security: contain physical miner commands in Stage A

Disable physical control through legacy HTTP/M30 producers, typed admission,
queue dispatch and upgraded Windows executors. Restrict diagnostic transports
to exact read-only operations, with ordinal PowerShell validation before sockets.

Retire unsupported pending/claimed work with atomic, idempotent security audits.
Preserve prior delivery evidence and report unknown outcomes after a prior claim,
including explicitly repaired pending rows. Include containment, cancellation,
concurrency and malformed-payload regressions and the old-Agent cutover runbook.

Validation: independent final application-security revalidation PASS. Two unchanged
baseline source-assertion failures are documented as exceptions. Production release
still requires native Windows validation and verified fencing/stop/drain/upgrade;
server cancellation alone cannot revoke a cached command held by an old Agent.

agents/windows/tests/Test-MinerOpsOldAgentFence.ps1

@@ -0,0 +1,46 @@
+param(
+    [Parameter(Mandatory=$true)][string]$BaselineRoot,
+    [Parameter(Mandatory=$true)][string]$CachedPayloadPath,
+    [Parameter(Mandatory=$true)][string]$MinerIp,
+    [switch]$ExpectFenced
+)
+$ErrorActionPreference = "Stop"
+if ($env:MINEROPS_STAGE_A_SIMULATION -ne "1") {
+    throw "Requires an explicitly isolated Stage A simulation; never use physical targets."
+}
+
+# Supply a git-archived 2d89e80 Windows source directory, NOT a running installation.
+# Only AST function definitions execute; no startup, config loading, or task loops.
+$tokens = $null; $errors = $null
+$ast = [System.Management.Automation.Language.Parser]::ParseFile(
+    (Join-Path $BaselineRoot "MinerOpsAgentService.ps1"), [ref]$tokens, [ref]$errors)
+if ($errors.Count) { throw "Baseline parser error" }
+foreach ($definition in $ast.FindAll({
+    param($node)
+    $node -is [System.Management.Automation.Language.FunctionDefinitionAst] -and
+    $node.Parent -is [System.Management.Automation.Language.NamedBlockAst]
+}, $true)) {
+    Invoke-Expression $definition.Extent.Text
+}
+. (Join-Path $BaselineRoot "MinerOpsControl.ps1")
+function Read-AgentConfig {
+    return [pscustomobject]@{
+        api3_account = "simulation"; api3_password = "simulation-only"; api3_port = 4433
+    }
+}
+function Get-MinerOpsApi3Salt { return @{ salt = "simulation-only"; salt_response = @{} } }
+
+$payload = Get-Content -LiteralPath $CachedPayloadPath -Raw | ConvertFrom-Json
+if ($payload.action -ne "suspend") { throw "This simulation expects the audited cached suspend command" }
+# Remap ONLY the target to the address of the dedicated disposable miner container.
+$payload.ip_address = $MinerIp
+$result = Run-MinerControlCommand -Payload $payload
+if ($ExpectFenced) {
+    if ($result.command_accepted -ne $false -or $result.failure_code -ne "write_rejected") {
+        throw "Old executor unexpectedly reached/accepted a simulated miner through the fence"
+    }
+    Write-Host "Fenced old cached command failed; independently verify simulator write count stayed zero."
+} else {
+    if ($result.command_accepted -ne $true) { throw "Unfenced control simulation did not reproduce old execution" }
+    Write-Host "Unfenced old cached command reproduced; simulated miner received service stop."
+}