@bongos/core 1.17.0

package/tests/boxes.mjs

@@ -0,0 +1,1255 @@
+// tests/boxes.mjs
+//
+// Hermetic unit smoke for the per-builder box lifecycle (ADR 0031 §2/§5, #598).
+// Covers the PURE decision core of modules/dev-box/boxes.js (rank gate, size/cost
+// catalog, idle/dormant SELECTION, transition legality) and the dry-run/live
+// contract of modules/dev-box/do-api.js — all with NO database, NO DigitalOcean, NO
+// network, and NO real clock (nowMs is always injected). The DB-backed
+// orchestration in scripts/gds/box.js is exercised on the control plane in
+// dry-run; the decisions it relies on are pinned here.
+//
+// Run:  node tests/boxes.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const boxes = require('../modules/dev-box/boxes.js');
+const { DoApi, DoApiError } = require('../scripts/gds/do-api.js');
+const { isTunnelReadyStatus } = require('../modules/dev-box/routes/box.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const HOUR = 3_600_000;
+const DAY = 86_400_000;
+const NOW = Date.parse('2026-06-04T12:00:00Z');
+
+console.log('rank gate:');
+
+t('rankMeetsBoxFloor: ordering xenos < thetes < metic < archon', () => {
+  assert.equal(boxes.rankMeetsBoxFloor('xenos', 'xenos'), true);
+  assert.equal(boxes.rankMeetsBoxFloor('metic', 'xenos'), true);
+  assert.equal(boxes.rankMeetsBoxFloor('archon', 'metic'), true);
+  assert.equal(boxes.rankMeetsBoxFloor('xenos', 'metic'), false);
+  assert.equal(boxes.rankMeetsBoxFloor('metic', 'archon'), false);
+  // ADR 0034 regression (#869): thetes sits above the xenos floor, below metic.
+  assert.equal(boxes.rankMeetsBoxFloor('thetes', 'xenos'), true);
+  assert.equal(boxes.rankMeetsBoxFloor('thetes', 'metic'), false);
+  assert.equal(boxes.rankMeetsBoxFloor('metic', 'thetes'), true);
+});
+
+t('rankMeetsBoxFloor: unknown rank or floor is false (fail-closed)', () => {
+  assert.equal(boxes.rankMeetsBoxFloor('bogus', 'xenos'), false);
+  assert.equal(boxes.rankMeetsBoxFloor(undefined, 'xenos'), false);
+  assert.equal(boxes.rankMeetsBoxFloor('archon', 'bogus'), false);
+});
+
+t('boxScopeForRank: xenos/thetes→starter, metic/archon→full', () => {
+  assert.equal(boxes.boxScopeForRank('xenos'), 'starter');
+  assert.equal(boxes.boxScopeForRank('metic'), 'full');
+  assert.equal(boxes.boxScopeForRank('archon'), 'full');
+  // ADR 0034: a Thetes may hold a box but earns no scope uplift — still 'starter'.
+  assert.equal(boxes.boxScopeForRank('thetes'), 'starter');
+});
+
+t('thetes can provision a box (ADR 0034 regression, #869)', () => {
+  // The bug: thetes missing from RANK_ORDER → fail-closed below the xenos floor
+  // → 403 on /box/ensure for the whole tier (builder 25 hit 6+ of these).
+  assert.doesNotThrow(() => boxes.assertProvisionAllowed({ rank: 'thetes' }));
+  const d = boxes.decideEnsureAction({ boxState: 'none', rank: 'thetes', status: 'active' });
+  assert.equal(d.action, 'provision');
+});
+
+t('assertProvisionAllowed: passes at/above floor, throws INSUFFICIENT_RANK below', () => {
+  // Default floor (xenos): even a Xenos may get a (scoped) box — ADR 0031 §5(b).
+  assert.doesNotThrow(() => boxes.assertProvisionAllowed({ rank: 'xenos' }));
+  assert.doesNotThrow(() => boxes.assertProvisionAllowed({ rank: 'archon' }));
+  // Raised floor: a Xenos is refused.
+  let err;
+  try { boxes.assertProvisionAllowed({ rank: 'xenos', floor: 'metic' }); }
+  catch (e) { err = e; }
+  assert.ok(err, 'should throw');
+  assert.equal(err.code, 'INSUFFICIENT_RANK');
+  assert.equal(err.required, 'metic');
+  assert.equal(err.actual, 'xenos');
+});
+
+console.log('box block (idea 257 / task 1163):');
+
+t('blocked builder is denied a NEW box (state none → BOX_PROVISION_BLOCKED)', () => {
+  const d = boxes.decideEnsureAction({ boxState: 'none', rank: 'metic', status: 'active', blocked: true });
+  assert.equal(d.action, 'denied');
+  assert.equal(d.reason, 'BOX_PROVISION_BLOCKED');
+});
+
+t('blocked builder cannot WAKE a parked box (state parked → BOX_PROVISION_BLOCKED)', () => {
+  const d = boxes.decideEnsureAction({ boxState: 'parked', rank: 'metic', status: 'active', blocked: true });
+  assert.equal(d.action, 'denied');
+  assert.equal(d.reason, 'BOX_PROVISION_BLOCKED');
+});
+
+t('block is FUTURE-ONLY: an already-active box still heartbeats (state active → ready)', () => {
+  // Lars's "block future opens only" default: blocking does not tear down a
+  // running box; the active box keeps heartbeating until it idles out or the
+  // Archon explicitly closes it (close_current).
+  const d = boxes.decideEnsureAction({ boxState: 'active', rank: 'metic', status: 'active', blocked: true });
+  assert.equal(d.action, 'ready');
+});
+
+t('block does not disturb an in-flight provision (state provisioning → in_progress)', () => {
+  const d = boxes.decideEnsureAction({ boxState: 'provisioning', rank: 'metic', status: 'active', blocked: true });
+  assert.equal(d.action, 'in_progress');
+});
+
+t('NOT blocked is unchanged (state none → provision)', () => {
+  const d = boxes.decideEnsureAction({ boxState: 'none', rank: 'metic', status: 'active', blocked: false });
+  assert.equal(d.action, 'provision');
+  // Default (blocked omitted) must behave exactly as before this feature.
+  const d2 = boxes.decideEnsureAction({ boxState: 'parked', rank: 'metic', status: 'active' });
+  assert.equal(d2.action, 'wake');
+});
+
+console.log('size + cost catalog:');
+
+t('default size is in the catalog and is the 4 GB box', () => {
+  assert.ok(boxes.SIZE_CATALOG[boxes.DEFAULT_SIZE], 'default size present');
+  assert.equal(boxes.DEFAULT_SIZE, 's-2vcpu-4gb');
+});
+
+t('computeActiveCostUsd: hours × hourly rate', () => {
+  const cost = boxes.computeActiveCostUsd({
+    sizeSlug: 's-2vcpu-4gb', activeSinceMs: NOW - 10 * HOUR, untilMs: NOW,
+  });
+  // 10h × 0.03571 ≈ 0.3571
+  assert.ok(Math.abs(cost - 0.3571) < 0.001, `expected ~0.3571, got ${cost}`);
+});
+
+t('computeActiveCostUsd: zero/negative/invalid interval → 0', () => {
+  assert.equal(boxes.computeActiveCostUsd({ sizeSlug: 's-2vcpu-4gb', activeSinceMs: NOW, untilMs: NOW }), 0);
+  assert.equal(boxes.computeActiveCostUsd({ sizeSlug: 's-2vcpu-4gb', activeSinceMs: NOW, untilMs: NOW - HOUR }), 0);
+  assert.equal(boxes.computeActiveCostUsd({ sizeSlug: 's-2vcpu-4gb', activeSinceMs: null, untilMs: NOW }), 0);
+  assert.equal(boxes.computeActiveCostUsd({ sizeSlug: 'no-such-size', activeSinceMs: NOW - HOUR, untilMs: NOW }), 0);
+});
+
+console.log('idle / dormant selection:');
+
+t('selectIdleBoxes: picks active boxes past the idle threshold, ignores others', () => {
+  const rows = [
+    { state: 'active', github_login: 'old', last_activity_at: new Date(NOW - 45 * 60000).toISOString() },
+    { state: 'active', github_login: 'fresh', last_activity_at: new Date(NOW - 5 * 60000).toISOString() },
+    { state: 'parked', github_login: 'parked', last_activity_at: new Date(NOW - 999 * 60000).toISOString() },
+  ];
+  const idle = boxes.selectIdleBoxes(rows, { idleMinutes: 30, nowMs: NOW });
+  assert.equal(idle.length, 1);
+  assert.equal(idle[0].github_login, 'old');
+});
+
+t('selectIdleBoxes: COALESCEs to active_since when never heartbeated', () => {
+  const rows = [
+    // No heartbeat, but active_since is recent → NOT idle (full window from boot).
+    { state: 'active', github_login: 'booting', last_activity_at: null, active_since: new Date(NOW - 2 * 60000).toISOString() },
+    // No heartbeat, active_since old → idle.
+    { state: 'active', github_login: 'stale', last_activity_at: null, active_since: new Date(NOW - 90 * 60000).toISOString() },
+  ];
+  const idle = boxes.selectIdleBoxes(rows, { idleMinutes: 30, nowMs: NOW });
+  assert.deepEqual(idle.map((r) => r.github_login), ['stale']);
+});
+
+t('selectIdleBoxes: guards bad inputs', () => {
+  assert.deepEqual(boxes.selectIdleBoxes(null, { idleMinutes: 30, nowMs: NOW }), []);
+  assert.deepEqual(boxes.selectIdleBoxes([], { idleMinutes: 0, nowMs: NOW }), []);
+  assert.deepEqual(boxes.selectIdleBoxes([], { idleMinutes: 30, nowMs: NaN }), []);
+});
+
+t('selectIdleBoxes: skips boxes where claude_active=true regardless of age', () => {
+  const rows = [
+    // Old + claude running → kept alive.
+    { state: 'active', github_login: 'clauding', last_activity_at: new Date(NOW - 60 * 60000).toISOString(), claude_active: true },
+    // Old + claude NOT running → idle.
+    { state: 'active', github_login: 'idle', last_activity_at: new Date(NOW - 60 * 60000).toISOString(), claude_active: false },
+    // Old + no claude_active field (legacy row) → idle.
+    { state: 'active', github_login: 'legacy', last_activity_at: new Date(NOW - 60 * 60000).toISOString() },
+  ];
+  const idle = boxes.selectIdleBoxes(rows, { idleMinutes: 30, nowMs: NOW });
+  assert.deepEqual(idle.map((r) => r.github_login).sort(), ['idle', 'legacy']);
+});
+
+t('selectDormantBoxes: picks parked boxes past the dormant threshold', () => {
+  const rows = [
+    { state: 'parked', github_login: 'gone', parked_at: new Date(NOW - 20 * DAY).toISOString() },
+    { state: 'parked', github_login: 'recent', parked_at: new Date(NOW - 3 * DAY).toISOString() },
+    { state: 'active', github_login: 'working', parked_at: null },
+  ];
+  const dormant = boxes.selectDormantBoxes(rows, { dormantDays: 14, nowMs: NOW });
+  assert.equal(dormant.length, 1);
+  assert.equal(dormant[0].github_login, 'gone');
+});
+
+console.log('transition legality:');
+
+t('canTransition: legal moves', () => {
+  assert.equal(boxes.canTransition('provision', 'none'), true);
+  assert.equal(boxes.canTransition('provision', 'destroyed'), true);
+  assert.equal(boxes.canTransition('park', 'active'), true);
+  assert.equal(boxes.canTransition('wake', 'parked'), true);
+  assert.equal(boxes.canTransition('deprovision', 'parked'), true);
+  assert.equal(boxes.canTransition('deprovision', 'active'), true);
+});
+
+t('canTransition: illegal moves', () => {
+  assert.equal(boxes.canTransition('provision', 'active'), false, 'no double-provision');
+  assert.equal(boxes.canTransition('park', 'parked'), false, 'no double-park');
+  assert.equal(boxes.canTransition('wake', 'active'), false, 'no wake an active box');
+  assert.equal(boxes.canTransition('park', 'none'), false);
+});
+
+console.log('\nprovision dry-run inertness (#1034):');
+
+// cmdProvision is dependency-injected (pool, boxes, boxOnboard) and box.js exports
+// it for tests (the CLI IIFE is require.main-guarded). We inject recording fakes
+// so we can assert the literal contract the #1034 bug violated: a dry-run
+// (no --apply) must not write to builder_boxes — i.e. ensureBoxRow / setBoxState /
+// recordEvent must never fire, and a MISSING row (getBoxByBuilderId → null) must
+// still be treated as the provisionable 'none' state.
+const boxCli = require('../scripts/gds/box.js');
+
+function fakeProvisionDeps({ existingBox = null } = {}) {
+  const calls = [];
+  const fakeBoxes = {
+    assertProvisionAllowed() {},                 // no throw → rank gate passes
+    boxScopeForRank() { return 'full'; },
+    canTransition: boxes.canTransition,          // exercise the REAL transition map
+    async getBoxByBuilderId() { calls.push('getBoxByBuilderId'); return existingBox; },
+    async ensureBoxRow() { calls.push('ensureBoxRow'); return { id: 1, state: 'none', provisioned_at: null }; },
+    async setBoxState() { calls.push('setBoxState'); return {}; },
+    async recordEvent() { calls.push('recordEvent'); },
+    async setTerminalAccess() { calls.push('setTerminalAccess'); },
+  };
+  const fakeOnboard = { async listSshKeys() { return []; }, wrapManagedBlock() { return ''; } };
+  const pool = {
+    async query() {
+      return { rows: [{ id: 42, github_login: 'tester', display_name: 'T', rank: 'metic', status: 'active' }] };
+    },
+  };
+  return { calls, fakeBoxes, fakeOnboard, pool };
+}
+
+await ta('cmdProvision dry-run (no row yet) reads the gate but writes NOTHING to builder_boxes', async () => {
+  const { calls, fakeBoxes, fakeOnboard, pool } = fakeProvisionDeps({ existingBox: null });
+  const res = await boxCli.cmdProvision(pool, fakeBoxes, fakeOnboard, 'tester', { apply: false });
+  assert.equal(res.dryRun, true, 'dry-run returns {dryRun:true}');
+  assert.ok(calls.includes('getBoxByBuilderId'), 'gate reads via getBoxByBuilderId');
+  assert.ok(!calls.includes('ensureBoxRow'), 'dry-run must NOT ensureBoxRow (the #1034 bug)');
+  assert.ok(!calls.includes('setBoxState'), 'dry-run must NOT write box state');
+  assert.ok(!calls.includes('recordEvent'), 'dry-run must NOT write box_events');
+});
+
+await ta('cmdProvision dry-run still rejects an illegal transition (active box → no double-provision)', async () => {
+  const { calls, fakeBoxes, fakeOnboard, pool } = fakeProvisionDeps({ existingBox: { state: 'active' } });
+  const res = await boxCli.cmdProvision(pool, fakeBoxes, fakeOnboard, 'tester', { apply: false });
+  assert.equal(res.ok, false, "an 'active' box cannot be re-provisioned");
+  assert.match(res.error, /'active'/);
+  assert.ok(!calls.includes('ensureBoxRow'), 'a rejected dry-run also writes nothing');
+});
+
+console.log('DigitalOcean client (do-api):');
+
+await ta('dry-run is the DEFAULT and sends NO network request', async () => {
+  let called = 0;
+  const api = new DoApi({ fetchImpl: () => { called++; throw new Error('should not fetch'); } });
+  assert.equal(api.dryRun, true);
+  const r = await api.createDroplet({ name: 'x', region: 'nyc3', size: 's-2vcpu-4gb', image: 'ubuntu-24-04-x64' });
+  assert.equal(called, 0, 'fetch must not be called in dry-run');
+  assert.equal(r.dryRun, true);
+  assert.ok(r.droplet && String(r.droplet.id).startsWith('dryrun-'), 'returns a synthetic droplet');
+});
+
+await ta('live mode without a token throws clearly (never silent no-op)', async () => {
+  assert.throws(
+    () => new DoApi({ dryRun: false }),
+    (e) => e instanceof DoApiError && /DO_API_TOKEN/.test(e.message)
+  );
+});
+
+await ta('live createDroplet builds the right request via injected fetch', async () => {
+  const seen = {};
+  const fakeFetch = async (url, opts) => {
+    seen.url = url; seen.opts = opts;
+    return { ok: true, status: 202, text: async () => JSON.stringify({ droplet: { id: 123, status: 'new' } }) };
+  };
+  const api = new DoApi({ dryRun: false, token: 'tok_test', fetchImpl: fakeFetch });
+  const r = await api.createDroplet({ name: 'otb-box-someone', region: 'nyc3', size: 's-2vcpu-4gb', image: 'ubuntu-24-04-x64', tags: ['otb-builder-box'] });
+  assert.equal(r.droplet.id, 123);
+  assert.match(seen.url, /\/v2\/droplets$/);
+  assert.equal(seen.opts.method, 'POST');
+  assert.equal(seen.opts.headers.Authorization, 'Bearer tok_test');
+  const body = JSON.parse(seen.opts.body);
+  assert.equal(body.name, 'otb-box-someone');
+  assert.equal(body.size, 's-2vcpu-4gb');
+});
+
+await ta('live mode surfaces a DO error body as DoApiError', async () => {
+  const fakeFetch = async () => ({ ok: false, status: 422, text: async () => JSON.stringify({ id: 'unprocessable', message: 'bad size' }) });
+  const api = new DoApi({ dryRun: false, token: 'tok', fetchImpl: fakeFetch });
+  let err;
+  try { await api.getDroplet(1); } catch (e) { err = e; }
+  assert.ok(err instanceof DoApiError);
+  assert.equal(err.status, 422);
+  assert.match(err.message, /bad size/);
+});
+
+console.log('DB helpers (fake pg client — no real Postgres):');
+
+// A fake pg client: records every query and returns canned rows in order.
+function fakeDb(responses = []) {
+  const calls = [];
+  let i = 0;
+  return {
+    calls,
+    async query(sql, params) { calls.push({ sql, params }); return responses[i++] || { rows: [] }; },
+  };
+}
+
+await ta('recordComputeCost: tallies + writes a cost_log row keyed PER INTERVAL', async () => {
+  const db = fakeDb();
+  const box = { id: 7, builder_id: 42, size_slug: 's-2vcpu-4gb', active_since: new Date(NOW - 5 * HOUR).toISOString() };
+  const cost = await boxes.recordComputeCost(db, { box, untilMs: NOW, actor: 'sweep:idle' });
+  assert.ok(Math.abs(cost - 0.1786) < 0.001, `5h × rate ≈ 0.1786, got ${cost}`);
+  // 3 writes: UPDATE tally, INSERT box_events(cost), INSERT cost_log.
+  assert.equal(db.calls.length, 3);
+  const costLog = db.calls.find((c) => /INSERT INTO cost_log/.test(c.sql));
+  assert.ok(costLog, 'cost_log insert fired');
+  const sourceRef = costLog.params[2];
+  // source_ref must be per-interval (box id + interval end), so a second park
+  // of the same box does not collide on cost_log's UNIQUE(source, source_ref).
+  assert.match(sourceRef, /^builder_boxes#7@\d+$/, `source_ref per-interval, got ${sourceRef}`);
+  assert.equal(costLog.params[3], 42, 'builder_id attributed');
+});
+
+await ta('recordComputeCost: zero interval writes nothing', async () => {
+  const db = fakeDb();
+  const box = { id: 1, builder_id: 2, size_slug: 's-2vcpu-4gb', active_since: null };
+  const cost = await boxes.recordComputeCost(db, { box, untilMs: NOW });
+  assert.equal(cost, 0);
+  assert.equal(db.calls.length, 0, 'no writes for a zero-cost interval');
+});
+
+await ta('bumpActivity: an active box resets its clock with NO per-heartbeat event', async () => {
+  const db = fakeDb([{ rows: [{ state: 'active' }] }]);
+  const state = await boxes.bumpActivity(db, 42);
+  assert.equal(state, 'active');
+  assert.equal(db.calls.length, 1, 'only the UPDATE — heartbeats must not churn box_events');
+  assert.match(db.calls[0].sql, /UPDATE builder_boxes[\s\S]*state = 'active'/);
+});
+
+await ta('bumpActivity: with claudeActive=true writes claude_active column', async () => {
+  const db = fakeDb([{ rows: [{ state: 'active' }] }]);
+  const state = await boxes.bumpActivity(db, 42, { claudeActive: true });
+  assert.equal(state, 'active');
+  assert.match(db.calls[0].sql, /claude_active = \$2/);
+  assert.deepEqual(db.calls[0].params, [42, true]);
+});
+
+await ta('bumpActivity: without claudeActive does NOT write claude_active column', async () => {
+  const db = fakeDb([{ rows: [{ state: 'active' }] }]);
+  await boxes.bumpActivity(db, 42);
+  assert.ok(!db.calls[0].sql.includes('claude_active'), 'no claude_active column when flag not supplied');
+});
+
+await ta('bumpActivity: claudeActive=true stamps first_connected_at write-once (#823)', async () => {
+  const db = fakeDb([{ rows: [{ state: 'active' }] }]);
+  await boxes.bumpActivity(db, 42, { claudeActive: true });
+  // COALESCE so a later beat never moves it — the monotonic "connected" signal.
+  assert.match(db.calls[0].sql, /first_connected_at = COALESCE\(first_connected_at, now\(\)\)/);
+  // Still no extra bind param — first_connected_at uses now() inline.
+  assert.deepEqual(db.calls[0].params, [42, true]);
+});
+
+await ta('bumpActivity: claudeActive=false does NOT touch first_connected_at (never un-ticks)', async () => {
+  const db = fakeDb([{ rows: [{ state: 'active' }] }]);
+  await boxes.bumpActivity(db, 42, { claudeActive: false });
+  assert.ok(!db.calls[0].sql.includes('first_connected_at'), 'a claude_active=false beat leaves first_connected_at intact');
+});
+
+await ta('hasEverConnected: true when first_connected_at is set, false otherwise (#823)', async () => {
+  const connected = fakeDb([{ rows: [{ connected: true }] }]);
+  assert.equal(await boxes.hasEverConnected(connected, 42), true);
+  assert.match(connected.calls[0].sql, /first_connected_at IS NOT NULL/);
+
+  const notYet = fakeDb([{ rows: [{ connected: false }] }]);
+  assert.equal(await boxes.hasEverConnected(notYet, 42), false);
+
+  const noRow = fakeDb([{ rows: [] }]); // no box row at all
+  assert.equal(await boxes.hasEverConnected(noRow, 42), false);
+});
+
+await ta('setBoxState: rejects a non-allowlisted column (injection guard)', async () => {
+  const db = fakeDb([{ rows: [{ id: 1 }] }]);
+  await assert.rejects(
+    () => boxes.setBoxState(db, 1, 'active', { 'ip = oops; DROP TABLE builder_boxes; --': 'x' }),
+    /not.*allowlist|allowlist/i
+  );
+  // A legit column still goes through, parameterized.
+  const db2 = fakeDb([{ rows: [{ id: 1, state: 'active' }] }]);
+  const row = await boxes.setBoxState(db2, 1, 'active', { ip: '1.2.3.4', snapshot_id: null });
+  assert.ok(row);
+  assert.match(db2.calls[0].sql, /UPDATE builder_boxes SET state = \$2/);
+});
+
+await ta('setBoxState: host_keys + host_keys_at are allowlisted, parameterized (idea 310)', async () => {
+  const db = fakeDb([{ rows: [{ id: 1, state: 'destroyed' }] }]);
+  const row = await boxes.setBoxState(db, 1, 'destroyed', { host_keys: null, host_keys_at: null });
+  assert.ok(row);
+  // Settable (no allowlist throw) and bound as params, never interpolated.
+  assert.match(db.calls[0].sql, /host_keys = \$\d+/);
+  assert.match(db.calls[0].sql, /host_keys_at = \$\d+/);
+  assert.deepEqual(db.calls[0].params, [1, 'destroyed', null, null]);
+});
+
+console.log('\nidea 310 — a rebuilt box never serves a stale SSH identity:');
+
+await ta('deprovisionOne clears host_keys + host_keys_at on teardown', async () => {
+  // The lockout bug: a reaped box rebuilds with fresh host keys, but the GDS row
+  // kept the OLD keys (~10 min) so GET /box/me served a stale identity and the
+  // desktop app pinned the WRONG key. deprovisionOne must null them.
+  const calls = [];
+  const fakeBoxes = {
+    async recordComputeCost() { calls.push('recordComputeCost'); return 0; },
+    async recordStorageCost() { calls.push('recordStorageCost'); return 0; },
+    async setBoxState(_db, _bid, state, patch) { calls.push({ state, patch }); return {}; },
+    async recordEvent() { calls.push('recordEvent'); },
+  };
+  const doApi = { dryRun: true, async deleteDroplet() {}, async deleteSnapshot() {} };
+  // No droplet/snapshot/parked_at → no cost or DO calls; CF/DNS unconfigured in
+  // the test env → tunnel + blackhole-DNS teardown are skipped.
+  const box = {
+    id: 7, builder_id: 42, state: 'active', droplet_id: null, snapshot_id: null,
+    parked_at: null, github_login: 'tester', hostname: 'box-tester.dev.example.com',
+  };
+  await boxCli.deprovisionOne({}, fakeBoxes, doApi, box, { actor: 'test:sweep', login: 'tester' });
+  const destroyed = calls.find((c) => c && c.state === 'destroyed');
+  assert.ok(destroyed, 'sets state destroyed');
+  assert.equal(destroyed.patch.host_keys, null, 'host_keys cleared on teardown');
+  assert.equal(destroyed.patch.host_keys_at, null, 'host_keys_at cleared on teardown');
+});
+
+await ta('bumpActivity: a non-active box is a no-op that reports current state', async () => {
+  // UPDATE matches nothing → falls through to a state read.
+  const db = fakeDb([{ rows: [] }, { rows: [{ state: 'parked' }] }]);
+  const state = await boxes.bumpActivity(db, 42);
+  assert.equal(state, 'parked');
+  assert.equal(db.calls.length, 2, 'no heartbeat event written for a non-active box');
+});
+
+console.log('\nensure decision (#701 onboarding middleware):');
+
+t('decideEnsureAction: inactive builder is denied (fail-closed, checked first)', () => {
+  const d = boxes.decideEnsureAction({ boxState: 'none', rank: 'archon', status: 'inactive' });
+  assert.equal(d.action, 'denied');
+  assert.equal(d.reason, 'BUILDER_INACTIVE');
+});
+
+t('decideEnsureAction: below the floor is denied with required/actual', () => {
+  const d = boxes.decideEnsureAction({ boxState: 'none', rank: 'xenos', status: 'active', floor: 'metic' });
+  assert.equal(d.action, 'denied');
+  assert.equal(d.reason, 'INSUFFICIENT_RANK');
+  assert.equal(d.required, 'metic');
+  assert.equal(d.actual, 'xenos');
+});
+
+t('decideEnsureAction: no box → provision (auto-provision); a Xenos qualifies at the default floor', () => {
+  for (const s of ['none', 'destroyed', 'error', undefined, null]) {
+    assert.equal(boxes.decideEnsureAction({ boxState: s, rank: 'xenos', status: 'active' }).action, 'provision', `state=${s}`);
+  }
+});
+
+t('decideEnsureAction: parked → wake (wake-on-connect)', () => {
+  assert.equal(boxes.decideEnsureAction({ boxState: 'parked', rank: 'xenos', status: 'active' }).action, 'wake');
+});
+
+t('decideEnsureAction: active → ready; in-flight states → in_progress', () => {
+  assert.equal(boxes.decideEnsureAction({ boxState: 'active', rank: 'metic', status: 'active' }).action, 'ready');
+  for (const s of ['provisioning', 'waking', 'parking']) {
+    assert.equal(boxes.decideEnsureAction({ boxState: s, rank: 'metic', status: 'active' }).action, 'in_progress', `state=${s}`);
+  }
+});
+
+t('decideEnsureAction: an unknown state fails closed to in_progress (never a blind provision)', () => {
+  assert.equal(boxes.decideEnsureAction({ boxState: 'frobnicating', rank: 'metic', status: 'active' }).action, 'in_progress');
+});
+
+console.log('\nintent queue (#701):');
+
+await ta('enqueueIntent: a fresh insert returns created=true and always enqueues state=pending', async () => {
+  const db = fakeDb([{ rows: [{ id: 1, builder_id: 42, action: 'provision', state: 'pending' }] }]);
+  const { intent, created } = await boxes.enqueueIntent(db, 42, 'provision', 'api:self');
+  assert.equal(created, true);
+  assert.equal(intent.action, 'provision');
+  assert.equal(intent.state, 'pending', 'enqueueIntent always enqueues a plain pending intent');
+  assert.match(db.calls[0].sql, /INSERT INTO box_intents/);
+});
+
+await ta('getOpenIntent: a pending or running intent is open (blocks a duplicate enqueue)', async () => {
+  const db = fakeDb([{ rows: [{ id: 9, state: 'pending' }] }]);
+  const open = await boxes.getOpenIntent(db, 7);
+  assert.equal(open.state, 'pending');
+  // Only the two live states gate a re-enqueue — there is no approval-hold state.
+  assert.match(db.calls[0].sql, /state IN \('pending', 'running'\)/);
+});
+
+await ta('enqueueIntent: a unique-violation (open intent exists) returns the existing one, created=false', async () => {
+  const db = {
+    calls: [],
+    async query(sql) {
+      this.calls.push({ sql });
+      if (/INSERT INTO box_intents/.test(sql)) { const e = new Error('dup'); e.code = '23505'; throw e; }
+      return { rows: [{ id: 9, builder_id: 42, action: 'wake', state: 'pending' }] };
+    },
+  };
+  const { intent, created } = await boxes.enqueueIntent(db, 42, 'wake', 'api:self');
+  assert.equal(created, false);
+  assert.equal(intent.id, 9);
+});
+
+await ta('claimNextIntent: claims with FOR UPDATE SKIP LOCKED and flips to running', async () => {
+  const db = fakeDb([{ rows: [{ id: 3, action: 'provision', state: 'running' }] }]);
+  const intent = await boxes.claimNextIntent(db);
+  assert.equal(intent.id, 3);
+  assert.match(db.calls[0].sql, /FOR UPDATE SKIP LOCKED/);
+  assert.match(db.calls[0].sql, /state = 'running'/);
+});
+
+await ta('setTerminalAccess: only an active box stores the url + credential', async () => {
+  const db = fakeDb([{ rows: [{ state: 'active' }] }]);
+  const state = await boxes.setTerminalAccess(db, 42, { url: 'https://abc.trycloudflare.com', credential: 's3cr3t' });
+  assert.equal(state, 'active');
+  assert.match(db.calls[0].sql, /UPDATE builder_boxes[\s\S]*state = 'active'/);
+  assert.match(db.calls[0].sql, /terminal_url = \$2[\s\S]*terminal_credential = \$3/);
+  assert.deepEqual(db.calls[0].params, [42, 'https://abc.trycloudflare.com', 's3cr3t']);
+});
+
+await ta('setTerminalAccess: a missing credential is stored as null', async () => {
+  const db = fakeDb([{ rows: [{ state: 'active' }] }]);
+  await boxes.setTerminalAccess(db, 42, { url: 'https://abc.trycloudflare.com' });
+  assert.equal(db.calls[0].params[2], null);
+});
+
+await ta('setTerminalAccess: a non-active box does not store, reports current state', async () => {
+  const db = fakeDb([{ rows: [] }, { rows: [{ state: 'parked' }] }]);
+  const state = await boxes.setTerminalAccess(db, 42, { url: 'https://abc.trycloudflare.com', credential: 'x' });
+  assert.equal(state, 'parked');
+  assert.equal(db.calls.length, 2);
+});
+
+console.log('\ngit non-interactive (the #854 ttyd/SSH input-freeze fix):');
+
+t('infra pins GIT_TERMINAL_PROMPT=0 across every box arrival path (#854)', () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const { fileURLToPath } = require('node:url');
+  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+  const unit = read('infra/box-terminal.service');
+  const cloudInit = read('infra/builder-box-cloud-init.yaml');
+  const fetchSh = read('infra/box-source-fetch.sh');
+
+  // 1. ttyd process tree: the systemd unit pins the env var for the whole tree
+  //    (bash -l -> claude -> any git). This is the canonical file box.js inlines.
+  assert.match(unit, /^Environment=GIT_TERMINAL_PROMPT=0$/m,
+    'box-terminal.service must pin GIT_TERMINAL_PROMPT=0 for the ttyd process tree');
+
+  // 2. Fresh boxes (cloud-init write_files): a profile.d export for LOGIN shells
+  //    AND an /etc/environment entry (pam_env) for NON-login SSH are both baked.
+  assert.match(cloudInit, /path: \/etc\/profile\.d\/05-git-noninteractive\.sh/,
+    'cloud-init must write the profile.d git-noninteractive file');
+  assert.match(cloudInit, /export GIT_TERMINAL_PROMPT=0/,
+    'cloud-init profile.d entry must export GIT_TERMINAL_PROMPT=0');
+  assert.match(cloudInit, /path: \/etc\/environment[\s\S]{0,160}GIT_TERMINAL_PROMPT=0/,
+    'cloud-init must add GIT_TERMINAL_PROMPT=0 to /etc/environment (covers non-login SSH)');
+
+  // 3. Existing boxes self-heal: the source-fetch cron re-asserts BOTH files
+  //    (runs before the token check, idempotent, no disruptive restart).
+  assert.match(fetchSh, /GIT_NOPROMPT_FILE=\/etc\/profile\.d\/05-git-noninteractive\.sh/,
+    'box-source-fetch.sh must re-assert the profile.d file on existing boxes');
+  assert.match(fetchSh, /grep -qs '\^GIT_TERMINAL_PROMPT=0\$' \/etc\/environment/,
+    'box-source-fetch.sh must re-assert /etc/environment on existing boxes');
+
+  // 4. Delivery wiring intact: cloud-init still inlines the canonical unit (the
+  //    #774 placeholder box.js base64-fills), so a fresh box gets the unit env.
+  assert.match(cloudInit, /__BOX_TERMINAL_SERVICE_B64__/,
+    'cloud-init must still inline box-terminal.service via its placeholder');
+});
+
+t('box-source-fetch.sh reports host keys IMMEDIATELY, not only via the */10 cron (task 1460)', () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const { fileURLToPath } = require('node:url');
+  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  const fetchSh = fs.readFileSync(path.join(ROOT, 'infra/box-source-fetch.sh'), 'utf8');
+
+  // The off->on bug: a re-provision mints FRESH /etc/ssh host keys and clears the
+  // GDS's stored copy (idea 310), but the reporter ran ONLY on a */10 cron — so
+  // GET /box/me had no key for up to 10 min and the laptop's stale known_hosts pin
+  // stranded the connect ("Host denied"). box-source-fetch.sh runs at first boot
+  // (cloud-init) and every */10, so it must INVOKE the reporter directly — not just
+  // wire the cron — to close that window from minutes to seconds.
+  assert.match(fetchSh, /echo "\*\/10 \* \* \* \* \$WORKSPACE\/infra\/box-report-host-keys\.sh/,
+    'box-source-fetch.sh must still wire the */10 host-keys cron (the backstop)');
+  assert.match(fetchSh, /^\s*"\$WORKSPACE\/infra\/box-report-host-keys\.sh" >> \/tmp\/box-report-host-keys\.log 2>&1 \|\| true\s*$/m,
+    'box-source-fetch.sh must ALSO invoke the host-keys reporter immediately (task 1460), non-fatal under set -e');
+});
+
+t('box-heartbeat.sh counts an open ttyd browser terminal as in-use (idea #294 / task 1161)', () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const { fileURLToPath } = require('node:url');
+  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  const hb = fs.readFileSync(path.join(ROOT, 'infra/box-heartbeat.sh'), 'utf8');
+
+  // The bug: the browser on-ramp (#760/#774) reaches the box via ttyd over the
+  // Cloudflare tunnel — not SSH, no utmp, ~0% CPU — so the heartbeat saw "idle"
+  // and the sweep destroyed an in-use box. An OPEN browser terminal holds an
+  // ESTABLISHED connection to ttyd's local port (default 7681, overridable).
+  assert.match(hb, /TTYD_PORT="\$\{BOX_TTYD_PORT:-7681\}"/,
+    'must default the ttyd port to 7681, overridable via BOX_TTYD_PORT');
+  assert.match(hb, /state established "\( sport = :\$TTYD_PORT \)"/,
+    'must detect an ESTABLISHED connection to the ttyd port (the listening socket is filtered out)');
+  assert.match(hb, /ACTIVE=1; TTYD_CONNECTED=1/,
+    'an open ttyd session must set ACTIVE=1 so the heartbeat actually pings');
+  assert.match(hb, /if \[ "\$TTYD_CONNECTED" -eq 1 \]; then CLAUDE_ACTIVE="true"; fi/,
+    'an open ttyd session must report claude_active=true so the reaper spares it');
+});
+
+t('#893: terminal session persists (tmux) + close-box teardown command is wired', () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const { fileURLToPath } = require('node:url');
+  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+  const unit = read('infra/box-terminal.service');
+  const cloudInit = read('infra/builder-box-cloud-init.yaml');
+  const fetchSh = read('infra/box-source-fetch.sh');
+  const boxJs = read('scripts/gds/box.js');
+  const closeBox = read('infra/close-box.sh');
+  const launch = read('infra/otb-box-launch.sh');
+
+  // --- persistence: task 986 moved the tmux logic OUT of box-terminal.service's
+  //     inline ExecStart into /usr/local/bin/otb-box-launch (canonical copy:
+  //     infra/otb-box-launch.sh) and made it auto-run `claude`. #893's intent is
+  //     unchanged -- a browser disconnect only detaches the tmux CLIENT; the "otb"
+  //     session (with claude) survives on the box and the next connect reattaches
+  //     -- it just lives in the launcher now. So assert the service INVOKES the
+  //     launcher, and that the tmux attach-or-create persistence + `bash -l`
+  //     fallback live in the launcher.
+  assert.match(unit, /--writable \/usr\/local\/bin\/otb-box-launch/,
+    'box-terminal.service must run ttyd against /usr/local/bin/otb-box-launch (task 986)');
+  assert.match(launch, /tmux has-session -t otb/,
+    'otb-box-launch must reuse the existing "otb" tmux session when present (#893 persistence)');
+  assert.match(launch, /tmux new-session -d -s otb\b/,
+    'otb-box-launch must create the "otb" tmux session when absent (#893 attach-or-create)');
+  assert.match(launch, /exec tmux attach-session -t otb/,
+    'otb-box-launch must attach to the persistent "otb" session on connect (#893)');
+  assert.match(launch, /command -v tmux[\s\S]*?else[\s\S]*?exec bash -l/,
+    'otb-box-launch must fall back to bash -l when tmux is absent');
+  // fresh boxes get tmux from the package list.
+  assert.match(cloudInit, /packages:[\s\S]*?^\s*- tmux$/m,
+    'cloud-init must install tmux so the persistence path works on fresh boxes');
+  // launcher delivery chain (mirrors the close-box chain below): canonical infra
+  // copy -> cloud-init placeholder on first boot -> box.js gz+b64 fill ->
+  // box-source-fetch self-heal on existing boxes.
+  assert.match(cloudInit, /path: \/usr\/local\/bin\/otb-box-launch[\s\S]{0,160}__OTB_BOX_LAUNCH_B64__/,
+    'cloud-init must write /usr/local/bin/otb-box-launch via its placeholder');
+  assert.match(boxJs, /__OTB_BOX_LAUNCH_B64__[\s\S]{0,80}fileGzB64\('otb-box-launch\.sh'\)/,
+    "box.js must gz+b64-fill the otb-box-launch placeholder from infra/otb-box-launch.sh");
+  assert.match(fetchSh, /install -m 0755 "\$WORKSPACE\/infra\/otb-box-launch\.sh" \/usr\/local\/bin\/otb-box-launch/,
+    'box-source-fetch.sh must self-heal /usr/local/bin/otb-box-launch on existing boxes');
+
+  // --- close-box command: canonical script + first-boot delivery (cloud-init
+  //     placeholder box.js fills) + existing-box self-heal in source-fetch.
+  assert.match(closeBox, /\/box\/close/,
+    'infra/close-box.sh must POST to /box/close (the deprovision action)');
+  assert.match(cloudInit, /path: \/usr\/local\/bin\/close-box[\s\S]{0,120}__CLOSE_BOX_B64__/,
+    'cloud-init must write /usr/local/bin/close-box via its placeholder');
+  assert.match(boxJs, /__CLOSE_BOX_B64__[\s\S]{0,60}fileGzB64\('close-box\.sh'\)/,
+    "box.js must gz+b64-fill the close-box placeholder from infra/close-box.sh");
+  assert.match(fetchSh, /install -m 0755 "\$WORKSPACE\/infra\/close-box\.sh" \/usr\/local\/bin\/close-box/,
+    'box-source-fetch.sh must self-heal /usr/local/bin/close-box on existing boxes');
+});
+
+console.log('\n#913 - terminal credential drift (systemd % expansion + self-heal):');
+
+t('no unescaped % in any infra/*.service Exec line (#913 class guard)', () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const { fileURLToPath } = require('node:url');
+  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  const dir = path.join(ROOT, 'infra');
+  const units = fs.readdirSync(dir).filter((n) => n.endsWith('.service'));
+  assert.ok(units.length > 0, 'expected at least one infra/*.service unit');
+  for (const name of units) {
+    const lines = fs.readFileSync(path.join(dir, name), 'utf8').split('\n');
+    lines.forEach((line, i) => {
+      if (!/^\s*Exec\w*=/.test(line)) return;
+      // systemd expands % specifiers in Exec* lines; a literal % must be %%.
+      const residue = line.split('%%').join('');
+      assert.ok(!residue.includes('%'),
+        `infra/${name}:${i + 1} has an unescaped % in an Exec line - systemd ` +
+        'expands % specifiers before the shell runs (write %% for a literal %). ' +
+        'This is the #913 bug class: printf "%s" became a directive-free format ' +
+        'and seeded a garbage ttyd password.');
+    });
+  }
+});
+
+t('box-terminal.service seeds the ttyd password via escaped %%s printf (#913)', () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const { fileURLToPath } = require('node:url');
+  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  const unit = fs.readFileSync(path.join(ROOT, 'infra/box-terminal.service'), 'utf8');
+  assert.match(unit, /printf "%%s" "\$BOX_TERMINAL_CREDENTIAL"/,
+    'the ExecStartPre seed must printf "%%s" so the shell sees printf "%s"');
+});
+
+t('box-report-terminal.sh self-heals live ttyd credential drift (#913)', () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const { fileURLToPath } = require('node:url');
+  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  const sh = fs.readFileSync(path.join(ROOT, 'infra/box-report-terminal.sh'), 'utf8');
+  // reads the password the RUNNING ttyd enforces from its argv...
+  assert.match(sh, /\/proc\/\$TTYD_PID\/cmdline/,
+    'must read the live ttyd argv to learn the password actually being enforced');
+  assert.match(sh, /--credential/,
+    'must locate the --credential argv entry');
+  // ...and restarts the unit on mismatch so ttyd re-reads CRED_FILE.
+  assert.match(sh, /systemctl restart box-terminal/,
+    'must restart box-terminal when the live password differs from CRED_FILE');
+});
+
+// ---------------------------------------------------------------------------
+// #889 — GET /box/terminal readiness probe must NOT treat a Cloudflare
+// tunnel-down (HTTP 530 / error 1033) page as a live tunnel. The terminal URL
+// is recorded at provision time, before cloudflared connects, so a too-eager
+// probe handed out a clickable link that 1033s (builder 25, term-iammasterqua).
+// Ready ONLY when the ORIGIN (ttyd) answered: 401 basic-auth or 2xx/3xx.
+// ---------------------------------------------------------------------------
+t('terminal probe: 401 (ttyd basic-auth challenge) is the ready signal', () => {
+  assert.equal(isTunnelReadyStatus(401), true);
+});
+t('terminal probe: 2xx/3xx (origin answered) is ready', () => {
+  assert.equal(isTunnelReadyStatus(200), true);
+  assert.equal(isTunnelReadyStatus(204), true);
+  assert.equal(isTunnelReadyStatus(302), true);
+});
+t('terminal probe: CF 1033 tunnel-down (530) is NOT ready (the #889 bug)', () => {
+  assert.equal(isTunnelReadyStatus(530), false);
+});
+t('terminal probe: CF origin-unreachable 5xx are NOT ready', () => {
+  for (const s of [500, 502, 503, 504, 520, 521, 522, 523, 524, 525, 526]) {
+    assert.equal(isTunnelReadyStatus(s), false, `status ${s} must not be ready`);
+  }
+});
+t('terminal probe: a 4xx other than 401 is NOT ready', () => {
+  assert.equal(isTunnelReadyStatus(403), false);
+  assert.equal(isTunnelReadyStatus(404), false);
+});
+
+console.log('\nlive game preview (#898/#903, ADR 0044) + cloud-init 64KB budget:');
+
+t('#903: rendered cloud-init user-data stays under DigitalOcean\'s 64KB cap', () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const zlib = require('node:zlib');
+  const { fileURLToPath } = require('node:url');
+  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  const infra = (n) => path.join(ROOT, 'infra', n);
+  const gz = (n) => zlib.gzipSync(fs.readFileSync(infra(n))).toString('base64');
+
+  // Mirror box.js readCloudInit's substitution: EVERY inlined infra file is gz+b64
+  // (#903 margin; task 1314's source-fetch growth blew the cap, task 1321 gz+b64'd
+  // the rest), and ONLY the dynamic runtime values (keys/env/session) are plain b64.
+  // Realistic named-tunnel secrets (2 keys, tokens) give a worst-case render size.
+  let out = fs.readFileSync(infra('builder-box-cloud-init.yaml'), 'utf8')
+    .split('__BOX_SOURCE_FETCH_B64__').join(gz('box-source-fetch.sh'))
+    .split('__BOX_AUTHKEYS_FETCH_B64__').join(gz('box-authorized-keys-fetch.sh'))
+    .split('__BOX_TERMINAL_SERVICE_B64__').join(gz('box-terminal.service'))
+    .split('__BOX_TERMINAL_CREDSYNC_SERVICE_B64__').join(gz('box-terminal-credsync.service'))
+    .split('__BOX_TERMINAL_CREDENTIAL_PATH_B64__').join(gz('box-terminal-credential.path'))
+    .split('__CLOUDFLARED_SERVICE_B64__').join(gz('cloudflared.service'))
+    .split('__CLOUDFLARED_RUN_B64__').join(gz('cloudflared-run.sh'))
+    .split('__CLOSE_BOX_B64__').join(gz('close-box.sh'))
+    .split('__REPO_URL__').join('git@github.com:owner/amazonprimea.git')
+    .split('__BUILDER_AUTHORIZED_KEYS_B64__').join(Buffer.from('ssh-ed25519 AAAA...k1\nssh-ed25519 AAAA...k2\n').toString('base64'))
+    .split('__BOX_ENV_B64__').join(Buffer.from('BOX_TUNNEL_TOKEN=' + 'x'.repeat(200) + '\nBOX_TERMINAL_HOSTNAME=term-x.amazonprimea.com\nBOX_TERMINAL_CREDENTIAL=' + 'a'.repeat(48) + '\nBOX_PREVIEW_HOSTNAME=sandbox-x.amazonprimea.com\n').toString('base64'))
+    .split('__GDS_SESSION_B64__').join(Buffer.from(JSON.stringify({ token: 'x'.repeat(64), builder: { id: 1, github_login: 'x', rank: 'archon' }, api_base: 'https://amazonprimea.com' })).toString('base64'));
+  const bytes = Buffer.byteLength(out, 'utf8');
+  assert.ok(bytes < 64 * 1024, `rendered cloud-init is ${bytes}B; must stay under DO's 65536B cap`);
+});
+
+t('task 1040: cloud-init keeps SSH host keys stable across wake (ssh_deletekeys:false drop-in) + stays ASCII', () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const { fileURLToPath } = require('node:url');
+  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  const raw = fs.readFileSync(path.join(ROOT, 'infra', 'builder-box-cloud-init.yaml'), 'utf8');
+
+  // The box is recreated from a snapshot on every `wake` (new instance-id), and
+  // cmdWake passes NO user_data — so without ssh_deletekeys:false baked INTO the
+  // snapshot, cloud-init's cc_ssh regenerates /etc/ssh/ssh_host_* on every wake
+  // and stales every builder's known_hosts pin (Claude Desktop's strict ssh2
+  // verifier then hard-fails with "Host denied (verification failed)"). The
+  // drop-in must live in cloud.cfg.d so it rides in the snapshot and is parsed on
+  // every wake boot.
+  assert.match(raw, /path: \/etc\/cloud\/cloud\.cfg\.d\/99-otb-keep-hostkeys\.cfg/,
+    'cloud-init must write the host-key-persistence drop-in into /etc/cloud/cloud.cfg.d/');
+  assert.match(raw, /ssh_deletekeys:\s*false/,
+    'the drop-in must set ssh_deletekeys: false so cc_ssh preserves the snapshot host keys');
+
+  // cloud-init's YAML loader silently DISCARDS the entire config on any non-ASCII
+  // byte (learning #48 / #724) — which would void this drop-in along with it.
+  // Guard that the whole file stays 7-bit ASCII.
+  const nonAscii = [...raw].findIndex((c) => c.charCodeAt(0) > 127);
+  assert.equal(nonAscii, -1,
+    `builder-box-cloud-init.yaml must be ASCII-only (cloud-init drops non-ASCII configs); first offending char at index ${nonAscii}`);
+});
+
+t('#903: cloud-init gzips the big source-fetch script + box.js has the size guard', () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const { fileURLToPath } = require('node:url');
+  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+  // The source-fetch write_files entry must use gz+b64 (that's the margin), and
+  // box.js must gzip it + fail fast before DO if the render exceeds the cap.
+  assert.match(read('infra/builder-box-cloud-init.yaml'),
+    /path: \/usr\/local\/bin\/box-source-fetch\.sh[\s\S]{0,80}encoding: gz\+b64/,
+    'box-source-fetch.sh must be inlined as gz+b64');
+  const boxjs = read('scripts/gds/box.js');
+  assert.match(boxjs, /fileGzB64\('box-source-fetch\.sh'\)/, 'box.js must gz+b64 the source-fetch script');
+  assert.match(boxjs, /MAX_USERDATA_BYTES/, 'box.js must define the user-data size guard');
+  assert.match(boxjs, /over DigitalOcean's .* limit/, 'box.js must fail fast with an actionable over-limit message');
+});
+
+console.log('\nterminal credential race (#917, ideas #232/#233):');
+
+t('#917: box-terminal.service never launches ttyd with an empty password and writes the credential atomically', () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const { fileURLToPath } = require('node:url');
+  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  const unit = fs.readFileSync(path.join(ROOT, 'infra', 'box-terminal.service'), 'utf8');
+
+  // ExecStart must read the credential into a var, refuse to start when empty
+  // (Restart=always retries), and never inline an unguarded $(cat ...).
+  assert.match(unit, /ExecStart=.*\[ -n "\$CRED" \] \|\|.*exit 1/,
+    'ExecStart must refuse to launch ttyd with an empty credential');
+  assert.doesNotMatch(unit, /ExecStart=.*--credential "otb:\$\(cat /,
+    'ExecStart must not inline an unguarded $(cat ...) as the password');
+  // ExecStartPre must write tmp + mv (atomic) — `printf > file` truncates first,
+  // opening the empty-read window that locked a blank password into ttyd.
+  assert.match(unit, /ExecStartPre=.*terminal-credential\.tmp && mv -f .*terminal-credential\.tmp/,
+    'ExecStartPre must write the credential atomically (tmp + mv)');
+  // ...and wait for a credential source (named-tunnel race) before the random
+  // fallback, without stalling quick-tunnel boxes (box.env present, no var -> break).
+  assert.match(unit, /ExecStartPre=.*for i in \$\(seq[\s\S]*?sleep 5/,
+    'ExecStartPre must poll/wait for the credential before falling back');
+  assert.match(unit, /\[ -f \/etc\/otb\/box\.env \] && break/,
+    'a quick-tunnel box (box.env present, no baked credential) must skip the wait');
+});
+
+t('#917: the credential-drift watcher pair restarts ttyd only on a real mismatch', () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const { fileURLToPath } = require('node:url');
+  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+  const pathUnit = read('infra/box-terminal-credential.path');
+  assert.match(pathUnit, /PathModified=\/etc\/otb\/terminal-credential/,
+    'the path unit must watch the credential file (create + change)');
+  assert.match(pathUnit, /Unit=box-terminal-credsync\.service/,
+    'the path unit must trigger credsync');
+
+  const credsync = read('infra/box-terminal-credsync.service');
+  assert.match(credsync, /Type=oneshot/, 'credsync must be a oneshot');
+  // Compares the live ttyd argv password to the file; restarts only on mismatch
+  // (loop-safe: after the restart they match, so the next trigger no-ops).
+  assert.match(credsync, /\/proc\/\$PID\/cmdline/, 'credsync must read the live ttyd argv');
+  assert.match(credsync, /\[ "\$RUN" = "\$FILE" \] && exit 0/,
+    'credsync must no-op when the running password matches the file');
+  assert.match(credsync, /systemctl restart box-terminal/,
+    'credsync must restart box-terminal on a real mismatch');
+});
+
+t('#917: delivery wiring — cloud-init (fresh boxes) + source-fetch self-heal (existing boxes)', () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const { fileURLToPath } = require('node:url');
+  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+  const cloudInit = read('infra/builder-box-cloud-init.yaml');
+  assert.match(cloudInit, /path: \/etc\/systemd\/system\/box-terminal-credsync\.service[\s\S]{0,120}__BOX_TERMINAL_CREDSYNC_SERVICE_B64__/,
+    'cloud-init must inline box-terminal-credsync.service via its placeholder');
+  assert.match(cloudInit, /path: \/etc\/systemd\/system\/box-terminal-credential\.path[\s\S]{0,120}__BOX_TERMINAL_CREDENTIAL_PATH_B64__/,
+    'cloud-init must inline box-terminal-credential.path via its placeholder');
+  assert.match(cloudInit, /systemctl enable --now box-terminal-credential\.path/,
+    'cloud-init must arm the credential watcher at first boot');
+  // The runcmd credential seed must be atomic too (tmp + mv, same race as the unit).
+  assert.match(cloudInit, /terminal-credential\.tmp && mv -f \/etc\/otb\/terminal-credential\.tmp \/etc\/otb\/terminal-credential/,
+    'the cloud-init credential seed must write atomically (tmp + mv)');
+
+  const boxjs = read('scripts/gds/box.js');
+  assert.match(boxjs, /fileGzB64\('box-terminal-credsync\.service'\)/,
+    'box.js must gz+b64-fill the credsync placeholder');
+  assert.match(boxjs, /fileGzB64\('box-terminal-credential\.path'\)/,
+    'box.js must gz+b64-fill the path-unit placeholder');
+
+  const fetchSh = read('infra/box-source-fetch.sh');
+  // Units refresh when they DIFFER (not only when absent — the idea #222 gap that
+  // kept already-provisioned boxes on stale units forever).
+  assert.match(fetchSh, /for UNIT in box-terminal\.service box-terminal-credsync\.service box-terminal-credential\.path cloudflared\.service/,
+    'source-fetch must refresh all terminal units from the repo copy');
+  assert.match(fetchSh, /cmp -s "\$WORKSPACE\/infra\/\$UNIT" "\/etc\/systemd\/system\/\$UNIT"/,
+    'source-fetch must compare repo vs installed unit (refresh on diff, not only on absent)');
+  // And every tick: arm the watcher + run one drift check (self-heals a raced box
+  // within one cron tick even if it predates the path unit).
+  assert.match(fetchSh, /systemctl enable --now box-terminal-credential\.path/,
+    'source-fetch must arm the credential watcher on existing boxes');
+  assert.match(fetchSh, /systemctl start box-terminal-credsync\.service/,
+    'source-fetch must run a drift check on every tick');
+});
+
+t('#1001/ADR 0052: live game preview enables on EVERY named-tunnel box (reverses #903 full-clone gate)', () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const { fileURLToPath } = require('node:url');
+  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+  const fetchSh = read('infra/box-source-fetch.sh');
+  // ADR 0052: the game (public/, src/world, src/rooms) is now in the starter
+  // sparse scope and the unit runs the game-only entry, so the preview enables on
+  // EVERY box, gated ONLY on the named tunnel (BOX_PREVIEW_HOSTNAME). The
+  // src/rooms presence check survives as a belt-and-braces "clone finished" guard
+  // (it now passes on every box), not as a full-clone gate.
+  assert.match(fetchSh, /BOX_PREVIEW_HOSTNAME=.*box\.env/,
+    'preview enable must still require the named-tunnel preview host');
+  assert.match(fetchSh, /-d "\$WORKSPACE\/src\/rooms"/,
+    'preview enable keeps the src/rooms "game materialized" sanity guard');
+  assert.match(fetchSh, /install -m 0755 "\$WORKSPACE\/infra\/box-preview\.sh" \/usr\/local\/bin\/box-preview/,
+    'box-source-fetch must install the box-preview command');
+  // box.js bakes the preview host so the box knows its own URL.
+  assert.match(read('scripts/gds/box.js'), /BOX_PREVIEW_HOSTNAME=\$\{ph\}/,
+    'box.js must bake BOX_PREVIEW_HOSTNAME from the tunnel previewHostname');
+
+  // ADR 0052 — the game must be in the starter clone so a Xenos/Thetes box can
+  // serve the sandbox.
+  const boxAccess = read('modules/dev-box/box-access.js');
+  for (const p of ["'src/world'", "'src/rooms'", "'public'"]) {
+    assert.ok(boxAccess.includes(p), `STARTER_SPARSE_PATHS must include ${p} (ADR 0052)`);
+  }
+  // migrations/ stays excluded — a degraded-DB preview needs no schema.
+  assert.ok(!/['"]migrations['"]/.test(boxAccess.split('STARTER_SPARSE_PATHS')[1].split(']')[0]),
+    'STARTER_SPARSE_PATHS must NOT include migrations/ (degraded-DB preview needs no schema)');
+
+  // The unit runs the GAME-ONLY entry, never the full server.js.
+  const svc = read('infra/box-game-preview.service');
+  assert.match(svc, /node \/workspace\/src\/preview-server\.js/,
+    'box-game-preview.service must run the game-only entry');
+  assert.ok(!/ExecStart=.*node \/workspace\/server\.js/.test(svc),
+    'box-game-preview.service must NOT run the full server.js');
+
+  // The game-only entry must never be able to mount the internal API surface.
+  // Test the CODE, not the prose — the file's own comments explain that it does
+  // NOT mount /api/gds, so strip comments before asserting on real wiring.
+  const prevCode = read('src/preview-server.js')
+    .replace(/\/\*[\s\S]*?\*\//g, '')                          // block comments
+    .split('\n').map((l) => l.replace(/\/\/.*$/, '')).join('\n'); // line comments
+  assert.ok(!/\brequire\(\s*['"][^'"]*\/gds\b/.test(prevCode),
+    'src/preview-server.js must not require any src/bongos module');
+  assert.ok(!/buildGdsRouter/.test(prevCode),
+    'src/preview-server.js must not import the GDS router builder');
+  assert.ok(!/\.use\(\s*['"]\/api\b/.test(prevCode),
+    'src/preview-server.js must not mount any /api/* surface');
+  assert.ok(!/BuildersHallRoom/.test(prevCode),
+    'src/preview-server.js must not register the internal BuildersHallRoom');
+  // …and it MUST register the game rooms via the shared helper (no drift).
+  assert.match(prevCode, /registerGameRooms\(/,
+    'src/preview-server.js must register game rooms via the shared helper');
+});
+
+t('#1044: box-game-preview ExecStartPre guards on a real install sentinel, not a bare -d node_modules', () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const { fileURLToPath } = require('node:url');
+  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+  const svc = fs.readFileSync(path.join(ROOT, 'infra/box-game-preview.service'), 'utf8');
+  const guard = svc.split('\n').find((l) => l.startsWith('ExecStartPre=') && l.includes('npm'));
+  assert.ok(guard, 'box-game-preview.service must have a dep-install ExecStartPre');
+  // The antipattern (#1044): `-d node_modules` treats an empty-but-present dir as
+  // "installed", so npm ci never runs and the preview crash-loops on
+  // `Cannot find module 'express'`. The guard must probe a real install sentinel.
+  assert.ok(!/\[\s*-d\s+\/workspace\/node_modules\s*\]/.test(guard),
+    'guard must NOT short-circuit on a bare `-d /workspace/node_modules` (empty dir passes it — #1044)');
+  assert.match(guard, /\[\s*-[ef]\s+\/workspace\/node_modules\/(\.package-lock\.json|[^/\s]+\/package\.json)\s*\]/,
+    'guard must probe a real install sentinel (node_modules/.package-lock.json or a known dep\'s package.json)');
+  // Still self-heals an uninstalled box.
+  assert.match(guard, /npm ci --omit=dev \|\| npm install --omit=dev/,
+    'guard must still run npm ci (fallback npm install), --omit=dev, when the sentinel is absent');
+});
+
+console.log('\nDO poll loops (waitForAction + settleDroplet share _poll, #1092 C8):');
+
+await ta('settleDroplet returns {ip:null} in dry-run and never fetches', async () => {
+  let called = 0;
+  const api = new DoApi({ fetchImpl: () => { called++; throw new Error('should not fetch'); } });
+  const r = await api.settleDroplet('drop1');
+  assert.deepEqual(r, { ip: null });
+  assert.equal(called, 0);
+});
+
+await ta('settleDroplet polls getDroplet until active and returns the public IPv4', async () => {
+  let n = 0;
+  const fakeFetch = async () => {
+    n++;
+    const droplet = n >= 3
+      ? { id: 'd1', status: 'active', networks: { v4: [{ type: 'private', ip_address: '10.0.0.1' }, { type: 'public', ip_address: '203.0.113.7' }] } }
+      : { id: 'd1', status: 'new', networks: { v4: [] } };
+    return { ok: true, status: 200, text: async () => JSON.stringify({ droplet }) };
+  };
+  const api = new DoApi({ dryRun: false, token: 'tok', fetchImpl: fakeFetch });
+  const slept = [];
+  const r = await api.settleDroplet('d1', { sleepFn: async (ms) => { slept.push(ms); } });
+  assert.deepEqual(r, { ip: '203.0.113.7' });
+  assert.equal(n, 3, 'polled until the droplet reported active');
+  assert.equal(slept.length, 2, 'slept only between the two not-yet-active polls');
+});
+
+await ta('settleDroplet throws once the try budget is exhausted', async () => {
+  const fakeFetch = async () => ({ ok: true, status: 200, text: async () => JSON.stringify({ droplet: { id: 'd1', status: 'new', networks: { v4: [] } } }) });
+  const api = new DoApi({ dryRun: false, token: 'tok', fetchImpl: fakeFetch });
+  await assert.rejects(
+    () => api.settleDroplet('d1', { tries: 3, sleepFn: async () => {} }),
+    /did not reach 'active'/
+  );
+});
+
+await ta('waitForAction returns true once the action completes', async () => {
+  let n = 0;
+  const fakeFetch = async () => { n++; return { ok: true, status: 200, text: async () => JSON.stringify({ action: { id: 'a1', status: n >= 2 ? 'completed' : 'in-progress' } }) }; };
+  const api = new DoApi({ dryRun: false, token: 'tok', fetchImpl: fakeFetch });
+  const ok = await api.waitForAction('a1', { sleepFn: async () => {} });
+  assert.equal(ok, true);
+  assert.equal(n, 2);
+});
+
+await ta('waitForAction throws DoApiError when the action errors', async () => {
+  const fakeFetch = async () => ({ ok: true, status: 200, text: async () => JSON.stringify({ action: { id: 'a1', status: 'errored' } }) });
+  const api = new DoApi({ dryRun: false, token: 'tok', fetchImpl: fakeFetch });
+  let err;
+  try { await api.waitForAction('a1', { sleepFn: async () => {} }); } catch (e) { err = e; }
+  assert.ok(err instanceof DoApiError);
+  assert.match(err.message, /errored/);
+});
+
+await ta('waitForAction throws on timeout (try budget exhausted)', async () => {
+  const fakeFetch = async () => ({ ok: true, status: 200, text: async () => JSON.stringify({ action: { id: 'a1', status: 'in-progress' } }) });
+  const api = new DoApi({ dryRun: false, token: 'tok', fetchImpl: fakeFetch });
+  await assert.rejects(() => api.waitForAction('a1', { tries: 2, sleepFn: async () => {} }), /did not complete in time/);
+});
+
+console.log('\ntask 1289 — droplet⇄row drift detection (planDropletDrift, pure):');
+
+t('planDropletDrift: a droplet a live box owns is in sync (no drift)', () => {
+  const droplets = [{ id: 111, name: 'otb-box-alice', tags: ['otb-builder-box', 'builder:alice'] }];
+  const boxRows = [{ builder_id: 1, github_login: 'alice', state: 'active', droplet_id: '111' }];
+  const { zombies, ghosts } = boxes.planDropletDrift({ droplets, boxRows, nowMs: NOW });
+  assert.equal(zombies.length, 0);
+  assert.equal(ghosts.length, 0);
+});
+
+t('planDropletDrift: ZOMBIE — droplet exists but its box row is destroyed (the bug)', () => {
+  // The exact task-1289 shape: deprovision marked the row destroyed + nulled
+  // droplet_id, but the droplet was never actually deleted.
+  const droplets = [{ id: 222, name: 'otb-box-lars589', tags: ['otb-builder-box', 'builder:lars589'], created_at: '2026-05-01T00:00:00Z' }];
+  const boxRows = [{ builder_id: 3, github_login: 'lars589', state: 'destroyed', droplet_id: null }];
+  const { zombies, ghosts } = boxes.planDropletDrift({ droplets, boxRows, nowMs: NOW });
+  assert.equal(ghosts.length, 0);
+  assert.equal(zombies.length, 1);
+  assert.equal(zombies[0].dropletId, '222');
+  assert.equal(zombies[0].login, 'lars589');
+  assert.equal(zombies[0].builderId, 3, 'maps the zombie back to its builder for edge teardown');
+});
+
+t('planDropletDrift: ZOMBIE — a droplet with no box row at all', () => {
+  const droplets = [{ id: 333, name: 'otb-box-ghostuser', tags: ['otb-builder-box', 'builder:ghostuser'], created_at: '2026-01-01T00:00:00Z' }];
+  const { zombies } = boxes.planDropletDrift({ droplets, boxRows: [], nowMs: NOW });
+  assert.equal(zombies.length, 1);
+  assert.equal(zombies[0].login, 'ghostuser');
+  assert.equal(zombies[0].builderId, null);
+});
+
+t('planDropletDrift: in-flight provision is NOT a zombie (young-droplet guard)', () => {
+  // Droplet created 2 min before NOW; box still provisioning, droplet_id not yet
+  // written. Must be skipped, never deleted.
+  const created = new Date(NOW - 2 * 60_000).toISOString();
+  const droplets = [{ id: 444, name: 'otb-box-newbie', tags: ['builder:newbie'], created_at: created }];
+  const boxRows = [{ builder_id: 9, github_login: 'newbie', state: 'provisioning', droplet_id: null }];
+  const { zombies, skippedYoung } = boxes.planDropletDrift({ droplets, boxRows, nowMs: NOW, minAgeMinutes: 30 });
+  assert.equal(zombies.length, 0, 'young droplet not killed');
+  assert.equal(skippedYoung.length, 1);
+  assert.equal(skippedYoung[0].dropletId, '444');
+});
+
+t('planDropletDrift: GHOST — live row whose droplet vanished from DO', () => {
+  const droplets = []; // DO has none
+  const boxRows = [{ builder_id: 5, github_login: 'bob', state: 'active', droplet_id: '555' }];
+  const { zombies, ghosts } = boxes.planDropletDrift({ droplets, boxRows, nowMs: NOW });
+  assert.equal(zombies.length, 0);
+  assert.equal(ghosts.length, 1);
+  assert.equal(ghosts[0].builderId, 5);
+  assert.equal(ghosts[0].dropletId, '555');
+  assert.equal(ghosts[0].state, 'active');
+});
+
+t('planDropletDrift: a parked box (no droplet) is never a ghost', () => {
+  const boxRows = [{ builder_id: 6, github_login: 'carol', state: 'parked', droplet_id: null, snapshot_id: 's-1' }];
+  const { ghosts } = boxes.planDropletDrift({ droplets: [], boxRows, nowMs: NOW });
+  assert.equal(ghosts.length, 0);
+});
+
+t('loginFromDroplet: prefers the builder: tag, falls back to the otb-box- name', () => {
+  assert.equal(boxes.loginFromDroplet({ tags: ['otb-builder-box', 'builder:dave'], name: 'otb-box-x' }), 'dave');
+  assert.equal(boxes.loginFromDroplet({ tags: ['otb-builder-box'], name: 'otb-box-erin' }), 'erin');
+  assert.equal(boxes.loginFromDroplet({ tags: [], name: 'something-else' }), null);
+});
+
+console.log('\ntask 1289 — idempotent delete + confirm-before-destroyed:');
+
+await ta('deleteWithRetry: a 404 (already gone) is success, not failure', async () => {
+  let calls = 0;
+  const r = await boxCli.deleteWithRetry(async () => { calls++; const e = new Error('not found'); e.status = 404; throw e; }, { sleepFn: async () => {} });
+  assert.equal(r.ok, true);
+  assert.equal(r.alreadyGone, true);
+  assert.equal(calls, 1, 'a 404 short-circuits — no retry');
+});
+
+await ta('deleteWithRetry: retries a transient failure, then succeeds', async () => {
+  let calls = 0;
+  const r = await boxCli.deleteWithRetry(async () => { calls++; if (calls < 2) throw new Error('503 transient'); }, { sleepFn: async () => {} });
+  assert.equal(r.ok, true);
+  assert.equal(calls, 2);
+});
+
+await ta('deleteWithRetry: a real failure after the retry budget returns ok:false', async () => {
+  let calls = 0;
+  const r = await boxCli.deleteWithRetry(async () => { calls++; throw new Error('500 boom'); }, { tries: 3, sleepFn: async () => {} });
+  assert.equal(r.ok, false);
+  assert.match(r.error.message, /boom/);
+  assert.equal(calls, 3);
+});
+
+await ta('deprovisionOne: a failed droplet delete parks at ERROR (not destroyed) and throws — the zombie fix', async () => {
+  // This is the heart of task 1289: the row must NEVER reach 'destroyed' while the
+  // droplet is still alive. A delete that keeps failing leaves state='error' with
+  // droplet_id preserved (not nulled) and throws so the caller surfaces it.
+  const states = [];
+  const fakeBoxes = {
+    async recordComputeCost() { return 0; },
+    async recordStorageCost() { return 0; },
+    async setBoxState(_db, _bid, state, patch) { states.push({ state, patch }); return {}; },
+    async recordEvent() {},
+  };
+  const doApi = { dryRun: false, async deleteDroplet() { throw new Error('DO 500'); }, async deleteSnapshot() {} };
+  const box = { id: 7, builder_id: 42, state: 'active', droplet_id: '999', snapshot_id: null, parked_at: null, github_login: 'tester' };
+  await assert.rejects(
+    () => boxCli.deprovisionOne({}, fakeBoxes, doApi, box, { actor: 'test', login: 'tester', sleepFn: async () => {} }),
+    /DO 500/
+  );
+  assert.equal(states.length, 1, 'exactly one state write');
+  assert.equal(states[0].state, 'error', 'parks at error, NOT destroyed');
+  assert.ok(!('droplet_id' in states[0].patch), 'droplet_id is PRESERVED (not nulled) so the zombie stays queryable');
+  assert.match(states[0].patch.error_note, /delete failed/);
+});
+
+await ta('deprovisionOne: a droplet already gone (404) proceeds cleanly to destroyed', async () => {
+  const states = [];
+  const fakeBoxes = {
+    async recordComputeCost() { return 0; },
+    async recordStorageCost() { return 0; },
+    async setBoxState(_db, _bid, state, patch) { states.push({ state, patch }); return {}; },
+    async recordEvent() {},
+  };
+  const doApi = { dryRun: false, async deleteDroplet() { const e = new Error('gone'); e.status = 404; throw e; }, async deleteSnapshot() {} };
+  const box = { id: 8, builder_id: 43, state: 'active', droplet_id: '1000', snapshot_id: null, parked_at: null, github_login: 'tester2' };
+  await boxCli.deprovisionOne({}, fakeBoxes, doApi, box, { actor: 'test', login: 'tester2', sleepFn: async () => {} });
+  const destroyed = states.find((s) => s.state === 'destroyed');
+  assert.ok(destroyed, 'a 404 droplet is treated as deleted → reaches destroyed');
+  assert.equal(destroyed.patch.droplet_id, null);
+});
+
+console.log('\ntask 2034 — a post-destroyed teardown failure must not clobber state=destroyed:');
+
+await ta('deprovisionOne: a post-destroyed recordEvent throw does NOT undo the teardown (stays destroyed, no reject)', async () => {
+  // The builder-95 false-error (2026-07-04): the droplet delete succeeded and the
+  // row committed 'destroyed', but the follow-up audit event threw. That exception
+  // used to propagate to the sweep's catch, which flipped the row back to 'error'
+  // with a null droplet_id. The audit write is best-effort — it must be swallowed
+  // so deprovisionOne resolves and 'destroyed' stands.
+  const states = [];
+  const fakeBoxes = {
+    async recordComputeCost() { return 0; },
+    async recordStorageCost() { return 0; },
+    async setBoxState(_db, _bid, state, patch) { states.push({ state, patch }); return {}; },
+    async recordEvent() { throw new Error('box_events insert failed'); },
+  };
+  const doApi = { dryRun: false, async deleteDroplet() {}, async deleteSnapshot() {} };
+  const box = { id: 9, builder_id: 95, state: 'active', droplet_id: '2000', snapshot_id: null, parked_at: null, github_login: 'jaxri' };
+  // Must NOT reject — the teardown itself succeeded.
+  await boxCli.deprovisionOne({}, fakeBoxes, doApi, box, { actor: 'sweep:idle', login: 'jaxri', sleepFn: async () => {} });
+  assert.equal(states.length, 1, 'exactly one state write');
+  assert.equal(states[0].state, 'destroyed', "stays 'destroyed' despite the audit-event failure");
+  assert.equal(states[0].patch.droplet_id, null, 'droplet_id nulled — the teardown is real');
+});
+
+await ta('markErrorUnlessDestroyed: never flips an already-destroyed box back to error (guard)', async () => {
+  // Second line of defence: even if some OTHER post-commit step throws (e.g. the
+  // reconcile path's recordSourceEvent) and lands in a caller's catch, a box that
+  // already reached 'destroyed' must be left alone.
+  const writes = [];
+  const fakeBoxes = {
+    async getBoxByBuilderId() { return { state: 'destroyed' }; },
+    async setBoxState(_db, _bid, state, patch) { writes.push({ state, patch }); return {}; },
+  };
+  await boxCli.markErrorUnlessDestroyed({}, fakeBoxes, 95, 'recordSourceEvent failed after teardown');
+  assert.equal(writes.length, 0, 'a destroyed box is left alone — no error downgrade');
+});
+
+await ta('markErrorUnlessDestroyed: a genuine (pre-destroyed) failure still parks at error (guard)', async () => {
+  const writes = [];
+  const fakeBoxes = {
+    async getBoxByBuilderId() { return { state: 'active' }; }, // never reached 'destroyed'
+    async setBoxState(_db, _bid, state, patch) { writes.push({ state, patch }); return {}; },
+  };
+  await boxCli.markErrorUnlessDestroyed({}, fakeBoxes, 96, 'DO 500 before teardown');
+  assert.equal(writes.length, 1, 'a not-destroyed box is parked at error, as before');
+  assert.equal(writes[0].state, 'error');
+  assert.match(writes[0].patch.error_note, /DO 500/);
+});
+
+console.log(`\nboxes.mjs: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);