@bongos/core 1.19.126 → 1.19.128

package/tests/provision.mjs

@@ -1033,17 +1033,40 @@ await ta('placeManifestCreds rejects a dedicated droplet (no post-hoc exec path)
   assert.equal(noCode.ok, false); assert.match(noCode.error, /no github_code/);
 });
 
-await ta('placeManifestCreds fails when /healthz never reports auth_configured (never claims success)', async () => {
+await ta('verification timeout reports the code as SPENT and does not disown the placement (F23)', async () => {
   const inst = { ...coTenant, domain: 'mercury.example.com' };
   const deps = {
-    apply: true, privileged: false, log: () => {},
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
     convertManifestCode: async () => ({ clientId: 'Iv1.abcdef0123456789', clientSecret: 'z'.repeat(40), appId: 1, appSlug: 's' }),
     exec: () => ({ ok: true, stdout: '{"ok":true,"auth_configured":false}' }),
     writeFile: () => ({ ok: true }),
   };
   const r = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, deps);
   assert.equal(r.ok, false);
-  assert.match(r.error, /auth_configured=false/);
+  assert.equal(r.codeSpent, true, 'the conversion happened — the single-use code is burned');
+  assert.match(r.error, /credentials are placed/, 'the error owns what DID happen');
+  assert.doesNotMatch(r.error, /\b\d+s\b|minute|second/i, 'no wall-clock promises (§5.2)');
+});
+
+await ta('verification PATIENCE wins the boot race — one conversion, success (F23)', async () => {
+  const inst = { ...coTenant, domain: 'mercury.example.com' };
+  let probes = 0, converts = 0;
+  const deps = {
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
+    convertManifestCode: async () => { converts++; return { clientId: 'Iv1.abcdef0123456789', clientSecret: 'z'.repeat(40), appId: 1, appSlug: 's' }; },
+    exec: (cmd) => {
+      if (/healthz/.test(cmd)) {
+        probes++;
+        return { ok: true, stdout: probes > 20 ? '{"auth_configured":true}' : '{"auth_configured":false}' };
+      }
+      return { ok: true, stdout: '' };
+    },
+    writeFile: () => ({ ok: true }),
+  };
+  const r = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, deps);
+  assert.equal(r.ok, true, 'a slow child boot is waited out, not recorded as a failure');
+  assert.equal(converts, 1, 'the single-use code is converted exactly once');
+  assert.ok(probes > 10, 'the old 10-probe budget would have lost this race');
 });
 
 await ta('drainOAuthManifests (--apply): claims a code_received row, places creds, resolves done', async () => {
@@ -1064,9 +1087,57 @@ await ta('drainOAuthManifests (--apply): claims a code_received row, places cred
   assert.equal(resolved.length, 1);
   assert.equal(resolved[0].status, 'done');
   assert.equal(resolved[0].patch.app_slug, 'app-3');
+  assert.equal(resolved[0].patch.github_code, null, 'a done row holds no re-convertible code (F23)');
   assert.ok(events.includes('oauth-manifest-done'));
 });
 
+await ta('a SPENT code is never re-converted — terminal error, no code_received reset (F23)', async () => {
+  // A stateful one-row store: claimNext honors status, resolve writes it back —
+  // exactly the reset loop that used to re-convert a burned code on the next tick.
+  const row = { id: 21, instance_id: 1, github_code: 'BURNED', attempts: 1, status: 'code_received' };
+  const resolves = []; let converts = 0;
+  const deps = {
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
+    db: {}, writeFile: () => ({ ok: true }),
+    exec: (cmd) => (/healthz/.test(cmd) ? { ok: true, stdout: '{"auth_configured":false}' } : { ok: true, stdout: '' }),
+    convertManifestCode: async () => { converts++; return { clientId: 'Iv1.abcdef0123456789', clientSecret: 'z'.repeat(40), appId: 3, appSlug: 'a' }; },
+    provisioning: {
+      claimNextOAuthManifest: async () => (row.status === 'code_received' ? { ...row } : null),
+      getInstanceById: async () => ({ ...coTenant, domain: 'mercury.example.com' }),
+      resolveOAuthManifest: async (_db, _id, status, patch = {}) => {
+        resolves.push({ status, patch });
+        row.status = status;
+        if ('github_code' in patch) row.github_code = patch.github_code;
+      },
+      recordEvent: async () => {},
+    },
+  };
+  await P.drainOAuthManifests(deps);   // tick 1: converts, placement verification times out
+  await P.drainOAuthManifests(deps);   // tick 2: must find nothing to claim
+  assert.equal(converts, 1, 'the single-use code was converted exactly once across ticks');
+  assert.equal(row.status, 'error', 'a spent code is terminal');
+  assert.equal(row.github_code, null, 'the burned code is scrubbed from the row');
+  assert.ok(!resolves.some((x) => x.status === 'code_received'), 'never reset for a doomed retry');
+});
+
+await ta('a PRE-conversion failure stays retryable — the narrowing spared the retry path (F23)', async () => {
+  let claims = 0; const resolves = [];
+  const deps = {
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
+    db: {}, exec: () => ({ ok: true, stdout: '' }), writeFile: () => ({ ok: true }),
+    provisioning: {
+      claimNextOAuthManifest: async () => (claims++ === 0 ? { id: 22, instance_id: 1, github_code: 'C', attempts: 1 } : null),
+      // dedicated shape → placeManifestCreds refuses BEFORE converting (codeSpent absent)
+      getInstanceById: async () => ({ ...coTenant, hosting_shape: 'dedicated', domain: 'd.example.com' }),
+      resolveOAuthManifest: async (_db, _id, status, patch = {}) => { resolves.push({ status, patch }); },
+      recordEvent: async () => {},
+    },
+  };
+  await P.drainOAuthManifests(deps);
+  assert.equal(resolves.length, 1);
+  assert.equal(resolves[0].status, 'code_received', 'an unconverted code may retry on a later tick');
+});
+
 console.log('\nprivileged mode (PROVISION_SUDO — task 2066):');
 
 t('dbCreateCmd: privileged runs createdb as the postgres role; default is bare (peer auth)', () => {
@@ -1502,17 +1573,20 @@ console.log('\ndomain-attach leg (task 1002692 — give an ACTIVE instance its l
 // bodies), and recorded events. No status writes to capture — domain-attach must
 // never touch the instance lifecycle.
 function attachRecorder({ apply = false } = {}) {
-  const cmds = [], envs = [], writes = [], events = [];
+  const cmds = [], envs = [], writes = [], events = [], dnsNotes = [];
   const deps = {
     apply, log: () => {},
     db: { query: async () => ({ rows: [] }) },
-    provisioning: { recordEvent: async (_db, e) => { events.push(e); } },
+    provisioning: {
+      recordEvent: async (_db, e) => { events.push(e); },
+      recordDnsNote: async (_db, id, note) => { dnsNotes.push({ id, note }); },
+    },
     exec: (cmd, opts = {}) => { cmds.push(cmd); envs.push((opts && opts.env) || null); return { ok: true, stdout: '' }; },
     writeFile: (p, body) => { writes.push({ path: p, body }); return { ok: true }; },
     doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
   };
-  return { deps, cmds, envs, writes, events };
+  return { deps, cmds, envs, writes, events, dnsNotes };
 }
 
 const activeStandalone = {
@@ -1630,5 +1704,197 @@ await ta('cmdRunIntents (--apply): an UNKNOWN intent action never falls through
   assert.ok(!cmds.some((c) => /systemctl (stop|disable)/.test(c)), 'no teardown commands ran');
 });
 
+console.log('\nprovisioning truthfulness (task 1002720 — QA-walk F15/F16/F19):');
+
+// An apply-mode recorder for provisionInstance: every command succeeds except
+// (optionally) the healthz probe, which soft-fails the way a refused connection
+// does under allowFail.
+function truthRecorder({ healthzFails = false } = {}) {
+  const cmds = [], statuses = [], patches = [], probes = [], logs = [], events = [], dnsNotes = [];
+  const deps = {
+    apply: true, privileged: false, log: (m) => logs.push(String(m)), sleep: async () => {},
+    db: { query: async () => ({ rows: [] }) },
+    provisioning: {
+      setInstanceStatus: async (_db, _id, s, patch) => { statuses.push(s); patches.push(patch || {}); },
+      recordLivenessProbe: async (_db, _id, up) => { probes.push(up); },
+      recordDnsNote: async (_db, _id, note) => { dnsNotes.push(note); },
+      recordEvent: async (_db, e) => { events.push(e); },
+      getInstanceBySlug: async () => null, getInstanceById: async () => null,
+      claimNextIntent: async () => null, resolveIntent: async () => {},
+      enqueueIntent: async () => ({ created: true }),
+      claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
+    },
+    exec: (cmd) => {
+      cmds.push(cmd);
+      if (healthzFails && /healthz/.test(cmd)) return { ok: true, stdout: '', softFailed: true };
+      return { ok: true, stdout: '' };
+    },
+    writeFile: () => ({ ok: true }),
+    doApi: null,
+    checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
+    getGithubToken: async () => null,
+  };
+  return { deps, cmds, statuses, patches, probes, logs, events, dnsNotes };
+}
+
+await ta('F15: a refused /healthz is RECORDED — probe handed to the overlay, note cleared, success line qualified', async () => {
+  const { deps, cmds, statuses, patches, probes, logs, events } = truthRecorder({ healthzFails: true });
+  const r = await P.provisionInstance({ ...coTenant }, deps);
+  assert.equal(r.ok, true, 'a failed probe must NOT fail the run — that would burn the intent retry budget');
+  assert.equal(r.healthy, false);
+  assert.equal(statuses[statuses.length - 1], 'active', 'the lifecycle still activates (the overlay carries the truth)');
+  assert.equal(patches[patches.length - 1].error_note, null, 'a stale error_note never rides into active');
+  assert.deepEqual(probes, [false], 'the runner hands its observation to the liveness overlay');
+  assert.ok(cmds.filter((c) => /healthz/.test(c)).length >= 2, 'a slow boot gets a bounded retry, not one shot');
+  assert.ok(logs.some((l) => /not answering/.test(l)), 'the operator line is qualified, not a bare ✓');
+  const activeEvent = events.find((e) => e.event === 'active');
+  assert.match(activeEvent.detail, /not answering/, 'the event detail carries the observation');
+});
+
+await ta('F15: a passing /healthz records up=true immediately — no five-minute "live?" limbo', async () => {
+  const { deps, cmds, probes, logs } = truthRecorder();
+  const r = await P.provisionInstance({ ...coTenant }, deps);
+  assert.equal(r.ok, true);
+  assert.equal(r.healthy, true);
+  assert.deepEqual(probes, [true]);
+  assert.equal(cmds.filter((c) => /healthz/.test(c)).length, 1, 'a pass ends the loop on the first probe');
+  assert.ok(logs.some((l) => /✓ mercury provisioned$/.test(l)), 'the plain success line survives');
+});
+
+await ta('F16: a no-hook attach is honest — ok:true, dns_note written, event says SKIPPED', async () => {
+  const savedHook = P.CONFIG.dnsHook, savedCp = P.CONFIG.controlPlaneIp, savedRemote = P.CONFIG.remoteHost;
+  P.CONFIG.dnsHook = null; P.CONFIG.controlPlaneIp = '203.0.113.9'; P.CONFIG.remoteHost = null;
+  try {
+    const { deps, events, dnsNotes } = attachRecorder({ apply: true });
+    const r = await P.domainAttachInstance({ ...activeStandalone }, deps);
+    assert.equal(r.ok, true, 'an unset hook is unretryable — ok:false would burn the retry budget');
+    assert.equal(dnsNotes.length, 1);
+    assert.match(dnsNotes[0].note, /A record/, 'the owner is told the outstanding manual step');
+    assert.match(dnsNotes[0].note, /203\.0\.113\.9/, 'the note names the target IP');
+    assert.doesNotMatch(dnsNotes[0].note, /shortly|minute|second/i, 'no wall-clock promises (§5.2)');
+    const detail = events.map((e) => e.detail).join('\n');
+    assert.match(detail, /DNS SKIPPED/, 'the event stops claiming DNS was re-asserted');
+  } finally { P.CONFIG.dnsHook = savedHook; P.CONFIG.controlPlaneIp = savedCp; P.CONFIG.remoteHost = savedRemote; }
+});
+
+await ta('F16: a hooked attach CLEARS a stale dns_note', async () => {
+  const savedHook = P.CONFIG.dnsHook, savedCp = P.CONFIG.controlPlaneIp, savedRemote = P.CONFIG.remoteHost;
+  P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh'; P.CONFIG.controlPlaneIp = '203.0.113.9'; P.CONFIG.remoteHost = null;
+  try {
+    const { deps, dnsNotes } = attachRecorder({ apply: true });
+    const r = await P.domainAttachInstance({ ...activeStandalone }, deps);
+    assert.equal(r.ok, true);
+    assert.deepEqual(dnsNotes, [{ id: activeStandalone.id, note: null }], 'a successful attach retires the note');
+  } finally { P.CONFIG.dnsHook = savedHook; P.CONFIG.controlPlaneIp = savedCp; P.CONFIG.remoteHost = savedRemote; }
+});
+
+await ta('F19: a RETIRED intent records its reason on the instance without changing its status', async () => {
+  let claims = 0; const resolved = []; const statusWrites = [];
+  const deps = {
+    apply: true, log: () => {},
+    db: { query: async () => ({ rows: [] }) },
+    provisioning: {
+      claimNextIntent: async () => (claims++ === 0
+        ? { id: 9, instance_id: 18, action: 'domain-attach', attempts: P.MAX_INTENT_ATTEMPTS } : null),
+      // an ACTIVE instance with no domain → the attach leg returns ok:false (unretryable)
+      getInstanceById: async () => ({ ...activeStandalone, domain: null }),
+      resolveIntent: async (_db, id, state, err) => { resolved.push({ id, state, err }); },
+      setInstanceStatus: async (_db, _id, s, patch) => { statusWrites.push({ s, patch }); },
+      recordEvent: async () => {},
+      claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
+    },
+    exec: () => ({ ok: true }), writeFile: () => ({ ok: true }), doApi: null,
+    checkDnsTokenScope: async () => ({ reachable: true, zone: 'z' }),
+  };
+  const r = await P.cmdRunIntents(deps);
+  assert.equal(r.errors, 1);
+  assert.equal(resolved[0].state, 'error', 'the intent retires');
+  assert.equal(statusWrites.length, 1, 'the retire is surfaced on the instance');
+  assert.equal(statusWrites[0].s, 'active', 'status write is a NO-OP on status — a healthy instance is never marked broken');
+  assert.match(statusWrites[0].patch.error_note, /no domain recorded/, 'the reason survives where the card reads it');
+});
+
+await ta('F19: a NON-final failure re-pends the intent and writes nothing on the instance', async () => {
+  let claims = 0; const resolved = []; const statusWrites = []; const updates = [];
+  const deps = {
+    apply: true, log: () => {},
+    db: { query: async (sql) => { if (/UPDATE provisioning_intents/.test(sql)) updates.push(sql); return { rows: [] }; } },
+    provisioning: {
+      claimNextIntent: async () => (claims++ === 0
+        ? { id: 10, instance_id: 18, action: 'domain-attach', attempts: 1 } : null),
+      getInstanceById: async () => ({ ...activeStandalone, domain: null }),
+      resolveIntent: async (_db, id, state, err) => { resolved.push({ id, state, err }); },
+      setInstanceStatus: async (_db, _id, s, patch) => { statusWrites.push({ s, patch }); },
+      recordEvent: async () => {},
+      claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
+    },
+    exec: () => ({ ok: true }), writeFile: () => ({ ok: true }), doApi: null,
+    checkDnsTokenScope: async () => ({ reachable: true, zone: 'z' }),
+  };
+  await P.cmdRunIntents(deps);
+  assert.equal(resolved.length, 0, 'not resolved — it re-pends for a later tick');
+  assert.equal(updates.length, 1, 're-pended via the intents table');
+  assert.equal(statusWrites.length, 0, 'no instance write until the intent actually retires');
+});
+
+console.log('\nreview-panel hardening (task 1002720 — the loopback/latch/birth-note seams):');
+
+await ta('a PASSING loopback probe on a DOMAIN-bearing instance records NO verdict — the address claim belongs to the sweep', async () => {
+  const { deps, probes } = truthRecorder();
+  const r = await P.provisionInstance({ ...coTenant, domain: 'mercury.example.com' }, deps);
+  assert.equal(r.ok, true);
+  assert.equal(r.healthy, true);
+  assert.deepEqual(probes, [], 'loopback-up proves the process, not the domain — "Answering at" must stay unearned');
+});
+
+await ta('a FAILED loopback probe is a verdict on any shape — recorded even with a domain', async () => {
+  const { deps, probes } = truthRecorder({ healthzFails: true });
+  const r = await P.provisionInstance({ ...coTenant, domain: 'mercury.example.com' }, deps);
+  assert.equal(r.healthy, false);
+  assert.deepEqual(probes, [false], 'a dead process answers nowhere — down is down');
+});
+
+await ta('birth-path dns_note: written when the hook is unset, CLEARED when a later run has one', async () => {
+  const savedHook = P.CONFIG.dnsHook, savedPub = P.CONFIG.publicIp;
+  P.CONFIG.publicIp = '203.0.113.5';
+  try {
+    P.CONFIG.dnsHook = null;
+    const a = truthRecorder();
+    await P.provisionInstance({ ...coTenant, domain: 'mercury.example.com' }, a.deps);
+    assert.equal(a.dnsNotes.length, 1, 'the no-hook birth writes the note');
+    assert.match(a.dnsNotes[0], /A record/);
+    P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh';
+    const b = truthRecorder();
+    await P.provisionInstance({ ...coTenant, domain: 'mercury.example.com' }, b.deps);
+    assert.deepEqual(b.dnsNotes, [null], 'a hooked run (e.g. a revive) retires the stale note');
+  } finally { P.CONFIG.dnsHook = savedHook; P.CONFIG.publicIp = savedPub; }
+});
+
+await ta('a successful domain-attach releases the F19 error_note latch', async () => {
+  const savedHook = P.CONFIG.dnsHook, savedCp = P.CONFIG.controlPlaneIp, savedRemote = P.CONFIG.remoteHost;
+  P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh'; P.CONFIG.controlPlaneIp = '203.0.113.9'; P.CONFIG.remoteHost = null;
+  try {
+    const { deps } = attachRecorder({ apply: true });
+    const cleared = [];
+    deps.provisioning.clearErrorNote = async (_db, id) => { cleared.push(id); };
+    const r = await P.domainAttachInstance({ ...activeStandalone, error_note: 'DNS preflight failed' }, deps);
+    assert.equal(r.ok, true);
+    assert.deepEqual(cleared, [activeStandalone.id], 'the "we stopped trying" paragraph must not outlive its recovery');
+  } finally { P.CONFIG.dnsHook = savedHook; P.CONFIG.controlPlaneIp = savedCp; P.CONFIG.remoteHost = savedRemote; }
+});
+
+await ta('UNUSABLE creds from a successful conversion still report codeSpent — no re-POST of a burned code', async () => {
+  const inst = { ...coTenant, domain: 'mercury.example.com' };
+  const deps = {
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
+    convertManifestCode: async () => ({ clientId: 'short', clientSecret: 'also-short' }),
+    exec: () => ({ ok: true, stdout: '' }), writeFile: () => ({ ok: true }),
+  };
+  const r = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /unusable creds/);
+  assert.equal(r.codeSpent, true, 'the conversion RESOLVED — GitHub burned the code even though the creds are junk');
+});
+
 console.log(`\nprovision: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/provisioning_domain_attach.mjs

@@ -189,6 +189,46 @@ await ta('same domain again is idempotent — 200, changed:false, nothing re-que
   assert.equal(enqueueCalls.length, 0);
 });
 
+await ta('same domain again RE-ENQUEUES when the wiring stopped — the owner re-kick (task 1002720 / F19)', async () => {
+  // A retired domain-attach intent left its error_note; re-sending the same
+  // address is the owner's re-kick. The idempotent no-op above still holds for
+  // a healthy instance — this branch needs the demonstrated failure.
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com', error_note: 'DNS preflight failed' } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'spike.cloudbongos.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.changed, false);
+  assert.equal(res.body.queued, true, 'the attach intent re-queues');
+  assert.deepEqual(enqueueCalls.map((c) => c.action), ['domain-attach']);
+  assert.equal(updateCalls.length, 0, 'the domain itself is untouched');
+  assert.match(res.body.message, /Wiring that address again/);
+});
+
+await ta('a verified-DOWN address re-enqueues too; an open intent keeps the no-op', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com', last_verified_up: false } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'spike.cloudbongos.com' });
+  assert.equal(res.body.queued, true, 'probed-down wiring may be re-kicked');
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com', error_note: 'x' } });
+  const savedGetOpen = provisioning.getOpenIntent;
+  provisioning.getOpenIntent = async () => ({ id: 5, action: 'domain-attach' });
+  try {
+    const res2 = await post('/provisioning/instances/18/domain', { domain: 'spike.cloudbongos.com' });
+    assert.equal(res2.body.queued, false, 'an in-flight intent is never doubled');
+    assert.equal(enqueueCalls.length, 0);
+  } finally { provisioning.getOpenIntent = savedGetOpen; }
+});
+
+await ta('re-kick honors enqueueIntent created:false — a racing enqueue is never double-reported', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com', error_note: 'x' } });
+  const savedEnqueue = provisioning.enqueueIntent;
+  provisioning.enqueueIntent = async (...a) => { enqueueCalls.push({ action: a[2] }); return { intent: { id: 5 }, created: false }; };
+  try {
+    const res = await post('/provisioning/instances/18/domain', { domain: 'spike.cloudbongos.com' });
+    assert.equal(res.status, 200, res.raw);
+    assert.equal(res.body.queued, false, 'queued mirrors created, like the sibling attach path');
+    assert.match(res.body.message, /already being wired/);
+  } finally { provisioning.enqueueIntent = savedEnqueue; }
+});
+
 await ta('a DIFFERENT domain already set is a truthful 409 domain_already_set (re-pointing is not this route)', async () => {
   reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'old.cloudbongos.com' } });
   const res = await post('/provisioning/instances/18/domain', { domain: 'new.cloudbongos.com' });

package/tests/public_landing_projects.mjs

@@ -117,6 +117,39 @@ test('the empty state points a new owner at the wizard view — never at a hall'
   assert.doesNotMatch(body, /Enter the Hall/i);
 });
 
+test('teardown copy states what the runner actually does, per hosting shape (F17)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  // the DECIDED policy: shared shapes keep the database; a dedicated machine
+  // takes its database with it — the copy branches on the shape field
+  assert.match(body, /The database is kept/, 'the kept-shape promise is present');
+  assert.match(body, /database goes with (it|the machine)/, 'the dedicated branch exists');
+  assert.match(body, /hosting_shape === 'dedicated'/, 'shape-driven, not flat prose');
+  assert.match(body, /repository is untouched|repository stays yours|repository is still yours/i);
+  // the pre-walk over-claim can never come back
+  assert.doesNotMatch(body, /server and database go away/i);
+  assert.doesNotMatch(body, /database (is|will be) (deleted|dropped|destroyed|removed)/i);
+});
+
+test('the done panel reads the open intent — a queued revive is never told to start another (F22)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  const fn = (body.match(/function renderProgress\(inst\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  assert.ok(fn, 'renderProgress() must be extractable');
+  assert.match(fn, /open_intent/, 'the strip is chosen from the open intent, not status alone');
+  assert.match(fn, /revive/, 'a queued revive on a torn-down instance gets the revive vocabulary');
+  // a requested instance ALWAYS has its provision intent open — the status
+  // branch must win there or it goes dead and diverges from the mine card
+  assert.match(fn, /!== 'requested'/, 'requested speaks its status, not its (always-present) intent');
+  assert.match(body, /inst\.open_intent = data\.open_intent \|\| null/, 'the watch hands the intent through');
+  // teardown speaks its own stage names in the done panel, in its own palette
+  assert.match(fn, /'teardown'/, 'the teardown flow is used');
+  assert.match(body, /\.prog\.flowDown/, 'the .prog strip has the teardown palette (transcribed from .strip.flowDown)');
+});
+
+test('the address row surfaces the manual-DNS note the runner recorded (F16)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  assert.match(body, /inst\.dns_note/, 'the card reads the dns_note the runner writes');
+});
+
 test('the watch give-up hands the owner their projects view — "the hall has it" is dead', async () => {
   // the wizard (and its 33-minute watch cap) lives on /projects now
   const { body } = await request('/projects', 'game.test.local');