fix: keep refresh and frozen IAM setup-owned

[alongubkin]

Summary

• add a planning-free executor refresh path and use it for Running deployment health ticks
• keep normal runtime updates scoped to Live resources; Frozen changes require the setup handoff
• prevent AWS runtime resource controllers from attaching resource-scoped data policies and reject exact grants to Live AWS resources

Why

A periodic refresh planned desired-release drift as an update. That scheduled unchanged Frozen storage controllers, whose update path attempted iam:PutRolePolicy against the setup-owned content service-account role. The management role correctly lacked that privilege.

Validation

• cargo test -p alien-preflights --lib (259 passed)
• cargo test -p alien-infra --all-features test_refresh_does_not_plan_config_changes --lib
• cargo check -p alien-deployment --all-features
• git diff --check

The default-feature alien-infra lib test target is currently broken on main by cloud modules compiled without their feature-gated dependencies; validation used the full cloud feature set.

[greptile-apps]

Frozen removals leave stale state

When a setup re-import removes a Frozen resource, import persistence retains the absent resource in StackState, and this Live-only executor no longer reconciles it. The update therefore reports success while subsequent dependency checks and health observations use state for a resource that setup already removed.

Knowledge Base Used: Deployment Engine (alien-deployment)

Prompt To Fix With AI

This is a comment left during a code review.
Path: crates/alien-deployment/src/updating.rs
Line: 299

Comment:
**Frozen removals leave stale state**

When a setup re-import removes a Frozen resource, import persistence retains the absent resource in `StackState`, and this Live-only executor no longer reconciles it. The update therefore reports success while subsequent dependency checks and health observations use state for a resource that setup already removed.

**Knowledge Base Used:** [Deployment Engine (alien-deployment)](https://app.greptile.com/alien/-/custom-context/knowledge-base/alienplatform/alien/-/docs/deployment-engine.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Greptile Summary

The PR separates runtime reconciliation from setup-owned infrastructure management.

• Adds a planning-free executor refresh path for Running deployment health ticks.
• Restricts ordinary updates to Live resources and reserves Frozen changes for setup handoff.
• Replaces imported stack state atomically while preserving omitted Live controller state, allowing setup-omitted Frozen state to be removed.
• Tightens AWS runtime resource policy handling and preflight validation for Live AWS resource grants.

Confidence Score: 5/5

The PR appears safe to merge.

The previously reported stale Frozen-state issue is resolved because the import route preserves only omitted Live resources and the SQLite store persists the resulting complete state without merging old Frozen entries back in; no blocking failure remains.

Important Files Changed

Filename	Overview
crates/alien-manager/src/routes/stack.rs	Re-import merging now preserves omitted Live controller state while allowing setup-omitted Frozen resources to disappear from the authoritative state.
crates/alien-manager/src/stores/sqlite/deployment.rs	Imported stack state now replaces the persisted snapshot rather than re-merging stale setup-owned resources.
crates/alien-deployment/src/updating.rs	Runtime update execution is restricted to Live resources and clears setup authorization after convergence.
crates/alien-infra/src/core/executor.rs	Introduces a planning-free refresh operation that steps persisted controllers without applying desired-state transitions.
crates/alien-deployment/src/running.rs	Running health ticks now use planning-free refresh and map controller failure states to RefreshFailed.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Setup["Setup re-import"] --> Merge["Merge imported setup state"]
  Existing["Existing StackState"] --> Preserve["Preserve omitted Live state"]
  Merge --> Complete["Complete ownership-aware StackState"]
  Preserve --> Complete
  Complete --> Persist["Replace persisted StackState"]
  Persist --> Runtime["Runtime update reconciles Live resources"]
  Persist --> Frozen["Frozen resources remain setup-owned"]

Loading

_{Reviews (2): Last reviewed commit: "fix: drop removed frozen state on reimpo..." | Re-trigger Greptile}