flowviant 0.102.2 → 0.104.0

package/bin/lib/deploy.mjs

@@ -6,290 +6,63 @@
  * .flowviant/deploy.json so the app can list targets, and (basic) observes
  * out-of-band deployments.
  *
- * ── THE MACHINE'S OWN ENVIRONMENT IS THE SOURCE OF A DEPLOY'S SECRETS
- *    (2026-09-21), BECAUSE FLOWVIANT NO LONGER HOLDS ANY ──
- *
- * This lane used to get both halves of its secrets from the end-to-end
- * encrypted vault: `deployCreds()` put the deploy-scope credentials in the
- * command's environment, and `appSecretsFor('prod')` fed `wrangler secret put`
- * on stdin so a prod deploy pushed the project's app secrets to the provider's
- * own store. The vault is DELETED — the owner: "no i dont want it. unless its
- * needed where i want to show the env of each of the machines (for
- * comparison)", and on the recovery passphrase that protected it, "no, its fine
- * to repaste from providers".
- *
- * So both halves are gone, and what replaces them is the operator:
- *
- *  - the deploy COMMAND runs with the infra credentials that are in this
- *    daemon's own environment, passed through `childEnv`'s opt-in `deploy: true`
- *    allowlist. If `wrangler` authenticates when the operator runs it in that
- *    shell, it authenticates here.
- *  - the `pushSecrets` step is DELETED outright rather than reimplemented
- *    against `process.env`. It existed to move values Flowviant was custodian
- *    of; with no custody there is nothing here that the operator does not
- *    already have in front of them, and `wrangler secret put` is a command they
- *    can run. Flowviant automating a push of secrets it does not hold, from an
- *    environment it does not own, into a provider store it cannot read back, is
- *    the shape of a feature that fails silently and invisibly. `target
- *    .pushSecrets` is still PARSED and reported (a dormant key is the standing
- *    call) — it simply drives nothing.
- *
- * ── WHAT A DEPLOY LOG IS ACTUALLY SCRUBBED AGAINST, corrected 2026-09-21 by
- *    the review that caught this paragraph asserting a guarantee it had lost ──
- *
- * Every log line that leaves the machine still passes through `scrub`. What
- * this paragraph claimed for a few hours was that being fed from the checkout's
- * `.env*` files was "strictly more of what a deploy log can contain than the
- * vault ever delivered", and for THIS lane that was exactly backwards. The
- * vault's deploy-scope half WAS `CLOUDFLARE_API_TOKEN` and friends, so those
- * were redacted; an operator's own token lives in the shell they started the
- * daemon in — which is the entire reason `childEnv`'s `deploy: true` widening
- * exists — and almost never in a checkout file. So the one lane that hands a
- * credential to a command and then streams that command's stdout to the server
- * was the one lane no longer redacting it.
- *
- * It is fed from BOTH now, and the join is made in `scanEnvForScrub` rather
- * than here so no call site has to remember: the checkout's `.env*` files, plus
- * the PRESENT values of `childEnv`'s own `DEPLOY_KEEP` names out of
- * `process.env` (see `processEnvSecrets`, which also explains why `CF_API_TOKEN`
- * is redacted although it is never passed, and why none of this reaches the
- * `/fleet/env-report` wire — that report is a statement about the checkout's
- * files, and this box's shell is not one). Deriving the redaction list from the
- * admission list is what stops the two drifting the next time a name is added.
- *
- * The honest residue, stated: a credential that is neither in `DEPLOY_KEEP` nor
- * in a checkout `.env*` — one a `build` script fetches for itself, say — is not
- * redacted, because this daemon has never seen it.
+ * THIS FILE IS THE JOB LEASE (SOLID F060, split from one 811-line module):
+ * claim → heartbeat → run → report, single-flight per job id and never twice
+ * in one process. The rest of the lane sits beside it, one reason to change
+ * each:
+ *   - deployConfig.mjs    what `.flowviant/deploy.json` on base declares, and
+ *                         the report of it to the server
+ *   - deployCheckout.mjs  the throwaway detached worktree at the base tip
+ *   - deployRunner.mjs    the commands, their environment and log scrubbing,
+ *                         the health check (and why a deploy's secrets are
+ *                         the machine's own environment)
+ *   - deployWire.mjs      the one `/fleet/deploy-*` POST
  */
 
-
-import { spawn } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import {
-  copyFileSync,
-  existsSync,
-  lstatSync,
-  mkdirSync,
-  readdirSync,
-  realpathSync,
-  rmdirSync,
-  rmSync,
-  symlinkSync,
-  unlinkSync,
-} from 'node:fs';
-import { homedir } from 'node:os';
-import { basename, isAbsolute, join, relative, sep } from 'node:path';
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT, DAEMON_INSTANCE } from './config.mjs';
+import { DAEMON_INSTANCE } from './config.mjs';
 import { c, note, ok, warn } from './ui.mjs';
-import { scrub, myPubB64 } from './env.mjs';
-import { childEnv } from './childEnv.mjs';
-import { git, gitNetAsync } from './git.mjs';
+import { scrub } from './uplinkScrub.mjs';
+import { post } from './deployWire.mjs';
+import { runDeploy } from './deployRunner.mjs';
+import { workLanesStopped } from './standDownGate.mjs';
 
-const deployUrl = (tail) => FLEET_URL.replace(/\/agents\/?$/, `/${tail}`);
-
-async function post(tail, body) {
-  const res = await fetch(deployUrl(tail), {
-    method: 'POST',
-    headers: {
-      Authorization: `Bearer ${FLEET_TOKEN}`,
-      'User-Agent': USER_AGENT,
-      'Content-Type': 'application/json',
-    },
-    signal: AbortSignal.timeout(30_000),
-    body: JSON.stringify(body),
-  });
-  const json = await res.json().catch(() => ({}));
-  if (!res.ok || json?.success === false) {
-    throw new Error(`${tail} failed (${res.status}${json?.error ? `: ${json.error}` : ''})`);
-  }
-  return json?.data;
-}
+/** In-flight guard (single-flight per daemon process): job id → what it is
+ *  deploying, in words (`web → prod`, for the stand-down's sentence), and —
+ *  once the server has granted the claim — the job and its context, which is
+ *  what `reportDeploysAbandoned` needs to settle it. */
+const claiming = new Map();
+/** How many deploys this process is running (claim through report) — a
+ *  deploy is work the machine must not be restarted under (fleet.mjs,
+ *  `machineBusy`). */
+export const deploysInFlight = () => claiming.size;
+/** What the in-flight deploys are deploying, `target → env` each. */
+export const deploysInFlightLabels = () => [...claiming.values()].map((c) => c.label);
 
 /**
- * Read + parse `.flowviant/deploy.json` AS IT IS ON THE BASE BRANCH. Returns []
- * if the branch has none.
- *
- * IT USED TO READ THE WORKING TREE, which made the feature's one stated bound
- * false. `deploy_target`'s own description says "only ids already declared in
- * `.flowviant/deploy.json` on MAIN can be named (the daemon reads and runs from
- * the repo ROOT, never a session worktree, so an agent cannot author the command
- * it triggers without shipping it first)" — and the repo root's WORKING TREE is
- * exactly where the machine operator's tabs stand (their place is the checkout).
- * So an agent that had read an injected instruction could write an uncommitted
- * `.flowviant/deploy.json` naming any shell command, call `deploy_target`, and
- * have the daemon run it from the repo root with `CLOUDFLARE_API_TOKEN` and
- * every other deploy-scope credential in its environment. Nothing about that
- * needed a commit, a review, or an owner.
- *
- * Reading the COMMITTED tree is what makes the sentence true: authoring the
- * command now requires landing it on base, which is a reviewed act. The file is
- * read through git rather than the filesystem, so an uncommitted edit is simply
- * not there.
+ * RESOLVES ONCE EVERY DEPLOY THIS PROCESS HAS CLAIMED HAS REPORTED (or given
+ * up reporting) — immediately when none is in flight.
  *
- * A base ref that does not resolve yields NO TARGETS, and says so once. That is
- * the withholding direction and it is the right one here — a deploy is
- * irreversible and running the wrong file is worse than running nothing.
+ * The stand-down waits on this before it exits (standDownExit.mjs), because a
+ * STAND-DOWN LETS A DEPLOY FINISH AND REPORT (ruling 2026-09-26): the process
+ * that holds the claim is the only thing that can post its outcome, and an
+ * outcome that never lands has the server hand the same irreversible job out
+ * again three minutes later.
  */
-export function readDeployConfig(repoRoot, baseRef) {
-  let raw;
-  if (baseRef) {
-    try {
-      raw = git(['show', `${baseRef}:.flowviant/deploy.json`], repoRoot);
-    } catch {
-      // No such file on base, or a base ref that does not resolve. Both mean
-      // "this branch declares no targets", which is a real answer.
-      return [];
-    }
-  } else {
-    // No base ref in hand (a caller that has not been updated). Refuse rather
-    // than silently falling back to the working tree — that fallback IS the bug.
-    warn('deploy: no base branch resolved, so no deploy targets were read.');
-    return [];
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    const targets = Array.isArray(parsed?.targets) ? parsed.targets : [];
-    // Keep only fields the server + runner need; the daemon holds the commands.
-    return targets
-      .filter((t) => t && typeof t.id === 'string' && typeof t.command === 'string')
-      .slice(0, 20);
-  } catch (e) {
-    warn(`deploy: .flowviant/deploy.json on the base branch is not valid JSON — ${e.message}`);
-    return [];
-  }
+const settleWaiters = [];
+export function whenDeploysSettle() {
+  if (claiming.size === 0) return Promise.resolve();
+  return new Promise((resolve) => settleWaiters.push(resolve));
 }
-
-/** Report the parsed config to the server (only when it changed). */
-let lastConfigJson = null;
-export async function reportDeployConfig(repoRoot, baseRef) {
-  const targets = readDeployConfig(repoRoot, baseRef);
-  const json = JSON.stringify(targets);
-  if (json === lastConfigJson) return;
-  // Scrub command strings before the server sees them — a command line can embed
-  // an internal host or a synced secret. Only redacted metadata leaves the box.
-  const scrubCmds = (o) =>
-    o && typeof o === 'object'
-      ? Object.fromEntries(Object.entries(o).map(([k, v]) => [k, scrub(String(v ?? ''))]))
-      : o;
-  /**
-   * NORMALIZE BEFORE POSTING (2026-09-24, the audit). `.flowviant/deploy.json`
-   * is a hand-written file; the shared schema treats `healthStatus` /
-   * `healthcheck` / `build` / `label` as display metadata and drops what it
-   * cannot read rather than refusing the whole target — but this file used to
-   * send them through unmodified, so a `"healthStatus": "200"` (which
-   * `verifyHealth` below already coerces with `Number()`) or a `null` label
-   * used to reach the wire looking present-but-unreadable. Send exactly what
-   * the mirror is going to keep instead of what the file happened to spell:
-   * a numeric `healthStatus` when the value is numeric or a numeric string,
-   * and no key at all for `label` / `healthcheck` / `build` when the file's
-   * value is not a non-empty string.
-   */
-  const numOrOmit = (v) => {
-    if (typeof v === 'number' && Number.isFinite(v)) return v;
-    if (typeof v === 'string' && /^\s*\d+\s*$/.test(v)) return Number(v);
-    return undefined;
-  };
-  const strOrOmit = (v) => (typeof v === 'string' && v.trim() ? v : undefined);
-  const meta = targets.map((t) => {
-    const label = strOrOmit(t.label);
-    const build = strOrOmit(t.build);
-    const healthcheck = strOrOmit(t.healthcheck);
-    const healthStatus = numOrOmit(t.healthStatus);
-    return {
-      id: t.id,
-      ...(label !== undefined ? { label } : {}),
-      provider: t.provider || 'cloudflare',
-      command: scrub(String(t.command ?? '')),
-      ...(build !== undefined ? { build: scrub(build) } : {}),
-      commands: scrubCmds(t.commands),
-      ...(healthcheck !== undefined ? { healthcheck } : {}),
-      ...(healthStatus !== undefined ? { healthStatus } : {}),
-      pushSecrets: t.pushSecrets,
-      // Deploy-on-merge: the env this target auto-deploys to when commits land
-      // on base. MUST ride this map — a field forgotten here never reaches the
-      // server, and the server is what turns a landed report into the job.
-      ...(typeof t.onMerge === 'string' ? { onMerge: t.onMerge } : {}),
-    };
-  });
-  try {
-    const data = await post('deploy-config', { pubkey: myPubB64(), targets: meta });
-    // Set on any 2xx, rejected targets included — the route now accepts a
-    // report per-target rather than failing the whole thing, so a target it
-    // could not read is not a reason to re-post this same file forever.
-    lastConfigJson = json;
-    // THE SERVER NAMES WHAT IT COULD NOT READ. Warned once per CHANGED config —
-    // this function only reaches here when the file did — never once per poll.
-    const rejected = Array.isArray(data?.rejected) ? data.rejected : [];
-    for (const r of rejected) {
-      warn(
-        `deploy: .flowviant/deploy.json target "${r?.id ?? '?'}" was not accepted — ${r?.reason ?? 'invalid'}`
-      );
-    }
-  } catch (e) {
-    warn(`deploy: could not report config — ${e.message}`);
-  }
+/** The job's real outcome is on its way (`report` has started): a second
+ *  Ctrl+C must not race it with `unknown` (`reportDeploysAbandoned`). */
+function markReporting(jobId) {
+  const entry = claiming.get(jobId);
+  if (entry) entry.reporting = true;
 }
-
-/** Run a shell command ASYNC (never blocks the daemon's event loop — the
- *  reconcile poll + the deploy heartbeat must keep firing during a long
- *  deploy). Captures combined + scrubbed output; resolves {ok,out,code}. */
-function run(command, { cwd, env }) {
-  return new Promise((resolve) => {
-    const child = spawn(command, { cwd, env, shell: true, stdio: ['pipe', 'pipe', 'pipe'] });
-    let buf = '';
-    const cap = (d) => {
-      buf += d.toString();
-      if (buf.length > 512 * 1024) buf = buf.slice(-512 * 1024); // bound memory
-    };
-    child.stdout.on('data', cap);
-    child.stderr.on('data', cap);
-    const timer = setTimeout(() => {
-      try {
-        child.kill('SIGKILL');
-      } catch {
-        /* already gone */
-      }
-    }, 30 * 60_000);
-    // A broken pipe (a child that exits before its stdin is closed) surfaces as
-    // an ASYNC 'error' on the stdin stream, which the try/catch around this
-    // cannot catch. Without a listener it is an uncaught exception that kills
-    // the whole daemon. Swallow it.
-    //
-    // The `input` parameter this used to take went with the prod-secret push —
-    // it existed so a value could reach `wrangler secret put` on stdin rather
-    // than argv, and there is no value left to send. Closing stdin immediately
-    // is now the only case.
-    child.stdin.on('error', () => {});
-    child.stdin.end();
-    child.on('close', (code) => {
-      clearTimeout(timer);
-      resolve({ ok: code === 0, code: code ?? -1, out: scrub(buf) });
-    });
-    child.on('error', (e) => {
-      clearTimeout(timer);
-      resolve({ ok: false, code: -1, out: scrub(`${buf}\n${e.message}`) });
-    });
-  });
-}
-
-const tailLines = (s, n = 40) => s.split('\n').filter(Boolean).slice(-n);
-
-/** Health-check a deployed target: GET the URL, expect `status`. Retries a few
- *  times for propagation lag. */
-async function verifyHealth(url, status) {
-  for (let i = 0; i < 4; i++) {
-    try {
-      const res = await fetch(url, { signal: AbortSignal.timeout(10_000), redirect: 'manual' });
-      if (res.status === Number(status)) return true; // coerce — a string "200" in deploy.json must still match
-    } catch {
-      /* not up yet */
-    }
-    await new Promise((r) => setTimeout(r, 3000));
-  }
-  return false;
+function releaseClaim(jobId) {
+  claiming.delete(jobId);
+  if (claiming.size === 0) for (const resolve of settleWaiters.splice(0)) resolve();
 }
-
-const claiming = new Set(); // in-flight guard (single-flight per daemon process)
 /**
  * JOBS THIS PROCESS HAS ALREADY RUN, whatever the server thinks.
  *
@@ -322,7 +95,7 @@ export function processDeployJobs(jobs, ctx) {
     if (!job || typeof job.id !== 'string') continue;
     if (claiming.has(job.id)) continue;
     if (ran.has(job.id)) continue; // already executed here — never twice
-    claiming.add(job.id);
+    claiming.set(job.id, { label: `${job.targetId} → ${job.env}`, held: null, reporting: false });
     void (async () => {
       let beat = null;
       try {
@@ -336,9 +109,22 @@ export function processDeployJobs(jobs, ctx) {
           instance: DAEMON_INSTANCE,
         }).catch(() => null);
         if (!claimed?.claimed) return; // another daemon won the claim
+        /**
+         * A CLAIM THAT COMES BACK AFTER THE STAND-DOWN BEGAN IS NOT RUN. The
+         * loop gate cannot see it (the claim was already on the wire), and the
+         * command is irreversible: starting it now would start work under a
+         * daemon that is leaving. Nothing has run, so the server's stale sweep
+         * handing the job out again in three minutes is the right outcome.
+         */
+        if (workLanesStopped()) {
+          note(`${c.cyan('deploy')} ${c.dim(`— ${job.targetId} → ${job.env} was claimed as this daemon began stopping; not run, the app hands it out again.`)}`);
+          return;
+        }
+        const entry = claiming.get(job.id);
+        if (entry) entry.held = { job, ctx };
         // Keep the claim fresh while we run — a long deploy must never be
         // re-queued out from under us (that would double-deploy). The async
-        // run() below keeps the event loop free so this fires.
+        // run() in deployRunner.mjs keeps the event loop free so this fires.
         /**
          * …AND IT CAN DIE, which is what makes the `stillBeating` predicate
          * below mean anything.
@@ -378,380 +164,27 @@ export function processDeployJobs(jobs, ctx) {
         // From here the work is DONE. Whatever the report does, this job must
         // never run again in this process.
         ran.add(job.id);
+        if (abandoned.has(job.id)) return; // its outcome was already said: `unknown`
+        markReporting(job.id);
         await report(job, ctx, outcome, () => beat != null);
         if (outcome.ok) ok(`${c.cyan('deploy')} ${c.dim(`— ${job.targetId} → ${job.env} done${outcome.healthOk === false ? ' (health failed)' : ''}`)}`);
         else warn(`deploy: ${job.targetId} → ${job.env} failed — ${outcome.message}`);
       } catch (e) {
         warn(`deploy job ${job.id} errored: ${e.message}`);
+        if (abandoned.has(job.id)) return;
+        markReporting(job.id);
         await report(job, ctx, { ok: false, message: e.message }).catch(() => {});
       } finally {
         // Stopped only AFTER the report has landed or given up — the requeue is
         // gated on heartbeat staleness, so beating through the retries is what
         // stops the server handing this job out again mid-retry.
         if (beat) clearInterval(beat);
-        claiming.delete(job.id);
+        releaseClaim(job.id);
       }
     })();
   }
 }
 
-/**
- * A DEPLOY BUILDS THE BASE COMMIT, NEVER THE OPERATOR'S WORKING TREE
- * (audit 2026-09-24).
- *
- * `readDeployConfig` reads the TARGET off base so that authoring a command
- * requires landing it — and then every command ran with `cwd: repoRoot`, the
- * operator's own checkout, on whatever branch they left it with whatever they
- * had not committed. So `npm run build` and `wrangler deploy` read the
- * package.json scripts, wrangler.toml and source of that working tree:
- * deploy-on-merge (queued by a teammate's ship, a PR merge or an agent merge,
- * none of which moves the checkout) shipped code WITHOUT the merge that
- * triggered it, and a co-owner's "deploy it to prod" shipped the operator's
- * half-finished branch. Reproduced: a checkout on `feature` with an
- * uncommitted edit deployed the edit.
- *
- * So a deploy runs in a THROWAWAY DETACHED WORKTREE at the base tip — the
- * shipMerge shape — and the config is read from THAT SHA, so the command and
- * the code it builds are one commit. The directory dies in a `finally`.
- *
- * What a fresh worktree does not have is what git does not track: installed
- * dependencies and the operator's env files. Those are the checkout's
- * ENVIRONMENT, not its code, so for every directory base tracks (three levels
- * deep) a `node_modules` in the checkout is re-created as a directory of links
- * to its entries — a WORKSPACE package's link re-pointed at base's own copy of
- * that package, never the checkout's working tree — and a `.env` / `.env.*` /
- * `.dev.vars` the base commit does not carry is COPIED in. Stated residual:
- * installed third-party packages and those env files are still the checkout's,
- * so a dependency installed for a feature branch, or an untracked env file an
- * agent edited, reaches the build; so does a workspace package's untracked
- * build output (`dist/`), which is simply absent here and fails the build
- * loudly rather than shipping the checkout's. A `.bin` shim is linked whole, so
- * a workspace package's own CLI still runs from the checkout. Submodules are
- * not initialised. The code and the commands no longer come from the checkout.
- */
-const ENV_FILE_RE = /^(?:\.env(?:\..+)?|\.dev\.vars)$/;
-const lexists = (p) => {
-  try {
-    lstatSync(p);
-    return true;
-  } catch {
-    return false;
-  }
-};
-
-/** Bring the checkout's untracked environment into a deploy worktree. Returns
- *  every path it created, so the cleanup can unlink them BEFORE the worktree
- *  is removed (a recursive delete must never be handed a symlink into the
- *  operator's own node_modules). */
-export function linkCheckoutEnvironment(repoRoot, dir) {
-  const made = [];
-  let realRoot = repoRoot;
-  try {
-    realRoot = realpathSync(repoRoot);
-  } catch {
-    /* compared as given */
-  }
-  /**
-   * A node_modules is a REAL directory of per-entry links, not one link to the
-   * checkout's (review, audit 2026-09-24). A workspace package — npm, yarn and
-   * pnpm all install one as a link like `node_modules/@x/shared ->
-   * ../../packages/shared` — resolves THROUGH the checkout's node_modules into
-   * the checkout's WORKING TREE, so a whole-directory link had every bundler
-   * import the operator's uncommitted `packages/shared/src` into a deploy of
-   * base. An entry whose real path is inside the checkout but outside any
-   * node_modules is re-pointed at the SAME path in this worktree (base's copy);
-   * one base does not carry is left out, since base cannot import what it does
-   * not have. Every other entry links to the checkout's own, as before.
-   */
-  const linkNodeModules = (src, dst, depth) => {
-    let entries;
-    try {
-      entries = readdirSync(src, { withFileTypes: true });
-      mkdirSync(dst);
-      made.push(dst);
-    } catch {
-      return;
-    }
-    for (const e of entries) {
-      const s = join(src, e.name);
-      const d = join(dst, e.name);
-      // A scope directory holds packages, not a package: one level down.
-      if (depth === 0 && e.name.startsWith('@') && e.isDirectory()) {
-        linkNodeModules(s, d, 1);
-        continue;
-      }
-      let target = s;
-      if (e.isSymbolicLink()) {
-        let real;
-        try {
-          real = realpathSync(s);
-        } catch {
-          continue; // a dangling link — nothing to bring
-        }
-        const rel = relative(realRoot, real);
-        const inCheckout = rel !== '' && !rel.startsWith('..') && !isAbsolute(rel);
-        if (inCheckout && !rel.split(sep).includes('node_modules')) {
-          if (!existsSync(join(dir, rel))) continue;
-          target = join(dir, rel);
-        }
-      }
-      try {
-        symlinkSync(target, d);
-        made.push(d);
-      } catch {
-        /* the build says so if it needed it */
-      }
-    }
-  };
-  const walk = (rel, depth) => {
-    let entries;
-    try {
-      entries = readdirSync(join(repoRoot, rel), { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const e of entries) {
-      const src = join(repoRoot, rel, e.name);
-      const dst = join(dir, rel, e.name);
-      if (e.name === '.git') continue;
-      if (e.name === 'node_modules') {
-        if (e.isDirectory() && !lexists(dst)) linkNodeModules(src, dst, 0);
-        continue;
-      }
-      if (e.isFile() && ENV_FILE_RE.test(e.name)) {
-        if (!lexists(dst)) {
-          try {
-            copyFileSync(src, dst);
-            made.push(dst);
-          } catch {
-            /* unreadable — the build says so if it needed it */
-          }
-        }
-        continue;
-      }
-      // Recurse only into directories BASE tracks — an untracked `dist/` or a
-      // cache is neither code nor environment, and walking it costs a scan.
-      if (e.isDirectory() && depth < 3 && existsSync(dst) && !lexists(join(dst, '.git'))) {
-        walk(join(rel, e.name), depth + 1);
-      }
-    }
-  };
-  walk('', 0);
-  return made;
-}
-
-/**
- * Cut the deploy worktree at the base tip. Returns `{ dir, sha, cleanup }`, or
- * throws with a sentence when base does not resolve. `worktreeDir` defaults to
- * the daemon's own worktree home for this repo (fleet.mjs keys it the same
- * way); the job id is hashed into the path, never joined raw — it is a
- * server-named string.
- */
-export async function openDeployCheckout({ repoRoot, baseRef, jobId, worktreeDir }) {
-  if (!baseRef) throw new Error('no base branch resolved, so there is nothing to deploy from');
-  try {
-    // A NETWORK call, so timed, non-interactive and off the event loop — a
-    // bare `git fetch` here is `execFileSync` with no timeout, and a remote
-    // that prompts or a half-open connection froze every poll and lease on
-    // the machine until it returned.
-    await gitNetAsync(['fetch', 'origin', '--quiet'], repoRoot);
-  } catch {
-    /* offline — deploy the base this box last saw, and say which */
-  }
-  let sha;
-  try {
-    sha = git(['rev-parse', '--verify', `${baseRef}^{commit}`], repoRoot);
-  } catch {
-    throw new Error(`the base branch ${baseRef} does not resolve on this machine`);
-  }
-  const home =
-    worktreeDir ??
-    join(
-      homedir(),
-      '.flowviant',
-      'worktrees',
-      `${basename(repoRoot)}-${createHash('sha256').update(repoRoot).digest('hex').slice(0, 8)}`
-    );
-  const dir = join(home, 'deploy', createHash('sha256').update(String(jobId)).digest('hex').slice(0, 16));
-  mkdirSync(join(home, 'deploy'), { recursive: true });
-  const drop = (made = [], target = dir) => {
-    // Newest first, so a node_modules directory we made is empty of our links
-    // by the time it is removed.
-    for (const p of [...made].reverse()) {
-      try {
-        unlinkSync(p);
-      } catch {
-        try {
-          rmdirSync(p);
-        } catch {
-          /* already gone */
-        }
-      }
-    }
-    try {
-      git(['worktree', 'remove', '--force', target], repoRoot);
-    } catch {
-      /* not registered */
-    }
-    // Every symlink we made is already unlinked, and `rmSync` unlinks a
-    // symlink rather than descending it, so this can only delete our own copy.
-    try {
-      rmSync(target, { recursive: true, force: true });
-    } catch {
-      /* best-effort */
-    }
-    try {
-      git(['worktree', 'prune'], repoRoot);
-    } catch {
-      /* best-effort */
-    }
-  };
-  drop(); // a corpse from a crashed deploy of the same job
-  // …and any other job's corpse old enough that no deploy can still be running
-  // in it (two commands at most, 30 minutes each), so a daemon killed
-  // mid-deploy does not leave a checkout on disk for ever.
-  try {
-    const cutoff = Date.now() - 3 * 60 * 60 * 1000;
-    for (const name of readdirSync(join(home, 'deploy'))) {
-      const p = join(home, 'deploy', name);
-      try {
-        if (p !== dir && lstatSync(p).mtimeMs < cutoff) drop([], p);
-      } catch {
-        /* gone meanwhile */
-      }
-    }
-  } catch {
-    /* nothing to sweep */
-  }
-  git(['worktree', 'add', '--detach', dir, sha], repoRoot);
-  let made = [];
-  try {
-    made = linkCheckoutEnvironment(repoRoot, dir);
-  } catch {
-    /* the build says so if it needed any of it */
-  }
-  return { dir, sha, cleanup: () => drop(made) };
-}
-
-export async function runDeploy(job, ctx) {
-  let checkout;
-  try {
-    checkout = await openDeployCheckout({
-      repoRoot: ctx.repoRoot,
-      baseRef: ctx.baseRef,
-      jobId: job.id,
-      worktreeDir: ctx.worktreeDir,
-    });
-  } catch (e) {
-    return { ok: false, message: `deploy not run — ${e.message}`, logs: [] };
-  }
-  try {
-    const targets = readDeployConfig(ctx.repoRoot, checkout.sha);
-    const target = targets.find((t) => t.id === job.targetId);
-    if (!target) {
-      return { ok: false, message: `target "${job.targetId}" not in .flowviant/deploy.json`, logs: [] };
-    }
-    const outcome = await runDeployIn(job, target, checkout.dir);
-    const short = checkout.sha.slice(0, 12);
-    return { ...outcome, sha: checkout.sha, message: `${outcome.message} (${short})` };
-  } finally {
-    checkout.cleanup();
-  }
-}
-
-async function runDeployIn(job, target, cwd) {
-  // AN ALLOWLIST, not `{...process.env}` minus names. What stood here was
-  //
-  //     const env = { ...process.env, ...deployCreds() };
-  //     delete env.FLEET_TOKEN;
-  //
-  // and that delete was a NO-OP: `FLEET_TOKEN` is a module constant in
-  // config.mjs, while the environment variable is `FLOWVIANT_FLEET`. The
-  // machine credential was therefore in the environment of every deploy
-  // command — and of `target.build`, which is a string the REPO controls —
-  // under a comment asserting the opposite. A denylist is a claim about a set
-  // you cannot see; this is built from {} instead.
-  //
-  // `deploy: true` is the OPT-IN SECOND GROUP (childEnv.mjs): a named set of
-  // infra credential variables kept out of this daemon's own environment, and
-  // nothing else. It replaced `extra: deployCreds()` when the vault was deleted
-  // — the credentials are the OPERATOR's now, in the shell they started the
-  // daemon in, rather than values Flowviant decrypted onto the box.
-  const env = childEnv({ cwd, deploy: true }); // infra creds; never a file
-  const logs = [];
-  /**
-   * THE ENV-ISOLATION GUARD, RE-APPLIED HERE (2026-09-24, the audit).
-   *
-   * The server already refuses a non-prod trigger whose target declares no
-   * per-env override — `createDeployJob`'s own comment names the same
-   * fallback this file resolves, `commands?.[env] || command`, as the reason:
-   * the base `command` (and the bare `npx wrangler rollback` default) is the
-   * PROD command, so a dev/preview trigger with no override would silently
-   * run production. But that check reads the SERVER'S MIRROR
-   * (`reportDeployConfig`'s last post), and this function reads the file OFF
-   * THE COMMIT it is about to build and run — a window the trigger-time check
-   * cannot close: the file on base changed after the last report, or this
-   * daemon has not reported yet. So the same rule is asked again here,
-   * against the only copy that is about to matter, and prod is the one env
-   * this never touches.
-   */
-  if (job.env !== 'prod') {
-    const key = job.kind === 'rollback' ? `rollback:${job.env}` : job.env;
-    if (!target.commands?.[key]) {
-      return {
-        ok: false,
-        message: `target declares no ${job.env} command — refusing to fall back to the prod command`,
-        logs,
-      };
-    }
-  }
-  // Rollback is a single wrangler command; deploy is build → secrets → deploy.
-  if (job.kind === 'rollback') {
-    const cmd = target.commands?.[`rollback:${job.env}`] || `npx wrangler rollback`;
-    const r = await run(cmd, { cwd, env });
-    logs.push(...tailLines(r.out));
-    return { ok: r.ok, message: r.ok ? 'rolled back' : logs.slice(-6).join('\n'), logs };
-  }
-
-  if (target.build) {
-    const b = await run(target.build, { cwd, env });
-    logs.push(...tailLines(b.out));
-    if (!b.ok) return { ok: false, message: `build failed:\n${logs.slice(-6).join('\n')}`, logs };
-  }
-
-  // THE PROD-SECRET PUSH IS DELETED (2026-09-21). What stood here read
-  // `appSecretsFor('prod')` out of the vault and piped each value into
-  // `wrangler secret put` on stdin — never argv, so no prod plaintext in `ps`.
-  // That care was right and it is moot: the vault is gone, Flowviant holds no
-  // app secret for anybody, and there is nothing left to push. It is not
-  // reimplemented against `process.env`, because a deploy that quietly pushes
-  // whatever happens to be exported in the daemon's shell into a provider's
-  // secret store is a worse feature than no feature — the operator can see and
-  // run `wrangler secret put`, and they are the only one who can tell which
-  // values belong there. `target.pushSecrets` stays parsed and reported, which
-  // is what every retired key in this product does.
-  const cmd = target.commands?.[job.env] || target.command;
-  const d = await run(cmd, { cwd, env });
-  logs.push(...tailLines(d.out));
-  if (!d.ok) return { ok: false, message: `deploy failed:\n${logs.slice(-8).join('\n')}`, logs };
-
-  // Extract the wrangler version/deployment id if present.
-  const idMatch = d.out.match(/Current Version ID:\s*([0-9a-f-]+)/i);
-  const deploymentId = idMatch ? idMatch[1] : null;
-
-  let healthOk = null;
-  if (target.healthcheck) {
-    healthOk = await verifyHealth(target.healthcheck, target.healthStatus ?? 200);
-  }
-  return {
-    ok: true,
-    healthOk,
-    deploymentId,
-    message: healthOk === false ? 'deployed, but health check failed' : 'deployed',
-    logs,
-  };
-}
-
 /**
  * THE OUTCOME IS RETRIED, because losing it re-runs the deploy.
  *
@@ -769,25 +202,34 @@ async function runDeployIn(job, target, cwd) {
  * `ran` guard as the floor.
  */
 async function report(job, ctx, outcome, stillBeating = () => true) {
-  const body = {
-    jobId: job.id,
-    pubkey: ctx.myPubB64(),
-    // The same term the claim carries, for the same reason: the pubkey is one
-    // keypair per home directory, so two daemons on one box share it, and a
-    // stale holder's late report would otherwise settle the RECLAIMER's
-    // running job. The server matches it when present; an older server
-    // ignores the extra key.
-    instance: DAEMON_INSTANCE,
-    ok: !!outcome.ok,
-    deploymentId: outcome.deploymentId ?? null,
-    healthOk: outcome.healthOk ?? null,
-    message: scrub(outcome.message || ''),
-  };
+  const body = reportBody(job, ctx, outcome);
   for (let attempt = 0; attempt < 6; attempt++) {
     try {
       await post('deploy-report', body);
       return;
     } catch (e) {
+      /**
+       * A REFUSED CREDENTIAL IS SAID, NEVER THROWN (ruling 2026-09-26). A
+       * stand-down lets the deploy finish and report — and the stand-down may
+       * be a Disconnect, which rotates the credential while the command is
+       * still running. Retrying the API's own refusal changes nothing, and
+       * throwing would leave the outcome in nobody's hands; one line names
+       * what happened and where the result is.
+       *
+       * ONLY THE API'S OWN REFUSAL (`credentialRejected`, authReject.mjs's
+       * rule, set by deployWire.mjs). An edge 401/403 — Cloudflare's bot
+       * checks answer this client class with their own — is a blip like any
+       * other and keeps the retries below: dropping the outcome over one
+       * would have the server hand the irreversible job out again.
+       */
+      if (e?.credentialRejected) {
+        warn(
+          `deploy: ${job.targetId} → ${job.env} ${outcome.ok ? 'finished' : 'failed'}, but its outcome ` +
+            `could not be reported — the app refused this machine's credential (HTTP ${e.status}). ` +
+            'The result is only in this log.'
+        );
+        return;
+      }
       // The last attempt says so; the ones before it are noise on a path that
       // usually recovers.
       if (attempt === 5) {
@@ -804,3 +246,62 @@ async function report(job, ctx, outcome, stillBeating = () => true) {
     }
   }
 }
+
+/** The one shape of `/fleet/deploy-report`, for a real outcome and for an
+ *  abandoned one alike. */
+function reportBody(job, ctx, outcome) {
+  return {
+    jobId: job.id,
+    pubkey: ctx.myPubB64(),
+    // The same term the claim carries, for the same reason: the pubkey is one
+    // keypair per home directory, so two daemons on one box share it, and a
+    // stale holder's late report would otherwise settle the RECLAIMER's
+    // running job. The server matches it when present; an older server
+    // ignores the extra key.
+    instance: DAEMON_INSTANCE,
+    ok: !!outcome.ok,
+    deploymentId: outcome.deploymentId ?? null,
+    healthOk: outcome.healthOk ?? null,
+    message: scrub(outcome.message || ''),
+    // `unknown` only when this process leaves without seeing the end of the
+    // command (`reportDeploysAbandoned`). A daemon→server report field, so no
+    // floor: an older server ignores the key and records `ok: false` — a
+    // terminal failure, which is still never handed out again.
+    ...(outcome.unknown ? { outcome: 'unknown' } : {}),
+  };
+}
+
+/**
+ * THE WORDS A DEPLOY'S OUTCOME CARRIES WHEN NOBODY SAW IT END — the second
+ * Ctrl+C during a stand-down's drain (standDownExit.mjs, ruling 2026-09-26).
+ */
+export const ABANDONED_DEPLOY_WORDS = 'outcome unknown: operator left mid-deploy';
+
+/** Jobs whose outcome was posted as `unknown`: their own report never follows. */
+const abandoned = new Set();
+
+/**
+ * A PERSON IS LEAVING BEFORE THE DEPLOYS END — settle each claimed one as
+ * `unknown`, ONCE, so the server marks it terminal and never hands the same
+ * irreversible job out again (ruling 2026-09-26: a second Ctrl+C during the
+ * drain leaves, but says so first). Best-effort and bounded by the caller: one
+ * post per job, no retries, never throws. The commands themselves are not
+ * touched — they run in their own process groups and only their timeout ends
+ * them.
+ */
+export async function reportDeploysAbandoned() {
+  // Only a deploy whose command is still running: one already reporting has
+  // its real outcome on the wire (and keeps retrying it), and whichever post
+  // landed first would win.
+  const held = [...claiming.entries()].filter(([id, c]) => c.held && !c.reporting && !abandoned.has(id));
+  await Promise.all(
+    held.map(async ([id, { held: h }]) => {
+      abandoned.add(id);
+      try {
+        await post('deploy-report', reportBody(h.job, h.ctx, { ok: false, unknown: true, message: ABANDONED_DEPLOY_WORDS }));
+      } catch (e) {
+        warn(`deploy: ${h.job.targetId} → ${h.job.env} — could not say its outcome is unknown: ${e.message}`);
+      }
+    })
+  );
+}