@bongos/core 1.19.59 → 1.19.61

package/tests/provisioning_domain_attach.mjs

@@ -0,0 +1,289 @@
+// tests/provisioning_domain_attach.mjs
+//
+// The domain-attach path (task 1002692, gap 5 of the creation-flow audit / idea
+// 1000677): before this, NO route could give an EXISTING instance its address — a
+// slug re-request silently dropped the domain in the body, and a domainless
+// instance (e.g. Spike Harbor, instance 18) was stuck domainless forever, which
+// also blocked GitHub sign-in (the github-app manifest route 409s without a domain).
+//
+// Covers:
+//   • updateInstanceDomain / getInstanceByDomain — the service slice (recording fakes)
+//   • INTENT_ACTIONS lockstep — 'domain-attach' rides the intent queue (migration 005)
+//   • POST /provisioning/instances/:id/domain — validate + record + enqueue, with
+//     truthful answers for every refusal (bad domain, taken domain, wrong state,
+//     open-intent conflict) — driven over the real mounted router
+//   • POST /provisioning/instances — a slug re-request carrying a domain now SAYS
+//     the domain was ignored instead of silently dropping it
+//   • POST /provisioning/instances/:id/github-app — accepts the newly-addressed
+//     instance (the domain_required 409 clears once a domain is recorded)
+//
+// DB-free: data-access fns are stubbed on the cached module object (the
+// provisioning_onboard_mode.mjs pattern). No network.
+//
+// Run:  node tests/provisioning_domain_attach.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+console.log('service slice — updateInstanceDomain / getInstanceByDomain:');
+
+await ta('updateInstanceDomain: parameterized UPDATE of only the domain (+updated_at), returns the row', async () => {
+  const calls = [];
+  const db = { query: async (sql, params) => {
+    calls.push({ sql, params });
+    return { rows: [{ id: 18, domain: params[1] }] };
+  } };
+  const row = await provisioning.updateInstanceDomain(db, 18, 'spike.cloudbongos.com');
+  assert.equal(row.domain, 'spike.cloudbongos.com');
+  assert.match(calls[0].sql, /UPDATE provisioning_instances/);
+  assert.match(calls[0].sql, /SET domain = \$2, updated_at = now\(\)/, 'touches ONLY the domain column');
+  assert.deepEqual(calls[0].params, [18, 'spike.cloudbongos.com']);
+});
+
+await ta('getInstanceByDomain: case-insensitive exact match, parameterized', async () => {
+  const calls = [];
+  const db = { query: async (sql, params) => {
+    calls.push({ sql, params });
+    return { rows: params[0] === 'spike.cloudbongos.com' ? [{ id: 18 }] : [] };
+  } };
+  const hit = await provisioning.getInstanceByDomain(db, 'SPIKE.cloudbongos.com');
+  assert.equal(hit.id, 18, 'matches regardless of stored/asked case');
+  assert.match(calls[0].sql, /lower\(domain\) = \$1/);
+  assert.equal(await provisioning.getInstanceByDomain(db, 'other.example.com'), null);
+});
+
+t("INTENT_ACTIONS includes 'domain-attach' (lockstep with the provisioning_005 CHECK)", () => {
+  assert.ok(provisioning.INTENT_ACTIONS.includes('domain-attach'));
+});
+
+// ── the routes, over a real mounted router (stubbed data access) ──────────────────
+let instance = null;             // what getInstanceById returns
+let domainHolder = null;         // what getInstanceByDomain returns
+let updateCalls = [];
+let enqueueCalls = [];
+let enqueueResult = null;        // what enqueueIntent reports
+let createResult = null;         // what createInstance reports (re-request tests)
+let manifestRows = [];
+provisioning.getInstanceById = async (_db, id) => (instance ? { ...instance, id } : null);
+provisioning.getInstanceByDomain = async (_db, d) => domainHolder;
+provisioning.updateInstanceDomain = async (_db, id, domain) => {
+  updateCalls.push({ id, domain });
+  instance = { ...instance, domain };
+  return { ...instance, id };
+};
+provisioning.enqueueIntent = async (_db, id, action, requestedBy) => {
+  enqueueCalls.push({ id, action, requestedBy });
+  return enqueueResult || { intent: { id: 9, action, state: 'pending' }, created: true };
+};
+provisioning.getOpenIntent = async () => null;
+provisioning.createInstance = async () => createResult;
+provisioning.recordEvent = async () => {};
+provisioning.createOAuthManifest = async (_db, row) => { manifestRows.push(row); return { id: 1, ...row }; };
+provisioning.getLatestOAuthManifestForInstance = async () => null;
+
+const api = require('../src/module-api.js');
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
+api.requirePermission = () => (_req, _res, next) => next();
+api.branding = () => ({
+  domains: { publicOrigin: 'https://cb.test' },
+  identity: { productName: 'Cloud Bongos' },
+});
+
+const express = require('express');
+const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(typeof opts === 'object' ? opts : {}), ...(details || {}) } });
+  };
+  next();
+});
+app.use('/api/bongos', provisioningRoutes());
+
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function post(path, body = {}) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}${path}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+function reset({ inst } = {}) {
+  instance = inst || null;
+  domainHolder = null;
+  updateCalls = [];
+  enqueueCalls = [];
+  enqueueResult = null;
+  createResult = null;
+  manifestRows = [];
+}
+
+console.log('\nPOST /provisioning/instances/:id/domain — give an existing instance its address:');
+
+await ta('ACTIVE domainless instance: domain is validated, recorded, and a domain-attach intent queues', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'standalone', domain: null } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'Spike.CloudBongos.com.' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.ok, true);
+  assert.equal(res.body.domain, 'spike.cloudbongos.com', 'normalized before storing');
+  assert.deepEqual(updateCalls, [{ id: 18, domain: 'spike.cloudbongos.com' }]);
+  assert.deepEqual(enqueueCalls.map((c) => c.action), ['domain-attach']);
+  assert.equal(res.body.queued, true);
+});
+
+await ta('a malformed domain is refused 400 before anything is written', async () => {
+  for (const bad of ['not a host', 'com', '', '-x.example.com']) {
+    reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: null } });
+    const res = await post('/provisioning/instances/18/domain', { domain: bad });
+    assert.equal(res.status, 400, `${JSON.stringify(bad)}: ${res.raw}`);
+    assert.equal(res.body.error.code, 'bad_domain');
+    assert.equal(updateCalls.length, 0, 'nothing recorded');
+    assert.equal(enqueueCalls.length, 0, 'nothing queued');
+  }
+});
+
+await ta("another instance already holding the domain is a truthful 409 domain_taken (never a silent shadow)", async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: null } });
+  domainHolder = { id: 99, slug: 'other' };
+  const res = await post('/provisioning/instances/18/domain', { domain: 'spike.cloudbongos.com' });
+  assert.equal(res.status, 409, res.raw);
+  assert.equal(res.body.error.code, 'domain_taken');
+  assert.equal(updateCalls.length, 0);
+});
+
+await ta('same domain again is idempotent — 200, changed:false, nothing re-queued', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com' } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'SPIKE.cloudbongos.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.changed, false);
+  assert.equal(updateCalls.length, 0);
+  assert.equal(enqueueCalls.length, 0);
+});
+
+await ta('a DIFFERENT domain already set is a truthful 409 domain_already_set (re-pointing is not this route)', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'old.cloudbongos.com' } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'new.cloudbongos.com' });
+  assert.equal(res.status, 409, res.raw);
+  assert.equal(res.body.error.code, 'domain_already_set');
+  assert.equal(res.body.error.details.current, 'old.cloudbongos.com', 'names the current address');
+  assert.equal(updateCalls.length, 0);
+});
+
+await ta('REQUESTED instance: domain records with NO intent — the provision run wires it', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'fresh', status: 'requested', domain: null } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'fresh.cloudbongos.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.queued, false);
+  assert.deepEqual(updateCalls, [{ id: 18, domain: 'fresh.cloudbongos.com' }]);
+  assert.equal(enqueueCalls.length, 0, 'provision will wire it — no separate intent');
+});
+
+await ta('an instance mid-flight (provisioning / tearing_down / torn_down) is a truthful 409', async () => {
+  for (const status of ['provisioning', 'tearing_down', 'torn_down']) {
+    reset({ inst: { owner_builder_id: 7, slug: 'spike', status, domain: null } });
+    const res = await post('/provisioning/instances/18/domain', { domain: 'spike.cloudbongos.com' });
+    assert.equal(res.status, 409, `${status}: ${res.raw}`);
+    assert.equal(res.body.error.code, 'domain_not_attachable');
+    assert.equal(res.body.error.details.status, status, 'names the real state');
+    assert.equal(updateCalls.length, 0, `${status}: nothing recorded`);
+  }
+});
+
+await ta('an open non-domain intent (e.g. a teardown) is a truthful 409 intent_conflict, not a false success', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: null } });
+  enqueueResult = { intent: { id: 5, action: 'teardown', state: 'pending' }, created: false };
+  const res = await post('/provisioning/instances/18/domain', { domain: 'spike.cloudbongos.com' });
+  assert.equal(res.status, 409, res.raw);
+  assert.equal(res.body.error.code, 'intent_conflict');
+  assert.equal(res.body.error.details.action, 'teardown', 'names the real blocker');
+});
+
+await ta('an already-open domain-attach intent is idempotent — 200 queued:false "already being wired"', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: null } });
+  enqueueResult = { intent: { id: 5, action: 'domain-attach', state: 'pending' }, created: false };
+  const res = await post('/provisioning/instances/18/domain', { domain: 'spike.cloudbongos.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.queued, false);
+  assert.match(res.body.message, /already/i);
+});
+
+await ta('not the owner → 404 (own-scoped; existence not leaked)', async () => {
+  reset({ inst: { owner_builder_id: 42, slug: 'theirs', status: 'active', domain: null } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'x.cloudbongos.com' });
+  assert.equal(res.status, 404, res.raw);
+});
+
+console.log('\nPOST /provisioning/instances — slug re-requests are truthful about the domain:');
+
+await ta('re-request with a domain on an existing instance SAYS the domain was ignored (and where to send it)', async () => {
+  reset();
+  createResult = { instance: { id: 18, owner_builder_id: 7, slug: 'spike', status: 'active', domain: null }, created: false };
+  const res = await post('/provisioning/instances', { slug: 'spike', hosting_shape: 'standalone', domain: 'spike.cloudbongos.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.ok(res.body.domain_ignored, 'the drop is surfaced, not silent');
+  assert.equal(res.body.domain_ignored.requested, 'spike.cloudbongos.com');
+  assert.match(res.body.domain_ignored.hint, /\/domain/, 'points at the domain-attach route');
+});
+
+await ta('re-request with the SAME domain the instance already has → no ignored flag (nothing was dropped)', async () => {
+  reset();
+  createResult = { instance: { id: 18, owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com' }, created: false };
+  const res = await post('/provisioning/instances', { slug: 'spike', hosting_shape: 'standalone', domain: 'spike.cloudbongos.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.domain_ignored, undefined);
+});
+
+await ta('a fresh create with a domain is untouched (the domain is stored at creation — nothing ignored)', async () => {
+  reset();
+  createResult = { instance: { id: 43, owner_builder_id: 7, slug: 'new', status: 'requested', domain: 'new.cloudbongos.com' }, created: true };
+  const res = await post('/provisioning/instances', { slug: 'new', hosting_shape: 'standalone', domain: 'new.cloudbongos.com' });
+  assert.equal(res.status, 201, res.raw);
+  assert.equal(res.body.domain_ignored, undefined);
+});
+
+console.log('\nPOST /provisioning/instances/:id/github-app — accepts the newly-addressed instance:');
+
+await ta('domainless instance still 409s domain_required; once addressed, the manifest mints', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: null } });
+  const before = await post('/provisioning/instances/18/github-app', {});
+  assert.equal(before.status, 409, before.raw);
+  assert.equal(before.body.error.code, 'domain_required');
+
+  instance = { ...instance, domain: 'spike.cloudbongos.com' };
+  const after = await post('/provisioning/instances/18/github-app', {});
+  assert.equal(after.status, 200, after.raw);
+  assert.equal(manifestRows.length, 1, 'a manifest attempt row was recorded');
+  assert.match(after.body.manifest.url, /spike\.cloudbongos\.com/, 'the manifest points at the new address');
+});
+
+server.close();
+console.log(`\nprovisioning_domain_attach: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/provisioning_teardown_intent.mjs

@@ -0,0 +1,267 @@
+// tests/provisioning_teardown_intent.mjs
+//
+// Teardown vs the action-blind open-intent index (task 1002691). Repro'd live on
+// instance 16: POST /instances re-enqueued a 'provision' intent for an ALREADY-ACTIVE
+// instance (created:false), and the owner's later teardown enqueue collided with that
+// stale open intent on ux_provisioning_intents_open (per-instance, action-blind). The
+// route trusted created:false and answered "A teardown is already queued" — a lie; no
+// teardown was ever recorded and the instance leaked.
+//
+// Covers both layers of the fix:
+//   • enqueueTeardown        — supersedes a stale PENDING provision intent, never yanks
+//                              a RUNNING one, and reports each outcome distinctly
+//                              (fake db that ENFORCES the unique index, so the collision
+//                              is reproduced faithfully)
+//   • the teardown routes    — answer truthfully per outcome: "already queued" only when
+//                              the open intent IS a teardown; a mid-flight provision is a
+//                              409 conflict, not a false success
+//   • POST /instances        — stops enqueueing a provision intent for an instance that
+//                              needs no standing up (the enabling misstep)
+//
+// DB-free: the pool is never queried — the data-access fns the routes need are stubbed
+// on the cached module object (the provisioning_onboard_mode.mjs pattern). No network.
+//
+// Run:  node tests/provisioning_teardown_intent.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ── enqueueTeardown: the collision mechanics, against an index-faithful fake ──────
+// A stateful fake of provisioning_intents that ENFORCES ux_provisioning_intents_open
+// (at most ONE open pending|running intent per instance, action-blind) — so the exact
+// collision the bug rode on is reproduced, not approximated. Dispatches on SQL shape.
+function fakeIntentDb(seed = []) {
+  let nextId = 1;
+  const rows = seed.map((r) => ({ id: nextId++, requested_by: null, last_error: null, resolved_at: null, ...r }));
+  const open = (instanceId) => rows.filter((r) =>
+    String(r.instance_id) === String(instanceId) && (r.state === 'pending' || r.state === 'running'));
+  return {
+    rows,
+    query: async (sql, params) => {
+      if (/INSERT INTO provisioning_intents/.test(sql)) {
+        const [instance_id, action, requested_by] = params;
+        if (open(instance_id).length) {
+          throw Object.assign(
+            new Error('duplicate key value violates unique constraint "ux_provisioning_intents_open"'),
+            { code: '23505' });
+        }
+        const row = { id: nextId++, instance_id, action, requested_by, state: 'pending', last_error: null, resolved_at: null };
+        rows.push(row);
+        return { rows: [row] };
+      }
+      if (/UPDATE provisioning_intents/.test(sql) && /state = 'error'/.test(sql)) {
+        // The supersede's guard must live in the SQL itself: pending-only (a running
+        // provision is the runner's mid-flight work) and provision-only (an open
+        // teardown is left alone for the idempotent path).
+        assert.match(sql, /action = 'provision' AND state = 'pending'/);
+        const hit = rows.filter((r) =>
+          String(r.instance_id) === String(params[0]) && r.action === 'provision' && r.state === 'pending');
+        for (const r of hit) { r.state = 'error'; r.last_error = 'superseded: teardown requested'; }
+        return { rows: hit.map((r) => ({ id: r.id })) };
+      }
+      if (/SELECT \* FROM provisioning_intents/.test(sql)) {
+        const o = open(params[0]);
+        return { rows: o.length ? [o[o.length - 1]] : [] };
+      }
+      throw new Error(`fakeIntentDb: unexpected SQL: ${String(sql).slice(0, 80)}`);
+    },
+  };
+}
+
+console.log('enqueueTeardown — teardown vs the action-blind open-intent index (task 1002691):');
+
+await ta('a stale PENDING provision intent is superseded — the teardown actually queues (the leak, fixed)', async () => {
+  const db = fakeIntentDb([{ instance_id: 16, action: 'provision', state: 'pending' }]);
+  const r = await provisioning.enqueueTeardown(db, 16, 'api:self');
+  assert.equal(r.created, true, 'the teardown was queued');
+  assert.equal(r.superseded, true, 'reports that a provision intent was canceled');
+  assert.equal(r.intent.action, 'teardown');
+  assert.equal(r.intent.state, 'pending');
+  const prov = db.rows.find((x) => x.action === 'provision');
+  assert.equal(prov.state, 'error', 'the stale provision intent is closed, not left open');
+  assert.match(prov.last_error, /superseded/);
+});
+
+await ta('a RUNNING provision intent is never yanked — a distinct conflict outcome, not a false "already queued"', async () => {
+  const db = fakeIntentDb([{ instance_id: 16, action: 'provision', state: 'running' }]);
+  const r = await provisioning.enqueueTeardown(db, 16, 'api:self');
+  assert.equal(r.created, false);
+  assert.equal(r.conflict, 'open_intent', 'the route needs a distinct outcome to answer truthfully');
+  assert.equal(r.intent.action, 'provision', 'the blocking intent is surfaced as-is');
+  assert.equal(r.intent.state, 'running', 'still running — the mid-flight work was not canceled');
+  assert.equal(db.rows.filter((x) => x.action === 'teardown').length, 0, 'no teardown row was inserted');
+});
+
+await ta('an already-open TEARDOWN is idempotent — created:false and NO conflict ("already queued" is now true)', async () => {
+  const db = fakeIntentDb([{ instance_id: 16, action: 'teardown', state: 'pending' }]);
+  const r = await provisioning.enqueueTeardown(db, 16, 'api:self');
+  assert.equal(r.created, false);
+  assert.equal(r.conflict, undefined, 'no conflict — this is the one genuine already-queued case');
+  assert.equal(r.intent.action, 'teardown');
+});
+
+await ta('a clean queue just enqueues (no supersede)', async () => {
+  const db = fakeIntentDb([]);
+  const r = await provisioning.enqueueTeardown(db, 16, 'api:archon:1');
+  assert.equal(r.created, true);
+  assert.equal(r.superseded, false);
+  assert.equal(r.intent.action, 'teardown');
+  assert.equal(r.intent.requested_by, 'api:archon:1');
+});
+
+t('PROVISION_ENQUEUE_FROM: an active or tearing-down instance never re-enqueues a provision intent', () => {
+  assert.equal(provisioning.PROVISION_ENQUEUE_FROM.has('active'), false, 'active — the enabling misstep');
+  assert.equal(provisioning.PROVISION_ENQUEUE_FROM.has('tearing_down'), false, 'tearing_down — mid-reclaim');
+  for (const s of ['requested', 'provisioning', 'error', 'torn_down']) {
+    assert.equal(provisioning.PROVISION_ENQUEUE_FROM.has(s), true, `${s} may (re)provision`);
+  }
+});
+
+// ── the routes: truthful responses per outcome, over a real mounted router ────────
+let teardownOutcome = null;   // what the next enqueueTeardown call reports
+let teardownCalls = [];
+let enqueueIntentCalls = [];
+let createResult = null;      // what the next createInstance call reports
+provisioning.getInstanceById = async (_db, id) =>
+  ({ id, owner_builder_id: 7, slug: 'spike', status: 'active' });
+provisioning.enqueueTeardown = async (_db, id, requestedBy) => {
+  teardownCalls.push({ id, requestedBy });
+  return teardownOutcome;
+};
+provisioning.enqueueIntent = async (_db, id, action, requestedBy) => {
+  enqueueIntentCalls.push({ id, action, requestedBy });
+  return { intent: { id: 99, action, state: 'pending' }, created: true };
+};
+provisioning.getOpenIntent = async () => null;
+provisioning.createInstance = async () => createResult;
+provisioning.recordEvent = async () => {};
+
+const api = require('../src/module-api.js');
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
+api.requirePermission = () => (_req, _res, next) => next();
+
+const express = require('express');
+const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(typeof opts === 'object' ? opts : {}), ...(details || {}) } });
+  };
+  next();
+});
+app.use('/api/bongos', provisioningRoutes());
+
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function post(path, body = {}) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}${path}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+console.log('\nPOST /provisioning/instances/:id/teardown — truthful responses:');
+
+await ta('a queued teardown says so (and surfaces that a stale provision was superseded)', async () => {
+  teardownOutcome = { intent: { action: 'teardown', state: 'pending' }, created: true, superseded: true };
+  const res = await post('/provisioning/instances/16/teardown');
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.queued, true);
+  assert.equal(res.body.superseded, true);
+  assert.match(res.body.message, /torn down/);
+});
+
+await ta('"already queued" is said ONLY when the open intent IS a teardown', async () => {
+  teardownOutcome = { intent: { action: 'teardown', state: 'pending' }, created: false, superseded: false };
+  const res = await post('/provisioning/instances/16/teardown');
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.queued, false);
+  assert.match(res.body.message, /already queued/);
+});
+
+await ta('a mid-flight provision is a 409 conflict — never the false "teardown already queued" (the live repro)', async () => {
+  teardownOutcome = { intent: { action: 'provision', state: 'running' }, created: false, superseded: false, conflict: 'open_intent' };
+  const res = await post('/provisioning/instances/16/teardown');
+  assert.equal(res.status, 409, res.raw);
+  assert.equal(res.body.error.code, 'intent_conflict');
+  assert.equal(res.body.error.details.action, 'provision', 'names the real blocker');
+  assert.doesNotMatch(String(res.body.error.message), /already queued/i, 'the old lie is gone');
+});
+
+console.log('\nPOST /provisioning/instances/:id/force-teardown — same truthful mapping (archon):');
+
+await ta('force-teardown surfaces the same 409 conflict instead of a false success', async () => {
+  teardownOutcome = { intent: { action: 'provision', state: 'running' }, created: false, superseded: false, conflict: 'open_intent' };
+  const res = await post('/provisioning/instances/16/force-teardown');
+  assert.equal(res.status, 409, res.raw);
+  assert.equal(res.body.error.code, 'intent_conflict');
+});
+
+await ta('force-teardown queues + reports supersede like the owner route', async () => {
+  teardownOutcome = { intent: { action: 'teardown', state: 'pending' }, created: true, superseded: true };
+  const res = await post('/provisioning/instances/16/force-teardown');
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.queued, true);
+  assert.equal(res.body.superseded, true);
+});
+
+console.log('\nPOST /provisioning/instances — no provision intent for an instance needing no standup:');
+
+await ta('re-requesting an ACTIVE instance does NOT enqueue a provision intent (the enabling misstep, fixed)', async () => {
+  createResult = { instance: { id: 42, owner_builder_id: 7, slug: 'spike', status: 'active' }, created: false };
+  enqueueIntentCalls = [];
+  const res = await post('/provisioning/instances', { slug: 'spike', hosting_shape: 'standalone' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(enqueueIntentCalls.length, 0, 'no provision intent was enqueued');
+  assert.equal(res.body.queued, false);
+  assert.equal(res.body.open_intent, null);
+});
+
+await ta('re-requesting an ERRORED instance still enqueues (the retry path is preserved)', async () => {
+  createResult = { instance: { id: 42, owner_builder_id: 7, slug: 'spike', status: 'error' }, created: false };
+  enqueueIntentCalls = [];
+  const res = await post('/provisioning/instances', { slug: 'spike', hosting_shape: 'standalone' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(enqueueIntentCalls.length, 1, 'the provision retry was enqueued');
+  assert.equal(enqueueIntentCalls[0].action, 'provision');
+});
+
+await ta('a FRESH instance always enqueues its provision intent (unchanged happy path)', async () => {
+  createResult = { instance: { id: 43, owner_builder_id: 7, slug: 'fresh', status: 'requested' }, created: true };
+  enqueueIntentCalls = [];
+  const res = await post('/provisioning/instances', { slug: 'fresh', hosting_shape: 'standalone' });
+  assert.equal(res.status, 201, res.raw);
+  assert.equal(enqueueIntentCalls.length, 1);
+  assert.equal(enqueueIntentCalls[0].action, 'provision');
+});
+
+server.close();
+console.log(`\nprovisioning_teardown_intent: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);