@bongos/core 1.19.763 → 1.19.765

package/tests/provisioning_capacity.mjs

@@ -0,0 +1,411 @@
+// tests/provisioning_capacity.mjs
+//
+// The box-capacity ceiling (ADR 0285, task 1003927): the shared arithmetic in
+// modules/provisioning/capacity.js, the runner preflight in
+// scripts/gds/provision-capacity.js, its composition into provisionInstance and
+// the drain loop, and the `capacity` block on GET /provisioning/fleet.
+//
+// Before this, nothing enforced the ceiling the ADR measured: the runner stood up
+// project N+1 on a full box and swap hid it. These tests pin the two walls (row
+// ceiling, live MemAvailable floor), that a refusal happens BEFORE any status write
+// or standup command, that it reaches the owner's card as error_note without
+// flipping the instance's status, and that the number every surface shows comes
+// from the same helpers. Hermetic: fake db, fake executors, a loopback listener
+// for the route; no Postgres, no shell, no /proc.
+//
+// Run:  node tests/provisioning_capacity.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import capacityDefault, {
+  DEFAULT_CEILING, DEFAULT_MEM_FLOOR_MB, PLACED_STATES,
+  parseMeminfo, placementBox, ceilingFor, placementVerdict, capacitySummary, countPlaced, fleetCapacity,
+} from '../modules/provisioning/capacity.js';
+import { MEMINFO_CMD, capacityPreflight, statusCapacityLine } from '../scripts/gds/provision-capacity.js';
+
+const require = createRequire(import.meta.url);
+const P = require('../scripts/gds/provision.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// The live control plane on 2026-09-16 (1968 MiB total) and the ADR's 4 GB tier.
+const MEMINFO_2GB = 'MemTotal:        2015216 kB\nMemFree:          123456 kB\nMemAvailable:    1135180 kB\nSwapTotal:       4194300 kB\n';
+const MEMINFO_4GB = 'MemTotal:        4030432 kB\nMemAvailable:    2500000 kB\n';
+const MEMINFO_TIGHT = 'MemTotal:        2015216 kB\nMemAvailable:      120000 kB\n';   // 117 MB free — under the 256 MB floor
+
+// A fake db: answers the ceiling COUNT with `placed`, records every query, and
+// returns no rows for anything else (allocatePort etc.).
+function fakeDb(placed) {
+  const queries = [];
+  return {
+    queries,
+    query: async (sql, params) => {
+      queries.push({ sql, params });
+      if (/count\(\*\)/.test(sql)) return { rows: [{ n: placed }] };
+      return { rows: [] };
+    },
+  };
+}
+
+console.log('the arithmetic (ADR 0285):');
+
+t('parseMeminfo: MemTotal / MemAvailable in MiB; absent fields read null, never 0', () => {
+  assert.deepEqual(parseMeminfo(MEMINFO_2GB), { memTotalMb: 1967, memAvailableMb: 1108 }, 'the ADR\'s own "1967 MiB RAM" reading');
+  assert.deepEqual(parseMeminfo(''), { memTotalMb: null, memAvailableMb: null });
+  assert.deepEqual(parseMeminfo(null), { memTotalMb: null, memAvailableMb: null });
+  assert.deepEqual(parseMeminfo('MemTotal:  4030432 kB\n'), { memTotalMb: 3935, memAvailableMb: null });
+});
+
+t('ceilingFor reproduces the ADR 0285 table from MemTotal: 15 / 39 / 41 — and a resize raises it with no knob', () => {
+  assert.deepEqual(ceilingFor({ memTotalMb: 1968, fixedMb: 750 }), { ceiling: 15, source: 'measured' }, 's-1vcpu-2gb control plane');
+  assert.deepEqual(ceilingFor({ memTotalMb: 3936, fixedMb: 750 }), { ceiling: 39, source: 'measured' }, 's-2vcpu-4gb control plane');
+  assert.deepEqual(ceilingFor({ memTotalMb: 3936, fixedMb: 630 }), { ceiling: 41, source: 'measured' }, 's-2vcpu-4gb overflow box');
+});
+
+t('ceilingFor: an explicit override wins; an unmeasured box falls to the ADR smallest-tier default and SAYS so', () => {
+  assert.deepEqual(ceilingFor({ override: 20, memTotalMb: 1968 }), { ceiling: 20, source: 'env' });
+  assert.deepEqual(ceilingFor({}), { ceiling: DEFAULT_CEILING, source: 'default' });
+  assert.deepEqual(ceilingFor({ memTotalMb: 500, fixedMb: 750 }), { ceiling: DEFAULT_CEILING, source: 'default' }, 'a box smaller than its fixed base cannot be measured into a ceiling');
+  assert.equal(DEFAULT_CEILING, 15);
+});
+
+t('placementBox: standalone → control plane always; co-tenant → the remote box only under remote-exec; dedicated → no shared box', () => {
+  assert.deepEqual(placementBox('standalone', {}), { box: 'control-plane', shapes: ['standalone', 'co-tenant'], fixedMb: 750 });
+  assert.deepEqual(placementBox('standalone', { remoteHost: 'cohost' }), { box: 'control-plane', shapes: ['standalone'], fixedMb: 750 });
+  assert.deepEqual(placementBox('co-tenant', {}), { box: 'control-plane', shapes: ['standalone', 'co-tenant'], fixedMb: 750 });
+  assert.deepEqual(placementBox('co-tenant', { remoteHost: 'cohost' }), { box: 'overflow', shapes: ['co-tenant'], fixedMb: 630 });
+  assert.equal(placementBox('dedicated', {}), null);
+});
+
+t('placementVerdict: the ceiling refuses at N of N, the floor refuses under 256 MB free, an unmeasured floor cannot refuse', () => {
+  const full = placementVerdict({ placed: 15, ceiling: 15, memAvailableMb: 1108 });
+  assert.equal(full.ok, false); assert.equal(full.wall, 'ceiling');
+  assert.match(full.reason, /15 of 15 project slots/, 'names N of M for the owner');
+  assert.match(full.reason, /Nothing was placed/);
+  assert.match(full.reason, /task 1003923/, 'points at the resize');
+  const tight = placementVerdict({ placed: 10, ceiling: 15, memAvailableMb: 117 });
+  assert.equal(tight.ok, false); assert.equal(tight.wall, 'memory');
+  assert.match(tight.reason, /117 MB of memory free, under the 256 MB/);
+  assert.deepEqual(placementVerdict({ placed: 10, ceiling: 15, memAvailableMb: 1108 }), { ok: true, wall: null, reason: null });
+  assert.equal(placementVerdict({ placed: 14, ceiling: 15, memAvailableMb: null }).ok, true, 'unmeasured memory: the ceiling alone decides');
+  assert.equal(placementVerdict({ placed: 16, ceiling: 15 }).ok, false, 'past the ceiling is still full');
+  assert.equal(DEFAULT_MEM_FLOOR_MB, 256);
+});
+
+t('capacitySummary: resize_due at 80% (12 of 15), remaining never negative, verdict carried', () => {
+  const eleven = capacitySummary({ box: 'control-plane', placed: 11, ceiling: 15, source: 'measured', memAvailableMb: 1108 });
+  assert.equal(eleven.resize_at, 12); assert.equal(eleven.resize_due, false); assert.equal(eleven.remaining, 4);
+  const twelve = capacitySummary({ box: 'control-plane', placed: 12, ceiling: 15, source: 'measured', memAvailableMb: 1108 });
+  assert.equal(twelve.resize_due, true, 'the ADR schedules the resize at 12');
+  assert.equal(twelve.verdict.ok, true, 'due for a resize is not yet full');
+  const over = capacitySummary({ box: 'control-plane', placed: 16, ceiling: 15, source: 'env' });
+  assert.equal(over.remaining, 0); assert.equal(over.verdict.ok, false);
+  assert.equal(over.mem_floor_mb, DEFAULT_MEM_FLOOR_MB);
+});
+
+await ta('countPlaced counts ONLY provisioning + active rows of the box\'s shapes, and can exclude the row being re-run', async () => {
+  const db = fakeDb(10);
+  assert.equal(await countPlaced(db, ['standalone']), 10);
+  assert.deepEqual(db.queries[0].params, [['standalone'], PLACED_STATES]);
+  assert.deepEqual(PLACED_STATES, ['provisioning', 'active'], 'error rows hold no running unit (live fleet, 2026-09-16) and must not take a slot');
+  assert.doesNotMatch(db.queries[0].sql, /id <>/, 'no exclusion unless asked');
+  await countPlaced(db, ['standalone', 'co-tenant'], { excludeId: 42 });
+  assert.match(db.queries[1].sql, /id <> \$3/);
+  assert.deepEqual(db.queries[1].params, [['standalone', 'co-tenant'], PLACED_STATES, 42]);
+  assert.equal(await countPlaced({ query: async () => ({ rows: [] }) }, ['standalone']), 0, 'a recording fake with no rows reads 0, not NaN');
+});
+
+await ta('fleetCapacity (the API + CLI summary) measures THIS host and counts the control plane\'s shapes', async () => {
+  delete process.env.PROVISION_BOX_CEILING;
+  const db = fakeDb(10);
+  const c = await fleetCapacity(db, { meminfo: MEMINFO_2GB, remoteHost: null });
+  assert.equal(c.box, 'control-plane'); assert.equal(c.placed, 10); assert.equal(c.ceiling, 15); assert.equal(c.source, 'measured');
+  assert.equal(c.mem_available_mb, 1108); assert.equal(c.resize_due, false); assert.equal(c.verdict.ok, true);
+  assert.deepEqual(db.queries[0].params[0], ['standalone', 'co-tenant']);
+  const remote = await fleetCapacity(fakeDb(3), { meminfo: MEMINFO_4GB, remoteHost: 'cohost' });
+  assert.equal(remote.ceiling, 39, 'the control plane\'s own 4 GB ceiling, not the overflow box\'s');
+  // The env override reaches the summary, and is read per call.
+  process.env.PROVISION_BOX_CEILING = '9';
+  const pinned = await fleetCapacity(fakeDb(10), { meminfo: MEMINFO_2GB, remoteHost: null });
+  assert.deepEqual([pinned.ceiling, pinned.source, pinned.verdict.ok], [9, 'env', false]);
+  delete process.env.PROVISION_BOX_CEILING;
+});
+
+console.log('\nthe runner preflight (scripts/gds/provision-capacity.js):');
+
+const standalone = { id: 7, slug: 'lantern', hosting_shape: 'standalone', status: 'requested', owner_builder_id: 3, port: null, db_name: 'lantern', domain: null };
+
+// Recording deps: which executor was asked, what was logged, which events landed.
+function preflightDeps({ apply = true, placed = 10, controlMeminfo = MEMINFO_2GB, boxMeminfo = MEMINFO_4GB } = {}) {
+  const asked = [], logs = [], events = [];
+  return {
+    asked, logs, events,
+    deps: {
+      apply, log: (l) => logs.push(l),
+      db: fakeDb(placed),
+      provisioning: { recordEvent: async (_db, e) => { events.push(e); } },
+      exec: (cmd) => { asked.push(['box', cmd]); return { ok: true, stdout: boxMeminfo }; },
+      controlExec: (cmd) => { asked.push(['control', cmd]); return { ok: true, stdout: controlMeminfo }; },
+    },
+  };
+}
+
+await ta('a standalone with room: ok, measured on the CONTROL executor, the count excludes its own row', async () => {
+  const h = preflightDeps({ placed: 10 });
+  const r = await capacityPreflight(standalone, h.deps);
+  assert.equal(r.ok, true);
+  assert.deepEqual(h.asked, [['control', MEMINFO_CMD]], 'a standalone runs control-plane-local, so its box is measured there');
+  assert.equal(r.ceiling, 15); assert.equal(r.source, 'measured'); assert.equal(r.placed, 10);
+  assert.deepEqual(h.deps.db.queries[0].params[2], 7, 'the row being provisioned never counts itself');
+  assert.equal(h.events.length, 0, 'nothing to record when it fits');
+  assert.ok(h.logs.some((l) => /control-plane box at 10 of 15 slots \(measured, 1108 MB free\)/.test(l)), `logs the box line: ${h.logs.join(' | ')}`);
+});
+
+await ta('a full box REFUSES with the owner-readable reason, records placement-refused, and returns (never throws)', async () => {
+  const h = preflightDeps({ placed: 15 });
+  const r = await capacityPreflight(standalone, h.deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /15 of 15 project slots are taken/);
+  assert.equal(h.events.length, 1);
+  assert.equal(h.events[0].event, 'placement-refused');
+  assert.equal(h.events[0].instanceId, 7);
+  assert.equal(h.events[0].detail, r.error, 'the ledger carries the same sentence the card will');
+  assert.ok(h.logs.some((l) => /✖ \[preflight\].*refusing to place lantern \(ceiling wall\)/.test(l)));
+});
+
+await ta('the live memory floor refuses even with slots to spare (a stray unit the ledger cannot see)', async () => {
+  const h = preflightDeps({ placed: 10, controlMeminfo: MEMINFO_TIGHT });
+  const r = await capacityPreflight(standalone, h.deps);
+  assert.equal(r.ok, false);
+  assert.equal(r.verdict.wall, 'memory');
+  assert.match(r.error, /117 MB of memory free/);
+  assert.equal(h.events[0].event, 'placement-refused');
+});
+
+await ta('at 80% it still places, but the log names the resize trigger', async () => {
+  const h = preflightDeps({ placed: 12 });
+  const r = await capacityPreflight(standalone, h.deps);
+  assert.equal(r.ok, true); assert.equal(r.resize_due, true);
+  assert.ok(h.logs.some((l) => /at or past 80%: schedule the resize \(task 1003923\)/.test(l)), h.logs.join(' | '));
+});
+
+await ta('a co-tenant under remote-exec is measured on the BOX executor against the overflow base (41 on 4 GB)', async () => {
+  const { CONFIG } = require('../scripts/gds/provision-config.js');
+  const prior = CONFIG.remoteHost;
+  CONFIG.remoteHost = 'cohost';
+  try {
+    const h = preflightDeps({ placed: 40 });
+    const r = await capacityPreflight({ ...standalone, hosting_shape: 'co-tenant' }, h.deps);
+    assert.deepEqual(h.asked, [['box', MEMINFO_CMD]]);
+    assert.equal(r.box, 'overflow'); assert.equal(r.ceiling, 41); assert.equal(r.ok, true);
+    assert.deepEqual(h.deps.db.queries[0].params[0], ['co-tenant'], 'only the shapes that share that box count');
+  } finally { CONFIG.remoteHost = prior; }
+});
+
+await ta('a dedicated droplet is its own box: no measurement, no count, no refusal', async () => {
+  const h = preflightDeps({ placed: 99 });
+  const r = await capacityPreflight({ ...standalone, hosting_shape: 'dedicated' }, h.deps);
+  assert.deepEqual(r, { ok: true, skipped: 'dedicated' });
+  assert.equal(h.asked.length, 0); assert.equal(h.deps.db.queries.length, 0);
+});
+
+await ta('dry-run measures nothing and refuses nothing, even on a full box; an unmeasured --apply falls to the default and warns', async () => {
+  const dry = preflightDeps({ apply: false, placed: 15 });
+  const r = await capacityPreflight(standalone, dry.deps);
+  assert.equal(r.ok, true); assert.equal(r.dryRun, true);
+  assert.equal(dry.events.length, 0);
+  assert.ok(dry.logs.some((l) => /would refuse if full/.test(l)));
+  // --apply with an executor that answers no stdout (a fake, or a box without procfs)
+  const blind = preflightDeps({ placed: 3, controlMeminfo: '' });
+  const b = await capacityPreflight(standalone, blind.deps);
+  assert.equal(b.ok, true); assert.equal(b.source, 'default'); assert.equal(b.ceiling, DEFAULT_CEILING);
+  assert.ok(blind.logs.some((l) => /could not measure the box.*PROVISION_BOX_CEILING/.test(l)), blind.logs.join(' | '));
+  // …and an executor that throws is the same as one that answers nothing.
+  const throwing = preflightDeps({ placed: 3 });
+  throwing.deps.controlExec = () => { throw new Error('ssh down'); };
+  assert.equal((await capacityPreflight(standalone, throwing.deps)).source, 'default');
+});
+
+await ta('statusCapacityLine prints "box at N of M" for the CLI', async () => {
+  delete process.env.PROVISION_BOX_CEILING;
+  // fleetCapacity reads THIS host's /proc/meminfo (absent on a Windows dev box → default);
+  // the line must carry the count and the source whichever it is.
+  const line = await statusCapacityLine(fakeDb(12));
+  assert.match(line, /control-plane box: 12 of \d+ project slots taken \((measured|default)/);
+});
+
+console.log('\ncomposition into the runner (provisionInstance + the drain loop):');
+
+// The recorder from tests/provision.mjs, with a db that answers the ceiling count.
+function recorder({ apply, placed, meminfo = MEMINFO_2GB }) {
+  const cmds = [], writes = [], statuses = [], events = [];
+  const db = fakeDb(placed);
+  const deps = {
+    apply, log: () => {}, db,
+    provisioning: {
+      setInstanceStatus: async (_db, _id, s) => { statuses.push(s); },
+      recordEvent: async (_db, e) => { events.push(e); },
+      getInstanceBySlug: async () => null,
+    },
+    exec: (cmd) => { cmds.push(cmd); return { ok: true, stdout: /meminfo/.test(cmd) ? meminfo : '' }; },
+    writeFile: (p) => { writes.push(p); return { ok: true }; },
+    doApi: null,
+    checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
+    getGithubToken: async () => null,
+  };
+  return { deps, cmds, writes, statuses, events };
+}
+
+await ta('provisionInstance(--apply) on a full box returns ok:false BEFORE any status write or standup command', async () => {
+  const h = recorder({ apply: true, placed: 15 });
+  const r = await P.provisionInstance(standalone, h.deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /15 of 15 project slots/);
+  assert.deepEqual(h.statuses, [], 'never flipped to provisioning — a project that was not placed is not "provisioning"');
+  assert.deepEqual(h.cmds, [MEMINFO_CMD], 'the ONLY command run was the measurement');
+  assert.deepEqual(h.writes, [], 'no unit, no env file, no Caddy block');
+  assert.deepEqual(h.events.map((e) => e.event), ['placement-refused']);
+});
+
+await ta('provisionInstance(--apply) with room proceeds into the runbook exactly as before', async () => {
+  const h = recorder({ apply: true, placed: 10 });
+  const r = await P.provisionInstance({ ...standalone, hosting_shape: 'co-tenant', port: 3003 }, h.deps);
+  assert.equal(r.ok, true);
+  assert.equal(h.statuses[0], 'provisioning');
+  assert.equal(h.cmds[0], MEMINFO_CMD, 'measured first');
+  assert.ok(h.cmds.some((c) => /createdb lantern/.test(c)), 'then the runbook');
+});
+
+await ta('provisionInstance(dry-run) on a full box still prints the whole plan — dry-run places nothing, so it refuses nothing', async () => {
+  const h = recorder({ apply: false, placed: 15 });
+  const r = await P.provisionInstance({ ...standalone, hosting_shape: 'co-tenant', port: 3003 }, h.deps);
+  assert.equal(r.ok, true);
+  assert.ok(h.cmds.some((c) => /createdb lantern/.test(c)));
+});
+
+// The drain loop's retirement path: MAX_INTENT_ATTEMPTS reached → the intent is
+// resolved 'error' and the reason lands on the instance WITHOUT changing its status.
+await ta('cmdRunIntents: a refused placement retires onto the card as error_note, status untouched, event recorded', async () => {
+  let claims = 0; const resolved = [], statusWrites = [], events = [];
+  const deps = {
+    apply: true, log: () => {},
+    db: fakeDb(15),
+    provisioning: {
+      claimNextIntent: async () => (claims++ === 0 ? { id: 9, instance_id: 7, action: 'provision', attempts: P.MAX_INTENT_ATTEMPTS } : null),
+      getInstanceById: async () => ({ ...standalone }),
+      resolveIntent: async (_db, id, state, err) => { resolved.push({ id, state, err }); },
+      setInstanceStatus: async (_db, id, status, patch) => { statusWrites.push({ id, status, patch }); },
+      recordEvent: async (_db, e) => { events.push(e); },
+      claimNextOAuthManifest: async () => null,
+      resolveOAuthManifest: async () => {},
+    },
+    exec: (cmd) => ({ ok: true, stdout: /meminfo/.test(cmd) ? MEMINFO_2GB : '' }),
+    writeFile: () => ({ ok: true }), doApi: null,
+  };
+  const r = await P.cmdRunIntents(deps);
+  assert.equal(r.errors, 1); assert.equal(r.ok, 0);
+  assert.equal(resolved[0].state, 'error');
+  assert.match(resolved[0].err, /15 of 15 project slots/, 'the intent carries the reason');
+  assert.equal(statusWrites.length, 1);
+  assert.equal(statusWrites[0].status, 'requested', 'the CURRENT status is passed back — never flipped to error');
+  assert.match(statusWrites[0].patch.error_note, /Nothing was placed/, 'the card reads why');
+  assert.deepEqual(events.map((e) => e.event), ['placement-refused']);
+});
+
+await ta('cmdRunIntents: below the attempt cap a refusal goes back to pending with last_error — a teardown may free the slot', async () => {
+  let claims = 0; const updates = [];
+  const db = fakeDb(15);
+  const rawQuery = db.query;
+  db.query = async (sql, params) => { if (/SET state='pending'/.test(sql)) { updates.push(params); return { rows: [] }; } return rawQuery(sql, params); };
+  const deps = {
+    apply: true, log: () => {}, db,
+    provisioning: {
+      claimNextIntent: async () => (claims++ === 0 ? { id: 9, instance_id: 7, action: 'provision', attempts: 1 } : null),
+      getInstanceById: async () => ({ ...standalone }),
+      resolveIntent: async () => { throw new Error('must not resolve on a retryable refusal'); },
+      setInstanceStatus: async () => { throw new Error('must not touch the instance on a retryable refusal'); },
+      recordEvent: async () => {},
+      claimNextOAuthManifest: async () => null,
+      resolveOAuthManifest: async () => {},
+    },
+    exec: (cmd) => ({ ok: true, stdout: /meminfo/.test(cmd) ? MEMINFO_2GB : '' }),
+    writeFile: () => ({ ok: true }), doApi: null,
+  };
+  const r = await P.cmdRunIntents(deps);
+  assert.equal(r.errors, 1);
+  assert.equal(updates.length, 1);
+  assert.equal(updates[0][0], 9);
+  assert.match(updates[0][1], /15 of 15 project slots/);
+});
+
+console.log('\nthe fleet API carries the same summary:');
+
+// Stub the route's data access at the same seams tests/provisioning_paid_shape_gate.mjs
+// uses; the capacity module object is shared with the route through the require cache.
+const provisioning = require('../modules/provisioning/provisioning.js');
+provisioning.listAllInstances = async () => [{ id: 1, owner_builder_id: 7, slug: 'lantern', status: 'active', hosting_shape: 'standalone', settings: {}, detail: {}, github_login: 'o', display_name: 'O', rank: 'archon' }];
+const api = require('../src/module-api.js');
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
+api.requirePermission = () => (_req, _res, next) => next();
+const realFleetCapacity = capacityDefault.fleetCapacity;
+
+const express = require('express');
+const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(details || (typeof opts === 'object' ? opts : {})) } });
+  };
+  next();
+});
+app.use('/api/bongos', provisioningRoutes());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+function get(path) {
+  return new Promise((resolve, reject) => {
+    http.get(`${base}${path}`, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    }).on('error', reject);
+  });
+}
+
+await ta('GET /provisioning/fleet returns `capacity` beside the roster — placed, ceiling, source, resize_due', async () => {
+  capacityDefault.fleetCapacity = async (db) => fleetCapacity(fakeDb(12), { meminfo: MEMINFO_2GB, remoteHost: null });
+  try {
+    const res = await get('/provisioning/fleet');
+    assert.equal(res.status, 200, res.raw);
+    assert.equal(res.body.instances.length, 1);
+    const c = res.body.capacity;
+    assert.equal(c.box, 'control-plane'); assert.equal(c.placed, 12); assert.equal(c.ceiling, 15);
+    assert.equal(c.source, 'measured'); assert.equal(c.resize_due, true); assert.equal(c.remaining, 3);
+    assert.equal(c.verdict.ok, true);
+  } finally { capacityDefault.fleetCapacity = realFleetCapacity; }
+});
+
+await ta('a capacity read that fails never fails the roster: `capacity` is null, the instances still come back', async () => {
+  capacityDefault.fleetCapacity = async () => { throw new Error('count unavailable'); };
+  try {
+    const res = await get('/provisioning/fleet');
+    assert.equal(res.status, 200, res.raw);
+    assert.equal(res.body.instances.length, 1);
+    assert.equal(res.body.capacity, null);
+  } finally { capacityDefault.fleetCapacity = realFleetCapacity; }
+});
+
+server.close();
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);