security: contain physical miner commands in Stage A

Disable physical control through legacy HTTP/M30 producers, typed admission,
queue dispatch and upgraded Windows executors. Restrict diagnostic transports
to exact read-only operations, with ordinal PowerShell validation before sockets.

Retire unsupported pending/claimed work with atomic, idempotent security audits.
Preserve prior delivery evidence and report unknown outcomes after a prior claim,
including explicitly repaired pending rows. Include containment, cancellation,
concurrency and malformed-payload regressions and the old-Agent cutover runbook.

Validation: independent final application-security revalidation PASS. Two unchanged
baseline source-assertion failures are documented as exceptions. Production release
still requires native Windows validation and verified fencing/stop/drain/upgrade;
server cancellation alone cannot revoke a cached command held by an old Agent.

agents/windows/README.md

@@ -1,7 +1,44 @@
 # MinerOps Windows Agent
 
+## Stage A physical-control containment
+
+Physical miner control is disabled in this version, including suspend, resume,
+performance-mode changes, reboot, M30 tests, and miner-side password changes.
+No environment flag, configured API3 credential, or Agent capability report can
+enable it. This is containment, not completion of Blocker #3 identity binding.
+
+The Hub returns HTTP 410 for retired legacy command, scheduling, and unrestricted
+diagnostic endpoints (after authorization where applicable). Typed control POSTs
+require `miners.control` and return HTTP 409 `physical_control_disabled_stage_a`.
+The unrestricted `whatsminer-read-test` endpoint is not a supported read-only tool.
+
+Authenticated queue polling cancels pending/claimed physical and unknown command
+types, records an atomic `agent.command.rejected` audit entry, and only delivers
+fixed telemetry/discovery command types. Results cannot promote retired entries.
+Original payloads, prior results/errors, timestamps, and terminal history remain.
+Cancellation of an already claimed command does **not** prove it was never sent;
+the audit explicitly records its previous execution outcome as unknown.
+
+The Windows executor rejects all current physical-control schemas without any
+device connection and advertises physical control as unavailable. Existing Agents
+must be stopped/drained and upgraded before claiming fleet-wide containment:
+server cancellation cannot recall payloads cached by older running Agents.
+Do not enable control or deploy this work before separate security review.
+The ordered, fail-closed procedure is in
+[the Stage A old-Agent cutover runbook](../../docs/operations/STAGE_A_OLD_AGENT_CUTOVER.txt).
+Native Windows PowerShell 5.1/SYSTEM validation and verified fleet network fencing
+remain production gates; server cancellation alone cannot contain an old executor.
+
+Retained legacy/API3 enrichment helpers validate exact read commands and fixed
+parameters before opening a socket. Unknown operations and extra keys fail closed.
+Schedule cancel/delete require `miners.control` and retire matching live unsupported
+commands for the stored Agent with atomic actor-attributed rejection audits.
+Deletion retains schedule history; retries do not duplicate audits. Previously
+claimed execution remains unknown. Manual cutover retirement does not claim read
+work and must sweep offline/queue-only Agent IDs until the global live count is zero.
+
 The Windows Agent runs at a mining site and performs local discovery, polling,
-API3 enrichment, pool polling, and approved queued miner-control operations.
+API3 enrichment, and pool polling. Physical miner control is disabled in Stage A.
 MinerOps does not send API3 credentials through the hub command queue; those
 credentials remain in the Agent's local `agent-config.json`.