@mriekki/project-forge 4.10.3 → 4.10.5

package/assets/components.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "package": "@mriekki/project-forge",
-  "version": "4.10.3",
+  "version": "4.10.5",
   "defaultProfile": "greenfield-project",
   "profiles": {
     "greenfield-project": {
@@ -13,7 +13,7 @@
   },
   "components": {
     "core": {
-      "revision": "8796fd8dc22df8b64078e5b460e1008a8c7a5f7d",
+      "revision": "bd66fc30c233d7efae03a3a029aca6ccf4bd7991",
       "version": "4.0.0",
       "distribution": "greenfield-workspace",
       "descriptor": "assets/core/distribution.json",
@@ -21,7 +21,7 @@
       "canonicalDescriptor": "distributions/greenfield-workspace.json"
     },
     "deployment": {
-      "revision": "75c272db383f1803383e8cd4ad4511537c175abe",
+      "revision": "8df115fe5c27fcf6647d7e87258166616e8e2e53",
       "distribution": "greenfield-project",
       "descriptor": "assets/deployment/distribution.json",
       "sourceRoot": "assets/generated/deployment",

package/assets/generated/ASSEMBLY.json

@@ -1,10 +1,10 @@
 {
   "schemaVersion": 2,
   "package": "@mriekki/project-forge",
-  "version": "4.10.3",
+  "version": "4.10.5",
   "components": {
     "core": {
-      "revision": "8796fd8dc22df8b64078e5b460e1008a8c7a5f7d",
+      "revision": "bd66fc30c233d7efae03a3a029aca6ccf4bd7991",
       "version": "4.0.0",
       "distribution": "greenfield-workspace",
       "files": [
@@ -51,7 +51,7 @@
         {
           "source": "core/skills/setup/SKILL.md",
           "destination": ".github/skills/setup/SKILL.md",
-          "sha256": "27419e0d330abf2b6b03a696eba352ab2ece13a616c41fc0ade9aed85e8834f1"
+          "sha256": "9b3dee1d965f1999490d0e3c58925c341ac5f3f5b228ccfe6a0ac53d64b19a64"
         },
         {
           "source": "core/skills/build/SKILL.md",
@@ -326,7 +326,7 @@
       ]
     },
     "deployment": {
-      "revision": "75c272db383f1803383e8cd4ad4511537c175abe",
+      "revision": "8df115fe5c27fcf6647d7e87258166616e8e2e53",
       "distribution": "greenfield-project",
       "files": [
         {
@@ -402,17 +402,17 @@
         {
           "source": "src/project_forge_deployment/cloudflare_ingress.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/cloudflare_ingress.py",
-          "sha256": "ca2c80e0b64792f550a08fc51994bdfdac42644c35f23cdf7ae5c50b468109f8"
+          "sha256": "f462bcc1cb9d1fd20a93cf7fa6ea00402df0be69507308ffbd7e2af0d0f2900f"
         },
         {
           "source": "src/project_forge_deployment/cloudflare_ingress_remote.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/cloudflare_ingress_remote.py",
-          "sha256": "35ac39b4f4538d4ff23f68982cc4b176782378cf03539fa51a228becbdfcf4d0"
+          "sha256": "6f92ec8b50baeb6894f096935450f3cf1f86abf5313a681ee3c5bca2283ddc99"
         },
         {
           "source": "src/project_forge_deployment/cloudflare_route_apply.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/cloudflare_route_apply.py",
-          "sha256": "d3fe77a2f61ae281308ad1046ee1e6e5ea460f3605c5cd275cc16cff3e9bb568"
+          "sha256": "ddcc5caf9006402b77c57eb77d9777f4e5b7c7a5c5847770f5963b29935c8984"
         },
         {
           "source": "src/project_forge_deployment/cli.py",
@@ -452,7 +452,7 @@
         {
           "source": "src/project_forge_deployment/errors.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/errors.py",
-          "sha256": "0bc20b1b739f999960422b7bd05249f4179f3612910ecbb6cf2805b5f4babd61"
+          "sha256": "e92719788aa163890f5970b2f7e3282bf5690c2340d0abba6a9a14e9b935ddfd"
         },
         {
           "source": "src/project_forge_deployment/home_lab.py",
@@ -467,7 +467,7 @@
         {
           "source": "src/project_forge_deployment/ingress_cli.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/ingress_cli.py",
-          "sha256": "0e4088a17734f560c750528942fbd34d2464bcdd06d60467a9dc684a73fc18e1"
+          "sha256": "59ff40843573da74dc430b517130f300b3eb2f2e4f00de0eb6dab5f9efb27692"
         },
         {
           "source": "src/project_forge_deployment/keys.py",
@@ -577,7 +577,7 @@
         {
           "source": "src/project_forge_deployment/teardown.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/teardown.py",
-          "sha256": "0c75bb1ec77218d1b6ee3f54a626556ee46f2de8e91d1e9afa87200bce39254e"
+          "sha256": "4c4516c06f8b8aa13c125fc06e47633197c50f0301fb20d0005d79952a8e92d6"
         },
         {
           "source": "src/project_forge_deployment/teardown_cli.py",
@@ -602,7 +602,7 @@
         {
           "source": "docs/CLOUDFLARE_INGRESS.md",
           "destination": "docs/project-forge/CLOUDFLARE_INGRESS.md",
-          "sha256": "e0d95aa8e1c204390a51a7900ef60542537c1a9d2eeb017f34920e8dcb5e8329"
+          "sha256": "603cf5e732439efdb4f628a16555eba1226db9ef0a665872fd0341c85f9050ee"
         },
         {
           "source": "docs/DEVELOPER_ENVIRONMENTS.md",

package/assets/generated/core/core/skills/setup/SKILL.md

@@ -214,6 +214,28 @@ Rules:
 - the recorded setup scope comes from the developer's actual selections;
 - later environment changes belong in mutable project topology, not casual rewrites of Bootstrap provenance.
 
+### Builder-owned target namespace
+
+Treat reusable remote target definitions as Builder-owned personal state. The Project owns logical environment roles and a logical `targetProfile` binding; it does not own another Builder's physical machine, SSH identity, trust, current address, or readiness.
+
+The same logical target name may resolve to a different physical machine for another developer. For example, Project topology may bind `Production -> production`; each Builder may define their own personal `production` target with their own hostname, SSH account, identity, and trust. Do not treat another Builder's target profile, hostname, SSH identity/trust, address, or readiness as authoritative for this workstation.
+
+When an already-bound remote environment references `<target>` but this Builder's personal/local profile has no such target, do not describe the Project as broken and do not ask the Builder to gain access to another person's box. Surface the condition explicitly:
+
+```text
+<ENVIRONMENT> TARGET NOT CONFIGURED FOR THIS BUILDER
+
+This Project binds <environment> to logical target <target>, but this
+Builder has not defined that target in their personal Project Forge profile.
+
+CHOICES
+Define my target `<target>` [RECOMMENDED]
+Sync/import my personal target `<target>` if I already defined it elsewhere
+Keep `<environment>` unavailable on this Builder
+```
+
+`Define my target` uses the supported personal target-profile flow and preserves the Project's existing logical `targetProfile` name. Do not silently substitute a differently named personal target merely because it is reachable; selecting a different logical target is a Project topology rebind and requires its separate explicit decision. Production-class configuration/access remains distinct from Production proof and application-deployment authorization.
+
 ### Define another environment
 
 For `Other / define another environment`, collect only material durable facts, normally:
@@ -482,4 +504,4 @@ Useful next actions include:
 - `/deploy <environment>` — only after readiness and its own authorization contract;
 - `/tear-down <scope>` — destructive cleanup under its separate gate.
 
-Do not create a second top-level developer-environment-mode workflow. Local/remote workstation convergence belongs here.
+Do not create a second top-level developer-environment-mode workflow. Local/remote workstation convergence belongs here.

package/assets/generated/deployment/docs/CLOUDFLARE_INGRESS.md

@@ -141,6 +141,19 @@ Registration requires:
 [PUBLIC INGRESS ROUTE WRITE]
 ```
 
+Route registration, removal, and post-write recovery hold the target's shared
+per-scope lock across preflight and provider writes. This serializes Project
+Forge route operations using the same target and prevents one operation's
+whole-tunnel configuration rollback from replacing another concurrent managed
+route change. Recovery also rechecks the reviewed host binding before reading
+or changing provider state; if that binding changed or ownership is uncertain,
+it stops and reports the state for inspection instead of attempting rollback.
+
+The target lock coordinates Deployment Kit operations; it is not a Cloudflare
+API compare-and-swap and cannot serialize manual or external dashboard/API
+edits. Such drift is checked against the reviewed configuration and recovery
+fails closed rather than restoring over an unrecognized configuration.
+
 Remove:
 
 ```text

package/assets/generated/deployment/src/project_forge_deployment/cloudflare_ingress.py

@@ -14,15 +14,17 @@ import json
 import re
 import shlex
 import subprocess
+import tempfile
 import urllib.parse
+from contextlib import contextmanager
 from copy import deepcopy
-from typing import Any
+from typing import Any, Iterator
 
 from . import cloudflare_api
 from .box_platform import platform_status
 from .box_platform_assets import CADDY_CONTAINER, NETWORK_NAME, PLATFORM_ROOT
 from .cloudflare_ingress_remote import REMOTE_SCRIPT
-from .errors import DeploymentKitError
+from .errors import CloudflarePostWriteVerificationError, DeploymentKitError
 from .profiles import load_profile
 from .route_registry import route_inventory
 from .ssh import ssh_args, verify_access
@@ -38,10 +40,6 @@ PUBLIC_INGRESS_ROUTE_REMOVE_PHRASE = "[PUBLIC INGRESS ROUTE REMOVE]"
 CLOUDFLARE_API_TOKEN_ENV = "PROJECT_FORGE_CLOUDFLARE_API_TOKEN"
 
 
-class CloudflarePostWriteVerificationError(DeploymentKitError):
-    """Final public-route verification failed after mutations completed."""
-
-
 _SLUG_RE = re.compile(r"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$")
 _REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
 _LABEL_RE = re.compile(r"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$")
@@ -202,14 +200,17 @@ def _run_remote(
     expected: dict[str, Any] | None = None,
     tunnel_token: str | None = None,
 ) -> str:
-    if action not in {"status", "install", "upgrade", "route-inventory", "route-register", "route-remove"}:
+    if action not in {
+        "status", "install", "upgrade", "route-inventory",
+        "route-register", "route-remove", "route-register-locked", "route-remove-locked",
+    }:
         raise DeploymentKitError(f"Unsupported Cloudflare ingress action: {action}")
     args = [action, _slug(scope, "scope")]
     args.append(_metadata_tsv(metadata) if metadata is not None else "")
     args.append(_route_tsv(spec) if spec is not None else "")
-    if action == "route-register":
+    if action in {"route-register", "route-register-locked"}:
         args.append(_route_tsv(expected) if expected is not None else "NONE")
-    elif action == "route-remove":
+    elif action in {"route-remove", "route-remove-locked"}:
         args.append("")
     remote_command = "sudo -n bash -s -- " + " ".join(shlex.quote(item) for item in args)
     completed = subprocess.run(
@@ -226,6 +227,97 @@ def _run_remote(
     return stdout
 
 
+@contextmanager
+def route_transaction_lock(name: str, scope: str) -> Iterator[None]:
+    """Serialize route mutations and recovery through the target's shared-scope lock."""
+    scope = _slug(scope, "scope")
+    profile = load_profile(name)
+    access = verify_access(profile)
+    remote_command = "sudo -n bash -s -- " + " ".join(
+        shlex.quote(item) for item in ("route-lock", scope, "", "", "")
+    )
+    args = ssh_args(profile, access["address"], command=remote_command)
+    args[1:1] = ["-o", "ServerAliveInterval=5", "-o", "ServerAliveCountMax=2"]
+
+    with tempfile.TemporaryFile() as stderr_file:
+        try:
+            process = subprocess.Popen(
+                args,
+                stdin=subprocess.PIPE,
+                stdout=subprocess.PIPE,
+                stderr=stderr_file,
+            )
+        except OSError as error:
+            raise DeploymentKitError(f"Could not start the Cloudflare route transaction lock: {error}") from error
+        if process.stdin is None or process.stdout is None:
+            process.kill()
+            process.wait()
+            raise DeploymentKitError("Could not establish the Cloudflare route transaction lock pipes.")
+        try:
+            process.stdin.write(build_remote_script().encode("utf-8"))
+            process.stdin.flush()
+            ready = process.stdout.readline()
+        except OSError as error:
+            try:
+                process.stdin.close()
+            except OSError:
+                pass
+            try:
+                process.wait(timeout=20)
+            except subprocess.TimeoutExpired:
+                process.kill()
+                process.wait()
+            raise DeploymentKitError(f"Could not establish the Cloudflare route transaction lock: {error}") from error
+        if ready != b"LOCKED\n":
+            try:
+                process.stdin.close()
+            except OSError:
+                pass
+            try:
+                return_code = process.wait(timeout=20)
+            except subprocess.TimeoutExpired:
+                process.kill()
+                return_code = process.wait()
+            stderr_file.seek(0)
+            detail = stderr_file.read().decode("utf-8", errors="replace").strip()
+            if not detail:
+                detail = f"remote lock exited with status {return_code}"
+            raise DeploymentKitError(f"Could not acquire the Cloudflare route transaction lock: {detail}")
+
+        body_failed = False
+        try:
+            yield
+        except BaseException:
+            body_failed = True
+            raise
+        finally:
+            release_error: OSError | None = None
+            try:
+                process.stdin.close()
+            except OSError as error:
+                release_error = error
+            timed_out = False
+            try:
+                return_code = process.wait(timeout=20)
+            except subprocess.TimeoutExpired:
+                process.kill()
+                process.wait()
+                timed_out = True
+            if not body_failed and timed_out:
+                raise DeploymentKitError("Cloudflare route transaction lock did not release cleanly.")
+            if not body_failed and release_error is not None:
+                raise DeploymentKitError(
+                    f"Could not release the Cloudflare route transaction lock: {release_error}"
+                ) from release_error
+            if return_code != 0 and not body_failed:
+                stderr_file.seek(0)
+                detail = stderr_file.read().decode("utf-8", errors="replace").strip()
+                raise DeploymentKitError(
+                    "Cloudflare route transaction lock exited unsuccessfully"
+                    + (f": {detail}" if detail else f" (status {return_code}).")
+                )
+
+
 def cloudflare_ingress_status(name: str, scope: str) -> dict[str, Any]:
     scope = _slug(scope, "scope")
     profile = load_profile(name)
@@ -261,6 +353,53 @@ def _config_snapshot(config: dict[str, Any]) -> str:
     return hashlib.sha256(json.dumps(config, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
 
 
+def _reviewed_config_matches(actual: Any, reviewed: Any) -> bool:
+    if not isinstance(actual, dict) or not isinstance(reviewed, dict):
+        return False
+    normalized = deepcopy(actual)
+    if "warp-routing" not in reviewed and normalized.get("warp-routing") == {"enabled": False}:
+        normalized.pop("warp-routing")
+    return normalized == reviewed
+
+
+def _restore_tunnel_configuration_if_unchanged(
+    api_token: str,
+    host: dict[str, Any],
+    *,
+    expected_current: dict[str, Any],
+    previous: dict[str, Any],
+) -> None:
+    current = cloudflare_api.get_tunnel_configuration(
+        api_token, host["accountId"], host["tunnelId"]
+    )
+    if _reviewed_config_matches(current, previous):
+        return
+    if not _reviewed_config_matches(current, expected_current):
+        raise DeploymentKitError(
+            "Tunnel configuration rollback was skipped because current provider state changed "
+            "after this operation; concurrent changes were preserved."
+        )
+    try:
+        cloudflare_api.update_tunnel_configuration(
+            api_token, host["accountId"], host["tunnelId"], previous
+        )
+    except Exception as write_error:
+        try:
+            restored = cloudflare_api.get_tunnel_configuration(
+                api_token, host["accountId"], host["tunnelId"]
+            )
+        except Exception as read_error:
+            raise DeploymentKitError(
+                "Tunnel configuration rollback response was uncertain and current state could "
+                f"not be verified: {read_error}"
+            ) from write_error
+        if not _reviewed_config_matches(restored, previous):
+            raise DeploymentKitError(
+                "Tunnel configuration rollback failed and current state does not match the "
+                f"previous configuration: {write_error}"
+            ) from write_error
+
+
 def _tunnel_summary(tunnel: dict[str, Any] | None) -> dict[str, Any] | None:
     if tunnel is None:
         return None
@@ -564,6 +703,67 @@ def _exact_dns_record(records: list[dict[str, Any]], *, spec: dict[str, Any], tu
     return record
 
 
+def _read_public_route_dns(
+    api_token: str,
+    host: dict[str, Any],
+    spec: dict[str, Any],
+) -> dict[str, Any] | None:
+    records = cloudflare_api.list_dns_records(
+        api_token, host["zoneId"], name=spec["publicHostname"]
+    )
+    return _exact_dns_record(records, spec=spec, tunnel_id=host["tunnelId"])
+
+
+def _reconcile_public_route_dns(
+    api_token: str,
+    host: dict[str, Any],
+    spec: dict[str, Any],
+    *,
+    should_exist: bool,
+) -> None:
+    current = _read_public_route_dns(api_token, host, spec)
+    if should_exist:
+        if current is not None:
+            return
+        try:
+            cloudflare_api.create_dns_cname(
+                api_token,
+                host["zoneId"],
+                name=spec["publicHostname"],
+                content=f"{host['tunnelId']}.cfargotunnel.com",
+                comment=_dns_marker(spec),
+            )
+        except Exception as write_error:
+            try:
+                created = _read_public_route_dns(api_token, host, spec)
+            except Exception as read_error:
+                raise DeploymentKitError(
+                    "DNS restoration response was uncertain and current state could not be "
+                    f"verified: {read_error}"
+                ) from write_error
+            if created is None:
+                raise
+        return
+
+    if current is None:
+        return
+    try:
+        cloudflare_api.delete_dns_record(api_token, host["zoneId"], str(current["id"]))
+    except Exception as write_error:
+        try:
+            remaining = _read_public_route_dns(api_token, host, spec)
+        except Exception as read_error:
+            raise DeploymentKitError(
+                "DNS cleanup response was uncertain and current state could not be "
+                f"verified: {read_error}"
+            ) from write_error
+        if remaining is not None:
+            raise
+        return
+    if _read_public_route_dns(api_token, host, spec) is not None:
+        raise DeploymentKitError("Owned Cloudflare DNS record remained after cleanup.")
+
+
 def plan_public_route(
     name: str,
     *,
@@ -627,7 +827,12 @@ def plan_public_route(
     }
 
 
-def apply_public_route(plan: dict[str, Any], *, api_token: str) -> dict[str, Any]:
+def apply_public_route(
+    plan: dict[str, Any],
+    *,
+    api_token: str,
+    _lock_held: bool = False,
+) -> dict[str, Any]:
     if plan.get("action") == "already-configured":
         return {**plan, "mutated": False}
     required = {
@@ -637,6 +842,9 @@ def apply_public_route(plan: dict[str, Any], *, api_token: str) -> dict[str, Any
     }
     if not isinstance(plan, dict) or set(plan) != required or plan["action"] != "register":
         raise DeploymentKitError("Malformed Cloudflare public-route plan.")
+    if not _lock_held:
+        with route_transaction_lock(plan["targetName"], plan["scope"]):
+            return apply_public_route(plan, api_token=api_token, _lock_held=True)
     name = plan["targetName"]
     scope = plan["scope"]
     spec = plan["route"]
@@ -658,77 +866,100 @@ def apply_public_route(plan: dict[str, Any], *, api_token: str) -> dict[str, Any
     profile = load_profile(name)
     access = verify_access(profile)
     host_written = False
-    config_written = False
-    dns_created: dict[str, Any] | None = None
+    config_write_attempted = False
+    dns_create_attempted = False
     try:
         _run_remote(
             profile,
             access["address"],
-            "route-register",
+            "route-register-locked",
             scope=scope,
             spec=spec,
             expected=plan["previousRoute"],
         )
         host_written = True
         if plan["desiredTunnelConfig"] != plan["tunnelConfig"]:
+            config_write_attempted = True
             cloudflare_api.update_tunnel_configuration(
                 api_token, host["accountId"], host["tunnelId"], plan["desiredTunnelConfig"]
             )
-            config_written = True
         if current_dns is None:
-            dns_created = cloudflare_api.create_dns_cname(
+            dns_create_attempted = True
+            cloudflare_api.create_dns_cname(
                 api_token,
                 host["zoneId"],
                 name=spec["publicHostname"],
                 content=f"{host['tunnelId']}.cfargotunnel.com",
                 comment=plan["dnsMarker"],
             )
-    except Exception:
-        if dns_created is not None:
+    except Exception as original_error:
+        rollback_errors: list[str] = []
+        if dns_create_attempted:
             try:
-                cloudflare_api.delete_dns_record(api_token, host["zoneId"], str(dns_created["id"]))
-            except Exception:
-                pass
-        if config_written:
+                _reconcile_public_route_dns(api_token, host, spec, should_exist=False)
+            except Exception as error:
+                rollback_errors.append(f"DNS rollback failed: {error}")
+        if config_write_attempted:
             try:
-                cloudflare_api.update_tunnel_configuration(
-                    api_token, host["accountId"], host["tunnelId"], plan["tunnelConfig"]
+                _restore_tunnel_configuration_if_unchanged(
+                    api_token,
+                    host,
+                    expected_current=plan["desiredTunnelConfig"],
+                    previous=plan["tunnelConfig"],
                 )
-            except Exception:
-                pass
+            except Exception as error:
+                rollback_errors.append(str(error))
         if host_written and plan["previousRoute"] is None:
             try:
-                _run_remote(profile, access["address"], "route-remove", scope=scope, spec=spec)
-            except Exception:
-                pass
+                _run_remote(profile, access["address"], "route-remove-locked", scope=scope, spec=spec)
+            except Exception as error:
+                rollback_errors.append(f"Host route rollback failed: {error}")
+        if rollback_errors:
+            raise DeploymentKitError(
+                "Cloudflare public-route apply failed and rollback was incomplete; external state "
+                "may remain changed. " + "; ".join(rollback_errors)
+            ) from original_error
         raise
 
     try:
+        final_host = cloudflare_ingress_status(name, scope)
+        if _status_snapshot(final_host) != plan["hostStatusSnapshot"]:
+            raise CloudflarePostWriteVerificationError(
+                "Cloudflare host binding changed during public-route apply."
+            )
         final_inventory = cloudflare_route_inventory(name, scope)
         if _find_route(final_inventory, spec["routeId"]) != spec:
-            raise DeploymentKitError("Public route registration returned without exact host ownership metadata.")
+            raise CloudflarePostWriteVerificationError(
+                "Public route registration returned without exact host ownership metadata."
+            )
         final_config = cloudflare_api.get_tunnel_configuration(api_token, host["accountId"], host["tunnelId"])
         if final_config != plan["desiredTunnelConfig"]:
-            raise DeploymentKitError("Cloudflare tunnel configuration does not match the reviewed route plan after apply.")
+            raise CloudflarePostWriteVerificationError(
+                "Cloudflare tunnel configuration does not match the reviewed route plan after apply."
+            )
         final_dns = _exact_dns_record(
             cloudflare_api.list_dns_records(api_token, host["zoneId"], name=spec["publicHostname"]),
             spec=spec,
             tunnel_id=host["tunnelId"],
         )
         if final_dns is None:
-            raise DeploymentKitError("Cloudflare DNS record is missing after public-route apply.")
-        return {
-            "targetName": name,
-            "scope": scope,
-            "route": spec,
-            "dnsRecordId": str(final_dns["id"]),
-            "publicUrl": f"https://{spec['publicHostname']}",
-            "mutated": True,
-        }
+            raise CloudflarePostWriteVerificationError(
+                "Cloudflare DNS record is missing after public-route apply."
+            )
+    except CloudflarePostWriteVerificationError:
+        raise
     except Exception as error:
         raise CloudflarePostWriteVerificationError(
-            f"Cloudflare public-route post-write verification failed: {error}"
+            f"Cloudflare public-route post-write verification could not confirm provider state: {error}"
         ) from error
+    return {
+        "targetName": name,
+        "scope": scope,
+        "route": spec,
+        "dnsRecordId": str(final_dns["id"]),
+        "publicUrl": f"https://{spec['publicHostname']}",
+        "mutated": True,
+    }
 
 
 def plan_public_route_removal(
@@ -780,13 +1011,21 @@ def plan_public_route_removal(
     }
 
 
-def apply_public_route_removal(plan: dict[str, Any], *, api_token: str) -> dict[str, Any]:
+def apply_public_route_removal(
+    plan: dict[str, Any],
+    *,
+    api_token: str,
+    _lock_held: bool = False,
+) -> dict[str, Any]:
     required = {
         "targetName", "scope", "action", "route", "routeInventorySnapshot", "hostStatusSnapshot",
         "tunnelConfig", "tunnelConfigSha256", "desiredTunnelConfig", "dnsRecord", "requiredAuthorization",
     }
     if not isinstance(plan, dict) or set(plan) != required or plan["action"] != "remove":
         raise DeploymentKitError("Malformed Cloudflare public-route removal plan.")
+    if not _lock_held:
+        with route_transaction_lock(plan["targetName"], plan["scope"]):
+            return apply_public_route_removal(plan, api_token=api_token, _lock_held=True)
     name = plan["targetName"]
     scope = plan["scope"]
     route = plan["route"]
@@ -807,35 +1046,90 @@ def apply_public_route_removal(plan: dict[str, Any], *, api_token: str) -> dict[
     if dns is None or str(dns.get("id")) != str(plan["dnsRecord"].get("id")):
         raise DeploymentKitError("Cloudflare DNS record changed after removal planning.")
 
-    cloudflare_api.update_tunnel_configuration(
-        api_token, host["accountId"], host["tunnelId"], plan["desiredTunnelConfig"]
-    )
     try:
-        cloudflare_api.delete_dns_record(api_token, host["zoneId"], str(dns["id"]))
-    except Exception:
         cloudflare_api.update_tunnel_configuration(
-            api_token, host["accountId"], host["tunnelId"], plan["tunnelConfig"]
+            api_token, host["accountId"], host["tunnelId"], plan["desiredTunnelConfig"]
         )
+    except Exception as original_error:
+        try:
+            _restore_tunnel_configuration_if_unchanged(
+                api_token,
+                host,
+                expected_current=plan["desiredTunnelConfig"],
+                previous=plan["tunnelConfig"],
+            )
+        except Exception as rollback_error:
+            raise DeploymentKitError(
+                "Cloudflare public-route removal failed during tunnel update and rollback was "
+                f"incomplete: {rollback_error}"
+            ) from original_error
+        raise
+    try:
+        cloudflare_api.delete_dns_record(api_token, host["zoneId"], str(dns["id"]))
+    except Exception as original_error:
+        rollback_errors: list[str] = []
+        try:
+            _restore_tunnel_configuration_if_unchanged(
+                api_token,
+                host,
+                expected_current=plan["desiredTunnelConfig"],
+                previous=plan["tunnelConfig"],
+            )
+        except Exception as rollback_error:
+            rollback_errors.append(f"Tunnel configuration rollback failed: {rollback_error}")
+        try:
+            _reconcile_public_route_dns(api_token, host, route, should_exist=True)
+        except Exception as rollback_error:
+            rollback_errors.append(f"DNS rollback failed: {rollback_error}")
+        if rollback_errors:
+            raise DeploymentKitError(
+                "Cloudflare public-route removal failed and rollback was incomplete; external "
+                "state may remain changed. " + "; ".join(rollback_errors)
+            ) from original_error
         raise
 
     profile = load_profile(name)
     access = verify_access(profile)
     try:
-        _run_remote(profile, access["address"], "route-remove", scope=scope, spec=route)
-    except Exception:
+        _run_remote(profile, access["address"], "route-remove-locked", scope=scope, spec=route)
+    except Exception as original_error:
+        rollback_errors: list[str] = []
         try:
-            cloudflare_api.update_tunnel_configuration(
-                api_token, host["accountId"], host["tunnelId"], plan["tunnelConfig"]
-            )
-            cloudflare_api.create_dns_cname(
+            _restore_tunnel_configuration_if_unchanged(
                 api_token,
-                host["zoneId"],
-                name=route["publicHostname"],
-                content=f"{host['tunnelId']}.cfargotunnel.com",
-                comment=_dns_marker(route),
+                host,
+                expected_current=plan["desiredTunnelConfig"],
+                previous=plan["tunnelConfig"],
             )
-        except Exception:
-            pass
+        except Exception as error:
+            rollback_errors.append(f"Tunnel configuration rollback failed: {error}")
+        try:
+            _reconcile_public_route_dns(api_token, host, route, should_exist=True)
+        except Exception as error:
+            rollback_errors.append(f"DNS rollback failed: {error}")
+        try:
+            current_inventory = cloudflare_route_inventory(name, scope)
+            current_route = _find_route(current_inventory, route["routeId"])
+            if current_route is None:
+                _run_remote(
+                    profile,
+                    access["address"],
+                    "route-register-locked",
+                    scope=scope,
+                    spec=route,
+                    expected=None,
+                )
+            elif current_route != route:
+                raise DeploymentKitError(
+                    "Host route restoration was skipped because route ownership changed."
+                )
+        except Exception as error:
+            rollback_errors.append(f"Host route rollback failed: {error}")
+        if rollback_errors:
+            raise DeploymentKitError(
+                "Cloudflare public-route removal failed and rollback was incomplete; external "
+                "state may remain changed. " + "; ".join(rollback_errors)
+            ) from original_error
         raise
 
     final = cloudflare_route_inventory(name, scope)

package/assets/generated/deployment/src/project_forge_deployment/cloudflare_ingress_remote.py

@@ -305,6 +305,12 @@ case "$ACTION" in
     status)
         status
         ;;
+    route-lock)
+        exec 9>>"$LOCK_FILE"
+        flock -n 9 || { echo "Another Cloudflare ingress operation holds the lock." >&2; exit 75; }
+        printf 'LOCKED\n'
+        cat >/dev/null
+        ;;
     install|upgrade)
         exec 9>>"$LOCK_FILE"
         flock -n 9 || { echo "Another Cloudflare ingress operation holds the lock." >&2; exit 75; }
@@ -320,6 +326,10 @@ case "$ACTION" in
         if [[ "$ACTION" == route-register ]]; then route_register; else route_remove; fi
         route_inventory
         ;;
+    route-register-locked|route-remove-locked)
+        if [[ "$ACTION" == route-register-locked ]]; then route_register; else route_remove; fi
+        route_inventory
+        ;;
     *)
         echo "Unsupported Cloudflare ingress action: $ACTION" >&2
         exit 2

package/assets/generated/deployment/src/project_forge_deployment/cloudflare_route_apply.py

@@ -8,24 +8,16 @@ all reviewed ingress rules and every other configuration value remain exact.
 
 from __future__ import annotations
 
-from copy import deepcopy
 from typing import Any
 
 from . import cloudflare_api
 from . import cloudflare_ingress as ingress
-from .errors import DeploymentKitError
-from .profiles import load_profile
-from .ssh import verify_access
+from .errors import CloudflarePostWriteVerificationError, DeploymentKitError
 
 
 def _reviewed_config_matches(actual: Any, reviewed: Any) -> bool:
     """Match reviewed config after removing only the observed safe provider default."""
-    if not isinstance(actual, dict) or not isinstance(reviewed, dict):
-        return False
-    normalized = deepcopy(actual)
-    if "warp-routing" not in reviewed and normalized.get("warp-routing") == {"enabled": False}:
-        normalized.pop("warp-routing")
-    return normalized == reviewed
+    return ingress._reviewed_config_matches(actual, reviewed)
 
 
 def _read_final_state(plan: dict[str, Any], *, api_token: str) -> dict[str, Any]:
@@ -33,6 +25,10 @@ def _read_final_state(plan: dict[str, Any], *, api_token: str) -> dict[str, Any]
     scope = plan["scope"]
     spec = plan["route"]
     host = ingress.cloudflare_ingress_status(name, scope)
+    if ingress._status_snapshot(host) != plan["hostStatusSnapshot"]:
+        raise DeploymentKitError(
+            "Cloudflare host binding changed after route apply; recovery was stopped before reading provider state."
+        )
     inventory = ingress.cloudflare_route_inventory(name, scope)
     route = ingress._find_route(inventory, spec["routeId"])
     config = cloudflare_api.get_tunnel_configuration(api_token, host["accountId"], host["tunnelId"])
@@ -67,7 +63,12 @@ def _rollback_final_state(
         dns = state["dns"]
         if dns is not None:
             try:
-                cloudflare_api.delete_dns_record(api_token, host["zoneId"], str(dns["id"]))
+                ingress._reconcile_public_route_dns(
+                    api_token,
+                    host,
+                    spec,
+                    should_exist=False,
+                )
             except Exception as error:  # pragma: no cover - provider failure detail only
                 errors.append(f"DNS rollback failed: {error}")
         elif state["dnsError"] is not None:
@@ -77,11 +78,11 @@ def _rollback_final_state(
         current = state["config"]
         if _reviewed_config_matches(current, plan["desiredTunnelConfig"]):
             try:
-                cloudflare_api.update_tunnel_configuration(
+                ingress._restore_tunnel_configuration_if_unchanged(
                     api_token,
-                    host["accountId"],
-                    host["tunnelId"],
-                    plan["tunnelConfig"],
+                    host,
+                    expected_current=plan["desiredTunnelConfig"],
+                    previous=plan["tunnelConfig"],
                 )
             except Exception as error:  # pragma: no cover - provider failure detail only
                 errors.append(f"tunnel configuration rollback failed: {error}")
@@ -92,12 +93,12 @@ def _rollback_final_state(
 
     if plan["previousRoute"] is None and state["route"] == spec:
         try:
-            profile = load_profile(plan["targetName"])
-            access = verify_access(profile)
+            profile = ingress.load_profile(plan["targetName"])
+            access = ingress.verify_access(profile)
             ingress._run_remote(
                 profile,
                 access["address"],
-                "route-remove",
+                "route-remove-locked",
                 scope=plan["scope"],
                 spec=spec,
             )
@@ -107,20 +108,6 @@ def _rollback_final_state(
     return errors
 
 
-def _uncertain_recovery_error(
-    original_error: Exception,
-    recovery_error: Exception,
-) -> DeploymentKitError:
-    return DeploymentKitError(
-        "Cloudflare public-route final verification failed, and recovery could not read "
-        "the current host/provider state. External state is uncertain and rollback was "
-        "not attempted because current ownership could not be verified safely. "
-        f"Original verification error: {original_error} "
-        f"Recovery read failed: {recovery_error} "
-        "Inspect the managed host route, tunnel configuration, and DNS record before retrying."
-    )
-
-
 def apply_public_route(plan: dict[str, Any], *, api_token: str) -> dict[str, Any]:
     """Apply a reviewed public route with bounded post-write recovery.
 
@@ -129,14 +116,23 @@ def apply_public_route(plan: dict[str, Any], *, api_token: str) -> dict[str, Any
     post-write verification phase, so preflight failures can never be turned
     into success by observing later provider state.
     """
-    try:
+    if (
+        not isinstance(plan, dict)
+        or plan.get("action") != "register"
+        or not {"targetName", "scope"}.issubset(plan)
+    ):
         return ingress.apply_public_route(plan, api_token=api_token)
-    except ingress.CloudflarePostWriteVerificationError as original_error:
-        if not isinstance(plan, dict) or plan.get("action") != "register":
-            raise
+    with ingress.route_transaction_lock(plan["targetName"], plan["scope"]):
+        return _apply_public_route_locked(plan, api_token=api_token)
+
+
+def _apply_public_route_locked(plan: dict[str, Any], *, api_token: str) -> dict[str, Any]:
+    try:
+        return ingress.apply_public_route(plan, api_token=api_token, _lock_held=True)
+    except CloudflarePostWriteVerificationError as original_error:
         required = {
-            "targetName", "scope", "route", "previousRoute", "tunnelConfig",
-            "desiredTunnelConfig", "dnsRecord", "dnsMarker",
+            "targetName", "scope", "route", "previousRoute", "hostStatusSnapshot",
+            "tunnelConfig", "desiredTunnelConfig", "dnsRecord", "dnsMarker",
         }
         if not required.issubset(plan):
             raise
@@ -146,6 +142,12 @@ def apply_public_route(plan: dict[str, Any], *, api_token: str) -> dict[str, Any
         except Exception as recovery_error:
             raise _uncertain_recovery_error(original_error, recovery_error) from recovery_error
 
+        if ingress._status_snapshot(state["host"]) != plan["hostStatusSnapshot"]:
+            recovery_error = DeploymentKitError(
+                "Cloudflare host binding changed after route apply; recovery was stopped."
+            )
+            raise _uncertain_recovery_error(original_error, recovery_error) from recovery_error
+
         route_ok = state["route"] == plan["route"]
         config_ok = _reviewed_config_matches(state["config"], plan["desiredTunnelConfig"])
         dns_ok = state["dns"] is not None
@@ -168,3 +170,28 @@ def apply_public_route(plan: dict[str, Any], *, api_token: str) -> dict[str, Any
                 + " Inspect the managed host route, tunnel configuration, and DNS record before retrying."
             ) from original_error
         raise original_error
+
+
+def _uncertain_recovery_error(
+    original_error: Exception,
+    recovery_error: Exception,
+) -> DeploymentKitError:
+    return DeploymentKitError(
+        "Cloudflare public-route final verification failed, and recovery could not confirm "
+        "the reviewed host binding and current provider state. External state is uncertain "
+        "and rollback was not attempted because ownership could not be verified safely. "
+        f"Original verification error: {original_error} "
+        f"Recovery check failed: {recovery_error} "
+        "Inspect the managed host route, tunnel configuration, and DNS record before retrying."
+    )
+
+
+def apply_public_route_removal(plan: dict[str, Any], *, api_token: str) -> dict[str, Any]:
+    if (
+        not isinstance(plan, dict)
+        or plan.get("action") != "remove"
+        or not {"targetName", "scope"}.issubset(plan)
+    ):
+        return ingress.apply_public_route_removal(plan, api_token=api_token)
+    with ingress.route_transaction_lock(plan["targetName"], plan["scope"]):
+        return ingress.apply_public_route_removal(plan, api_token=api_token, _lock_held=True)

package/assets/generated/deployment/src/project_forge_deployment/errors.py

@@ -3,3 +3,7 @@
 
 class DeploymentKitError(Exception):
     """Expected fail-closed operational or configuration error."""
+
+
+class CloudflarePostWriteVerificationError(DeploymentKitError):
+    """Cloudflare route mutation completed but final provider verification failed."""

package/assets/generated/deployment/src/project_forge_deployment/ingress_cli.py

@@ -14,7 +14,6 @@ from .cloudflare_ingress import (
     PUBLIC_INGRESS_ROUTE_REMOVE_PHRASE,
     PUBLIC_INGRESS_ROUTE_WRITE_PHRASE,
     apply_cloudflare_ingress,
-    apply_public_route_removal,
     cloudflare_ingress_doctor,
     cloudflare_ingress_status,
     cloudflare_route_inventory,
@@ -22,7 +21,7 @@ from .cloudflare_ingress import (
     plan_public_route,
     plan_public_route_removal,
 )
-from .cloudflare_route_apply import apply_public_route
+from .cloudflare_route_apply import apply_public_route, apply_public_route_removal
 from .errors import DeploymentKitError
 
 

package/assets/generated/deployment/src/project_forge_deployment/teardown.py

@@ -15,7 +15,6 @@ from .box_platform import platform_status
 from .cloudflare_ingress import (
     CLOUDFLARE_API_TOKEN_ENV,
     PUBLIC_INGRESS_ROUTE_REMOVE_PHRASE,
-    apply_public_route_removal,
     cloudflare_ingress_status,
     cloudflare_route_inventory,
     plan_public_route_removal,
@@ -313,6 +312,8 @@ def _tear_down_public_ingress(
     app_slug: str,
     environment: str,
 ) -> dict[str, Any]:
+    from .cloudflare_route_apply import apply_public_route_removal
+
     inventory = cloudflare_route_inventory(target, scope)
     route = _find_route(inventory, app_slug, environment)
     if route is None:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mriekki/project-forge",
-  "version": "4.10.3",
+  "version": "4.10.5",
   "description": "Public consumer distribution and updater for Project Forge engineering assets.",
   "type": "module",
   "bin": {