@bongos/core 1.19.789 → 1.19.790

package/tests/core_upgrade_runner.mjs

@@ -0,0 +1,377 @@
+// tests/core_upgrade_runner.mjs — the control-plane half of the owner's deploy door
+// (task 1003159, ADR 0293).
+//
+// core_upgrade_door.mjs covers the WEB tier: what may be asked for, by whom, and that
+// asking never escalates. This file covers what happens when the runner drains that
+// request — the half that actually restarts the live service and changes what code the
+// platform runs.
+//
+// WHAT IS ACTUALLY AT RISK HERE, in the order it would hurt:
+//
+//   1. THE SELF-ROW GUARD AT THE CHOKE POINT. Every enqueue funnels through
+//      enqueueIntent. Until task 1003159 the guard existed and nothing called it for any
+//      action but core-upgrade, so a teardown aimed at the control-plane row would have
+//      been queued and drained. A test that only checks the pure predicate would have
+//      passed the whole time.
+//   2. A TARGET THAT IS NOT PUBLISHED YET. The release lane mints a git tag BEFORE the
+//      npm publish completes — 8–13 minutes on 2026-09-16 (learnings 1000263, 1000266).
+//      A door that trusted the request would routinely queue a version that does not
+//      exist and die inside npm.
+//   3. A REFUSAL THAT MARKS A HEALTHY INSTANCE BROKEN. The drain loop's catch flips the
+//      instance to 'error'. Every expected refusal here must RETURN, never throw, or the
+//      one act the owner was finally given would leave their project labelled broken.
+//   4. THE READ-BACK LYING. The box's own /version is the only honest answer (ADR 0293
+//      D6), and a body this parser cannot read must report "unconfirmed", never a
+//      mismatch — a mismatch rolls back a deploy that worked.
+//
+// Run:  node tests/core_upgrade_runner.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const R = require('../scripts/gds/provision-core-upgrade.js');
+const U = require('../scripts/gds/upgrade.js');
+const P = require('../modules/provisioning/provisioning.js');
+const G = require('../modules/provisioning/control-plane-guard.js');
+
+let passed = 0;
+let failed = 0;
+const t = async (name, fn) => {
+  try { await fn(); passed += 1; console.log(`  PASS  ${name}`); }
+  catch (e) { failed += 1; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+};
+
+// A runner dependency bag whose every side effect is observable and whose clock is
+// instant. `apply:true` because the interesting behaviour is the applied path.
+function makeDeps({ shape = 'control-plane', served = '1.19.760', available = ['1.19.758', '1.19.760', '1.19.762'], installed = '1.19.760', queries = [] } = {}) {
+  const ran = [];
+  const exec = (cmd) => {
+    ran.push(cmd);
+    if (/\/version/.test(cmd)) return { ok: true, stdout: served == null ? '' : JSON.stringify({ coreVersion: served }) };
+    return { ok: true, stdout: '' };
+  };
+  return {
+    ran,
+    queries,
+    db: { query: async (sql, params) => { queries.push({ sql, params }); return { rows: [] }; } },
+    provisioning: { recordEvent: async () => {}, clearErrorNote: async () => {} },
+    exec,
+    log: () => {},
+    apply: true,
+    privileged: false,
+    sleep: async () => {},
+    readInstalledCoreVersion: () => installed,
+    updateChannel: {
+      DEFAULT_CHANNEL: 'patch',
+      normalizeChannel: (c) => c,
+      channelAllows: () => true,
+      resolveChannelTarget: ({ available: a }) => (a.length ? a[a.length - 1] : null),
+      listAvailableVersions: () => ({ ok: true, versions: available }),
+    },
+    _shape: shape,
+  };
+}
+
+const inst = (over = {}) => ({ id: 7, slug: 'cloudbongos', port: 3002, status: 'active', hosting_shape: 'control-plane', owner_builder_id: 1, ...over });
+const intent = (over = {}) => ({ id: 99, action: 'core-upgrade', target_version: '1.19.762', requested_by: 'api:archon:42', ...over });
+
+console.log('\nthe choke point — what may be aimed at the platform itself:');
+
+await t('enqueueIntent REFUSES a teardown aimed at the control-plane row', async () => {
+  const db = { query: async (sql) => {
+    if (/SELECT hosting_shape/.test(sql)) return { rows: [{ hosting_shape: 'control-plane' }] };
+    throw new Error('the INSERT must never be reached');
+  } };
+  await assert.rejects(() => P.enqueueIntent(db, 7, 'teardown', 'api:archon:42'),
+    (e) => e.code === 'control_plane_protected');
+});
+
+await t('and every other action in the vocabulary is refused there too, except the two named', async () => {
+  for (const action of P.INTENT_ACTIONS) {
+    const db = { query: async (sql) => {
+      if (/SELECT hosting_shape/.test(sql)) return { rows: [{ hosting_shape: 'control-plane' }] };
+      return { rows: [{ id: 1, action, state: 'pending' }] };
+    } };
+    const allowed = G.CONTROL_PLANE_ACTIONS.includes(action);
+    if (allowed) {
+      const r = await P.enqueueIntent(db, 7, action, 'api:archon:42', action === 'core-upgrade' ? '1.19.762' : null);
+      assert.equal(r.created, true, `${action} is allowed on the self row`);
+    } else {
+      await assert.rejects(() => P.enqueueIntent(db, 7, action, 'api:archon:42'),
+        (e) => e.code === 'control_plane_protected', `${action} must be refused on the self row`);
+    }
+  }
+});
+
+await t('an ORDINARY instance is untouched by the guard — it is not a general gate', async () => {
+  const seen = [];
+  const db = { query: async (sql, params) => {
+    seen.push(sql);
+    if (/SELECT hosting_shape/.test(sql)) return { rows: [{ hosting_shape: 'co-tenant' }] };
+    return { rows: [{ id: 1, action: params[1], state: 'pending' }] };
+  } };
+  const r = await P.enqueueIntent(db, 7, 'teardown', 'api:self');
+  assert.equal(r.created, true);
+  assert.ok(seen.some((s) => /INSERT INTO provisioning_intents/.test(s)));
+});
+
+await t('a row that does NOT exist is left to the FK, not answered with the wrong refusal', async () => {
+  const db = { query: async (sql) => {
+    if (/SELECT hosting_shape/.test(sql)) return { rows: [] };
+    const e = new Error('violates foreign key constraint'); e.code = '23503'; throw e;
+  } };
+  await assert.rejects(() => P.enqueueIntent(db, 404, 'teardown', 'api:self'),
+    (e) => e.code === '23503', 'the FK error survives — a missing row is not "control plane protected"');
+});
+
+console.log('\nwhat the runner refuses, and the shape of the refusal:');
+
+await t('a non-active instance is a clean NO-OP — it must not burn the retry budget or look broken', async () => {
+  for (const status of ['requested', 'provisioning', 'tearing_down', 'torn_down', 'error']) {
+    const r = await R.coreUpgradeInstance(inst({ status }), makeDeps(), intent());
+    assert.equal(r.ok, true, status);
+    assert.equal(r.noop, true, status);
+  }
+});
+
+await t('a dedicated droplet is refused — the runner has no exec path to it, so queueing one would never land', async () => {
+  const r = await R.coreUpgradeInstance(inst({ hosting_shape: 'dedicated' }), makeDeps(), intent());
+  assert.equal(r.ok, false);
+  assert.match(r.error, /not automated/);
+});
+
+await t('an intent with no target is refused rather than guessed at', async () => {
+  const r = await R.coreUpgradeInstance(inst(), makeDeps(), intent({ target_version: null }));
+  assert.equal(r.ok, false);
+  assert.match(r.error, /refusing to guess/);
+});
+
+await t('EVERY refusal returns ok:false — none of them throws, because the drain loop marks a throw as a broken instance', async () => {
+  const cases = [
+    [inst({ hosting_shape: 'dedicated' }), makeDeps(), intent()],
+    [inst(), makeDeps(), intent({ target_version: null })],
+    [inst(), makeDeps({ available: [] }), intent()],
+    [inst(), makeDeps({ available: ['1.19.758'] }), intent({ target_version: '1.19.999' })],
+  ];
+  for (const [i, d, n] of cases) {
+    const r = await R.coreUpgradeInstance(i, d, n);
+    assert.equal(typeof r.ok, 'boolean');
+  }
+});
+
+await t('A SLUG THAT IS NOT A SLUG NEVER REACHES THE SHELL, whatever the DB holds', async () => {
+  // The slug is interpolated into the `bongos upgrade` command. isValidSlug is
+  // enforced on the CREATE route, but the control-plane self row is written by an
+  // operator script and any future write path is one more place to remember — so the
+  // check that matters is the one at the point of use.
+  for (const bad of ['cloud bongos', 'a;rm -rf /', '$(id)', '`id`', 'UPPER', 'x', '--lead', 'a--b', '']) {
+    const d = makeDeps();
+    const r = await R.coreUpgradeInstance(inst({ slug: bad }), d, intent());
+    assert.equal(r.ok, false, `'${bad}' must be refused`);
+    assert.match(r.error, /is not a valid slug/, `'${bad}'`);
+    assert.equal(d.ran.length, 0, `'${bad}' must not reach an executor`);
+  }
+});
+
+await t('and an ordinary slug still runs', async () => {
+  const d = makeDeps({ served: '1.19.762' });
+  const r = await R.coreUpgradeInstance(inst({ slug: 'cloud-bongos-2' }), d, intent());
+  assert.equal(r.ok, true);
+  assert.ok(d.ran.some((c) => c.includes('--service cloud-bongos-2')));
+});
+
+await t('the guard error carries a status and a sentence, so a route CAN answer with it', async () => {
+  // No route maps it today — reaching it means a route forgot its own check, which
+  // deserves a 500 and a stack. The fields exist so that stays a choice rather than a
+  // rewrite, and so the wording is settled once.
+  const selfRow = { query: async () => ({ rows: [{ hosting_shape: 'control-plane' }] }) };
+  await assert.rejects(() => G.assertIntentAllowed(selfRow, 1, 'teardown'), (err) => {
+    assert.equal(err.code, 'control_plane_protected');
+    assert.equal(err.status, 409);
+    assert.match(err.publicMessage, /cannot be aimed at the machine the platform itself runs on/);
+    assert.ok(!/hosting_shape|provisioning_instances/.test(err.publicMessage),
+      'and the public sentence names no column or table');
+    return true;
+  });
+});
+
+console.log('\nthe target has to be REAL (ADR 0293 D3):');
+
+await t('a version that is not published yet is refused, and the message says the tag precedes the package', () => {
+  const f = R.targetFault('1.19.999', ['1.19.758', '1.19.760'], '1.19.758', 'patch', () => true);
+  assert.match(f, /not published yet/);
+  assert.match(f, /tag appears several minutes before/);
+});
+
+await t('a registry that could not be read is refused DIFFERENTLY from a version that does not exist', () => {
+  const empty = R.targetFault('1.19.760', [], '1.19.758', 'patch', () => true);
+  assert.match(empty, /could not read the published core versions/);
+  assert.ok(!/not published yet/.test(empty), 'the two states must not be collapsed into one sentence');
+});
+
+await t('a published version the CHANNEL forbids is refused, and says so rather than claiming it does not exist', () => {
+  const f = R.targetFault('2.0.0', ['1.19.758', '2.0.0'], '1.19.758', 'stable', () => false);
+  assert.match(f, /outside this project's 'stable' update channel/);
+});
+
+await t('a published, permitted version is admitted', () => {
+  assert.equal(R.targetFault('1.19.760', ['1.19.758', '1.19.760'], '1.19.758', 'patch', () => true), null);
+});
+
+await t('the runner refuses an unpublished target BEFORE it runs anything', async () => {
+  const d = makeDeps({ available: ['1.19.758', '1.19.760'] });
+  const r = await R.coreUpgradeInstance(inst(), d, intent({ target_version: '1.19.999' }));
+  assert.equal(r.ok, false);
+  assert.equal(d.ran.length, 0, 'nothing was executed on the box');
+});
+
+console.log('\nthe move itself:');
+
+await t('drives upgrade.js with the registry, the health gate, the version read-back and the committed pin', async () => {
+  // served === the target: the state after a move that worked, which is what the flags
+  // are being asserted for.
+  const d = makeDeps({ served: '1.19.762' });
+  const r = await R.coreUpgradeInstance(inst(), d, intent());
+  assert.equal(r.ok, true);
+  const cmd = d.ran.find((c) => /upgrade\.js/.test(c));
+  assert.ok(cmd, 'it ran the upgrade CLI');
+  for (const flag of ['--registry', '--to 1.19.762', '--service cloudbongos', '--health-url', '--version-url', '--commit-pin']) {
+    assert.ok(cmd.includes(flag), `carries ${flag}`);
+  }
+  // --commit-pin is the one that cannot be dropped: without it the pin lives only in
+  // the working tree and the next pull-deploy resets it away. That is the silent
+  // thirteen-release revert upgrade.js's own header records.
+  assert.ok(cmd.includes('--commit-pin'));
+});
+
+await t('the health URL and the version URL are LOOPBACK — the apex is behind basic_auth and a CDN (ADR 0293 D6)', async () => {
+  const d = makeDeps();
+  await R.coreUpgradeInstance(inst(), d, intent());
+  const cmd = d.ran.find((c) => /upgrade\.js/.test(c));
+  assert.ok(cmd.includes('--health-url http://127.0.0.1:3002/healthz'));
+  assert.ok(cmd.includes('--version-url http://127.0.0.1:3002/version'));
+});
+
+await t('the ACTOR rides through to the ledger — a privileged act with no attributed row is the thing ADR 0293 D5 refuses', async () => {
+  const d = makeDeps();
+  await R.coreUpgradeInstance(inst(), d, intent());
+  const cmd = d.ran.find((c) => /upgrade\.js/.test(c));
+  assert.ok(cmd.includes('--requested-by 42'), 'the builder id is carried, not the decorated string');
+  assert.ok(cmd.includes('--upgrade-source owner-control'));
+});
+
+await t('a CLI-shaped requester (no builder behind it) carries NEITHER flag rather than a half-attributed row', async () => {
+  const d = makeDeps();
+  await R.coreUpgradeInstance(inst(), d, intent({ requested_by: 'runner' }));
+  const cmd = d.ran.find((c) => /upgrade\.js/.test(c));
+  assert.ok(!cmd.includes('--requested-by'));
+  // The DB constraint core_upgrades_door_needs_actor_chk refuses source='owner-control'
+  // with no actor, so emitting one without the other would fail at the insert.
+  assert.ok(!cmd.includes('--upgrade-source'));
+});
+
+await t('asking for the version already installed changes nothing', async () => {
+  const d = makeDeps({ installed: '1.19.762' });
+  const r = await R.coreUpgradeInstance(inst(), d, intent({ target_version: '1.19.762' }));
+  assert.equal(r.ok, true);
+  assert.equal(r.noop, true);
+  assert.equal(d.ran.length, 0);
+});
+
+console.log('\nreading the box back (ADR 0293 D6):');
+
+await t('the served version is read from 127.0.0.1/version, and a match confirms the move', async () => {
+  const d = makeDeps({ served: '1.19.762' });
+  const r = await R.coreUpgradeInstance(inst(), d, intent());
+  assert.equal(r.ok, true);
+  assert.equal(r.served, '1.19.762');
+  assert.equal(r.confirmed, true);
+  assert.ok(d.ran.some((c) => c.includes('http://127.0.0.1:3002/version')));
+});
+
+await t('a box serving something ELSE is reported as a move that did not take', async () => {
+  const d = makeDeps({ served: '1.19.758' });
+  const r = await R.coreUpgradeInstance(inst(), d, intent());
+  assert.equal(r.ok, false);
+  assert.match(r.error, /serving core 1\.19\.758, not the requested 1\.19\.762/);
+});
+
+await t('a box that will not answer is UNCONFIRMED, not failed — an unfamiliar reply must never roll back a good deploy', async () => {
+  const d = makeDeps({ served: null });
+  const r = await R.coreUpgradeInstance(inst(), d, intent());
+  assert.equal(r.ok, true, 'silence is not a failure verdict');
+  assert.equal(r.served, null);
+  assert.equal(r.confirmed, false);
+});
+
+await t('parseServedVersion reads the shapes a /version endpoint actually answers with', () => {
+  assert.equal(R.parseServedVersion(JSON.stringify({ coreVersion: '1.19.762' })), '1.19.762');
+  assert.equal(R.parseServedVersion(JSON.stringify({ core_version: '1.19.762' })), '1.19.762');
+  assert.equal(R.parseServedVersion(JSON.stringify({ version: '1.19.762' })), '1.19.762');
+  // An OLDER core is exactly what this reads, so a shape this parser has never seen is
+  // the expected case, not the exotic one.
+  assert.equal(R.parseServedVersion('cloudbongos 1.19.762 (ok)'), '1.19.762');
+  assert.equal(R.parseServedVersion(''), null);
+  assert.equal(R.parseServedVersion(null), null);
+  assert.equal(R.parseServedVersion('{"coreVersion":'), null, 'malformed JSON with no number in it is null, never a throw');
+});
+
+console.log('\nthe ledger carries who asked (ADR 0293 D5):');
+
+await t('no actor → the original four columns, so this still works against a DB without core_241', () => {
+  const s = U.ledgerInsert({ fromVersion: '1.19.758', toVersion: '1.19.762' });
+  assert.deepEqual(s.cols, ['from_version', 'to_version', 'source_commit', 'note']);
+  assert.ok(!s.sql.includes('requested_by_builder_id'));
+  assert.equal(s.vals.length, 4);
+});
+
+await t('an actor → the two attribution columns join the INSERT, in lockstep with the values', () => {
+  const s = U.ledgerInsert({ fromVersion: '1.19.758', toVersion: '1.19.762', requestedByBuilderId: 42, source: 'owner-control' });
+  assert.deepEqual(s.cols.slice(-2), ['requested_by_builder_id', 'source']);
+  assert.equal(s.cols.length, s.vals.length, 'a column list longer than its values is how a bound-parameter INSERT goes wrong');
+  assert.equal(s.vals[4], '42');
+  assert.equal(s.vals[5], 'owner-control');
+  assert.match(s.sql, /\$6\)$/, 'the placeholders grow with the columns');
+});
+
+console.log('\nthe snapshot the deploy control reads:');
+
+await t('the snapshot records the served version, the registry list and what the channel would take', async () => {
+  const queries = [];
+  const d = makeDeps({ served: '1.19.760', available: ['1.19.758', '1.19.760', '1.19.762'], queries });
+  await R.snapshotCoreVersions(inst(), d);
+  const w = queries.find((q) => /core_version_snapshot/.test(q.sql));
+  assert.ok(w, 'it wrote the snapshot');
+  assert.equal(w.params[1], '1.19.760', 'the served version');
+  assert.deepEqual(JSON.parse(w.params[2]), ['1.19.758', '1.19.760', '1.19.762']);
+  assert.equal(w.params[3], '1.19.762', 'and the version the channel would actually take');
+});
+
+await t('a box that does not answer still writes a snapshot — a NULL reading is a real state, not a missing row', async () => {
+  const queries = [];
+  const d = makeDeps({ served: null, queries });
+  await R.snapshotCoreVersions(inst(), d);
+  const w = queries.find((q) => /core_version_snapshot/.test(q.sql));
+  assert.ok(w);
+  assert.equal(w.params[1], null);
+  assert.equal(w.params[3], null, 'and nothing is recommended against a version we could not read');
+});
+
+await t('a shape the runner cannot reach is skipped entirely — no snapshot, no claim about it', async () => {
+  const queries = [];
+  const r = await R.snapshotCoreVersions(inst({ hosting_shape: 'dedicated' }), makeDeps({ queries }));
+  assert.equal(r.skipped, true);
+  assert.equal(queries.length, 0);
+});
+
+await t('the snapshot NEVER fails a tick — a registry hiccup leaves the old reading and its visibly older timestamp', async () => {
+  const d = makeDeps();
+  d.updateChannel.listAvailableVersions = () => { throw new Error('npm exploded'); };
+  const r = await R.snapshotCoreVersions(inst(), d);
+  assert.equal(r.ok, true);
+  assert.equal(r.skipped, true);
+});
+
+console.log(`\ncore_upgrade_runner: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/hall_nav.mjs

@@ -281,7 +281,10 @@ test('sidebar groups read by audience, in order', () => {
   // 'board-room' LED this group from the ADR 0266 carve until task 1003744 moved
   // it to the project group — see the note on nav[0]. What is left is rank surface
   // throughout, which is what lets the group keep its metic head honestly.
-  assert.deepEqual(nav[4].items.map((i) => i.id), ['watch', 'harbor', 'gate', 'sessions', 'project-settings', 'government']);
+  // 'deploy' (task 1003159, ADR 0293) is the SECOND archon item, beside 'government':
+  // its gate is the `core.pin.move` atom, archon-floor and system:true. It sits with
+  // the steering surfaces because that is what it is — the owner's third release gate.
+  assert.deepEqual(nav[4].items.map((i) => i.id), ['watch', 'harbor', 'gate', 'sessions', 'project-settings', 'deploy', 'government']);
 });
 
 test('Economy lives in Docs and points at the reward-schedule page', () => {

package/tests/hall_page_gate_map.mjs

@@ -81,6 +81,13 @@ const ORACLE = {
   // its neighbours: a steering surface, metic+ per ADR 0157. Its two WRITES gate
   // independently on `project.settings.manage`, so this row is only about the shell.
   '/builders/project-settings': 'requireGovernmentPage',
+  // The deploy door (task 1003159, ADR 0293) — the NARROWEST gate in this table, on
+  // the `core.pin.move` atom: archon-floor and system:true, the same key its preview
+  // and its move both check. Correct for the one page whose button restarts the live
+  // service and changes what code the platform runs. Its READ is gated as tightly as
+  // its write on purpose: the preview discloses the exact core version the box serves
+  // and how far behind it is, which is a vulnerability window.
+  '/builders/deploy': 'requireCorePinPage',
 
   // Metic+ via the `project.curate` atom — the exact permission GET /scouting
   // checks, so the page can never drift wider than the API it fronts. Its

package/tests/provisioning_disconnect.mjs

@@ -22,7 +22,7 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
-import { readFileSync } from 'node:fs';
+import { readFileSync, readdirSync } from 'node:fs';
 import http from 'node:http';
 
 const require = createRequire(import.meta.url);
@@ -43,14 +43,31 @@ const PROMISE = /shortly|briefly|minute|second|soon\b/i;
 
 console.log('the schema:');
 
-t("INTENT_ACTIONS includes 'disconnect', in strict lockstep with the provisioning_016 CHECK (the newest action migration)", () => {
+t("INTENT_ACTIONS includes 'disconnect', and 016 ADMITTED it while the LAST action migration must still carry it", () => {
   assert.ok(provisioning.INTENT_ACTIONS.includes('disconnect'));
   const sql = readFileSync(new URL('../modules/provisioning/migrations/provisioning_016_disconnect.sql', import.meta.url), 'utf8');
   const m = /CHECK \(action IN \(([^)]*)\)\)/.exec(sql);
   assert.ok(m, 'the migration widens the action CHECK');
-  const inSql = m[1].split(',').map((s) => s.trim().replace(/^'|'$/g, '')).sort();
-  assert.deepEqual(inSql, [...provisioning.INTENT_ACTIONS].sort(), 'the CHECK a live DB ends with and INTENT_ACTIONS carry the same set');
+  const inSql = m[1].split(',').map((s) => s.trim().replace(/^'|'$/g, ''));
+  assert.ok(inSql.includes('disconnect'), 'this migration is the one that admitted it');
   assert.match(sql, /INSERT INTO schema_migrations \(version\) VALUES \('provisioning_016_disconnect'\)/, 'self-registers');
+
+  // THE SET EQUALITY BELONGS TO WHICHEVER MIGRATION RUNS LAST, not to this one.
+  // Each of these files REPLACES the action CHECK rather than adding to it, so the
+  // constraint a live DB ends up with is the last one applied in name order — and
+  // a later migration that forgot 'disconnect' would silently drop it while this
+  // file still read as correct. 016 and 018 (task 1003159's core-upgrade) landed on
+  // separate branches, which is exactly how that goes wrong.
+  const migDir = new URL('../modules/provisioning/migrations/', import.meta.url);
+  const defining = readdirSync(migDir)
+    .filter((f) => f.endsWith('.sql'))
+    .filter((f) => /CHECK \(action IN \(/.test(readFileSync(new URL(f, migDir), 'utf8')))
+    .sort();
+  const lastSql = readFileSync(new URL(defining[defining.length - 1], migDir), 'utf8');
+  const lastIn = /CHECK \(action IN \(([^)]*)\)\)/.exec(lastSql)[1]
+    .split(',').map((s) => s.trim().replace(/^'|'$/g, '')).sort();
+  assert.deepEqual(lastIn, [...provisioning.INTENT_ACTIONS].sort(),
+    `the LAST action migration (${defining[defining.length - 1]}) and INTENT_ACTIONS carry the same set`);
 });
 
 console.log('\nthe queue:');
@@ -61,6 +78,11 @@ function queueDb({ open = null } = {}) {
   return {
     inserts, deletes,
     query: async (sql, params) => {
+      // The self-row guard's shape lookup (task 1003159, ADR 0293 D2) — every enqueue
+      // now asks "is this the control plane?" first. A tenant shape is the honest
+      // answer here; answering 'control-plane' would refuse the disconnect outright,
+      // which is itself correct behaviour and is covered in core_upgrade_runner.mjs.
+      if (/SELECT hosting_shape FROM provisioning_instances/.test(sql)) return { rows: [{ hosting_shape: 'co-tenant' }] };
       if (/SELECT \* FROM provisioning_intents/.test(sql)) return { rows: open ? [open] : [] };
       if (/INSERT INTO provisioning_intents/.test(sql)) {
         if (open) { const e = new Error('dup'); e.code = '23505'; throw e; }
@@ -77,7 +99,10 @@ await ta('an idle project queues a disconnect intent', async () => {
   const db = queueDb();
   const r = await disconnect.enqueueDisconnect(db, 7, 'api:self');
   assert.equal(r.created, true);
-  assert.deepEqual(db.inserts, [[7, 'disconnect', 'api:self']]);
+  // The trailing null is the target_version enqueueIntent gained in task 1003159:
+  // only a 'core-upgrade' names one, and the column's CHECK is an EQUIVALENCE, so a
+  // disconnect carrying a target would be refused by the database.
+  assert.deepEqual(db.inserts, [[7, 'disconnect', 'api:self', null]]);
 });
 
 for (const [action, state] of [['provision', 'pending'], ['provision', 'running'], ['teardown', 'running'], ['restart', 'pending']]) {

package/tests/provisioning_paid_shape_gate.mjs

@@ -161,10 +161,20 @@ await ta('a case-variant shape does not slip past the gate INTO a dedicated row'
   }
 });
 
-await ta('HOSTING_SHAPES still carries exactly the three shapes the gate reasons about', () => {
-  // If a fourth, also-metered shape is ever added, this test is the tripwire that says the
-  // gate's single-shape assumption needs revisiting.
-  assert.deepEqual([...provisioning.HOSTING_SHAPES].sort(), ['co-tenant', 'dedicated', 'standalone']);
+await ta('HOSTING_SHAPES carries the shapes the gate reasons about, and control-plane is NOT metered', () => {
+  // This tripwire fired for the first time at task 1003159, which added a fourth
+  // shape — 'control-plane', the platform's own box, enrolled so the owner's deploy
+  // door has a row to point at (ADR 0293 D2). Its question was "is the new shape
+  // also metered?", and the answer is NO, stated here rather than implied by
+  // absence: the control plane is infrastructure the project already runs and pays
+  // for, not a droplet allocated per request, so nothing about standing it up is
+  // billed through this gate. It is also not creatable through the create route at
+  // all — the self row is enrolled by the platform, not asked for by a builder.
+  assert.deepEqual([...provisioning.HOSTING_SHAPES].sort(),
+    ['co-tenant', 'control-plane', 'dedicated', 'standalone']);
+  // The assumption the tripwire actually guards is that exactly ONE shape is
+  // metered. A fifth shape that IS billed must widen the gate itself, in
+  // paid-shape-gate.js, and not merely this list.
 });
 
 server.close();

package/tests/provisioning_restart.mjs

@@ -29,7 +29,7 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
-import { readFileSync } from 'node:fs';
+import { readFileSync, readdirSync } from 'node:fs';
 import http from 'node:http';
 
 const require = createRequire(import.meta.url);
@@ -51,17 +51,33 @@ const PROMISE = /shortly|briefly|minute|second|soon\b/i;
 
 console.log('the module slice — constants, the migration, the enqueue classifier:');
 
-t("INTENT_ACTIONS includes 'restart', in lockstep with the provisioning_011 CHECK", () => {
+t("INTENT_ACTIONS includes 'restart', in lockstep with the LATEST action CHECK", () => {
+  // Pinned to provisioning_011 by name until task 1003159, which added
+  // 'core-upgrade' in provisioning_016 — and a lockstep assertion aimed at a
+  // superseded migration compares the live vocabulary against a frozen one, so it
+  // reds on the next widening rather than on a real drift. It now reads whichever
+  // migration most recently defines the CHECK, the shape
+  // tests/claimable_blocker_status.mjs uses for the claimable view.
   assert.ok(provisioning.INTENT_ACTIONS.includes('restart'));
-  const sql = readFileSync(new URL('../modules/provisioning/migrations/provisioning_011_restart.sql', import.meta.url), 'utf8');
+  const migDir = new URL('../modules/provisioning/migrations/', import.meta.url);
+  const defining = readdirSync(migDir)
+    .filter((f) => f.endsWith('.sql'))
+    .filter((f) => /CHECK \(action IN \(/.test(readFileSync(new URL(f, migDir), 'utf8')))
+    .sort();
+  assert.ok(defining.length, 'some migration defines the action CHECK');
+  const latest = defining[defining.length - 1];
+  const sql = readFileSync(new URL(latest, migDir), 'utf8');
   const m = /CHECK \(action IN \(([^)]*)\)\)/.exec(sql);
   assert.ok(m, 'the migration widens the action CHECK');
-  const inSql = m[1].split(',').map((s) => s.trim().replace(/^'|'$/g, ''));
-  assert.ok(inSql.includes('restart'), 'this migration is the one that admitted it');
-  // The NEWEST action migration owns the strict set equality (provisioning_016,
-  // tests/provisioning_disconnect.mjs); an older one is a prefix of the set.
-  for (const a of inSql) assert.ok(provisioning.INTENT_ACTIONS.includes(a), `${a} is still an INTENT_ACTION`);
-  assert.match(sql, /INSERT INTO schema_migrations \(version\) VALUES \('provisioning_011_restart'\)/, 'self-registers');
+  const inSql = m[1].split(',').map((s) => s.trim().replace(/^'|'$/g, '')).sort();
+  // The NEWEST migration owns the strict set equality — the CHECK a live DB ends up
+  // with is the last one applied, so this is the assertion that would catch an action
+  // added in code but never admitted by the schema. That is provisioning_018 today:
+  // 016_disconnect and 018_core_upgrade_intent each rewrite the CHECK, so the later
+  // one must carry BOTH actions or the earlier one's is silently dropped.
+  assert.deepEqual(inSql, [...provisioning.INTENT_ACTIONS].sort(), 'the CHECK and INTENT_ACTIONS carry the same set');
+  const sql011 = readFileSync(new URL('provisioning_011_restart.sql', migDir), 'utf8');
+  assert.match(sql011, /INSERT INTO schema_migrations \(version\) VALUES \('provisioning_011_restart'\)/, 'self-registers');
 });
 
 t('RESTART_FROM is exactly {active} — every other state is already served by the provision path', () => {

package/tests/provisioning_settings_apply.mjs

@@ -84,8 +84,17 @@ await ta('enqueueSettingsApply: a fresh intent → created:true; the INSERT carr
   const r = await provisioning.enqueueSettingsApply(db, 18, 'api:self');
   assert.equal(r.created, true);
   assert.equal(r.conflict, undefined);
-  assert.match(calls[0].sql, /INSERT INTO provisioning_intents/);
-  assert.deepEqual(calls[0].params, [18, 'settings-apply', 'api:self']);
+  // calls[0] is the self-row guard's shape lookup (ADR 0293 D2) — every enqueue now
+  // asks "is this the control plane?" before it writes. Assert on the INSERT itself
+  // rather than on a position, so this test says what it means and does not move
+  // again the next time a check joins the front of this function.
+  const insert = calls.find((c) => /INSERT INTO provisioning_intents/.test(c.sql));
+  assert.ok(insert, 'the enqueue reaches its INSERT');
+  assert.match(calls[0].sql, /SELECT hosting_shape FROM provisioning_instances/, 'and the guard ran FIRST');
+  // The trailing null is the target_version enqueueIntent gained in task 1003159:
+  // only a 'core-upgrade' names one, and the column's CHECK is an EQUIVALENCE, so a
+  // settings-apply carrying a target would be refused by the database.
+  assert.deepEqual(insert.params, [18, 'settings-apply', 'api:self', null]);
 });
 
 await ta('enqueueSettingsApply: an identical PENDING push already open → created:false, no conflict (it carries this change)', async () => {

package/tests/provisioning_teardown_intent.mjs

@@ -55,6 +55,13 @@ function fakeIntentDb(seed = []) {
   return {
     rows,
     query: async (sql, params) => {
+      // The self-row guard's shape lookup (task 1003159, ADR 0293 D2): every enqueue
+      // now asks "is this the control plane?" before it writes. These cases are all
+      // ORDINARY instances, so the honest answer is a tenant shape — answering
+      // 'control-plane' here would refuse every teardown in this file.
+      if (/SELECT hosting_shape FROM provisioning_instances/.test(sql)) {
+        return { rows: [{ hosting_shape: 'co-tenant' }] };
+      }
       if (/INSERT INTO provisioning_intents/.test(sql)) {
         const [instance_id, action, requested_by] = params;
         if (open(instance_id).length) {