@@ -146,7 +146,7 @@ for the http API surface, `tests/server/per_customer/` IS the per_customer stack
 ## commands
 
 - `bash scripts/test.sh` — run every module's local-mode suite; `--module <name>`, `--name <substring>`, `--env integ`, `--logs` available. see `tests/AGENTS.md` for authoring conventions
-- `bash scripts/deploy.sh status|push [--gerp <gerp_id>]` — artifact deploys (TF owns shape, S3 owns bytes), **no terraform anywhere in the push path**: the builder is `if package.json → zip the dir; elif .py → zip the dir + its transitively-resolved local imports; else exit 1` — **the import graph IS the bundle manifest** (shared `_helpers`/`*_rules`/vendored trees resolve off the code itself; no recipe files, no `archive_file` — those blocks are deleted). Bespoke needs are `match src_dir:` cases in `build_artifact` (scripts/deploy.py) that *do things first* — prune, stage — then call `build_node`/`build_py`; it's a build script, explicit cases at any count are fine. `status` = the `gerp:src-dir` tag query × live `CodeSha256` × artifact checksums (~12s, direction-aware); `push [--dirs …] [--notes …]` = deterministic zips → versioned artifacts + `provenance`/`release` annotations (operator-profile writes; org read) → `update-function-code` at the pinned version (tenant profile); `--deploy` builds and puts nothing, so the functions and the BFF take the artifacts already in the bucket (what `zip.sh lambda` + `upload.sh lambda` put); `--all` pushes every active gerp through its own `gerp-<id>` profile, whose region picks the bucket, and the BFF once. deployed state is never recorded — it's one `get-function` away. **functions SOURCE code from the bucket** (`data "aws_s3_object"` pins latest per function), so ANY applier — codebuild's bundled snapshot, a stale checkout — deploys bucket truth, never its local tree; a NEW function is push-then-apply (the data source fails the plan until its artifact exists). post-push, a plan shows function updates until the next apply — that's the state's `s3_object_version` pointer re-syncing FORWARD to the version the push already deployed (AWS doesn't expose code source, so state can't refresh it); the apply is a same-bytes no-op
+- `bash scripts/deploy.sh status|push [--gerp <gerp_id>]`, `deploy.sh fleet [--report]` (every gerp at once, scripts/fleet.py's pieces) — artifact deploys (TF owns shape, S3 owns bytes), **no terraform anywhere in the push path**: the builder is `if package.json → zip the dir; elif .py → zip the dir + its transitively-resolved local imports; else exit 1` — **the import graph IS the bundle manifest** (shared `_helpers`/`*_rules`/vendored trees resolve off the code itself; no recipe files, no `archive_file` — those blocks are deleted). Bespoke needs are `match src_dir:` cases in `build_artifact` (scripts/deploy.py) that *do things first* — prune, stage — then call `build_node`/`build_py`; it's a build script, explicit cases at any count are fine. `status` = the `gerp:src-dir` tag query × live `CodeSha256` × artifact checksums (~12s, direction-aware); `push [--dirs …] [--notes …]` = deterministic zips → versioned artifacts + `provenance`/`release` annotations (operator-profile writes; org read) → `update-function-code` at the pinned version (tenant profile); `--deploy` builds and puts nothing, so the functions and the BFF take the artifacts already in the bucket (what `zip.sh lambda` + `upload.sh lambda` put); `--all` pushes every active gerp through its own `gerp-<id>` profile, whose region picks the bucket, and the BFF once. deployed state is never recorded — it's one `get-function` away. **functions SOURCE code from the bucket** (`data "aws_s3_object"` pins latest per function), so ANY applier — codebuild's bundled snapshot, a stale checkout — deploys bucket truth, never its local tree; a NEW function is push-then-apply (the data source fails the plan until its artifact exists). post-push, a plan shows function updates until the next apply — that's the state's `s3_object_version` pointer re-syncing FORWARD to the version the push already deployed (AWS doesn't expose code source, so state can't refresh it); the apply is a same-bytes no-op
 - `bash scripts/deploy.sh image` — the agent-container deploy: build → push (auto-incremented immutable `vNN` tag) → CLI-update a gerp's runtime to the new digest, from the copy ECR replication makes in the gerp's own region, once it has arrived (FULL config carried — UpdateAgentRuntime replaces wholesale) → wait READY → re-pin the named endpoint (DEFAULT auto-tracks). The gerp is gradienterp by default (the dogfood takes an image first), `--gerp <id>` for another, `--all` for every active gerp — a fleet push is said, never implied; `--no-build` moves the named gerps onto the image already at the top of ECR, or `--no-build --tag vNN` onto that one. No terraform: the runtime tf reads `data.aws_ecr_image` `most_recent`, so a post-deploy plan is ALREADY clean (AgentCore exposes its config, unlike lambda code). No `agent_image_tag` var exists anymore; no fake gateway-target churn — routine image deploys change zero tf
 - `bash scripts/docker.sh --build|--run|--stop|--push <ecr-uri>` — the underlying agent-container build/run primitives (`deploy.sh image` drives build/push; use directly for local container smoke)
 - `bash scripts/local-dev.sh --install` — once per clone: creates `.venv` (python3.12), installs the tests', the agent container's and the local servers' python deps, and runs `npm ci` in each Node lambda. Every script that runs `.venv/bin/python` (`test.sh`, `deploy.sh`, `investigate.sh`) needs it
 
@@ -171,7 +171,7 @@ westwood's runtime moved onto it, one tool-calling turn through `scripts/chat.sh
 posted on the pull request; then westwood back onto the latest `vNN` and the `pr-` tag deleted,
 since the runtime's terraform pins the newest image in ECR and a `pr-` tag must never be it. The
 environment, its secret and the deploy role's subject stay in place for it. Merge, then
-`bash scripts/deploy.sh image --all` from main moves the fleet onto the next `vNN`.
+`bash scripts/deploy.sh image --gerp <id>` moves one gerp onto the next `vNN`; the fleet at once is deploy.yaml's `runtimes` job (`-f image=build`), until the image × runtime loop joins scripts/fleet.py.
 
 ## tearing down
 
 
@@ -101,3 +101,24 @@ that already exists, and the apply then sets the retention. One gerp at a time i
 dir (`prod/per_customer`, `prod/init_customer`): the script's init points the dir's backend at
 that gerp's state. A fresh account needs no import. A function that moves from a bare
 `aws_lambda_function` onto this module moves by a `moved` block in the calling module.
+
+## the fleet deploy
+
+Every gerp at once is `bash scripts/deploy.sh fleet [--report] [--gerp a,b] [--dirs …]`, a pipe
+over `scripts/fleet.py`'s pieces, each one AWS call shape with tab-separated lines on stdout:
+`listzipversions` (the bucket's latest version and sha256 per zip, read once: the run's target),
+`listgerps` (every active row with an account), `listzipfnsconf --gerp X` (the gerp's functions
+by the `gerp:src-dir` tag with their `CodeSha256`, through the `gerp-X` profile), `status
+<snapshot>` (the join: `in-sync`, `behind` with the snapshot's version to move to, `left` for a
+function with no artifact or a src_dir another gerp carries and this one does not), `update` (one
+`UpdateFunctionCode` per `behind` line, a gerp outside us-east-1 from its region's replica),
+`push <dir>` (build and put with provenance, the only piece that zips). Ten gerps run at once
+through `xargs -P`; a failed move is a line and the exit code, and the others finish; the report
+is `.build/fleet.tsv`. A loop is one artifact type paired with one resource type, zip × lambda
+function here; another deployable is another loop after it, not a column in these lines.
+
+The workflow yaml runs the same pipe on a runner. **Keep the two compositions identical in
+logic**: the same pieces in the same order with the same flags. A runner thing (`parallel` in
+the xargs slot, `::group::`, the step summary) is written in the yaml and never in a script, so
+no script under scripts/ reads `GITHUB_ACTIONS`. Two copies of a pipe are a hazard for people
+and a small one with agents reading both; the test that reads both holds them together.
@@ -13,18 +13,17 @@
       states: in-sync / artifact-ahead (pushed, not deployed) / repo-ahead
       (local zip differs from artifact — push needed) / no-artifact.
 
-  push [--gerp G | --all] [--dirs modules/x/lambdas/y ...] [--notes "..."] [--deploy] [--profile P]
+  push [--gerp G] [--dirs modules/x/lambdas/y ...] [--notes "..."] [--deploy] [--profile P]
       build each function's zip from its src dir (no terraform), then for each
       fleet function whose zip sha differs from the artifact's latest version:
       put-object (new version, sha256 checksum) + provenance annotation
       {src_dir, src_sha256, built_at} + release annotation (--notes; the
       agent-readable "what's in this version") + update-function-code from
       that exact version, then wait for LastUpdateStatus. `--deploy` builds and
       puts nothing: the functions (and the BFF) take the artifacts already in
-      the bucket. `--all` pushes every active gerp through its gerp-<id> profile,
-      the BFF once.
+      the bucket. Every gerp at once is the fleet pipe, `deploy.sh fleet` (scripts/fleet.py).
 
-  image [--gerp G | --all] [--no-build [--tag vNN] | --tag pr-<n>-<sha>]
+  image [--gerp G] [--no-build [--tag vNN] | --tag pr-<n>-<sha>]
       build, `upload image`, then each gerp's runtimes onto the digest from its
       own region's copy of the image, named endpoints re-pinned.
 
@@ -76,7 +75,7 @@ def bucket_for(region: str) -> str:
 # `build_artifact` routes to `build_webapp`.
 WEBAPP_DIR = "prod/gradienterp_cloud/bff"
 # tower's own functions: the same bundle and bucket as the fleet's, in the OPERATOR account, so
-# they answer to no gerp's tag query. Pushed when named by `--dirs`, never by a bare push or --all
+# they answer to no gerp's tag query. Pushed when named by `--dirs`, never by a bare push
 TOWER_DIR = "prod/tower/lambdas/"
 WEBAPP_ROOT = os.path.dirname(WEBAPP_DIR)
 BFF_FN = f"{CONFIG['STACK_PREFIX']}-cloud-bff"
@@ -527,22 +526,13 @@ def _push_webapp(args):
 
 
 def cmd_push(args):
-    """The BFF, once, then the named gerp's fleet — or with `--all`, every active gerp's in turn."""
+    """The BFF, once, then the named gerp's fleet. Every gerp at once is the fleet pipe (fleet.py)."""
     dirs = list(args.dirs) if args.dirs else None
-    if args.all and args.profile:
-        sys.exit("--all reaches each gerp through its own gerp-<id> profile; --profile names one")
     tower_dirs = [d for d in (dirs or []) if d.startswith(TOWER_DIR)]
-    if tower_dirs and args.all:
-        sys.exit("tower's functions live in the operator account and take no --all; push them by --dirs alone")
-    # the gerps are checked before anything builds or uploads, the BFF included; a push of the BFF
+    # the gerp is checked before anything builds or uploads, the BFF included; a push of the BFF
     # or of tower alone reaches only the operator account and names no gerp
     fleet_dirs = None if dirs is None else [d for d in dirs if d != WEBAPP_DIR and not d.startswith(TOWER_DIR)]
-    gerps = ([r["gerp_id"] for r in _active_rows(_boto(args.operator_profile))] if args.all else [args.gerp]) \
-        if fleet_dirs != [] else []
-    sessions = []
-    for g in gerps:
-        args.gerp, args.profile = g, (None if args.all else args.profile)
-        sessions.append((g, _target_session(args)))
+    sessions = [(args.gerp, _target_session(args))] if fleet_dirs != [] else []
     # The owner web app is outside the fleet enumeration below — `fleet()` is a tag query scoped to
     # the session's account and the BFF lives in the operator's, and its bundle needs the web/ files
     # `build_py` knows nothing about. So a bare push has to reach it EXPLICITLY: without this it
@@ -552,9 +542,7 @@ def cmd_push(args):
     if tower_dirs:
         # the same push as a fleet's, in the operator session: build, put, update-function-code
         _push_fleet(args, _boto(args.operator_profile), tower_dirs)
-    for g, session in sessions:
-        if args.all:
-            print(f"==> {g}")
+    for _g, session in sessions:
         _push_fleet(args, session, fleet_dirs)
 
 
@@ -777,9 +765,9 @@ def cmd_image(args):
     of any gerp agrees with what this just did.
 
     Which gerp: the operator's own by default (`--gerp gradienterp`) — an image lands on the
-    dogfood first, then `--gerp westwood-…` for the staging pair, then `--all` for every active
-    gerp. A fleet-wide push is said, never implied. `--no-build` skips the build and moves the
-    named gerps onto the image already at the top of ECR."""
+    dogfood first, then `--gerp westwood-…` for the staging pair. The fleet at once is the
+    runner's (deploy.yaml `runtimes`) until the image × runtime loop joins fleet.py. `--no-build`
+    skips the build and moves the named gerp onto the image already at the top of ECR."""
     op = _boto(args.operator_profile)
     ecr = op.client("ecr")
     if args.tag and not args.no_build and re.fullmatch(r"v\d+", args.tag):
@@ -797,13 +785,13 @@ def cmd_image(args):
     print(f"==> {tag} = {digest}")
 
     walked = 0
-    for gerp_id, account, region, ses in _gerp_sessions(op, only=None if args.all else args.gerp):
+    for gerp_id, account, region, ses in _gerp_sessions(op, only=args.gerp):
         print(f"==> {gerp_id} ({account}, {region})")
         if not image_replicated(op, region, digest):
             sys.exit(f"{gerp_id}: {tag} has not replicated to {region} yet — run again with --no-build")
         _update_runtimes(ses.client("bedrock-agentcore-control"), digest, gerp_id, region)
         walked += 1
-    if not args.all and not walked:
+    if not walked:
         sys.exit(f"no active gerp named {args.gerp} with an account")
     print(f"deployed {tag} to {walked} gerp(s) — a warm chat session stays on the old container; fresh sessions get {tag}")
 
@@ -1054,13 +1042,11 @@ def main():
     ps.add_argument("--deploy", action="store_true",
                     help="no build: point the live functions at the bucket's current artifacts (build + put alone is zip.sh then upload.sh)")
     ps.add_argument("--gerp", default="gradienterp", help="the gerp whose functions take the push (default: the operator's own)")
-    ps.add_argument("--all", action="store_true", help="every active gerp, each through gerp-<id> — said, never implied")
     ps.add_argument("--profile", default=None, help="the profile reaching it (default: gerp-<gerp>)")
     ps.add_argument("--operator-profile", default="operator-org")
     ps.set_defaults(fn=cmd_push)
     im = sub.add_parser("image")
     im.add_argument("--gerp", default="gradienterp", help="the gerp whose runtime takes the image (default: the operator's own)")
-    im.add_argument("--all", action="store_true", help="every active gerp — said, never implied")
     im.add_argument("--no-build", action="store_true", help="no build: move the named gerps onto the image already at the top of ECR")
     im.add_argument("--tag", help="with --no-build: the pushed vNN to move onto, rather than the top of ECR; "
                                   "with a build: push under this tag instead of the next vNN (a pull request's pr-<n>-<sha>)")
 
@@ -1,20 +1,51 @@
 #!/usr/bin/env bash
-# Artifact deploys — thin wrapper over scripts/deploy.py (see its docstring).
+# Artifact deploys — thin wrapper over scripts/deploy.py (see its docstring), and the fleet pipe.
 #
 #   bash scripts/deploy.sh status                         # gradienterp's gerp, through gerp-gradienterp
 #   bash scripts/deploy.sh status --gerp westwood-c40fd8 --all
 #   bash scripts/deploy.sh push --dirs modules/shipping/lambdas/manage_shipments --notes "..."
 #   bash scripts/deploy.sh push --gerp westwood-c40fd8     # whole fleet of one gerp
+#   bash scripts/deploy.sh push --deploy --dirs <src-dir> # no build: take the artifact upload.sh put
+#   bash scripts/deploy.sh image [--gerp <id>] [--no-build]
+#   bash scripts/deploy.sh fleet [--report] [--gerp a,b] [--dirs <src-dir>…]
 #
 # status and push refuse a profile whose account isn't the gerp row's; `bash scripts/awsacct.sh --all`
 # writes the gerp-<gerp_id> profiles.
-#   bash scripts/deploy.sh push --all --dirs <src-dir>    # every active gerp, the BFF once
-#   bash scripts/deploy.sh push --deploy --dirs <src-dir> # no build: take the artifact upload.sh put
-#   bash scripts/deploy.sh image [--gerp <id> | --all] [--no-build]
+#
+# `fleet` is the laptop's composition of scripts/fleet.py's pieces (issue #57): the snapshot of the
+# bucket once, every active gerp's functions ten at a time, the compare, and one update per function
+# that differs; `--report` stops after the compare, and the report is .build/fleet.tsv either way.
+# The workflow yaml runs the same pipe on a runner (deploy.yaml): keep the two identical in logic —
+# the same pieces in the same order with the same flags; a runner thing (`parallel`, `::group::`,
+# the step summary) is written in the yaml, never here.
 # the zips are zip.sh's and the puts upload.sh's; a gerp's stack, its stop and its start are apply.sh's.
 set -euo pipefail
 cd "$(dirname "$0")/.."
-# the laptop's .venv; python3 where there is none (a GitHub runner with the requirements installed)
 PY=python3
 [[ -x .venv/bin/python ]] && PY=.venv/bin/python
+
+if [[ "${1:-}" == fleet ]]; then
+  shift
+  report=0; only=""; dirs=()
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --report) report=1; shift ;;
+      --gerp) only="$2"; shift 2 ;;
+      --dirs) shift; while [[ $# -gt 0 && "$1" != --* ]]; do dirs+=("$1"); shift; done ;;
+      *) echo "fleet: unknown argument $1" >&2; exit 2 ;;
+    esac
+  done
+  mkdir -p .build
+  snapshot=.build/fleet-snapshot.tsv
+  "$PY" scripts/fleet.py listzipversions > "$snapshot"                                  # once, before any account: the run's target
+  echo "==> snapshot: $(wc -l < "$snapshot" | tr -d ' ') artifacts" >&2
+  "$PY" scripts/fleet.py listgerps | cut -f1 \
+    | { if [[ -n "$only" ]]; then grep -Fx -f <(tr ',' '\n' <<< "$only"); else cat; fi; } \
+    | xargs -P 10 -I{} "$PY" scripts/fleet.py listzipfnsconf --gerp {} \
+    | "$PY" scripts/fleet.py status "$snapshot" ${dirs[@]:+--dirs "${dirs[@]}"} \
+    | tee .build/fleet.tsv \
+    | { if [[ $report -eq 1 ]]; then cat; else "$PY" scripts/fleet.py update; fi; }
+  exit
+fi
+
 exec "$PY" scripts/deploy.py "$@"