security: contain physical miner commands in Stage A

Disable physical control through legacy HTTP/M30 producers, typed admission,
queue dispatch and upgraded Windows executors. Restrict diagnostic transports
to exact read-only operations, with ordinal PowerShell validation before sockets.

Retire unsupported pending/claimed work with atomic, idempotent security audits.
Preserve prior delivery evidence and report unknown outcomes after a prior claim,
including explicitly repaired pending rows. Include containment, cancellation,
concurrency and malformed-payload regressions and the old-Agent cutover runbook.

Validation: independent final application-security revalidation PASS. Two unchanged
baseline source-assertion failures are documented as exceptions. Production release
still requires native Windows validation and verified fencing/stop/drain/upgrade;
server cancellation alone cannot revoke a cached command held by an old Agent.

backend/tests/test_agent_zones_postgres.py

@@ -2,6 +2,7 @@
 
 import unittest
 from uuid import UUID
+from unittest.mock import patch
 
 import psycopg
 from psycopg.errors import ForeignKeyViolation, UniqueViolation
@@ -10,6 +11,8 @@ from app.agent_zones.repository import AgentZoneRepository
 from app.config import settings
 from app.miner_control.repository import MinerControlRepository
 from app.miner_control.service import MinerControlService
+from app.miner_control.exceptions import MinerControlUnavailable
+from app.agent_commands.policy import PHYSICAL_CONTROL_DISABLED
 
 
 SITE_A = UUID("00000000-0000-4000-8000-000000001630")
@@ -34,6 +37,29 @@ def connect():
 
 
 class AgentZonePostgresTests(unittest.TestCase):
+    def assert_stage_a_unavailable(self, expected_zone, expected_agent):
+        repository = MinerControlRepository(connect)
+        context = repository.get_control_context(MINER_UNASSIGNED)
+        # Check actual routing facts independently of the unconditional Stage A
+        # reason. A changed assertion must not hide a Site fallback regression.
+        self.assertEqual(context["agent_zone_id"], expected_zone)
+        self.assertEqual(context["agent_id"], expected_agent)
+        projection = MinerControlService(repository).get_controls(MINER_UNASSIGNED)
+        for capability in (projection.service_control, projection.performance_mode_control):
+            self.assertEqual(capability.state, "unavailable")
+            self.assertEqual(capability.reason, PHYSICAL_CONTROL_DISABLED)
+        self.assertIsNone(projection.available_service_action)
+        with patch.object(repository, "enqueue_with_audit") as enqueue:
+            for action, value in (("suspend", None), ("resume", None), ("performance_mode", "high")):
+                with self.assertRaisesRegex(MinerControlUnavailable, PHYSICAL_CONTROL_DISABLED):
+                    MinerControlService(repository).queue_control(
+                        MINER_UNASSIGNED, action, requested_value=value,
+                        actor_user_id=UUID("00000000-0000-4000-8000-000000001639"),
+                        actor_username="zone-containment-test",
+                    )
+            enqueue.assert_not_called()
+        return context
+
     @classmethod
     def setUpClass(cls):
         connection = connect()
@@ -203,10 +229,8 @@ class AgentZonePostgresTests(unittest.TestCase):
         finally:
             connection.close()
         try:
-            projection = MinerControlService(MinerControlRepository(connect)).get_controls(
-                MINER_UNASSIGNED
-            )
-            self.assertEqual(projection.service_control.reason, "agent_zone_disabled")
+            context = self.assert_stage_a_unavailable(ZONE_A, AGENT_A)
+            self.assertFalse(context["agent_zone_enabled"])
         finally:
             connection = connect()
             try:
@@ -228,16 +252,10 @@ class AgentZonePostgresTests(unittest.TestCase):
             connection.commit()
         finally:
             connection.close()
-        projection = MinerControlService(MinerControlRepository(connect)).get_controls(
-            MINER_UNASSIGNED
-        )
-        self.assertEqual(projection.service_control.reason, "agent_unavailable")
+        self.assert_stage_a_unavailable(ZONE_C, None)
 
     def test_null_zone_does_not_fall_back_to_site_agent(self):
-        projection = MinerControlService(MinerControlRepository(connect)).get_controls(
-            MINER_UNASSIGNED
-        )
-        self.assertEqual(projection.service_control.reason, "agent_zone_unassigned")
+        self.assert_stage_a_unavailable(None, None)
 
 
 if __name__ == "__main__":