@bongos/core 1.19.773 → 1.19.774

package/tests/projects_hub_pre_uat.mjs

@@ -63,7 +63,8 @@ test('addressRow branches by state before it trusts the domain — torn down and
   const stateFirst = body.indexOf("inst.status === 'torn_down' || inst.status === 'tearing_down'");
   const domainTest = body.indexOf('if (inst.domain)');
   assert.ok(stateFirst >= 0 && stateFirst < domainTest, 'the torn-down test comes before the domain test');
-  assert.match(body, /stays reserved for this project — it shows an error page until you bring it back/, 'torn down: the address is reserved, not answering');
+  assert.match(body, /stays reserved for this project — nothing answers there until you bring it back/, 'torn down: the address is reserved, and teardown parked it (task 1002897)');
+  assert.doesNotMatch(body, /shows an error page/, 'the pre-park promise is gone — teardown removes the proxy block that served it');
   assert.match(body, /if \(inst\.status === 'error'\) return 'Address <code>/, 'snagged has its own line');
   assert.match(body, /nothing is answering there yet/);
   assert.equal((body.match(/— it answers there once the instance is live\.'/g) || []).length, 1, 'the standup promise survives only for queued / standing-up');
@@ -428,13 +429,14 @@ test('the minute tick keeps a half-typed domain typed, and its receipt on the pa
 });
 
 /* ── the owner's five calls of 2026-08-24 (task 1003250) ── */
-test('decision 6 — the manage section is "Take it offline", and the teardown truth ends by saying nothing erases', () => {
+test('decision 6 — the manage section is "Take it offline", and the teardown truth ends by saying taking it offline erases nothing', () => {
   const del = (HUB.match(/<div class="card mSec" id="mDelete">[\s\S]*?<\/details>\s*<\/div>/) || [''])[0];
   assert.ok(del, '#mDelete exists');
   assert.match(del, /<h2[^>]*>Take it offline<\/h2>/, 'the heading says what the control does');
   assert.doesNotMatch(HUB, /Delete the project/, 'the word "Delete" no longer promises an erase anywhere on the page');
   const truth = fn('teardownTruth');
-  assert.equal((truth.match(/until you bring it back\. Nothing here erases a project\.'/g) || []).length, 2, 'both hosting shapes end on the same sentence');
+  // scoped to THIS control since task 1003249: the page now also carries the true delete
+  assert.equal((truth.match(/until you bring it back\. Taking it offline erases nothing\.'/g) || []).length, 2, 'both hosting shapes end on the same sentence');
 });
 
 test('decision 5 — the Type step says where the type can be changed (task 1003504)', () => {

package/tests/provision_disconnect.mjs

@@ -0,0 +1,231 @@
+// tests/provision_disconnect.mjs
+//
+// "Disconnect from Bongos entirely" — the runner leg (task 1003249, ADR 0290).
+//
+// The web tier only queues a 'disconnect' intent (tests/provisioning_disconnect.mjs). This is
+// where the project actually goes: the teardown legs first (units, Caddy block, parked DNS,
+// deploy key), then the erase a teardown deliberately never does — the database, its role, its
+// nightly dumps, its env file, state dir, checkout and unix account — then its catalog,
+// membership and client rows through the `project.catalog` port, and LAST the provisioning row,
+// which releases the name, the port and the address.
+//
+// What these tests pin:
+//   • ORDER: nothing is erased until the teardown ran; the row is deleted only after every
+//     erase and the catalog forget succeeded, so a failure leaves a row the runner can retry
+//   • the dump erase matches the nightly filename EXACTLY, so `test` never erases `test-nk`
+//   • each shape erases where its data lives (standalone: control plane; co-tenant: the
+//     co-hosting box; dedicated: nothing — its droplet went whole)
+//   • a dry run erases nothing and deletes nothing; an invalid slug is refused before any command
+//
+// Hermetic: recorded executors, a fake db, a fake catalog port. No shell, no Postgres.
+//
+// Run:  node tests/provision_disconnect.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const P = require('../scripts/gds/provision.js');
+const D = require('../scripts/gds/provision-disconnect.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const lantern = { id: 40, slug: 'lantern', hosting_shape: 'standalone', status: 'torn_down', owner_builder_id: 7, port: 3021, db_name: 'lantern', domain: 'lantern.cloudbongos.com', target_ref: null };
+
+function rig({ apply = true, privileged = false, failOn = null, catalogThrows = false, catalog = true } = {}) {
+  const events = [], logs = [];
+  const record = (where) => (cmd, opts) => {
+    events.push({ where, cmd, env: opts && opts.env });
+    if (failOn && failOn.test(cmd)) throw new Error(`Command failed: ${cmd}`);
+    return { ok: true, stdout: '' };
+  };
+  const deps = {
+    apply, privileged, log: (m) => logs.push(String(m)),
+    db: {
+      query: async (sql, params) => {
+        if (/SELECT github_id FROM builders/.test(sql)) return { rows: [{ github_id: 4242 }] };
+        if (/DELETE FROM provisioning_instances/.test(sql)) { events.push({ where: 'db', cmd: 'delete-row', params }); return { rowCount: 1, rows: [] }; }
+        return { rows: [] };
+      },
+    },
+    provisioning: {
+      setInstanceStatus: async (_db, _id, status) => { events.push({ where: 'status', cmd: status }); },
+      recordEvent: async () => {},
+    },
+    exec: record('box'), controlExec: record('control'),
+    writeFile: () => ({ ok: true }), controlWriteFile: () => ({ ok: true }),
+    doApi: { deleteDroplet: async (id) => { events.push({ where: 'do', cmd: `delete-droplet ${id}` }); } },
+    projectCatalog: catalog ? {
+      forgetOwnedProject: async (target, opts) => {
+        events.push({ where: 'catalog', cmd: 'forget', target, pool: opts && opts.pool });
+        if (catalogThrows) throw new Error('catalog down');
+        return { project: 1, client: 1, memberships: 2 };
+      },
+    } : null,
+  };
+  const at = (pred) => events.findIndex(pred);
+  const cmds = (where) => events.filter((e) => e.where === where).map((e) => e.cmd);
+  return { deps, events, logs, at, cmds };
+}
+
+const saved = { hook: P.CONFIG.dnsHook };
+P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh';
+
+console.log('the erase, in order:');
+
+await ta('standalone: teardown legs, then the database, its role, the dumps, env + state, checkout, account — then forget, then the row', async () => {
+  const r = rig();
+  const res = await D.disconnectInstance(lantern, r.deps);
+  assert.equal(res.ok, true, JSON.stringify(res));
+  const c = r.cmds('control');
+  const idx = (re) => r.at((e) => e.where === 'control' && re.test(e.cmd));
+  const order = [
+    /systemctl disable --now lantern$/,
+    /rm -f \/etc\/caddy\/sites\/lantern\.caddy/,
+    /^dropdb --if-exists --force lantern$/,
+    /^psql -v ON_ERROR_STOP=1 -d postgres -c 'DROP ROLE IF EXISTS "bongos-lantern"'$/,
+    /^find \/var\/backups\/gds -maxdepth 1 -type f -name 'lantern-\[0-9\]/,
+    /^rm -rf \/etc\/lantern \/var\/lib\/bongos-lantern$/,
+    /^rm -rf \/srv\/cloudbongos\/lantern$/,
+    /userdel bongos-lantern/,
+  ];
+  const positions = order.map((re) => idx(re));
+  positions.forEach((p, i) => assert.ok(p >= 0, `missing ${order[i]} in:\n${c.join('\n')}`));
+  for (let i = 1; i < positions.length; i++) assert.ok(positions[i - 1] < positions[i], `${order[i - 1]} before ${order[i]}`);
+  const forget = r.at((e) => e.cmd === 'forget');
+  const del = r.at((e) => e.cmd === 'delete-row');
+  assert.ok(positions[positions.length - 1] < forget && forget < del, 'erase, then forget, then the row — last');
+  assert.deepEqual(r.events[forget].target, { clientId: 'lantern', origin: 'https://lantern.cloudbongos.com', ownerGithubId: 4242 });
+  assert.equal(r.events[forget].pool, r.deps.db, 'the runner\'s own pool, not the web tier\'s');
+  assert.deepEqual(r.events[del].params, [40]);
+  assert.equal(r.cmds('box').length, 0, 'a standalone erases where it ran — the control plane');
+});
+
+await ta('privileged: postgres commands run as postgres, filesystem and account removal are sudo', async () => {
+  const r = rig({ privileged: true });
+  await D.disconnectInstance(lantern, r.deps);
+  const c = r.cmds('control');
+  assert.ok(c.includes('sudo -u postgres dropdb --if-exists --force lantern'), c.join('\n'));
+  assert.ok(c.some((x) => /^sudo -u postgres psql .*DROP ROLE IF EXISTS "bongos-lantern"/.test(x)));
+  assert.ok(c.some((x) => /^sudo find \/var\/backups\/gds /.test(x)));
+  assert.ok(c.includes('sudo rm -rf /etc/lantern /var/lib/bongos-lantern'));
+  assert.ok(c.includes('sudo rm -rf /srv/cloudbongos/lantern'));
+  assert.ok(c.some((x) => /sudo userdel bongos-lantern/.test(x)));
+});
+
+await ta('co-tenant: the erase runs on the co-hosting box, there is no per-project checkout to remove, DNS stays on the control plane', async () => {
+  const r = rig();
+  await D.disconnectInstance({ ...lantern, hosting_shape: 'co-tenant' }, r.deps);
+  const box = r.cmds('box');
+  assert.ok(box.includes('dropdb --if-exists --force lantern'), box.join('\n'));
+  assert.ok(!box.some((x) => /\/srv\/cloudbongos/.test(x)), 'a co-tenant runs from the shared checkout — never rm it');
+  assert.ok(!r.cmds('control').some((x) => /dropdb/.test(x)));
+});
+
+await ta('dedicated: its droplet went whole, so nothing is erased by command — the catalog and the row still go', async () => {
+  const r = rig();
+  const res = await D.disconnectInstance({ ...lantern, hosting_shape: 'dedicated', droplet_id: 9 }, r.deps);
+  assert.equal(res.ok, true);
+  assert.ok(!r.events.some((e) => /dropdb|rm -rf|userdel|find /.test(e.cmd || '')), r.events.map((e) => e.cmd).join('\n'));
+  assert.ok(r.at((e) => e.cmd === 'forget') >= 0 && r.at((e) => e.cmd === 'delete-row') >= 0);
+});
+
+console.log('\nthe dump erase is exact:');
+
+t('the nightly filename matches, and a project whose name merely STARTS with this one\'s does not', () => {
+  const glob = D.dumpGlob({ slug: 'test', db_name: 'test' });
+  const re = new RegExp(`^${glob.replace(/\./g, '\\.').replace(/\[0-9\]/g, '[0-9]')}$`);
+  assert.ok(re.test('test-2026-09-16T031500Z.sql.gz'), 'the name db-backup-nightly.sh writes');
+  assert.ok(!re.test('test-nk-2026-09-16T031500Z.sql.gz'), 'another project\'s dump');
+  assert.ok(!re.test('test-2-2026-09-16T031500Z.sql.gz'), 'a project named test-2');
+  assert.ok(!re.test('test-2026-09-16T031500Z.sql'), 'not a finished dump');
+});
+
+console.log('\nfailure leaves a row to retry:');
+
+await ta('a failed database drop returns a retryable failure: no forget, and the row is NOT deleted', async () => {
+  const r = rig({ failOn: /dropdb/ });
+  const res = await D.disconnectInstance(lantern, r.deps);
+  assert.equal(res.ok, false);
+  assert.match(res.error, /dropdb|database/);
+  assert.equal(r.at((e) => e.cmd === 'forget'), -1);
+  assert.equal(r.at((e) => e.cmd === 'delete-row'), -1);
+});
+
+await ta('a teardown that throws erases nothing, forgets nothing and keeps the row', async () => {
+  const r = rig();
+  r.deps.provisioning.setInstanceStatus = async () => { throw new Error('db down'); };
+  await assert.rejects(D.disconnectInstance(lantern, r.deps), /db down/);
+  assert.equal(r.at((e) => /dropdb|DROP ROLE|userdel|rm -rf/.test(e.cmd)), -1, r.events.map((e) => e.cmd).join(' | '));
+  assert.equal(r.at((e) => e.cmd === 'forget'), -1);
+  assert.equal(r.at((e) => e.cmd === 'delete-row'), -1);
+});
+
+await ta('a failed catalog forget also keeps the row — deleting it would orphan the map entry for good', async () => {
+  const r = rig({ catalogThrows: true });
+  const res = await D.disconnectInstance(lantern, r.deps);
+  assert.equal(res.ok, false);
+  assert.equal(r.at((e) => e.cmd === 'delete-row'), -1);
+});
+
+await ta('no catalog on this control plane (platform-identity off): nothing to forget, the row still goes', async () => {
+  const r = rig({ catalog: false });
+  const res = await D.disconnectInstance(lantern, r.deps);
+  assert.equal(res.ok, true);
+  assert.ok(r.at((e) => e.cmd === 'delete-row') >= 0);
+});
+
+await ta('no address: never catalogued, so nothing is forgotten', async () => {
+  const r = rig();
+  await D.disconnectInstance({ ...lantern, domain: null }, r.deps);
+  assert.equal(r.at((e) => e.cmd === 'forget'), -1);
+  assert.ok(r.at((e) => e.cmd === 'delete-row') >= 0);
+});
+
+console.log('\nguards:');
+
+await ta('a dry run plans the erase and deletes nothing', async () => {
+  const r = rig({ apply: false });
+  const res = await D.disconnectInstance(lantern, r.deps);
+  assert.equal(res.ok, true);
+  assert.equal(r.at((e) => e.cmd === 'forget'), -1);
+  assert.equal(r.at((e) => e.cmd === 'delete-row'), -1);
+  assert.ok(r.logs.some((l) => /would delete the provisioning row/.test(l)), r.logs.join('\n'));
+});
+
+await ta('an invalid slug is refused before a single command runs — no rm -rf is ever built from it', async () => {
+  for (const slug of ['', '..', 'a/b', 'Lantern', '-x']) {
+    const r = rig();
+    const res = await D.disconnectInstance({ ...lantern, slug }, r.deps);
+    assert.equal(res.ok, false, slug);
+    assert.equal(r.events.length, 0, `${JSON.stringify(slug)} ran: ${r.events.map((e) => e.cmd).join(' | ')}`);
+  }
+});
+
+await ta('the drain loop dispatches a disconnect intent to this leg', async () => {
+  const r = rig();
+  let claims = 0, resolved = null;
+  r.deps.provisioning = {
+    ...r.deps.provisioning,
+    claimNextIntent: async () => (claims++ === 0 ? { id: 3, instance_id: 40, action: 'disconnect', attempts: 1 } : null),
+    getInstanceById: async () => ({ ...lantern }),
+    resolveIntent: async (_db, id, state) => { resolved = [id, state]; },
+    claimNextOAuthManifest: async () => null,
+  };
+  const out = await P.cmdRunIntents(r.deps);
+  assert.equal(out.ok, 1, JSON.stringify(out));
+  assert.deepEqual(resolved, [3, 'done'], 'resolving the (now cascaded) intent is a harmless no-op');
+  assert.ok(r.at((e) => e.cmd === 'delete-row') >= 0);
+});
+
+P.CONFIG.dnsHook = saved.hook;
+console.log(`\nprovision_disconnect: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/provision_teardown_address.mjs

@@ -0,0 +1,230 @@
+// tests/provision_teardown_address.mjs
+//
+// Teardown reclaims the address itself (task 1002897, ADR 0181 §2, ADR 0200 §2).
+//
+// Before this, a torn-down project's hostname kept resolving to the platform and its
+// Caddy block kept proxying it to a port nothing listened on: every visitor got a bare
+// 502, and teardown only LOGGED "remove the Caddy block" for an operator. Live on
+// 2026-09-16, the five projects retired under task 1003946 all answered 502.
+//
+// What these tests pin: the teardown run removes the instance's <slug>.caddy snippet and
+// reloads Caddy on the box the project ran on, and parks the row's hostname at the
+// RFC 5737 blackhole through the same release env a re-point uses, from the control
+// plane. Both legs are best-effort — a hook failure never strands the row. The row keeps
+// its domain, so a revive stands the project back up at the same hostname. A platform-
+// reserved hostname is never parked. The database and dumps stay operator-only.
+//
+// Hermetic: recorded executors, a fake db, no shell, no network.
+//
+// Run:  node tests/provision_teardown_address.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const P = require('../scripts/gds/provision.js');
+const apexMod = require('../scripts/gds/instance-apex.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const HOOK = '/opt/infra/box-dns-cloudflare.sh';
+const lantern = { id: 5, slug: 'lantern', hosting_shape: 'standalone', status: 'active', owner_builder_id: 7, port: 3021, db_name: 'lantern', domain: 'lantern.cloudbongos.com', target_ref: null };
+
+// One ordered ledger across both executors and the status writes, so ordering is assertable.
+function rig({ apply = true, privileged = false, hookThrows = false } = {}) {
+  const events = [], logs = [];
+  const deps = {
+    apply, privileged, log: (m) => logs.push(String(m)),
+    db: { query: async () => ({ rows: [] }) },
+    provisioning: {
+      setInstanceStatus: async (_db, _id, status, extra) => { events.push({ where: 'status', status, extra }); },
+      recordEvent: async () => {},
+    },
+    exec: (cmd, opts) => { events.push({ where: 'box', cmd, env: opts && opts.env }); return { ok: true, stdout: '' }; },
+    controlExec: (cmd, opts) => {
+      events.push({ where: 'control', cmd, env: opts && opts.env });
+      if (hookThrows && cmd === HOOK) throw new Error('zone not reachable');
+      return { ok: true, stdout: '' };
+    },
+    writeFile: () => ({ ok: true }), controlWriteFile: () => ({ ok: true }),
+    doApi: { deleteDroplet: async (id) => { events.push({ where: 'do', cmd: `delete ${id}` }); } },
+  };
+  const on = (where) => events.filter((e) => e.where === where).map((e) => e.cmd);
+  const hookCalls = () => events.filter((e) => e.cmd === HOOK);
+  const at = (pred) => events.findIndex(pred);
+  return { deps, events, logs, on, hookCalls, at };
+}
+
+async function withHook(hook, fn) {
+  const saved = P.CONFIG.dnsHook;
+  P.CONFIG.dnsHook = hook;
+  try { return await fn(); } finally { P.CONFIG.dnsHook = saved; }
+}
+
+console.log('the Caddy leg:');
+
+await ta('standalone: the <slug>.caddy snippet is removed, THEN Caddy reloads — on the control plane, where it ran', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig();
+    await P.teardownInstance(lantern, r.deps);
+    const control = r.on('control');
+    const rm = control.findIndex((c) => c === 'rm -f /etc/caddy/sites/lantern.caddy');
+    const reload = control.findIndex((c) => c === 'systemctl reload caddy');
+    assert.ok(rm >= 0, `snippet removed: ${control.join(' | ')}`);
+    assert.ok(reload > rm, 'reload after the rm, so Caddy forgets the site');
+    assert.equal(r.on('box').length, 0, 'nothing crosses to the co-hosting box for a standalone');
+  });
+});
+
+await ta('co-tenant: the snippet comes off the co-hosting box it was written to', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig();
+    await P.teardownInstance({ ...lantern, hosting_shape: 'co-tenant' }, r.deps);
+    assert.ok(r.on('box').includes('rm -f /etc/caddy/sites/lantern.caddy'), r.on('box').join(' | '));
+    assert.ok(r.on('box').includes('systemctl reload caddy'));
+  });
+});
+
+await ta('privileged: the rm under /etc and the reload are sudo-prefixed', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig({ privileged: true });
+    await P.teardownInstance(lantern, r.deps);
+    assert.ok(r.on('control').includes('sudo rm -f /etc/caddy/sites/lantern.caddy'));
+    assert.ok(r.on('control').includes('sudo systemctl reload caddy'));
+  });
+});
+
+await ta('dedicated: no Caddy steps — the droplet (and its Caddy) is deleted whole', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig();
+    await P.teardownInstance({ ...lantern, hosting_shape: 'dedicated', droplet_id: 9 }, r.deps);
+    assert.ok(!r.events.some((e) => /caddy/.test(e.cmd || '')), r.events.map((e) => e.cmd).join(' | '));
+  });
+});
+
+console.log('\nthe DNS leg:');
+
+await ta('the hostname is parked at the blackhole through the release env, from the control plane, before the row reads torn_down', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig();
+    const res = await P.teardownInstance(lantern, r.deps);
+    assert.equal(res.ok, true);
+    const calls = r.hookCalls();
+    assert.equal(calls.length, 1);
+    assert.equal(calls[0].where, 'control', 'the Cloudflare token never leaves the control plane');
+    assert.deepEqual(calls[0].env, { BOX_HOSTNAME: 'lantern.cloudbongos.com', BOX_IP: '192.0.2.1', CLOUDFLARE_ZONE: 'cloudbongos.com', BOX_PROXIED: '0' });
+    assert.ok(r.at((e) => e.cmd === HOOK) < r.at((e) => e.status === 'torn_down'), 'parked before the row says torn_down');
+  });
+});
+
+await ta('dedicated: its hostname is parked too — the droplet IP it pointed at is gone', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig();
+    await P.teardownInstance({ ...lantern, hosting_shape: 'dedicated', droplet_id: 9 }, r.deps);
+    assert.equal(r.hookCalls().length, 1);
+    assert.equal(r.hookCalls()[0].where, 'control');
+  });
+});
+
+await ta('best-effort: a hook that throws is logged and the row still reaches torn_down', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig({ hookThrows: true });
+    const res = await P.teardownInstance(lantern, r.deps);
+    assert.equal(res.ok, true);
+    assert.equal(r.events.filter((e) => e.where === 'status').pop().status, 'torn_down');
+    assert.ok(r.logs.some((l) => /lantern\.cloudbongos\.com/.test(l) && /zone not reachable/.test(l)), r.logs.join('\n'));
+  });
+});
+
+await ta('no domain: nothing to park, and the snippet is still removed', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig();
+    await P.teardownInstance({ ...lantern, domain: null }, r.deps);
+    assert.equal(r.hookCalls().length, 0);
+    assert.ok(r.on('control').includes('rm -f /etc/caddy/sites/lantern.caddy'));
+  });
+});
+
+await ta('no DNS hook configured: no call, and the log names the address to park by hand', async () => {
+  await withHook(null, async () => {
+    const r = rig();
+    await P.teardownInstance(lantern, r.deps);
+    assert.equal(r.events.filter((e) => e.env).length, 0);
+    assert.ok(r.logs.some((l) => /lantern\.cloudbongos\.com/.test(l) && /BOX_DNS_HOOK unset/.test(l)), r.logs.join('\n'));
+  });
+});
+
+await ta('dry run: the park is planned in the log, never executed', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig({ apply: false });
+    await P.teardownInstance(lantern, r.deps);
+    assert.equal(r.hookCalls().length, 0);
+    assert.ok(r.logs.some((l) => /park lantern\.cloudbongos\.com -> 192\.0\.2\.1/.test(l)), r.logs.join('\n'));
+  });
+});
+
+await ta('a platform-reserved hostname (the apex, www, a deep label) is never parked', async () => {
+  const savedApex = apexMod.instanceApex;
+  apexMod.instanceApex = () => 'cloudbongos.com';
+  try {
+    await withHook(HOOK, async () => {
+      for (const domain of ['cloudbongos.com', 'www.cloudbongos.com', 'a.b.cloudbongos.com']) {
+        const r = rig();
+        await P.teardownInstance({ ...lantern, domain }, r.deps);
+        assert.equal(r.hookCalls().length, 0, `${domain} must not be blackholed`);
+        assert.ok(r.logs.some((l) => l.includes(domain) && /reserved/.test(l)), r.logs.join('\n'));
+      }
+      const ok = rig();
+      await P.teardownInstance(lantern, ok.deps);
+      assert.equal(ok.hookCalls().length, 1, 'an ordinary <slug>.<apex> is still parked');
+    });
+  } finally { apexMod.instanceApex = savedApex; }
+});
+
+console.log('\nwhat teardown still leaves, and what a revive gets back:');
+
+await ta('the operator line names only the database and the dumps — never the Caddy block', async () => {
+  await withHook(HOOK, async () => {
+    const r = rig();
+    await P.teardownInstance(lantern, r.deps);
+    const line = r.logs.find((l) => /left for the operator/.test(l));
+    assert.ok(line, r.logs.join('\n'));
+    assert.match(line, /dropdb lantern/);
+    assert.match(line, /prune .*lantern-\*\.sql\.gz/);
+    assert.doesNotMatch(line, /Caddy/i);
+    assert.ok(!r.events.some((e) => /dropdb|\.sql\.gz/.test(e.cmd || '')), 'data is never destroyed by a teardown');
+  });
+});
+
+await ta('the row keeps its domain and port, and a revive re-UPSERTs the SAME hostname to the box and rewrites its snippet', async () => {
+  const savedCp = P.CONFIG.controlPlaneIp;
+  P.CONFIG.controlPlaneIp = '198.51.100.20';
+  try {
+    await withHook(HOOK, async () => {
+      const r = rig();
+      await P.teardownInstance({ ...lantern, target_ref: 'example-owner/lantern' }, r.deps);
+      for (const e of r.events.filter((x) => x.where === 'status')) {
+        assert.ok(!e.extra || (!('domain' in e.extra) && !('port' in e.extra)), `status write must not release the claim: ${JSON.stringify(e.extra)}`);
+      }
+      const dns = [], writes = [];
+      await P.provisionInstance({ ...lantern, status: 'torn_down', target_ref: 'example-owner/lantern' }, {
+        apply: false, log: () => {},
+        db: { query: async () => ({ rows: [] }) },
+        provisioning: { setInstanceStatus: async () => {}, recordEvent: async () => {} },
+        exec: () => ({ ok: true, stdout: '' }),
+        controlExec: (cmd, opts) => { if (cmd === HOOK) dns.push(opts.env); return { ok: true, stdout: '' }; },
+        writeFile: () => ({ ok: true }), controlWriteFile: (p) => { writes.push(p); return { ok: true }; },
+        doApi: null, checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
+      });
+      assert.ok(dns.some((env) => env.BOX_HOSTNAME === 'lantern.cloudbongos.com' && env.BOX_IP === '198.51.100.20'), JSON.stringify(dns));
+      assert.ok(writes.some((p) => p.endsWith('/lantern.caddy')), writes.join(' | '));
+    });
+  } finally { P.CONFIG.controlPlaneIp = savedCp; }
+});
+
+console.log(`\nprovision_teardown_address: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);