refactor: deepen daemon wiring, reload, app-state, deployment, and CLI modules

AGENTS.md

@@ -111,10 +111,9 @@ CLI commands do NOT use zerowrap — they use `cliWriteLine`/`cliWritef` for out
 
 ### ControlPlane Pattern
 
-`ControlPlane` interface (`controlplane.go`) abstracts local vs remote operations.
-- `controlplane_remote.go` — delegates to `remote.Client` HTTP methods.
-- `controlplane_local.go` — calls service interfaces directly.
-- Test fakes in `push_test.go` — update when adding interface methods.
+`ControlPlane` interface (`controlplane.go`) is the seam CLI commands depend on.
+- `*remote.Client` implements it for both the explicit remote and the local admin socket.
+- Tests use the mockery mock in `cli/mocks/` — run `mockery` after adding interface methods.
 
 ### HTTP Admin Handlers
 

internal/adapters/in/cli/apps.go

@@ -62,7 +62,7 @@ func resolveAppPlane() (*controlPlaneHandle, error) {
 	if err != nil {
 		return nil, err
 	}
-	return &controlPlaneHandle{plane: NewRemoteControlPlane(client)}, nil
+	return &controlPlaneHandle{plane: client}, nil
 }
 
 // appMutationError translates ambiguous transport outcomes into the
@@ -1139,8 +1139,7 @@ func newAppLogsCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
-			plane := NewRemoteControlPlane(client)
-			return runAppLogs(cmd.Context(), plane, &remoteAppLogReader{client: client}, args[0], service, follow, tail, cmd.OutOrStdout(), jsonOut)
+			return runAppLogs(cmd.Context(), client, &remoteAppLogReader{client: client}, args[0], service, follow, tail, cmd.OutOrStdout(), jsonOut)
 		},
 	}
 	cmd.Flags().StringVar(&service, "service", "", "Service to read logs from (required when the app has several)")

internal/adapters/in/cli/apps_local_test.go

@@ -135,8 +135,8 @@ func TestControlPlane_LocalAndRemoteDTOParity(t *testing.T) {
 	go func() { _ = unixSrv.Serve(ln) }()
 	t.Cleanup(func() { _ = unixSrv.Close() })
 
-	localPlane := NewRemoteControlPlane(remote.NewLocalClientForSocket(localadmin.SocketPath(dir)))
-	remotePlane := NewRemoteControlPlane(remote.NewClient(tcp.URL))
+	localPlane := remote.NewLocalClientForSocket(localadmin.SocketPath(dir))
+	remotePlane := remote.NewClient(tcp.URL)
 
 	ctx := context.Background()
 

internal/adapters/in/cli/controlplane.go

@@ -9,7 +9,8 @@ import (
 )
 
 // ControlPlane defines command operations available to CLI execution paths.
-// Both explicit remote and local-daemon implementations call admin HTTP APIs.
+// *remote.Client implements it for both the explicit remote and the
+// owner-only local admin socket; tests substitute the generated mock.
 type ControlPlane interface {
 	// App lifecycle and reads. App mutations are daemon-owned for both
 	// the explicit remote and the owner-only local admin socket.
@@ -48,3 +49,5 @@ type ControlPlane interface {
 	ListVolumes(ctx context.Context) ([]dto.Volume, error)
 	PruneVolumes(ctx context.Context, req dto.VolumePruneRequest) (*dto.VolumePruneResponse, error)
 }
+
+var _ ControlPlane = (*remote.Client)(nil)

internal/adapters/in/cli/controlplane_remote_test.go → internal/adapters/in/cli/controlplane_client_test.go

@@ -15,15 +15,6 @@ import (
 	"github.com/bnema/gordon/internal/adapters/in/cli/remote"
 )
 
-var _ ControlPlane = (*remoteControlPlane)(nil)
-
-func TestRemoteControlPlane_ImplementsInterface(t *testing.T) {
-	client := remote.NewClient("https://gordon.example.com")
-	if NewRemoteControlPlane(client) == nil {
-		t.Fatal("expected non-nil remote control-plane")
-	}
-}
-
 func TestRemoteControlPlane_RunVolumeBackupsPreservesPartialResult(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
@@ -36,28 +27,27 @@ func TestRemoteControlPlane_RunVolumeBackupsPreservesPartialResult(t *testing.T)
 	}))
 	t.Cleanup(server.Close)
 
-	cp := NewRemoteControlPlane(remote.NewClient(server.URL))
+	cp := remote.NewClient(server.URL)
 	result, err := cp.RunVolumeBackups(context.Background(), "shop", "api", "data")
 
 	require.Error(t, err)
-	assert.Contains(t, err.Error(), "run volume backups")
+	assert.Contains(t, err.Error(), "one volume failed")
 	require.NotNil(t, result)
 	assert.Equal(t, "partial", result.Status)
 	require.Len(t, result.Backups, 1)
 	assert.Equal(t, "v1", result.Backups[0].ID)
 }
 
-func TestRemoteControlPlane_VolumeBackupErrorsAreWrapped(t *testing.T) {
+func TestRemoteControlPlane_VolumeBackupErrorsKeepHTTPStatus(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "boom", http.StatusBadGateway)
 	}))
 	t.Cleanup(server.Close)
 
-	cp := NewRemoteControlPlane(remote.NewClient(server.URL))
+	cp := remote.NewClient(server.URL)
 	_, err := cp.VolumeBackupStatus(context.Background())
 
 	require.Error(t, err)
-	assert.Contains(t, err.Error(), "get volume backup status")
 	var httpErr *remote.HTTPError
 	require.True(t, errors.As(err, &httpErr))
 	assert.Equal(t, http.StatusBadGateway, httpErr.StatusCode)

internal/adapters/in/cli/controlplane_resolver.go

@@ -43,12 +43,12 @@ func resolveControlPlane(_ string) (*controlPlaneHandle, error) {
 	if err != nil {
 		return nil, err
 	}
-	return &controlPlaneHandle{plane: NewRemoteControlPlane(client), isRemote: isRemote}, nil
+	return &controlPlaneHandle{plane: client, isRemote: isRemote}, nil
 }
 
 func newRemoteControlPlaneHandle(target *remote.ResolvedRemote) *controlPlaneHandle {
 	client := remote.NewClient(target.URL, remoteClientOptions(target.Token, target.InsecureTLS)...)
-	return &controlPlaneHandle{plane: NewRemoteControlPlane(client), isRemote: true}
+	return &controlPlaneHandle{plane: client, isRemote: true}
 }
 
 func resolveControlPlaneForRepository(ctx context.Context, repository string) (*controlPlaneHandle, error) {

internal/adapters/in/cli/controlplane_resolver_test.go

@@ -65,7 +65,7 @@ func TestResolveControlPlane_LocalUsesSocketBackedRemotePlane(t *testing.T) {
 	require.NoError(t, err)
 	require.NotNil(t, handle)
 	assert.False(t, handle.isRemote)
-	assert.IsType(t, &remoteControlPlane{}, handle.plane)
+	assert.IsType(t, &remote.Client{}, handle.plane)
 	assert.Equal(t, 1, factoryCalls)
 
 	status, err := handle.plane.GetStatus(context.Background())
@@ -103,7 +103,7 @@ func TestResolveControlPlane_ExplicitRemoteDoesNotUseLocalFactory(t *testing.T)
 	handle, err := resolveControlPlane("")
 	require.NoError(t, err)
 	assert.True(t, handle.isRemote)
-	assert.IsType(t, &remoteControlPlane{}, handle.plane)
+	assert.IsType(t, &remote.Client{}, handle.plane)
 }
 
 func TestResolveControlPlane_ExplicitUnknownRemoteReturnsError(t *testing.T) {

internal/adapters/in/cli/traffic_test.go

@@ -94,7 +94,7 @@ func TestRemoteTrafficStatusControlPlaneStillRenders(t *testing.T) {
 	}))
 	defer srv.Close()
 
-	cp := NewRemoteControlPlane(remote.NewClient(srv.URL))
+	cp := remote.NewClient(srv.URL)
 	var buf bytes.Buffer
 	require.NoError(t, runTrafficStatus(context.Background(), cp, &buf, false))
 

internal/adapters/out/appstate/store.go

@@ -489,7 +489,7 @@ func (s *Store) LoadRevision(ctx context.Context, app, revision string) (domain.
 	return rev, nil
 }
 
-// ListRevisions implements out.AppState.
+// ListRevisions returns revision ids ordered newest first.
 func (s *Store) ListRevisions(ctx context.Context, app string) ([]string, error) {
 	if err := checkCtx(ctx); err != nil {
 		return nil, err
@@ -734,7 +734,28 @@ func (s *Store) SaveOwnership(ctx context.Context, ownership domain.AppOwnership
 	})
 }
 
-// StageApply implements out.AppState.
+// AcceptApply implements out.AppState: stage, commit, materialize, then
+// best-effort garbage collection. Each step is its own transaction so a
+// crash leaves a state Recover or GC can finish.
+func (s *Store) AcceptApply(ctx context.Context, intent domain.AppApplyIntent) error {
+	if err := s.StageApply(ctx, intent); err != nil {
+		return fmt.Errorf("appstate: stage apply: %w", err)
+	}
+	if err := s.CommitApply(ctx, intent.App, intent.Intent); err != nil {
+		return fmt.Errorf("appstate: commit apply: %w", err)
+	}
+	if err := s.MaterializeApply(ctx, intent.App, intent.Intent); err != nil {
+		return fmt.Errorf("appstate: materialize apply (re-query by intent): %w", err)
+	}
+	if err := s.CollectGarbage(ctx, intent.App, []string{intent.Intent}); err != nil {
+		s.log.Warn().Err(err).Str("app", intent.App).Msg("appstate: garbage collection failed, continuing")
+	}
+	return nil
+}
+
+// StageApply writes a staged intent. No reservation or revision is
+// visible until CommitApply. It is one step of AcceptApply, exposed for
+// crash-recovery tests.
 func (s *Store) StageApply(ctx context.Context, intent domain.AppApplyIntent) error {
 	if err := checkCtx(ctx); err != nil {
 		return err
@@ -756,7 +777,8 @@ func (s *Store) StageApply(ctx context.Context, intent domain.AppApplyIntent) er
 	})
 }
 
-// CommitApply implements out.AppState: the single atomic commit point.
+// CommitApply is the single atomic commit point: staged→committed. It is
+// one step of AcceptApply, exposed for crash-recovery tests.
 func (s *Store) CommitApply(ctx context.Context, app, intentID string) error {
 	if err := checkCtx(ctx); err != nil {
 		return err
@@ -785,7 +807,8 @@ func (s *Store) CommitApply(ctx context.Context, app, intentID string) error {
 	})
 }
 
-// MaterializeApply implements out.AppState. Idempotent: safe to replay.
+// MaterializeApply finishes a committed intent. Idempotent: safe to
+// replay. It is one step of AcceptApply, exposed for crash-recovery tests.
 func (s *Store) MaterializeApply(ctx context.Context, app, intentID string) error {
 	if err := checkCtx(ctx); err != nil {
 		return err
@@ -948,7 +971,7 @@ func verifySupersedesLocked(bucket *bolt.Bucket, intent domain.AppApplyIntent) e
 	return nil
 }
 
-// LoadApplyIntent implements out.AppState.
+// LoadApplyIntent returns one apply intent by id.
 func (s *Store) LoadApplyIntent(ctx context.Context, app, intentID string) (domain.AppApplyIntent, error) {
 	if err := checkCtx(ctx); err != nil {
 		return domain.AppApplyIntent{}, err
@@ -994,7 +1017,7 @@ func loadApplyIntentLocked(bucket *bolt.Bucket, app, intentID string) (domain.Ap
 	return intent, nil
 }
 
-// ListIntents implements out.AppState.
+// ListIntents returns apply intent ids for recovery scans.
 func (s *Store) ListIntents(ctx context.Context, app string) ([]string, error) {
 	if err := checkCtx(ctx); err != nil {
 		return nil, err
@@ -1017,7 +1040,9 @@ func (s *Store) ListIntents(ctx context.Context, app string) ([]string, error) {
 	return ids, nil
 }
 
-// CollectGarbage implements out.AppState.
+// CollectGarbage removes staged orphans, applied intents, and
+// unreferenced revisions beyond retention. Referenced revisions
+// (desired/active/in-flight) are never evicted.
 func (s *Store) CollectGarbage(ctx context.Context, app string, inFlight []string) error {
 	if err := checkCtx(ctx); err != nil {
 		return err