@bongos/core 1.19.1073 → 1.19.1075

package/tests/boxes.mjs

@@ -1,1585 +0,0 @@
-// tests/boxes.mjs
-//
-// Hermetic unit smoke for the per-builder box lifecycle (ADR 0031 §2/§5, #598).
-// Covers the PURE decision core of modules/dev-box/boxes.js (rank gate, size/cost
-// catalog, idle/dormant SELECTION, transition legality) and the dry-run/live
-// contract of modules/dev-box/do-api.js — all with NO database, NO DigitalOcean, NO
-// network, and NO real clock (nowMs is always injected). The DB-backed
-// orchestration in scripts/gds/box.js is exercised on the control plane in
-// dry-run; the decisions it relies on are pinned here.
-//
-// Run:  node tests/boxes.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-const boxes = require('../modules/dev-box/boxes.js');
-const { DoApi, DoApiError } = require('../scripts/gds/do-api.js');
-const { isTunnelReadyStatus } = require('../modules/dev-box/routes/box.js');
-
-let passed = 0;
-let failed = 0;
-function t(name, fn) {
-  try { fn(); passed++; console.log(`  PASS  ${name}`); }
-  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
-}
-async function ta(name, fn) {
-  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
-  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
-}
-
-const HOUR = 3_600_000;
-const DAY = 86_400_000;
-const NOW = Date.parse('2026-06-04T12:00:00Z');
-
-console.log('rank gate:');
-
-t('rankMeetsBoxFloor: ordering xenos < thetes < metic < archon', () => {
-  assert.equal(boxes.rankMeetsBoxFloor('xenos', 'xenos'), true);
-  assert.equal(boxes.rankMeetsBoxFloor('metic', 'xenos'), true);
-  assert.equal(boxes.rankMeetsBoxFloor('archon', 'metic'), true);
-  assert.equal(boxes.rankMeetsBoxFloor('xenos', 'metic'), false);
-  assert.equal(boxes.rankMeetsBoxFloor('metic', 'archon'), false);
-  // ADR 0034 regression (#869): thetes sits above the xenos floor, below metic.
-  assert.equal(boxes.rankMeetsBoxFloor('thetes', 'xenos'), true);
-  assert.equal(boxes.rankMeetsBoxFloor('thetes', 'metic'), false);
-  assert.equal(boxes.rankMeetsBoxFloor('metic', 'thetes'), true);
-});
-
-t('rankMeetsBoxFloor: unknown rank or floor is false (fail-closed)', () => {
-  assert.equal(boxes.rankMeetsBoxFloor('bogus', 'xenos'), false);
-  assert.equal(boxes.rankMeetsBoxFloor(undefined, 'xenos'), false);
-  assert.equal(boxes.rankMeetsBoxFloor('archon', 'bogus'), false);
-});
-
-t('boxScopeForRank: xenos/thetes→starter, metic/archon→full', () => {
-  assert.equal(boxes.boxScopeForRank('xenos'), 'starter');
-  assert.equal(boxes.boxScopeForRank('metic'), 'full');
-  assert.equal(boxes.boxScopeForRank('archon'), 'full');
-  // ADR 0034: a Thetes may hold a box but earns no scope uplift — still 'starter'.
-  assert.equal(boxes.boxScopeForRank('thetes'), 'starter');
-});
-
-t('thetes can provision a box (ADR 0034 regression, #869)', () => {
-  // The bug: thetes missing from RANK_ORDER → fail-closed below the xenos floor
-  // → 403 on /box/ensure for the whole tier (builder 25 hit 6+ of these).
-  assert.doesNotThrow(() => boxes.assertProvisionAllowed({ rank: 'thetes' }));
-  const d = boxes.decideEnsureAction({ boxState: 'none', rank: 'thetes', status: 'active' });
-  assert.equal(d.action, 'provision');
-});
-
-t('assertProvisionAllowed: passes at/above floor, throws INSUFFICIENT_RANK below', () => {
-  // Default floor (xenos): even a Xenos may get a (scoped) box — ADR 0031 §5(b).
-  assert.doesNotThrow(() => boxes.assertProvisionAllowed({ rank: 'xenos' }));
-  assert.doesNotThrow(() => boxes.assertProvisionAllowed({ rank: 'archon' }));
-  // Raised floor: a Xenos is refused.
-  let err;
-  try { boxes.assertProvisionAllowed({ rank: 'xenos', floor: 'metic' }); }
-  catch (e) { err = e; }
-  assert.ok(err, 'should throw');
-  assert.equal(err.code, 'INSUFFICIENT_RANK');
-  assert.equal(err.required, 'metic');
-  assert.equal(err.actual, 'xenos');
-});
-
-console.log('box block (idea 257 / task 1163):');
-
-t('blocked builder is denied a NEW box (state none → BOX_PROVISION_BLOCKED)', () => {
-  const d = boxes.decideEnsureAction({ boxState: 'none', rank: 'metic', status: 'active', blocked: true });
-  assert.equal(d.action, 'denied');
-  assert.equal(d.reason, 'BOX_PROVISION_BLOCKED');
-});
-
-t('blocked builder cannot WAKE a parked box (state parked → BOX_PROVISION_BLOCKED)', () => {
-  const d = boxes.decideEnsureAction({ boxState: 'parked', rank: 'metic', status: 'active', blocked: true });
-  assert.equal(d.action, 'denied');
-  assert.equal(d.reason, 'BOX_PROVISION_BLOCKED');
-});
-
-t('block is FUTURE-ONLY: an already-active box still heartbeats (state active → ready)', () => {
-  // Lars's "block future opens only" default: blocking does not tear down a
-  // running box; the active box keeps heartbeating until it idles out or the
-  // Archon explicitly closes it (close_current).
-  const d = boxes.decideEnsureAction({ boxState: 'active', rank: 'metic', status: 'active', blocked: true });
-  assert.equal(d.action, 'ready');
-});
-
-t('block does not disturb an in-flight provision (state provisioning → in_progress)', () => {
-  const d = boxes.decideEnsureAction({ boxState: 'provisioning', rank: 'metic', status: 'active', blocked: true });
-  assert.equal(d.action, 'in_progress');
-});
-
-t('NOT blocked is unchanged (state none → provision)', () => {
-  const d = boxes.decideEnsureAction({ boxState: 'none', rank: 'metic', status: 'active', blocked: false });
-  assert.equal(d.action, 'provision');
-  // Default (blocked omitted) must behave exactly as before this feature.
-  const d2 = boxes.decideEnsureAction({ boxState: 'parked', rank: 'metic', status: 'active' });
-  assert.equal(d2.action, 'wake');
-});
-
-console.log('size + cost catalog:');
-
-t('default size is in the catalog and is the 4 GB box', () => {
-  assert.ok(boxes.SIZE_CATALOG[boxes.DEFAULT_SIZE], 'default size present');
-  assert.equal(boxes.DEFAULT_SIZE, 's-2vcpu-4gb');
-});
-
-t('computeActiveCostUsd: hours × hourly rate', () => {
-  const cost = boxes.computeActiveCostUsd({
-    sizeSlug: 's-2vcpu-4gb', activeSinceMs: NOW - 10 * HOUR, untilMs: NOW,
-  });
-  // 10h × 0.03571 ≈ 0.3571
-  assert.ok(Math.abs(cost - 0.3571) < 0.001, `expected ~0.3571, got ${cost}`);
-});
-
-t('computeActiveCostUsd: zero/negative/invalid interval → 0', () => {
-  assert.equal(boxes.computeActiveCostUsd({ sizeSlug: 's-2vcpu-4gb', activeSinceMs: NOW, untilMs: NOW }), 0);
-  assert.equal(boxes.computeActiveCostUsd({ sizeSlug: 's-2vcpu-4gb', activeSinceMs: NOW, untilMs: NOW - HOUR }), 0);
-  assert.equal(boxes.computeActiveCostUsd({ sizeSlug: 's-2vcpu-4gb', activeSinceMs: null, untilMs: NOW }), 0);
-  assert.equal(boxes.computeActiveCostUsd({ sizeSlug: 'no-such-size', activeSinceMs: NOW - HOUR, untilMs: NOW }), 0);
-});
-
-console.log('idle / dormant selection:');
-
-t('selectIdleBoxes: picks active boxes past the idle threshold, ignores others', () => {
-  const rows = [
-    { state: 'active', github_login: 'old', last_activity_at: new Date(NOW - 45 * 60000).toISOString() },
-    { state: 'active', github_login: 'fresh', last_activity_at: new Date(NOW - 5 * 60000).toISOString() },
-    { state: 'parked', github_login: 'parked', last_activity_at: new Date(NOW - 999 * 60000).toISOString() },
-  ];
-  const idle = boxes.selectIdleBoxes(rows, { idleMinutes: 30, nowMs: NOW });
-  assert.equal(idle.length, 1);
-  assert.equal(idle[0].github_login, 'old');
-});
-
-t('selectIdleBoxes: COALESCEs to active_since when never heartbeated', () => {
-  const rows = [
-    // No heartbeat, but active_since is recent → NOT idle (full window from boot).
-    { state: 'active', github_login: 'booting', last_activity_at: null, active_since: new Date(NOW - 2 * 60000).toISOString() },
-    // No heartbeat, active_since old → idle.
-    { state: 'active', github_login: 'stale', last_activity_at: null, active_since: new Date(NOW - 90 * 60000).toISOString() },
-  ];
-  const idle = boxes.selectIdleBoxes(rows, { idleMinutes: 30, nowMs: NOW });
-  assert.deepEqual(idle.map((r) => r.github_login), ['stale']);
-});
-
-t('selectIdleBoxes: guards bad inputs', () => {
-  assert.deepEqual(boxes.selectIdleBoxes(null, { idleMinutes: 30, nowMs: NOW }), []);
-  assert.deepEqual(boxes.selectIdleBoxes([], { idleMinutes: 0, nowMs: NOW }), []);
-  assert.deepEqual(boxes.selectIdleBoxes([], { idleMinutes: 30, nowMs: NaN }), []);
-});
-
-t('selectIdleBoxes: with NO cap configured, claude_active=true skips regardless of age (pre-1003507 path)', () => {
-  const rows = [
-    // Old + claude running → kept alive.
-    { state: 'active', github_login: 'clauding', last_activity_at: new Date(NOW - 60 * 60000).toISOString(), claude_active: true },
-    // Old + claude NOT running → idle.
-    { state: 'active', github_login: 'idle', last_activity_at: new Date(NOW - 60 * 60000).toISOString(), claude_active: false },
-    // Old + no claude_active field (legacy row) → idle.
-    { state: 'active', github_login: 'legacy', last_activity_at: new Date(NOW - 60 * 60000).toISOString() },
-  ];
-  const idle = boxes.selectIdleBoxes(rows, { idleMinutes: 30, nowMs: NOW });
-  assert.deepEqual(idle.map((r) => r.github_login).sort(), ['idle', 'legacy']);
-});
-
-// --- task 1003507: the unattended cap ---------------------------------------
-//
-// The bug had TWO legs and either one alone kept an abandoned box alive:
-//   (1) claude_active is a latch only a ping can clear, and the sweep honoured it
-//       with no time bound at all -> unreapable at every threshold, forever;
-//   (2) load > 0.2 kept last_activity_at fresh, so the idle clock never expired.
-// The reported box had BOTH, which is why these tests model a FRESH heartbeat:
-// a fix that only bounds (1) leaves the box alive through (2) and looks green
-// against a stale-heartbeat fixture.
-const CAP = 12;
-const HOURS = (n) => n * 60 * 60000;
-const at = (ms) => new Date(ms).toISOString();
-
-// The reported incident, to scale: droplet up 5 days, heartbeat 5 min old, a
-// `claude` process running, nobody attached for 21h.
-const abandonedBox = () => ({
-  state: 'active', github_login: 'abandoned', claude_active: true,
-  claude_active_since: at(NOW - HOURS(21)),
-  last_activity_at: at(NOW - 5 * 60000),
-  last_attached_at: at(NOW - HOURS(21)),
-  active_since: at(NOW - 5 * 24 * 60 * 60000),
-});
-const swept = (rows, over = {}) => boxes.selectIdleBoxes(rows, {
-  idleMinutes: 30, nowMs: NOW, unattendedMaxHours: CAP, ...over,
-}).map((r) => r.github_login);
-
-t('selectIdleBoxes: an unattended box past the cap is reaped even with a FRESH heartbeat', () => {
-  // The regression that matters: last_activity_at is 5 min old, so the ordinary
-  // idle rule can never fire. Only the attachment clock catches this box.
-  assert.deepEqual(swept([abandonedBox()]), ['abandoned']);
-});
-
-t('selectIdleBoxes: a box with a human attached is spared regardless of the cap', () => {
-  assert.deepEqual(swept([{ ...abandonedBox(), last_attached_at: at(NOW - 10 * 60000) }]), []);
-  assert.deepEqual(swept([{ ...abandonedBox(), last_attached_at: at(NOW - HOURS(11)) }]), []);
-});
-
-t('selectIdleBoxes: the cap boundary', () => {
-  assert.deepEqual(swept([{ ...abandonedBox(), last_attached_at: at(NOW - HOURS(12) + 60000) }]), []);
-  assert.deepEqual(swept([{ ...abandonedBox(), last_attached_at: at(NOW - HOURS(12) - 60000) }]), ['abandoned']);
-});
-
-t('selectIdleBoxes: a latched claude_active box that stopped heartbeating is reaped', () => {
-  // Leg (1) on its own: silence cannot clear the flag, so before this fix the
-  // row survived every sweep at every threshold.
-  assert.deepEqual(swept([{
-    state: 'active', github_login: 'zombie', claude_active: true,
-    claude_active_since: at(NOW - 365 * 24 * 60 * 60000),
-    last_activity_at: at(NOW - 365 * 24 * 60 * 60000),
-    last_attached_at: null,
-  }]), ['zombie']);
-});
-
-t('selectIdleBoxes: a box with NO attachment data keeps the old behaviour', () => {
-  // A box still running the pre-1003507 heartbeat never reports `attached`, so
-  // last_attached_at stays NULL. NULL must read as "no data", never as
-  // "unattended" — otherwise this fix parks every un-upgraded box mid-work.
-  // (core_238 deliberately does not backfill the column for the same reason.)
-  assert.deepEqual(swept([{
-    state: 'active', github_login: 'legacy', claude_active: true,
-    claude_active_since: at(NOW - HOURS(2)),
-    last_activity_at: at(NOW - 5 * 60000),
-    last_attached_at: null,
-  }]), []);
-  // ...but it is still reapable the ordinary way once it goes quiet.
-  assert.deepEqual(swept([{
-    state: 'active', github_login: 'legacy2', claude_active: false,
-    last_activity_at: at(NOW - HOURS(1)), last_attached_at: null,
-  }]), ['legacy2']);
-});
-
-t('selectIdleBoxes: omitting the cap preserves the unbounded veto exactly', () => {
-  assert.deepEqual(swept([abandonedBox()], { unattendedMaxHours: undefined }), []);
-  assert.deepEqual(swept([abandonedBox()], { unattendedMaxHours: 0 }), []);
-});
-
-t('attendedRecently: NULL is unknown (true), not unattended', () => {
-  assert.equal(boxes.attendedRecently({ last_attached_at: null }, { nowMs: NOW, unattendedMaxHours: CAP }), true);
-  assert.equal(boxes.attendedRecently({ last_attached_at: at(NOW - HOURS(1)) }, { nowMs: NOW, unattendedMaxHours: CAP }), true);
-  assert.equal(boxes.attendedRecently({ last_attached_at: at(NOW - HOURS(20)) }, { nowMs: NOW, unattendedMaxHours: CAP }), false);
-  // No cap configured -> nothing is ever "unattended".
-  assert.equal(boxes.attendedRecently({ last_attached_at: at(NOW - HOURS(999)) }, { nowMs: NOW }), true);
-});
-
-t('claudeVetoHolds: a true flag with no recorded start is refused', () => {
-  // An unknown latch age is exactly the forever-latch being fixed, so it must
-  // NOT be honoured — core_238 stamps every box that is claude_active on deploy.
-  assert.equal(boxes.claudeVetoHolds(
-    { claude_active: true, claude_active_since: null }, { nowMs: NOW, unattendedMaxHours: CAP }
-  ), false);
-  assert.equal(boxes.claudeVetoHolds(
-    { claude_active: true, claude_active_since: at(NOW - HOURS(2)) }, { nowMs: NOW, unattendedMaxHours: CAP }
-  ), true);
-  assert.equal(boxes.claudeVetoHolds(
-    { claude_active: true, claude_active_since: at(NOW - HOURS(20)) }, { nowMs: NOW, unattendedMaxHours: CAP }
-  ), false);
-  assert.equal(boxes.claudeVetoHolds({ claude_active: false }, { nowMs: NOW, unattendedMaxHours: CAP }), false);
-});
-
-t('idleReason: names the clock that actually selected the box', () => {
-  const opts = { nowMs: NOW, idleMinutes: 30, unattendedMaxHours: CAP };
-  assert.match(boxes.idleReason(abandonedBox(), opts), /unattended 21h/);
-  assert.match(boxes.idleReason({
-    state: 'active', claude_active: false,
-    last_activity_at: at(NOW - HOURS(1)), last_attached_at: at(NOW - 60000),
-  }, opts), /idle 60m/);
-});
-
-t('selectDormantBoxes: picks parked boxes past the dormant threshold', () => {
-  const rows = [
-    { state: 'parked', github_login: 'gone', parked_at: new Date(NOW - 20 * DAY).toISOString() },
-    { state: 'parked', github_login: 'recent', parked_at: new Date(NOW - 3 * DAY).toISOString() },
-    { state: 'active', github_login: 'working', parked_at: null },
-  ];
-  const dormant = boxes.selectDormantBoxes(rows, { dormantDays: 14, nowMs: NOW });
-  assert.equal(dormant.length, 1);
-  assert.equal(dormant[0].github_login, 'gone');
-});
-
-console.log('transition legality:');
-
-t('canTransition: legal moves', () => {
-  assert.equal(boxes.canTransition('provision', 'none'), true);
-  assert.equal(boxes.canTransition('provision', 'destroyed'), true);
-  assert.equal(boxes.canTransition('park', 'active'), true);
-  assert.equal(boxes.canTransition('wake', 'parked'), true);
-  assert.equal(boxes.canTransition('deprovision', 'parked'), true);
-  assert.equal(boxes.canTransition('deprovision', 'active'), true);
-});
-
-t('canTransition: illegal moves', () => {
-  assert.equal(boxes.canTransition('provision', 'active'), false, 'no double-provision');
-  assert.equal(boxes.canTransition('park', 'parked'), false, 'no double-park');
-  assert.equal(boxes.canTransition('wake', 'active'), false, 'no wake an active box');
-  assert.equal(boxes.canTransition('park', 'none'), false);
-});
-
-console.log('\nprovision dry-run inertness (#1034):');
-
-// cmdProvision is dependency-injected (pool, boxes, boxOnboard) and box.js exports
-// it for tests (the CLI IIFE is require.main-guarded). We inject recording fakes
-// so we can assert the literal contract the #1034 bug violated: a dry-run
-// (no --apply) must not write to builder_boxes — i.e. ensureBoxRow / setBoxState /
-// recordEvent must never fire, and a MISSING row (getBoxByBuilderId → null) must
-// still be treated as the provisionable 'none' state.
-const boxCli = require('../scripts/gds/box.js');
-
-function fakeProvisionDeps({ existingBox = null } = {}) {
-  const calls = [];
-  const fakeBoxes = {
-    assertProvisionAllowed() {},                 // no throw → rank gate passes
-    boxScopeForRank() { return 'full'; },
-    canTransition: boxes.canTransition,          // exercise the REAL transition map
-    async getBoxByBuilderId() { calls.push('getBoxByBuilderId'); return existingBox; },
-    async ensureBoxRow() { calls.push('ensureBoxRow'); return { id: 1, state: 'none', provisioned_at: null }; },
-    async setBoxState() { calls.push('setBoxState'); return {}; },
-    async recordEvent() { calls.push('recordEvent'); },
-    async setTerminalAccess() { calls.push('setTerminalAccess'); },
-  };
-  const fakeOnboard = { async listSshKeys() { return []; }, wrapManagedBlock() { return ''; } };
-  const pool = {
-    async query() {
-      return { rows: [{ id: 42, github_login: 'tester', display_name: 'T', rank: 'metic', status: 'active' }] };
-    },
-  };
-  return { calls, fakeBoxes, fakeOnboard, pool };
-}
-
-await ta('cmdProvision dry-run (no row yet) reads the gate but writes NOTHING to builder_boxes', async () => {
-  const { calls, fakeBoxes, fakeOnboard, pool } = fakeProvisionDeps({ existingBox: null });
-  const res = await boxCli.cmdProvision(pool, fakeBoxes, fakeOnboard, 'tester', { apply: false });
-  assert.equal(res.dryRun, true, 'dry-run returns {dryRun:true}');
-  assert.ok(calls.includes('getBoxByBuilderId'), 'gate reads via getBoxByBuilderId');
-  assert.ok(!calls.includes('ensureBoxRow'), 'dry-run must NOT ensureBoxRow (the #1034 bug)');
-  assert.ok(!calls.includes('setBoxState'), 'dry-run must NOT write box state');
-  assert.ok(!calls.includes('recordEvent'), 'dry-run must NOT write box_events');
-});
-
-await ta('cmdProvision dry-run still rejects an illegal transition (active box → no double-provision)', async () => {
-  const { calls, fakeBoxes, fakeOnboard, pool } = fakeProvisionDeps({ existingBox: { state: 'active' } });
-  const res = await boxCli.cmdProvision(pool, fakeBoxes, fakeOnboard, 'tester', { apply: false });
-  assert.equal(res.ok, false, "an 'active' box cannot be re-provisioned");
-  assert.match(res.error, /'active'/);
-  assert.ok(!calls.includes('ensureBoxRow'), 'a rejected dry-run also writes nothing');
-});
-
-console.log('DigitalOcean client (do-api):');
-
-await ta('dry-run is the DEFAULT and sends NO network request', async () => {
-  let called = 0;
-  const api = new DoApi({ fetchImpl: () => { called++; throw new Error('should not fetch'); } });
-  assert.equal(api.dryRun, true);
-  const r = await api.createDroplet({ name: 'x', region: 'nyc3', size: 's-2vcpu-4gb', image: 'ubuntu-24-04-x64' });
-  assert.equal(called, 0, 'fetch must not be called in dry-run');
-  assert.equal(r.dryRun, true);
-  assert.ok(r.droplet && String(r.droplet.id).startsWith('dryrun-'), 'returns a synthetic droplet');
-});
-
-await ta('live mode without a token throws clearly (never silent no-op)', async () => {
-  assert.throws(
-    () => new DoApi({ dryRun: false }),
-    (e) => e instanceof DoApiError && /DO_API_TOKEN/.test(e.message)
-  );
-});
-
-await ta('live createDroplet builds the right request via injected fetch', async () => {
-  const seen = {};
-  const fakeFetch = async (url, opts) => {
-    seen.url = url; seen.opts = opts;
-    return { ok: true, status: 202, text: async () => JSON.stringify({ droplet: { id: 123, status: 'new' } }) };
-  };
-  const api = new DoApi({ dryRun: false, token: 'tok_test', fetchImpl: fakeFetch });
-  const r = await api.createDroplet({ name: 'otb-box-someone', region: 'nyc3', size: 's-2vcpu-4gb', image: 'ubuntu-24-04-x64', tags: ['otb-builder-box'] });
-  assert.equal(r.droplet.id, 123);
-  assert.match(seen.url, /\/v2\/droplets$/);
-  assert.equal(seen.opts.method, 'POST');
-  assert.equal(seen.opts.headers.Authorization, 'Bearer tok_test');
-  const body = JSON.parse(seen.opts.body);
-  assert.equal(body.name, 'otb-box-someone');
-  assert.equal(body.size, 's-2vcpu-4gb');
-});
-
-await ta('live mode surfaces a DO error body as DoApiError', async () => {
-  const fakeFetch = async () => ({ ok: false, status: 422, text: async () => JSON.stringify({ id: 'unprocessable', message: 'bad size' }) });
-  const api = new DoApi({ dryRun: false, token: 'tok', fetchImpl: fakeFetch });
-  let err;
-  try { await api.getDroplet(1); } catch (e) { err = e; }
-  assert.ok(err instanceof DoApiError);
-  assert.equal(err.status, 422);
-  assert.match(err.message, /bad size/);
-});
-
-console.log('DB helpers (fake pg client — no real Postgres):');
-
-// A fake pg client: records every query and returns canned rows in order.
-function fakeDb(responses = []) {
-  const calls = [];
-  let i = 0;
-  return {
-    calls,
-    async query(sql, params) { calls.push({ sql, params }); return responses[i++] || { rows: [] }; },
-  };
-}
-
-await ta('recordComputeCost: tallies + writes a cost_log row keyed PER INTERVAL', async () => {
-  const db = fakeDb();
-  const box = { id: 7, builder_id: 42, size_slug: 's-2vcpu-4gb', active_since: new Date(NOW - 5 * HOUR).toISOString() };
-  const cost = await boxes.recordComputeCost(db, { box, untilMs: NOW, actor: 'sweep:idle' });
-  assert.ok(Math.abs(cost - 0.1786) < 0.001, `5h × rate ≈ 0.1786, got ${cost}`);
-  // 3 writes: UPDATE tally, INSERT box_events(cost), INSERT cost_log.
-  assert.equal(db.calls.length, 3);
-  const costLog = db.calls.find((c) => /INSERT INTO cost_log/.test(c.sql));
-  assert.ok(costLog, 'cost_log insert fired');
-  const sourceRef = costLog.params[2];
-  // source_ref must be per-interval (box id + interval end), so a second park
-  // of the same box does not collide on cost_log's UNIQUE(source, source_ref).
-  assert.match(sourceRef, /^builder_boxes#7@\d+$/, `source_ref per-interval, got ${sourceRef}`);
-  assert.equal(costLog.params[3], 42, 'builder_id attributed');
-});
-
-await ta('recordComputeCost: zero interval writes nothing', async () => {
-  const db = fakeDb();
-  const box = { id: 1, builder_id: 2, size_slug: 's-2vcpu-4gb', active_since: null };
-  const cost = await boxes.recordComputeCost(db, { box, untilMs: NOW });
-  assert.equal(cost, 0);
-  assert.equal(db.calls.length, 0, 'no writes for a zero-cost interval');
-});
-
-await ta('bumpActivity: an active box resets its clock with NO per-heartbeat event', async () => {
-  const db = fakeDb([{ rows: [{ state: 'active' }] }]);
-  const state = await boxes.bumpActivity(db, 42);
-  assert.equal(state, 'active');
-  assert.equal(db.calls.length, 1, 'only the UPDATE — heartbeats must not churn box_events');
-  assert.match(db.calls[0].sql, /UPDATE builder_boxes[\s\S]*state = 'active'/);
-});
-
-await ta('bumpActivity: with claudeActive=true writes claude_active column', async () => {
-  const db = fakeDb([{ rows: [{ state: 'active' }] }]);
-  const state = await boxes.bumpActivity(db, 42, { claudeActive: true });
-  assert.equal(state, 'active');
-  assert.match(db.calls[0].sql, /claude_active = \$2/);
-  assert.deepEqual(db.calls[0].params, [42, true]);
-});
-
-await ta('bumpActivity: without claudeActive does NOT write claude_active column', async () => {
-  const db = fakeDb([{ rows: [{ state: 'active' }] }]);
-  await boxes.bumpActivity(db, 42);
-  assert.ok(!db.calls[0].sql.includes('claude_active'), 'no claude_active column when flag not supplied');
-});
-
-await ta('bumpActivity: claudeActive=true stamps first_connected_at write-once (#823)', async () => {
-  const db = fakeDb([{ rows: [{ state: 'active' }] }]);
-  await boxes.bumpActivity(db, 42, { claudeActive: true });
-  // COALESCE so a later beat never moves it — the monotonic "connected" signal.
-  assert.match(db.calls[0].sql, /first_connected_at = COALESCE\(first_connected_at, now\(\)\)/);
-  // Still no extra bind param — first_connected_at uses now() inline.
-  assert.deepEqual(db.calls[0].params, [42, true]);
-});
-
-await ta('bumpActivity: claudeActive=false does NOT touch first_connected_at (never un-ticks)', async () => {
-  const db = fakeDb([{ rows: [{ state: 'active' }] }]);
-  await boxes.bumpActivity(db, 42, { claudeActive: false });
-  assert.ok(!db.calls[0].sql.includes('first_connected_at'), 'a claude_active=false beat leaves first_connected_at intact');
-});
-
-await ta('hasEverConnected: true when first_connected_at is set, false otherwise (#823)', async () => {
-  const connected = fakeDb([{ rows: [{ connected: true }] }]);
-  assert.equal(await boxes.hasEverConnected(connected, 42), true);
-  assert.match(connected.calls[0].sql, /first_connected_at IS NOT NULL/);
-
-  const notYet = fakeDb([{ rows: [{ connected: false }] }]);
-  assert.equal(await boxes.hasEverConnected(notYet, 42), false);
-
-  const noRow = fakeDb([{ rows: [] }]); // no box row at all
-  assert.equal(await boxes.hasEverConnected(noRow, 42), false);
-});
-
-await ta('setBoxState: rejects a non-allowlisted column (injection guard)', async () => {
-  const db = fakeDb([{ rows: [{ id: 1 }] }]);
-  await assert.rejects(
-    () => boxes.setBoxState(db, 1, 'active', { 'ip = oops; DROP TABLE builder_boxes; --': 'x' }),
-    /not.*allowlist|allowlist/i
-  );
-  // A legit column still goes through, parameterized.
-  const db2 = fakeDb([{ rows: [{ id: 1, state: 'active' }] }]);
-  const row = await boxes.setBoxState(db2, 1, 'active', { ip: '1.2.3.4', snapshot_id: null });
-  assert.ok(row);
-  assert.match(db2.calls[0].sql, /UPDATE builder_boxes SET state = \$2/);
-});
-
-await ta('setBoxState: host_keys + host_keys_at are allowlisted, parameterized (idea 310)', async () => {
-  const db = fakeDb([{ rows: [{ id: 1, state: 'destroyed' }] }]);
-  const row = await boxes.setBoxState(db, 1, 'destroyed', { host_keys: null, host_keys_at: null });
-  assert.ok(row);
-  // Settable (no allowlist throw) and bound as params, never interpolated.
-  assert.match(db.calls[0].sql, /host_keys = \$\d+/);
-  assert.match(db.calls[0].sql, /host_keys_at = \$\d+/);
-  assert.deepEqual(db.calls[0].params, [1, 'destroyed', null, null]);
-});
-
-console.log('\nidea 310 — a rebuilt box never serves a stale SSH identity:');
-
-await ta('deprovisionOne clears host_keys + host_keys_at on teardown', async () => {
-  // The lockout bug: a reaped box rebuilds with fresh host keys, but the GDS row
-  // kept the OLD keys (~10 min) so GET /box/me served a stale identity and the
-  // desktop app pinned the WRONG key. deprovisionOne must null them.
-  const calls = [];
-  const fakeBoxes = {
-    async recordComputeCost() { calls.push('recordComputeCost'); return 0; },
-    async recordStorageCost() { calls.push('recordStorageCost'); return 0; },
-    async setBoxState(_db, _bid, state, patch) { calls.push({ state, patch }); return {}; },
-    async recordEvent() { calls.push('recordEvent'); },
-  };
-  const doApi = { dryRun: true, async deleteDroplet() {}, async deleteSnapshot() {} };
-  // No droplet/snapshot/parked_at → no cost or DO calls; CF/DNS unconfigured in
-  // the test env → tunnel + blackhole-DNS teardown are skipped.
-  const box = {
-    id: 7, builder_id: 42, state: 'active', droplet_id: null, snapshot_id: null,
-    parked_at: null, github_login: 'tester', hostname: 'box-tester.dev.example.com',
-  };
-  await boxCli.deprovisionOne({}, fakeBoxes, doApi, box, { actor: 'test:sweep', login: 'tester' });
-  const destroyed = calls.find((c) => c && c.state === 'destroyed');
-  assert.ok(destroyed, 'sets state destroyed');
-  assert.equal(destroyed.patch.host_keys, null, 'host_keys cleared on teardown');
-  assert.equal(destroyed.patch.host_keys_at, null, 'host_keys_at cleared on teardown');
-});
-
-await ta('bumpActivity: a non-active box is a no-op that reports current state', async () => {
-  // UPDATE matches nothing → falls through to a state read.
-  const db = fakeDb([{ rows: [] }, { rows: [{ state: 'parked' }] }]);
-  const state = await boxes.bumpActivity(db, 42);
-  assert.equal(state, 'parked');
-  assert.equal(db.calls.length, 2, 'no heartbeat event written for a non-active box');
-});
-
-console.log('\nensure decision (#701 onboarding middleware):');
-
-t('decideEnsureAction: inactive builder is denied (fail-closed, checked first)', () => {
-  const d = boxes.decideEnsureAction({ boxState: 'none', rank: 'archon', status: 'inactive' });
-  assert.equal(d.action, 'denied');
-  assert.equal(d.reason, 'BUILDER_INACTIVE');
-});
-
-t('decideEnsureAction: below the floor is denied with required/actual', () => {
-  const d = boxes.decideEnsureAction({ boxState: 'none', rank: 'xenos', status: 'active', floor: 'metic' });
-  assert.equal(d.action, 'denied');
-  assert.equal(d.reason, 'INSUFFICIENT_RANK');
-  assert.equal(d.required, 'metic');
-  assert.equal(d.actual, 'xenos');
-});
-
-t('decideEnsureAction: no box → provision (auto-provision); a Xenos qualifies at the default floor', () => {
-  for (const s of ['none', 'destroyed', 'error', undefined, null]) {
-    assert.equal(boxes.decideEnsureAction({ boxState: s, rank: 'xenos', status: 'active' }).action, 'provision', `state=${s}`);
-  }
-});
-
-t('decideEnsureAction: parked → wake (wake-on-connect)', () => {
-  assert.equal(boxes.decideEnsureAction({ boxState: 'parked', rank: 'xenos', status: 'active' }).action, 'wake');
-});
-
-t('decideEnsureAction: active → ready; in-flight states → in_progress', () => {
-  assert.equal(boxes.decideEnsureAction({ boxState: 'active', rank: 'metic', status: 'active' }).action, 'ready');
-  for (const s of ['provisioning', 'waking', 'parking']) {
-    assert.equal(boxes.decideEnsureAction({ boxState: s, rank: 'metic', status: 'active' }).action, 'in_progress', `state=${s}`);
-  }
-});
-
-t('decideEnsureAction: an unknown state fails closed to in_progress (never a blind provision)', () => {
-  assert.equal(boxes.decideEnsureAction({ boxState: 'frobnicating', rank: 'metic', status: 'active' }).action, 'in_progress');
-});
-
-console.log('\nintent queue (#701):');
-
-await ta('enqueueIntent: a fresh insert returns created=true and always enqueues state=pending', async () => {
-  const db = fakeDb([{ rows: [{ id: 1, builder_id: 42, action: 'provision', state: 'pending' }] }]);
-  const { intent, created } = await boxes.enqueueIntent(db, 42, 'provision', 'api:self');
-  assert.equal(created, true);
-  assert.equal(intent.action, 'provision');
-  assert.equal(intent.state, 'pending', 'enqueueIntent always enqueues a plain pending intent');
-  assert.match(db.calls[0].sql, /INSERT INTO box_intents/);
-});
-
-await ta('getOpenIntent: a pending or running intent is open (blocks a duplicate enqueue)', async () => {
-  const db = fakeDb([{ rows: [{ id: 9, state: 'pending' }] }]);
-  const open = await boxes.getOpenIntent(db, 7);
-  assert.equal(open.state, 'pending');
-  // Only the two live states gate a re-enqueue — there is no approval-hold state.
-  assert.match(db.calls[0].sql, /state IN \('pending', 'running'\)/);
-});
-
-await ta('enqueueIntent: a unique-violation (open intent exists) returns the existing one, created=false', async () => {
-  const db = {
-    calls: [],
-    async query(sql) {
-      this.calls.push({ sql });
-      if (/INSERT INTO box_intents/.test(sql)) { const e = new Error('dup'); e.code = '23505'; throw e; }
-      return { rows: [{ id: 9, builder_id: 42, action: 'wake', state: 'pending' }] };
-    },
-  };
-  const { intent, created } = await boxes.enqueueIntent(db, 42, 'wake', 'api:self');
-  assert.equal(created, false);
-  assert.equal(intent.id, 9);
-});
-
-await ta('claimNextIntent: claims with FOR UPDATE SKIP LOCKED and flips to running', async () => {
-  const db = fakeDb([{ rows: [{ id: 3, action: 'provision', state: 'running' }] }]);
-  const intent = await boxes.claimNextIntent(db);
-  assert.equal(intent.id, 3);
-  assert.match(db.calls[0].sql, /FOR UPDATE SKIP LOCKED/);
-  assert.match(db.calls[0].sql, /state = 'running'/);
-});
-
-await ta('setTerminalAccess: only an active box stores the url + credential', async () => {
-  const db = fakeDb([{ rows: [{ state: 'active' }] }]);
-  const state = await boxes.setTerminalAccess(db, 42, { url: 'https://abc.trycloudflare.com', credential: 's3cr3t' });
-  assert.equal(state, 'active');
-  assert.match(db.calls[0].sql, /UPDATE builder_boxes[\s\S]*state = 'active'/);
-  assert.match(db.calls[0].sql, /terminal_url = \$2[\s\S]*terminal_credential = \$3/);
-  assert.deepEqual(db.calls[0].params, [42, 'https://abc.trycloudflare.com', 's3cr3t']);
-});
-
-await ta('setTerminalAccess: a missing credential is stored as null', async () => {
-  const db = fakeDb([{ rows: [{ state: 'active' }] }]);
-  await boxes.setTerminalAccess(db, 42, { url: 'https://abc.trycloudflare.com' });
-  assert.equal(db.calls[0].params[2], null);
-});
-
-await ta('setTerminalAccess: a non-active box does not store, reports current state', async () => {
-  const db = fakeDb([{ rows: [] }, { rows: [{ state: 'parked' }] }]);
-  const state = await boxes.setTerminalAccess(db, 42, { url: 'https://abc.trycloudflare.com', credential: 'x' });
-  assert.equal(state, 'parked');
-  assert.equal(db.calls.length, 2);
-});
-
-console.log('\ngit non-interactive (the #854 ttyd/SSH input-freeze fix):');
-
-t('infra pins GIT_TERMINAL_PROMPT=0 across every box arrival path (#854)', () => {
-  const fs = require('node:fs');
-  const path = require('node:path');
-  const { fileURLToPath } = require('node:url');
-  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-  const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
-
-  const unit = read('infra/box-terminal.service');
-  const cloudInit = read('infra/builder-box-cloud-init.yaml');
-  const fetchSh = read('infra/box-source-fetch.sh');
-
-  // 1. ttyd process tree: the systemd unit pins the env var for the whole tree
-  //    (bash -l -> claude -> any git). This is the canonical file box.js inlines.
-  assert.match(unit, /^Environment=GIT_TERMINAL_PROMPT=0$/m,
-    'box-terminal.service must pin GIT_TERMINAL_PROMPT=0 for the ttyd process tree');
-
-  // 2. Fresh boxes (cloud-init write_files): a profile.d export for LOGIN shells
-  //    AND an /etc/environment entry (pam_env) for NON-login SSH are both baked.
-  assert.match(cloudInit, /path: \/etc\/profile\.d\/05-git-noninteractive\.sh/,
-    'cloud-init must write the profile.d git-noninteractive file');
-  assert.match(cloudInit, /export GIT_TERMINAL_PROMPT=0/,
-    'cloud-init profile.d entry must export GIT_TERMINAL_PROMPT=0');
-  assert.match(cloudInit, /path: \/etc\/environment[\s\S]{0,160}GIT_TERMINAL_PROMPT=0/,
-    'cloud-init must add GIT_TERMINAL_PROMPT=0 to /etc/environment (covers non-login SSH)');
-
-  // 3. Existing boxes self-heal: the source-fetch cron re-asserts BOTH files
-  //    (runs before the token check, idempotent, no disruptive restart).
-  assert.match(fetchSh, /GIT_NOPROMPT_FILE=\/etc\/profile\.d\/05-git-noninteractive\.sh/,
-    'box-source-fetch.sh must re-assert the profile.d file on existing boxes');
-  assert.match(fetchSh, /grep -qs '\^GIT_TERMINAL_PROMPT=0\$' \/etc\/environment/,
-    'box-source-fetch.sh must re-assert /etc/environment on existing boxes');
-
-  // 4. Delivery wiring intact: cloud-init still inlines the canonical unit (the
-  //    #774 placeholder box.js base64-fills), so a fresh box gets the unit env.
-  assert.match(cloudInit, /__BOX_TERMINAL_SERVICE_B64__/,
-    'cloud-init must still inline box-terminal.service via its placeholder');
-});
-
-t('box-source-fetch.sh reports host keys IMMEDIATELY, not only via the */10 cron (task 1460)', () => {
-  const fs = require('node:fs');
-  const path = require('node:path');
-  const { fileURLToPath } = require('node:url');
-  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-  const fetchSh = fs.readFileSync(path.join(ROOT, 'infra/box-source-fetch.sh'), 'utf8');
-
-  // The off->on bug: a re-provision mints FRESH /etc/ssh host keys and clears the
-  // GDS's stored copy (idea 310), but the reporter ran ONLY on a */10 cron — so
-  // GET /box/me had no key for up to 10 min and the laptop's stale known_hosts pin
-  // stranded the connect ("Host denied"). box-source-fetch.sh runs at first boot
-  // (cloud-init) and every */10, so it must INVOKE the reporter directly — not just
-  // wire the cron — to close that window from minutes to seconds.
-  assert.match(fetchSh, /echo "\*\/10 \* \* \* \* \$WORKSPACE\/infra\/box-report-host-keys\.sh/,
-    'box-source-fetch.sh must still wire the */10 host-keys cron (the backstop)');
-  assert.match(fetchSh, /^\s*"\$WORKSPACE\/infra\/box-report-host-keys\.sh" >> \/tmp\/box-report-host-keys\.log 2>&1 \|\| true\s*$/m,
-    'box-source-fetch.sh must ALSO invoke the host-keys reporter immediately (task 1460), non-fatal under set -e');
-});
-
-t('box-heartbeat.sh counts an open ttyd browser terminal as in-use (idea #294 / task 1161)', () => {
-  const fs = require('node:fs');
-  const path = require('node:path');
-  const { fileURLToPath } = require('node:url');
-  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-  const hb = fs.readFileSync(path.join(ROOT, 'infra/box-heartbeat.sh'), 'utf8');
-
-  // The bug: the browser on-ramp (#760/#774) reaches the box via ttyd over the
-  // Cloudflare tunnel — not SSH, no utmp, ~0% CPU — so the heartbeat saw "idle"
-  // and the sweep destroyed an in-use box. An OPEN browser terminal holds an
-  // ESTABLISHED connection to ttyd's local port (default 7681, overridable).
-  assert.match(hb, /TTYD_PORT="\$\{BOX_TTYD_PORT:-7681\}"/,
-    'must default the ttyd port to 7681, overridable via BOX_TTYD_PORT');
-  assert.match(hb, /state established "\( sport = :\$TTYD_PORT \)"/,
-    'must detect an ESTABLISHED connection to the ttyd port (the listening socket is filtered out)');
-  assert.match(hb, /ACTIVE=1; TTYD_CONNECTED=1/,
-    'an open ttyd session must set ACTIVE=1 so the heartbeat actually pings');
-  assert.match(hb, /if \[ "\$TTYD_CONNECTED" -eq 1 \]; then CLAUDE_ACTIVE="true"; fi/,
-    'an open ttyd session must report claude_active=true so the reaper spares it');
-});
-
-t('#893: terminal session persists (tmux) + close-box teardown command is wired', () => {
-  const fs = require('node:fs');
-  const path = require('node:path');
-  const { fileURLToPath } = require('node:url');
-  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-  const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
-
-  const unit = read('infra/box-terminal.service');
-  const cloudInit = read('infra/builder-box-cloud-init.yaml');
-  const fetchSh = read('infra/box-source-fetch.sh');
-  const boxJs = read('scripts/gds/box.js');
-  const closeBox = read('infra/close-box.sh');
-  const launch = read('infra/otb-box-launch.sh');
-
-  // --- persistence: task 986 moved the tmux logic OUT of box-terminal.service's
-  //     inline ExecStart into /usr/local/bin/otb-box-launch (canonical copy:
-  //     infra/otb-box-launch.sh) and made it auto-run `claude`. #893's intent is
-  //     unchanged -- a browser disconnect only detaches the tmux CLIENT; the "otb"
-  //     session (with claude) survives on the box and the next connect reattaches
-  //     -- it just lives in the launcher now. So assert the service INVOKES the
-  //     launcher, and that the tmux attach-or-create persistence + `bash -l`
-  //     fallback live in the launcher.
-  assert.match(unit, /--writable \/usr\/local\/bin\/otb-box-launch/,
-    'box-terminal.service must run ttyd against /usr/local/bin/otb-box-launch (task 986)');
-  assert.match(launch, /tmux has-session -t otb/,
-    'otb-box-launch must reuse the existing "otb" tmux session when present (#893 persistence)');
-  assert.match(launch, /tmux new-session -d -s otb\b/,
-    'otb-box-launch must create the "otb" tmux session when absent (#893 attach-or-create)');
-  assert.match(launch, /exec tmux attach-session -t otb/,
-    'otb-box-launch must attach to the persistent "otb" session on connect (#893)');
-  assert.match(launch, /command -v tmux[\s\S]*?else[\s\S]*?exec bash -l/,
-    'otb-box-launch must fall back to bash -l when tmux is absent');
-  // fresh boxes get tmux from the package list.
-  assert.match(cloudInit, /packages:[\s\S]*?^\s*- tmux$/m,
-    'cloud-init must install tmux so the persistence path works on fresh boxes');
-  // launcher delivery chain (mirrors the close-box chain below): canonical infra
-  // copy -> cloud-init placeholder on first boot -> box.js gz+b64 fill ->
-  // box-source-fetch self-heal on existing boxes.
-  assert.match(cloudInit, /path: \/usr\/local\/bin\/otb-box-launch[\s\S]{0,160}__OTB_BOX_LAUNCH_B64__/,
-    'cloud-init must write /usr/local/bin/otb-box-launch via its placeholder');
-  assert.match(boxJs, /__OTB_BOX_LAUNCH_B64__[\s\S]{0,80}fileGzB64\('otb-box-launch\.sh'\)/,
-    "box.js must gz+b64-fill the otb-box-launch placeholder from infra/otb-box-launch.sh");
-  assert.match(fetchSh, /install -m 0755 "\$WORKSPACE\/infra\/otb-box-launch\.sh" \/usr\/local\/bin\/otb-box-launch/,
-    'box-source-fetch.sh must self-heal /usr/local/bin/otb-box-launch on existing boxes');
-
-  // --- close-box command: canonical script + first-boot delivery (cloud-init
-  //     placeholder box.js fills) + existing-box self-heal in source-fetch.
-  assert.match(closeBox, /\/box\/close/,
-    'infra/close-box.sh must POST to /box/close (the deprovision action)');
-  assert.match(cloudInit, /path: \/usr\/local\/bin\/close-box[\s\S]{0,120}__CLOSE_BOX_B64__/,
-    'cloud-init must write /usr/local/bin/close-box via its placeholder');
-  assert.match(boxJs, /__CLOSE_BOX_B64__[\s\S]{0,60}fileGzB64\('close-box\.sh'\)/,
-    "box.js must gz+b64-fill the close-box placeholder from infra/close-box.sh");
-  assert.match(fetchSh, /install -m 0755 "\$WORKSPACE\/infra\/close-box\.sh" \/usr\/local\/bin\/close-box/,
-    'box-source-fetch.sh must self-heal /usr/local/bin/close-box on existing boxes');
-});
-
-console.log('\n#913 - terminal credential drift (systemd % expansion + self-heal):');
-
-t('no unescaped % in any infra/*.service Exec line (#913 class guard)', () => {
-  const fs = require('node:fs');
-  const path = require('node:path');
-  const { fileURLToPath } = require('node:url');
-  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-  const dir = path.join(ROOT, 'infra');
-  const units = fs.readdirSync(dir).filter((n) => n.endsWith('.service'));
-  assert.ok(units.length > 0, 'expected at least one infra/*.service unit');
-  for (const name of units) {
-    const lines = fs.readFileSync(path.join(dir, name), 'utf8').split('\n');
-    lines.forEach((line, i) => {
-      if (!/^\s*Exec\w*=/.test(line)) return;
-      // systemd expands % specifiers in Exec* lines; a literal % must be %%.
-      const residue = line.split('%%').join('');
-      assert.ok(!residue.includes('%'),
-        `infra/${name}:${i + 1} has an unescaped % in an Exec line - systemd ` +
-        'expands % specifiers before the shell runs (write %% for a literal %). ' +
-        'This is the #913 bug class: printf "%s" became a directive-free format ' +
-        'and seeded a garbage ttyd password.');
-    });
-  }
-});
-
-t('box-terminal.service seeds the ttyd password via escaped %%s printf (#913)', () => {
-  const fs = require('node:fs');
-  const path = require('node:path');
-  const { fileURLToPath } = require('node:url');
-  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-  const unit = fs.readFileSync(path.join(ROOT, 'infra/box-terminal.service'), 'utf8');
-  assert.match(unit, /printf "%%s" "\$BOX_TERMINAL_CREDENTIAL"/,
-    'the ExecStartPre seed must printf "%%s" so the shell sees printf "%s"');
-});
-
-t('box-report-terminal.sh self-heals live ttyd credential drift (#913)', () => {
-  const fs = require('node:fs');
-  const path = require('node:path');
-  const { fileURLToPath } = require('node:url');
-  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-  const sh = fs.readFileSync(path.join(ROOT, 'infra/box-report-terminal.sh'), 'utf8');
-  // reads the password the RUNNING ttyd enforces from its argv...
-  assert.match(sh, /\/proc\/\$TTYD_PID\/cmdline/,
-    'must read the live ttyd argv to learn the password actually being enforced');
-  assert.match(sh, /--credential/,
-    'must locate the --credential argv entry');
-  // ...and restarts the unit on mismatch so ttyd re-reads CRED_FILE.
-  assert.match(sh, /systemctl restart box-terminal/,
-    'must restart box-terminal when the live password differs from CRED_FILE');
-});
-
-// ---------------------------------------------------------------------------
-// #889 — GET /box/terminal readiness probe must NOT treat a Cloudflare
-// tunnel-down (HTTP 530 / error 1033) page as a live tunnel. The terminal URL
-// is recorded at provision time, before cloudflared connects, so a too-eager
-// probe handed out a clickable link that 1033s (builder 25, term-iammasterqua).
-// Ready ONLY when the ORIGIN (ttyd) answered: 401 basic-auth or 2xx/3xx.
-// ---------------------------------------------------------------------------
-t('terminal probe: 401 (ttyd basic-auth challenge) is the ready signal', () => {
-  assert.equal(isTunnelReadyStatus(401), true);
-});
-t('terminal probe: 2xx/3xx (origin answered) is ready', () => {
-  assert.equal(isTunnelReadyStatus(200), true);
-  assert.equal(isTunnelReadyStatus(204), true);
-  assert.equal(isTunnelReadyStatus(302), true);
-});
-t('terminal probe: CF 1033 tunnel-down (530) is NOT ready (the #889 bug)', () => {
-  assert.equal(isTunnelReadyStatus(530), false);
-});
-t('terminal probe: CF origin-unreachable 5xx are NOT ready', () => {
-  for (const s of [500, 502, 503, 504, 520, 521, 522, 523, 524, 525, 526]) {
-    assert.equal(isTunnelReadyStatus(s), false, `status ${s} must not be ready`);
-  }
-});
-t('terminal probe: a 4xx other than 401 is NOT ready', () => {
-  assert.equal(isTunnelReadyStatus(403), false);
-  assert.equal(isTunnelReadyStatus(404), false);
-});
-
-console.log('\nlive game preview (#898/#903, ADR 0044) + cloud-init 64KB budget:');
-
-t('#903: rendered cloud-init user-data stays under DigitalOcean\'s 64KB cap', () => {
-  const fs = require('node:fs');
-  const path = require('node:path');
-  const zlib = require('node:zlib');
-  const { fileURLToPath } = require('node:url');
-  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-  const infra = (n) => path.join(ROOT, 'infra', n);
-  const gz = (n) => zlib.gzipSync(fs.readFileSync(infra(n))).toString('base64');
-
-  // Mirror box.js readCloudInit's substitution: EVERY inlined infra file is gz+b64
-  // (#903 margin; task 1314's source-fetch growth blew the cap, task 1321 gz+b64'd
-  // the rest), and ONLY the dynamic runtime values (keys/env/session) are plain b64.
-  // Realistic named-tunnel secrets (2 keys, tokens) give a worst-case render size.
-  let out = fs.readFileSync(infra('builder-box-cloud-init.yaml'), 'utf8')
-    .split('__BOX_SOURCE_FETCH_B64__').join(gz('box-source-fetch.sh'))
-    .split('__BOX_AUTHKEYS_FETCH_B64__').join(gz('box-authorized-keys-fetch.sh'))
-    .split('__BOX_TERMINAL_SERVICE_B64__').join(gz('box-terminal.service'))
-    .split('__BOX_TERMINAL_CREDSYNC_SERVICE_B64__').join(gz('box-terminal-credsync.service'))
-    .split('__BOX_TERMINAL_CREDENTIAL_PATH_B64__').join(gz('box-terminal-credential.path'))
-    .split('__CLOUDFLARED_SERVICE_B64__').join(gz('cloudflared.service'))
-    .split('__CLOUDFLARED_RUN_B64__').join(gz('cloudflared-run.sh'))
-    .split('__CLOSE_BOX_B64__').join(gz('close-box.sh'))
-    .split('__REPO_URL__').join('git@github.com:owner/example.git')
-    .split('__BUILDER_AUTHORIZED_KEYS_B64__').join(Buffer.from('ssh-ed25519 AAAA...k1\nssh-ed25519 AAAA...k2\n').toString('base64'))
-    .split('__BOX_ENV_B64__').join(Buffer.from('BOX_TUNNEL_TOKEN=' + 'x'.repeat(200) + '\nBOX_TERMINAL_HOSTNAME=term-x.example.com\nBOX_TERMINAL_CREDENTIAL=' + 'a'.repeat(48) + '\nBOX_PREVIEW_HOSTNAME=sandbox-x.example.com\n').toString('base64'))
-    .split('__GDS_SESSION_B64__').join(Buffer.from(JSON.stringify({ token: 'x'.repeat(64), builder: { id: 1, github_login: 'x', rank: 'archon' }, api_base: 'https://example.com' })).toString('base64'));
-  const bytes = Buffer.byteLength(out, 'utf8');
-  assert.ok(bytes < 64 * 1024, `rendered cloud-init is ${bytes}B; must stay under DO's 65536B cap`);
-});
-
-t('task 1040: cloud-init keeps SSH host keys stable across wake (ssh_deletekeys:false drop-in) + stays ASCII', () => {
-  const fs = require('node:fs');
-  const path = require('node:path');
-  const { fileURLToPath } = require('node:url');
-  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-  const raw = fs.readFileSync(path.join(ROOT, 'infra', 'builder-box-cloud-init.yaml'), 'utf8');
-
-  // The box is recreated from a snapshot on every `wake` (new instance-id), and
-  // cmdWake passes NO user_data — so without ssh_deletekeys:false baked INTO the
-  // snapshot, cloud-init's cc_ssh regenerates /etc/ssh/ssh_host_* on every wake
-  // and stales every builder's known_hosts pin (Claude Desktop's strict ssh2
-  // verifier then hard-fails with "Host denied (verification failed)"). The
-  // drop-in must live in cloud.cfg.d so it rides in the snapshot and is parsed on
-  // every wake boot.
-  assert.match(raw, /path: \/etc\/cloud\/cloud\.cfg\.d\/99-otb-keep-hostkeys\.cfg/,
-    'cloud-init must write the host-key-persistence drop-in into /etc/cloud/cloud.cfg.d/');
-  assert.match(raw, /ssh_deletekeys:\s*false/,
-    'the drop-in must set ssh_deletekeys: false so cc_ssh preserves the snapshot host keys');
-
-  // cloud-init's YAML loader silently DISCARDS the entire config on any non-ASCII
-  // byte (learning #48 / #724) — which would void this drop-in along with it.
-  // Guard that the whole file stays 7-bit ASCII.
-  const nonAscii = [...raw].findIndex((c) => c.charCodeAt(0) > 127);
-  assert.equal(nonAscii, -1,
-    `builder-box-cloud-init.yaml must be ASCII-only (cloud-init drops non-ASCII configs); first offending char at index ${nonAscii}`);
-});
-
-t('#903: cloud-init gzips the big source-fetch script + box.js has the size guard', () => {
-  const fs = require('node:fs');
-  const path = require('node:path');
-  const { fileURLToPath } = require('node:url');
-  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-  const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
-
-  // The source-fetch write_files entry must use gz+b64 (that's the margin), and
-  // box.js must gzip it + fail fast before DO if the render exceeds the cap.
-  assert.match(read('infra/builder-box-cloud-init.yaml'),
-    /path: \/usr\/local\/bin\/box-source-fetch\.sh[\s\S]{0,80}encoding: gz\+b64/,
-    'box-source-fetch.sh must be inlined as gz+b64');
-  const boxjs = read('scripts/gds/box.js');
-  assert.match(boxjs, /fileGzB64\('box-source-fetch\.sh'\)/, 'box.js must gz+b64 the source-fetch script');
-  assert.match(boxjs, /MAX_USERDATA_BYTES/, 'box.js must define the user-data size guard');
-  assert.match(boxjs, /over DigitalOcean's .* limit/, 'box.js must fail fast with an actionable over-limit message');
-});
-
-console.log('\nterminal credential race (#917, ideas #232/#233):');
-
-t('#917: box-terminal.service never launches ttyd with an empty password and writes the credential atomically', () => {
-  const fs = require('node:fs');
-  const path = require('node:path');
-  const { fileURLToPath } = require('node:url');
-  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-  const unit = fs.readFileSync(path.join(ROOT, 'infra', 'box-terminal.service'), 'utf8');
-
-  // ExecStart must read the credential into a var, refuse to start when empty
-  // (Restart=always retries), and never inline an unguarded $(cat ...).
-  assert.match(unit, /ExecStart=.*\[ -n "\$CRED" \] \|\|.*exit 1/,
-    'ExecStart must refuse to launch ttyd with an empty credential');
-  assert.doesNotMatch(unit, /ExecStart=.*--credential "otb:\$\(cat /,
-    'ExecStart must not inline an unguarded $(cat ...) as the password');
-  // ExecStartPre must write tmp + mv (atomic) — `printf > file` truncates first,
-  // opening the empty-read window that locked a blank password into ttyd.
-  assert.match(unit, /ExecStartPre=.*terminal-credential\.tmp && mv -f .*terminal-credential\.tmp/,
-    'ExecStartPre must write the credential atomically (tmp + mv)');
-  // ...and wait for a credential source (named-tunnel race) before the random
-  // fallback, without stalling quick-tunnel boxes (box.env present, no var -> break).
-  assert.match(unit, /ExecStartPre=.*for i in \$\(seq[\s\S]*?sleep 5/,
-    'ExecStartPre must poll/wait for the credential before falling back');
-  assert.match(unit, /\[ -f \/etc\/otb\/box\.env \] && break/,
-    'a quick-tunnel box (box.env present, no baked credential) must skip the wait');
-});
-
-t('#917: the credential-drift watcher pair restarts ttyd only on a real mismatch', () => {
-  const fs = require('node:fs');
-  const path = require('node:path');
-  const { fileURLToPath } = require('node:url');
-  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-  const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
-
-  const pathUnit = read('infra/box-terminal-credential.path');
-  assert.match(pathUnit, /PathModified=\/etc\/otb\/terminal-credential/,
-    'the path unit must watch the credential file (create + change)');
-  assert.match(pathUnit, /Unit=box-terminal-credsync\.service/,
-    'the path unit must trigger credsync');
-
-  const credsync = read('infra/box-terminal-credsync.service');
-  assert.match(credsync, /Type=oneshot/, 'credsync must be a oneshot');
-  // Compares the live ttyd argv password to the file; restarts only on mismatch
-  // (loop-safe: after the restart they match, so the next trigger no-ops).
-  assert.match(credsync, /\/proc\/\$PID\/cmdline/, 'credsync must read the live ttyd argv');
-  assert.match(credsync, /\[ "\$RUN" = "\$FILE" \] && exit 0/,
-    'credsync must no-op when the running password matches the file');
-  assert.match(credsync, /systemctl restart box-terminal/,
-    'credsync must restart box-terminal on a real mismatch');
-});
-
-t('#917: delivery wiring — cloud-init (fresh boxes) + source-fetch self-heal (existing boxes)', () => {
-  const fs = require('node:fs');
-  const path = require('node:path');
-  const { fileURLToPath } = require('node:url');
-  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-  const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
-
-  const cloudInit = read('infra/builder-box-cloud-init.yaml');
-  assert.match(cloudInit, /path: \/etc\/systemd\/system\/box-terminal-credsync\.service[\s\S]{0,120}__BOX_TERMINAL_CREDSYNC_SERVICE_B64__/,
-    'cloud-init must inline box-terminal-credsync.service via its placeholder');
-  assert.match(cloudInit, /path: \/etc\/systemd\/system\/box-terminal-credential\.path[\s\S]{0,120}__BOX_TERMINAL_CREDENTIAL_PATH_B64__/,
-    'cloud-init must inline box-terminal-credential.path via its placeholder');
-  assert.match(cloudInit, /systemctl enable --now box-terminal-credential\.path/,
-    'cloud-init must arm the credential watcher at first boot');
-  // The runcmd credential seed must be atomic too (tmp + mv, same race as the unit).
-  assert.match(cloudInit, /terminal-credential\.tmp && mv -f \/etc\/otb\/terminal-credential\.tmp \/etc\/otb\/terminal-credential/,
-    'the cloud-init credential seed must write atomically (tmp + mv)');
-
-  const boxjs = read('scripts/gds/box.js');
-  assert.match(boxjs, /fileGzB64\('box-terminal-credsync\.service'\)/,
-    'box.js must gz+b64-fill the credsync placeholder');
-  assert.match(boxjs, /fileGzB64\('box-terminal-credential\.path'\)/,
-    'box.js must gz+b64-fill the path-unit placeholder');
-
-  const fetchSh = read('infra/box-source-fetch.sh');
-  // Units refresh when they DIFFER (not only when absent — the idea #222 gap that
-  // kept already-provisioned boxes on stale units forever).
-  assert.match(fetchSh, /for UNIT in box-terminal\.service box-terminal-credsync\.service box-terminal-credential\.path cloudflared\.service/,
-    'source-fetch must refresh all terminal units from the repo copy');
-  assert.match(fetchSh, /cmp -s "\$WORKSPACE\/infra\/\$UNIT" "\/etc\/systemd\/system\/\$UNIT"/,
-    'source-fetch must compare repo vs installed unit (refresh on diff, not only on absent)');
-  // And every tick: arm the watcher + run one drift check (self-heals a raced box
-  // within one cron tick even if it predates the path unit).
-  assert.match(fetchSh, /systemctl enable --now box-terminal-credential\.path/,
-    'source-fetch must arm the credential watcher on existing boxes');
-  assert.match(fetchSh, /systemctl start box-terminal-credsync\.service/,
-    'source-fetch must run a drift check on every tick');
-});
-
-t('#1001/ADR 0052: live game preview enables on EVERY named-tunnel box (reverses #903 full-clone gate)', () => {
-  const fs = require('node:fs');
-  const path = require('node:path');
-  const { fileURLToPath } = require('node:url');
-  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-  const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
-
-  const fetchSh = read('infra/box-source-fetch.sh');
-  // ADR 0052: the game (public/, src/world, src/rooms) is now in the starter
-  // sparse scope and the unit runs the game-only entry, so the preview enables on
-  // EVERY box, gated ONLY on the named tunnel (BOX_PREVIEW_HOSTNAME). The
-  // src/rooms presence check survives as a belt-and-braces "clone finished" guard
-  // (it now passes on every box), not as a full-clone gate.
-  assert.match(fetchSh, /BOX_PREVIEW_HOSTNAME=.*box\.env/,
-    'preview enable must still require the named-tunnel preview host');
-  assert.match(fetchSh, /-d "\$WORKSPACE\/src\/rooms"/,
-    'preview enable keeps the src/rooms "game materialized" sanity guard');
-  assert.match(fetchSh, /install -m 0755 "\$WORKSPACE\/infra\/box-preview\.sh" \/usr\/local\/bin\/box-preview/,
-    'box-source-fetch must install the box-preview command');
-  // box.js bakes the preview host so the box knows its own URL.
-  assert.match(read('scripts/gds/box.js'), /BOX_PREVIEW_HOSTNAME=\$\{ph\}/,
-    'box.js must bake BOX_PREVIEW_HOSTNAME from the tunnel previewHostname');
-
-  // ADR 0052 — the game must be in the starter clone so a Xenos/Thetes box can
-  // serve the sandbox.
-  const boxAccess = read('modules/dev-box/box-access.js');
-  for (const p of ["'src/world'", "'src/rooms'", "'public'"]) {
-    assert.ok(boxAccess.includes(p), `STARTER_SPARSE_PATHS must include ${p} (ADR 0052)`);
-  }
-  // migrations/ stays excluded — a degraded-DB preview needs no schema.
-  assert.ok(!/['"]migrations['"]/.test(boxAccess.split('STARTER_SPARSE_PATHS')[1].split(']')[0]),
-    'STARTER_SPARSE_PATHS must NOT include migrations/ (degraded-DB preview needs no schema)');
-
-  // The unit runs the GAME-ONLY entry, never the full server.js.
-  const svc = read('infra/box-game-preview.service');
-  assert.match(svc, /node \/workspace\/src\/preview-server\.js/,
-    'box-game-preview.service must run the game-only entry');
-  assert.ok(!/ExecStart=.*node \/workspace\/server\.js/.test(svc),
-    'box-game-preview.service must NOT run the full server.js');
-
-  // The game-only entry must never be able to mount the internal API surface.
-  // Test the CODE, not the prose — the file's own comments explain that it does
-  // NOT mount /api/gds, so strip comments before asserting on real wiring.
-  const prevCode = read('src/preview-server.js')
-    .replace(/\/\*[\s\S]*?\*\//g, '')                          // block comments
-    .split('\n').map((l) => l.replace(/\/\/.*$/, '')).join('\n'); // line comments
-  assert.ok(!/\brequire\(\s*['"][^'"]*\/gds\b/.test(prevCode),
-    'src/preview-server.js must not require any src/bongos module');
-  assert.ok(!/buildGdsRouter/.test(prevCode),
-    'src/preview-server.js must not import the GDS router builder');
-  assert.ok(!/\.use\(\s*['"]\/api\b/.test(prevCode),
-    'src/preview-server.js must not mount any /api/* surface');
-  assert.ok(!/BuildersHallRoom/.test(prevCode),
-    'src/preview-server.js must not register the internal BuildersHallRoom');
-  // …and it MUST register the game rooms via the shared helper (no drift).
-  assert.match(prevCode, /registerGameRooms\(/,
-    'src/preview-server.js must register game rooms via the shared helper');
-});
-
-t('#1044: box-game-preview ExecStartPre guards on a real install sentinel, not a bare -d node_modules', () => {
-  const fs = require('node:fs');
-  const path = require('node:path');
-  const { fileURLToPath } = require('node:url');
-  const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-  const svc = fs.readFileSync(path.join(ROOT, 'infra/box-game-preview.service'), 'utf8');
-  const guard = svc.split('\n').find((l) => l.startsWith('ExecStartPre=') && l.includes('npm'));
-  assert.ok(guard, 'box-game-preview.service must have a dep-install ExecStartPre');
-  // The antipattern (#1044): `-d node_modules` treats an empty-but-present dir as
-  // "installed", so npm ci never runs and the preview crash-loops on
-  // `Cannot find module 'express'`. The guard must probe a real install sentinel.
-  assert.ok(!/\[\s*-d\s+\/workspace\/node_modules\s*\]/.test(guard),
-    'guard must NOT short-circuit on a bare `-d /workspace/node_modules` (empty dir passes it — #1044)');
-  assert.match(guard, /\[\s*-[ef]\s+\/workspace\/node_modules\/(\.package-lock\.json|[^/\s]+\/package\.json)\s*\]/,
-    'guard must probe a real install sentinel (node_modules/.package-lock.json or a known dep\'s package.json)');
-  // Still self-heals an uninstalled box.
-  assert.match(guard, /npm ci --omit=dev \|\| npm install --omit=dev/,
-    'guard must still run npm ci (fallback npm install), --omit=dev, when the sentinel is absent');
-});
-
-console.log('\nDO poll loops (waitForAction + settleDroplet share _poll, #1092 C8):');
-
-await ta('settleDroplet returns {ip:null} in dry-run and never fetches', async () => {
-  let called = 0;
-  const api = new DoApi({ fetchImpl: () => { called++; throw new Error('should not fetch'); } });
-  const r = await api.settleDroplet('drop1');
-  assert.deepEqual(r, { ip: null });
-  assert.equal(called, 0);
-});
-
-await ta('settleDroplet polls getDroplet until active and returns the public IPv4', async () => {
-  let n = 0;
-  const fakeFetch = async () => {
-    n++;
-    const droplet = n >= 3
-      ? { id: 'd1', status: 'active', networks: { v4: [{ type: 'private', ip_address: '10.0.0.1' }, { type: 'public', ip_address: '203.0.113.7' }] } }
-      : { id: 'd1', status: 'new', networks: { v4: [] } };
-    return { ok: true, status: 200, text: async () => JSON.stringify({ droplet }) };
-  };
-  const api = new DoApi({ dryRun: false, token: 'tok', fetchImpl: fakeFetch });
-  const slept = [];
-  const r = await api.settleDroplet('d1', { sleepFn: async (ms) => { slept.push(ms); } });
-  assert.deepEqual(r, { ip: '203.0.113.7' });
-  assert.equal(n, 3, 'polled until the droplet reported active');
-  assert.equal(slept.length, 2, 'slept only between the two not-yet-active polls');
-});
-
-await ta('settleDroplet throws once the try budget is exhausted', async () => {
-  const fakeFetch = async () => ({ ok: true, status: 200, text: async () => JSON.stringify({ droplet: { id: 'd1', status: 'new', networks: { v4: [] } } }) });
-  const api = new DoApi({ dryRun: false, token: 'tok', fetchImpl: fakeFetch });
-  await assert.rejects(
-    () => api.settleDroplet('d1', { tries: 3, sleepFn: async () => {} }),
-    /did not reach 'active'/
-  );
-});
-
-await ta('waitForAction returns true once the action completes', async () => {
-  let n = 0;
-  const fakeFetch = async () => { n++; return { ok: true, status: 200, text: async () => JSON.stringify({ action: { id: 'a1', status: n >= 2 ? 'completed' : 'in-progress' } }) }; };
-  const api = new DoApi({ dryRun: false, token: 'tok', fetchImpl: fakeFetch });
-  const ok = await api.waitForAction('a1', { sleepFn: async () => {} });
-  assert.equal(ok, true);
-  assert.equal(n, 2);
-});
-
-await ta('waitForAction throws DoApiError when the action errors', async () => {
-  const fakeFetch = async () => ({ ok: true, status: 200, text: async () => JSON.stringify({ action: { id: 'a1', status: 'errored' } }) });
-  const api = new DoApi({ dryRun: false, token: 'tok', fetchImpl: fakeFetch });
-  let err;
-  try { await api.waitForAction('a1', { sleepFn: async () => {} }); } catch (e) { err = e; }
-  assert.ok(err instanceof DoApiError);
-  assert.match(err.message, /errored/);
-});
-
-await ta('waitForAction throws on timeout (try budget exhausted)', async () => {
-  const fakeFetch = async () => ({ ok: true, status: 200, text: async () => JSON.stringify({ action: { id: 'a1', status: 'in-progress' } }) });
-  const api = new DoApi({ dryRun: false, token: 'tok', fetchImpl: fakeFetch });
-  await assert.rejects(() => api.waitForAction('a1', { tries: 2, sleepFn: async () => {} }), /did not complete in time/);
-});
-
-console.log('\ntask 1289 — droplet⇄row drift detection (planDropletDrift, pure):');
-
-t('planDropletDrift: a droplet a live box owns is in sync (no drift)', () => {
-  const droplets = [{ id: 111, name: 'otb-box-alice', tags: ['otb-builder-box', 'builder:alice'] }];
-  const boxRows = [{ builder_id: 1, github_login: 'alice', state: 'active', droplet_id: '111' }];
-  const { zombies, ghosts } = boxes.planDropletDrift({ droplets, boxRows, nowMs: NOW });
-  assert.equal(zombies.length, 0);
-  assert.equal(ghosts.length, 0);
-});
-
-t('planDropletDrift: ZOMBIE — droplet exists but its box row is destroyed (the bug)', () => {
-  // The exact task-1289 shape: deprovision marked the row destroyed + nulled
-  // droplet_id, but the droplet was never actually deleted.
-  const droplets = [{ id: 222, name: 'otb-box-example-owner', tags: ['otb-builder-box', 'builder:example-owner'], created_at: '2026-05-01T00:00:00Z' }];
-  const boxRows = [{ builder_id: 3, github_login: 'example-owner', state: 'destroyed', droplet_id: null }];
-  const { zombies, ghosts } = boxes.planDropletDrift({ droplets, boxRows, nowMs: NOW });
-  assert.equal(ghosts.length, 0);
-  assert.equal(zombies.length, 1);
-  assert.equal(zombies[0].dropletId, '222');
-  assert.equal(zombies[0].login, 'example-owner');
-  assert.equal(zombies[0].builderId, 3, 'maps the zombie back to its builder for edge teardown');
-});
-
-t('planDropletDrift: ZOMBIE — a droplet with no box row at all', () => {
-  const droplets = [{ id: 333, name: 'otb-box-ghostuser', tags: ['otb-builder-box', 'builder:ghostuser'], created_at: '2026-01-01T00:00:00Z' }];
-  const { zombies } = boxes.planDropletDrift({ droplets, boxRows: [], nowMs: NOW });
-  assert.equal(zombies.length, 1);
-  assert.equal(zombies[0].login, 'ghostuser');
-  assert.equal(zombies[0].builderId, null);
-});
-
-t('planDropletDrift: in-flight provision is NOT a zombie (young-droplet guard)', () => {
-  // Droplet created 2 min before NOW; box still provisioning, droplet_id not yet
-  // written. Must be skipped, never deleted.
-  const created = new Date(NOW - 2 * 60_000).toISOString();
-  const droplets = [{ id: 444, name: 'otb-box-newbie', tags: ['builder:newbie'], created_at: created }];
-  const boxRows = [{ builder_id: 9, github_login: 'newbie', state: 'provisioning', droplet_id: null }];
-  const { zombies, skippedYoung } = boxes.planDropletDrift({ droplets, boxRows, nowMs: NOW, minAgeMinutes: 30 });
-  assert.equal(zombies.length, 0, 'young droplet not killed');
-  assert.equal(skippedYoung.length, 1);
-  assert.equal(skippedYoung[0].dropletId, '444');
-});
-
-t('planDropletDrift: GHOST — live row whose droplet vanished from DO', () => {
-  const droplets = []; // DO has none
-  const boxRows = [{ builder_id: 5, github_login: 'bob', state: 'active', droplet_id: '555' }];
-  const { zombies, ghosts } = boxes.planDropletDrift({ droplets, boxRows, nowMs: NOW });
-  assert.equal(zombies.length, 0);
-  assert.equal(ghosts.length, 1);
-  assert.equal(ghosts[0].builderId, 5);
-  assert.equal(ghosts[0].dropletId, '555');
-  assert.equal(ghosts[0].state, 'active');
-});
-
-t('planDropletDrift: a parked box (no droplet) is never a ghost', () => {
-  const boxRows = [{ builder_id: 6, github_login: 'carol', state: 'parked', droplet_id: null, snapshot_id: 's-1' }];
-  const { ghosts } = boxes.planDropletDrift({ droplets: [], boxRows, nowMs: NOW });
-  assert.equal(ghosts.length, 0);
-});
-
-t('loginFromDroplet: prefers the builder: tag, falls back to the otb-box- name', () => {
-  assert.equal(boxes.loginFromDroplet({ tags: ['otb-builder-box', 'builder:dave'], name: 'otb-box-x' }), 'dave');
-  assert.equal(boxes.loginFromDroplet({ tags: ['otb-builder-box'], name: 'otb-box-erin' }), 'erin');
-  assert.equal(boxes.loginFromDroplet({ tags: [], name: 'something-else' }), null);
-});
-
-console.log('\ntask 1289 — idempotent delete + confirm-before-destroyed:');
-
-await ta('deleteWithRetry: a 404 (already gone) is success, not failure', async () => {
-  let calls = 0;
-  const r = await boxCli.deleteWithRetry(async () => { calls++; const e = new Error('not found'); e.status = 404; throw e; }, { sleepFn: async () => {} });
-  assert.equal(r.ok, true);
-  assert.equal(r.alreadyGone, true);
-  assert.equal(calls, 1, 'a 404 short-circuits — no retry');
-});
-
-await ta('deleteWithRetry: retries a transient failure, then succeeds', async () => {
-  let calls = 0;
-  const r = await boxCli.deleteWithRetry(async () => { calls++; if (calls < 2) throw new Error('503 transient'); }, { sleepFn: async () => {} });
-  assert.equal(r.ok, true);
-  assert.equal(calls, 2);
-});
-
-await ta('deleteWithRetry: a real failure after the retry budget returns ok:false', async () => {
-  let calls = 0;
-  const r = await boxCli.deleteWithRetry(async () => { calls++; throw new Error('500 boom'); }, { tries: 3, sleepFn: async () => {} });
-  assert.equal(r.ok, false);
-  assert.match(r.error.message, /boom/);
-  assert.equal(calls, 3);
-});
-
-await ta('deprovisionOne: a failed droplet delete parks at ERROR (not destroyed) and throws — the zombie fix', async () => {
-  // This is the heart of task 1289: the row must NEVER reach 'destroyed' while the
-  // droplet is still alive. A delete that keeps failing leaves state='error' with
-  // droplet_id preserved (not nulled) and throws so the caller surfaces it.
-  const states = [];
-  const fakeBoxes = {
-    async recordComputeCost() { return 0; },
-    async recordStorageCost() { return 0; },
-    async setBoxState(_db, _bid, state, patch) { states.push({ state, patch }); return {}; },
-    async recordEvent() {},
-  };
-  const doApi = { dryRun: false, async deleteDroplet() { throw new Error('DO 500'); }, async deleteSnapshot() {} };
-  const box = { id: 7, builder_id: 42, state: 'active', droplet_id: '999', snapshot_id: null, parked_at: null, github_login: 'tester' };
-  await assert.rejects(
-    () => boxCli.deprovisionOne({}, fakeBoxes, doApi, box, { actor: 'test', login: 'tester', sleepFn: async () => {} }),
-    /DO 500/
-  );
-  assert.equal(states.length, 1, 'exactly one state write');
-  assert.equal(states[0].state, 'error', 'parks at error, NOT destroyed');
-  assert.ok(!('droplet_id' in states[0].patch), 'droplet_id is PRESERVED (not nulled) so the zombie stays queryable');
-  assert.match(states[0].patch.error_note, /delete failed/);
-});
-
-await ta('deprovisionOne: a droplet already gone (404) proceeds cleanly to destroyed', async () => {
-  const states = [];
-  const fakeBoxes = {
-    async recordComputeCost() { return 0; },
-    async recordStorageCost() { return 0; },
-    async setBoxState(_db, _bid, state, patch) { states.push({ state, patch }); return {}; },
-    async recordEvent() {},
-  };
-  const doApi = { dryRun: false, async deleteDroplet() { const e = new Error('gone'); e.status = 404; throw e; }, async deleteSnapshot() {} };
-  const box = { id: 8, builder_id: 43, state: 'active', droplet_id: '1000', snapshot_id: null, parked_at: null, github_login: 'tester2' };
-  await boxCli.deprovisionOne({}, fakeBoxes, doApi, box, { actor: 'test', login: 'tester2', sleepFn: async () => {} });
-  const destroyed = states.find((s) => s.state === 'destroyed');
-  assert.ok(destroyed, 'a 404 droplet is treated as deleted → reaches destroyed');
-  assert.equal(destroyed.patch.droplet_id, null);
-});
-
-console.log('\ntask 2034 — a post-destroyed teardown failure must not clobber state=destroyed:');
-
-await ta('deprovisionOne: a post-destroyed recordEvent throw does NOT undo the teardown (stays destroyed, no reject)', async () => {
-  // The builder-95 false-error (2026-07-04): the droplet delete succeeded and the
-  // row committed 'destroyed', but the follow-up audit event threw. That exception
-  // used to propagate to the sweep's catch, which flipped the row back to 'error'
-  // with a null droplet_id. The audit write is best-effort — it must be swallowed
-  // so deprovisionOne resolves and 'destroyed' stands.
-  const states = [];
-  const fakeBoxes = {
-    async recordComputeCost() { return 0; },
-    async recordStorageCost() { return 0; },
-    async setBoxState(_db, _bid, state, patch) { states.push({ state, patch }); return {}; },
-    async recordEvent() { throw new Error('box_events insert failed'); },
-  };
-  const doApi = { dryRun: false, async deleteDroplet() {}, async deleteSnapshot() {} };
-  const box = { id: 9, builder_id: 95, state: 'active', droplet_id: '2000', snapshot_id: null, parked_at: null, github_login: 'jaxri' };
-  // Must NOT reject — the teardown itself succeeded.
-  await boxCli.deprovisionOne({}, fakeBoxes, doApi, box, { actor: 'sweep:idle', login: 'jaxri', sleepFn: async () => {} });
-  assert.equal(states.length, 1, 'exactly one state write');
-  assert.equal(states[0].state, 'destroyed', "stays 'destroyed' despite the audit-event failure");
-  assert.equal(states[0].patch.droplet_id, null, 'droplet_id nulled — the teardown is real');
-});
-
-await ta('markErrorUnlessDestroyed: never flips an already-destroyed box back to error (guard)', async () => {
-  // Second line of defence: even if some OTHER post-commit step throws (e.g. the
-  // reconcile path's recordSourceEvent) and lands in a caller's catch, a box that
-  // already reached 'destroyed' must be left alone.
-  const writes = [];
-  const fakeBoxes = {
-    async getBoxByBuilderId() { return { state: 'destroyed' }; },
-    async setBoxState(_db, _bid, state, patch) { writes.push({ state, patch }); return {}; },
-  };
-  await boxCli.markErrorUnlessDestroyed({}, fakeBoxes, 95, 'recordSourceEvent failed after teardown');
-  assert.equal(writes.length, 0, 'a destroyed box is left alone — no error downgrade');
-});
-
-await ta('markErrorUnlessDestroyed: a genuine (pre-destroyed) failure still parks at error (guard)', async () => {
-  const writes = [];
-  const fakeBoxes = {
-    async getBoxByBuilderId() { return { state: 'active' }; }, // never reached 'destroyed'
-    async setBoxState(_db, _bid, state, patch) { writes.push({ state, patch }); return {}; },
-  };
-  await boxCli.markErrorUnlessDestroyed({}, fakeBoxes, 96, 'DO 500 before teardown');
-  assert.equal(writes.length, 1, 'a not-destroyed box is parked at error, as before');
-  assert.equal(writes[0].state, 'error');
-  assert.match(writes[0].patch.error_note, /DO 500/);
-});
-
-console.log('\ntask 1002726 — the idle sweep parks, it does not destroy:');
-
-// The regression this pins: cmdSweepIdle used to call deprovisionOne, so an idle
-// box lost its droplet AND its snapshot — every sweep:idle row in the live
-// box_events history was a full teardown, and nothing could be woken. The sweep
-// must snapshot-and-park instead, leaving the filesystem recoverable.
-function sweepHarness({ idleRows, parkThrows = null }) {
-  const events = [];
-  const states = [];
-  const fakeBoxes = {
-    async listBoxes() { return idleRows; },
-    selectIdleBoxes: boxes.selectIdleBoxes,
-    effectiveActivityMs: boxes.effectiveActivityMs,
-    idleReason: boxes.idleReason,
-    async setBoxState(_db, _bid, state, patch) { states.push({ state, patch }); return {}; },
-    async recordComputeCost() { return 0; },
-    async recordEvent(_db, e) { events.push(e); },
-    async getBoxByBuilderId() { return { state: 'active' }; },
-  };
-  return { fakeBoxes, events, states, parkThrows };
-}
-
-await ta('cmdSweepIdle: an idle box is PARKED — snapshot retained, no snapshot delete', async () => {
-  const NOW_ROW = {
-    id: 3, builder_id: 3, state: 'active', droplet_id: '591743808', droplet_name: 'box-example-owner',
-    github_login: 'example-owner', last_activity_at: new Date(Date.now() - 5 * 3600_000).toISOString(),
-    claude_active: false, snapshot_id: null,
-  };
-  const h = sweepHarness({ idleRows: [NOW_ROW] });
-  const deleted = [];
-  const doApi = {
-    dryRun: false,
-    async powerOffDroplet() { return { action: { id: 1 } }; },
-    async waitForAction() {},
-    async snapshotDroplet() { return { action: { id: 2 } }; },
-    async getDroplet() { return { droplet: { snapshot_ids: ['999'] } }; },
-    async deleteDroplet(id) { deleted.push(`droplet:${id}`); },
-    async deleteSnapshot(id) { deleted.push(`snapshot:${id}`); },
-  };
-  // makeDo() is only reached under --apply; inject our fake by stubbing the DO
-  // client the command builds. cmdSweepIdle takes (pool, boxes, {apply}), so we
-  // exercise parkOne directly with the same contract the sweep now uses.
-  await boxCli.parkOne({}, h.fakeBoxes, doApi, NOW_ROW, { actor: 'sweep:idle' });
-
-  const parked = h.states.find((s) => s.state === 'parked');
-  assert.ok(parked, 'box reaches parked');
-  assert.equal(parked.patch.snapshot_id, '999', 'snapshot id retained on the row');
-  assert.equal(parked.patch.droplet_id, null, 'droplet released');
-  assert.ok(deleted.includes('droplet:591743808'), 'droplet destroyed (compute billing stops)');
-  assert.ok(!deleted.some((d) => d.startsWith('snapshot:')), 'the snapshot is NEVER deleted by an idle park');
-  assert.equal(h.events.find((e) => e.event === 'park')?.actor, 'sweep:idle', 'logged as a park, not a deprovision');
-});
-
-await ta('cmdSweepIdle: dry-run reports "would park" and touches nothing', async () => {
-  const row = {
-    id: 3, builder_id: 3, state: 'active', droplet_id: '591743808', github_login: 'example-owner',
-    last_activity_at: new Date(Date.now() - 5 * 3600_000).toISOString(), claude_active: false,
-  };
-  const h = sweepHarness({ idleRows: [row] });
-  const lines = [];
-  const origLog = console.log;
-  console.log = (...a) => lines.push(a.join(' '));
-  try {
-    const res = await boxCli.cmdSweepIdle({}, h.fakeBoxes, { apply: false });
-    assert.equal(res.parked, 0, 'dry-run parks nothing');
-  } finally { console.log = origLog; }
-  assert.ok(lines.some((l) => /would park/.test(l)), 'dry-run says park, not deprovision');
-  assert.ok(!lines.some((l) => /would deprovision/.test(l)), 'no destroy language survives');
-  assert.equal(h.states.length, 0, 'no state written in dry-run');
-});
-
-await ta('cmdSweepIdle: a box mid-session is never parked', async () => {
-  // Genuinely in use: Claude started 20 min ago and somebody is attached.
-  const busy = {
-    id: 4, builder_id: 4, state: 'active', droplet_id: '1', github_login: 'busy',
-    last_activity_at: new Date(Date.now() - 99 * 3600_000).toISOString(), claude_active: true,
-    claude_active_since: new Date(Date.now() - 20 * 60_000).toISOString(),
-    last_attached_at: new Date(Date.now() - 20 * 60_000).toISOString(),
-  };
-  const h = sweepHarness({ idleRows: [busy] });
-  const res = await boxCli.cmdSweepIdle({}, h.fakeBoxes, { apply: true });
-  assert.equal(res.parked, 0, 'a live session still holds the box open');
-  assert.equal(h.states.length, 0);
-});
-
-await ta('cmdSweepIdle: task 1003507 — a box claiming claude_active for 99h with nobody attached IS parked', async () => {
-  // The reported incident, end to end through the command. Before this task the
-  // sweep skipped the row on claude_active alone and reported 0 idle; it now
-  // parks it (snapshot kept), and the log names the clock that selected it.
-  const abandoned = {
-    id: 5, builder_id: 5, state: 'active', droplet_id: '591743808', github_login: 'abandoned',
-    last_activity_at: new Date(Date.now() - 5 * 60_000).toISOString(),
-    claude_active: true,
-    claude_active_since: new Date(Date.now() - 99 * 3600_000).toISOString(),
-    last_attached_at: new Date(Date.now() - 99 * 3600_000).toISOString(),
-  };
-  const h = sweepHarness({ idleRows: [abandoned] });
-  const lines = [];
-  const origLog = console.log;
-  console.log = (...a) => lines.push(a.join(' '));
-  let res;
-  try {
-    res = await boxCli.cmdSweepIdle({}, h.fakeBoxes, { apply: false });
-  } finally { console.log = origLog; }
-  assert.equal(res.parked, 0, 'dry-run writes nothing');
-  assert.ok(lines.some((l) => /would park .*abandoned/.test(l)), 'the abandoned box is selected');
-  assert.ok(lines.some((l) => /unattended 99h/.test(l)), 'the log names the unattended clock, not the idle one');
-});
-
-await ta('loadDeps: task 1003507 — resolving deps does not throw ReferenceError', async () => {
-  // _deps was UNDECLARED, so loadDeps() threw on its first call and every
-  // command reaching makeDo()/makeCf() died with it — including
-  // `sweep-idle --apply`, which builds its DO client before the park loop, so
-  // the sweep could never park anything. Reached here through the same
-  // apply:true path that hid the bug: the assertion is that we get PAST dep
-  // resolution, whatever the fake DO client then does.
-  const row = {
-    id: 6, builder_id: 6, state: 'active', droplet_id: '1', github_login: 'reap',
-    last_activity_at: new Date(Date.now() - 99 * 3600_000).toISOString(), claude_active: false,
-  };
-  const h = sweepHarness({ idleRows: [row] });
-  const origLog = console.log;
-  console.log = () => {};
-  let err = null;
-  try {
-    await boxCli.cmdSweepIdle({}, h.fakeBoxes, { apply: true });
-  } catch (e) { err = e; } finally { console.log = origLog; }
-  assert.ok(!(err && /_deps is not defined/.test(err.message)), `loadDeps threw: ${err && err.message}`);
-});
-
-console.log('\ntask 1002727 — the dormant sweep warns before it takes:');
-
-const DORMANT_DAY = 86_400_000;
-const parked = (d, extra = {}) => ({
-  id: 9, builder_id: 9, state: 'parked', github_login: 'sleeper', snapshot_id: 's1',
-  parked_at: new Date(NOW - d * DORMANT_DAY).toISOString(), ...extra,
-});
-
-t('selectDormantWarnBoxes: picks boxes in the lead window, not before, not after', () => {
-  const rows = [parked(10), parked(12), parked(15), parked(3)];
-  const warn = boxes.selectDormantWarnBoxes(rows, { dormantDays: 14, warnLeadDays: 3, nowMs: NOW });
-  const days = warn.map((r) => Math.round((NOW - Date.parse(r.parked_at)) / DORMANT_DAY)).sort((a, b) => a - b);
-  assert.deepEqual(days, [12], 'only the box inside [11d, 14d) is warned');
-});
-
-t('selectDormantWarnBoxes: a box already past the threshold is NOT in the warn set', () => {
-  // It belongs to selectDormantBoxes, which refuses to reclaim it unwarned.
-  const warn = boxes.selectDormantWarnBoxes([parked(20)], { dormantDays: 14, warnLeadDays: 3, nowMs: NOW });
-  assert.equal(warn.length, 0);
-});
-
-t('selectDormantWarnBoxes: guards bad inputs', () => {
-  assert.deepEqual(boxes.selectDormantWarnBoxes(null, { dormantDays: 14, warnLeadDays: 3, nowMs: NOW }), []);
-  assert.deepEqual(boxes.selectDormantWarnBoxes([], { dormantDays: 0, warnLeadDays: 3, nowMs: NOW }), []);
-  assert.deepEqual(boxes.selectDormantWarnBoxes([], { dormantDays: 14, warnLeadDays: 0, nowMs: NOW }), []);
-  assert.deepEqual(boxes.selectDormantWarnBoxes([], { dormantDays: 14, warnLeadDays: 3, nowMs: NaN }), []);
-});
-
-await ta('hasDormantWarning: keyed on the CURRENT parked interval, so a re-park re-arms', async () => {
-  const seen = [];
-  const db = { async query(sql, params) { seen.push({ sql, params }); return { rows: [] }; } };
-  const parkedAt = new Date(NOW - 5 * DORMANT_DAY).toISOString();
-  const got = await boxes.hasDormantWarning(db, { boxId: 9, parkedAt });
-  assert.equal(got, false, 'no receipt → not warned');
-  assert.match(seen[0].sql, /dormant_warning/);
-  assert.match(seen[0].sql, /created_at >= \$2/, 'scoped to events AFTER this park, not any historical one');
-  assert.deepEqual(seen[0].params, [9, parkedAt]);
-});
-
-await ta('hasDormantWarning: a missing box id or parked_at is false, never a query', async () => {
-  const db = { async query() { throw new Error('should not query'); } };
-  assert.equal(await boxes.hasDormantWarning(db, { boxId: null, parkedAt: 'x' }), false);
-  assert.equal(await boxes.hasDormantWarning(db, { boxId: 9, parkedAt: null }), false);
-});
-
-await ta('cmdSweepDormant: a box past the threshold that was NEVER warned is DEFERRED, not reclaimed', async () => {
-  // The safety property: even if the warning window was missed entirely (runner
-  // downtime, chat outage), the snapshot is not destroyed on this pass.
-  const box = parked(30);
-  const destroyed = [];
-  const events = [];
-  const fakeBoxes = {
-    async listBoxes() { return [box]; },
-    selectDormantBoxes: boxes.selectDormantBoxes,
-    selectDormantWarnBoxes: boxes.selectDormantWarnBoxes,
-    async hasDormantWarning() { return false; },      // never warned
-    async recordEvent(_db, e) { events.push(e); },
-    async setBoxState() { return {}; },
-    async recordComputeCost() { return 0; },
-    async recordStorageCost() { return 0; },
-    async getBoxByBuilderId() { return { state: 'parked' }; },
-  };
-  const lines = [];
-  const origLog = console.log;
-  console.log = (...a) => lines.push(a.join(' '));
-  let res;
-  try { res = await boxCli.cmdSweepDormant({}, fakeBoxes, { apply: true }); }
-  finally { console.log = origLog; }
-  assert.equal(res.reclaimed, 0, 'NOTHING reclaimed without a delivered warning');
-  assert.equal(res.deferred, 1, 'the reclaim is deferred to a later sweep');
-  assert.equal(destroyed.length, 0);
-  assert.ok(lines.some((l) => /deferred/.test(l)), 'the deferral is logged, not silent');
-});
-
-await ta('cmdSweepDormant: dry-run reclaims and warns nothing', async () => {
-  const fakeBoxes = {
-    async listBoxes() { return [parked(30), parked(12)]; },
-    selectDormantBoxes: boxes.selectDormantBoxes,
-    selectDormantWarnBoxes: boxes.selectDormantWarnBoxes,
-    async hasDormantWarning() { return true; },
-    async recordEvent() { throw new Error('dry-run must not write'); },
-    async setBoxState() { throw new Error('dry-run must not write'); },
-  };
-  const origLog = console.log;
-  console.log = () => {};
-  let res;
-  try { res = await boxCli.cmdSweepDormant({}, fakeBoxes, { apply: false }); }
-  finally { console.log = origLog; }
-  assert.equal(res.reclaimed, 0);
-  assert.equal(res.warned, 0);
-});
-
-console.log(`\nboxes.mjs: ${passed} passed, ${failed} failed`);
-process.exit(failed === 0 ? 0 : 1);