…t contract)

Applies the FAIL_PLAN v1 fixes for the #339/#340 bare-metal slice:

- B1 (blocking): carve the pure type-level DeployTargetPort 3-op -> 7-op
  contract expansion into a new front-loaded S0 (independently mergeable) —
  the rebase point for the sibling cloud adapters #342/#343 — so they are
  not serialized behind the bare-metal realization (now S8). Slices
  renumbered S0->S11; added LD-9 + the #357 -> S0 -> siblings merge order.
- N1: reframe WindowsServicePort as internal (not on the @netscript/cli JSR
  exports); no fabricated deno.json exports diff; genuine published surface =
  @netscript/config LinuxDeployTarget.
- N2: S2 renames all in-repo importers in the same commit.
- N3: F-1 is flag>500/fail>800, so upgrade-deploy-command.ts (312) needs no
  extraction; corrected stale 342 figures.
- N4: dispatch lane corrected to Opus 4.8 sub-agents.

Also tracks the eval record (plan-eval.md, port-ownership.md). Awaiting
PLAN-EVAL re-run. Planning-only; no product code.

Refs #339
Refs #340
Refs #327
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

…t contract)

Applies the FAIL_PLAN v1 fixes for the #339/#340 bare-metal slice:

- B1 (blocking): carve the pure type-level DeployTargetPort 3-op -> 7-op
  contract expansion into a new front-loaded S0 (independently mergeable) —
  the rebase point for the sibling cloud adapters #342/#343 — so they are
  not serialized behind the bare-metal realization (now S8). Slices
  renumbered S0->S11; added LD-9 + the #357 -> S0 -> siblings merge order.
- N1: reframe WindowsServicePort as internal (not on the @netscript/cli JSR
  exports); no fabricated deno.json exports diff; genuine published surface =
  @netscript/config LinuxDeployTarget.
- N2: S2 renames all in-repo importers in the same commit.
- N3: F-1 is flag>500/fail>800, so upgrade-deploy-command.ts (312) needs no
  extraction; corrected stale 342 figures.
- N4: dispatch lane corrected to Opus 4.8 sub-agents.

Also tracks the eval record (plan-eval.md, port-ownership.md). Awaiting
PLAN-EVAL re-run. Planning-only; no product code.

Refs #339
Refs #340
Refs #327
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

…t contract)

Applies the FAIL_PLAN v1 fixes for the #339/#340 bare-metal slice:

- B1 (blocking): carve the pure type-level DeployTargetPort 3-op -> 7-op
  contract expansion into a new front-loaded S0 (independently mergeable) —
  the rebase point for the sibling cloud adapters #342/#343 — so they are
  not serialized behind the bare-metal realization (now S8). Slices
  renumbered S0->S11; added LD-9 + the #357 -> S0 -> siblings merge order.
- N1: reframe WindowsServicePort as internal (not on the @netscript/cli JSR
  exports); no fabricated deno.json exports diff; genuine published surface =
  @netscript/config LinuxDeployTarget.
- N2: S2 renames all in-repo importers in the same commit.
- N3: F-1 is flag>500/fail>800, so upgrade-deploy-command.ts (312) needs no
  extraction; corrected stale 342 figures.
- N4: dispatch lane corrected to Opus 4.8 sub-agents.

Also tracks the eval record (plan-eval.md, port-ownership.md). Awaiting
PLAN-EVAL re-run. Planning-only; no product code.

Refs #339
Refs #340
Refs #327
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

…ter + deno compile) — PLAN (#364)

* docs(deploy): plan bare-metal deploy targets slice (#339 + #340)

Planning-only harness artifacts for the bare-metal deploy-target slice of
epic #327: OsServicePort + SystemdAdapter (#339) and the deno compile
single-binary artifact (#340), planned as one Archetype-7 slice. #341
(rollback/health-gate/OTEL/secrets) is out of scope.

Adds research.md, plan.md, worklog.md (Design checkpoint), and
context-pack.md under .llm/tmp/run/deploy-s3-baremetal/. Awaiting PLAN-EVAL.

Refs #327
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* docs(deploy): revise bare-metal plan per PLAN-EVAL v1 (front-load port contract)

Applies the FAIL_PLAN v1 fixes for the #339/#340 bare-metal slice:

- B1 (blocking): carve the pure type-level DeployTargetPort 3-op -> 7-op
  contract expansion into a new front-loaded S0 (independently mergeable) —
  the rebase point for the sibling cloud adapters #342/#343 — so they are
  not serialized behind the bare-metal realization (now S8). Slices
  renumbered S0->S11; added LD-9 + the #357 -> S0 -> siblings merge order.
- N1: reframe WindowsServicePort as internal (not on the @netscript/cli JSR
  exports); no fabricated deno.json exports diff; genuine published surface =
  @netscript/config LinuxDeployTarget.
- N2: S2 renames all in-repo importers in the same commit.
- N3: F-1 is flag>500/fail>800, so upgrade-deploy-command.ts (312) needs no
  extraction; corrected stale 342 figures.
- N4: dispatch lane corrected to Opus 4.8 sub-agents.

Also tracks the eval record (plan-eval.md, port-ownership.md). Awaiting
PLAN-EVAL re-run. Planning-only; no product code.

Refs #339
Refs #340
Refs #327
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* feat(config): add deploy.targets.linux config member (S1)

Add the `linux` sibling to the `deploy.targets` configuration surface for the
bare-metal Linux (systemd) deploy target, mirroring the shipped `windows`
member. This is the published-surface half of the bare-metal slice
(@netscript/config).

- Add LinuxDeployTarget interface (extends DeployTargetBase with
  systemctlPath/unitPrefix/installBase/user/group/runtimeDir) and wire it as a
  sibling `linux` key on DeployConfig.targets.
- Add LinuxDeployTargetSchema, which spreads deployTargetBaseShape (LD-5: no
  WindowsService->LinuxService inheritance, compose by spread), and wire
  `linux` into DeployConfigSchema.targets.
- Export LinuxDeployTarget + LinuxDeployTargetSchema from @netscript/config
  public mod.ts.
- Add ResolvedLinuxDeployConfig + resolveLinuxDeploy CLI resolver with
  Linux-sensible defaults (systemctl, /opt/netscript, x86_64-unknown-linux-gnu)
  that honors deploy.targets.linux overrides.
- Round-trip tests: config schema (windows+linux siblings, linux-only) and the
  CLI resolver (defaults + overrides). 5 passed / 0 failed.

Drift: config-file.v1.json is the vendored upstream Deno config schema and does
not schematize NetScript's deploy.targets (windows absent too), so no asset
entry was added; the contract is enforced by the @netscript/config Zod schemas.
Resolved base-config duplication vs windows is deferred to S7 (build-strategy
generalization). See drift.md D1/D2.

Refs #339 #340 #327

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* refactor(deploy): rename WindowsServicePort to OsServicePort (S2)

Generalize the Windows-only service lifecycle port into the OS-agnostic
`OsServicePort` seam that both the Windows (servy) and Linux (systemd) adapters
will satisfy. Clean rename with no deprecated shim (LD-2, alpha clean-break).

- Rename public/ports/windows-service-port.ts -> os-service-port.ts and the
  types WindowsService{Port,CommandResult,InstallRequest,Operation} ->
  OsService{Port,CommandResult,InstallRequest,Operation}.
- Update every in-repo importer in this same commit so `deno check` stays green
  (N2): adapters/servy-cli.ts (type refs only; the ServyCliAdapter class name is
  retained and evolves into ServyOsServiceAdapter at S3), the install/uninstall
  service-deploy handlers, and deploy_test.ts (RecordingWindowsServicePort ->
  RecordingOsServicePort). public-command-dependencies.ts imports the concrete
  ServyCliAdapter, whose name is unchanged, so it needs no edit here.

This is an internal-consumer rename: OsServicePort is not on the @netscript/cli
JSR export surface (`.`/`./scaffolding`/`./testing`), so there is no deno.json
exports diff (N1).

Gate: cli deno check 0 errors (539 files); deploy_test 4/4 steps green including
the servy-cli arg-mapping regression (Windows behaviour byte-identical).

Refs #339 #340 #327

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* refactor(deploy): evolve ServyCliAdapter to ServyOsServiceAdapter (S3)

Rename the Windows servy adapter to its OS-service identity and make it the
single source of truth for servy-cli argument construction, so port-driven and
command-layer invocations are provably byte-identical (F-12 naming; LD-1/LD-7).

- Rename public/adapters/servy-cli.ts -> servy-os-service.ts and the class
  ServyCliAdapter -> ServyOsServiceAdapter (+ options interface). Clean break,
  no shim (LD-2). Concrete-adapter importers updated in the same commit:
  public-command-dependencies.ts (import + field type + construction) and
  deploy_test.ts.
- Fold servy argument construction into shared builders in
  kernel/adapters/deploy/commands/servy-command.ts: add servyInstallArgs (new)
  alongside servyLifecycleArgs; the adapter now composes both instead of
  hand-rolling arg arrays. Structurally typed to avoid a kernel->public import
  of OsServiceInstallRequest.
- Extend the servy-path regression test to the full lifecycle matrix
  (install +--force, install without force, start/stop/status/uninstall),
  locking byte-identical args after the fold.

Scope boundary (drift D3): S3 folds servy *argument* construction into the
port/shared builders. The runServy *execution* free function is still consumed
directly by the start/stop/status commands and upgrade-steps.ts; routing those
call sites through the adapter necessarily edits the command files (S5's OS
routing/wiring slice) and upgrade orchestration, so the execution convergence is
deferred to S5. Arg strings are already unified here, which is what the
byte-identical guarantee requires.

Gate: cli deno check 0 errors (539 files); deploy_test 4/4 steps green including
the expanded servy arg-matrix regression.

Refs #339 #340 #327

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* feat(deploy): add systemd Linux OS-service adapter + unit renderer (S4)

Add the Linux bare-metal service-manager lane behind the OS-agnostic
`OsServicePort`, the systemd analogue of the Windows servy adapter (#340; LD-1,
LD-7, F-10). No routing/wiring yet (S5) and no target realization yet (S8) — this
slice is the self-contained Linux adapter + renderer.

- kernel/constants/linux.ts — canonical Linux defaults home mirroring
  constants/windows.ts: systemctl/journalctl paths, x86_64-unknown-linux-gnu
  compile triple, `netscript-` unit prefix, /opt/netscript install base,
  /run/netscript runtime dir, and systemd [Unit]/[Service]/[Install] defaults.
- kernel/adapters/linux/systemd/systemd-unit.ts — SystemdUnitConfig +
  renderSystemdUnit producing a well-formed `.service` unit (analogue of
  servy-xml.ts). Environment values escaped for systemd's quote/backslash
  parser; User/Group/RuntimeDirectory emitted only when provided.
- kernel/adapters/linux/systemd/systemd-command.ts — single source of truth for
  systemctl/journalctl args: fullUnitName, systemctlLifecycleArgs,
  systemctlEnableArgs (+--force), systemctlDisableArgs,
  systemctlDaemonReloadArgs, journalctlLogsArgs.
- public/adapters/systemd-os-service.ts — SystemdOsServiceAdapter implements
  OsServicePort. install = daemon-reload -> enable (fail-fast on reload); run
  maps start/stop/status -> lifecycle args and uninstall -> disable. Placed in
  public/adapters (not kernel/) for hexagonal-layer symmetry with the servy
  adapter, since it implements the public/ports seam (drift D4).

Tests: systemd_test.ts (renderer + arg builders) and
systemd-os-service_test.ts (adapter, RecordingProcessPort — byte-identical
systemctl invocation matrix + reload fail-fast) — 3 suites / 12 steps green.

Drift D4 (adapter directory corrected to respect layering), D5 (Linux default
consts duplicated with the S1 resolver; convergence deferred to S5/S7 base-config
consolidation — identical values, no behavioural drift).

Gate: cli deno check 0 errors (545 files); systemd tests 3 suites / 12 steps.

Refs #339 #340 #327

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* docs(deploy): checkpoint context-pack after S0-S4 (implement in progress)

Record S0-S4 committed/pushed/green with SHAs + drift D1-D5, and a precise
S5-S11 resume brief (OS-routing keystone notes, compile-tree move, build-strategy
split, registry realization + IMPL-3, e2e is Windows-only). PR #364 stays draft.

Refs #339 #340 #327

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* chore(harness): record b9e0ac9 in commits.md

Refs #339 #340 #327

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* refactor(deploy): route OS service lifecycle through OsServicePort (S5)

Converge the bare-metal deploy command layer onto the OsServicePort seam and
make service naming OS-agnostic, unblocking the Linux (systemd) lane.

- New kernel/adapters/deploy/runtime-detect.ts (pure): ServiceOs, detectServiceOs,
  fullServiceNameForOs (windows NetScript.<svc> / linux netscript-<svc>.service),
  serviceConfigFileName + serviceConfigPath (.xml / .service).
- New public/adapters/os-service-factory.ts: createOsServicePort(os, opts) →
  ServyOsServiceAdapter (windows) / SystemdOsServiceAdapter (linux).
- public-command-dependencies.ts: windowsServices: ServyOsServiceAdapter →
  osServices: OsServicePort via createOsServicePort(detectServiceOs()); deploy-group
  install/uninstall wiring updated.
- install/uninstall-service-deploy.ts: optional os?: ServiceOs (default detect);
  replaced hardcoded NetScript.<svc>+.xml with fullServiceNameForOs + serviceConfigPath.
- start/stop/status-deploy-command.ts: execute through the port (port.run) instead of
  the raw runServy free function (D3 convergence for the command layer). Windows guard +
  servy-tuned output parsing retained (drift D6); runServy stays for upgrade-steps.ts.
- Tests: runtime-detect_test.ts (5 steps); deploy_test.ts adds a linux-routing install
  case and pins existing windows cases to os:'windows'. 5 suites / 22 steps green.

Gate: cli deno check 0 (548 files); arch:check FAIL=0 for cli (layering intact).
Drift: D6 (guard/verbose boundary), D3 resolved for command layer, D5 still → S7.

Refs #339 #340 #327

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* chore(harness): append 7fe70af to commits.md

Refs #339 #340 #327

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* refactor(deploy): generalize compile pipeline to OS-generic single-binary (S6)

Relocate kernel/adapters/windows/compile/* -> kernel/adapters/deploy/compile/*
(git mv, history preserved) and make the deno compile pipeline OS-generic so the
same machinery emits a Windows .exe or a Linux ELF from the host (or an explicit
cross triple), unblocking #340 bare-metal artifacts.

- New compile-platform.ts: defaultCompileTarget() = host triple (Deno.build.target),
  binaryExtensionForTarget() = .exe only for *-windows-* triples. compile-runner now
  derives arch from the host by default (was hardcoded windows-msvc) and the output
  path extension from the triple (was hardcoded .exe). Byte-identical on a Windows
  host; Linux now yields an extension-less binary + Linux triple.
- Fix the one broken cross-import (runner v8-profiles -> ../../windows/runtime);
  all other relative imports keep depth. arch:check FAIL=0 (intra-kernel only).
- Update importers: package-cli-deploy-command.ts, build-windows-strategy.ts,
  build-windows-cli.ts. De-Windows header comments (comment-only).
- Tests: compile-platform_test.ts (3 steps). Relocated dir: 5 passed / 0 failed.
- Drift D7 (plan --include-as-is has no Deno 2.9 flag; --include already embeds
  assets, denort is automatic) + D8 (no deno:2.5 pin exists; denoland/deno:2 is
  live container config, not bare-metal's to remove) recorded as plan inaccuracies.

Gate: cli deno check 0, lint 0 on moved dir, arch:check FAIL=0, compile tests 5/0.

Refs #339 #340 #327

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* chore(harness): record 123b9e8 (S6 compile generalization) in commits.md

Refs #339 #340 #327

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* refactor(deploy): extract OS-neutral build orchestrator + dedupe linux consts (S7)

Generalize the deploy build path so a Linux (systemd) strategy can reuse the
Windows orchestration core without duplication.

- New public/features/deploy/build/prepare-deploy-build.ts: deployBuildDirs()
  (pure DEPLOY_DIRS layout) + prepareDeployBuild() (create layout, extract
  compile targets, apply --skip, topo-sort). OS-neutral core shared with the
  S8 Linux build path. buildWindowsDeployment now calls it instead of inlining
  the mkdir + extractCompileTargets + skip + topologicalSort block; Windows
  call sequence and stdout are byte-identical (dropped the now-unused join,
  DEPLOY_DIRS, extractCompileTargets, topologicalSort imports).
- D5: deploy-config-resolvers.ts stops re-declaring five DEFAULT_LINUX_*
  constants and imports the canonical ones from kernel/constants/linux.ts
  (identical values; resolveLinuxDeploy tests stay green).
- D2 base-default extraction re-sequenced to S8 (see drift.md): needs a shared
  structural type over two @netscript/config schemas and resolveWindowsDeploy
  has no direct unit test, so it cannot be proven green on a Windows-only host
  without the per-slice-forbidden E2E; benign identical-literal duplication.

Tests: new prepare-deploy-build_test.ts (cast-free, 2 tests). Gate: cli check 0
(465 files), deploy feature tests 3/5 steps, resolver tests 4/4, lint 0,
arch:check no FAIL.

Refs #339 #340 #327

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* chore(harness): record bf6d283 (S7 build-strategy generalization) in commits.md

Refs #339 #340 #327

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* feat(deploy): realize bare-metal service deploy-target registry (S8)

Evolve the WindowsServiceDeployTarget stub off the legacy-3 `operations`
hardcode onto the canonical 6-op surface (plan/emit/up/down/status/logs) and
add the LinuxServiceDeployTarget sibling, both composed from a new shared
`ServiceDeployTarget` base (centralizes the canonical ops + legacy
build/install/uninstall verb aliases per LD-3; mirrors the endorsed
base-plugin-service seam). rollback/secrets stay declared-unsupported (omitted,
LD-4, bodies -> #341). Register `linux-service` in DEFAULT_DEPLOY_TARGETS
alongside `windows-service` (KnownDeployTargetKey reservation now backed by a
concrete descriptor).

IMPL-3: update command-registry_test.ts operations assertion to the canonical
6-op array in the same commit that migrates the stub off the legacy-3 hardcode.

F-DEPLOY-1: add subset-declaration test (every declared op has a handler; legacy
aliases callable; rollback/secrets undefined) + default-registry scan
(both OS targets seeded, deterministic order) + a target-scoped result assertion.

As kernel-domain descriptors these adapters must not import the public
OsServicePort/build pipeline (hexagonal layering); real execution stays on the
public deploy-group path. Boundary recorded as drift D-S8.

Gate: cli check 0 errors, deploy-target + command-registry tests 11/11,
arch:check FAIL=0. packages/cli is check-only (excluded from root fmt/lint).

Refs #339 #340 #327

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* chore(harness): record S8 registry realization (commit c9f23ef)

Append S8 commit to commits.md; add worklog S8 entry + drift D-S8 (deploy-target
descriptor delegation bounded by hexagonal layering); re-sequence D2 base-default
extraction S8 → S9 (paired with resolveWindowsDeploy test backstop).

Refs #339 #340 #327

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* test(deploy): OS-routing e2e-lite + resolver base extraction (S9)

F-DEPLOY-2 OS-routing e2e-lite: new `os-service-factory_test.ts` proves the OS
decision (`detectServiceOs`), OS-appropriate naming (`fullServiceNameForOs`), and
port construction (`createOsServicePort`) agree — Windows → ServyOsServiceAdapter,
Linux → SystemdOsServiceAdapter — via a cast-free ProcessPort stub + instanceof.
(F-DEPLOY-2's thin-router import-graph and F-DEPLOY-1's subset-declaration are
otherwise `reviewed`/landed in S8; subset-declaration test shipped in c9f23ef.)

D2 base-default extraction (re-sequenced from S7/S8, with its green backstop):
- `resolved-config.ts`: new `ResolvedDeployBaseConfig` holding the 14 shared
  build/bundle/compile/health/logging/docker fields; `ResolvedWindowsDeployConfig`
  and `ResolvedLinuxDeployConfig` now `extend` it with only their OS-specific path
  fields (structurally identical shape — consumers unaffected).
- `deploy-config-resolvers.ts`: new private `resolveDeployBase(base, compileTargetDefault)`
  keyed on the sound `@netscript/config` `DeployTargetBase` input (both OS targets
  extend it — no fabricated structural type); both resolvers spread it and add
  OS-specific fields. Net -1 `as readonly string[]` cast (two folded into one).
- Backstop: new `resolveWindowsDeploy` defaults + overrides tests (mirroring the
  Linux ones) so the previously-untested Windows resolver is proven byte-stable
  through the extraction. Closes the D2 sequencing seam.

Gate: cli `deno check` 0 errors (555 files); resolver + routing + runtime-detect
tests 8/8; arch:check FAIL=0. packages/cli is check-only; no @netscript/config
files touched.

Refs #339 #340 #327

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* chore(harness): record S9 OS-routing tests + D2 resolution (commit 4751973)

Append S9 to commits.md; worklog S9 entry; drift D2 resolution (base-default
extraction landed via sound @netscript/config DeployTargetBase; D2/D5 seam closed).

Refs #339 #340 #327

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* docs(deploy): document OS-agnostic bare-metal deploy surface + debt (S10)

@netscript/cli README: bare-metal deployment section — OS-agnostic OsServicePort
(Servy/systemd), deno compile single-binary artifacts + OS-generic triple,
per-OS deploy.targets config, manual binary-signing hook, and the canonical
operation coverage (rollback/secrets declared-unsupported -> #341).

arch-debt: narrow cli-deploy-artifacts-missing to container/orchestrator lane
(#343); add cli-deploy-target-rollback-secrets-deferred (#341) and
cli-deploy-linux-integration-untested (Windows-only host gap).

IMPL-4: correct stale "342" file-size figure + tighten the OpenHands-minimax
dispatch-lane note in the run context-pack.

Refs #339 #340 #327

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* chore(harness): record S10 docs + arch-debt + IMPL-4 (commit 73287a7)

Refs #339 #340 #327

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* refactor(deploy-s3): drop redundant readonly cast in deploy-config-resolvers

Eval nit: `base.bundleExternal as readonly string[]` was an unnecessary
safe-widening cast (string[] is already assignable to readonly string[]);
the non-negotiable 2-cast policy forbids retaining any third cast as debt.
Removed the `as`; the ternary types cleanly. Verified `deno check` green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* test(deploy-s3): update deploy.targets tests for valid linux key (fix stale check-test)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>