@bongos/core 1.19.59 → 1.19.60

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.59",
-  "core_contract": "1.19.59",
-  "source_commit": "e93244fafbe4236b1b90218f03c70c92bfd0becb",
+  "core_version": "1.19.60",
+  "core_contract": "1.19.60",
+  "source_commit": "ce8873473b894cf991da712833f18dc9e5f3f88c",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T23:37:01.674Z",
+  "built_at": "2026-08-11T23:51:23.264Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 291,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1217,
+    "functional_verbatim": 1218,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1529,
-  "tree_sha256": "0f793cd7617fce56439932f68de11239e7639d28e50f8d9ee485ba8a602a5f30",
+  "file_count": 1530,
+  "tree_sha256": "acefccdf8f346aff9dfc425d717f82bc3d87cc5c680d303bd19ffc334dc9b195",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "5c89524ec76f5f5df365a188541d50aa31167ae7920124baf562fb32ad30632c"
+      "sha256": "34b9ebfa393ad892c959bf356c1727188e71c61a8ff9ee0d0eca66433a51614e"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1312,7 +1312,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "0076d08133c342fa905fa90682e606eefa02747d5b11aea9f0bdb3563b293f76"
+      "sha256": "bad0bdd6cdd07d66ed8b3bbc2bb2751ce1d6a0a819bc2d455952f5b0c18cea64"
     },
     {
       "path": "docs/architecture.md",
@@ -3732,7 +3732,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "468557062f75a9a02e3cab53103389d7ecaaede6528b60587e51a71ce9dfecf5"
+      "sha256": "655d7e07f8a50cd12420c67e0cb12ff4f94098e53b218b0985f866b9433e409f"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -3742,7 +3742,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "f48562d5f17e0ea9934b4ca96c84e1ac0fc448819a8fff54227045e52aa98731"
+      "sha256": "c0a1a015e20c446513ae435075379e1c46cfe0e492574ff9f64d9ef39b081e4b"
     },
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
@@ -4032,12 +4032,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f2e15bf06d0e8080e47aeea514dfc26dc267c14a96d32fe805cb240491f0baad"
+      "sha256": "862808e3b9e59ac80baa7bcdda60a08dc8f0f31152750ea99264a5aac24c1140"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c3feb3c561c5bf96e9580673b6995835a0d5674f54f96c8b3109fc304e090556"
+      "sha256": "51b6e2905a863ad6c9d25eecf376a8db1f61ee960e00dd5b12f4d5aefcf36625"
     },
     {
       "path": "public-docs/index.html",
@@ -5657,7 +5657,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a02eb4c1cfa272d700a9776652612143de38566cd86208f059ed1d0fed24934b"
+      "sha256": "dd71e36bfd25965ca6b720f1fdbd94ba47553260915176d693f5246fdaac8d2e"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -7149,6 +7149,11 @@
       "mode": "0000644",
       "sha256": "9a41d64fba3a8cc8ffdbccb0aea363ca6ccb63909cfeefd4bd0b05ebab052403"
     },
+    {
+      "path": "tests/provisioning_teardown_intent.mjs",
+      "mode": "0000644",
+      "sha256": "c5ebacf7e29be4e6afecedf5b8593eef750d497e0c502cfa2be92a89b2cff0a1"
+    },
     {
       "path": "tests/pruned_lockfile_integrity.mjs",
       "mode": "0000644",

package/clients/bongos-client/index.d.ts

@@ -246,10 +246,10 @@ export interface PostOverrideRequestsIdDecideRequest { decision: string; note?:
 export interface PostProjectsInviteRequest { client_id: string; github_login: string }
 export interface PostProjectsRequest { origin: string; name: string; tagline?: string; art_url?: string }
 export interface PostProjectsResponse { project: unknown }
-export interface PostProvisioningInstancesIdForceTeardownResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; message: unknown }
+export interface PostProvisioningInstancesIdForceTeardownResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; superseded: unknown; message: unknown }
 export interface PostProvisioningInstancesIdGithubAppRequest { account?: string }
 export interface PostProvisioningInstancesIdGithubAppResponse { state: unknown; account: unknown; post_url: unknown; personal_url: unknown; org_url: unknown; org_login: unknown; manifest: unknown; redirect_url: unknown; expires_at: unknown }
-export interface PostProvisioningInstancesIdTeardownResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; message: unknown }
+export interface PostProvisioningInstancesIdTeardownResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; superseded: unknown; message: unknown }
 export interface PostProvisioningInstancesRequest { slug: string; target_ref?: string; hosting_shape?: string; domain?: string; tier?: string; onboard_mode?: string }
 export interface PostSearchMarkRequest { chunk_id?: StringifiableId; useful?: unknown }
 export interface PostSearchRequest { expand?: unknown; q?: string; source_kind?: string; limit?: unknown }

package/docs/api/openapi.json

@@ -15637,6 +15637,7 @@
           "queued": {},
           "action": {},
           "status": {},
+          "superseded": {},
           "message": {}
         },
         "required": [
@@ -15644,6 +15645,7 @@
           "queued",
           "action",
           "status",
+          "superseded",
           "message"
         ]
       },
@@ -15691,6 +15693,7 @@
           "queued": {},
           "action": {},
           "status": {},
+          "superseded": {},
           "message": {}
         },
         "required": [
@@ -15698,6 +15701,7 @@
           "queued",
           "action",
           "status",
+          "superseded",
           "message"
         ]
       },

package/modules/provisioning/provisioning.js

@@ -38,6 +38,12 @@ const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest'];
 // Mirrors dev-box canTransition('deprovision', …): a requested/torn_down/error
 // instance has nothing running to tear down via the happy path.
 const TEARDOWN_FROM = new Set(['provisioning', 'active', 'tearing_down']);
+// The states from which (re)enqueueing a 'provision' intent is meaningful. An
+// 'active' instance needs no standup — blindly re-enqueueing one on a slug
+// re-request left a stale open provision intent that then blocked the owner's
+// teardown on the action-blind ux_provisioning_intents_open (task 1002691);
+// 'tearing_down' is mid-reclaim (any open slot belongs to the teardown).
+const PROVISION_ENQUEUE_FROM = new Set(['requested', 'provisioning', 'error', 'torn_down']);
 
 // Monthly cost estimate (USD) for a dedicated droplet tier — VISIBILITY only
 // (ADR 0111 §6), never a bill. A small local table so this module needs no
@@ -350,6 +356,31 @@ async function enqueueIntent(db, instanceId, action, requestedBy) {
   }
 }
 
+// Queue a teardown, superseding a stale PENDING provision intent if one holds the
+// open slot (task 1002691: ux_provisioning_intents_open is action-blind, so the old
+// blind enqueue collided with such an intent and the API falsely said "teardown
+// already queued" — the instance leaked). A pending provision is flipped to 'error'
+// (the state CHECK has no 'superseded'; last_error says why) so the runner never
+// stands it up. A RUNNING provision is mid-flight infra work and is never yanked —
+// the caller gets { conflict: 'open_intent' } with the blocking intent so the route
+// can answer truthfully. Each statement is atomic and the index stays the arbiter:
+// any interleaving with the runner or a concurrent enqueue lands on one of these
+// truthful outcomes.
+async function enqueueTeardown(db, instanceId, requestedBy) {
+  const { rows: superseded } = await db.query(
+    `UPDATE provisioning_intents
+        SET state = 'error', last_error = 'superseded: teardown requested',
+            updated_at = now(), resolved_at = now()
+      WHERE instance_id = $1 AND action = 'provision' AND state = 'pending'
+      RETURNING id`,
+    [instanceId]
+  );
+  const { intent, created } = await enqueueIntent(db, instanceId, 'teardown', requestedBy);
+  if (created) return { intent, created: true, superseded: superseded.length > 0 };
+  if (intent.action === 'teardown') return { intent, created: false, superseded: false };
+  return { intent, created: false, superseded: false, conflict: 'open_intent' };
+}
+
 // The instance's currently-open (pending|running) intent, if any.
 async function getOpenIntent(db, instanceId) {
   const { rows } = await db.query(
@@ -540,7 +571,7 @@ async function costLedger(db, { limit = 500 } = {}) {
 module.exports = {
   // constants
   INSTANCE_STATES, HOSTING_SHAPES, ONBOARD_MODES, INTENT_ACTIONS, TEARDOWN_FROM,
-  TIER_MONTHLY_USD, CERT_ELIGIBLE_STATES,
+  PROVISION_ENQUEUE_FROM, TIER_MONTHLY_USD, CERT_ELIGIBLE_STATES,
   // pure
   isValidSlug, costEstimateUsd, publicInstance, normalizeHostname,
   // pure — GitHub App Manifest flow (task 2080)
@@ -549,7 +580,7 @@ module.exports = {
   isProvisionedHostname,
   getInstanceById, getInstanceBySlug, listInstancesForOwner, listAllInstances,
   createInstance, setInstanceStatus,
-  enqueueIntent, getOpenIntent, claimNextIntent, resolveIntent,
+  enqueueIntent, enqueueTeardown, getOpenIntent, claimNextIntent, resolveIntent,
   recordEvent, instanceStateForSlug, costLedger,
   // data access — GitHub App Manifest attempts (task 2080)
   createOAuthManifest, getOAuthManifestByState, attachManifestCode,

package/modules/provisioning/routes/provisioning.js

@@ -271,16 +271,22 @@ module.exports = function provisioningRoutes() {
       if (!provisioning.TEARDOWN_FROM.has(inst.status)) {
         return res.fail('not_teardownable', 409, { status: inst.status });
       }
-      const { created } = await provisioning.enqueueIntent(pool, id, 'teardown', `api:archon:${req.builder.id}`);
-      if (created) {
+      // Same truthful outcome mapping as the owner's teardown (task 1002691).
+      const r = await provisioning.enqueueTeardown(pool, id, `api:archon:${req.builder.id}`);
+      if (r.conflict) {
+        return res.fail('intent_conflict', { status: 409,
+          message: `A '${r.intent.action}' run is currently ${r.intent.state} for this instance — the teardown could not be queued; retry in a moment.`,
+          details: { action: r.intent.action, state: r.intent.state } });
+      }
+      if (r.created) {
         await provisioning.recordEvent(pool, {
           instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'teardown',
-          detail: `force-teardown by archon ${req.builder.github_login || req.builder.id}`,
+          detail: `force-teardown by archon ${req.builder.github_login || req.builder.id}${r.superseded ? ' (superseded a stale provision intent)' : ''}`,
           actor: `api:archon:${req.builder.id}`,
         }).catch(() => {});
       }
-      res.json({ ok: true, queued: created, action: 'teardown', status: inst.status,
-        message: created ? 'The instance will be torn down shortly.' : 'A teardown is already queued for that instance.' });
+      res.json({ ok: true, queued: r.created, action: 'teardown', status: inst.status, superseded: r.superseded,
+        message: r.created ? 'The instance will be torn down shortly.' : 'A teardown is already queued for that instance.' });
     } catch (err) {
       console.error('[provisioning] POST /provisioning/instances/:id/force-teardown', err);
       res.fail('teardown_failed', { status: 500, message: 'internal error' });
@@ -338,8 +344,16 @@ module.exports = function provisioningRoutes() {
       if (!created && String(instance.owner_builder_id) !== String(req.builder.id)) {
         return res.fail('slug_taken', { status: 409, message: 'That instance slug is already in use.' });
       }
-      // Enqueue the provision intent (idempotent: an already-open intent is returned).
-      const { intent, created: intentCreated } = await provisioning.enqueueIntent(pool, instance.id, 'provision', 'api:self');
+      // Enqueue the provision intent (idempotent: an already-open intent is returned)
+      // — but ONLY when the instance actually needs standing up. Blindly enqueueing on
+      // a re-request of an ACTIVE instance left a stale open provision intent that then
+      // blocked the owner's teardown on the action-blind open-intent index (task 1002691).
+      let intent = null, intentCreated = false;
+      if (created || provisioning.PROVISION_ENQUEUE_FROM.has(instance.status)) {
+        ({ intent, created: intentCreated } = await provisioning.enqueueIntent(pool, instance.id, 'provision', 'api:self'));
+      } else {
+        intent = await provisioning.getOpenIntent(pool, instance.id);
+      }
       if (created) {
         await provisioning.recordEvent(pool, {
           instanceId: instance.id, ownerBuilderId: req.builder.id, event: 'request',
@@ -416,15 +430,24 @@ module.exports = function provisioningRoutes() {
       if (!provisioning.TEARDOWN_FROM.has(inst.status)) {
         return res.fail('not_teardownable', { status: 409, message: `Instance is '${inst.status}' — nothing to tear down right now.`, details: { status: inst.status } });
       }
-      const { created } = await provisioning.enqueueIntent(pool, id, 'teardown', 'api:self');
-      if (created) {
+      // enqueueTeardown supersedes a stale pending provision intent and reports each
+      // outcome distinctly, so "already queued" is only ever said when it is TRUE
+      // (task 1002691 — the old blind enqueue lied here and the instance leaked).
+      const r = await provisioning.enqueueTeardown(pool, id, 'api:self');
+      if (r.conflict) {
+        return res.fail('intent_conflict', { status: 409,
+          message: `A '${r.intent.action}' run is currently ${r.intent.state} for this instance — the teardown could not be queued; retry in a moment.`,
+          details: { action: r.intent.action, state: r.intent.state } });
+      }
+      if (r.created) {
         await provisioning.recordEvent(pool, {
           instanceId: id, ownerBuilderId: req.builder.id, event: 'teardown',
-          detail: 'teardown requested by owner', actor: 'api:self',
+          detail: r.superseded ? 'teardown requested by owner (superseded a stale provision intent)' : 'teardown requested by owner',
+          actor: 'api:self',
         }).catch(() => {});
       }
-      res.json({ ok: true, queued: created, action: 'teardown', status: inst.status,
-        message: created ? 'Your instance will be torn down shortly.' : 'A teardown is already queued for that instance.' });
+      res.json({ ok: true, queued: r.created, action: 'teardown', status: inst.status, superseded: r.superseded,
+        message: r.created ? 'Your instance will be torn down shortly.' : 'A teardown is already queued for that instance.' });
     } catch (err) {
       console.error('[provisioning] POST /provisioning/instances/:id/teardown', err);
       res.fail('teardown_failed', { status: 500, message: 'internal error' });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.59",
+  "version": "1.19.60",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.59",
+      "version": "1.19.60",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.59",
+  "version": "1.19.60",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -545,8 +545,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.57 with no explicit bump. run 31546064883. (task 1002620)
 //   1.19.59 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.58 with no explicit bump. run 31547103265. (task 1002620)
+//   1.19.60 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.59 with no explicit bump. run 31548021746. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.59'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.60'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provisioning_teardown_intent.mjs

@@ -0,0 +1,267 @@
+// tests/provisioning_teardown_intent.mjs
+//
+// Teardown vs the action-blind open-intent index (task 1002691). Repro'd live on
+// instance 16: POST /instances re-enqueued a 'provision' intent for an ALREADY-ACTIVE
+// instance (created:false), and the owner's later teardown enqueue collided with that
+// stale open intent on ux_provisioning_intents_open (per-instance, action-blind). The
+// route trusted created:false and answered "A teardown is already queued" — a lie; no
+// teardown was ever recorded and the instance leaked.
+//
+// Covers both layers of the fix:
+//   • enqueueTeardown        — supersedes a stale PENDING provision intent, never yanks
+//                              a RUNNING one, and reports each outcome distinctly
+//                              (fake db that ENFORCES the unique index, so the collision
+//                              is reproduced faithfully)
+//   • the teardown routes    — answer truthfully per outcome: "already queued" only when
+//                              the open intent IS a teardown; a mid-flight provision is a
+//                              409 conflict, not a false success
+//   • POST /instances        — stops enqueueing a provision intent for an instance that
+//                              needs no standing up (the enabling misstep)
+//
+// DB-free: the pool is never queried — the data-access fns the routes need are stubbed
+// on the cached module object (the provisioning_onboard_mode.mjs pattern). No network.
+//
+// Run:  node tests/provisioning_teardown_intent.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ── enqueueTeardown: the collision mechanics, against an index-faithful fake ──────
+// A stateful fake of provisioning_intents that ENFORCES ux_provisioning_intents_open
+// (at most ONE open pending|running intent per instance, action-blind) — so the exact
+// collision the bug rode on is reproduced, not approximated. Dispatches on SQL shape.
+function fakeIntentDb(seed = []) {
+  let nextId = 1;
+  const rows = seed.map((r) => ({ id: nextId++, requested_by: null, last_error: null, resolved_at: null, ...r }));
+  const open = (instanceId) => rows.filter((r) =>
+    String(r.instance_id) === String(instanceId) && (r.state === 'pending' || r.state === 'running'));
+  return {
+    rows,
+    query: async (sql, params) => {
+      if (/INSERT INTO provisioning_intents/.test(sql)) {
+        const [instance_id, action, requested_by] = params;
+        if (open(instance_id).length) {
+          throw Object.assign(
+            new Error('duplicate key value violates unique constraint "ux_provisioning_intents_open"'),
+            { code: '23505' });
+        }
+        const row = { id: nextId++, instance_id, action, requested_by, state: 'pending', last_error: null, resolved_at: null };
+        rows.push(row);
+        return { rows: [row] };
+      }
+      if (/UPDATE provisioning_intents/.test(sql) && /state = 'error'/.test(sql)) {
+        // The supersede's guard must live in the SQL itself: pending-only (a running
+        // provision is the runner's mid-flight work) and provision-only (an open
+        // teardown is left alone for the idempotent path).
+        assert.match(sql, /action = 'provision' AND state = 'pending'/);
+        const hit = rows.filter((r) =>
+          String(r.instance_id) === String(params[0]) && r.action === 'provision' && r.state === 'pending');
+        for (const r of hit) { r.state = 'error'; r.last_error = 'superseded: teardown requested'; }
+        return { rows: hit.map((r) => ({ id: r.id })) };
+      }
+      if (/SELECT \* FROM provisioning_intents/.test(sql)) {
+        const o = open(params[0]);
+        return { rows: o.length ? [o[o.length - 1]] : [] };
+      }
+      throw new Error(`fakeIntentDb: unexpected SQL: ${String(sql).slice(0, 80)}`);
+    },
+  };
+}
+
+console.log('enqueueTeardown — teardown vs the action-blind open-intent index (task 1002691):');
+
+await ta('a stale PENDING provision intent is superseded — the teardown actually queues (the leak, fixed)', async () => {
+  const db = fakeIntentDb([{ instance_id: 16, action: 'provision', state: 'pending' }]);
+  const r = await provisioning.enqueueTeardown(db, 16, 'api:self');
+  assert.equal(r.created, true, 'the teardown was queued');
+  assert.equal(r.superseded, true, 'reports that a provision intent was canceled');
+  assert.equal(r.intent.action, 'teardown');
+  assert.equal(r.intent.state, 'pending');
+  const prov = db.rows.find((x) => x.action === 'provision');
+  assert.equal(prov.state, 'error', 'the stale provision intent is closed, not left open');
+  assert.match(prov.last_error, /superseded/);
+});
+
+await ta('a RUNNING provision intent is never yanked — a distinct conflict outcome, not a false "already queued"', async () => {
+  const db = fakeIntentDb([{ instance_id: 16, action: 'provision', state: 'running' }]);
+  const r = await provisioning.enqueueTeardown(db, 16, 'api:self');
+  assert.equal(r.created, false);
+  assert.equal(r.conflict, 'open_intent', 'the route needs a distinct outcome to answer truthfully');
+  assert.equal(r.intent.action, 'provision', 'the blocking intent is surfaced as-is');
+  assert.equal(r.intent.state, 'running', 'still running — the mid-flight work was not canceled');
+  assert.equal(db.rows.filter((x) => x.action === 'teardown').length, 0, 'no teardown row was inserted');
+});
+
+await ta('an already-open TEARDOWN is idempotent — created:false and NO conflict ("already queued" is now true)', async () => {
+  const db = fakeIntentDb([{ instance_id: 16, action: 'teardown', state: 'pending' }]);
+  const r = await provisioning.enqueueTeardown(db, 16, 'api:self');
+  assert.equal(r.created, false);
+  assert.equal(r.conflict, undefined, 'no conflict — this is the one genuine already-queued case');
+  assert.equal(r.intent.action, 'teardown');
+});
+
+await ta('a clean queue just enqueues (no supersede)', async () => {
+  const db = fakeIntentDb([]);
+  const r = await provisioning.enqueueTeardown(db, 16, 'api:archon:1');
+  assert.equal(r.created, true);
+  assert.equal(r.superseded, false);
+  assert.equal(r.intent.action, 'teardown');
+  assert.equal(r.intent.requested_by, 'api:archon:1');
+});
+
+t('PROVISION_ENQUEUE_FROM: an active or tearing-down instance never re-enqueues a provision intent', () => {
+  assert.equal(provisioning.PROVISION_ENQUEUE_FROM.has('active'), false, 'active — the enabling misstep');
+  assert.equal(provisioning.PROVISION_ENQUEUE_FROM.has('tearing_down'), false, 'tearing_down — mid-reclaim');
+  for (const s of ['requested', 'provisioning', 'error', 'torn_down']) {
+    assert.equal(provisioning.PROVISION_ENQUEUE_FROM.has(s), true, `${s} may (re)provision`);
+  }
+});
+
+// ── the routes: truthful responses per outcome, over a real mounted router ────────
+let teardownOutcome = null;   // what the next enqueueTeardown call reports
+let teardownCalls = [];
+let enqueueIntentCalls = [];
+let createResult = null;      // what the next createInstance call reports
+provisioning.getInstanceById = async (_db, id) =>
+  ({ id, owner_builder_id: 7, slug: 'spike', status: 'active' });
+provisioning.enqueueTeardown = async (_db, id, requestedBy) => {
+  teardownCalls.push({ id, requestedBy });
+  return teardownOutcome;
+};
+provisioning.enqueueIntent = async (_db, id, action, requestedBy) => {
+  enqueueIntentCalls.push({ id, action, requestedBy });
+  return { intent: { id: 99, action, state: 'pending' }, created: true };
+};
+provisioning.getOpenIntent = async () => null;
+provisioning.createInstance = async () => createResult;
+provisioning.recordEvent = async () => {};
+
+const api = require('../src/module-api.js');
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
+api.requirePermission = () => (_req, _res, next) => next();
+
+const express = require('express');
+const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(typeof opts === 'object' ? opts : {}), ...(details || {}) } });
+  };
+  next();
+});
+app.use('/api/bongos', provisioningRoutes());
+
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function post(path, body = {}) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}${path}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+console.log('\nPOST /provisioning/instances/:id/teardown — truthful responses:');
+
+await ta('a queued teardown says so (and surfaces that a stale provision was superseded)', async () => {
+  teardownOutcome = { intent: { action: 'teardown', state: 'pending' }, created: true, superseded: true };
+  const res = await post('/provisioning/instances/16/teardown');
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.queued, true);
+  assert.equal(res.body.superseded, true);
+  assert.match(res.body.message, /torn down/);
+});
+
+await ta('"already queued" is said ONLY when the open intent IS a teardown', async () => {
+  teardownOutcome = { intent: { action: 'teardown', state: 'pending' }, created: false, superseded: false };
+  const res = await post('/provisioning/instances/16/teardown');
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.queued, false);
+  assert.match(res.body.message, /already queued/);
+});
+
+await ta('a mid-flight provision is a 409 conflict — never the false "teardown already queued" (the live repro)', async () => {
+  teardownOutcome = { intent: { action: 'provision', state: 'running' }, created: false, superseded: false, conflict: 'open_intent' };
+  const res = await post('/provisioning/instances/16/teardown');
+  assert.equal(res.status, 409, res.raw);
+  assert.equal(res.body.error.code, 'intent_conflict');
+  assert.equal(res.body.error.details.action, 'provision', 'names the real blocker');
+  assert.doesNotMatch(String(res.body.error.message), /already queued/i, 'the old lie is gone');
+});
+
+console.log('\nPOST /provisioning/instances/:id/force-teardown — same truthful mapping (archon):');
+
+await ta('force-teardown surfaces the same 409 conflict instead of a false success', async () => {
+  teardownOutcome = { intent: { action: 'provision', state: 'running' }, created: false, superseded: false, conflict: 'open_intent' };
+  const res = await post('/provisioning/instances/16/force-teardown');
+  assert.equal(res.status, 409, res.raw);
+  assert.equal(res.body.error.code, 'intent_conflict');
+});
+
+await ta('force-teardown queues + reports supersede like the owner route', async () => {
+  teardownOutcome = { intent: { action: 'teardown', state: 'pending' }, created: true, superseded: true };
+  const res = await post('/provisioning/instances/16/force-teardown');
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.queued, true);
+  assert.equal(res.body.superseded, true);
+});
+
+console.log('\nPOST /provisioning/instances — no provision intent for an instance needing no standup:');
+
+await ta('re-requesting an ACTIVE instance does NOT enqueue a provision intent (the enabling misstep, fixed)', async () => {
+  createResult = { instance: { id: 42, owner_builder_id: 7, slug: 'spike', status: 'active' }, created: false };
+  enqueueIntentCalls = [];
+  const res = await post('/provisioning/instances', { slug: 'spike', hosting_shape: 'standalone' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(enqueueIntentCalls.length, 0, 'no provision intent was enqueued');
+  assert.equal(res.body.queued, false);
+  assert.equal(res.body.open_intent, null);
+});
+
+await ta('re-requesting an ERRORED instance still enqueues (the retry path is preserved)', async () => {
+  createResult = { instance: { id: 42, owner_builder_id: 7, slug: 'spike', status: 'error' }, created: false };
+  enqueueIntentCalls = [];
+  const res = await post('/provisioning/instances', { slug: 'spike', hosting_shape: 'standalone' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(enqueueIntentCalls.length, 1, 'the provision retry was enqueued');
+  assert.equal(enqueueIntentCalls[0].action, 'provision');
+});
+
+await ta('a FRESH instance always enqueues its provision intent (unchanged happy path)', async () => {
+  createResult = { instance: { id: 43, owner_builder_id: 7, slug: 'fresh', status: 'requested' }, created: true };
+  enqueueIntentCalls = [];
+  const res = await post('/provisioning/instances', { slug: 'fresh', hosting_shape: 'standalone' });
+  assert.equal(res.status, 201, res.raw);
+  assert.equal(enqueueIntentCalls.length, 1);
+  assert.equal(enqueueIntentCalls[0].action, 'provision');
+});
+
+server.close();
+console.log(`\nprovisioning_teardown_intent: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);