Remove ControlPlane and migration-based flow compilation

[jumski]

Summary

Remove the ControlPlane edge function, every migration-based flow-compilation surface, and both options that bypass safe startup verification: compilation: false and production allowDataLoss.

Worker startup becomes the only supported deployment owner for flow definitions. A worker always sends the structural flow definition to Postgres, which compiles a missing concrete slug or verifies an existing one before registration or polling.

Remove

pkgs/cli

• Delete the pgflow compile command and its tests.
• Stop creating supabase/functions/pgflow/ during installation.
• Remove compile-command documentation and output.

pkgs/edge-worker

• Delete ControlPlane, its public export, server code, fixtures, and tests.
• Remove compilation: false; flow workers must always compile or verify before registration.

pkgs/dsl

• Remove the public SQL-text compileFlow() helper and its tests.
• Keep the flow-shape extraction used by startup compilation.

Documentation and examples

• Redirect manual-compilation and compile-API pages to startup compilation.
• Redirect the ControlPlane reference to the migration notice.
• Remove migration-based flow compilation from current examples and deployment guides.
• Rewrite versioning around startup deployment rather than generated migration files.
• Keep historical release-news pages intact and mark their APIs as obsolete in current versions.
• Remove installed and demo ControlPlane functions.
• Update package READMEs, architecture guides, generated indexes, and cross-links.

Canonical deployment path

worker starts
  -> sends concrete flow slug + structural flow definition
  -> Postgres takes the concrete-slug advisory lock
  -> missing definition: compile atomically
  -> matching definition: verify
  -> production mismatch: refuse to start
  -> local mismatch: quiesce old workers, delete runtime data, and recompile
  -> track the worker function
  -> register the worker instance
  -> poll

Compilation or verification must finish before track_worker_function() or worker-instance registration. A failed deployment must not enroll itself for automatic restart.

There must be no second implementation that converts a flow into independently deployable SQL.

Versioning after this change

A structural change uses a new concrete slug:

const greetUserV2 = new Flow({ slug: 'greetUserV2' })

Deploy the worker or complete worker set for V2. The first V2 worker compiles the missing definition during startup; later V2 workers verify the same definition. V1 workers and runs remain independent until they drain.

Startup may commit the definition before every worker in a multi-worker deployment is live. Durable queues hold work for a worker that starts later. Production deployment fencing is documented in #654.

Verification boundary

Startup verifies persisted structural shape and deployment metadata. It cannot detect handler-code changes or TypeScript input/output contract changes.

The versioning guide must continue to require a new concrete slug for semantic contract changes that shape comparison cannot observe.

Destructive recompilation fence

Production shape mismatches always fail. Remove the supported production allowDataLoss path.

Local destructive recompilation must use one tested quiescence sequence:

identify every old worker subscribed to the concrete flow
  -> deprecate them
  -> wait until they stop polling and finish callbacks
  -> delete runtime data and private queues
  -> compile the replacement definition
  -> track and register the new worker

The compiler advisory lock coordinates compilers only. Do not claim that it fences runtime workers.

Breaking-change notes

This removes public APIs and workflows:

• ControlPlane from @pgflow/edge-worker;
• pgflow compile;
• SQL migration generation through compileFlow();
• FlowWorkerConfig.compilation = false;
• production FlowWorkerConfig.compilation.allowDataLoss.

Existing generated migration files remain ordinary SQL in user repositories, but pgflow no longer generates or supports that deployment workflow.

Acceptance criteria

• Worker startup is the only supported owner of flow compilation and verification.
• Compilation or verification succeeds before worker-function tracking and worker-instance registration.
• A failed deployment cannot enter the automatic-restart set.
• ControlPlane code, exports, generated functions, tests, and current docs are removed.
• pgflow compile, its installation output, and its tests are removed.
• Public SQL-text flow compilation is removed.
• compilation: false and production allowDataLoss are rejected by the type system and runtime.
• Production mismatches always fail without deleting data.
• Local destructive recompilation deprecates and drains old workers before deletion.
• Versioning docs distinguish structural verification from undetectable handler and TypeScript contract changes.
• Removed pages redirect to startup compilation or the migration notice; historical release news remains intact.
• Startup-compilation tests cover missing, matching, local mismatch, production mismatch, quiesced destructive recompilation, and failed registration ordering.
• Release notes identify every removed public surface.

Out of scope

• Stable aliases.
• Per-step queues.
• Custom or shared queues.
• Changes to flow-shape semantics.