@bongos/core 1.19.260 → 1.19.261

package/modules/provisioning/provisioning.js

@@ -43,10 +43,21 @@ const PROJECT_TYPES = ['game', 'research', 'business', 'non-profit', 'not-sure']
 // domain-dependent standup legs for an already-ACTIVE instance that was just
 // given its address via POST /provisioning/instances/:id/domain.
 const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest', 'domain-attach'];
-// The states from which a teardown is meaningful (there is something to reclaim).
-// Mirrors dev-box canTransition('deprovision', …): a requested/torn_down/error
-// instance has nothing running to tear down via the happy path.
-const TEARDOWN_FROM = new Set(['provisioning', 'active', 'tearing_down']);
+// Every state a teardown can be asked for — i.e. everything except the one
+// state where there is provably nothing left to release. DERIVED from
+// INSTANCE_STATES on purpose (task 1003042, walk finding N5): the old hand-kept
+// whitelist ['provisioning','active','tearing_down'] silently excluded
+// 'requested' and 'error', and since force-teardown reuses this same set there
+// was NO path — owner or archon — to remove such a row; errored instances piled
+// up permanently (instance 15 'swag' sat there from 2026-08-07). The premise
+// that an errored row has "nothing to reclaim" was simply wrong: a provision
+// that fails mid-run lands at 'error' AFTER it may have created the database,
+// taken a port, written the systemd unit and the Caddy block, and UPSERTed the
+// DNS record. teardownInstance's steps are individually allowFail, so it
+// reclaims whatever actually exists and settles the row either way.
+// Deriving it means a future 7th state is teardownable by default — the safe
+// direction, since the failure mode being fixed here was a row with no exit.
+const TEARDOWN_FROM = new Set(INSTANCE_STATES.filter((s) => s !== 'torn_down'));
 // The states from which (re)enqueueing a 'provision' intent is meaningful. An
 // 'active' instance needs no standup — blindly re-enqueueing one on a slug
 // re-request left a stale open provision intent that then blocked the owner's

package/modules/provisioning/routes/provisioning.js

@@ -290,20 +290,37 @@ module.exports = function provisioningRoutes() {
     }
   });
 
+  // The ONE teardown-state refusal, shared by the owner route and the archon
+  // force route. It was duplicated, and the copies drifted: the owner's carried a
+  // plain sentence while force-teardown's used the positional res.fail form with
+  // no message at all, so its body returned the bare code "not_teardownable" as
+  // the human text (walk finding N5, §5.1's plain-sentence rule). One helper, one
+  // wording, no way to drift again. Returns true when it has answered.
+  function refusedAsTornDown(inst, res) {
+    if (provisioning.TEARDOWN_FROM.has(inst.status)) return false;
+    // res.fail's return value is not part of its contract — answer, then say so.
+    res.fail('not_teardownable', {
+      status: 409,
+      message: 'This project has already been torn down — its server is stopped and there is nothing left to release.',
+      details: { status: inst.status },
+    });
+    return true;
+  }
+
   // POST /provisioning/instances/:id/force-teardown — Archon tears down ANY
   // instance. Trust-safe by the same mechanism as the owner's own teardown: it
   // ENQUEUES a 'teardown' intent for the control-plane runner; the web tier never
-  // holds cloud tokens. rank: archon (acts on another owner's infrastructure).
-  // Declared among the archon routes (archon-first).
+  // holds cloud tokens. Gated by 'provisioning.fleet.manage', whose floor is
+  // metic (ADR 0157 lowered it from archon) — "force" means ACROSS OWNERSHIP, not
+  // past the state machine: the state gate below is the same one the owner route
+  // uses. Declared among the archon routes (archon-first).
   router.post('/provisioning/instances/:id/force-teardown', auth.requireBuilder, auth.requirePermission('provisioning.fleet.manage'), async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     try {
       const inst = await provisioning.getInstanceById(pool, id);
       if (!inst) return res.fail('instance_not_found', 404);
-      if (!provisioning.TEARDOWN_FROM.has(inst.status)) {
-        return res.fail('not_teardownable', 409, { status: inst.status });
-      }
+      if (refusedAsTornDown(inst, res)) return;
       // Same truthful outcome mapping as the owner's teardown (task 1002691).
       const r = await provisioning.enqueueTeardown(pool, id, `api:archon:${req.builder.id}`);
       if (r.conflict) {
@@ -670,9 +687,7 @@ module.exports = function provisioningRoutes() {
       if (!inst || String(inst.owner_builder_id) !== String(req.builder.id)) {
         return res.fail('instance_not_found', 404);
       }
-      if (!provisioning.TEARDOWN_FROM.has(inst.status)) {
-        return res.fail('not_teardownable', { status: 409, message: `Instance is '${inst.status}' — nothing to tear down right now.`, details: { status: inst.status } });
-      }
+      if (refusedAsTornDown(inst, res)) return;
       // enqueueTeardown supersedes a stale pending provision intent and reports each
       // outcome distinctly, so "already queued" is only ever said when it is TRUE
       // (task 1002691 — the old blind enqueue lied here and the instance leaked).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.260",
+  "version": "1.19.261",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.260",
+      "version": "1.19.261",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.260",
+  "version": "1.19.261",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -251,6 +251,12 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .btn.small{font-size:13.5px;padding:8px 16px;}
 .btn.danger{background:transparent;color:var(--err);box-shadow:none;border:2px solid color-mix(in srgb,var(--err) 35%,transparent);}
 .btn.danger:hover{background:var(--err-soft);border-color:var(--err);}
+/* a disabled danger button must LOOK disabled. .btn.danger is declared AFTER
+   .btn:disabled at equal specificity, so without these it keeps full-strength
+   --err and only the cursor says the control is inert — on a destructive button
+   that reads as "click me", which is the one thing it must not (task 1003042). */
+.btn.danger:disabled{background:transparent;color:color-mix(in srgb,var(--ink) 40%,var(--bg-deep));border-color:color-mix(in srgb,var(--ink) 18%,transparent);box-shadow:none;cursor:not-allowed;transform:none;}
+.btn.danger:disabled:hover{background:transparent;border-color:color-mix(in srgb,var(--ink) 18%,transparent);}
 .btn .gh{width:17px;height:17px;fill:currentColor;}
 .linklike{background:none;border:none;cursor:pointer;font-family:var(--font-body);font-weight:700;font-size:13.5px;color:var(--link-ink);text-decoration:underline;padding:6px 4px;}
 

package/public-landing/projects.html

@@ -636,9 +636,25 @@ h1[tabindex="-1"]:focus{outline:none;}
         </details>
       </div>
 
+      <!-- live since task 1003042: the teardown control, for a project in ANY
+           state that still holds something. The server used to refuse a
+           'requested' or an 'error' project outright — and force-teardown reused
+           the same guard — so a snagged project had no way out of its owner's
+           list at all (walk finding N5). This section is built for that case as
+           much as for a healthy one, which is why it asks for the project's own
+           name typed back: it is the only control on this page that ends
+           something, and the card's one-click confirm is too light for it. -->
       <div class="card" id="mDelete">
         <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">Delete the project</h2>
-        <div class="empty"><p>Deleting a project from this page isn’t wired up yet. A running project can still be torn down from its card under <a href="?view=mine" data-nav-to="mine">Your projects</a> — that stops the server and keeps your repository.</p></div>
+        <div id="mDel"><p class="finePrint">Reading the project…</p></div>
+        <!-- the teardown-vs-delete distinction, stated once as a SIBLING of the
+             volatile slot (the #mRepoVisWhy shape) so no re-render can drop it.
+             Nothing on this page erases a project, and the copy says so rather
+             than letting the word "Delete" imply it. -->
+        <details class="finePrint" id="mDelWhat">
+          <summary>What this removes — and what it keeps</summary>
+          <p>Tearing down stops the project’s server and its nightly backups. It does <b>not</b> erase the project: it stays in your list marked <b>torn down</b> so you can bring it back, your repository on GitHub is untouched, and its database and existing backups are kept on purpose. There is no permanent-delete button — clearing a project’s database for good, and freeing its web address for another project, are done by hand today.</p>
+        </details>
       </div>
     </section>
   </div>
@@ -3522,11 +3538,15 @@ h1[tabindex="-1"]:focus{outline:none;}
     return chipMarkup('', inst.status);
   }
 
-  /* client mirror of provisioning.TEARDOWN_FROM minus tearing_down (already
-     going); no button either while a teardown intent is already queued */
+  /* client mirror of provisioning.TEARDOWN_FROM — every state EXCEPT torn_down
+     (nothing left to release), minus tearing_down (already going) and minus a
+     teardown that is already queued. It used to list only provisioning+active,
+     which is how a snagged project ended up with no way out of the owner's list
+     at all: its only button was "Try again" (walk finding N5, task 1003042). */
   function canTeardown(inst) {
     if (inst.open_intent && inst.open_intent.action === 'teardown') return false;
-    return inst.status === 'provisioning' || inst.status === 'active';
+    if (inst.status === 'tearing_down' || inst.status === 'torn_down') return false;
+    return true;
   }
   /* client mirror of provisioning.DOMAIN_ATTACH_FROM */
   /* the platform-assigned <slug>.<apex> for this instance, from the server-stamped
@@ -3651,9 +3671,16 @@ h1[tabindex="-1"]:focus{outline:none;}
      retention is deliberate on shared boxes; a dedicated machine takes its
      database with it). Copy follows the runner, never the other way around. */
   function teardownTruth(inst) {
+    /* the address line is NOT decoration: teardown has no DNS or Caddy leg, so
+       the hostname keeps resolving and serves an error page rather than going
+       quiet. The old copy promised the address goes silent, which was simply
+       untrue — and the rule above is that copy follows the runner. Releasing the
+       address is tracked separately (task 1002897); until then "reserved" is
+       both the honest word and the accurate one, since a revive re-uses exactly
+       this hostname. */
     return inst && inst.hosting_shape === 'dedicated'
-      ? 'This project has a machine to itself, so the machine goes away and its database goes with it. Your repository is untouched.'
-      : 'The server goes away and the address stops answering. Your repository is untouched. The database is kept, so bringing it back later restores its memory.';
+      ? 'This project has a machine to itself, so the machine goes away and its database goes with it. Your repository is untouched. Its web address stays reserved for this project and shows an error page until you bring it back.'
+      : 'The server goes away. Your repository is untouched. The database is kept, so bringing it back later restores its memory. Its web address stays reserved for this project and shows an error page until you bring it back.';
   }
 
   function addressRow(inst) {
@@ -3924,6 +3951,10 @@ h1[tabindex="-1"]:focus{outline:none;}
     /* a fact with no answer hides — never a dash (the card rule) */
     $('mCreated').textContent = inst.created_at ? 'Created ' + listedDate(inst.created_at) : '';
     $('mCreated').hidden = !inst.created_at;
+    /* fetch-free like everything else here, so the once-a-minute tick may call
+       it: the delete section reads only status + open_intent, both already in
+       hand, and a queued teardown must show up without a reload */
+    renderDelete(inst);
   }
 
   function loadManage(quiet) {
@@ -4093,6 +4124,113 @@ h1[tabindex="-1"]:focus{outline:none;}
     if (t.hasAttribute('data-repo-public-no')) { if (manageRepo) renderRepoVis(manageRepo); }
   });
 
+  /* ── delete the project (task 1003042): the manage page's teardown control.
+     It renders from status + open_intent only — no second request — so the
+     minute tick can repaint it and a queued teardown appears without a reload.
+     Every outcome the server can answer is SAID here, refusals included: the
+     1002691/1002692 rule, and the reason this section exists at all. ── */
+
+  /* the SLUG whose confirmation is open, or null — not a bare boolean: a flag
+     would also suppress the repaint after navigating to a DIFFERENT project,
+     leaving one project's confirm prompt on screen while the act below is bound
+     to another. Keyed by slug, a different project always repaints. */
+  var mDelAsking = null;
+
+  function delMsg(html) { $('mDel').innerHTML = html; }
+
+  function renderDelete(inst) {
+    if (mDelAsking && mDelAsking === inst.slug) return; /* keep THIS project's open confirmation */
+    if (inst.status === 'torn_down') {
+      delMsg('<div class="addr">This project is already torn down — its server is stopped.</div>' +
+        '<p class="finePrint">Its repository, its database and its web address are all still here. ' +
+        'Bring it back any time from <a href="?view=mine" data-nav-to="mine">your projects</a>.</p>');
+      return;
+    }
+    if (inst.status === 'tearing_down') {
+      delMsg('<div class="addr">This project is being torn down right now.</div>' +
+        '<p class="finePrint">This page updates when it lands.</p>');
+      return;
+    }
+    if (inst.open_intent && inst.open_intent.action === 'teardown') {
+      delMsg('<div class="addr">A teardown is queued for this project.</div>' +
+        '<p class="finePrint">This page updates when it starts.</p>');
+      return;
+    }
+    /* a project that never finished standing up still reaches here — that is
+       the whole point of the widened gate; the consequence copy is the same */
+    delMsg('<p class="plain">' + teardownTruth(inst) + '</p>' +
+      '<div class="actions"><button type="button" class="btn small danger" data-del-ask>Tear it down</button></div>');
+  }
+
+  /* the project's own name, typed back — a second click is the card's bar, and
+     this control ends a whole project rather than one setting */
+  function askDelete() {
+    var inst = manageInst;
+    if (!inst) return;
+    mDelAsking = inst.slug;
+    delMsg('<div class="confirmRow"><span class="plain">Tear down <b>' + esc(inst.slug) + '</b>? ' +
+      teardownTruth(inst) + ' Type the project’s name to confirm.</span></div>' +
+      '<div class="attach">' +
+      '<input type="text" id="mDelName" autocomplete="off" spellcheck="false" maxlength="40" ' +
+      'aria-label="Type the project name to confirm" placeholder="' + esc(inst.slug) + '">' +
+      '<button type="button" class="btn small danger" data-del-yes disabled>Yes, tear it down</button>' +
+      '<button type="button" class="linklike" data-del-no>Keep it</button></div>');
+    var field = $('mDelName');
+    if (field) field.focus();
+  }
+
+  function delTypedMatches() {
+    var field = $('mDelName');
+    return !!(field && manageInst && field.value.trim() === manageInst.slug);
+  }
+
+  function doDelete() {
+    var inst = manageInst;
+    /* the typed name is this page's own gate, never the server's — so a click
+       on a button that only LOOKS enabled cannot act */
+    if (!inst || !delTypedMatches()) return;
+    mDelAsking = null;
+    delMsg('<p class="finePrint">Asking…</p>');
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(inst.id) + '/teardown', {
+      method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' }, body: '{}'
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) {
+          var note = esc(data.message || 'Teardown requested.');
+          if (data.superseded) note += ' (A stale standup request was cleared to make room.)';
+          delMsg('<div class="projMsg ok">' + note + '</div>');
+          loadManage(true); /* the status and intent this page renders just changed */
+          return;
+        }
+        /* the still-true state first, then exactly what the server said */
+        renderDelete(inst);
+        $('mDel').insertAdjacentHTML('beforeend',
+          res.status === 401
+            ? '<div class="projMsg err">' + signInAgain() + '</div>'
+            : '<div class="projMsg err">' + esc(apiError(data, res.status).message ||
+                'The teardown could not be queued — try again in a moment.') + '</div>');
+      });
+    }).catch(function () {
+      renderDelete(inst);
+      $('mDel').insertAdjacentHTML('beforeend',
+        '<div class="projMsg err">Couldn’t reach the platform — check your connection and try again.</div>');
+    });
+  }
+
+  $('mDel').addEventListener('input', function (ev) {
+    if (!ev.target || ev.target.id !== 'mDelName') return;
+    var yes = $('mDel').querySelector('[data-del-yes]');
+    if (yes) yes.disabled = !delTypedMatches();
+  });
+
+  $('mDel').addEventListener('click', function (ev) {
+    var t = ev.target.closest && ev.target.closest('button');
+    if (!t) return;
+    if (t.hasAttribute('data-del-ask')) return askDelete();
+    if (t.hasAttribute('data-del-yes')) return doDelete();
+    if (t.hasAttribute('data-del-no')) { mDelAsking = null; if (manageInst) renderDelete(manageInst); }
+  });
+
   /* ── teardown: ask, confirm (the truth, itemized — direction §5.4), then
      SAY exactly what the server said ── */
 

package/scripts/gds/copy-inventory.js

@@ -40,14 +40,18 @@ const path = require('node:path');
 const crypto = require('node:crypto');
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
-const REGISTRY_REL = path.join('docs', 'copy-registry.json');
-const REPORT_REL = path.join('docs', 'copy-inventory.md');
+// Repo-relative paths that end up INSIDE the checked-in artifacts are joined with
+// '/', never path.join: CI compares the committed bytes, so a Windows run baking
+// 'modules\hall-ui\public' in would rewrite ~1600 lines and never match again.
+// (fs still resolves forward slashes on Windows, so reads are unaffected.)
+const REGISTRY_REL = 'docs/copy-registry.json';
+const REPORT_REL = 'docs/copy-inventory.md';
 
 // The surfaces this tool knows how to read. `id` is the contract-shaped surface
 // name; `at` is where it REALLY lives. Adding a surface is a data edit — the point.
 const SURFACES = [
-  { id: 'builders-hall', kind: 'dir', at: path.join('modules', 'hall-ui', 'public'), exts: ['.html', '.js'] },
-  { id: 'status-dashboard', kind: 'dir', at: path.join('modules', 'status-ui', 'public'), exts: ['.html', '.js'] },
+  { id: 'builders-hall', kind: 'dir', at: 'modules/hall-ui/public', exts: ['.html', '.js'] },
+  { id: 'status-dashboard', kind: 'dir', at: 'modules/status-ui/public', exts: ['.html', '.js'] },
   // THE LANDING SURFACE IS public-landing/, NOT src/platform-server.js. The first
   // cut pointed here at the server file, which only fs.readFileSync's these
   // templates — so its JS patterns matched a handful of incidental literals and the
@@ -255,7 +259,7 @@ function filesFor(surface, { fsImpl = fs } = {}) {
   return fsImpl.readdirSync(abs)
     .filter((n) => surface.exts.includes(path.extname(n)))
     .sort()
-    .map((n) => path.join(surface.at, n));
+    .map((n) => `${surface.at}/${n}`);
 }
 
 function buildRegistry() {

package/scripts/gds/provision.js

@@ -2049,10 +2049,10 @@ async function teardownInstance(inst, deps) {
     boxExec(`${sudoP}systemctl disable --now ${backupUnitName(inst)}.timer`, { allowFail: true });
     boxExec(`${sudoP}rm -f ${backupServicePath(inst)} ${backupTimerPath(inst)}`, { allowFail: true });
     boxExec(`${sudoP}systemctl daemon-reload`, { allowFail: true });
-    // DB + Caddy block + backup dumps are left for an explicit operator (data is
-    // precious; a teardown should not silently dropdb or delete backups). Log the
-    // manual follow-ups.
-    log(`  (left for the operator: dropdb ${dbName(inst)}, remove the Caddy block for ${inst.slug}, prune ${CONFIG.backupDir}/${dbName(inst)}-*.sql.gz)`);
+    // Left for an operator (data is precious), naming ONLY what this row created —
+    // teardown now takes 'requested'/'error'. `port` + `domain` stay held: ADR 0181.
+    const dumps = inst.db_name ? [`dropdb ${dbName(inst)}`, `prune ${CONFIG.backupDir}/${dbName(inst)}-*.sql.gz`] : [];
+    log(`  (left for the operator: ${dumps.concat([`remove the Caddy block for ${inst.slug} if one was written`]).join(', ')})`);
   } else if (apply && deps.doApi && inst.droplet_id) {
     await deps.doApi.deleteDroplet(inst.droplet_id);
   }

package/src/module-api.js

@@ -947,8 +947,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.258 with no explicit bump. run 32286866098. (task 1002620)
 //   1.19.260 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.259 with no explicit bump. run 32289043893. (task 1002620)
+//   1.19.261 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.260 with no explicit bump. run 32295699354. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.260'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.261'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub.mjs

@@ -1052,3 +1052,70 @@ test('making a repo public asks first — exposure is never one accidental click
   assert.match(SCRIPT, /data-repo-public-yes/, 'the confirm is a distinct second click');
   assert.match(SCRIPT, /data-repo-public-no/, 'and declining is offered, not implied');
 });
+
+/* ── the delete section (task 1003042, walk finding N5) ─────────────────── */
+
+test('the delete section is live markup with its body slot (C7)', () => {
+  assert.match(HUB, /id="mDel"/, 'the volatile slot is real markup, not JS-built');
+  assert.match(HUB, /id="mDelWhat"/, 'the teardown-vs-delete fold ships with the page');
+  // the fold is a SIBLING of the volatile slot, so no re-render can drop it
+  const card = (HUB.match(/<div class="card" id="mDelete">[\s\S]*?\n      <\/div>/) || [''])[0];
+  assert.ok(card, 'the delete card must be extractable');
+  const slotAt = card.indexOf('id="mDel"');
+  const foldAt = card.indexOf('id="mDelWhat"');
+  assert.ok(slotAt > 0 && foldAt > slotAt, 'the fold sits outside the slot it must survive');
+  assert.doesNotMatch(card, /isn’t wired up/, 'the placeholder copy is gone — the section is real now');
+});
+
+test('"delete" never claims to erase — the fold states what is kept', () => {
+  const fold = (HUB.match(/<details class="finePrint" id="mDelWhat">[\s\S]*?<\/details>/) || [''])[0];
+  assert.ok(fold, 'the fold must be extractable');
+  assert.match(fold, /does <b>not<\/b> erase the project/i, 'the distinction is stated, not implied');
+  assert.match(fold, /torn down/, 'it names the state the project actually lands in');
+  assert.match(fold, /repository on GitHub is untouched/, 'and what survives');
+  assert.match(fold, /no permanent-delete button/i, 'the absent capability is admitted, not faked');
+});
+
+test('tearing a project down asks for its NAME — the page\'s heaviest control', () => {
+  const fn = (SCRIPT.match(/function askDelete\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'askDelete() must be extractable');
+  assert.match(fn, /Type the project’s name to confirm/, 'the ask is stated in plain words');
+  assert.match(fn, /teardownTruth\(inst\)/, 'and carries the consequence, from the one truth site');
+  assert.match(fn, /id="mDelName"/, 'a typed confirmation, not just a second click');
+  assert.match(fn, /data-del-yes disabled/, 'the act is unreachable until the name matches');
+  assert.match(SCRIPT, /data-del-no/, 'declining is offered, not implied');
+  // the typed value is re-checked at act time — an enabled-LOOKING button cannot act
+  const doFn = (SCRIPT.match(/function doDelete\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(doFn, /if \(!inst \|\| !delTypedMatches\(\)\) return;/,
+    'the guard is re-evaluated on the click, never trusted from the disabled attribute');
+});
+
+test('the delete section mirrors the server gate — every state but torn_down', () => {
+  const fn = (SCRIPT.match(/function canTeardown\(inst\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'canTeardown() must be extractable');
+  // the old whitelist is what made a snagged project a dead end (N5)
+  assert.doesNotMatch(fn, /inst\.status === 'provisioning' \|\| inst\.status === 'active'/,
+    'the two-state whitelist is gone');
+  assert.match(fn, /torn_down/, 'torn_down is the only lifecycle exclusion');
+  const render = (SCRIPT.match(/function renderDelete\(inst\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(render, 'renderDelete() must be extractable');
+  // keyed by PROJECT, not a bare flag: a boolean would also suppress the repaint
+  // after navigating to a DIFFERENT project, leaving one project's confirm prompt
+  // on screen while the act is bound to another
+  assert.match(render, /if \(mDelAsking && mDelAsking === inst\.slug\) return;/,
+    'the minute tick must never repaint over a half-typed confirmation, and the guard is project-scoped');
+  for (const s of ['torn_down', 'tearing_down']) {
+    assert.match(render, new RegExp(s), `${s} gets its own honest state, not the action`);
+  }
+});
+
+test('a teardown does not silence the address — the copy says what the runner does', () => {
+  const fn = (SCRIPT.match(/function teardownTruth\(inst\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'teardownTruth() must be extractable');
+  // the runner has NO DNS or Caddy leg, so the hostname keeps resolving and 502s
+  assert.doesNotMatch(fn, /the address stops answering/,
+    'the old claim was untrue — teardown releases neither the DNS record nor the Caddy block');
+  assert.match(fn, /stays reserved for this project/,
+    'the honest word, and the accurate one — a revive re-uses exactly this hostname');
+  assert.match(fn, /repository is untouched/, 'what survives is still stated in both shapes');
+});

package/tests/provisioning_teardown_states.mjs

@@ -0,0 +1,176 @@
+// tests/provisioning_teardown_states.mjs
+//
+// The teardown STATE gate (task 1003042, walk finding N5). Sibling of
+// provisioning_teardown_intent.mjs, which covers the intent-collision mapping;
+// this file covers which STATES may be torn down at all, and how the one
+// remaining refusal reads.
+//
+// The bug: TEARDOWN_FROM was a hand-kept whitelist, ['provisioning','active',
+// 'tearing_down'], that silently omitted 'requested' and 'error'. Because the
+// archon force-teardown route reuses the SAME set, there was no path — owner or
+// archon — to remove a snagged project, so errored rows accumulated forever
+// (instance 15 'swag' from 2026-08-07). Two things are pinned here:
+//
+//   • the set is DERIVED from INSTANCE_STATES minus 'torn_down', so a future
+//     state is teardownable by default and cannot be silently excluded again;
+//   • the surviving refusal is a plain SENTENCE on BOTH routes. force-teardown
+//     used the positional res.fail(code, 409, details) form with no message,
+//     and envelope()'s `message || code` fallback then put the bare string
+//     "not_teardownable" on the wire as the human text (§5.1's plain-sentence
+//     rule). This test mounts the REAL attachFail, not a shim, so that exact
+//     regression is caught on the wire and not merely in the call shape.
+//
+// DB-free: the pool is never queried — the data-access fns the routes need are
+// stubbed on the cached module object (the provisioning_teardown_intent.mjs
+// pattern). No network beyond a loopback listener.
+//
+// Run:  node tests/provisioning_teardown_states.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ── the constant itself ──────────────────────────────────────────────────────
+
+console.log('TEARDOWN_FROM — every state except the one with nothing left:');
+
+t('every INSTANCE_STATE except torn_down may be torn down', () => {
+  for (const s of provisioning.INSTANCE_STATES) {
+    assert.equal(provisioning.TEARDOWN_FROM.has(s), s !== 'torn_down',
+      `${s} should ${s === 'torn_down' ? 'NOT ' : ''}be teardownable`);
+  }
+});
+
+t("'requested' and 'error' are IN — the two the old whitelist dropped (N5)", () => {
+  assert.equal(provisioning.TEARDOWN_FROM.has('requested'), true);
+  assert.equal(provisioning.TEARDOWN_FROM.has('error'), true);
+});
+
+t('the set is derived, not hand-listed — size tracks INSTANCE_STATES', () => {
+  assert.equal(provisioning.TEARDOWN_FROM.size, provisioning.INSTANCE_STATES.length - 1,
+    'a state added to INSTANCE_STATES must be teardownable by default, never silently excluded');
+});
+
+// ── the routes, over a real mounted router + the REAL error envelope ─────────
+
+let currentStatus = 'active';
+let teardownCalls = [];
+provisioning.getInstanceById = async (_db, id) =>
+  ({ id, owner_builder_id: 7, slug: 'swag', status: currentStatus });
+provisioning.enqueueTeardown = async (_db, id, requestedBy) => {
+  teardownCalls.push({ id, requestedBy, status: currentStatus });
+  return { intent: { action: 'teardown', state: 'pending' }, created: true, superseded: false };
+};
+provisioning.recordEvent = async () => {};
+
+const api = require('../src/module-api.js');
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner', rank: 'archon' }; next(); };
+api.requirePermission = () => (_req, _res, next) => next();
+
+const express = require('express');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
+const app = express();
+app.use(express.json());
+app.use(attachFail);   // the REAL envelope — a shim would hide the bare-code bug
+app.use('/api/bongos', provisioningRoutes());
+
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function post(path) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(`${base}${path}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': 2 },
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end('{}');
+  });
+}
+
+const OWNER = '/provisioning/instances/15/teardown';
+const FORCE = '/provisioning/instances/15/force-teardown';
+
+console.log('\nEvery non-torn-down state is accepted — on BOTH routes:');
+
+for (const state of ['requested', 'provisioning', 'active', 'tearing_down', 'error']) {
+  await ta(`owner teardown queues from '${state}'`, async () => {
+    currentStatus = state; teardownCalls = [];
+    const res = await post(OWNER);
+    assert.equal(res.status, 200, res.raw);
+    assert.equal(res.body.queued, true);
+    assert.equal(teardownCalls.length, 1, 'the intent was actually enqueued');
+  });
+  await ta(`force-teardown queues from '${state}'`, async () => {
+    currentStatus = state; teardownCalls = [];
+    const res = await post(FORCE);
+    assert.equal(res.status, 200, res.raw);
+    assert.equal(res.body.queued, true);
+    assert.equal(teardownCalls.length, 1);
+  });
+}
+
+await ta("the live repro: instance 15 'swag' sat at 'error' and could not be removed by ANYONE", async () => {
+  currentStatus = 'error';
+  teardownCalls = [];
+  const owner = await post(OWNER);
+  const force = await post(FORCE);
+  assert.equal(owner.status, 200, `owner teardown: ${owner.raw}`);
+  assert.equal(force.status, 200, `force-teardown: ${force.raw}`);
+  assert.equal(teardownCalls.length, 2, 'both roles now have a real path out');
+});
+
+console.log("\nOnly 'torn_down' still refuses — and it refuses in a sentence:");
+
+for (const [label, path] of [['owner teardown', OWNER], ['force-teardown', FORCE]]) {
+  await ta(`${label} refuses a torn-down project with 409 not_teardownable`, async () => {
+    currentStatus = 'torn_down'; teardownCalls = [];
+    const res = await post(path);
+    assert.equal(res.status, 409, res.raw);
+    assert.equal(res.body.error.code, 'not_teardownable');
+    assert.equal(res.body.error.details.status, 'torn_down', 'the real state is named');
+    assert.equal(teardownCalls.length, 0, 'nothing was enqueued');
+  });
+
+  await ta(`${label}'s message is a plain sentence, never the bare code (the N5 §5.1 violation)`, async () => {
+    currentStatus = 'torn_down';
+    const res = await post(path);
+    const m = String(res.body.error.message || '');
+    assert.notEqual(m, 'not_teardownable', 'the bare code must never be the human text');
+    assert.doesNotMatch(m, /_/, 'no snake_case identifier leaks into owner-facing copy');
+    assert.ok(/\s/.test(m) && /\.$/.test(m), `a real sentence, got: ${JSON.stringify(m)}`);
+    assert.match(m, /torn down/i, 'it says what is actually true of the project');
+  });
+}
+
+await ta('both routes give the SAME refusal — the copies cannot drift again', async () => {
+  currentStatus = 'torn_down';
+  const owner = await post(OWNER);
+  const force = await post(FORCE);
+  assert.equal(owner.body.error.message, force.body.error.message);
+  assert.equal(owner.status, force.status);
+});
+
+server.close();
+
+console.log(`\nprovisioning_teardown_states: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);