feat(cloudflare): qualify native Bricks runtime compatibility

[TyMac20]

This adds native Bricks authoring and protected previews to the Cloudflare WordPress runtime. A staged native artifact can initialize an operator-prepared site, create a revision, and restore retained native content through the existing D1 lease/CAS coordinator. Native Bricks documents, design resources and WordPress media survive reconstruction from D1/R2.

Implementation

• Preserve native _bricks_* and required _wp_* metadata, R2-only manifest entries and tombstones. Hydrate integrity-checked uploads and PHP-required theme files while serving browser assets from R2. Version both edge and persisted render caches when runtime behavior changes.
• Adapt Bricks ID generation to the Workers clock, preserve Settings initialization required by native controls, and correct SQLite DISTINCT naming and multi-table DELETE aliases. License injection remains secret-backed; license enforcement is unchanged.
• Add immutable, SHA-verified artifact staging at PUT /v1/bricks/artifacts/{sha256}, native provisioning at POST /v1/bricks/sites, revision/restore endpoints, and operation polling. Requests bind the runtime package, native artifact, customer/site identity, source provenance and exact canonical base. Restore produces a new monotonic revision, with explicit restored-from and pre-restore pointers.
• Provisioning initializes native documents in a declared operator-prepared empty allocation. It does not create Cloudflare resources or install Bricks within the Worker request. A preparation/export script builds the pinned runtime and verified restore pack outside Worker request limits.
• Serve receipt-bound previews through the owning principal and current site lifecycle/generation. Raw native host access is denied, stale previews are rejected, and preview responses are private/no-store. Ready previews carry protected_preview receipts; editor acceptance remains false and all client-acceptance steps remain not_run.
• Reduce native persistence allocations by retaining the immutable runtime package, avoiding thousands of R2 refetches, releasing PHP before packing canonical state, and disabling OPCache file caching for reconstructed native runtimes. Use PHP’s system allocator for native runtimes, reducing measured WASM memory; PHP allocator counters are explicitly unavailable in this mode. The code uses normal PHP execution and rendering.

Verified behavior and evidence

The actual Build artifact producer and writer completed the following against the existing disposable Worker with real D1/R2 resources:

Operation	Canonical version	Verified result
Provision	3	Native page/header/footer/design/media state and expected rendered heading
Revise	4	Changed native heading, exact-base admission and ready protected preview
Restore	5	New revision identity with the original native document hashes and design-system version

Every operation passed terminal receipt verification, immutable replay, operation polling and authenticated native preview observation. A stale mutation base returned 409. Preview access checks returned 401 without credentials, 409 for a stale receipt, 405 for a write, and 404 on the raw native hostname. The original provision receipt remains its immutable historical draft.

Runtime source 2f851aa136cb0a20a0bed1c456a6469c12767ba6 was then uploaded as Worker preview version 5e5b9b92-3593-494b-83be-9fda4b7348cc. A fresh runtime reconstructed the restored revision solely from D1/R2: desktop and mobile rendered 19 native elements, two loaded fixture images and no horizontal overflow. Inspected screenshots were byte-identical across the Worker version change. This supersedes the earlier outstanding second-version reconstruction item for the API fixture.

Tracked evidence at fd4775e974239de81092356223c78bb4836291db:

• Remote API fixture report, exact operation/resource receipts, and cold reconstruction receipt.
• Desktop screenshot and mobile screenshot.
• Earlier local PHP/D1/R2 rehearsal.
• Separate public-render/media proof: the unchanged desktop/mobile assertions passed with 42 native elements, four sections and four loaded images on the normal canary root.

Validation: package TypeScript build, 144 runtime tests and two package boundary tests passed; the runtime checks include the 14 focused native/preview tests. Actual local PHP-WASM and remote Worker rehearsals passed. The full package command was attempted; the canonical MDI seed-regeneration test requires a host php executable, which is unavailable. That single test was excluded from the 144-test run. Earlier package/Wrangler dry-run evidence remains recorded separately.

Remaining qualification

• The legitimate licensed visual editor and the Editor-role edit -> publish -> public observation -> restore -> reopen transaction remain unqualified. The agency license prerequisite is still open in the tracked evidence. Programmatic authoring and restore do not establish client editability.
• The Worker memory gate fails. A logged normal-canary run now provides real CPU, wall, V8 isolate memory, WASM memory and shared-resource D1/R2 counts. Native-only system allocation reduced preview WASM memory from 139,198,460 to 80,543,740 bytes and CPU from roughly 5–6.9 seconds to 3.0–3.3 seconds. However, total isolate samples remain 184,273,280–192,740,510 bytes, above 128 MiB. HTTP 200 does not clear this gate. The latest real native revision (version 8), restoration (new version 9), rendered headings, replay and polling all pass on Worker 7657aa45-c5f2-4ac5-ab0c-783544bc3452, source 0bd5103e. Default canonical content and the separately owned engine/sales namespaces remain unchanged. See the exact baseline telemetry, local allocation profile, and allocator follow-up with actual Worker measurements. Further retained-memory reduction remains required.
• The API fixture uses placeholder pixel media and no bundled fonts. Its screenshots establish rendering/reconstruction mechanics, not generated-site design acceptance. The separate earlier public fixture still has a low-contrast project section. Actual product-engine and sales-service rehearsals were handed separate empty native allocations and are tracked outside this fixture proof.

This remains an opt-in prototype under qualification. General Build target enablement, licensed editor acceptance and production release gates are outstanding. The existing customer static preview has not been migrated or published through this native target.