
+    const result = await deleteApp(ctx, app, http);
+    return result.deleted ? { ...base, outcome: "deleted" } : { ...base, outcome: "deleted", detail: "already absent" };
+  } catch (err) {
+    return { ...base, outcome: "failed", detail: err instanceof Error ? err.message : String(err) };
+  }
+}