@bongos/core 1.19.772 → 1.19.774

package/tests/provision_teardown_address.mjs

@@ -0,0 +1,230 @@
+// tests/provision_teardown_address.mjs
+//
+// Teardown reclaims the address itself (task 1002897, ADR 0181 §2, ADR 0200 §2).
+//
+// Before this, a torn-down project's hostname kept resolving to the platform and its
+// Caddy block kept proxying it to a port nothing listened on: every visitor got a bare
+// 502, and teardown only LOGGED "remove the Caddy block" for an operator. Live on
+// 2026-09-16, the five projects retired under task 1003946 all answered 502.
+//
+// What these tests pin: the teardown run removes the instance's <slug>.caddy snippet and
+// reloads Caddy on the box the project ran on, and parks the row's hostname at the
+// RFC 5737 blackhole through the same release env a re-point uses, from the control
+// plane. Both legs are best-effort — a hook failure never strands the row. The row keeps
+// its domain, so a revive stands the project back up at the same hostname. A platform-
+// reserved hostname is never parked. The database and dumps stay operator-only.
+//
+// Hermetic: recorded executors, a fake db, no shell, no network.
+//
+// Run:  node tests/provision_teardown_address.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const P = require('../scripts/gds/provision.js');
+const apexMod = require('../scripts/gds/instance-apex.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const HOOK = '/opt/infra/box-dns-cloudflare.sh';
+const lantern = { id: 5, slug: 'lantern', hosting_shape: 'standalone', status: 'active', owner_builder_id: 7, port: 3021, db_name: 'lantern', domain: 'lantern.cloudbongos.com', target_ref: null };
+
+// One ordered ledger across both executors and the status writes, so ordering is assertable.
+function rig({ apply = true, privileged = false, hookThrows = false } = {}) {
+  const events = [], logs = [];
+  const deps = {
+    apply, privileged, log: (m) => logs.push(String(m)),
+    db: { query: async () => ({ rows: [] }) },
+    provisioning: {
+      setInstanceStatus: async (_db, _id, status, extra) => { events.push({ where: 'status', status, extra }); },
+      recordEvent: async () => {},
+    },
+    exec: (cmd, opts) => { events.push({ where: 'box', cmd, env: opts && opts.env }); return { ok: true, stdout: '' }; },
+    controlExec: (cmd, opts) => {
+      events.push({ where: 'control', cmd, env: opts && opts.env });
+      if (hookThrows && cmd === HOOK) throw new Error('zone not reachable');
+      return { ok: true, stdout: '' };
+    },
+    writeFile: () => ({ ok: true }), controlWriteFile: () => ({ ok: true }),
+    doApi: { deleteDroplet: async (id) => { events.push({ where: 'do', cmd: `delete ${id}` }); } },
+  };
+  const on = (where) => events.filter((e) => e.where === where).map((e) => e.cmd);
+  const hookCalls = () => events.filter((e) => e.cmd === HOOK);
+  const at = (pred) => events.findIndex(pred);
+  return { deps, events, logs, on, hookCalls, at };
+}
+
+async function withHook(hook, fn) {
+  const saved = P.CONFIG.dnsHook;
+  P.CONFIG.dnsHook = hook;
+  try { return await fn(); } finally { P.CONFIG.dnsHook = saved; }
+}
+
+console.log('the Caddy leg:');
+
+await ta('standalone: the <slug>.caddy snippet is removed, THEN Caddy reloads — on the control plane, where it ran', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig();
+    await P.teardownInstance(lantern, r.deps);
+    const control = r.on('control');
+    const rm = control.findIndex((c) => c === 'rm -f /etc/caddy/sites/lantern.caddy');
+    const reload = control.findIndex((c) => c === 'systemctl reload caddy');
+    assert.ok(rm >= 0, `snippet removed: ${control.join(' | ')}`);
+    assert.ok(reload > rm, 'reload after the rm, so Caddy forgets the site');
+    assert.equal(r.on('box').length, 0, 'nothing crosses to the co-hosting box for a standalone');
+  });
+});
+
+await ta('co-tenant: the snippet comes off the co-hosting box it was written to', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig();
+    await P.teardownInstance({ ...lantern, hosting_shape: 'co-tenant' }, r.deps);
+    assert.ok(r.on('box').includes('rm -f /etc/caddy/sites/lantern.caddy'), r.on('box').join(' | '));
+    assert.ok(r.on('box').includes('systemctl reload caddy'));
+  });
+});
+
+await ta('privileged: the rm under /etc and the reload are sudo-prefixed', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig({ privileged: true });
+    await P.teardownInstance(lantern, r.deps);
+    assert.ok(r.on('control').includes('sudo rm -f /etc/caddy/sites/lantern.caddy'));
+    assert.ok(r.on('control').includes('sudo systemctl reload caddy'));
+  });
+});
+
+await ta('dedicated: no Caddy steps — the droplet (and its Caddy) is deleted whole', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig();
+    await P.teardownInstance({ ...lantern, hosting_shape: 'dedicated', droplet_id: 9 }, r.deps);
+    assert.ok(!r.events.some((e) => /caddy/.test(e.cmd || '')), r.events.map((e) => e.cmd).join(' | '));
+  });
+});
+
+console.log('\nthe DNS leg:');
+
+await ta('the hostname is parked at the blackhole through the release env, from the control plane, before the row reads torn_down', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig();
+    const res = await P.teardownInstance(lantern, r.deps);
+    assert.equal(res.ok, true);
+    const calls = r.hookCalls();
+    assert.equal(calls.length, 1);
+    assert.equal(calls[0].where, 'control', 'the Cloudflare token never leaves the control plane');
+    assert.deepEqual(calls[0].env, { BOX_HOSTNAME: 'lantern.cloudbongos.com', BOX_IP: '192.0.2.1', CLOUDFLARE_ZONE: 'cloudbongos.com', BOX_PROXIED: '0' });
+    assert.ok(r.at((e) => e.cmd === HOOK) < r.at((e) => e.status === 'torn_down'), 'parked before the row says torn_down');
+  });
+});
+
+await ta('dedicated: its hostname is parked too — the droplet IP it pointed at is gone', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig();
+    await P.teardownInstance({ ...lantern, hosting_shape: 'dedicated', droplet_id: 9 }, r.deps);
+    assert.equal(r.hookCalls().length, 1);
+    assert.equal(r.hookCalls()[0].where, 'control');
+  });
+});
+
+await ta('best-effort: a hook that throws is logged and the row still reaches torn_down', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig({ hookThrows: true });
+    const res = await P.teardownInstance(lantern, r.deps);
+    assert.equal(res.ok, true);
+    assert.equal(r.events.filter((e) => e.where === 'status').pop().status, 'torn_down');
+    assert.ok(r.logs.some((l) => /lantern\.cloudbongos\.com/.test(l) && /zone not reachable/.test(l)), r.logs.join('\n'));
+  });
+});
+
+await ta('no domain: nothing to park, and the snippet is still removed', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig();
+    await P.teardownInstance({ ...lantern, domain: null }, r.deps);
+    assert.equal(r.hookCalls().length, 0);
+    assert.ok(r.on('control').includes('rm -f /etc/caddy/sites/lantern.caddy'));
+  });
+});
+
+await ta('no DNS hook configured: no call, and the log names the address to park by hand', async () => {
+  await withHook(null, async () => {
+    const r = rig();
+    await P.teardownInstance(lantern, r.deps);
+    assert.equal(r.events.filter((e) => e.env).length, 0);
+    assert.ok(r.logs.some((l) => /lantern\.cloudbongos\.com/.test(l) && /BOX_DNS_HOOK unset/.test(l)), r.logs.join('\n'));
+  });
+});
+
+await ta('dry run: the park is planned in the log, never executed', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig({ apply: false });
+    await P.teardownInstance(lantern, r.deps);
+    assert.equal(r.hookCalls().length, 0);
+    assert.ok(r.logs.some((l) => /park lantern\.cloudbongos\.com -> 192\.0\.2\.1/.test(l)), r.logs.join('\n'));
+  });
+});
+
+await ta('a platform-reserved hostname (the apex, www, a deep label) is never parked', async () => {
+  const savedApex = apexMod.instanceApex;
+  apexMod.instanceApex = () => 'cloudbongos.com';
+  try {
+    await withHook(HOOK, async () => {
+      for (const domain of ['cloudbongos.com', 'www.cloudbongos.com', 'a.b.cloudbongos.com']) {
+        const r = rig();
+        await P.teardownInstance({ ...lantern, domain }, r.deps);
+        assert.equal(r.hookCalls().length, 0, `${domain} must not be blackholed`);
+        assert.ok(r.logs.some((l) => l.includes(domain) && /reserved/.test(l)), r.logs.join('\n'));
+      }
+      const ok = rig();
+      await P.teardownInstance(lantern, ok.deps);
+      assert.equal(ok.hookCalls().length, 1, 'an ordinary <slug>.<apex> is still parked');
+    });
+  } finally { apexMod.instanceApex = savedApex; }
+});
+
+console.log('\nwhat teardown still leaves, and what a revive gets back:');
+
+await ta('the operator line names only the database and the dumps — never the Caddy block', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig();
+    await P.teardownInstance(lantern, r.deps);
+    const line = r.logs.find((l) => /left for the operator/.test(l));
+    assert.ok(line, r.logs.join('\n'));
+    assert.match(line, /dropdb lantern/);
+    assert.match(line, /prune .*lantern-\*\.sql\.gz/);
+    assert.doesNotMatch(line, /Caddy/i);
+    assert.ok(!r.events.some((e) => /dropdb|\.sql\.gz/.test(e.cmd || '')), 'data is never destroyed by a teardown');
+  });
+});
+
+await ta('the row keeps its domain and port, and a revive re-UPSERTs the SAME hostname to the box and rewrites its snippet', async () => {
+  const savedCp = P.CONFIG.controlPlaneIp;
+  P.CONFIG.controlPlaneIp = '198.51.100.20';
+  try {
+    await withHook(HOOK, async () => {
+      const r = rig();
+      await P.teardownInstance({ ...lantern, target_ref: 'example-owner/lantern' }, r.deps);
+      for (const e of r.events.filter((x) => x.where === 'status')) {
+        assert.ok(!e.extra || (!('domain' in e.extra) && !('port' in e.extra)), `status write must not release the claim: ${JSON.stringify(e.extra)}`);
+      }
+      const dns = [], writes = [];
+      await P.provisionInstance({ ...lantern, status: 'torn_down', target_ref: 'example-owner/lantern' }, {
+        apply: false, log: () => {},
+        db: { query: async () => ({ rows: [] }) },
+        provisioning: { setInstanceStatus: async () => {}, recordEvent: async () => {} },
+        exec: () => ({ ok: true, stdout: '' }),
+        controlExec: (cmd, opts) => { if (cmd === HOOK) dns.push(opts.env); return { ok: true, stdout: '' }; },
+        writeFile: () => ({ ok: true }), controlWriteFile: (p) => { writes.push(p); return { ok: true }; },
+        doApi: null, checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
+      });
+      assert.ok(dns.some((env) => env.BOX_HOSTNAME === 'lantern.cloudbongos.com' && env.BOX_IP === '198.51.100.20'), JSON.stringify(dns));
+      assert.ok(writes.some((p) => p.endsWith('/lantern.caddy')), writes.join(' | '));
+    });
+  } finally { P.CONFIG.controlPlaneIp = savedCp; }
+});
+
+console.log(`\nprovision_teardown_address: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/provisioning_capacity_gate.mjs

@@ -0,0 +1,192 @@
+// tests/provisioning_capacity_gate.mjs
+//
+// A full box refused at the create route (task 1003938, ADR 0285).
+//
+// Task 1003927 put the ceiling in the RUNNER: a project that does not fit is refused at
+// placement, retried, then retired with the reason on the card — minutes after the wizard
+// said "requested". This gate answers the same ceiling up front, as a 409 `box_full`
+// naming N of M, before any row or intent exists.
+//
+// What these tests pin: the refusal lands before createInstance; a box the web tier cannot
+// count (dedicated, a remote co-host) is never refused here; a re-request of a row that
+// already holds its slot stays idempotent, while a revive (which takes a slot) is counted;
+// the live-memory floor stays the runner's; and a capacity read that fails ADMITS, because
+// the runner remains the wall.
+//
+// Hermetic: capacity.fleetCapacity is re-pointed at the real arithmetic over a fake count
+// and a fixed meminfo; the route's data access is stubbed; auth is faked. No Postgres.
+//
+// Run:  node tests/provisioning_capacity_gate.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// The live control plane on 2026-09-16: 1968 MiB total → a measured ceiling of 15.
+const MEMINFO_2GB = 'MemTotal:        2015216 kB\nMemAvailable:    1135180 kB\n';
+const MEMINFO_TIGHT = 'MemTotal:        2015216 kB\nMemAvailable:      120000 kB\n';   // under the 256 MB floor
+
+const capacity = require('../modules/provisioning/capacity.js');
+const realFleetCapacity = capacity.fleetCapacity;
+let placed = 0, meminfo = MEMINFO_2GB, capacityReads = 0, capacityFails = false;
+capacity.fleetCapacity = async () => {
+  capacityReads++;
+  if (capacityFails) throw new Error('count unavailable');
+  const db = { query: async () => ({ rows: [{ n: placed }] }) };
+  return realFleetCapacity(db, { meminfo, remoteHost: null });
+};
+
+// ── stubs: the route's data access + auth ────────────────────────────────────────
+const provisioning = require('../modules/provisioning/provisioning.js');
+let existing = null, lastCreateArgs = null;
+provisioning.getInstanceBySlug = async () => existing;
+provisioning.createInstance = async (_db, args) => {
+  lastCreateArgs = args;
+  if (existing) return { instance: existing, created: false };
+  return { instance: { id: 42, owner_builder_id: 7, slug: args.slug, hosting_shape: args.hostingShape, status: 'requested' }, created: true };
+};
+provisioning.enqueueIntent = async () => ({ intent: { id: 1, state: 'pending' }, created: true });
+provisioning.getOpenIntent = async () => null;
+provisioning.recordEvent = async () => {};
+
+const api = require('../src/module-api.js');
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
+api.requirePermission = () => (_req, _res, next) => next();
+
+const express = require('express');
+const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(details || (typeof opts === 'object' ? opts : {})) } });
+  };
+  next();
+});
+app.use('/api/bongos', provisioningRoutes());
+
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function post(body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}/provisioning/instances`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+function reset({ count = 0, row = null, mem = MEMINFO_2GB, fails = false } = {}) {
+  placed = count; existing = row; meminfo = mem; capacityFails = fails;
+  capacityReads = 0; lastCreateArgs = null;
+  delete process.env.PROVISION_REMOTE_HOST;
+}
+
+const WIZARD = { slug: 'lantern', hosting_shape: 'standalone', no_address: true };
+
+// ── the wall ──────────────────────────────────────────────────────────────────────
+
+await ta('a full box answers 409 box_full naming N of M, and no row is created', async () => {
+  reset({ count: 15 });
+  const res = await post(WIZARD);
+  assert.equal(res.status, 409, res.raw);
+  assert.equal(res.body.error.code, 'box_full');
+  assert.match(res.body.error.message, /15 of 15 project slots/);
+  assert.equal(res.body.error.details.placed, 15);
+  assert.equal(res.body.error.details.ceiling, 15);
+  assert.equal(lastCreateArgs, null, 'the refusal lands before createInstance');
+});
+
+await ta('a box with one slot left admits the create', async () => {
+  reset({ count: 14 });
+  const res = await post(WIZARD);
+  assert.equal(res.status, 201, res.raw);
+  assert.equal(lastCreateArgs && lastCreateArgs.slug, 'lantern');
+});
+
+await ta('an absent shape (the co-tenant default) on a local box is counted too', async () => {
+  reset({ count: 15 });
+  const res = await post({ slug: 'lantern', no_address: true });
+  assert.equal(res.status, 409, res.raw);
+  assert.equal(res.body.error.code, 'box_full');
+});
+
+// ── boxes the web tier cannot count are the runner's ──────────────────────────────
+
+await ta('dedicated is its own box: never refused here, and the count is never read', async () => {
+  reset({ count: 15 });
+  const res = await post({ slug: 'lantern', hosting_shape: 'dedicated', no_address: true });
+  assert.equal(res.status, 201, res.raw);
+  assert.equal(capacityReads, 0);
+});
+
+await ta('a co-tenant under remote-exec lands on a box this host cannot measure: admitted', async () => {
+  reset({ count: 15 });
+  process.env.PROVISION_REMOTE_HOST = 'overflow.example';
+  const res = await post({ slug: 'lantern', hosting_shape: 'co-tenant', no_address: true });
+  assert.equal(res.status, 201, res.raw);
+  assert.equal(capacityReads, 0);
+  delete process.env.PROVISION_REMOTE_HOST;
+});
+
+await ta('the live-memory floor is left to the runner: slots free + memory tight still admits', async () => {
+  reset({ count: 3, mem: MEMINFO_TIGHT });
+  const res = await post(WIZARD);
+  assert.equal(res.status, 201, res.raw);
+});
+
+// ── re-requests ───────────────────────────────────────────────────────────────────
+
+await ta('a re-request of the owner\'s ACTIVE project on a full box stays idempotent (no box_full)', async () => {
+  reset({ count: 15, row: { id: 42, owner_builder_id: 7, slug: 'lantern', hosting_shape: 'standalone', status: 'active' } });
+  const res = await post(WIZARD);
+  assert.notEqual(res.status, 409, res.raw);
+  assert.ok(res.status < 300, res.raw);
+});
+
+await ta('a revive of a torn-down project takes a slot, so a full box refuses it', async () => {
+  reset({ count: 15, row: { id: 42, owner_builder_id: 7, slug: 'lantern', hosting_shape: 'standalone', status: 'torn_down' } });
+  const res = await post(WIZARD);
+  assert.equal(res.status, 409, res.raw);
+  assert.equal(res.body.error.code, 'box_full');
+  assert.equal(lastCreateArgs, null);
+});
+
+// ── the gate is an early answer, not the enforcement ──────────────────────────────
+
+await ta('a capacity read that fails ADMITS — the runner remains the wall', async () => {
+  reset({ count: 15, fails: true });
+  const res = await post(WIZARD);
+  assert.equal(res.status, 201, res.raw);
+});
+
+await ta('a malformed slug or shape gets the handler\'s 400, not box_full', async () => {
+  for (const body of [{ slug: 'Bad Slug!', hosting_shape: 'standalone' }, { slug: 'lantern', hosting_shape: 'giant' }]) {
+    reset({ count: 15 });
+    const res = await post(body);
+    assert.equal(res.status, 400, `${JSON.stringify(body)} → ${res.raw}`);
+  }
+});
+
+capacity.fleetCapacity = realFleetCapacity;
+server.close();
+console.log(`\nprovisioning_capacity_gate: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/provisioning_disconnect.mjs

@@ -0,0 +1,231 @@
+// tests/provisioning_disconnect.mjs
+//
+// "Disconnect from Bongos entirely" — the web tier (task 1003249, ADR 0290).
+//
+// "Take it offline" only tears a project down: the database, backups and address stay
+// reserved (ADR 0181). The owner asked for a separate, truer delete. The web tier's half
+// is the same shape as every other provisioning action — it only ENQUEUES; the runner does
+// the destruction (scripts/gds/provision-disconnect.js, tests/provision_disconnect.mjs).
+//
+// What these tests pin:
+//   • the schema: a 'disconnect' intent action, admitted by migration provisioning_016,
+//     which (as the NEWEST action migration) owns the strict INTENT_ACTIONS set equality
+//   • the queue: a disconnect is refused while ANY other intent is open (never superseded —
+//     a destructive run must not race a standup), and is idempotent against itself
+//   • the route: own-scoped (404 for anyone else) with the archon override, a server-side
+//     typed-name confirm, a 409 naming the blocking run, an audit event, and copy that makes
+//     no wall-clock promise
+//
+// DB-free: data access is stubbed on the cached module objects; auth is faked.
+//
+// Run:  node tests/provisioning_disconnect.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+const disconnect = require('../modules/provisioning/disconnect.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const PROMISE = /shortly|briefly|minute|second|soon\b/i;
+
+console.log('the schema:');
+
+t("INTENT_ACTIONS includes 'disconnect', in strict lockstep with the provisioning_016 CHECK (the newest action migration)", () => {
+  assert.ok(provisioning.INTENT_ACTIONS.includes('disconnect'));
+  const sql = readFileSync(new URL('../modules/provisioning/migrations/provisioning_016_disconnect.sql', import.meta.url), 'utf8');
+  const m = /CHECK \(action IN \(([^)]*)\)\)/.exec(sql);
+  assert.ok(m, 'the migration widens the action CHECK');
+  const inSql = m[1].split(',').map((s) => s.trim().replace(/^'|'$/g, '')).sort();
+  assert.deepEqual(inSql, [...provisioning.INTENT_ACTIONS].sort(), 'the CHECK a live DB ends with and INTENT_ACTIONS carry the same set');
+  assert.match(sql, /INSERT INTO schema_migrations \(version\) VALUES \('provisioning_016_disconnect'\)/, 'self-registers');
+});
+
+console.log('\nthe queue:');
+
+// A fake db over one open-intent slot, mirroring ux_provisioning_intents_open.
+function queueDb({ open = null } = {}) {
+  const inserts = [], deletes = [];
+  return {
+    inserts, deletes,
+    query: async (sql, params) => {
+      if (/SELECT \* FROM provisioning_intents/.test(sql)) return { rows: open ? [open] : [] };
+      if (/INSERT INTO provisioning_intents/.test(sql)) {
+        if (open) { const e = new Error('dup'); e.code = '23505'; throw e; }
+        inserts.push(params);
+        return { rows: [{ id: 99, instance_id: params[0], action: params[1], requested_by: params[2], state: 'pending' }] };
+      }
+      if (/DELETE FROM provisioning_instances/.test(sql)) { deletes.push(params); return { rowCount: 1, rows: [] }; }
+      throw new Error(`unexpected SQL: ${sql}`);
+    },
+  };
+}
+
+await ta('an idle project queues a disconnect intent', async () => {
+  const db = queueDb();
+  const r = await disconnect.enqueueDisconnect(db, 7, 'api:self');
+  assert.equal(r.created, true);
+  assert.deepEqual(db.inserts, [[7, 'disconnect', 'api:self']]);
+});
+
+for (const [action, state] of [['provision', 'pending'], ['provision', 'running'], ['teardown', 'running'], ['restart', 'pending']]) {
+  await ta(`a ${state} '${action}' run REFUSES the disconnect — it is never superseded`, async () => {
+    const db = queueDb({ open: { id: 5, action, state } });
+    const r = await disconnect.enqueueDisconnect(db, 7, 'api:self');
+    assert.equal(r.conflict, 'open_intent');
+    assert.equal(r.intent.action, action);
+    assert.equal(db.inserts.length, 0);
+  });
+}
+
+await ta('an open disconnect makes a second request idempotent, not a conflict', async () => {
+  const db = queueDb({ open: { id: 5, action: 'disconnect', state: 'pending' } });
+  const r = await disconnect.enqueueDisconnect(db, 7, 'api:self');
+  assert.equal(r.created, false);
+  assert.equal(r.conflict, undefined);
+});
+
+await ta('deleteInstance removes the row by id (its intents, events and manifests cascade)', async () => {
+  const db = queueDb();
+  assert.equal(await disconnect.deleteInstance(db, 7), 1);
+  assert.deepEqual(db.deletes, [[7]]);
+});
+
+console.log('\nthe route:');
+
+let instance = null, enqueued = [], events = [], enqueueResult = null;
+provisioning.getInstanceById = async (_db, id) => (instance ? { ...instance, id } : null);
+provisioning.recordEvent = async (_db, e) => { events.push(e); };
+disconnect.enqueueDisconnect = async (_db, id, requestedBy) => { enqueued.push([id, requestedBy]); return enqueueResult; };
+
+const api = require('../src/module-api.js');
+let builder = { id: 7, rank: 'xenos', github_login: 'owner' };
+api.requireBuilder = (req, _res, next) => { req.builder = builder; next(); };
+
+const express = require('express');
+const disconnectRoutes = require('../modules/provisioning/routes/disconnect.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    const extra = typeof opts === 'object' ? opts : {};
+    res.status(status).json({ error: { code, message: extra.message || code, details: details || extra.details } });
+  };
+  next();
+});
+app.use('/api/bongos', disconnectRoutes());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function post(path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}${path}`, {
+      method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+function reset({ inst = { owner_builder_id: 7, slug: 'lantern', status: 'active' }, who = { id: 7, rank: 'xenos', github_login: 'owner' }, result = { intent: { id: 1, action: 'disconnect', state: 'pending' }, created: true } } = {}) {
+  instance = inst; builder = who; enqueueResult = result; enqueued = []; events = [];
+}
+const URL_ = '/provisioning/instances/40/disconnect';
+
+await ta('the owner, typing the name, queues it — with an audit event and no wall-clock promise', async () => {
+  reset();
+  const res = await post(URL_, { confirm_slug: 'lantern' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.queued, true);
+  assert.equal(res.body.action, 'disconnect');
+  assert.doesNotMatch(res.body.message, PROMISE);
+  assert.deepEqual(enqueued, [[40, 'api:self']]);
+  assert.equal(events.length, 1);
+  assert.equal(events[0].event, 'disconnect');
+  assert.equal(events[0].actor, 'api:self');
+});
+
+for (const state of ['requested', 'active', 'error', 'torn_down']) {
+  await ta(`reachable from '${state}' — the state machine is the queue's job, not a status gate`, async () => {
+    reset({ inst: { owner_builder_id: 7, slug: 'lantern', status: state } });
+    const res = await post(URL_, { confirm_slug: 'lantern' });
+    assert.equal(res.status, 200, res.raw);
+  });
+}
+
+await ta('the typed name is checked on the SERVER: a wrong or missing name is refused and nothing is queued', async () => {
+  // A missing name fails validation outright — it is never stringified and compared, so a
+  // project literally named `undefined` cannot be disconnected by omitting the field.
+  for (const [body, code] of [[{ confirm_slug: 'lanterns' }, 'confirm_mismatch'], [{ confirm_slug: '' }, 'confirm_mismatch'], [{}, 'validation_failed']]) {
+    reset();
+    const res = await post(URL_, body);
+    assert.equal(res.status, 400, `${JSON.stringify(body)} → ${res.raw}`);
+    assert.equal(res.body.error.code, code, `${JSON.stringify(body)} → ${res.raw}`);
+    assert.equal(enqueued.length, 0);
+  }
+  reset();
+  const ok = await post(URL_, { confirm_slug: '  Lantern ' });
+  assert.equal(ok.status, 200, 'case and surrounding space are forgiven, the name is not');
+});
+
+await ta('someone else\'s project is a 404 — it does not leak that the id exists', async () => {
+  reset({ who: { id: 8, rank: 'metic', github_login: 'other' } });
+  const res = await post(URL_, { confirm_slug: 'lantern' });
+  assert.equal(res.status, 404, res.raw);
+  assert.equal(enqueued.length, 0);
+});
+
+await ta('an archon may disconnect any project, and the event names WHICH archon', async () => {
+  reset({ who: { id: 3, rank: 'archon', github_login: 'arch' } });
+  const res = await post(URL_, { confirm_slug: 'lantern' });
+  assert.equal(res.status, 200, res.raw);
+  assert.deepEqual(enqueued, [[40, 'api:archon:3']]);
+  assert.equal(events[0].actor, 'api:archon:3');
+});
+
+await ta('an open run answers 409 naming it, and records nothing', async () => {
+  reset({ result: { intent: { id: 5, action: 'provision', state: 'running' }, created: false, conflict: 'open_intent' } });
+  const res = await post(URL_, { confirm_slug: 'lantern' });
+  assert.equal(res.status, 409, res.raw);
+  assert.equal(res.body.error.code, 'intent_conflict');
+  assert.match(res.body.error.message, /provision/);
+  assert.doesNotMatch(res.body.error.message, PROMISE);
+  assert.equal(events.length, 0);
+});
+
+await ta('a repeated request while the disconnect is queued says so, and writes no second event', async () => {
+  reset({ result: { intent: { id: 1, action: 'disconnect', state: 'running' }, created: false } });
+  const res = await post(URL_, { confirm_slug: 'lantern' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.queued, false);
+  assert.equal(events.length, 0);
+});
+
+await ta('a missing project is a 404', async () => {
+  reset({ inst: null });
+  const res = await post(URL_, { confirm_slug: 'lantern' });
+  assert.equal(res.status, 404, res.raw);
+});
+
+server.close();
+console.log(`\nprovisioning_disconnect: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/provisioning_restart.mjs

@@ -56,11 +56,11 @@ t("INTENT_ACTIONS includes 'restart', in lockstep with the provisioning_011 CHEC
   const sql = readFileSync(new URL('../modules/provisioning/migrations/provisioning_011_restart.sql', import.meta.url), 'utf8');
   const m = /CHECK \(action IN \(([^)]*)\)\)/.exec(sql);
   assert.ok(m, 'the migration widens the action CHECK');
-  const inSql = m[1].split(',').map((s) => s.trim().replace(/^'|'$/g, '')).sort();
-  // The NEWEST migration owns the strict set equality — the CHECK a live DB
-  // ends up with is the last one applied, so this is the assertion that would
-  // catch an action added in code but never admitted by the schema.
-  assert.deepEqual(inSql, [...provisioning.INTENT_ACTIONS].sort(), 'the CHECK and INTENT_ACTIONS carry the same set');
+  const inSql = m[1].split(',').map((s) => s.trim().replace(/^'|'$/g, ''));
+  assert.ok(inSql.includes('restart'), 'this migration is the one that admitted it');
+  // The NEWEST action migration owns the strict set equality (provisioning_016,
+  // tests/provisioning_disconnect.mjs); an older one is a prefix of the set.
+  for (const a of inSql) assert.ok(provisioning.INTENT_ACTIONS.includes(a), `${a} is still an INTENT_ACTION`);
   assert.match(sql, /INSERT INTO schema_migrations \(version\) VALUES \('provisioning_011_restart'\)/, 'self-registers');
 });