@bongos/core 1.19.59 → 1.19.61

package/modules/provisioning/routes/provisioning.js

@@ -271,16 +271,22 @@ module.exports = function provisioningRoutes() {
       if (!provisioning.TEARDOWN_FROM.has(inst.status)) {
         return res.fail('not_teardownable', 409, { status: inst.status });
       }
-      const { created } = await provisioning.enqueueIntent(pool, id, 'teardown', `api:archon:${req.builder.id}`);
-      if (created) {
+      // Same truthful outcome mapping as the owner's teardown (task 1002691).
+      const r = await provisioning.enqueueTeardown(pool, id, `api:archon:${req.builder.id}`);
+      if (r.conflict) {
+        return res.fail('intent_conflict', { status: 409,
+          message: `A '${r.intent.action}' run is currently ${r.intent.state} for this instance — the teardown could not be queued; retry in a moment.`,
+          details: { action: r.intent.action, state: r.intent.state } });
+      }
+      if (r.created) {
         await provisioning.recordEvent(pool, {
           instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'teardown',
-          detail: `force-teardown by archon ${req.builder.github_login || req.builder.id}`,
+          detail: `force-teardown by archon ${req.builder.github_login || req.builder.id}${r.superseded ? ' (superseded a stale provision intent)' : ''}`,
           actor: `api:archon:${req.builder.id}`,
         }).catch(() => {});
       }
-      res.json({ ok: true, queued: created, action: 'teardown', status: inst.status,
-        message: created ? 'The instance will be torn down shortly.' : 'A teardown is already queued for that instance.' });
+      res.json({ ok: true, queued: r.created, action: 'teardown', status: inst.status, superseded: r.superseded,
+        message: r.created ? 'The instance will be torn down shortly.' : 'A teardown is already queued for that instance.' });
     } catch (err) {
       console.error('[provisioning] POST /provisioning/instances/:id/force-teardown', err);
       res.fail('teardown_failed', { status: 500, message: 'internal error' });
@@ -338,8 +344,16 @@ module.exports = function provisioningRoutes() {
       if (!created && String(instance.owner_builder_id) !== String(req.builder.id)) {
         return res.fail('slug_taken', { status: 409, message: 'That instance slug is already in use.' });
       }
-      // Enqueue the provision intent (idempotent: an already-open intent is returned).
-      const { intent, created: intentCreated } = await provisioning.enqueueIntent(pool, instance.id, 'provision', 'api:self');
+      // Enqueue the provision intent (idempotent: an already-open intent is returned)
+      // — but ONLY when the instance actually needs standing up. Blindly enqueueing on
+      // a re-request of an ACTIVE instance left a stale open provision intent that then
+      // blocked the owner's teardown on the action-blind open-intent index (task 1002691).
+      let intent = null, intentCreated = false;
+      if (created || provisioning.PROVISION_ENQUEUE_FROM.has(instance.status)) {
+        ({ intent, created: intentCreated } = await provisioning.enqueueIntent(pool, instance.id, 'provision', 'api:self'));
+      } else {
+        intent = await provisioning.getOpenIntent(pool, instance.id);
+      }
       if (created) {
         await provisioning.recordEvent(pool, {
           instanceId: instance.id, ownerBuilderId: req.builder.id, event: 'request',
@@ -347,11 +361,24 @@ module.exports = function provisioningRoutes() {
           actor: 'api:self',
         }).catch(() => {});
       }
+      // A re-request cannot change an existing instance's domain — SAY so instead of
+      // silently dropping it (task 1002692); the domain route is the real path.
+      let domainIgnored;
+      if (!created && body.domain) {
+        const asked = provisioning.normalizeHostname(body.domain);
+        if (asked && asked !== provisioning.normalizeHostname(instance.domain)) {
+          domainIgnored = {
+            requested: asked, current: instance.domain || null,
+            hint: `a re-request never changes an existing instance's address — POST /provisioning/instances/${instance.id}/domain instead`,
+          };
+        }
+      }
       res.status(created ? 201 : 200).json({
         instance: provisioning.publicInstance(instance),
         open_intent: intent ? { action: intent.action, state: intent.state } : null,
         queued: intentCreated,
         created,
+        ...(domainIgnored ? { domain_ignored: domainIgnored } : {}),
       });
     } catch (err) {
       console.error('[provisioning] POST /provisioning/instances', err);
@@ -416,21 +443,108 @@ module.exports = function provisioningRoutes() {
       if (!provisioning.TEARDOWN_FROM.has(inst.status)) {
         return res.fail('not_teardownable', { status: 409, message: `Instance is '${inst.status}' — nothing to tear down right now.`, details: { status: inst.status } });
       }
-      const { created } = await provisioning.enqueueIntent(pool, id, 'teardown', 'api:self');
-      if (created) {
+      // enqueueTeardown supersedes a stale pending provision intent and reports each
+      // outcome distinctly, so "already queued" is only ever said when it is TRUE
+      // (task 1002691 — the old blind enqueue lied here and the instance leaked).
+      const r = await provisioning.enqueueTeardown(pool, id, 'api:self');
+      if (r.conflict) {
+        return res.fail('intent_conflict', { status: 409,
+          message: `A '${r.intent.action}' run is currently ${r.intent.state} for this instance — the teardown could not be queued; retry in a moment.`,
+          details: { action: r.intent.action, state: r.intent.state } });
+      }
+      if (r.created) {
         await provisioning.recordEvent(pool, {
           instanceId: id, ownerBuilderId: req.builder.id, event: 'teardown',
-          detail: 'teardown requested by owner', actor: 'api:self',
+          detail: r.superseded ? 'teardown requested by owner (superseded a stale provision intent)' : 'teardown requested by owner',
+          actor: 'api:self',
         }).catch(() => {});
       }
-      res.json({ ok: true, queued: created, action: 'teardown', status: inst.status,
-        message: created ? 'Your instance will be torn down shortly.' : 'A teardown is already queued for that instance.' });
+      res.json({ ok: true, queued: r.created, action: 'teardown', status: inst.status, superseded: r.superseded,
+        message: r.created ? 'Your instance will be torn down shortly.' : 'A teardown is already queued for that instance.' });
     } catch (err) {
       console.error('[provisioning] POST /provisioning/instances/:id/teardown', err);
       res.fail('teardown_failed', { status: 500, message: 'internal error' });
     }
   });
 
+  // POST /provisioning/instances/:id/domain — give the caller's OWN instance its
+  // address (task 1002692, gap 5: no path existed to add a domain after creation).
+  // Validates + records the domain; for an already-ACTIVE instance it also enqueues
+  // a 'domain-attach' intent the control-plane runner drains (web tier holds no
+  // cloud tokens — ADR 0111 §2). A requested/error instance only records it: the
+  // (re)provision run wires the domain itself. Re-pointing an existing address is
+  // out of scope — refuse truthfully. Body: { domain (required) }.
+  router.post('/provisioning/instances/:id/domain', auth.requireBuilder, async (req, res) => {
+    const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
+    if (!id) return;
+    if (validateOrRespond(req, res, { domain: { required: true, type: 'string', maxLength: 253 } })) return;
+    try {
+      const domain = provisioning.normalizeHostname((req.body || {}).domain);
+      if (!domain) {
+        return res.fail('bad_domain', 400, { reason: 'a real multi-label hostname (e.g. myproject.example.com) — no scheme, path, or bare TLD' });
+      }
+      const inst = await provisioning.getInstanceById(pool, id);
+      if (!inst || String(inst.owner_builder_id) !== String(req.builder.id)) {
+        return res.fail('instance_not_found', 404);
+      }
+      const current = provisioning.normalizeHostname(inst.domain);
+      if (current && current === domain) {
+        return res.json({ ok: true, changed: false, queued: false, domain: inst.domain,
+          message: 'This instance already has that address.' });
+      }
+      if (current) {
+        return res.fail('domain_already_set', { status: 409,
+          message: `This instance is already addressed as '${inst.domain}' — re-pointing an existing address is not supported here.`,
+          details: { current: inst.domain } });
+      }
+      const holder = await provisioning.getInstanceByDomain(pool, domain);
+      if (holder && String(holder.id) !== String(inst.id)) {
+        return res.fail('domain_taken', { status: 409, message: 'That address is already in use by another instance.' });
+      }
+      if (!provisioning.DOMAIN_ATTACH_FROM.has(inst.status)) {
+        return res.fail('domain_not_attachable', { status: 409,
+          message: `Instance is '${inst.status}' — an address can be attached once it settles ('active') or before standup ('requested').`,
+          details: { status: inst.status } });
+      }
+      // Record BEFORE enqueueing: the runner reads the row's domain, so the intent
+      // must never race ahead of the column it wires.
+      await provisioning.updateInstanceDomain(pool, id, domain);
+      let queued = false;
+      if (inst.status === 'active') {
+        const { intent, created } = await provisioning.enqueueIntent(pool, id, 'domain-attach', 'api:self');
+        if (!created && intent.action !== 'domain-attach') {
+          // The open slot is held by other work (e.g. a teardown). The address IS
+          // recorded — say exactly what happened and what to do.
+          return res.fail('intent_conflict', { status: 409,
+            message: `The address was recorded, but a '${intent.action}' run is currently ${intent.state} for this instance — re-send this request once it settles to wire the address.`,
+            details: { action: intent.action, state: intent.state, recorded: true } });
+        }
+        queued = created;
+        if (!created) {
+          // an identical attach is already open — idempotent
+          await provisioning.recordEvent(pool, {
+            instanceId: id, ownerBuilderId: req.builder.id, event: 'domain',
+            detail: `domain ${domain} recorded (attach already queued)`, actor: 'api:self',
+          }).catch(() => {});
+          return res.json({ ok: true, changed: true, queued: false, domain,
+            message: 'That address is already being wired for this instance.' });
+        }
+      }
+      await provisioning.recordEvent(pool, {
+        instanceId: id, ownerBuilderId: req.builder.id, event: 'domain',
+        detail: queued ? `domain ${domain} recorded + attach queued` : `domain ${domain} recorded (wired at provision)`,
+        actor: 'api:self',
+      }).catch(() => {});
+      res.json({ ok: true, changed: true, queued, domain,
+        message: queued
+          ? 'Your instance is being wired to its new address — it will answer there shortly.'
+          : 'Address recorded — it will be wired when the instance is provisioned.' });
+    } catch (err) {
+      console.error('[provisioning] POST /provisioning/instances/:id/domain', err);
+      res.fail('domain_attach_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding
   // link for the caller's OWN instance (task 2080, ADR 0133). rank: any authenticated
   // builder (own resource). Returns the pre-filled manifest + the GitHub form-POST target

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.59",
+  "version": "1.19.61",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.59",
+      "version": "1.19.61",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.59",
+  "version": "1.19.61",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision.js

@@ -1510,6 +1510,90 @@ runcmd:
 `;
 }
 
+// ---------------------------------------------------------------------------
+// Attach a late-arriving domain to an ALREADY-ACTIVE instance (task 1002692):
+// re-assert exactly the domain-dependent runbook legs — web.env origins (+ a
+// service RESTART so the process re-reads them), the Cloudflare A-record UPSERT
+// (step 5), the Caddy site snippet (step 6) — then healthz. Expected failures
+// RETURN { ok:false } instead of throwing: the drain loop's catch flips the
+// instance to 'error', which must never happen to a healthy ACTIVE instance
+// over a domain hiccup.
+// ---------------------------------------------------------------------------
+async function domainAttachInstance(inst, deps) {
+  const { db, provisioning, exec, writeFile, log, apply, privileged } = deps;
+  const controlExec = deps.controlExec || exec;
+  // Same box routing as provisionInstance: a standalone runs control-plane-local
+  // (task 2074), so its env/caddy/service live HERE, not on the co-hosting box.
+  const standalone = inst.hosting_shape === 'standalone';
+  const boxExec = standalone ? controlExec : exec;
+  const boxWriteFile = standalone ? (deps.controlWriteFile || writeFile) : writeFile;
+  const sudoP = privileged ? 'sudo ' : '';
+  log(`domain-attach ${inst.slug} (shape=${inst.hosting_shape}, status=${inst.status}, domain=${inst.domain || '-'})`);
+
+  if (!inst.domain) return { ok: false, error: 'no domain recorded on the instance — nothing to wire' };
+  // Pre-active states are the provision run's job; post-active states have nothing
+  // to address. A clean no-op (not an error) so a raced teardown/re-request never
+  // burns the intent's retry budget.
+  if (inst.status !== 'active') {
+    log(`  instance is '${inst.status}' — nothing to wire now (provision owns pre-active domains)`);
+    return { ok: true, noop: true };
+  }
+  if (inst.hosting_shape === 'dedicated') {
+    return { ok: false, error: `domain-attach for a dedicated instance is not automated yet — point an A record for ${inst.domain} at the droplet's IP and reload its Caddy` };
+  }
+
+  // DNS preflight (the task-1980 stance): verify token reach BEFORE touching the box.
+  if (CONFIG.dnsHook && apply) {
+    const scope = await (deps.checkDnsTokenScope || checkDnsTokenScope)(inst.domain);
+    if (!scope.reachable) {
+      return { ok: false, error: `DNS preflight failed for ${inst.domain}: ${scope.reason}. ${scope.guidance}` };
+    }
+    log(`  [preflight] DNS token can reach zone ${scope.zone} ✓`);
+  }
+
+  // The A-record target — the same derivation as provisionInstance step 1.
+  const recordIp = standalone
+    ? (CONFIG.controlPlaneIp || (CONFIG.remoteHost ? null : CONFIG.publicIp))
+    : CONFIG.publicIp;
+
+  log('  [config] re-write per-instance web.env (origins now carry the domain)');
+  boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation: null }), { mode: 0o600, sudo: true });
+  log('  [service] restart to pick up the new origins');
+  boxExec(`${sudoP}systemctl restart ${inst.slug}`);
+
+  // DNS A-record UPSERT — mirrors provisionInstance step 5 (control-plane exec only:
+  // the hook needs the Cloudflare token, which never leaves the control plane).
+  if (CONFIG.dnsHook) {
+    if (!recordIp) {
+      const ipEnvHint = standalone ? 'PROVISION_CONTROL_PLANE_IP (standalone)' : 'PROVISION_PUBLIC_IP (co-tenant)';
+      if (apply) return { ok: false, error: `cannot UPSERT DNS for ${inst.domain}: no target IP — set ${ipEnvHint} in the control-plane box.env` };
+      log(`  [dns] would upsert A ${inst.domain} once the target IP is known (set ${ipEnvHint})`);
+    } else {
+      const dnsEnv = dnsUpsertEnv(inst, { publicIp: recordIp, proxied: standalone });
+      log(`  [dns] upsert A ${inst.domain} -> ${recordIp} (zone ${dnsEnv.CLOUDFLARE_ZONE}, proxied=${dnsEnv.BOX_PROXIED === '1'}) via ${CONFIG.dnsHook}`);
+      controlExec(CONFIG.dnsHook, { env: dnsEnv });
+    }
+  } else {
+    log('  [dns] skipped (BOX_DNS_HOOK unset) — point the A record manually');
+  }
+
+  log('  [caddy] write site snippet + reload');
+  boxWriteFile(caddySnippetPath(inst), caddyBlock(inst), { mode: 0o644, sudo: true });
+  boxExec(`${sudoP}systemctl reload caddy`, { allowFail: true });
+
+  log('  [healthz] verify the instance answers');
+  boxExec(healthzCmd(inst), { allowFail: true });
+
+  if (apply) {
+    await provisioning.recordEvent(db, {
+      instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: 'domain-attached',
+      detail: `domain ${inst.domain} wired (env + DNS + caddy re-asserted)`, actor: 'runner',
+    }).catch(() => {});
+  }
+  log(`  ✓ ${inst.slug} addressed as ${inst.domain}`);
+  return { ok: true };
+}
+
 // ---------------------------------------------------------------------------
 // Teardown one instance (reverse the runbook; idempotent).
 // ---------------------------------------------------------------------------
@@ -1735,9 +1819,13 @@ async function cmdRunIntents(deps) {
     try {
       const inst = await provisioning.getInstanceById(db, intent.instance_id);
       if (!inst) { await provisioning.resolveIntent(db, intent.id, 'error', 'instance row vanished'); errors++; continue; }
-      const result = intent.action === 'provision'
-        ? await provisionInstance(inst, deps)
-        : await teardownInstance(inst, deps);
+      // Dispatch EXPLICITLY per action — an unrecognized action must surface as an
+      // error, never fall through to the destructive teardown leg (task 1002692).
+      let result;
+      if (intent.action === 'provision') result = await provisionInstance(inst, deps);
+      else if (intent.action === 'teardown') result = await teardownInstance(inst, deps);
+      else if (intent.action === 'domain-attach') result = await domainAttachInstance(inst, deps);
+      else result = { ok: false, error: `unknown intent action '${intent.action}' — refusing to guess` };
       if (result && result.ok === false) {
         if (intent.attempts >= MAX_INTENT_ATTEMPTS) await provisioning.resolveIntent(db, intent.id, 'error', result.error || 'op failed');
         else await db.query(`UPDATE provisioning_intents SET state='pending', last_error=$2, updated_at=now() WHERE id=$1`, [intent.id, result.error || 'op failed']);
@@ -1907,7 +1995,7 @@ module.exports = {
   caddyBlock, caddySnippetPath, healthzCmd, dedicatedUserData, nextFreePort,
   // executors + orchestration (injectable deps for tests)
   makeExec, makeWriteFile, allocatePort, boundLocalPorts, provisionInstance, teardownInstance,
-  cmdRunIntents, cmdReconcile, cmdStatus,
+  domainAttachInstance, cmdRunIntents, cmdReconcile, cmdStatus,
   // GitHub App Manifest flow (task 2080, ADR 0133)
   convertManifestCode, placeManifestCreds, drainOAuthManifests, MANIFEST_UA,
   // cross-site identity federation (ADR 0141 §4, task #1002109)

package/src/module-api.js

@@ -545,8 +545,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.57 with no explicit bump. run 31546064883. (task 1002620)
 //   1.19.59 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.58 with no explicit bump. run 31547103265. (task 1002620)
+//   1.19.60 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.59 with no explicit bump. run 31548021746. (task 1002620)
+//   1.19.61 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.60 with no explicit bump. run 31550061440. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.59'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.61'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provision.mjs

@@ -1421,5 +1421,139 @@ await ta('provisionInstance(standalone, hub-configured): still NOT federated —
   });
 });
 
+console.log('\ndomain-attach leg (task 1002692 — give an ACTIVE instance its late-arriving address):');
+
+// Recorder for the attach leg: captures commands (with env), file writes (with
+// bodies), and recorded events. No status writes to capture — domain-attach must
+// never touch the instance lifecycle.
+function attachRecorder({ apply = false } = {}) {
+  const cmds = [], envs = [], writes = [], events = [];
+  const deps = {
+    apply, log: () => {},
+    db: { query: async () => ({ rows: [] }) },
+    provisioning: { recordEvent: async (_db, e) => { events.push(e); } },
+    exec: (cmd, opts = {}) => { cmds.push(cmd); envs.push((opts && opts.env) || null); return { ok: true, stdout: '' }; },
+    writeFile: (p, body) => { writes.push({ path: p, body }); return { ok: true }; },
+    doApi: null,
+    checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
+  };
+  return { deps, cmds, envs, writes, events };
+}
+
+const activeStandalone = {
+  id: 18, slug: 'spike', hosting_shape: 'standalone', status: 'active', owner_builder_id: 7,
+  port: 3010, db_name: 'spike', domain: 'spike.cloudbongos.com', target_ref: 'jaxri/spike-harbor',
+};
+
+await ta('domainAttachInstance(active standalone): env re-write → restart → DNS upsert → caddy → healthz', async () => {
+  const savedPub = P.CONFIG.publicIp, savedHook = P.CONFIG.dnsHook;
+  P.CONFIG.publicIp = '203.0.113.5';
+  P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh';
+  try {
+    const { deps, cmds, envs, writes } = attachRecorder();
+    const r = await P.domainAttachInstance(activeStandalone, deps);
+    assert.equal(r.ok, true);
+    const env = writes.find((w) => /\/spike\/web\.env$/.test(w.path));
+    assert.ok(env, 're-writes web.env');
+    assert.match(env.body, /https:\/\/spike\.cloudbongos\.com/, 'the new address reaches the origins');
+    const joined = cmds.join('\n');
+    assert.match(joined, /systemctl restart spike/, 'RESTART (not reload) so the process re-reads its env');
+    const di = cmds.indexOf('/opt/infra/box-dns-cloudflare.sh');
+    assert.ok(di >= 0, 'DNS hook invoked by path');
+    assert.equal(envs[di].BOX_HOSTNAME, 'spike.cloudbongos.com');
+    assert.equal(envs[di].BOX_PROXIED, '1', 'standalone rides the CF proxy (task 2077)');
+    assert.ok(writes.some((w) => /\/spike\.caddy$/.test(w.path)), 'writes the Caddy site snippet');
+    assert.match(joined, /reload caddy/);
+    assert.match(joined, /healthz/);
+    const idx = (re) => cmds.findIndex((c) => re.test(c));
+    assert.ok(idx(/restart spike/) < idx(/reload caddy/), 'service restart before caddy reload');
+  } finally { P.CONFIG.publicIp = savedPub; P.CONFIG.dnsHook = savedHook; }
+});
+
+await ta('domainAttachInstance: no domain recorded → ok:false, nothing runs', async () => {
+  const { deps, cmds } = attachRecorder();
+  const r = await P.domainAttachInstance({ ...activeStandalone, domain: null }, deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /no domain/i);
+  assert.equal(cmds.length, 0);
+});
+
+await ta('domainAttachInstance: instance no longer active → clean no-op (provision owns pre-active wiring; never burns the retry budget)', async () => {
+  for (const status of ['requested', 'provisioning', 'tearing_down', 'torn_down', 'error']) {
+    const { deps, cmds } = attachRecorder();
+    const r = await P.domainAttachInstance({ ...activeStandalone, status }, deps);
+    assert.equal(r.ok, true, status);
+    assert.equal(r.noop, true, status);
+    assert.equal(cmds.length, 0, `${status}: nothing ran`);
+  }
+});
+
+await ta('domainAttachInstance: dedicated is not automated — ok:false with guidance, box untouched', async () => {
+  const { deps, cmds } = attachRecorder();
+  const r = await P.domainAttachInstance({ ...activeStandalone, hosting_shape: 'dedicated' }, deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /dedicated/);
+  assert.equal(cmds.length, 0);
+});
+
+await ta('domainAttachInstance(--apply): a DNS preflight failure returns ok:false — never THROWS (a throw would flip the ACTIVE instance to error in the drain loop)', async () => {
+  const savedHook = P.CONFIG.dnsHook; P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh';
+  try {
+    const { deps, cmds } = attachRecorder({ apply: true });
+    deps.checkDnsTokenScope = async () => ({ reachable: false, zone: 'z', reason: 'not in scope', guidance: 'widen the token' });
+    const r = await P.domainAttachInstance(activeStandalone, deps);
+    assert.equal(r.ok, false);
+    assert.match(r.error, /preflight.*not in scope/);
+    assert.ok(!cmds.some((c) => /restart/.test(c)), 'stops before touching the service');
+  } finally { P.CONFIG.dnsHook = savedHook; }
+});
+
+await ta('cmdRunIntents (--apply) routes a domain-attach intent to the attach leg and resolves it done', async () => {
+  let claims = 0; const resolved = [];
+  const deps = {
+    apply: true, log: () => {},
+    db: { query: async () => ({ rows: [] }) },
+    provisioning: {
+      claimNextIntent: async () => (claims++ === 0 ? { id: 6, instance_id: 18, action: 'domain-attach', attempts: 1 } : null),
+      getInstanceById: async () => ({ ...activeStandalone }),
+      resolveIntent: async (_db, id, state) => { resolved.push({ id, state }); },
+      setInstanceStatus: async () => {},
+      recordEvent: async () => {},
+      claimNextOAuthManifest: async () => null,
+      resolveOAuthManifest: async () => {},
+    },
+    exec: () => ({ ok: true }), writeFile: () => ({ ok: true }), doApi: null,
+    checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
+  };
+  const r = await P.cmdRunIntents(deps);
+  assert.equal(r.ran, 1);
+  assert.equal(r.ok, 1);
+  assert.deepEqual(resolved, [{ id: 6, state: 'done' }]);
+});
+
+await ta('cmdRunIntents (--apply): an UNKNOWN intent action never falls through to teardown', async () => {
+  let claims = 0; const resolved = []; const cmds = [];
+  const deps = {
+    apply: true, log: () => {},
+    db: { query: async () => ({ rows: [] }) },
+    provisioning: {
+      claimNextIntent: async () => (claims++ === 0 ? { id: 7, instance_id: 18, action: 'oauth-manifest', attempts: P.MAX_INTENT_ATTEMPTS } : null),
+      getInstanceById: async () => ({ ...activeStandalone }),
+      resolveIntent: async (_db, id, state, err) => { resolved.push({ id, state, err }); },
+      setInstanceStatus: async () => {},
+      recordEvent: async () => {},
+      claimNextOAuthManifest: async () => null,
+      resolveOAuthManifest: async () => {},
+    },
+    exec: (c) => { cmds.push(c); return { ok: true }; },
+    writeFile: () => ({ ok: true }), doApi: null,
+  };
+  const r = await P.cmdRunIntents(deps);
+  assert.equal(r.errors, 1, 'surfaced as an error, not silently executed');
+  assert.equal(resolved.length, 1);
+  assert.equal(resolved[0].state, 'error');
+  assert.ok(!cmds.some((c) => /systemctl (stop|disable)/.test(c)), 'no teardown commands ran');
+});
+
 console.log(`\nprovision: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);