Record low-risk bbolt bucket coverage

Update Phase C docs with the next record-level storage slice: static objects, Worker scripts, plugin lifecycle records, and approvals now have tested bbolt APIs, while runtime storage and secret-bearing buckets remain explicitly pending.

Constraint: Docs must keep JSON as the default store until the startup path changes
Rejected: Call record-level storage complete | task/monitor/tunnel and secret-bearing buckets remain uncovered
Confidence: high
Scope-risk: narrow
Directive: Do not document DDNS/OIDC/notify/users/tokens as record-level ready until encryption tests exist
Tested: git diff --cached --check; cross-checked lattice-server main still uses store.OpenWithCipher
Not-tested: Rendered docs site

Author: lr00rl

docs/PRODUCT-VISION.md

@@ -17,12 +17,12 @@ The bar is not "works." The bar is **惊艳 — a product that makes a self-host
 | **P1 · Trust** | Secure by default, fail-closed, auditable, nothing to misconfigure into insecurity | Strong: RBAC, rate-limit, signed plugins (fail-closed), tamper-evident audit WAL, 2FA, at-rest encryption |
 | **P2 · Identity** | Password + 2FA + SSO; the front door is frictionless and enterprise-ready | Password ✅ + TOTP 2FA ✅ + OIDC/SSO backend/UI ✅; **2FA policy + WebAuthn groundwork next** |
 | **P3 · Platform** | A real plugin system — install, verify, run, and extend safely; a marketplace of official + community plugins | Manifest + signing ✅, loader ✅, preflight verify ✅, host-API broker + server adapter ✅, lifecycle registry/API/UI ✅, runtime manager + runner contract ✅; **plugin artifacts don't execute yet** |
-| **P4 · Scale & durability** | Survives growth and crashes; backup/restore is a non-event | JSON state + at-rest encryption + audit WAL ✅; bbolt import/export + JSON migration/rollback CLI ✅; first record-level APIs ✅; **default store still whole-file JSON** |
+| **P4 · Scale & durability** | Survives growth and crashes; backup/restore is a non-event | JSON state + at-rest encryption + audit WAL ✅; bbolt import/export + JSON migration/rollback CLI ✅; record-level APIs for low-risk buckets ✅; **default store still whole-file JSON** |
 | **P5 · Experience (惊艳)** | A dashboard that is fast, legible, real-time, and beautiful; onboarding that takes minutes | Functional zero-dep dashboard with SSO + plugin lifecycle panels; **many endpoints still have no UI; design layer immature** |
 
 ## 3. Honest current state (2026-06-12)
 
-Delivered and pushed: control plane + node agent + SDK + dashboard across 6 repos; security hardening; DDNS, monitoring, notifications, WireGuard mesh, CF Tunnel; plugin manifest/signing + loader + preflight verify + host-API broker/server adapter + lifecycle registry/API + dashboard panel + runtime manager + runner contract; TOTP 2FA; tamper-evident audit WAL; node-token rotation; bounded task execution; **AES-256-GCM at-rest encryption** (ADR-002); bbolt state import/export foundation with explicit JSON migration/rollback CLI and first record-level APIs for nodes, KV, and audit events. Minimal external Go deps are currently limited to the OIDC stack approved in ADR-001 (`oauth2`, `go-oidc`, transitive `go-jose`) plus bbolt for Phase C storage; still zero CGo. `go test -race` green; dashboard tests green.
+Delivered and pushed: control plane + node agent + SDK + dashboard across 6 repos; security hardening; DDNS, monitoring, notifications, WireGuard mesh, CF Tunnel; plugin manifest/signing + loader + preflight verify + host-API broker/server adapter + lifecycle registry/API + dashboard panel + runtime manager + runner contract; TOTP 2FA; tamper-evident audit WAL; node-token rotation; bounded task execution; **AES-256-GCM at-rest encryption** (ADR-002); bbolt state import/export foundation with explicit JSON migration/rollback CLI and record-level APIs for low-risk buckets (nodes, KV, audit, static, Workers, plugin lifecycle, approvals). Minimal external Go deps are currently limited to the OIDC stack approved in ADR-001 (`oauth2`, `go-oidc`, transitive `go-jose`) plus bbolt for Phase C storage; still zero CGo. `go test -race` green; dashboard tests green.
 
 The three gaps that most separate us from 惊艳, in dependency order: **identity policy polish**, **the platform actually running plugins**, and **a storage engine that scales** — plus a **dashboard worthy of the backend**.
 
@@ -43,7 +43,7 @@ Each phase has an exit bar. Phases ship as tested, reviewed, committed slices (t
 - **Exit:** a signed plugin installs, runs, is capability-confined, and its host calls are brokered + audited. Foundation for the user's own LatticeNet/* official plugins (sing-box/xray/sub-store).
 
 ### Phase C — Storage that scales  *(item ④, next high-leverage backend slice)*
-- C1 · **Replace the whole-file JSON store with bbolt** (pure Go, preserves zero-CGo). Import/export + JSON migration/rollback CLI ✅; first record-level APIs for nodes/KV/audit ✅; broader per-bucket record writes, the at-rest encryption boundary (ADR-002) re-homed onto the default store, audit WAL head anchoring, and backup/restore still pending.
+- C1 · **Replace the whole-file JSON store with bbolt** (pure Go, preserves zero-CGo). Import/export + JSON migration/rollback CLI ✅; record-level APIs for low-risk buckets ✅; secret-bearing bucket writes, the at-rest encryption boundary (ADR-002) re-homed onto the default store, audit WAL head anchoring, and backup/restore still pending.
 - C2 · crash-safe migration from the JSON file, JSON export/import, retention policy for high-volume audit/monitor results.
 - **Exit:** writes are O(record) not O(state); a 10k-node/long-audit deployment stays responsive; crash-safe.
 - **Timing note:** done after A/B so it migrates a known-stable schema; the fresh at-rest boundary is re-homed deliberately, not rushed.

docs/iterations/iter-012-bbolt-low-risk-buckets.md

@@ -0,0 +1,89 @@
+# Iteration 012 - bbolt Low-Risk Bucket Coverage
+
+- **Date:** 2026-06-13
+- **Phase:** C1 storage foundation
+- **Repos:** `lattice-server`, `lattice`
+- **Status:** Verified low-risk bucket record APIs / default store not switched
+
+## Goal
+
+Extend the bbolt record-level foundation beyond nodes/KV/audit while avoiding
+secret-bearing buckets. This slice adds record-level APIs for static objects,
+Worker scripts, plugin lifecycle records, and approvals.
+
+## Scope
+
+- Add record-level static object writes and bucket reads:
+  - `PutStatic`
+  - `Static`
+- Add record-level Worker writes and reads:
+  - `UpsertWorker`
+  - `Workers`
+- Add record-level plugin lifecycle writes and reads:
+  - `UpsertPluginInstallation`
+  - `PluginInstallation`
+  - `PluginInstallations`
+  - `SetPluginStatus`
+- Add record-level approval writes and reads:
+  - `UpsertApproval`
+  - `Approval`
+  - `Approvals`
+- Preserve current JSON-store behavior:
+  - static objects sorted by path
+  - Workers sorted by name
+  - plugin lifecycle sorted by id
+  - approvals sorted newest first
+  - plugin status transition validation reused
+- Keep writes local to their bbolt buckets; record-level writes must not reset
+  unrelated imported buckets.
+
+## Non-Goals
+
+- Do not switch `cmd/lattice-server` to bbolt.
+- Do not add `-data-engine=bolt` yet.
+- Do not add record-level writes for DDNS, notification channels, OIDC providers,
+  TOTP challenges, users, tokens, or sessions yet.
+- Do not migrate or anchor the audit WAL into bbolt yet.
+
+## Security Notes
+
+- This slice still avoids reversible secret fields. Static content and Worker
+  source can contain operator-provided sensitive text, but the current JSON store
+  already persists those fields as ordinary state; this change does not widen
+  their exposure or route runtime traffic to bbolt.
+- Secret-bearing per-record methods must be added with field-specific encryption
+  tests before they are considered ready.
+- Plugin lifecycle reads clone capability slices so callers cannot mutate a
+  returned slice and accidentally affect future in-memory state assumptions.
+
+## Verification
+
+Targeted tests added in `lattice-server/internal/store/bolt_state_test.go`:
+
+- static, Worker, plugin lifecycle, and approval record-level writes work after
+  a full import.
+- plugin lifecycle transition validation is preserved.
+- plugin capability slices are cloned on read.
+- records keep JSON-store ordering semantics.
+- record-level writes do not reset unrelated buckets.
+- records persist across close/reopen.
+
+Commands run:
+
+```sh
+GOCACHE=/tmp/lattice-review-go-build GOWORK=/Users/cdcd/roobli/RTFS_justTaste/Probe-Dashboards/Lattice/lattice/go.work go test ./internal/store -run TestBoltState -count=1
+GOCACHE=/tmp/lattice-review-go-build GOWORK=/Users/cdcd/roobli/RTFS_justTaste/Probe-Dashboards/Lattice/lattice/go.work go test ./internal/store -count=1
+GOCACHE=/tmp/lattice-review-go-build GOWORK=/Users/cdcd/roobli/RTFS_justTaste/Probe-Dashboards/Lattice/lattice/go.work go test ./... -count=1
+GOCACHE=/tmp/lattice-review-go-build GOWORK=/Users/cdcd/roobli/RTFS_justTaste/Probe-Dashboards/Lattice/lattice/go.work go vet ./...
+GOCACHE=/tmp/lattice-review-go-build GOWORK=/Users/cdcd/roobli/RTFS_justTaste/Probe-Dashboards/Lattice/lattice/go.work go test -race ./... -count=1
+```
+
+## Residuals
+
+- Remaining low/medium-risk buckets: tasks, task results, monitors, monitor
+  results, tunnels.
+- Secret-bearing buckets need field-specific encryption tests before per-record
+  methods: users, tokens, sessions, TOTP challenges, DDNS profiles, notification
+  channels, OIDC providers/auth states.
+- Runtime store switching remains blocked until record-level coverage is broad
+  enough and backup/restore drills are complete.

docs/roadmap.md

@@ -9,18 +9,18 @@
 > encryption, tamper-evident audit WAL, signed plugin loader, lifecycle UI, host
 > API broker, and runtime runner contract are now landed. The durable storage
 > direction is **bbolt**, not SQLite, to preserve the pure-Go / zero-CGo rule;
-> bucketized bbolt import/export, JSON migration/rollback CLI, and first
-> record-level bbolt APIs have landed, but JSON is still the default server
-> store.
+> bucketized bbolt import/export, JSON migration/rollback CLI, and record-level
+> bbolt APIs for low-risk buckets have landed, but JSON is still the default
+> server store.
 
 
 ## V1 Hardening
 
 - Replace JSON storage with bbolt migrations, preserving AES-256-GCM secret
   encryption and moving hot/ephemeral records off whole-file rewrites.
-  *(Bucketized import/export, JSON rollback CLI, and first record-level
-  node/KV/audit APIs delivered; broader record-level writes and default store
-  switch pending.)*
+  *(Bucketized import/export, JSON rollback CLI, and record-level APIs for
+  nodes/KV/audit/static/Workers/plugin lifecycle/approvals delivered;
+  secret-bearing writes and default store switch pending.)*
 - Keep protobuf/ConnectRPC transport and generated TypeScript clients as a later
   API-boundary upgrade; current JSON APIs remain the bootstrap surface.
 - TOTP setup and recovery codes. *(Delivered 2026-06-12; enforce-2FA policy,