@bongos/core 1.19.772 → 1.19.774

package/tests/module-scope-map.mjs

@@ -252,3 +252,42 @@ test('methodology joined the roster (task 1002989) — the instruction surfaces
   assert.equal(covers('scripts/gds/fitness.js'), false, 'the fitness tool stayed with devsecops (task 1003124)');
   assert.equal(covers('scripts/gds/ship.js'), false, 'the ship pipeline belongs to lifecycle');
 });
+
+test('SHARED_GLOBS: the ownerless floor every goal wall includes (task 1003655, ADR 0288)', () => {
+  // `tests/` is the whole floor and the bar for joining it is high: no module can
+  // honestly own the path AND every task legitimately writes it.
+  assert.deepEqual([...scope.SHARED_GLOBS], ['tests/']);
+  // It is SHARED, not OWNED — no module key may claim it, or the floor would be a
+  // second list drifting against the roster.
+  for (const k of scope.moduleKeys()) {
+    const globs = scope.scopeForModule(k).globs;
+    assert.ok(!globs.includes('tests/'), `module "${k}" must not own the shared root tests/`);
+  }
+  // Module-owned suites keep their own module's key — they are not part of the floor.
+  assert.equal(gsc.scopeSubset(['lifecycle'], ['modules/lifecycle/tests/ship.mjs']).ok, true);
+  assert.equal(gsc.scopeSubset(['art-pipeline'], ['modules/lifecycle/tests/ship.mjs']).ok, false);
+});
+
+test('SHARED_GLOBS is DERIVED against PROTECTED_GLOBS, never a trusted literal', () => {
+  // Same contract as `protected` (ADR 0086 §7): a protected path listed here would
+  // widen EVERY goal's wall into the trust core in one line, so the export filters
+  // its own literal rather than trusting it.
+  for (const g of scope.SHARED_GLOBS) {
+    assert.equal(scope.isProtected([g]), false, `shared glob ${g} overlaps the protected core`);
+  }
+  assert.deepEqual(
+    [...scope.SHARED_GLOBS],
+    scope.SHARED_GLOBS_RAW.filter((g) => !scope.isProtected([g])),
+    'the exported floor must be the faithful filter of its literal',
+  );
+  // Prove the filter actually filters, rather than passing because the literal is clean.
+  assert.deepEqual(['tests/', 'migrations/'].filter((g) => !scope.isProtected([g])), ['tests/']);
+});
+
+test('the gap this closed: an honest task declaring its own test is now authorizable', () => {
+  // Before task 1003655 this was refused out_of_scope under EVERY goal, because
+  // tests/ resolved to no module — so the wall was only passable by under-declaring
+  // touches[] (idea 1000816). Asserted through the real consumer.
+  const r = gsc.check(['ideas'], ['modules/ideas/inbox.js', 'tests/idea_routing.mjs'], 'thetes');
+  assert.equal(r.ok, true, r.reason);
+});

package/tests/module_exports_unique_keys.mjs

@@ -0,0 +1,70 @@
+// tests/module_exports_unique_keys.mjs
+//
+// No `module.exports = { … }` shorthand literal may name the same key twice (task 1003922).
+//
+// modules/provisioning/provisioning.js carried two adjacent export lines that repeated
+// createInstance, setInstanceStatus, updateInstanceDomain and updateInstanceSettings, a
+// merge residue. JavaScript accepts it silently, which is the hazard: a later edit that
+// removes or renames a key on ONE line leaves the other copy exporting it, so the edit
+// looks applied and is not. This scans every server-side .js file's trailing shorthand
+// export literal, so the next one fails here instead of in review.
+//
+// Run:  node tests/module_exports_unique_keys.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SKIP_DIRS = new Set(['node_modules', 'vendor', '.git', 'public']);
+
+function jsFiles(dir, out = []) {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.isDirectory()) { if (!SKIP_DIRS.has(entry.name)) jsFiles(path.join(dir, entry.name), out); }
+    else if (entry.name.endsWith('.js')) out.push(path.join(dir, entry.name));
+  }
+  return out;
+}
+
+// The trailing `module.exports = { … };` — only when it is pure shorthand (no `key: value`,
+// calls, spreads or strings), since that is the form a duplicated line hides in.
+function duplicateExportKeys(src) {
+  const at = src.lastIndexOf('module.exports = {');
+  if (at < 0) return [];
+  const end = src.indexOf('\n};', at);
+  if (end < 0) return [];
+  const body = src.slice(at + 'module.exports = {'.length, end)
+    .replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/.*$/gm, '');
+  if (/[:(){}[\]'"`.]/.test(body)) return [];
+  const counts = new Map();
+  for (const key of body.split(',').map((s) => s.trim()).filter(Boolean)) counts.set(key, (counts.get(key) || 0) + 1);
+  return [...counts].filter(([, n]) => n > 1).map(([key]) => key);
+}
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+t('the detector finds a repeated key across two export lines, and ignores a clean or non-shorthand literal', () => {
+  assert.deepEqual(duplicateExportKeys('module.exports = {\n  a, b,\n  a, c,\n};\n'), ['a']);
+  assert.deepEqual(duplicateExportKeys('module.exports = {\n  a, b, // a\n  c,\n};\n'), []);
+  assert.deepEqual(duplicateExportKeys('module.exports = {\n  a: 1, a: 2,\n};\n'), []);
+});
+
+t('no server-side module.exports shorthand literal repeats a key', () => {
+  const files = ['src', 'modules', 'scripts'].flatMap((d) => jsFiles(path.join(ROOT, d)));
+  files.push(path.join(ROOT, 'server.js'));
+  assert.ok(files.length > 100, `scanned too few files (${files.length}) — the walk is broken`);
+  const offenders = files
+    .filter((f) => fs.existsSync(f))
+    .map((f) => [path.relative(ROOT, f).replace(/\\/g, '/'), duplicateExportKeys(fs.readFileSync(f, 'utf8').replace(/\r\n/g, '\n'))])
+    .filter(([, keys]) => keys.length)
+    .map(([f, keys]) => `${f}: ${keys.join(', ')}`);
+  assert.deepEqual(offenders, [], `a key exported twice is a merge hazard — merge the lines:\n${offenders.join('\n')}`);
+});
+
+console.log(`\nmodule_exports_unique_keys: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/module_manifest.mjs

@@ -276,3 +276,88 @@ test('every bundled module declares a maintenance posture (the catalog has no un
     });
   assert.deepEqual(undeclared, [], `these modules declare no maintenance.status: ${undeclared.join(', ')}`);
 });
+
+// --- declarativeSeams: the seam-wiring guard's exemption list (task 1003819) ---
+//
+// The exemption is validated AGAINST `contributes` because this is the one place
+// holding both. A typo'd exemption that validated clean would exempt nothing while
+// reading as though it exempted something — the failure mode in the direction that
+// HIDES a defect, which is exactly what the guard exists to catch.
+
+test('declarativeSeams: a valid exemption naming a declared seam + entry passes', () => {
+  const r = validateManifest({
+    ...baseManifest(),
+    declarativeSeams: { pollers: ['box-lifecycle'], uiSections: ['boxes'] },
+  });
+  assert.equal(r.valid, true, r.errors.join('; '));
+});
+
+test('declarativeSeams: an exemption for a seam the module does not declare is an ERROR', () => {
+  const r = validateManifest({
+    ...baseManifest(),
+    contributes: { routes: ['box'] }, // no pollers declared
+    declarativeSeams: { pollers: ['box-lifecycle'] },
+  });
+  assert.equal(r.valid, false);
+  assert.ok(r.errors.some((e) => /does not declare contributes\.pollers/.test(e)), r.errors.join('; '));
+});
+
+test('declarativeSeams: an exemption naming an ENTRY the module does not list is an ERROR (the typo case)', () => {
+  const r = validateManifest({
+    ...baseManifest(),
+    declarativeSeams: { pollers: ['box-lifecyle'] }, // transposed letters
+  });
+  assert.equal(r.valid, false);
+  assert.ok(r.errors.some((e) => /"box-lifecyle" is not in contributes\.pollers/.test(e)), r.errors.join('; '));
+});
+
+test('declarativeSeams: the per-entry check spans EVERY seam, not just bare string arrays', () => {
+  // webSurfaces declares OBJECTS and `migrations: true` is implicit, so an earlier cut
+  // that compared exemptions against raw strings bailed on both (`if (!isStrArray…)
+  // continue`) and let a bogus exemption validate clean — 2 of the 8 allowed keys
+  // silently outside acceptance criterion 3. The comparison is against the LABELS now.
+  const base = { ...baseManifest(), contributes: { webSurfaces: [{ host: 'status.', dir: 'public' }] } };
+  const bad = validateManifest({ ...base, declarativeSeams: { webSurfaces: ['bogus'] } });
+  assert.equal(bad.valid, false, 'a bogus webSurfaces exemption must not validate');
+  assert.ok(bad.errors.some((e) => /"bogus" is not in contributes\.webSurfaces/.test(e)), bad.errors.join('; '));
+  assert.equal(validateManifest({ ...base, declarativeSeams: { webSurfaces: ['status.(public)'] } }).valid, true);
+
+  const mig = { ...baseManifest(), contributes: { migrations: true } };
+  assert.equal(validateManifest({ ...mig, declarativeSeams: { migrations: ['bogus'] } }).valid, false);
+  assert.equal(validateManifest({ ...mig, declarativeSeams: { migrations: ['migrations/'] } }).valid, true);
+});
+
+test('declarativeSeams: an unknown seam key is an ERROR, not a silent no-op', () => {
+  const r = validateManifest({ ...baseManifest(), declarativeSeams: { pollerz: ['x'] } });
+  assert.equal(r.valid, false);
+  assert.ok(r.errors.some((e) => /declarativeSeams\.pollerz: unknown seam/.test(e)), r.errors.join('; '));
+});
+
+test('declarativeSeams: shape errors — non-object block, non-string-array entries', () => {
+  assert.equal(validateManifest({ ...baseManifest(), declarativeSeams: ['pollers'] }).valid, false);
+  assert.equal(validateManifest({ ...baseManifest(), declarativeSeams: { pollers: 'box-lifecycle' } }).valid, false);
+  assert.equal(validateManifest({ ...baseManifest(), declarativeSeams: { pollers: [''] } }).valid, false);
+});
+
+test('declarativeSeams is OPTIONAL — a manifest without it still validates', () => {
+  const m = baseManifest();
+  assert.ok(!('declarativeSeams' in m));
+  assert.equal(validateManifest(m).valid, true);
+});
+
+test('every bundled module with a declarativeSeams block validates against its own contributes', async () => {
+  // The live manifests are the real regression surface: an exemption that drifts from
+  // the contributes block it exempts is the defect this field is here to prevent.
+  const fsm = (await import('node:fs')).default;
+  const modulesDir = path.join(ROOT, 'modules');
+  const bad = [];
+  for (const k of fsm.readdirSync(modulesDir)) {
+    const mp = path.join(modulesDir, k, 'module.json');
+    if (!fsm.existsSync(mp)) continue;
+    const m = JSON.parse(fsm.readFileSync(mp, 'utf8'));
+    if (!m.declarativeSeams) continue;
+    const r = validateManifest(m);
+    if (!r.valid) bad.push(`${k}: ${r.errors.join('; ')}`);
+  }
+  assert.deepEqual(bad, [], bad.join('\n'));
+});

package/tests/project_catalog_forget.mjs

@@ -0,0 +1,83 @@
+// tests/project_catalog_forget.mjs
+//
+// The catalog's half of "Disconnect from Bongos entirely" (task 1003249, ADR 0290): a
+// disconnected project leaves the map for good — its catalog row, its catalog client and the
+// membership rows keyed on that client are DELETED, not hidden.
+//
+// It writes rows keyed on values an owner supplies (a slug, an address), so it keeps the two
+// claim rules the publish path keeps (project-catalog.js header):
+//   1. the PROJECT row goes only when its owner is this instance's owner;
+//   2. the CLIENT (and its memberships) goes only when it is bound to this origin or was never
+//      credentialed — a slug that collides with a real, credentialed client elsewhere is not
+//      ours to delete.
+//
+// DB-free: a recording pool answers by statement shape.
+//
+// Run:  node tests/project_catalog_forget.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const catalog = require('../modules/platform-identity/project-catalog.js');
+
+function pool({ client = null } = {}) {
+  const calls = [];
+  return {
+    calls,
+    query: async (sql, params) => {
+      calls.push({ sql: sql.replace(/\s+/g, ' ').trim(), params });
+      if (/^SELECT .* FROM platform_identity_sso_clients/.test(sql.replace(/\s+/g, ' ').trim())) return { rows: client ? [client] : [] };
+      if (/^DELETE FROM platform_identity_projects/.test(sql.replace(/\s+/g, ' ').trim())) return { rowCount: 1, rows: [] };
+      if (/^DELETE FROM platform_identity_project_memberships/.test(sql.replace(/\s+/g, ' ').trim())) return { rowCount: 3, rows: [] };
+      if (/^DELETE FROM platform_identity_sso_clients/.test(sql.replace(/\s+/g, ' ').trim())) return { rowCount: 1, rows: [] };
+      throw new Error(`unexpected SQL: ${sql}`);
+    },
+  };
+}
+const TARGET = { clientId: 'lantern', origin: 'https://lantern.example.com/', ownerGithubId: 4242 };
+const deletes = (p) => p.calls.filter((c) => /^DELETE/.test(c.sql));
+
+test('an uncredentialed catalog-only client: the project row, the client and its memberships all go', async () => {
+  const p = pool({ client: { origin: 'https://lantern.example.com', secret_hash: '' } });
+  const out = await catalog.forgetOwnedProject(TARGET, { pool: p });
+  assert.deepEqual(out, { project: 1, client: 1, memberships: 3 });
+  const d = deletes(p);
+  assert.match(d[0].sql, /DELETE FROM platform_identity_projects WHERE origin = \$1 AND owner_github_id = \$2/);
+  assert.deepEqual(d[0].params, ['https://lantern.example.com', 4242], 'origin normalised, owner-scoped (claim rule 2)');
+  assert.deepEqual(d[1].params, ['lantern']);
+  assert.match(d[1].sql, /platform_identity_project_memberships/);
+  assert.match(d[2].sql, /platform_identity_sso_clients/, 'memberships go before the client they key on');
+});
+
+test('a credentialed client bound to THIS origin is this project\'s — it goes too', async () => {
+  const p = pool({ client: { origin: 'https://lantern.example.com', secret_hash: 'abc123' } });
+  const out = await catalog.forgetOwnedProject(TARGET, { pool: p });
+  assert.equal(out.client, 1);
+});
+
+test('a credentialed client at ANOTHER origin shares only the slug — it and its memberships are left alone (claim rule 1)', async () => {
+  const p = pool({ client: { origin: 'https://someone-else.example.org', secret_hash: 'abc123' } });
+  const out = await catalog.forgetOwnedProject(TARGET, { pool: p });
+  assert.deepEqual(out, { project: 1, client: 0, memberships: 0 });
+  assert.equal(deletes(p).length, 1, 'only the owner-scoped project row');
+});
+
+test('no client row: the project row still goes', async () => {
+  const p = pool();
+  assert.deepEqual(await catalog.forgetOwnedProject(TARGET, { pool: p }), { project: 1, client: 0, memberships: 0 });
+});
+
+test('no address or no owner identity: nothing is touched', async () => {
+  for (const t of [{ ...TARGET, origin: '' }, { ...TARGET, ownerGithubId: null }, { ...TARGET, clientId: '' }]) {
+    const p = pool({ client: { origin: 'https://lantern.example.com', secret_hash: '' } });
+    assert.deepEqual(await catalog.forgetOwnedProject(t, { pool: p }), { project: 0, client: 0, memberships: 0 });
+    assert.equal(p.calls.length, 0);
+  }
+});
+
+test('the kernel port exposes it as `forget`, beside publish and catalogued', () => {
+  assert.equal(typeof catalog.projectCatalogPort.forget, 'function');
+  assert.deepEqual(Object.keys(catalog.projectCatalogPort).sort(), ['catalogued', 'forget', 'publish']);
+});

package/tests/projects_hub.mjs

@@ -1305,7 +1305,8 @@ test('"delete" never claims to erase — the fold states what is kept', () => {
   assert.match(fold, /does <b>not<\/b> erase the project/i, 'the distinction is stated, not implied');
   assert.match(fold, /torn down/, 'it names the state the project actually lands in');
   assert.match(fold, /repository on GitHub is untouched/, 'and what survives');
-  assert.match(fold, /no permanent-delete button/i, 'the absent capability is admitted, not faked');
+  // the true delete exists since task 1003249 — the fold points at it rather than admitting its absence
+  assert.match(fold, /use <b>Disconnect from Bongos entirely<\/b> below/, 'the erase lives in its own card, and the fold says where');
 });
 
 test('tearing a project down asks for its NAME — the page\'s heaviest control', () => {
@@ -1350,12 +1351,17 @@ test('the delete section mirrors the server gate — every state but torn_down',
     'and the sentence is dropped where no such button rendered');
 });
 
-test('a teardown does not silence the address — the copy says what the runner does', () => {
+test('a teardown keeps the address reserved and says nothing answers there — the copy says what the runner does', () => {
   const fn = (SCRIPT.match(/function teardownTruth\(inst\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
   assert.ok(fn, 'teardownTruth() must be extractable');
-  // the runner has NO DNS or Caddy leg, so the hostname keeps resolving and 502s
+  // the runner parks the hostname and removes its Caddy block (task 1002897), but the
+  // row keeps the address, so the copy says "reserved", never "goes away"
   assert.doesNotMatch(fn, /the address stops answering/,
-    'the old claim was untrue — teardown releases neither the DNS record nor the Caddy block');
+    'the address is held for a revive, not released');
+  assert.match(fn, /nothing answers there until you bring it back/,
+    'what a visitor now meets at the parked address');
+  assert.doesNotMatch(fn, /shows an error page/,
+    'the pre-park 502 promise is gone');
   assert.match(fn, /stays reserved for this project/,
     'the honest word, and the accurate one — a revive re-uses exactly this hostname');
   assert.match(fn, /repository is untouched/, 'what survives is still stated in both shapes');

package/tests/projects_hub_pre_uat.mjs

@@ -63,7 +63,8 @@ test('addressRow branches by state before it trusts the domain — torn down and
   const stateFirst = body.indexOf("inst.status === 'torn_down' || inst.status === 'tearing_down'");
   const domainTest = body.indexOf('if (inst.domain)');
   assert.ok(stateFirst >= 0 && stateFirst < domainTest, 'the torn-down test comes before the domain test');
-  assert.match(body, /stays reserved for this project — it shows an error page until you bring it back/, 'torn down: the address is reserved, not answering');
+  assert.match(body, /stays reserved for this project — nothing answers there until you bring it back/, 'torn down: the address is reserved, and teardown parked it (task 1002897)');
+  assert.doesNotMatch(body, /shows an error page/, 'the pre-park promise is gone — teardown removes the proxy block that served it');
   assert.match(body, /if \(inst\.status === 'error'\) return 'Address <code>/, 'snagged has its own line');
   assert.match(body, /nothing is answering there yet/);
   assert.equal((body.match(/— it answers there once the instance is live\.'/g) || []).length, 1, 'the standup promise survives only for queued / standing-up');
@@ -428,13 +429,14 @@ test('the minute tick keeps a half-typed domain typed, and its receipt on the pa
 });
 
 /* ── the owner's five calls of 2026-08-24 (task 1003250) ── */
-test('decision 6 — the manage section is "Take it offline", and the teardown truth ends by saying nothing erases', () => {
+test('decision 6 — the manage section is "Take it offline", and the teardown truth ends by saying taking it offline erases nothing', () => {
   const del = (HUB.match(/<div class="card mSec" id="mDelete">[\s\S]*?<\/details>\s*<\/div>/) || [''])[0];
   assert.ok(del, '#mDelete exists');
   assert.match(del, /<h2[^>]*>Take it offline<\/h2>/, 'the heading says what the control does');
   assert.doesNotMatch(HUB, /Delete the project/, 'the word "Delete" no longer promises an erase anywhere on the page');
   const truth = fn('teardownTruth');
-  assert.equal((truth.match(/until you bring it back\. Nothing here erases a project\.'/g) || []).length, 2, 'both hosting shapes end on the same sentence');
+  // scoped to THIS control since task 1003249: the page now also carries the true delete
+  assert.equal((truth.match(/until you bring it back\. Taking it offline erases nothing\.'/g) || []).length, 2, 'both hosting shapes end on the same sentence');
 });
 
 test('decision 5 — the Type step says where the type can be changed (task 1003504)', () => {

package/tests/provision_disconnect.mjs

@@ -0,0 +1,231 @@
+// tests/provision_disconnect.mjs
+//
+// "Disconnect from Bongos entirely" — the runner leg (task 1003249, ADR 0290).
+//
+// The web tier only queues a 'disconnect' intent (tests/provisioning_disconnect.mjs). This is
+// where the project actually goes: the teardown legs first (units, Caddy block, parked DNS,
+// deploy key), then the erase a teardown deliberately never does — the database, its role, its
+// nightly dumps, its env file, state dir, checkout and unix account — then its catalog,
+// membership and client rows through the `project.catalog` port, and LAST the provisioning row,
+// which releases the name, the port and the address.
+//
+// What these tests pin:
+//   • ORDER: nothing is erased until the teardown ran; the row is deleted only after every
+//     erase and the catalog forget succeeded, so a failure leaves a row the runner can retry
+//   • the dump erase matches the nightly filename EXACTLY, so `test` never erases `test-nk`
+//   • each shape erases where its data lives (standalone: control plane; co-tenant: the
+//     co-hosting box; dedicated: nothing — its droplet went whole)
+//   • a dry run erases nothing and deletes nothing; an invalid slug is refused before any command
+//
+// Hermetic: recorded executors, a fake db, a fake catalog port. No shell, no Postgres.
+//
+// Run:  node tests/provision_disconnect.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const P = require('../scripts/gds/provision.js');
+const D = require('../scripts/gds/provision-disconnect.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const lantern = { id: 40, slug: 'lantern', hosting_shape: 'standalone', status: 'torn_down', owner_builder_id: 7, port: 3021, db_name: 'lantern', domain: 'lantern.cloudbongos.com', target_ref: null };
+
+function rig({ apply = true, privileged = false, failOn = null, catalogThrows = false, catalog = true } = {}) {
+  const events = [], logs = [];
+  const record = (where) => (cmd, opts) => {
+    events.push({ where, cmd, env: opts && opts.env });
+    if (failOn && failOn.test(cmd)) throw new Error(`Command failed: ${cmd}`);
+    return { ok: true, stdout: '' };
+  };
+  const deps = {
+    apply, privileged, log: (m) => logs.push(String(m)),
+    db: {
+      query: async (sql, params) => {
+        if (/SELECT github_id FROM builders/.test(sql)) return { rows: [{ github_id: 4242 }] };
+        if (/DELETE FROM provisioning_instances/.test(sql)) { events.push({ where: 'db', cmd: 'delete-row', params }); return { rowCount: 1, rows: [] }; }
+        return { rows: [] };
+      },
+    },
+    provisioning: {
+      setInstanceStatus: async (_db, _id, status) => { events.push({ where: 'status', cmd: status }); },
+      recordEvent: async () => {},
+    },
+    exec: record('box'), controlExec: record('control'),
+    writeFile: () => ({ ok: true }), controlWriteFile: () => ({ ok: true }),
+    doApi: { deleteDroplet: async (id) => { events.push({ where: 'do', cmd: `delete-droplet ${id}` }); } },
+    projectCatalog: catalog ? {
+      forgetOwnedProject: async (target, opts) => {
+        events.push({ where: 'catalog', cmd: 'forget', target, pool: opts && opts.pool });
+        if (catalogThrows) throw new Error('catalog down');
+        return { project: 1, client: 1, memberships: 2 };
+      },
+    } : null,
+  };
+  const at = (pred) => events.findIndex(pred);
+  const cmds = (where) => events.filter((e) => e.where === where).map((e) => e.cmd);
+  return { deps, events, logs, at, cmds };
+}
+
+const saved = { hook: P.CONFIG.dnsHook };
+P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh';
+
+console.log('the erase, in order:');
+
+await ta('standalone: teardown legs, then the database, its role, the dumps, env + state, checkout, account — then forget, then the row', async () => {
+  const r = rig();
+  const res = await D.disconnectInstance(lantern, r.deps);
+  assert.equal(res.ok, true, JSON.stringify(res));
+  const c = r.cmds('control');
+  const idx = (re) => r.at((e) => e.where === 'control' && re.test(e.cmd));
+  const order = [
+    /systemctl disable --now lantern$/,
+    /rm -f \/etc\/caddy\/sites\/lantern\.caddy/,
+    /^dropdb --if-exists --force lantern$/,
+    /^psql -v ON_ERROR_STOP=1 -d postgres -c 'DROP ROLE IF EXISTS "bongos-lantern"'$/,
+    /^find \/var\/backups\/gds -maxdepth 1 -type f -name 'lantern-\[0-9\]/,
+    /^rm -rf \/etc\/lantern \/var\/lib\/bongos-lantern$/,
+    /^rm -rf \/srv\/cloudbongos\/lantern$/,
+    /userdel bongos-lantern/,
+  ];
+  const positions = order.map((re) => idx(re));
+  positions.forEach((p, i) => assert.ok(p >= 0, `missing ${order[i]} in:\n${c.join('\n')}`));
+  for (let i = 1; i < positions.length; i++) assert.ok(positions[i - 1] < positions[i], `${order[i - 1]} before ${order[i]}`);
+  const forget = r.at((e) => e.cmd === 'forget');
+  const del = r.at((e) => e.cmd === 'delete-row');
+  assert.ok(positions[positions.length - 1] < forget && forget < del, 'erase, then forget, then the row — last');
+  assert.deepEqual(r.events[forget].target, { clientId: 'lantern', origin: 'https://lantern.cloudbongos.com', ownerGithubId: 4242 });
+  assert.equal(r.events[forget].pool, r.deps.db, 'the runner\'s own pool, not the web tier\'s');
+  assert.deepEqual(r.events[del].params, [40]);
+  assert.equal(r.cmds('box').length, 0, 'a standalone erases where it ran — the control plane');
+});
+
+await ta('privileged: postgres commands run as postgres, filesystem and account removal are sudo', async () => {
+  const r = rig({ privileged: true });
+  await D.disconnectInstance(lantern, r.deps);
+  const c = r.cmds('control');
+  assert.ok(c.includes('sudo -u postgres dropdb --if-exists --force lantern'), c.join('\n'));
+  assert.ok(c.some((x) => /^sudo -u postgres psql .*DROP ROLE IF EXISTS "bongos-lantern"/.test(x)));
+  assert.ok(c.some((x) => /^sudo find \/var\/backups\/gds /.test(x)));
+  assert.ok(c.includes('sudo rm -rf /etc/lantern /var/lib/bongos-lantern'));
+  assert.ok(c.includes('sudo rm -rf /srv/cloudbongos/lantern'));
+  assert.ok(c.some((x) => /sudo userdel bongos-lantern/.test(x)));
+});
+
+await ta('co-tenant: the erase runs on the co-hosting box, there is no per-project checkout to remove, DNS stays on the control plane', async () => {
+  const r = rig();
+  await D.disconnectInstance({ ...lantern, hosting_shape: 'co-tenant' }, r.deps);
+  const box = r.cmds('box');
+  assert.ok(box.includes('dropdb --if-exists --force lantern'), box.join('\n'));
+  assert.ok(!box.some((x) => /\/srv\/cloudbongos/.test(x)), 'a co-tenant runs from the shared checkout — never rm it');
+  assert.ok(!r.cmds('control').some((x) => /dropdb/.test(x)));
+});
+
+await ta('dedicated: its droplet went whole, so nothing is erased by command — the catalog and the row still go', async () => {
+  const r = rig();
+  const res = await D.disconnectInstance({ ...lantern, hosting_shape: 'dedicated', droplet_id: 9 }, r.deps);
+  assert.equal(res.ok, true);
+  assert.ok(!r.events.some((e) => /dropdb|rm -rf|userdel|find /.test(e.cmd || '')), r.events.map((e) => e.cmd).join('\n'));
+  assert.ok(r.at((e) => e.cmd === 'forget') >= 0 && r.at((e) => e.cmd === 'delete-row') >= 0);
+});
+
+console.log('\nthe dump erase is exact:');
+
+t('the nightly filename matches, and a project whose name merely STARTS with this one\'s does not', () => {
+  const glob = D.dumpGlob({ slug: 'test', db_name: 'test' });
+  const re = new RegExp(`^${glob.replace(/\./g, '\\.').replace(/\[0-9\]/g, '[0-9]')}$`);
+  assert.ok(re.test('test-2026-09-16T031500Z.sql.gz'), 'the name db-backup-nightly.sh writes');
+  assert.ok(!re.test('test-nk-2026-09-16T031500Z.sql.gz'), 'another project\'s dump');
+  assert.ok(!re.test('test-2-2026-09-16T031500Z.sql.gz'), 'a project named test-2');
+  assert.ok(!re.test('test-2026-09-16T031500Z.sql'), 'not a finished dump');
+});
+
+console.log('\nfailure leaves a row to retry:');
+
+await ta('a failed database drop returns a retryable failure: no forget, and the row is NOT deleted', async () => {
+  const r = rig({ failOn: /dropdb/ });
+  const res = await D.disconnectInstance(lantern, r.deps);
+  assert.equal(res.ok, false);
+  assert.match(res.error, /dropdb|database/);
+  assert.equal(r.at((e) => e.cmd === 'forget'), -1);
+  assert.equal(r.at((e) => e.cmd === 'delete-row'), -1);
+});
+
+await ta('a teardown that throws erases nothing, forgets nothing and keeps the row', async () => {
+  const r = rig();
+  r.deps.provisioning.setInstanceStatus = async () => { throw new Error('db down'); };
+  await assert.rejects(D.disconnectInstance(lantern, r.deps), /db down/);
+  assert.equal(r.at((e) => /dropdb|DROP ROLE|userdel|rm -rf/.test(e.cmd)), -1, r.events.map((e) => e.cmd).join(' | '));
+  assert.equal(r.at((e) => e.cmd === 'forget'), -1);
+  assert.equal(r.at((e) => e.cmd === 'delete-row'), -1);
+});
+
+await ta('a failed catalog forget also keeps the row — deleting it would orphan the map entry for good', async () => {
+  const r = rig({ catalogThrows: true });
+  const res = await D.disconnectInstance(lantern, r.deps);
+  assert.equal(res.ok, false);
+  assert.equal(r.at((e) => e.cmd === 'delete-row'), -1);
+});
+
+await ta('no catalog on this control plane (platform-identity off): nothing to forget, the row still goes', async () => {
+  const r = rig({ catalog: false });
+  const res = await D.disconnectInstance(lantern, r.deps);
+  assert.equal(res.ok, true);
+  assert.ok(r.at((e) => e.cmd === 'delete-row') >= 0);
+});
+
+await ta('no address: never catalogued, so nothing is forgotten', async () => {
+  const r = rig();
+  await D.disconnectInstance({ ...lantern, domain: null }, r.deps);
+  assert.equal(r.at((e) => e.cmd === 'forget'), -1);
+  assert.ok(r.at((e) => e.cmd === 'delete-row') >= 0);
+});
+
+console.log('\nguards:');
+
+await ta('a dry run plans the erase and deletes nothing', async () => {
+  const r = rig({ apply: false });
+  const res = await D.disconnectInstance(lantern, r.deps);
+  assert.equal(res.ok, true);
+  assert.equal(r.at((e) => e.cmd === 'forget'), -1);
+  assert.equal(r.at((e) => e.cmd === 'delete-row'), -1);
+  assert.ok(r.logs.some((l) => /would delete the provisioning row/.test(l)), r.logs.join('\n'));
+});
+
+await ta('an invalid slug is refused before a single command runs — no rm -rf is ever built from it', async () => {
+  for (const slug of ['', '..', 'a/b', 'Lantern', '-x']) {
+    const r = rig();
+    const res = await D.disconnectInstance({ ...lantern, slug }, r.deps);
+    assert.equal(res.ok, false, slug);
+    assert.equal(r.events.length, 0, `${JSON.stringify(slug)} ran: ${r.events.map((e) => e.cmd).join(' | ')}`);
+  }
+});
+
+await ta('the drain loop dispatches a disconnect intent to this leg', async () => {
+  const r = rig();
+  let claims = 0, resolved = null;
+  r.deps.provisioning = {
+    ...r.deps.provisioning,
+    claimNextIntent: async () => (claims++ === 0 ? { id: 3, instance_id: 40, action: 'disconnect', attempts: 1 } : null),
+    getInstanceById: async () => ({ ...lantern }),
+    resolveIntent: async (_db, id, state) => { resolved = [id, state]; },
+    claimNextOAuthManifest: async () => null,
+  };
+  const out = await P.cmdRunIntents(r.deps);
+  assert.equal(out.ok, 1, JSON.stringify(out));
+  assert.deepEqual(resolved, [3, 'done'], 'resolving the (now cascaded) intent is a harmless no-op');
+  assert.ok(r.at((e) => e.cmd === 'delete-row') >= 0);
+});
+
+P.CONFIG.dnsHook = saved.hook;
+console.log(`\nprovision_disconnect: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);