@bongos/core 1.19.1000 → 1.19.1001

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1000",
-  "core_contract": "1.19.1000",
-  "source_commit": "418cf03d39cecaf2d846caa21fdb61edb6d8b0f3",
+  "core_version": "1.19.1001",
+  "core_contract": "1.19.1001",
+  "source_commit": "e3841cdcf855bc3c78235929cb9b991fe6771293",
   "source_ref": "HEAD",
-  "built_at": "2026-09-24T01:30:19.307Z",
+  "built_at": "2026-09-24T14:59:23.930Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 521,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2408,
+    "functional_verbatim": 2410,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2955,
-  "tree_sha256": "7199a5097f99b2342ed5b37fc07050fa409594d5d006e6a72c3228e7b3f2f7dd",
+  "file_count": 2957,
+  "tree_sha256": "316e3f355b647effab194c60ce7bd7be3e67446b6c021d7bf3c163987ac4a2a6",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2157,12 +2157,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "a92aafc05e0bf1434d96a9032b5b2d4b1d13177d9969ee02d9f6287777a64df7"
+      "sha256": "20ab80e06f03ad1c1f1f33e3f804d402d011bca4c7b2b9df0090269958009d92"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "36beb96ae7c9b5a49e02252ff10b222cfae14224eaf5ed639d7515f36a3f1f73"
+      "sha256": "51f4a9dd2fcd6d34bd3eaa08285acf9b7c9c1ccc294d1e616c1338607701439e"
     },
     {
       "path": "docs/architecture.md",
@@ -2722,7 +2722,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "a9c208d7638a739dbbe12a7b1ee4a52e4b3c4ad047a043ccf5e3e4ae262eb805"
+      "sha256": "9c37bc89b41410876a2d54f99781ff465a2cd106fd3cd8ef6502bb097e832afe"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6634,6 +6634,11 @@
       "mode": "0000644",
       "sha256": "d2ff6733aaab0c009cfe2e90e756fa9742193dba7c5078c5e1d5fa2fd6ef6e8a"
     },
+    {
+      "path": "modules/provisioning/cost-ledger.js",
+      "mode": "0000644",
+      "sha256": "0f6a25220ce3786ba3d813bcba2e39ef902aa25ed4420264efaca36b9ddb3432"
+    },
     {
       "path": "modules/provisioning/credential-preflight.js",
       "mode": "0000644",
@@ -6827,7 +6832,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "5c409a38ac511fe0fa331a5f012c4eda8598d7e8532070e13a42ba707f934f27"
+      "sha256": "fba7da2883254cc0f7f2eafee6c437aeac00f97fb1f8a35acade67e48c6a6eff"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -6872,7 +6877,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "7738dad310a0de636739fecd9d98036c1d9e4381f7e972337fa8c01d59ccfe9c"
+      "sha256": "6f123553f9fd1f3d48f5356dcddb628c78660c10615f3d7e137f71bf2e7d0750"
     },
     {
       "path": "modules/provisioning/routes/repo-private.js",
@@ -8202,12 +8207,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "eb742b3a898d8b78fc95893d284f6db4151a98f35ddc81a131f16ff586466a98"
+      "sha256": "ef44492854e8c7dc0bffd40525911500bb56a175d59d82d1807dc1e55c58d0bc"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "130f3e4d93f2846e676c68bd54fb3a318311dfc0912ffa48994fcb2b941a2dfd"
+      "sha256": "2687fb0dcd9a64ca3bc3d4d39f634ec22490bbc935df1d7aa1fc02826d8e76ca"
     },
     {
       "path": "public-docs/index.html",
@@ -10252,7 +10257,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "24c5dcae4a5e4be1d9c543791a1be89713e71e8f06150e414463e6064628e6b9"
+      "sha256": "499b3d104f70faa2b9cc4252419f7ff3f08a645fcdf329ec9a26761a25289e65"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13434,6 +13439,11 @@
       "mode": "0000644",
       "sha256": "406ea4d32fe1bbb7aa1f69e0c4dc967feb2fc43c8bf0f70848547fdc6faf8762"
     },
+    {
+      "path": "tests/provisioning_cost_ledger.mjs",
+      "mode": "0000644",
+      "sha256": "a0176f26c37067860379df4da0274646771c7d6c427d84fad0145763c7366152"
+    },
     {
       "path": "tests/provisioning_credential_preflight.mjs",
       "mode": "0000644",

package/docs/api/openapi.json

@@ -12819,7 +12819,7 @@
           "provisioning"
         ],
         "summary": "GET /provisioning/fleet/cost-ledger",
-        "description": "GET /provisioning/fleet/cost-ledger — per-instance monthly estimate + total. rank: archon — cost oversight across the fleet (the /boxes/cost-ledger precedent). Declared among the archon routes (archon-first) for correct auditor classification.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `provisioning.fleet.manage` (all required).",
+        "description": "GET /provisioning/fleet/cost-ledger — per-instance monthly cost to us + estimated cost to its owner, with totals. rank: archon — cost oversight across the fleet (the /boxes/cost-ledger precedent). Declared among the archon routes (archon-first) for correct auditor classification.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `provisioning.fleet.manage` (all required).",
         "x-rank": "metic+archon",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "x-permissions": [

package/docs/api-reference.md

@@ -515,7 +515,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 |---|---|---|---|---|
 | GET | `/api/bongos/provisioning/control-plane` | `archon` | — | GET /provisioning/control-plane — "which row is this platform, and where does it stand?" The deploy page's first call: the self row is cr… |
 | GET | `/api/bongos/provisioning/fleet` | `metic+archon` | — | GET /provisioning/fleet — the full instance roster across all owners. |
-| GET | `/api/bongos/provisioning/fleet/cost-ledger` | `metic+archon` | — | GET /provisioning/fleet/cost-ledger — per-instance monthly estimate + total. |
+| GET | `/api/bongos/provisioning/fleet/cost-ledger` | `metic+archon` | — | GET /provisioning/fleet/cost-ledger — per-instance monthly cost to us + estimated cost to its owner, with totals. |
 | GET | `/api/bongos/provisioning/github-app/callback` | `public` | — | GET /provisioning/github-app/callback?code=&state= — GitHub redirects the owner's BROWSER here after they approve the App Manifest (task … |
 | GET | `/api/bongos/provisioning/github-app/status` | `public` | — | GET /provisioning/github-app/status?state=<> — the PUBLIC progress read the onboarding callback page polls (task 2096) to know when setup… |
 | GET | `/api/bongos/provisioning/health` | `public` | — | GET /provisioning/health — liveness + the core version this module mounted against. |

package/docs/module-api-changelog.md

@@ -2474,5 +2474,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.998 with no explicit bump. run 35942048393. (task 1002620)
   1.19.1000 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.999 with no explicit bump. run 35943151697. (task 1002620)
+  1.19.1001 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1000 with no explicit bump. run 36016738965. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/cost-ledger.js

@@ -0,0 +1,74 @@
+'use strict';
+// The fleet cost ledger (GET /provisioning/fleet/cost-ledger) — VISIBILITY only (ADR 0111 §6).
+//
+// It asks two questions, one column each (task 1004148, ADR 0327). Before, one column
+// asked both and reported a confident $0 for every project:
+//   platform_monthly_usd — what a row costs US. A cloud-host runs on its owner's own
+//     account, so $0 is correct; the one thing we pay for is the control plane's box.
+//   owner_monthly_usd    — an ESTIMATE of the owner's own hosting bill, never ours.
+// null in either column means UNPRICED — the row names no plan we can price — and is
+// never folded into a total as 0.
+
+const { HOSTING_SHAPES, TIER_MONTHLY_USD } = require('./provisioning');
+
+// What a cloud-host's owner pays Render per month, keyed by the plan stored in `tier`:
+// web service + Postgres, ~$13 at the default plans (ADR 0327). No row names a plan yet;
+// the Render standup (task 1004183) writes one, and the pilot (task 1004142) confirms
+// these names and prices.
+const RENDER_PLAN_MONTHLY_USD = Object.freeze({
+  'starter+basic-256mb': 13,
+});
+
+function priceOf(table, key) {
+  return typeof key === 'string' && Object.hasOwn(table, key) ? table[key] : null;
+}
+
+function platformMonthlyUsd({ hostingShape, tier } = {}) {
+  // The box the projects share today is priced once, here, by its droplet size.
+  if (hostingShape === 'control-plane') return priceOf(TIER_MONTHLY_USD, tier);
+  return HOSTING_SHAPES.includes(hostingShape) ? 0 : null;
+}
+
+function ownerMonthlyUsd({ hostingShape, tier } = {}) {
+  if (hostingShape === 'cloud-host') return priceOf(RENDER_PLAN_MONTHLY_USD, tier);
+  // co-tenant shares our box and the control plane is ours: no owner is billed for either.
+  if (hostingShape === 'co-tenant' || hostingShape === 'control-plane') return 0;
+  return null; // byo-host runs on the owner's own machine, whose bill we cannot see
+}
+
+function columnTotal(instances, key) {
+  const priced = instances.map((i) => i[key]).filter((v) => v !== null);
+  const sum = priced.reduce((a, v) => a + v, 0);
+  return { monthly_usd: Number(sum.toFixed(4)), unpriced: instances.length - priced.length };
+}
+
+// Per-instance costs + a total per column, over the instances not torn down.
+async function costLedger(db, { limit = 500 } = {}) {
+  const { rows } = await db.query(
+    `SELECT pi.id, pi.slug, pi.hosting_shape, pi.tier, pi.status, b.github_login
+       FROM provisioning_instances pi
+       JOIN builders b ON b.id = pi.owner_builder_id
+      WHERE pi.status <> 'torn_down'
+      ORDER BY pi.updated_at DESC
+      LIMIT $1`,
+    [Math.min(Math.max(Number(limit) || 500, 1), 2000)]
+  );
+  const instances = rows.map((r) => {
+    const shape = { hostingShape: r.hosting_shape, tier: r.tier };
+    return {
+      id: r.id, slug: r.slug, owner: r.github_login,
+      hosting_shape: r.hosting_shape, tier: r.tier, status: r.status,
+      platform_monthly_usd: platformMonthlyUsd(shape),
+      owner_monthly_usd: ownerMonthlyUsd(shape),
+    };
+  });
+  return {
+    instances,
+    totals: {
+      platform: columnTotal(instances, 'platform_monthly_usd'),
+      owner: columnTotal(instances, 'owner_monthly_usd'),
+    },
+  };
+}
+
+module.exports = { RENDER_PLAN_MONTHLY_USD, platformMonthlyUsd, ownerMonthlyUsd, costLedger };

package/modules/provisioning/provisioning.js

@@ -307,9 +307,10 @@ function isValidSlug(slug) {
 // 'dedicated' was the only shape that priced above zero and provisioning_027 folded it into
 // 'cloud-host', so no row can carry it. ADR 0327 says a ledger of OUR spend "should read
 // ~$0 per cloud-host and be *correct*"; what an owner is worth telling is THEIR platform
-// cost, a different column — task 1004148. The 'dedicated' arm and the tier table stay
-// because this is pure and its tests call it with that value; the droplet code path is
-// task 1004185's to delete.
+// cost, a different column — ownerMonthlyUsd in cost-ledger.js, which the fleet ledger
+// reads instead of this stored value. The 'dedicated' arm and the tier table stay because
+// this is pure and its tests call it with that value; the droplet code path is task
+// 1004185's to delete.
 function costEstimateUsd({ hostingShape, tier } = {}) {
   if (hostingShape !== 'dedicated') return 0;
   // An ABSENT tier is not an unknown one. The runner substitutes its own default
@@ -1434,30 +1435,6 @@ async function planetChoicesForHosts(db, hosts) {
   return out;
 }
 
-// Fleet cost ledger (Archon): per-instance monthly estimate + a total, over the
-// instances that still cost something (not torn_down). VISIBILITY only (ADR 0111 §6).
-async function costLedger(db, { limit = 500 } = {}) {
-  const { rows } = await db.query(
-    `SELECT pi.id, pi.slug, pi.hosting_shape, pi.tier, pi.status,
-            pi.cost_estimate_usd, b.github_login
-       FROM provisioning_instances pi
-       JOIN builders b ON b.id = pi.owner_builder_id
-      WHERE pi.status <> 'torn_down'
-      ORDER BY pi.cost_estimate_usd DESC, pi.updated_at DESC
-      LIMIT $1`,
-    [Math.min(Math.max(Number(limit) || 500, 1), 2000)]
-  );
-  const totalMonthlyUsd = rows.reduce((a, r) => a + Number(r.cost_estimate_usd || 0), 0);
-  return {
-    instances: rows.map((r) => ({
-      id: r.id, slug: r.slug, owner: r.github_login,
-      hosting_shape: r.hosting_shape, tier: r.tier, status: r.status,
-      cost_estimate_usd: Number(r.cost_estimate_usd || 0),
-    })),
-    total_monthly_usd: Number(totalMonthlyUsd.toFixed(4)),
-  };
-}
-
 module.exports = {
   // constants
   INSTANCE_STATES, HOSTING_SHAPES, ONBOARD_MODES, PROJECT_TYPES, INTENT_ACTIONS, TEARDOWN_FROM,
@@ -1488,7 +1465,7 @@ module.exports = {
   recordSettingsPushOwed,
   createInstance, setInstanceStatus, updateInstanceDomain, clearReleasedDomains, updateInstanceSettings, updateInstanceDetail,
   enqueueIntent, enqueueTeardown, enqueueSettingsApply, enqueueRestart, getOpenIntent, claimNextIntent, resolveIntent,
-  recordEvent, instanceStateForSlug, planetChoicesForHosts, projectOwnedBy, costLedger,
+  recordEvent, instanceStateForSlug, planetChoicesForHosts, projectOwnedBy,
   // data access — GitHub App Manifest attempts (task 2080)
   createOAuthManifest, getOAuthManifestByState, attachManifestCode,
   getLatestOAuthManifestForInstance, claimNextOAuthManifest, resolveOAuthManifest,

package/modules/provisioning/routes/provisioning.js

@@ -29,7 +29,7 @@
 //     GET    /provisioning/instances/:id/invite-suggestions — who is worth inviting (R28, ADR 0251)
 //   Archon-scoped (requireRank('archon') — the fleet, the /boxes precedent):
 //     GET    /provisioning/fleet                    — the full instance roster + the box's slot `capacity` (ADR 0285)
-//     GET    /provisioning/fleet/cost-ledger        — per-instance + total cost estimate
+//     GET    /provisioning/fleet/cost-ledger        — per-instance cost to us + to its owner, with totals
 //     POST   /provisioning/instances/:id/force-teardown — tear down ANY instance
 //   public:
 //     GET    /provisioning/health                   — liveness + core version
@@ -49,6 +49,7 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const auth = api, { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
+const { costLedger } = require('../cost-ledger');
 const { onboardPlan, stepsForShape } = require('../onboard-plan');
 const { ALWAYS_ON_CORE, OPTIONAL_MODULES, starterBundleAnswerTable, optionalModules, effectiveModules } = require('../starter-bundles');
 const { recommendationsForDetails } = require('../recommendations');
@@ -214,14 +215,14 @@ module.exports = function provisioningRoutes() {
     }
   });
 
-  // GET /provisioning/fleet/cost-ledger — per-instance monthly estimate + total.
+  // GET /provisioning/fleet/cost-ledger — per-instance monthly cost to us + estimated cost to its owner, with totals.
   // rank: archon — cost oversight across the fleet (the /boxes/cost-ledger precedent).
   // Declared among the archon routes (archon-first) for correct auditor classification.
   router.get('/provisioning/fleet/cost-ledger', auth.requireBuilder, auth.requirePermission('provisioning.fleet.manage'), async (req, res) => {
     try {
       // R14 (#2001 / ADR 0119): shared helper; per-endpoint cap preserved (default 500, max 2000).
       const { limit } = api.parsePagination(req, { defaultLimit: 500, maxLimit: 2000 });
-      const out = await provisioning.costLedger(pool, { limit });
+      const out = await costLedger(pool, { limit });
       res.json(out);
     } catch (err) {
       log.error('[provisioning] GET /provisioning/fleet/cost-ledger', err);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1000",
+  "version": "1.19.1001",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1000",
+      "version": "1.19.1001",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1000",
+  "version": "1.19.1001",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1000'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1001'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provisioning_cost_ledger.mjs

@@ -0,0 +1,98 @@
+// tests/provisioning_cost_ledger.mjs — the fleet cost ledger asks two questions, one
+// column each (task 1004148, ADR 0327): what a row costs US, and an estimate of what it
+// costs its OWNER. A row neither can price reads null (unpriced), never 0 — the old
+// single column reported a confident $0 for every project, with no way to tell
+// "costs nothing" from "we don't know".
+//
+// DB-free: CI has no Postgres, so costLedger runs against a recording fake.
+//
+// Run:  node tests/provisioning_cost_ledger.mjs
+import { strict as assert } from 'node:assert';
+import { makeRunner } from './helpers.mjs';
+import {
+  platformMonthlyUsd, ownerMonthlyUsd, costLedger, RENDER_PLAN_MONTHLY_USD,
+} from '../modules/provisioning/cost-ledger.js';
+
+const { test, summary } = makeRunner();
+
+const PLAN = Object.keys(RENDER_PLAN_MONTHLY_USD)[0];
+
+await test('a cloud-host with no plan named is unpriced for its owner, not $0', () => {
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'cloud-host', tier: null }), null);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'cloud-host' }), null);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'cloud-host', tier: '' }), null);
+});
+
+await test('a cloud-host on a named plan is priced from the plan table', () => {
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'cloud-host', tier: PLAN }), RENDER_PLAN_MONTHLY_USD[PLAN]);
+  assert.ok(RENDER_PLAN_MONTHLY_USD[PLAN] > 0);
+});
+
+await test('an unrecognised plan is unpriced, including an Object.prototype key', () => {
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'cloud-host', tier: 'pro-max+pro-64gb' }), null);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'cloud-host', tier: 'constructor' }), null);
+  assert.equal(platformMonthlyUsd({ hostingShape: 'control-plane', tier: 'toString' }), null);
+});
+
+await test('a cloud-host costs US a correct $0: it runs on its owner\'s own account', () => {
+  assert.equal(platformMonthlyUsd({ hostingShape: 'cloud-host', tier: PLAN }), 0);
+  assert.equal(platformMonthlyUsd({ hostingShape: 'cloud-host', tier: null }), 0);
+});
+
+await test('byo-host: $0 to us, and unpriced for the owner (their own machine)', () => {
+  assert.equal(platformMonthlyUsd({ hostingShape: 'byo-host' }), 0);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'byo-host' }), null);
+});
+
+await test('co-tenant shares our box: no owner is billed, and the box is priced once', () => {
+  assert.equal(platformMonthlyUsd({ hostingShape: 'co-tenant' }), 0);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'co-tenant' }), 0);
+});
+
+await test('the control plane is OUR cost, priced by its droplet size; no size is unpriced', () => {
+  assert.equal(platformMonthlyUsd({ hostingShape: 'control-plane', tier: 's-1vcpu-2gb' }), 12);
+  assert.equal(platformMonthlyUsd({ hostingShape: 'control-plane', tier: null }), null);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'control-plane', tier: 's-1vcpu-2gb' }), 0);
+});
+
+await test('an unknown shape is unpriced in both columns', () => {
+  assert.equal(platformMonthlyUsd({ hostingShape: 'dedicated', tier: 's-2vcpu-4gb' }), null);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'dedicated', tier: 's-2vcpu-4gb' }), null);
+});
+
+function recordingDb(rows) {
+  const calls = [];
+  return { calls, query: async (sql, params) => { calls.push({ sql, params }); return { rows }; } };
+}
+const row = (id, hosting_shape, tier = null) =>
+  ({ id, slug: `p${id}`, hosting_shape, tier, status: 'active', github_login: 'owner' });
+
+await test('the live fleet today: every total says how many rows it could not price', async () => {
+  // Measured 2026-09-24: the control plane (no size recorded) + five cloud-hosts (no plan).
+  const db = recordingDb([row(1, 'control-plane'), ...[2, 3, 4, 5, 6].map((id) => row(id, 'cloud-host'))]);
+  const out = await costLedger(db);
+  assert.deepEqual(out.totals.platform, { monthly_usd: 0, unpriced: 1 });
+  assert.deepEqual(out.totals.owner, { monthly_usd: 0, unpriced: 5 });
+  assert.equal(out.instances[0].platform_monthly_usd, null);
+  assert.equal(out.instances[1].owner_monthly_usd, null);
+});
+
+await test('totals sum only priced rows, per column', async () => {
+  const db = recordingDb([
+    row(1, 'control-plane', 's-1vcpu-2gb'), row(2, 'cloud-host', PLAN), row(3, 'cloud-host', PLAN),
+    row(4, 'cloud-host'), row(5, 'byo-host'),
+  ]);
+  const out = await costLedger(db);
+  assert.deepEqual(out.totals.platform, { monthly_usd: 12, unpriced: 0 });
+  assert.deepEqual(out.totals.owner, { monthly_usd: 2 * RENDER_PLAN_MONTHLY_USD[PLAN], unpriced: 2 });
+  assert.equal('cost_estimate_usd' in out.instances[0], false, 'the one-column-two-questions field is gone');
+});
+
+await test('the query skips torn-down rows and clamps the limit', async () => {
+  const db = recordingDb([]);
+  await costLedger(db, { limit: 99999 });
+  assert.match(db.calls[0].sql, /status <> 'torn_down'/);
+  assert.deepEqual(db.calls[0].params, [2000]);
+});
+
+summary();