@bongos/core 1.19.127 → 1.19.129

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.127",
-  "core_contract": "1.19.127",
-  "source_commit": "f4b67a76dc2ad911a7c9257ba4280de4ac7904c7",
+  "core_version": "1.19.129",
+  "core_contract": "1.19.129",
+  "source_commit": "4f6f1fe2d419e1f7a6b2877ce6d3b2f793308257",
   "source_ref": "HEAD",
-  "built_at": "2026-08-15T00:49:23.419Z",
+  "built_at": "2026-08-15T02:03:44.422Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 303,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1245,
+    "functional_verbatim": 1246,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1569,
-  "tree_sha256": "deedfbf01298656cc039a9d567722f3689778d62d8aacc97a230ac4490a39c7a",
+  "file_count": 1570,
+  "tree_sha256": "15adcb143cdb095a549345805c5491c08b64429b4ef6730ef4878344c15d2ea9",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3844,6 +3844,11 @@
       "mode": "0000644",
       "sha256": "ddbc1f7e659e716fcbb3ba3ec6c1237756f46dbd895bcb27a1dc925a7c782e76"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_008_dns_note.sql",
+      "mode": "0000644",
+      "sha256": "8dc04a18ad77563a2bd73029bf13cab03fb5dadd1b62850fddbde475257e6a76"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -3862,7 +3867,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "59fd212df421b2bdcdfaef4871aa1927c371d3f7d6affafe44e810135acd12b6"
+      "sha256": "90aa880898f6b3235e8b2a1a553695c63c29920968edb9c9af58364902118e33"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -3872,7 +3877,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "321db8769eda7c5f6f385e90edaeec70fc071f0bc2e53e6147705153b0d32d3a"
+      "sha256": "eddf451d5ee5085563af258b5c605c445776c9e226587341f9b4b8b405492240"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -3882,7 +3887,7 @@
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
       "mode": "0000644",
-      "sha256": "4a5c817d88771a62ccb5d26aea865976b7246a253b2ad7b00e11e3be856586ef"
+      "sha256": "0dc18db288580ca00792194ce5f50a13aae8c445c14d7fc42a2095ab2379c93f"
     },
     {
       "path": "modules/provisioning/ui/.gitkeep",
@@ -4167,12 +4172,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ecb64df7be6949adcb0d88b5f21ca3014724b598fa1a6d939a3a50d8f9696aa6"
+      "sha256": "113fa76500c41f49120cb6a76558c693e3862d5f7dbd754c6b6f9e604bd0d45e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "5be9320e605a4b67ba2d63fa4ab831b99bda91a847c11338fd5e0ed6a65d0779"
+      "sha256": "88877c77760c0d9d44361b8522fa2e871a8a62f85a500454acc9af972db8b00e"
     },
     {
       "path": "public-docs/index.html",
@@ -4427,7 +4432,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "6dcb73054fa58d3b0254f1d82a7f639ed465db2c2fd1e83e26f29b80532047e5"
+      "sha256": "ac866c928701c41ac7f055f8807590a3db71eb2538502a54a6fca9ac1d79868d"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5082,7 +5087,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "a10501b65207bbd72f9fc039d4cf1ef0be7f85dc832e8e95e1b26aa966e507b8"
+      "sha256": "1925ed112ec553a95388b81cccc1fb003ba2a0e91a5a80c6e315b45895688d0f"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -5757,7 +5762,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "80e087f2181512cfdf51030c27aeb7aaa4235421c4e06c9d7c4a000d418b0d0a"
+      "sha256": "0d17e220c27abd9a9064c461404fa8fdf2f352f404e10673b76ff8a34ccd04c2"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7297,7 +7302,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "edb6c5da9ec32536d50f7cb648b81b026b7926f73f891feb0906fc7343b5b11d"
+      "sha256": "5297caf5005fd26c8435aa374511882a6c2d232e43f07cdc6ec19d1168ee1cc1"
     },
     {
       "path": "tests/provisioning_default_domain.mjs",
@@ -7307,7 +7312,7 @@
     {
       "path": "tests/provisioning_domain_attach.mjs",
       "mode": "0000644",
-      "sha256": "fbbd7397fd03181e9c2ea58ed8accb1a9d9d66d4c904a09265161e1034b02f9f"
+      "sha256": "856f434c8e1a8e8ad549c81689f1bbe27ff555e4ba08f9b485c3e9d46838a4a5"
     },
     {
       "path": "tests/provisioning_github_app_routes.mjs",
@@ -7332,7 +7337,7 @@
     {
       "path": "tests/public_landing_projects.mjs",
       "mode": "0000644",
-      "sha256": "2d4dea6cd6be287c1d7629009adc64fba526b1ebbe53a800ae43499e1b8e3f18"
+      "sha256": "7f2fe0290fc0a429b54ca53d449453e9009a57e40bb8003b2718beef33be2309"
     },
     {
       "path": "tests/public_mirror_export.mjs",

package/modules/provisioning/migrations/provisioning_008_dns_note.sql

@@ -0,0 +1,15 @@
+-- provisioning_008_dns_note.sql — transport the runner's "DNS was skipped" fact
+-- to the owner's card (task 1002720 / QA-walk F16).
+--
+-- WHY. With BOX_DNS_HOOK unset, domain-attach wires env + Caddy but SKIPS the
+-- A-record upsert — a fact that lived only in the runner's log while the owner's
+-- card promised the address "will answer shortly" (it never would). This column
+-- carries the outstanding manual step as a plain sentence the card renders.
+--
+-- OVERLAY, NOT A STATE (the provisioning_006 rule): nullable, no default,
+-- never written by the lifecycle. NULL = nothing outstanding. A later attach
+-- with a working hook clears it.
+ALTER TABLE provisioning_instances ADD COLUMN IF NOT EXISTS dns_note text;
+
+INSERT INTO schema_migrations (version) VALUES ('provisioning_008_dns_note')
+ON CONFLICT (version) DO NOTHING;

package/modules/provisioning/provisioning.js

@@ -198,6 +198,9 @@ function publicInstance(row) {
     // them differently ("live?" vs "unreachable"). Never collapse the two.
     last_verified_at: row.last_verified_at || null,
     last_verified_up: row.last_verified_up == null ? null : !!row.last_verified_up,
+    // The outstanding manual-DNS step, if the runner had no hook to point the
+    // A record (task 1002720 / F16). null = nothing outstanding.
+    dns_note: row.dns_note || null,
     cost_estimate_usd: Number(row.cost_estimate_usd || 0),
     error_note: row.error_note || null,
     created_at: row.created_at,
@@ -372,6 +375,30 @@ async function recordLivenessProbe(db, id, up) {
   return rows[0] || null;
 }
 
+// Record (or clear, with null) the outstanding manual-DNS sentence the card
+// renders (task 1002720 / F16). Same narrowness rule as recordLivenessProbe:
+// no `status`, no `updated_at` — the runner's lifecycle authorship and the
+// owner's card ordering stay untouched.
+async function recordDnsNote(db, id, note) {
+  const { rows } = await db.query(
+    `UPDATE provisioning_instances SET dns_note = $2 WHERE id = $1 RETURNING id, dns_note`,
+    [id, note || null]
+  );
+  return rows[0] || null;
+}
+
+// Clear the error_note latch (task 1002720 / F19). The retire leg of the intent
+// runner sets it when work stops; a later SUCCESSFUL run must release it, or the
+// card shows "we stopped trying" forever on a healed instance. Same narrowness
+// rule: no status, no updated_at.
+async function clearErrorNote(db, id) {
+  const { rows } = await db.query(
+    `UPDATE provisioning_instances SET error_note = NULL WHERE id = $1 RETURNING id`,
+    [id]
+  );
+  return rows[0] || null;
+}
+
 // The caller's own instances, newest first.
 async function listInstancesForOwner(db, ownerBuilderId) {
   const { rows } = await db.query(
@@ -701,7 +728,7 @@ module.exports = {
   isProvisionedHostname,
   getInstanceById, getInstanceBySlug, getInstanceByDomain, listInstancesForOwner, listAllInstances,
   // data access — verification overlay (task 1002696)
-  listActiveInstancesForLiveness, recordLivenessProbe,
+  listActiveInstancesForLiveness, recordLivenessProbe, recordDnsNote, clearErrorNote,
   createInstance, setInstanceStatus, updateInstanceDomain,
   enqueueIntent, enqueueTeardown, getOpenIntent, claimNextIntent, resolveIntent,
   recordEvent, instanceStateForSlug, costLedger,

package/modules/provisioning/routes/provisioning.js

@@ -589,6 +589,28 @@ module.exports = function provisioningRoutes() {
       }
       const current = provisioning.normalizeHostname(inst.domain);
       if (current && current === domain) {
+        // Re-sending the SAME address is the owner's only re-kick when the
+        // wiring stopped (task 1002720 / F19) — the mirror of what POST
+        // /instances already does for a snagged standup. Only when the wiring
+        // DEMONSTRABLY needs it — a retired intent left its error_note, or the
+        // probe says the address doesn't answer — and nothing is in flight. A
+        // healthy instance (no note, verified up or unprobed) keeps the
+        // idempotent no-op below.
+        const needsRewire = inst.error_note || inst.last_verified_up === false;
+        if (inst.status === 'active' && needsRewire && !(await provisioning.getOpenIntent(pool, id))) {
+          const { created } = await provisioning.enqueueIntent(pool, id, 'domain-attach', 'api:self');
+          if (created) {
+            await provisioning.recordEvent(pool, {
+              instanceId: id, ownerBuilderId: req.builder.id, event: 'domain',
+              detail: `domain ${domain} re-attach queued (owner re-kick)`, actor: 'api:self',
+            }).catch(() => {});
+          }
+          // created:false = a racing enqueue got there first — still truthful.
+          return res.json({ ok: true, changed: false, queued: !!created, domain: inst.domain,
+            message: created
+              ? 'Wiring that address again — this card updates when it starts.'
+              : 'That address is already being wired — this card updates when it starts.' });
+        }
         return res.json({ ok: true, changed: false, queued: false, domain: inst.domain,
           message: 'This instance already has that address.' });
       }
@@ -640,8 +662,11 @@ module.exports = function provisioningRoutes() {
         actor: 'api:self',
       }).catch(() => {});
       res.json({ ok: true, changed: true, queued, domain,
+        // State-only sentence (task 1002720 / F16): the web tier holds no cloud
+        // tokens and cannot know whether a DNS hook exists on the runner, so
+        // "it will answer there shortly" was a promise it could not keep.
         message: queued
-          ? 'Your instance is being wired to its new address — it will answer there shortly.'
+          ? 'Your instance is being wired to its new address — this card will show whether it answers.'
           : 'Address recorded — it will be wired when the instance is provisioned.' });
     } catch (err) {
       console.error('[provisioning] POST /provisioning/instances/:id/domain', err);

package/modules/provisioning/tests/provisioning.mjs

@@ -235,5 +235,26 @@ t('publicInstance projects the declared type — nullable, never silently droppe
   assert.equal(q.type, null, 'a row predating provisioning_007 projects null, not undefined');
 });
 
+t('publicInstance projects dns_note — nullable, never silently dropped (task 1002720 / F16)', () => {
+  const p = P.publicInstance({ id: 1, slug: 'x', status: 'active', dns_note: 'point the A record at 203.0.113.5' });
+  assert.match(p.dns_note, /A record/, 'the owner-facing manual-DNS sentence must reach the card');
+  const q = P.publicInstance({ id: 2, slug: 'y', status: 'active' });
+  assert.equal(q.dns_note, null, 'a row predating provisioning_008 projects null, not undefined');
+});
+
+await ta('recordDnsNote / clearErrorNote are NARROW single-column updates — no status, no updated_at', async () => {
+  let sql = '', params = null;
+  const db = { query: async (q, p) => { sql = q; params = p; return { rows: [{ id: 5 }] }; } };
+  await P.recordDnsNote(db, 5, 'note text');
+  assert.match(sql, /SET dns_note = \$2/);
+  assert.doesNotMatch(sql, /status|updated_at/, 'the overlay must never reshuffle lifecycle or card order');
+  assert.deepEqual(params, [5, 'note text']);
+  await P.recordDnsNote(db, 5, null);
+  assert.deepEqual(params, [5, null], 'null clears');
+  await P.clearErrorNote(db, 5);
+  assert.match(sql, /SET error_note = NULL/);
+  assert.doesNotMatch(sql, /status\s*=|updated_at/, 'releasing the latch must not touch the lifecycle');
+});
+
 console.log(`\nprovisioning module: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.127",
+  "version": "1.19.129",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.127",
+      "version": "1.19.129",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.127",
+  "version": "1.19.129",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -228,6 +228,17 @@ h1[tabindex="-1"]:focus{outline:none;}
 .prog.isLive .pnote{color:color-mix(in srgb,var(--ok) 75%,var(--ink));font-size:14px;}
 .prog.isErr{background:var(--err-soft);border-color:color-mix(in srgb,var(--err) 25%,var(--bg-card));}
 .prog.isErr .pnote{color:var(--err);}
+/* teardown's calm neutral (F22) — transcribed from cosmos's .strip.flowDown,
+   the same .prog-mirrors-.strip duplication as the rest of this block */
+.prog.flowDown{border-color:var(--line);background:linear-gradient(180deg,var(--neutral-soft) 0%,var(--bg-card) 100%);}
+.prog.flowDown .stages li:not(:first-child)::before{background:var(--line);}
+.prog.flowDown .stages li.done:not(:first-child)::before{background:var(--ink-faint);}
+.prog.flowDown .sdot{border-color:var(--line);}
+.prog.flowDown .stages li.done .sdot{border-color:var(--ink-faint);background:var(--ink-faint);}
+.prog.flowDown .stages li.now .sdot{border-color:var(--ink-soft);}
+.prog.flowDown .stages li.now .sdot::after{background:var(--ink-soft);}
+.prog.flowDown .slbl{color:var(--ink-faint);}
+.prog.flowDown .stages li.now .slbl,.prog.flowDown .stages li.done .slbl{color:var(--ink-soft);}
 .again{
   display:inline-block;margin-top:14px;font-size:13px;font-weight:700;color:var(--ink-faint);
   background:none;border:none;cursor:pointer;font-family:var(--font-body);text-decoration:underline;
@@ -2864,25 +2875,55 @@ h1[tabindex="-1"]:focus{outline:none;}
     var watchPending = false;      /* a parked progress watch, resumed on re-entry */
     var watchGen = 0;              /* same orphaning contract as manifestGen above */
     function stopPolling() { watchGen += 1; if (pollTimer) { clearTimeout(pollTimer); pollTimer = null; } }
-    function progressMarkup(stageNow, stagesDone, note, cls) {
-      var names = ['Request filed', 'Standing it up', 'Live'];
-      return '<div class="prog ' + (cls || '') + '" role="status" aria-live="polite">' +
-        '<ul class="stages">' + names.map(function (n, i) {
+    /* The done panel's own flow vocabularies (F22). A local mirror of the mine
+       view's FLOWS — that table lives in the OTHER page IIFE, out of scope here,
+       the same isolation that makes .prog duplicate .strip. */
+    var PROG_FLOWS = {
+      standup: { names: ['Request filed', 'Standing it up', 'Live'], cls: '' },
+      revive: { names: ['Revive queued', 'Standing it up', 'Back live'], cls: '' },
+      teardown: { names: ['Teardown queued', 'Winding down', 'Torn down'], cls: 'flowDown' }
+    };
+    function progressMarkup(stageNow, stagesDone, note, cls, flow) {
+      var f = PROG_FLOWS[flow || 'standup'];
+      return '<div class="prog ' + (f.cls ? f.cls + ' ' : '') + (cls || '') + '" role="status" aria-live="polite">' +
+        '<ul class="stages">' + f.names.map(function (n, i) {
           var c = stagesDone > i ? 'done' : (stageNow === i ? 'now' : '');
           return '<li class="' + c + '"><span class="sdot"></span><span class="slbl">' + n + '</span></li>';
         }).join('') + '</ul>' +
         '<p class="pnote">' + note + '</p></div>';
     }
     /* Renders the current instance state; returns true when the state is terminal
-       (no further polling wanted). */
+       (no further polling wanted). The strip is chosen by the OPEN INTENT first,
+       then status (F22): a torn-down instance with a queued revive must never be
+       told to "start another project". */
     function renderProgress(inst) {
       var el = $('liveProgress');
       if (!el) return true;
       var s = inst && inst.status;
+      var revive = !!(inst && inst.torn_down_at);
+      var oi = inst && inst.open_intent;
+      /* requested/provisioning/tearing_down speak their STATUS (a requested
+         instance always has its provision intent open — the intent branch
+         would make the status branch dead and diverge from the mine card) */
+      if (oi && s !== 'provisioning' && s !== 'tearing_down' && s !== 'requested') {
+        if (oi.action === 'provision') {
+          el.innerHTML = progressMarkup(0, 0,
+            (s === 'torn_down' ? 'A revive is queued' : 'A standup is queued') + ' — this panel updates when it starts.',
+            '', s === 'torn_down' ? 'revive' : 'standup');
+          return false;
+        }
+        if (oi.action === 'teardown') {
+          el.innerHTML = progressMarkup(0, 0, 'A teardown is queued — this panel updates when it starts.', '', 'teardown');
+          return false;
+        }
+      }
       if (s === 'requested') {
-        el.innerHTML = progressMarkup(1, 1, 'Waiting for a runner to pick it up. This updates the moment it starts.');
+        el.innerHTML = progressMarkup(1, 1, 'Waiting for a runner to pick it up. This updates the moment it starts.', '', revive ? 'revive' : 'standup');
       } else if (s === 'provisioning') {
-        el.innerHTML = progressMarkup(1, 1, 'Raising the server, database, and address — nothing needed from you.');
+        el.innerHTML = progressMarkup(1, 1,
+          revive ? 'Bringing it back on the newest platform version — nothing needed from you.'
+                 : 'Raising the server, database, and address — nothing needed from you.',
+          '', revive ? 'revive' : 'standup');
       } else if (s === 'active') {
         var addr = inst.domain ? 'https://' + inst.domain : null;
         el.innerHTML = progressMarkup(-1, 3,
@@ -2894,9 +2935,13 @@ h1[tabindex="-1"]:focus{outline:none;}
            false "keeps retrying" — retries stop, and the retry door is the mine view */
         el.innerHTML = progressMarkup(1, 1,
           'The standup stopped partway — it won’t continue on its own. Retry it (and see the technical details) from <a href="?view=mine">your projects page</a>.', 'isErr');
-      } else if (s === 'tearing_down' || s === 'torn_down') {
-        /* a deliberate end is calm, never styled as a failure (direction §5) */
-        el.innerHTML = progressMarkup(-1, 0, 'This instance was torn down. Bring it back any time from <a href="?view=mine">your projects page</a>, or start another below.');
+      } else if (s === 'tearing_down') {
+        /* a deliberate end is calm, never styled as a failure (direction §5) —
+           and it speaks the teardown vocabulary, not the standup's (F22) */
+        el.innerHTML = progressMarkup(1, 1, 'Taking the server offline. The repository stays yours; ' +
+          (inst.hosting_shape === 'dedicated' ? 'its database goes with the machine.' : 'the database is kept.'), '', 'teardown');
+      } else if (s === 'torn_down') {
+        el.innerHTML = progressMarkup(-1, 3, 'This instance was torn down. Bring it back any time from <a href="?view=mine">your projects page</a>, or start another below.', '', 'teardown');
         return true;
       } else {
         el.innerHTML = progressMarkup(0, 1, 'Filed. Watching for the standup to start…');
@@ -2936,6 +2981,7 @@ h1[tabindex="-1"]:focus{outline:none;}
           .then(function (data) {
             if (myGen !== watchGen) return;
             var inst = data.instance;
+            if (inst) inst.open_intent = data.open_intent || null;   /* F22: the strip reads intents */
             /* the checklist reflects live state (task 1002694): a status transition —
                e.g. the scaffold landing — re-renders the steps (change-only, so the
                5s tick never clobbers an open dropdown or mid-flight button) */
@@ -3198,6 +3244,10 @@ h1[tabindex="-1"]:focus{outline:none;}
   /* domainless instances get their first address; an assigned default may be
      upgraded to a bring-your-own domain (the server allows exactly that re-point) */
   function canAttachDomain(inst) {
+    /* the re-kick door (F19): an active instance whose address wiring stopped
+       (error_note, no intent in flight) can re-send its own domain — the route
+       re-enqueues the attach for exactly this shape */
+    if (inst.status === 'active' && inst.domain && inst.error_note && !inst.open_intent) return true;
     return (!inst.domain || inst.domain === assignedDefaultFor(inst)) &&
       (inst.status === 'requested' || inst.status === 'error' || inst.status === 'active');
   }
@@ -3258,7 +3308,8 @@ h1[tabindex="-1"]:focus{outline:none;}
                : 'Raising the server, database, and address — nothing needed from you.');
     }
     if (s === 'tearing_down') {
-      return stripMarkup('teardown', 1, 1, 'Taking the server offline. The repository stays yours; the database is kept.');
+      return stripMarkup('teardown', 1, 1, 'Taking the server offline. The repository stays yours; ' +
+        (inst.hosting_shape === 'dedicated' ? 'its database goes with the machine.' : 'the database is kept.'));
     }
     if (inst.open_intent) {
       var a = inst.open_intent.action;
@@ -3297,6 +3348,14 @@ h1[tabindex="-1"]:focus{outline:none;}
   /* ── rendering ───────────────────────────────────────────────────────── */
 
   var SHAPE_LABEL = { standalone: 'its own server', 'co-tenant': 'shared server', dedicated: 'its own server' };
+  /* what a teardown ACTUALLY does, per hosting shape (F17 — the DECIDED policy:
+     retention is deliberate on shared boxes; a dedicated machine takes its
+     database with it). Copy follows the runner, never the other way around. */
+  function teardownTruth(inst) {
+    return inst && inst.hosting_shape === 'dedicated'
+      ? 'This project has a machine to itself, so the machine goes away and its database goes with it. Your repository is untouched.'
+      : 'The server goes away and the address stops answering. Your repository is untouched. The database is kept, so bringing it back later restores its memory.';
+  }
 
   function addressRow(inst) {
     if (inst.domain) {
@@ -3305,6 +3364,9 @@ h1[tabindex="-1"]:focus{outline:none;}
            heartbeat earns it — never the runner finishing its script */
         var link = '<a href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">' + esc(inst.domain) + '</a>';
         if (inst.last_verified_up) return 'Answering at ' + link;
+        /* the runner had no DNS hook (F16): the CAUSE beats the bare symptom —
+           a successful A record flips last_verified_up and retires the note */
+        if (inst.dns_note) return 'Its address is ' + link + '. ' + esc(inst.dns_note);
         if (inst.last_verified_up === false) return 'Not answering at ' + link + ' right now.';
         return 'Its address is ' + link + ' — confirming it answers.';
       }
@@ -3335,20 +3397,28 @@ h1[tabindex="-1"]:focus{outline:none;}
     var addr = addressRow(inst);
     if (addr) body += '<div class="addr">' + addr + '</div>';
     if (canAttachDomain(inst)) {
+      var rekick = inst.status === 'active' && inst.domain && inst.error_note;
       body += '<div class="attach">' +
-        '<input type="text" id="dom-' + iid + '" placeholder="myproject.example.com" autocomplete="off" spellcheck="false" maxlength="253">' +
+        '<input type="text" id="dom-' + iid + '" placeholder="myproject.example.com" autocomplete="off" spellcheck="false" maxlength="253"' +
+        (rekick ? ' value="' + esc(inst.domain) + '"' : '') + '>' +
         '<button type="button" class="btn small" data-attach="' + iid + '">' +
-        (inst.domain ? 'Use your own domain' : 'Give it an address') + '</button></div>';
+        (rekick ? 'Try the address again' : inst.domain ? 'Use your own domain' : 'Give it an address') + '</button></div>';
     }
-    if (inst.status === 'error' && !inst.open_intent) {
+    if ((inst.status === 'error' || inst.error_note) && !inst.open_intent) {
       /* once a retry is queued the strip tells the story — the stale error
-         paragraph would just contradict it (owner walk, 2026-08-12) */
+         paragraph would just contradict it (owner walk, 2026-08-12). Also
+         covers an ACTIVE instance whose intent retired with a note (F19) —
+         the work stopped and the card must say so, not stay silent. */
       body += '<div class="projMsg err">' + errMarkup(inst) + '</div>';
     }
     body += stripFor(inst);
-    if (gone) {
+    if (gone && !inst.open_intent) {
+      /* with a revive queued, the strip tells the story — this paragraph would
+         contradict it (F22, the same guard the error paragraph has) */
       body += '<div class="projMsg">Torn down' + (inst.torn_down_at ? ' ' + esc(shortDate(inst.torn_down_at)) : '') +
-        '. The repository is still yours, and its database is kept — bringing it back takes one click. Or <a href="?view=new">start another</a>.</div>';
+        (inst.hosting_shape === 'dedicated'
+          ? '. The repository is still yours. Bringing it back stands up a fresh machine with an empty database. Or <a href="?view=new">start another</a>.</div>'
+          : '. The repository is still yours, and its database is kept — bringing it back takes one click. Or <a href="?view=new">start another</a>.</div>');
     }
     var lm = lastMsg[inst.id];
     body += '<div class="projMsg' + (lm && lm.cls ? ' ' + lm.cls : '') + '" id="msg-' + iid + '">' + (lm ? lm.text : '') + '</div>';
@@ -3522,7 +3592,7 @@ h1[tabindex="-1"]:focus{outline:none;}
     var act = $('act-' + id);
     if (!act) return;
     act.innerHTML = '<div class="confirmRow">' +
-      '<span class="plain">Tear it down? The server goes away and the address stops answering. Your repository is untouched. The database is kept, so bringing it back later restores its memory.</span>' +
+      '<span class="plain">Tear it down? ' + teardownTruth(byId[id]) + '</span>' +
       '<button type="button" class="btn small danger" data-teardown-yes="' + esc(id) + '">Yes, tear it down</button>' +
       '<button type="button" class="linklike" data-teardown-no="' + esc(id) + '">Keep it running</button></div>';
   }

package/scripts/gds/provision.js

@@ -169,6 +169,14 @@ const CONFIG = {
 
 const MAX_INTENT_ATTEMPTS = numEnv('PROVISION_INTENT_MAX_ATTEMPTS', 3);
 
+// Manifest-placement verification budget (task 1002720 / QA-walk F23): a child
+// instance is a full Node boot away from reporting auth_configured=true, and the
+// old 10×1s poll routinely lost that race — recording a failure for a setup that
+// succeeded, then burning the SINGLE-USE manifest code on the retry. ~3 min of
+// patience; the poll runs after the intent loop, so it delays nothing.
+const MANIFEST_VERIFY_TRIES = numEnv('PROVISION_MANIFEST_VERIFY_TRIES', 90);
+const MANIFEST_VERIFY_INTERVAL_MS = numEnv('PROVISION_MANIFEST_VERIFY_INTERVAL_MS', 2000);
+
 // ---------------------------------------------------------------------------
 // Lazy dep load (so --help / arg errors need no Postgres) — the box.js pattern.
 // ---------------------------------------------------------------------------
@@ -1503,9 +1511,21 @@ async function provisionInstance(inst, deps) {
       // only on the control plane — it must never run on the (token-free) co-hosting
       // box even when the box-mutating steps above went there over SSH (task 2065).
       controlExec(CONFIG.dnsHook, { env: dnsEnv });
+      // The clear half of the birth-path note (F16): a revive after the operator
+      // configured the hook must retire the stale "point your A record" sentence.
+      if (apply && provisioning.recordDnsNote) {
+        await provisioning.recordDnsNote(db, inst.id, null).catch(() => {});
+      }
     }
   } else {
     log('  [dns] skipped (no domain, or BOX_DNS_HOOK unset)');
+    // Birth-path twin of the domain-attach note (F16): a domain with no hook is
+    // the same silent skip here, so the owner card gets the same sentence.
+    if (apply && inst.domain) {
+      if (provisioning.recordDnsNote) await provisioning.recordDnsNote(db, inst.id,
+        `Automatic DNS isn't set up on this platform — point ${inst.domain}'s A record at ${recordIp || 'your server'}, and this card will show when it answers.`
+      ).catch(() => {});
+    }
   }
 
   // ── step 6: Caddy per-instance site snippet + reload ──────────────────────
@@ -1520,17 +1540,55 @@ async function provisionInstance(inst, deps) {
   } else { log('    (Caddy on the droplet via cloud-init)'); }
 
   // ── step 7: healthz ───────────────────────────────────────────────────────
+  // The probe RESULT is recorded, not discarded (task 1002720 / QA-walk F15: a
+  // refused connection used to ride silently into 'active' and the card said
+  // live). Bounded retry so a slow first boot is not slandered — the
+  // placeManifestCreds loop shape. Still ok:true either way: a failed probe
+  // must not flip the intent to failed (cmdRunIntents would burn the 3-attempt
+  // budget on an instance that may simply be slow); the liveness overlay is
+  // what tells the owner the truth.
   log('  [healthz] verify the instance answers');
-  if (local) boxExec(healthzCmd(inst), { allowFail: true });
-  else log('    (verified post-boot)');
+  const sleep = deps.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
+  let healthy = null;                     // null = not observed (dry-run / dedicated)
+  if (local) {
+    const tries = apply ? 10 : 1;
+    for (let i = 0; i < tries; i++) {
+      const res = boxExec(healthzCmd(inst), { allowFail: true });
+      if (!apply) break;                  // dry-run: exactly one plan line
+      if (res && !res.softFailed) { healthy = true; break; }
+      healthy = false;
+      if (i < tries - 1) await sleep(1000);
+    }
+  } else log('    (verified post-boot)');
 
-  // Mark active.
+  // Mark active. error_note: null — a stale note from an earlier failed run
+  // must not ride into the active state (F15's second half; the co-tenant +
+  // standalone paths never cleared it). The runner hands its own observation
+  // to the liveness overlay so the card gets an honest verdict immediately
+  // instead of waiting ~5 min for the first sweep.
   if (apply) {
-    await provisioning.setInstanceStatus(db, inst.id, 'active', { ...patch, provisioned_at: new Date().toISOString() });
-    await provisioning.recordEvent(db, { instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: 'active', detail: `provisioned (${inst.hosting_shape}, port ${inst.port || '-'})`, actor: 'runner' });
+    await provisioning.setInstanceStatus(db, inst.id, 'active', { ...patch, error_note: null, provisioned_at: new Date().toISOString() });
+    // The overlay column is DOMAIN-scoped when a domain exists (the sweep
+    // probes https://<domain>; loopback only when there is none), and the card
+    // renders up=true as "Answering at <domain>". This probe is loopback, so:
+    // a FAILURE is a verdict on any shape (a dead process answers nowhere),
+    // but a PASS proves only the process — for a domain-bearing instance the
+    // address claim stays "not checked yet" until the sweep earns it.
+    const probeIsVerdict = healthy === false || (healthy === true && !inst.domain);
+    if (probeIsVerdict && provisioning.recordLivenessProbe) {
+      await provisioning.recordLivenessProbe(db, inst.id, healthy).catch(() => {});
+    }
+    await provisioning.recordEvent(db, {
+      instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: 'active',
+      detail: `provisioned (${inst.hosting_shape}, port ${inst.port || '-'})` +
+              (healthy === false ? ' — not answering /healthz yet' : ''),
+      actor: 'runner',
+    });
   }
-  log(`  ✓ ${inst.slug} provisioned`);
-  return { ok: true, port: inst.port };
+  log(healthy === false
+    ? `  ⚠ ${inst.slug} provisioned, but it is not answering /healthz yet — its card will read "unreachable"`
+    : `  ✓ ${inst.slug} provisioned`);
+  return { ok: true, port: inst.port, healthy };
 }
 
 // The cloud-init user-data for a dedicated droplet: run the co-tenant standup
@@ -1616,6 +1674,7 @@ async function domainAttachInstance(inst, deps) {
 
   // DNS A-record UPSERT — mirrors provisionInstance step 5 (control-plane exec only:
   // the hook needs the Cloudflare token, which never leaves the control plane).
+  let dnsSkipped = false;
   if (CONFIG.dnsHook) {
     if (!recordIp) {
       const ipEnvHint = standalone ? 'PROVISION_CONTROL_PLANE_IP (standalone)' : 'PROVISION_PUBLIC_IP (co-tenant)';
@@ -1627,7 +1686,11 @@ async function domainAttachInstance(inst, deps) {
       controlExec(CONFIG.dnsHook, { env: dnsEnv });
     }
   } else {
-    log('  [dns] skipped (BOX_DNS_HOOK unset) — point the A record manually');
+    // Still ok:true below — an unset hook is unretryable, and ok:false would
+    // burn the intent's retry budget on it. The skip is surfaced to the OWNER
+    // via dns_note (F16), not just this operator log line.
+    dnsSkipped = true;
+    log(`  [dns] skipped (BOX_DNS_HOOK unset) — point ${inst.domain}'s A record at ${recordIp || 'this server'} manually`);
   }
 
   log('  [caddy] write site snippet + reload');
@@ -1638,12 +1701,24 @@ async function domainAttachInstance(inst, deps) {
   boxExec(healthzCmd(inst), { allowFail: true });
 
   if (apply) {
+    // Written BOTH ways so a later successful attach clears a stale note.
+    if (provisioning.recordDnsNote) await provisioning.recordDnsNote(db, inst.id, dnsSkipped
+      ? `Automatic DNS isn't set up on this platform — point ${inst.domain}'s A record at ${recordIp || 'your server'}, and this card will show when it answers.`
+      : null).catch(() => {});
+    // Release the F19 latch: this run SUCCEEDED, so a "we stopped trying" note
+    // from an earlier retired attach must not outlive its own recovery.
+    if (provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id).catch(() => {});
     await provisioning.recordEvent(db, {
       instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: 'domain-attached',
-      detail: `domain ${inst.domain} wired (env + DNS + caddy re-asserted)`, actor: 'runner',
+      detail: dnsSkipped
+        ? `domain ${inst.domain} wired (env + caddy); DNS SKIPPED — no hook configured`
+        : `domain ${inst.domain} wired (env + DNS + caddy re-asserted)`,
+      actor: 'runner',
     }).catch(() => {});
   }
-  log(`  ✓ ${inst.slug} addressed as ${inst.domain}`);
+  log(dnsSkipped
+    ? `  ✓ ${inst.slug} configured for ${inst.domain} — DNS still needs your A record`
+    : `  ✓ ${inst.slug} addressed as ${inst.domain}`);
   return { ok: true };
 }
 
@@ -1750,11 +1825,14 @@ async function placeManifestCreds(inst, mrow, deps) {
 
   // 2) validate the returned creds BEFORE writing (catch a malformed GitHub response —
   //    the same length/charset guard oauth-secret.js uses against silent truncation).
+  // From here on the single-use manifest code is SPENT (the conversion POST
+  // consumed it) — every return carries codeSpent:true so the drain never
+  // resets the row for a retry that would re-convert a burned code and 404.
   const idV = oauthSecret.validateClientId(creds.clientId);
   const secV = oauthSecret.validateClientSecret(creds.clientSecret);
   if (!idV.ok || !secV.ok) {
     const why = [!idV.ok ? `id: ${idV.reason}` : null, !secV.ok ? `secret: ${secV.reason}` : null].filter(Boolean).join('; ');
-    return { ok: false, error: `GitHub returned unusable creds (${why})` };
+    return { ok: false, codeSpent: apply, error: `GitHub returned unusable creds (${why})` };
   }
 
   // 3) rewrite web.env with the creds + restart the unit (never logs the secret — the
@@ -1764,21 +1842,24 @@ async function placeManifestCreds(inst, mrow, deps) {
   boxExec(`${sudoP}systemctl restart ${inst.slug}`);
 
   // 4) verify /healthz reports auth_configured=true (only meaningful under --apply).
+  //    PATIENT (F23): the child must boot before it can answer; losing this race
+  //    used to record a failure for a setup that had succeeded.
   if (apply) {
+    const sleep = deps.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
     let authConfigured = false;
-    for (let i = 0; i < 10; i++) {
+    for (let i = 0; i < MANIFEST_VERIFY_TRIES; i++) {
       const out = boxExec(healthzCmd(inst), { allowFail: true });
       if (oauthSecret.parseHealthzAuth(out && out.stdout).authConfigured) { authConfigured = true; break; }
-      await new Promise((r) => setTimeout(r, 1000));
+      await sleep(MANIFEST_VERIFY_INTERVAL_MS);
     }
     if (!authConfigured) {
-      return { ok: false, error: 'placed creds but /healthz still reports auth_configured=false — sign-in not live yet' };
+      return { ok: false, codeSpent: true, error: 'the credentials are placed, but the project did not report sign-in ready in time' };
     }
     log('  [oauth-manifest] ✓ /healthz auth_configured=true — sign-in is live');
   } else {
     log('  [oauth-manifest] would probe /healthz for auth_configured after restart');
   }
-  return { ok: true, appId: creds.appId, appSlug: creds.appSlug };
+  return { ok: true, codeSpent: apply, appId: creds.appId, appSlug: creds.appSlug };
 }
 
 // Drain provisioning_oauth_manifests rows awaiting conversion (status 'code_received').
@@ -1820,11 +1901,17 @@ async function drainOAuthManifests(deps) {
       if (!inst) { await provisioning.resolveOAuthManifest(db, mrow.id, 'error', { last_error: 'instance row vanished' }); errors++; continue; }
       const result = await placeManifestCreds(inst, mrow, deps);
       if (result && result.ok === false) {
-        if (mrow.attempts >= MAX_INTENT_ATTEMPTS) await provisioning.resolveOAuthManifest(db, mrow.id, 'error', { last_error: result.error });
+        // A SPENT code is terminal, always (F23): GitHub's manifest code is
+        // single-use, so resetting the row to 'code_received' guarantees the
+        // next tick re-converts a burned code and 404s forever. Only failures
+        // that happened BEFORE the conversion stay retryable.
+        if (result.codeSpent) await provisioning.resolveOAuthManifest(db, mrow.id, 'error', { last_error: result.error, github_code: null });
+        else if (mrow.attempts >= MAX_INTENT_ATTEMPTS) await provisioning.resolveOAuthManifest(db, mrow.id, 'error', { last_error: result.error });
         else await provisioning.resolveOAuthManifest(db, mrow.id, 'code_received', { last_error: result.error });
         errors++; log(`  ✖ oauth-manifest #${mrow.id}: ${result.error}`);
       } else {
-        await provisioning.resolveOAuthManifest(db, mrow.id, 'done', { app_id: result.appId, app_slug: result.appSlug });
+        // github_code: null on done too — a finished row holds no re-convertible code.
+        await provisioning.resolveOAuthManifest(db, mrow.id, 'done', { app_id: result.appId, app_slug: result.appSlug, github_code: null });
         await provisioning.recordEvent(db, {
           instanceId: inst.id, ownerBuilderId: mrow.requested_by, event: 'oauth-manifest-done',
           detail: `sign-in wired via GitHub App Manifest (app ${result.appSlug || result.appId || '?'})`, actor: 'runner',
@@ -1880,8 +1967,17 @@ async function cmdRunIntents(deps) {
       else if (intent.action === 'domain-attach') result = await domainAttachInstance(inst, deps);
       else result = { ok: false, error: `unknown intent action '${intent.action}' — refusing to guess` };
       if (result && result.ok === false) {
-        if (intent.attempts >= MAX_INTENT_ATTEMPTS) await provisioning.resolveIntent(db, intent.id, 'error', result.error || 'op failed');
-        else await db.query(`UPDATE provisioning_intents SET state='pending', last_error=$2, updated_at=now() WHERE id=$1`, [intent.id, result.error || 'op failed']);
+        if (intent.attempts >= MAX_INTENT_ATTEMPTS) {
+          await provisioning.resolveIntent(db, intent.id, 'error', result.error || 'op failed');
+          // A retired intent stops silently otherwise (F19): record the reason
+          // on the instance WITHOUT changing its lifecycle status — passing the
+          // CURRENT status makes the status write a no-op, so a healthy active
+          // instance is never marked broken over a domain hiccup, but the card
+          // can say why the work stopped.
+          await provisioning.setInstanceStatus(db, intent.instance_id, inst.status, { error_note: result.error || 'op failed' }).catch(() => {});
+        } else {
+          await db.query(`UPDATE provisioning_intents SET state='pending', last_error=$2, updated_at=now() WHERE id=$1`, [intent.id, result.error || 'op failed']);
+        }
         errors++;
       } else { await provisioning.resolveIntent(db, intent.id, 'done', null); ok++; }
     } catch (e) {

package/src/module-api.js

@@ -681,8 +681,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.125 with no explicit bump. run 31853055269. (task 1002620)
 //   1.19.127 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.126 with no explicit bump. run 31854730552. (task 1002620)
+//   1.19.128 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.127 with no explicit bump. run 31857842473. (task 1002620)
+//   1.19.129 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.128 with no explicit bump. run 31858158416. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.127'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.129'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provision.mjs

@@ -1033,17 +1033,40 @@ await ta('placeManifestCreds rejects a dedicated droplet (no post-hoc exec path)
   assert.equal(noCode.ok, false); assert.match(noCode.error, /no github_code/);
 });
 
-await ta('placeManifestCreds fails when /healthz never reports auth_configured (never claims success)', async () => {
+await ta('verification timeout reports the code as SPENT and does not disown the placement (F23)', async () => {
   const inst = { ...coTenant, domain: 'mercury.example.com' };
   const deps = {
-    apply: true, privileged: false, log: () => {},
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
     convertManifestCode: async () => ({ clientId: 'Iv1.abcdef0123456789', clientSecret: 'z'.repeat(40), appId: 1, appSlug: 's' }),
     exec: () => ({ ok: true, stdout: '{"ok":true,"auth_configured":false}' }),
     writeFile: () => ({ ok: true }),
   };
   const r = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, deps);
   assert.equal(r.ok, false);
-  assert.match(r.error, /auth_configured=false/);
+  assert.equal(r.codeSpent, true, 'the conversion happened — the single-use code is burned');
+  assert.match(r.error, /credentials are placed/, 'the error owns what DID happen');
+  assert.doesNotMatch(r.error, /\b\d+s\b|minute|second/i, 'no wall-clock promises (§5.2)');
+});
+
+await ta('verification PATIENCE wins the boot race — one conversion, success (F23)', async () => {
+  const inst = { ...coTenant, domain: 'mercury.example.com' };
+  let probes = 0, converts = 0;
+  const deps = {
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
+    convertManifestCode: async () => { converts++; return { clientId: 'Iv1.abcdef0123456789', clientSecret: 'z'.repeat(40), appId: 1, appSlug: 's' }; },
+    exec: (cmd) => {
+      if (/healthz/.test(cmd)) {
+        probes++;
+        return { ok: true, stdout: probes > 20 ? '{"auth_configured":true}' : '{"auth_configured":false}' };
+      }
+      return { ok: true, stdout: '' };
+    },
+    writeFile: () => ({ ok: true }),
+  };
+  const r = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, deps);
+  assert.equal(r.ok, true, 'a slow child boot is waited out, not recorded as a failure');
+  assert.equal(converts, 1, 'the single-use code is converted exactly once');
+  assert.ok(probes > 10, 'the old 10-probe budget would have lost this race');
 });
 
 await ta('drainOAuthManifests (--apply): claims a code_received row, places creds, resolves done', async () => {
@@ -1064,9 +1087,57 @@ await ta('drainOAuthManifests (--apply): claims a code_received row, places cred
   assert.equal(resolved.length, 1);
   assert.equal(resolved[0].status, 'done');
   assert.equal(resolved[0].patch.app_slug, 'app-3');
+  assert.equal(resolved[0].patch.github_code, null, 'a done row holds no re-convertible code (F23)');
   assert.ok(events.includes('oauth-manifest-done'));
 });
 
+await ta('a SPENT code is never re-converted — terminal error, no code_received reset (F23)', async () => {
+  // A stateful one-row store: claimNext honors status, resolve writes it back —
+  // exactly the reset loop that used to re-convert a burned code on the next tick.
+  const row = { id: 21, instance_id: 1, github_code: 'BURNED', attempts: 1, status: 'code_received' };
+  const resolves = []; let converts = 0;
+  const deps = {
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
+    db: {}, writeFile: () => ({ ok: true }),
+    exec: (cmd) => (/healthz/.test(cmd) ? { ok: true, stdout: '{"auth_configured":false}' } : { ok: true, stdout: '' }),
+    convertManifestCode: async () => { converts++; return { clientId: 'Iv1.abcdef0123456789', clientSecret: 'z'.repeat(40), appId: 3, appSlug: 'a' }; },
+    provisioning: {
+      claimNextOAuthManifest: async () => (row.status === 'code_received' ? { ...row } : null),
+      getInstanceById: async () => ({ ...coTenant, domain: 'mercury.example.com' }),
+      resolveOAuthManifest: async (_db, _id, status, patch = {}) => {
+        resolves.push({ status, patch });
+        row.status = status;
+        if ('github_code' in patch) row.github_code = patch.github_code;
+      },
+      recordEvent: async () => {},
+    },
+  };
+  await P.drainOAuthManifests(deps);   // tick 1: converts, placement verification times out
+  await P.drainOAuthManifests(deps);   // tick 2: must find nothing to claim
+  assert.equal(converts, 1, 'the single-use code was converted exactly once across ticks');
+  assert.equal(row.status, 'error', 'a spent code is terminal');
+  assert.equal(row.github_code, null, 'the burned code is scrubbed from the row');
+  assert.ok(!resolves.some((x) => x.status === 'code_received'), 'never reset for a doomed retry');
+});
+
+await ta('a PRE-conversion failure stays retryable — the narrowing spared the retry path (F23)', async () => {
+  let claims = 0; const resolves = [];
+  const deps = {
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
+    db: {}, exec: () => ({ ok: true, stdout: '' }), writeFile: () => ({ ok: true }),
+    provisioning: {
+      claimNextOAuthManifest: async () => (claims++ === 0 ? { id: 22, instance_id: 1, github_code: 'C', attempts: 1 } : null),
+      // dedicated shape → placeManifestCreds refuses BEFORE converting (codeSpent absent)
+      getInstanceById: async () => ({ ...coTenant, hosting_shape: 'dedicated', domain: 'd.example.com' }),
+      resolveOAuthManifest: async (_db, _id, status, patch = {}) => { resolves.push({ status, patch }); },
+      recordEvent: async () => {},
+    },
+  };
+  await P.drainOAuthManifests(deps);
+  assert.equal(resolves.length, 1);
+  assert.equal(resolves[0].status, 'code_received', 'an unconverted code may retry on a later tick');
+});
+
 console.log('\nprivileged mode (PROVISION_SUDO — task 2066):');
 
 t('dbCreateCmd: privileged runs createdb as the postgres role; default is bare (peer auth)', () => {
@@ -1502,17 +1573,20 @@ console.log('\ndomain-attach leg (task 1002692 — give an ACTIVE instance its l
 // bodies), and recorded events. No status writes to capture — domain-attach must
 // never touch the instance lifecycle.
 function attachRecorder({ apply = false } = {}) {
-  const cmds = [], envs = [], writes = [], events = [];
+  const cmds = [], envs = [], writes = [], events = [], dnsNotes = [];
   const deps = {
     apply, log: () => {},
     db: { query: async () => ({ rows: [] }) },
-    provisioning: { recordEvent: async (_db, e) => { events.push(e); } },
+    provisioning: {
+      recordEvent: async (_db, e) => { events.push(e); },
+      recordDnsNote: async (_db, id, note) => { dnsNotes.push({ id, note }); },
+    },
     exec: (cmd, opts = {}) => { cmds.push(cmd); envs.push((opts && opts.env) || null); return { ok: true, stdout: '' }; },
     writeFile: (p, body) => { writes.push({ path: p, body }); return { ok: true }; },
     doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
   };
-  return { deps, cmds, envs, writes, events };
+  return { deps, cmds, envs, writes, events, dnsNotes };
 }
 
 const activeStandalone = {
@@ -1630,5 +1704,197 @@ await ta('cmdRunIntents (--apply): an UNKNOWN intent action never falls through
   assert.ok(!cmds.some((c) => /systemctl (stop|disable)/.test(c)), 'no teardown commands ran');
 });
 
+console.log('\nprovisioning truthfulness (task 1002720 — QA-walk F15/F16/F19):');
+
+// An apply-mode recorder for provisionInstance: every command succeeds except
+// (optionally) the healthz probe, which soft-fails the way a refused connection
+// does under allowFail.
+function truthRecorder({ healthzFails = false } = {}) {
+  const cmds = [], statuses = [], patches = [], probes = [], logs = [], events = [], dnsNotes = [];
+  const deps = {
+    apply: true, privileged: false, log: (m) => logs.push(String(m)), sleep: async () => {},
+    db: { query: async () => ({ rows: [] }) },
+    provisioning: {
+      setInstanceStatus: async (_db, _id, s, patch) => { statuses.push(s); patches.push(patch || {}); },
+      recordLivenessProbe: async (_db, _id, up) => { probes.push(up); },
+      recordDnsNote: async (_db, _id, note) => { dnsNotes.push(note); },
+      recordEvent: async (_db, e) => { events.push(e); },
+      getInstanceBySlug: async () => null, getInstanceById: async () => null,
+      claimNextIntent: async () => null, resolveIntent: async () => {},
+      enqueueIntent: async () => ({ created: true }),
+      claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
+    },
+    exec: (cmd) => {
+      cmds.push(cmd);
+      if (healthzFails && /healthz/.test(cmd)) return { ok: true, stdout: '', softFailed: true };
+      return { ok: true, stdout: '' };
+    },
+    writeFile: () => ({ ok: true }),
+    doApi: null,
+    checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
+    getGithubToken: async () => null,
+  };
+  return { deps, cmds, statuses, patches, probes, logs, events, dnsNotes };
+}
+
+await ta('F15: a refused /healthz is RECORDED — probe handed to the overlay, note cleared, success line qualified', async () => {
+  const { deps, cmds, statuses, patches, probes, logs, events } = truthRecorder({ healthzFails: true });
+  const r = await P.provisionInstance({ ...coTenant }, deps);
+  assert.equal(r.ok, true, 'a failed probe must NOT fail the run — that would burn the intent retry budget');
+  assert.equal(r.healthy, false);
+  assert.equal(statuses[statuses.length - 1], 'active', 'the lifecycle still activates (the overlay carries the truth)');
+  assert.equal(patches[patches.length - 1].error_note, null, 'a stale error_note never rides into active');
+  assert.deepEqual(probes, [false], 'the runner hands its observation to the liveness overlay');
+  assert.ok(cmds.filter((c) => /healthz/.test(c)).length >= 2, 'a slow boot gets a bounded retry, not one shot');
+  assert.ok(logs.some((l) => /not answering/.test(l)), 'the operator line is qualified, not a bare ✓');
+  const activeEvent = events.find((e) => e.event === 'active');
+  assert.match(activeEvent.detail, /not answering/, 'the event detail carries the observation');
+});
+
+await ta('F15: a passing /healthz records up=true immediately — no five-minute "live?" limbo', async () => {
+  const { deps, cmds, probes, logs } = truthRecorder();
+  const r = await P.provisionInstance({ ...coTenant }, deps);
+  assert.equal(r.ok, true);
+  assert.equal(r.healthy, true);
+  assert.deepEqual(probes, [true]);
+  assert.equal(cmds.filter((c) => /healthz/.test(c)).length, 1, 'a pass ends the loop on the first probe');
+  assert.ok(logs.some((l) => /✓ mercury provisioned$/.test(l)), 'the plain success line survives');
+});
+
+await ta('F16: a no-hook attach is honest — ok:true, dns_note written, event says SKIPPED', async () => {
+  const savedHook = P.CONFIG.dnsHook, savedCp = P.CONFIG.controlPlaneIp, savedRemote = P.CONFIG.remoteHost;
+  P.CONFIG.dnsHook = null; P.CONFIG.controlPlaneIp = '203.0.113.9'; P.CONFIG.remoteHost = null;
+  try {
+    const { deps, events, dnsNotes } = attachRecorder({ apply: true });
+    const r = await P.domainAttachInstance({ ...activeStandalone }, deps);
+    assert.equal(r.ok, true, 'an unset hook is unretryable — ok:false would burn the retry budget');
+    assert.equal(dnsNotes.length, 1);
+    assert.match(dnsNotes[0].note, /A record/, 'the owner is told the outstanding manual step');
+    assert.match(dnsNotes[0].note, /203\.0\.113\.9/, 'the note names the target IP');
+    assert.doesNotMatch(dnsNotes[0].note, /shortly|minute|second/i, 'no wall-clock promises (§5.2)');
+    const detail = events.map((e) => e.detail).join('\n');
+    assert.match(detail, /DNS SKIPPED/, 'the event stops claiming DNS was re-asserted');
+  } finally { P.CONFIG.dnsHook = savedHook; P.CONFIG.controlPlaneIp = savedCp; P.CONFIG.remoteHost = savedRemote; }
+});
+
+await ta('F16: a hooked attach CLEARS a stale dns_note', async () => {
+  const savedHook = P.CONFIG.dnsHook, savedCp = P.CONFIG.controlPlaneIp, savedRemote = P.CONFIG.remoteHost;
+  P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh'; P.CONFIG.controlPlaneIp = '203.0.113.9'; P.CONFIG.remoteHost = null;
+  try {
+    const { deps, dnsNotes } = attachRecorder({ apply: true });
+    const r = await P.domainAttachInstance({ ...activeStandalone }, deps);
+    assert.equal(r.ok, true);
+    assert.deepEqual(dnsNotes, [{ id: activeStandalone.id, note: null }], 'a successful attach retires the note');
+  } finally { P.CONFIG.dnsHook = savedHook; P.CONFIG.controlPlaneIp = savedCp; P.CONFIG.remoteHost = savedRemote; }
+});
+
+await ta('F19: a RETIRED intent records its reason on the instance without changing its status', async () => {
+  let claims = 0; const resolved = []; const statusWrites = [];
+  const deps = {
+    apply: true, log: () => {},
+    db: { query: async () => ({ rows: [] }) },
+    provisioning: {
+      claimNextIntent: async () => (claims++ === 0
+        ? { id: 9, instance_id: 18, action: 'domain-attach', attempts: P.MAX_INTENT_ATTEMPTS } : null),
+      // an ACTIVE instance with no domain → the attach leg returns ok:false (unretryable)
+      getInstanceById: async () => ({ ...activeStandalone, domain: null }),
+      resolveIntent: async (_db, id, state, err) => { resolved.push({ id, state, err }); },
+      setInstanceStatus: async (_db, _id, s, patch) => { statusWrites.push({ s, patch }); },
+      recordEvent: async () => {},
+      claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
+    },
+    exec: () => ({ ok: true }), writeFile: () => ({ ok: true }), doApi: null,
+    checkDnsTokenScope: async () => ({ reachable: true, zone: 'z' }),
+  };
+  const r = await P.cmdRunIntents(deps);
+  assert.equal(r.errors, 1);
+  assert.equal(resolved[0].state, 'error', 'the intent retires');
+  assert.equal(statusWrites.length, 1, 'the retire is surfaced on the instance');
+  assert.equal(statusWrites[0].s, 'active', 'status write is a NO-OP on status — a healthy instance is never marked broken');
+  assert.match(statusWrites[0].patch.error_note, /no domain recorded/, 'the reason survives where the card reads it');
+});
+
+await ta('F19: a NON-final failure re-pends the intent and writes nothing on the instance', async () => {
+  let claims = 0; const resolved = []; const statusWrites = []; const updates = [];
+  const deps = {
+    apply: true, log: () => {},
+    db: { query: async (sql) => { if (/UPDATE provisioning_intents/.test(sql)) updates.push(sql); return { rows: [] }; } },
+    provisioning: {
+      claimNextIntent: async () => (claims++ === 0
+        ? { id: 10, instance_id: 18, action: 'domain-attach', attempts: 1 } : null),
+      getInstanceById: async () => ({ ...activeStandalone, domain: null }),
+      resolveIntent: async (_db, id, state, err) => { resolved.push({ id, state, err }); },
+      setInstanceStatus: async (_db, _id, s, patch) => { statusWrites.push({ s, patch }); },
+      recordEvent: async () => {},
+      claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
+    },
+    exec: () => ({ ok: true }), writeFile: () => ({ ok: true }), doApi: null,
+    checkDnsTokenScope: async () => ({ reachable: true, zone: 'z' }),
+  };
+  await P.cmdRunIntents(deps);
+  assert.equal(resolved.length, 0, 'not resolved — it re-pends for a later tick');
+  assert.equal(updates.length, 1, 're-pended via the intents table');
+  assert.equal(statusWrites.length, 0, 'no instance write until the intent actually retires');
+});
+
+console.log('\nreview-panel hardening (task 1002720 — the loopback/latch/birth-note seams):');
+
+await ta('a PASSING loopback probe on a DOMAIN-bearing instance records NO verdict — the address claim belongs to the sweep', async () => {
+  const { deps, probes } = truthRecorder();
+  const r = await P.provisionInstance({ ...coTenant, domain: 'mercury.example.com' }, deps);
+  assert.equal(r.ok, true);
+  assert.equal(r.healthy, true);
+  assert.deepEqual(probes, [], 'loopback-up proves the process, not the domain — "Answering at" must stay unearned');
+});
+
+await ta('a FAILED loopback probe is a verdict on any shape — recorded even with a domain', async () => {
+  const { deps, probes } = truthRecorder({ healthzFails: true });
+  const r = await P.provisionInstance({ ...coTenant, domain: 'mercury.example.com' }, deps);
+  assert.equal(r.healthy, false);
+  assert.deepEqual(probes, [false], 'a dead process answers nowhere — down is down');
+});
+
+await ta('birth-path dns_note: written when the hook is unset, CLEARED when a later run has one', async () => {
+  const savedHook = P.CONFIG.dnsHook, savedPub = P.CONFIG.publicIp;
+  P.CONFIG.publicIp = '203.0.113.5';
+  try {
+    P.CONFIG.dnsHook = null;
+    const a = truthRecorder();
+    await P.provisionInstance({ ...coTenant, domain: 'mercury.example.com' }, a.deps);
+    assert.equal(a.dnsNotes.length, 1, 'the no-hook birth writes the note');
+    assert.match(a.dnsNotes[0], /A record/);
+    P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh';
+    const b = truthRecorder();
+    await P.provisionInstance({ ...coTenant, domain: 'mercury.example.com' }, b.deps);
+    assert.deepEqual(b.dnsNotes, [null], 'a hooked run (e.g. a revive) retires the stale note');
+  } finally { P.CONFIG.dnsHook = savedHook; P.CONFIG.publicIp = savedPub; }
+});
+
+await ta('a successful domain-attach releases the F19 error_note latch', async () => {
+  const savedHook = P.CONFIG.dnsHook, savedCp = P.CONFIG.controlPlaneIp, savedRemote = P.CONFIG.remoteHost;
+  P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh'; P.CONFIG.controlPlaneIp = '203.0.113.9'; P.CONFIG.remoteHost = null;
+  try {
+    const { deps } = attachRecorder({ apply: true });
+    const cleared = [];
+    deps.provisioning.clearErrorNote = async (_db, id) => { cleared.push(id); };
+    const r = await P.domainAttachInstance({ ...activeStandalone, error_note: 'DNS preflight failed' }, deps);
+    assert.equal(r.ok, true);
+    assert.deepEqual(cleared, [activeStandalone.id], 'the "we stopped trying" paragraph must not outlive its recovery');
+  } finally { P.CONFIG.dnsHook = savedHook; P.CONFIG.controlPlaneIp = savedCp; P.CONFIG.remoteHost = savedRemote; }
+});
+
+await ta('UNUSABLE creds from a successful conversion still report codeSpent — no re-POST of a burned code', async () => {
+  const inst = { ...coTenant, domain: 'mercury.example.com' };
+  const deps = {
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
+    convertManifestCode: async () => ({ clientId: 'short', clientSecret: 'also-short' }),
+    exec: () => ({ ok: true, stdout: '' }), writeFile: () => ({ ok: true }),
+  };
+  const r = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /unusable creds/);
+  assert.equal(r.codeSpent, true, 'the conversion RESOLVED — GitHub burned the code even though the creds are junk');
+});
+
 console.log(`\nprovision: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/provisioning_domain_attach.mjs

@@ -189,6 +189,46 @@ await ta('same domain again is idempotent — 200, changed:false, nothing re-que
   assert.equal(enqueueCalls.length, 0);
 });
 
+await ta('same domain again RE-ENQUEUES when the wiring stopped — the owner re-kick (task 1002720 / F19)', async () => {
+  // A retired domain-attach intent left its error_note; re-sending the same
+  // address is the owner's re-kick. The idempotent no-op above still holds for
+  // a healthy instance — this branch needs the demonstrated failure.
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com', error_note: 'DNS preflight failed' } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'spike.cloudbongos.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.changed, false);
+  assert.equal(res.body.queued, true, 'the attach intent re-queues');
+  assert.deepEqual(enqueueCalls.map((c) => c.action), ['domain-attach']);
+  assert.equal(updateCalls.length, 0, 'the domain itself is untouched');
+  assert.match(res.body.message, /Wiring that address again/);
+});
+
+await ta('a verified-DOWN address re-enqueues too; an open intent keeps the no-op', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com', last_verified_up: false } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'spike.cloudbongos.com' });
+  assert.equal(res.body.queued, true, 'probed-down wiring may be re-kicked');
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com', error_note: 'x' } });
+  const savedGetOpen = provisioning.getOpenIntent;
+  provisioning.getOpenIntent = async () => ({ id: 5, action: 'domain-attach' });
+  try {
+    const res2 = await post('/provisioning/instances/18/domain', { domain: 'spike.cloudbongos.com' });
+    assert.equal(res2.body.queued, false, 'an in-flight intent is never doubled');
+    assert.equal(enqueueCalls.length, 0);
+  } finally { provisioning.getOpenIntent = savedGetOpen; }
+});
+
+await ta('re-kick honors enqueueIntent created:false — a racing enqueue is never double-reported', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com', error_note: 'x' } });
+  const savedEnqueue = provisioning.enqueueIntent;
+  provisioning.enqueueIntent = async (...a) => { enqueueCalls.push({ action: a[2] }); return { intent: { id: 5 }, created: false }; };
+  try {
+    const res = await post('/provisioning/instances/18/domain', { domain: 'spike.cloudbongos.com' });
+    assert.equal(res.status, 200, res.raw);
+    assert.equal(res.body.queued, false, 'queued mirrors created, like the sibling attach path');
+    assert.match(res.body.message, /already being wired/);
+  } finally { provisioning.enqueueIntent = savedEnqueue; }
+});
+
 await ta('a DIFFERENT domain already set is a truthful 409 domain_already_set (re-pointing is not this route)', async () => {
   reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'old.cloudbongos.com' } });
   const res = await post('/provisioning/instances/18/domain', { domain: 'new.cloudbongos.com' });

package/tests/public_landing_projects.mjs

@@ -117,6 +117,39 @@ test('the empty state points a new owner at the wizard view — never at a hall'
   assert.doesNotMatch(body, /Enter the Hall/i);
 });
 
+test('teardown copy states what the runner actually does, per hosting shape (F17)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  // the DECIDED policy: shared shapes keep the database; a dedicated machine
+  // takes its database with it — the copy branches on the shape field
+  assert.match(body, /The database is kept/, 'the kept-shape promise is present');
+  assert.match(body, /database goes with (it|the machine)/, 'the dedicated branch exists');
+  assert.match(body, /hosting_shape === 'dedicated'/, 'shape-driven, not flat prose');
+  assert.match(body, /repository is untouched|repository stays yours|repository is still yours/i);
+  // the pre-walk over-claim can never come back
+  assert.doesNotMatch(body, /server and database go away/i);
+  assert.doesNotMatch(body, /database (is|will be) (deleted|dropped|destroyed|removed)/i);
+});
+
+test('the done panel reads the open intent — a queued revive is never told to start another (F22)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  const fn = (body.match(/function renderProgress\(inst\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  assert.ok(fn, 'renderProgress() must be extractable');
+  assert.match(fn, /open_intent/, 'the strip is chosen from the open intent, not status alone');
+  assert.match(fn, /revive/, 'a queued revive on a torn-down instance gets the revive vocabulary');
+  // a requested instance ALWAYS has its provision intent open — the status
+  // branch must win there or it goes dead and diverges from the mine card
+  assert.match(fn, /!== 'requested'/, 'requested speaks its status, not its (always-present) intent');
+  assert.match(body, /inst\.open_intent = data\.open_intent \|\| null/, 'the watch hands the intent through');
+  // teardown speaks its own stage names in the done panel, in its own palette
+  assert.match(fn, /'teardown'/, 'the teardown flow is used');
+  assert.match(body, /\.prog\.flowDown/, 'the .prog strip has the teardown palette (transcribed from .strip.flowDown)');
+});
+
+test('the address row surfaces the manual-DNS note the runner recorded (F16)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  assert.match(body, /inst\.dns_note/, 'the card reads the dns_note the runner writes');
+});
+
 test('the watch give-up hands the owner their projects view — "the hall has it" is dead', async () => {
   // the wizard (and its 33-minute watch cap) lives on /projects now
   const { body } = await request('/projects', 'game.test.local');