Fence Cloudflare mutations for lossless D1 cutover

[chubes4]

Parent: #1970

Goal

Activate the merged exact-state adoption contract and move the live Cloudflare runtime from Durable Object coordination to D1 without a source mutation racing export, adoption, or promotion.

Scope

• deploy adoption support while retaining Durable Object coordination
• add an authenticated bounded source mutation fence with explicit acquisition, status, expiry, and release semantics
• provision/configure production D1
• export and adopt the exact live pointer/version under the fence
• verify pointer, version, commit receipt, and R2 manifest parity
• promote the D1-backed Worker and prove a canonical N+1 mutation/publication
• preserve and prove a symmetric rollback path

Acceptance

No mutation can commit between source export and target promotion. D1 starts at the exact live version, the first D1 write commits N+1, public routes remain available, and rollback evidence is reproducible.

[chubes4]

Implementation PR opened: #1977.

The PR adds the shared DO/D1 mutation-fence contract, authenticated coherent cutover status, renewable publication leases, documentation, and passing production-shaped gates for both coordinator profiles.

The issue remains open for the operator phase after merge: deploy the DO-backed build, provision/configure D1, fence/export/adopt/verify/promote production, prove N+1, and capture rollback evidence.

[chubes4]

Production cutover completed on 2026-07-23.

Final production

• URL: https://wp-codebox-cloudflare-runtime.chubes.workers.dev/
• Active Worker version: a5c2cdfc-26e4-4097-83e3-20ccdb1703d2
• Source revision: 2b5e1ed14f791c6edf5db2224ccdfc1225f7691e
• Active coordinator: D1 25858208-50ff-46f4-b79d-458f2f6f93c4
• Final canonical state: version 36, revision 29542b72-06e4-4ef8-ad8d-c5fa00fa0fc9, coherent and unfenced
• Publication: b00aacf8-f82a-4eff-b600-8675e7f18537, canonical version 36, routes / and /2026/07/23/cloudflare-r2-proof-1/
• Published proof route serves through x-wp-codebox-page-cache-source: publication-r2
• Health passes on WordPress 7.0.2 / PHP 8.5.8

Lossless cutover evidence

1. DO was fenced and exported coherently at version 35, revision 49488d90-1680-4a76-ae78-d78dd046bc31.
2. Empty D1 adopted that exact pointer/version and was fenced before promotion.
3. Production promoted to D1 while anonymous R2 publication remained available.
4. The first D1 mutation committed exactly N+1: version 36, revision 29542b72-06e4-4ef8-ad8d-c5fa00fa0fc9.
5. The version-36 route was rendered and promoted through immutable R2 publication.

Rollback evidence

The D1 profile now retains the historical DO class and namespace as an operator-only dormant coordinator. With active D1 fenced, the dormant DO was independently fenced and advanced from version 35 to the exact D1 version 36 using the matching target fence token. Both status envelopes were coherent and identical before release:

• active: d1, version 36, revision 29542b72-06e4-4ef8-ad8d-c5fa00fa0fc9
• rollback target: durable-object, version 36, same revision

Both are now unfenced; D1 remains active. Cloudflare version rollback therefore has an exact state-matched DO target rather than stale version 35.

Control-plane and compatibility repairs

• Initial fence/cutover implementation: Fence Cloudflare coordinator cutovers #1977
• Site isolation: Scope Cloudflare state by site identity #1981
• Deterministic D1 provisioning/config: Provision Cloudflare D1 coordinator deterministically #1987, Make emitted D1 configs portable #1988, Preserve glob strings in generated D1 config #1989
• Mixed-version DO class compatibility: Preserve Durable Object class during D1 cutover #1994
• Dormant coordinator synchronization and fenced monotonic adoption: Preserve lossless D1 rollback state #1996
• Homeboy Cloudflare deployment repairs: Add bounded Cloudflare predeploy commands Extra-Chill/homeboy-extensions#2373, #2374, #2376, #2378

All production deploys ran through the Homeboy Cloudflare extension with immutable source checks, binding preflight, redacted evidence, HTTP gates, and automatic rollback on failed gates. Controlled failed attempts restored the prior healthy version. The temporary cutover Worker was deleted after synchronization and now returns 404.