@bongos/core 1.19.1035 → 1.19.1036

package/tests/core_upgrade_owner_door.mjs

@@ -0,0 +1,444 @@
+// tests/core_upgrade_owner_door.mjs — a project's owner may move ITS core (task 1004174, ADR 0339).
+//
+// The owner's ruling (2026-09-26): only a project's owner upgrades it. The deploy door was
+// `core.pin.move` alone, so the owner of a hosted project below Archon could see they were
+// behind and never act. This file proves the widening is exactly that wide and no wider:
+//
+//   1. the owner of a TENANT row is admitted, to the preview and the move, for that row only;
+//   2. everyone else meets the unmodified atom gate, and a non-owner is refused byte-for-byte
+//      as before, whether or not the id exists;
+//   3. the platform's own row stays atom-only, even for the caller who owns it;
+//   4. the intent's actor names which door was used, and the runner's parse accepts both and
+//      nothing else (the id is interpolated into a shell command);
+//   5. the /deploy page shell admits a project owner and still refuses a stranger;
+//   6. a hosted project's hall hands its owner to the hub's door and never trusts a bad URL.
+//
+// These EXECUTE the real gate, router, page gate and shell.js; none of them reads source text.
+//
+// Run:  node tests/core_upgrade_owner_door.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+// The session double must be installed BEFORE auth.js loads: auth.js destructures
+// lookupSession at require time (the tests/scouting_page_gate.mjs precedent).
+const dbKernel = require('../src/bongos/db-kernel.js');
+let nextSession = null;
+dbKernel.lookupSession = async () => nextSession;
+
+const auth = require('../src/bongos/auth.js');
+const seams = require('../src/module-seams.js');
+const catalog = require('../modules/government/catalog.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const AZ = require('../modules/provisioning/core-upgrade-authz.js');
+const { requestedByOf } = require('../scripts/gds/provision-core-upgrade.js');
+const { hubDeployUrl } = require('../src/bongos/routes/core-update.js');
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed += 1; console.log(`  PASS  ${name}`); }
+  catch (e) { failed += 1; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// The cast. Builder 7 owns the hosted project hoodify-finance (a xenos on the hub, as
+// erikwils is); 8 is a stranger; 42 is an Archon. Builder 7 is also recorded as owning the
+// platform row here, which is the case the ruling must NOT open.
+const OWNER = { id: 7, rank: 'xenos' };
+const STRANGER = { id: 8, rank: 'xenos' };
+const ARCHON = { id: 42, rank: 'archon' };
+const TENANT = Object.freeze({ id: 41, slug: 'hoodify-finance', status: 'active', hosting_shape: 'cloud-host', owner_builder_id: 7 });
+const COTENANT = Object.freeze({ id: 43, slug: 'mercury', status: 'active', hosting_shape: 'co-tenant', owner_builder_id: 7 });
+const PLATFORM = Object.freeze({ id: 1, slug: 'cloudbongos', status: 'active', hosting_shape: 'control-plane', owner_builder_id: 7 });
+const ROWS = new Map([[41, TENANT], [43, COTENANT], [1, PLATFORM]]);
+
+// ── 1. the predicate ──────────────────────────────────────────────────────────
+
+console.log('\nwho owns an upgradable project:');
+
+await t('the owner of a cloud-host or co-tenant row owns it', () => {
+  assert.equal(AZ.ownsUpgradableProject(TENANT, OWNER), true);
+  assert.equal(AZ.ownsUpgradableProject(COTENANT, OWNER), true);
+  assert.equal(AZ.ownsUpgradableProject(TENANT, { id: '7' }), true, 'ids compare as ids, not as types');
+});
+
+await t('the platform row is never an owner-movable project, even for its recorded owner', () => {
+  assert.equal(AZ.ownsUpgradableProject(PLATFORM, OWNER), false);
+  assert.equal(AZ.OWNER_SHAPES.has('control-plane'), false);
+});
+
+await t('it fails closed on every missing piece', () => {
+  assert.equal(AZ.ownsUpgradableProject(TENANT, STRANGER), false, 'someone else');
+  assert.equal(AZ.ownsUpgradableProject(null, OWNER), false, 'no row');
+  assert.equal(AZ.ownsUpgradableProject(TENANT, null), false, 'no builder');
+  assert.equal(AZ.ownsUpgradableProject(TENANT, { id: null }), false, 'a builder with no id');
+  assert.equal(AZ.ownsUpgradableProject({ ...TENANT, owner_builder_id: null }, { id: null }), false, 'null never equals null');
+  assert.equal(AZ.ownsUpgradableProject({ ...TENANT, hosting_shape: 'something-new' }, OWNER), false, 'a later shape is excluded by omission');
+});
+
+// ── 2. the middleware ─────────────────────────────────────────────────────────
+
+console.log('\nthe OR gate:');
+
+// The atom gate as a spy: admits an Archon, refuses everyone else with the ONE body the
+// door has always sent. Nothing about the refusal depends on the id.
+function pinGateSpy() {
+  const spy = (req, res, next) => {
+    spy.calls += 1;
+    if (req.builder && req.builder.rank === 'archon') return next();
+    res.statusCode = 403;
+    res.body = { ok: false, error: 'forbidden', permission: 'core.pin.move' };
+    return undefined;
+  };
+  spy.calls = 0;
+  return spy;
+}
+
+async function runGate({ id, builder, getInstanceById, log }) {
+  const pinGate = pinGateSpy();
+  const lookups = [];
+  const provisioning = {
+    getInstanceById: getInstanceById || (async (_db, n) => { lookups.push(n); return ROWS.get(n) || null; }),
+  };
+  const gate = AZ.requireOwnProjectOrPin({ pinGate, provisioning, pool: {}, log });
+  const req = { params: { id }, builder };
+  const res = {};
+  let admitted = false;
+  await gate(req, res, () => { admitted = true; });
+  return { admitted, pinCalls: pinGate.calls, authority: req.coreUpgradeAuthority, res, lookups };
+}
+
+await t('the owner is admitted to THEIR project without meeting the atom', async () => {
+  const r = await runGate({ id: '41', builder: OWNER });
+  assert.equal(r.admitted, true);
+  assert.equal(r.pinCalls, 0, 'ownership answered first');
+  assert.equal(r.authority, 'owner');
+});
+
+await t('a stranger meets the atom and is refused', async () => {
+  const r = await runGate({ id: '41', builder: STRANGER });
+  assert.equal(r.admitted, false);
+  assert.equal(r.pinCalls, 1);
+  assert.equal(r.authority, 'pin');
+  assert.equal(r.res.statusCode, 403);
+});
+
+await t('the refusal is byte-identical whether the id exists or not', async () => {
+  const real = await runGate({ id: '41', builder: STRANGER });
+  const ghost = await runGate({ id: '999', builder: STRANGER });
+  assert.deepEqual(ghost.res, real.res, 'a stranger learns nothing about which ids exist');
+});
+
+await t('the owner of the platform row is NOT admitted by ownership', async () => {
+  const r = await runGate({ id: '1', builder: OWNER });
+  assert.equal(r.admitted, false);
+  assert.equal(r.pinCalls, 1, 'the platform row stays on the atom');
+});
+
+await t('an Archon is admitted by the atom, on a project they do not own', async () => {
+  const r = await runGate({ id: '41', builder: ARCHON });
+  assert.equal(r.admitted, true);
+  assert.equal(r.pinCalls, 1);
+  assert.equal(r.authority, 'pin', 'so the actor records the Archon door');
+});
+
+await t('an id that is not a plain positive integer is never looked up', async () => {
+  for (const id of ['abc', '0', '-1', '1e3', '41; DROP TABLE x', '', ' 41', '041x']) {
+    const r = await runGate({ id, builder: OWNER });
+    assert.deepEqual(r.lookups, [], `"${id}" reached the database`);
+    assert.equal(r.admitted, false, `"${id}" admitted a xenos`);
+    assert.equal(r.pinCalls, 1, `"${id}" skipped the atom`);
+  }
+});
+
+await t('a failing ownership read falls to the atom: it can deny an owner, never admit anyone', async () => {
+  const logged = [];
+  const log = { error: (m) => logged.push(m) };
+  const boom = async () => { throw new Error('connection reset (row: secret-owner-data)'); };
+  const owner = await runGate({ id: '41', builder: OWNER, getInstanceById: boom, log });
+  assert.equal(owner.admitted, false, 'an outage denies the owner');
+  assert.equal(owner.pinCalls, 1);
+  const archon = await runGate({ id: '41', builder: ARCHON, getInstanceById: boom, log });
+  assert.equal(archon.admitted, true, 'and leaves the Archon path working');
+  assert.ok(logged.length >= 1 && logged.every((m) => /falling back to core\.pin\.move/.test(m)), 'the fallback is logged');
+});
+
+// ── 3. the actor and the runner's parse ───────────────────────────────────────
+
+console.log('\nthe actor says which door was used:');
+
+await t('owner and Archon moves are labelled apart, and both carry the builder id', () => {
+  assert.equal(AZ.coreUpgradeActor({ coreUpgradeAuthority: 'owner', builder: { id: 7 } }), 'api:owner:7');
+  assert.equal(AZ.coreUpgradeActor({ coreUpgradeAuthority: 'pin', builder: { id: 42 } }), 'api:archon:42');
+  assert.equal(AZ.coreUpgradeActor({ builder: { id: 42 } }), 'api:archon:42', 'no recorded door is the Archon door');
+});
+
+await t('the runner attributes both, and passes nothing but digits into its command', () => {
+  assert.equal(requestedByOf({ requested_by: 'api:archon:42' }), '42');
+  assert.equal(requestedByOf({ requested_by: 'api:owner:7' }), '7');
+  for (const bad of ['api:owner:7; rm -rf /', 'api:owner:', 'api:self', 'api:owner:7 ', 'owner:7', 'api:root:1']) {
+    assert.equal(requestedByOf({ requested_by: bad }), '', `"${bad}" must not pass`);
+  }
+  assert.equal(requestedByOf({ requested_by: 42 }), '');
+  assert.equal(requestedByOf(null), '');
+  assert.equal(requestedByOf({}), '');
+});
+
+// ── 4. the assembled router, driven by real requests ──────────────────────────
+
+console.log('\nthe routes, end to end:');
+
+await t('POST: the owner queues a move on their project; a stranger and the platform row are refused', async () => {
+  const api = require('../src/module-api.js');
+  const prov = require('../modules/provisioning/provisioning.js');
+  const routePath = require.resolve('../modules/provisioning/routes/core-upgrade.js');
+  const saved = {};
+  const stub = (key, value) => {
+    saved[key] = Object.getOwnPropertyDescriptor(api, key);
+    Object.defineProperty(api, key, { value, configurable: true, writable: true });
+  };
+  // The caller rides a test header; the atom gate is the spy's rule (Archon only) with
+  // the door's own refusal shape. Everything between them is the real code.
+  stub('requireBuilder', (req, _res, next) => { req.builder = JSON.parse(req.headers['x-test-builder']); next(); });
+  stub('requirePermission', (atom) => (req, res, next) => {
+    if (req.builder.rank === 'archon') return next();
+    return res.status(403).json({ ok: false, error: 'forbidden', permission: atom });
+  });
+  stub('pool', {});
+  const queued = [];
+  const savedProv = { get: prov.getInstanceById, enq: prov.enqueueIntent, rec: prov.recordEvent };
+  prov.getInstanceById = async (_db, n) => ROWS.get(Number(n)) || null;
+  prov.enqueueIntent = async (_db, id, action, requestedBy, targetVersion) => {
+    queued.push({ id, action, requestedBy, targetVersion });
+    return { intent: { id: queued.length, action, state: 'pending', target_version: targetVersion }, created: true };
+  };
+  prov.recordEvent = async () => {};
+  delete require.cache[routePath];
+
+  const express = require('express');
+  const app = express();
+  app.use(express.json());
+  app.use(require(routePath)());
+  const server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  const base = `http://127.0.0.1:${server.address().port}`;
+  const post = (id, who) => fetch(`${base}/provisioning/instances/${id}/core-upgrade`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', 'x-test-builder': JSON.stringify(who) },
+    body: JSON.stringify({ to: '1.19.1033', dry_run: true }),
+  });
+  try {
+    const own = await post(41, OWNER);
+    assert.notEqual(own.status, 403, 'the owner is not refused on their own project');
+    assert.deepEqual(queued.map((q) => [q.id, q.requestedBy]), [[41, 'api:owner:7']], 'queued, and attributed to the owner door');
+
+    const strangerReal = await post(41, STRANGER);
+    const strangerGhost = await post(999, STRANGER);
+    assert.equal(strangerReal.status, 403);
+    assert.equal(strangerGhost.status, 403);
+    assert.deepEqual(await strangerReal.json(), await strangerGhost.json(), 'the same refusal for a real and a missing id');
+
+    const platform = await post(1, OWNER);
+    assert.equal(platform.status, 403, 'owning the platform row does not open the platform to a non-Archon');
+
+    const archon = await post(41, ARCHON);
+    assert.notEqual(archon.status, 403);
+    assert.deepEqual(queued.map((q) => q.requestedBy), ['api:owner:7', 'api:archon:42'], 'nothing else was queued');
+
+    const preview = await fetch(`${base}/provisioning/instances/41/core-upgrade`, { headers: { 'x-test-builder': JSON.stringify(STRANGER) } });
+    assert.equal(preview.status, 403, 'the preview is gated like the move');
+
+    const cp = await fetch(`${base}/provisioning/control-plane`, { headers: { 'x-test-builder': JSON.stringify(OWNER) } });
+    assert.equal(cp.status, 403, 'the platform entrance keeps the atom alone');
+  } finally {
+    server.close();
+    for (const [k, d] of Object.entries(saved)) Object.defineProperty(api, k, d);
+    prov.getInstanceById = savedProv.get;
+    prov.enqueueIntent = savedProv.enq;
+    prov.recordEvent = savedProv.rec;
+    delete require.cache[routePath];
+  }
+});
+
+// ── 5. the /deploy page shell ─────────────────────────────────────────────────
+
+console.log('\nthe /deploy page shell:');
+
+function fakeRes() {
+  const res = {
+    _redirect: null,
+    status() { return this; },
+    json() { return this; },
+    redirect(a, b) { this._redirect = b === undefined ? { code: 302, loc: a } : { code: a, loc: b }; return this; },
+    end() { return this; },
+  };
+  attachFail({}, res, () => {});
+  return res;
+}
+
+async function runPage(session, hub) {
+  nextSession = session;
+  seams._reset();
+  seams.registerProvider('government', {
+    resolveBuilderPermissions: async () => catalog.seedForRank(session ? session.rank : 'xenos'),
+  });
+  if (hub) seams.registerProvider('platform-identity.hub', hub);
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireCorePinPage({ headers: { cookie: 'gds_session=t' } }, res, () => { nexted = true; });
+  return { res, nexted };
+}
+
+const OWNER_SESSION = { builder_id: 7, github_id: '9001', rank: 'xenos' };
+const STRANGER_SESSION = { builder_id: 8, github_id: '9002', rank: 'xenos' };
+const ARCHON_SESSION = { builder_id: 42, github_id: '9042', rank: 'archon' };
+const owns = { isProjectOwner: async (githubId) => String(githubId) === '9001' };
+
+await t('a project owner holding no atom reaches the shell', async () => {
+  const { nexted } = await runPage(OWNER_SESSION, owns);
+  assert.ok(nexted, 'without this the widening is real in the API and unreachable in the product');
+});
+
+await t('a stranger gets exactly the redirect the page sent before the second door existed', async () => {
+  const withDoor = await runPage(STRANGER_SESSION, owns);
+  const noDoor = await runPage(STRANGER_SESSION, null);
+  assert.equal(withDoor.nexted, false);
+  assert.deepEqual(withDoor.res._redirect, noDoor.res._redirect);
+  assert.match(withDoor.res._redirect.loc, /denied=core\.pin\.move/, 'and it still names the atom');
+});
+
+await t('an Archon is admitted by the atom without the second door being asked', async () => {
+  const spy = { isProjectOwner: () => { throw new Error('must not be consulted for an atom holder'); } };
+  const { nexted } = await runPage(ARCHON_SESSION, spy);
+  assert.ok(nexted);
+});
+
+seams._reset();
+nextSession = null;
+
+// ── 6. the hand-off address, and the hall that uses it ────────────────────────
+
+console.log('\nthe hand-off to the hub:');
+
+await t('deploy_url is the hub origin plus this project\'s slug, and null without a hub', () => {
+  assert.equal(hubDeployUrl({ origin: 'https://cloudbongos.com', clientId: 'hoodify-finance' }),
+    'https://cloudbongos.com/deploy?project=hoodify-finance');
+  assert.equal(hubDeployUrl({ origin: 'https://cloudbongos.com/', clientId: 'mercury' }),
+    'https://cloudbongos.com/deploy?project=mercury', 'a trailing slash is not doubled');
+  assert.equal(hubDeployUrl({ origin: 'https://h.test', clientId: 'a b&c' }), 'https://h.test/deploy?project=a%20b%26c');
+  assert.equal(hubDeployUrl({ origin: 'https://cloudbongos.com' }), null, 'no client id: not federated');
+  assert.equal(hubDeployUrl({ origin: 'javascript:alert(1)', clientId: 'x' }), null);
+  assert.equal(hubDeployUrl({ origin: 'https://h.test/"><script>', clientId: 'x' }), null);
+  assert.equal(hubDeployUrl(null), null);
+});
+
+const SHELL = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/shell.js'), 'utf8');
+
+// The real shell.js in a DOM stub (the tests/core_update_banner.mjs harness), with the
+// /core-update answer carrying a deploy_url and elements that remember their attributes.
+function boot({ provisioning, deployUrl }) {
+  const els = new Map();
+  const inserted = [];
+  const makeEl = () => ({
+    dataset: {}, style: {}, textContent: '', hidden: false, _html: '', _attrs: {},
+    classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } },
+    setAttribute(k, v) { this._attrs[k] = String(v); }, getAttribute(k) { return k in this._attrs ? this._attrs[k] : null; }, removeAttribute(k) { delete this._attrs[k]; },
+    addEventListener() {},
+    querySelector() { return { addEventListener() {} }; },
+    querySelectorAll() { return []; },
+    appendChild() {}, focus() {}, click() {}, scrollIntoView() {}, remove() {},
+    insertAdjacentElement(_pos, el) { inserted.push(el); },
+    set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; },
+  });
+  // The rail's Deploy item as the rendered markup makes it: data-gate="archon"
+  // data-module="provisioning" (shell.js renders both attributes onto the <a>).
+  const deploy = makeEl();
+  deploy.dataset.gate = 'archon';
+  deploy.dataset.module = 'provisioning';
+  els.set('nav-deploy', deploy);
+  const documentObj = {
+    body: { dataset: { page: 'settings' } },
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } } },
+    getElementById(id) { if (!els.has(id)) els.set(id, makeEl()); return els.get(id); },
+    querySelectorAll() { return []; },
+    createElement() { return makeEl(); },
+    addEventListener() {}, dispatchEvent() {},
+    get cookie() { return ''; }, set cookie(_v) {},
+  };
+  const location = { hostname: 'h', origin: 'https://h', pathname: '/settings', hash: '', assign() {}, replace() {} };
+  const update = { running: '1.19.871', latest: '1.19.1033', behind: true, reading: 'ok' };
+  const windowObj = {
+    __BRANDING__: {}, __MODULES__: { enabled: { provisioning } },
+    BongosClient: {
+      createClient: () => ({
+        request: (_method, p) => (p === '/api/bongos/core-update'
+          ? Promise.resolve({ status: 200, data: { ok: true, update, deploy_url: deployUrl } })
+          : new Promise(() => {})),
+      }),
+    },
+    matchMedia: () => ({ matches: false, addEventListener() {} }),
+    localStorage: { getItem: () => null, setItem() {} },
+    requestAnimationFrame() {}, scrollTo() {}, location, addEventListener() {},
+  };
+  const sandbox = { window: windowObj, document: documentObj, location, console, setTimeout, clearTimeout, queueMicrotask,
+    CustomEvent: class { constructor(ty, i) { this.type = ty; Object.assign(this, i); } } };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(SHELL, sandbox, { filename: 'shell.js' });
+  windowObj.OTBShell.applyAccess({ authed: true, rank: 'archon', permissions: { 'core.pin.move': true } });
+  return {
+    banner: () => inserted.find((e) => String(e._html).includes('is available')),
+    deployItem: () => els.get('nav-deploy'),
+  };
+}
+const settle = () => new Promise((r) => setTimeout(r, 0));
+const HUB = 'https://cloudbongos.com/deploy?project=hoodify-finance';
+
+await t('on a hosted project, the banner\'s Upgrade goes to the hub door for THIS project', async () => {
+  const b = boot({ provisioning: false, deployUrl: HUB });
+  await settle();
+  assert.ok(b.banner(), 'the banner renders');
+  assert.ok(b.banner().innerHTML.includes(`href="${HUB}"`), 'Upgrade links to the hub');
+  assert.doesNotMatch(b.banner().innerHTML, /href="\/deploy"/, 'never the dead local page');
+});
+
+await t('on a hosted project, the rail\'s Deploy item is re-pointed at the hub', async () => {
+  const b = boot({ provisioning: false, deployUrl: HUB });
+  await settle();
+  const item = b.deployItem();
+  assert.equal(item.getAttribute('href'), HUB);
+  assert.equal('module' in item.dataset, false, 'its module gate is lifted so the access loop stops hiding it');
+  assert.equal(item.hidden, false, 'an Archon on their own project sees it');
+});
+
+await t('a hosted project with no hub, or a hub address that is not plain http(s), offers no link', async () => {
+  for (const url of [null, 'javascript:alert(1)', 'https://x.test/"><img src=x onerror=alert(1)>', 42]) {
+    const b = boot({ provisioning: false, deployUrl: url });
+    await settle();
+    assert.ok(b.banner(), 'the news is still told');
+    assert.doesNotMatch(b.banner().innerHTML, /core-update-notice__action/, `no action for ${JSON.stringify(url)}`);
+    const item = b.deployItem();
+    assert.equal(item.getAttribute('href'), null, `the rail is not re-pointed for ${JSON.stringify(url)}`);
+    assert.equal(item.dataset.module, 'provisioning', 'and it keeps its module gate, so a hosted project still hides it');
+  }
+});
+
+await t('on the platform, the local door wins: the hub address is ignored', async () => {
+  const b = boot({ provisioning: true, deployUrl: HUB });
+  await settle();
+  assert.match(b.banner().innerHTML, /href="\/deploy"/);
+  assert.ok(!b.banner().innerHTML.includes(HUB));
+  const item = b.deployItem();
+  assert.notEqual(item.getAttribute('href'), HUB, 'the rail keeps the local /deploy');
+  assert.equal(item.dataset.module, 'provisioning', 'and its module gate, which the platform satisfies');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = '9cc99bb9b7cce948';
+const SHELL_SHA = '983282a83fd5aa71';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);

package/tests/provisioning_teardown_intent.mjs

@@ -47,20 +47,22 @@ async function ta(name, fn) {
 // A stateful fake of provisioning_intents that ENFORCES ux_provisioning_intents_open
 // (at most ONE open pending|running intent per instance, action-blind) — so the exact
 // collision the bug rode on is reproduced, not approximated. Dispatches on SQL shape.
-function fakeIntentDb(seed = []) {
+function fakeIntentDb(seed = [], { shape = 'co-tenant' } = {}) {
   let nextId = 1;
+  let updates = 0;
   const rows = seed.map((r) => ({ id: nextId++, requested_by: null, last_error: null, resolved_at: null, ...r }));
   const open = (instanceId) => rows.filter((r) =>
     String(r.instance_id) === String(instanceId) && (r.state === 'pending' || r.state === 'running'));
   return {
     rows,
+    get updates() { return updates; },
     query: async (sql, params) => {
       // The self-row guard's shape lookup (task 1003159, ADR 0293 D2): every enqueue
       // now asks "is this the control plane?" before it writes. These cases are all
       // ORDINARY instances, so the honest answer is a tenant shape — answering
       // 'control-plane' here would refuse every teardown in this file.
       if (/SELECT hosting_shape FROM provisioning_instances/.test(sql)) {
-        return { rows: [{ hosting_shape: 'co-tenant' }] };
+        return { rows: [{ hosting_shape: shape }] };
       }
       if (/INSERT INTO provisioning_intents/.test(sql)) {
         const [instance_id, action, requested_by] = params;
@@ -80,6 +82,12 @@ function fakeIntentDb(seed = []) {
         // push, task 1003238 to the restart; an open teardown is left alone for the
         // idempotent path).
         assert.match(sql, /action IN \('provision', 'settings-apply', 'restart', 'repo-private'\) AND state = 'pending'/);
+        updates++;
+        // The supersede must skip the platform's own row IN ITS OWN SQL (task 1004286): the
+        // guard refuses that teardown only afterwards, in enqueueIntent. Modelled, not assumed.
+        if (shape === 'control-plane' && /NOT EXISTS \(SELECT 1 FROM provisioning_instances WHERE id = \$1 AND hosting_shape = 'control-plane'\)/.test(sql)) {
+          return { rows: [] };
+        }
         const hit = rows.filter((r) =>
           String(r.instance_id) === String(params[0]) && SUPERSEDABLE.has(r.action) && r.state === 'pending');
         for (const r of hit) { r.state = 'error'; r.last_error = 'superseded: teardown requested'; }
@@ -135,6 +143,24 @@ await ta('a clean queue just enqueues (no supersede)', async () => {
   assert.equal(r.intent.requested_by, 'api:archon:1');
 });
 
+// task 1004286 — the supersede runs BEFORE the control-plane guard (which lives in
+// enqueueIntent, the one place every intent passes), and the two share no transaction. So a teardown pressed on
+// the platform's own row was correctly refused — after it had already cancelled a
+// pending restart. 'restart' is the one action both allowed on the control plane and
+// superseded by a teardown, so that is the whole blast radius. The owner was told nothing
+// happened while the restart they asked for no longer ran. The supersede now skips that row in
+// its own statement, so the guard still runs once, in one place.
+await ta('a REFUSED teardown of the control-plane row leaves a pending restart pending', async () => {
+  const db = fakeIntentDb([{ instance_id: 1, action: 'restart', state: 'pending' }], { shape: 'control-plane' });
+  await assert.rejects(provisioning.enqueueTeardown(db, 1, 'api:archon:1'),
+    (e) => e.code === 'control_plane_protected', 'the teardown is refused, as before');
+  const restart = db.rows.find((x) => x.action === 'restart');
+  assert.equal(restart.state, 'pending', 'the refused teardown cancelled nothing');
+  assert.equal(restart.last_error, null);
+  assert.equal(db.rows.filter((x) => x.action === 'teardown').length, 0, 'and queued nothing');
+  assert.equal(db.updates, 1, 'one supersede statement ran, and it matched nothing on the control-plane row');
+});
+
 t('PROVISION_ENQUEUE_FROM: an active or tearing-down instance never re-enqueues a provision intent', () => {
   assert.equal(provisioning.PROVISION_ENQUEUE_FROM.has('active'), false, 'active — the enabling misstep');
   assert.equal(provisioning.PROVISION_ENQUEUE_FROM.has('tearing_down'), false, 'tearing_down — mid-reclaim');

package/tests/scouting_page_gate.mjs

@@ -174,11 +174,19 @@ await t('the OTHER page gates are untouched — their seam is never consulted at
   assert.ok(vote, 'board.vote.cast floors at xenos on purpose (ADR 0266) — admitted without the seam');
 });
 
-await t('only ONE gate declares a second door (a widening must be opted into, one gate at a time)', () => {
+await t('only the gates WITH A PROOF declare a second door (a widening must be opted into, one gate at a time)', () => {
   const src = require('node:fs').readFileSync(new URL('../src/bongos/auth.js', import.meta.url), 'utf8');
-  const declarations = [...src.matchAll(/alsoAdmits:\s*'([^']+)'/g)].map((m) => m[1]);
-  assert.deepEqual(declarations, ['isProjectOwner'],
+  // Keyed by GATE, not just the door's name, so a third gate borrowing 'isProjectOwner'
+  // fails here instead of hiding behind an unchanged list of names. Each entry names the
+  // file that proves its widening:
+  //   requireProjectCuratePage — this file (ADR 0210 D3);
+  //   requireCorePinPage       — tests/core_upgrade_owner_door.mjs (ADR 0339, task 1004174).
+  const declarations = [...src.matchAll(/(require\w+Page):\s*Object\.freeze\(\{[^}]*alsoAdmits:\s*'([^']+)'/g)]
+    .map((m) => `${m[1]}:${m[2]}`);
+  assert.deepEqual(declarations, ['requireProjectCuratePage:isProjectOwner', 'requireCorePinPage:isProjectOwner'],
     'a second alsoAdmits appearing without its own proof is how a page gate quietly widens');
+  const plain = [...src.matchAll(/alsoAdmits:\s*'([^']+)'/g)].length;
+  assert.equal(plain, declarations.length, 'every alsoAdmits sits on a named page gate this test can see');
 });
 
 seams._reset();