Shared fleet logic behind narrow operator interfaces

The live preflight reads the relevant facet across every zone in the account, verifies that fleet membership is unchanged, reevaluates the latest saved intent, and refuses the entire row or policy action if any selected drift cell lacks a deterministic adapter. A cell action deliberately narrows only the action scope, not the account-wide membership and read check. Blocked controls render the exact reason in both the matrix and intent manager.

Canonical passthrough intent inspects serving DNS, every editable ruleset phase, Worker routes and custom domains, Pages domains, SSL for SaaS custom hostnames, load balancers, health checks, waiting rooms, Web3 hostnames, and snippets. Each extra resource carries its canonical owner in audit evidence. Missing coverage or an attachment without a reversible adapter blocks the complete alignment.

The Free rule expression cannot select a hostname, so the exact value includes both the http_ratelimit rule and every http_request_firewall_custom skip targeting that phase. Fresh alignment reads both phases. Creation and restoration place the skip first; scope changes disable the rate rule around the skip edit; removal deletes the rate rule first. Reversing a verified transition retains the same safety order.

Local and hosted CLI/MCP reads use one retrieval service. Activity summaries are filtered and paginated in D1 before transfer; standalone files are projected after loading. Exact resource discovery reads one zone and family, with detail endpoints for known IDs. Facet inspection reads the selected category across account zones so policy precedence and uniqueness retain their full context, then projects only the requested facet and zone. Observed values, policy composition, acknowledgement validity, and capability labels reuse the dashboard modules.

Pages bind their query and account to a stored revision or observed-content digest. Responses declare freshness, requested scope, incomplete coverage, and value truncation. They are live reads rather than retained snapshots; a changed revision requires restarting pagination. Collection pagination follows provider metadata and fails closed when it stalls or exceeds its bounds. Discovery cannot supply a cached substitute for the fresh planning and verification required by writes.

Cloudflare GET requests honor Retry-After after HTTP 429 responses. Both dashboard proxies preserve the upstream delay. Concurrent reads through the same API client recheck the shared cooldown before dispatch, so another response can extend a wait; cancellation stops waiting reads before another request. CLI and MCP reads use the same bounded retry behavior. An exhausted throttle aborts inventory collection instead of becoming an ordinary coverage gap, while mutation requests are never automatically retried.

Neither interface accepts arbitrary Cloudflare methods or paths. Complete fleet intent replacement is a separate local persistence operation with account, schema, revision, diff, digest, and lock checks; it cannot smuggle a Cloudflare request. The direct local process holds the configured token, so its host environment and outputs remain part of the trusted operator boundary.

If a planner cannot identify an exact writable endpoint, required dependency, or authoritative verification read, that path remains comparison-only. Fleet does not fall back to a generic write.