@bongos/core 1.19.916 → 1.19.918

package/scripts/gds/provision-repo.js

@@ -201,6 +201,56 @@ function grantInstanceRepoReadCmd(inst, { privileged = false } = {}) {
   return `${privileged ? 'sudo ' : ''}usermod -aG ${APP_USER} ${instanceUser(inst)}`;
 }
 
+// Can this plane give a child instance its OWN unix account AT ALL? (task 1004018, ADR 0317)
+//
+// ensureInstanceUserCmd above needs uid 0 — directly, or through the `privileged` sudo
+// prefix. The self-host image runs `USER node` and installs no sudo, so there it cannot
+// run, and every child on that plane would share one uid: exactly the /proc/<pid>/environ
+// vector ADR 0281 exists to close. Probed, not configured — a runner either reaches root
+// on this plane or it does not, and an operator who wants provisioning to proceed needs
+// privilege, not a flag that says to pretend.
+//
+// The probe runs the SAME escalation the mutation will, so a pass is evidence rather than
+// inference. Read-only, no mutation, and no pipeline: a pipeline's exit status is the last
+// stage's, which would erase the difference below.
+//
+// A shell that RAN AND ANSWERED is the only failure that proves the plane cannot. Under
+// remote exec boxExec is `ssh <host> bash -s`, so an unreachable co-hosting box throws
+// here too — and answering that with "this plane cannot create accounts, provision
+// elsewhere" would be a confident wrong diagnosis that burns the intent's retry budget on
+// a network blip. Exit 1 (not root) and 127 (no sudo binary) are read as proof; ssh
+// reports its own failures as 255, so both still mean what they say across the hop.
+const ACCOUNT_PROOF_STATUS = new Set([1, 127, 9009]);
+function accountPlaneGap(exec, { privileged = false } = {}) {
+  // sh -c, not a bare test: under sudo the outer (unprivileged) shell would expand
+  // $(id -u) before sudo ever ran, and the probe would answer about the wrong user.
+  const cmd = `${privileged ? 'sudo ' : ''}sh -c 'test "$(id -u)" = 0'`;
+  try { exec(cmd); return null; } catch (e) {
+    // e.stderr is a zero-length Buffer when the command failed SILENTLY — truthy, and
+    // String()s to '' — so it has to be length-checked or it shadows the only cause there
+    // is. `test` exiting 1 writes nothing, and that is this probe's commonest refusal.
+    const stderr = e && e.stderr && e.stderr.length ? e.stderr : null;
+    const why = String(stderr || (e && e.message) || e).trim().slice(0, 200) || `exit status ${e && e.status}`;
+    if (!ACCOUNT_PROOF_STATUS.has(e && e.status)) {
+      return `could not confirm the runner can create a per-instance unix account on this plane: '${cmd}' failed (${why}). Every instance is given its own account, so provisioning refuses rather than assume — re-run once the box answers.`;
+    }
+    return `this plane cannot create a per-instance unix account, so every child instance would run as one uid and could read its siblings' secrets: '${cmd}' failed (${why}). Provision from a host where the runner is root or holds sudo (PROVISION_SUDO=1) — a shared uid is the isolation ADR 0281 exists to provide, not a detail.`;
+  }
+}
+
+// The preflight around accountPlaneGap: the narration its sibling preflights carry,
+// including the dry-run line without which the plan prints step 1c's useradd as though it
+// will work. Returns the refusal, or null to proceed. `dedicated` skips it — that account
+// is created by cloud-init, which runs as root. Lives here beside the account it guards.
+function accountPreflight({ exec, apply, log, shape, privileged = false, probe = accountPlaneGap }) {
+  if (shape === 'dedicated') return null;
+  if (!apply) { log('  [preflight] would probe whether the runner can create this instance\'s own unix account'); return null; }
+  const missing = probe(exec, { privileged });
+  if (missing) return `Account preflight failed: ${missing}`;
+  log('  [preflight] the runner can create the instance\'s own unix account ✓');
+  return null;
+}
+
 // Create-or-rotate the instance's PG login role and hand it its OWN database — and
 // nothing else. Three statements, one psql, ON_ERROR_STOP:
 //   1. CREATE ROLE ... LOGIN PASSWORD, or ALTER ... PASSWORD when it already exists (the
@@ -1020,6 +1070,8 @@ async function refreshStandaloneCorePin(inst, deps) {
 
 module.exports = {
   APP_USER,
+  accountPlaneGap,
+  accountPreflight,
   CORE_PKG_DIR,
   INSTANCE_GITIGNORE,
   alreadyScaffolded,

package/scripts/gds/provision.js

@@ -50,7 +50,7 @@ const cp = require('node:child_process');
 const crypto = require('node:crypto');
 
 const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
-const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
+const { APP_USER, accountPreflight, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, ingressPlaneGap, ingressPreflight, shouldFederate, zoneForDomain } = require('./provision-net.js');
 const { resolveProcessManager } = require('./provision-process.js');
@@ -276,6 +276,12 @@ async function provisionInstance(inst, deps) {
   // skipped 0303 entirely, reached step 6 and died on the snippet write.
   const ingressGap = ingressPreflight({ exec: boxExec, apply, log, shape: inst.hosting_shape, probe: deps.ingressPlaneGap });
   if (ingressGap) return { ok: false, error: ingressGap };
+  // Account preflight (task 1004018, ADR 0317). The third and last PLANE question — can this
+  // box give the child its own unix account? — before 0303 below asks the per-DOMAIN one. A
+  // plane that cannot would run every child as one uid, the ADR 0281 vector, and step 1c's
+  // useradd would crash mid-provision instead of refusing.
+  const accountGap = accountPreflight({ exec: boxExec, apply, log, shape: inst.hosting_shape, privileged, probe: deps.accountPlaneGap });
+  if (accountGap) return { ok: false, error: accountGap };
   // Caddy preflight (task 1002860, ADR 0303): a box whose base Caddyfile has no tls-check ask
   // can never certify this domain, so refuse before touching it. Injectable like the DNS check.
   const caddyCheck = deps.checkCaddyWiring || checkCaddyWiring;

package/src/bongos/module-scope-map.js

@@ -62,6 +62,14 @@ const MODULE_GLOBS = {
     // exploit-detail engagement-doc store (/security/docs). Stays kernel when the
     // red-team FEATURE carved to modules/security/ (BV1.R79 / 02-module-map §5).
     'src/bongos/routes/security.js',
+    // The GET /me AGGREGATOR (task 1004110, ADR 0318). A core facade, not a
+    // builder-settings file: it resolves TEN module ports (lifecycle, reward,
+    // onboarding, government, specialities, grade, box, art, discord) and
+    // builder-settings is merely one of them. It was listed under that module
+    // for task AFFINITY, and the affinity listing alone made the whole module
+    // protected - ADR 0314 in a second costume. Ownership follows what the
+    // file IS, and what it is is the core read facade over ten modules.
+    'src/bongos/routes/me.js',
     'server.js', 'config/',
   
     // ADOPTED (task 1004111): a protected path owned by no module is authorable
@@ -140,11 +148,13 @@ const MODULE_GLOBS = {
   // --- builder prefs (wandering/skill/sound/render) + builder-needs ---
   // Carved into modules/builder-settings/ (BV1.R80 / ADR 0093 §1): the five pref
   // libs + builder-needs + their db slice + the `/me/*-prefs` routes + the
-  // `builder-settings` kernel PORT. The `GET /me` aggregator stays a thin core
-  // facade (routes/me.js) resolving that port — listed for task affinity. The
-  // pref-mirroring CLIs travel with the domain but stay under scripts/.
+  // `builder-settings` kernel PORT. The `GET /me` aggregator is NOT here: it
+  // stays a thin core facade resolving that port, and since task 1004110
+  // (ADR 0318) it is owned by KERNEL. Listing it here for task AFFINITY was
+  // the single glob that made this whole module protected, on a file the
+  // comment itself said was core. The pref-mirroring CLIs travel with the
+  // domain but stay under scripts/.
   'builder-settings': [
-    'src/bongos/routes/me.js',
     'scripts/gds/fetch-sound-prefs.js',
     'modules/builder-settings/',
   ],

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.916'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.918'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/module-scope-map.mjs

@@ -2,6 +2,7 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
+import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -78,12 +79,24 @@ test('`protected` is DERIVED from the imported PROTECTED_GLOBS, never hand-set',
 // three is still refused by the path wall (asserted below). What changed is who
 // may CREATE a goal whose territory happens to include them.
 //
-// `builder-settings` STAYS, deliberately: its overlap is src/bongos/routes/me.js
-// caught by the blanket src/bongos/routes/ prefix, not a command, so narrowing it
-// needs the me.js strangler move or a blanket-glob change — out of scope here.
+// NARROWED NINE -> EIGHT BY ADR 0318 (task 1004110). `builder-settings` left the
+// set. It derived protected on exactly one glob, src/bongos/routes/me.js, caught
+// by the blanket src/bongos/routes/ prefix. That glob was never an ownership
+// claim: MODULE_GLOBS listed it for task AFFINITY and said in the same comment
+// that the GET /me aggregator stays a thin CORE facade. It resolves ten module
+// ports and builder-settings is one of them, so the file is kernel territory and
+// is now owned there. Same shape as ADR 0314 one step on: owning the command is
+// not owning the authority, and neither is being listed next to it.
+//
+// Neither of the two routes the task proposed was taken, and the measurements are
+// why. Narrowing the blanket prefix was rejected because all 18 files under
+// src/bongos/routes/ are protected by that prefix AND NOTHING ELSE, so narrowing
+// removes the only wall from auth.js, builders.js, backup.js and core-update.js.
+// Moving me.js into modules/builder-settings/ was rejected because a ten-port
+// aggregator inside one module would have to resolve nine foreign ports from
+// inside a module, which is the core->module edge ADR 0083 rule 1 forbids.
 const PROTECTED_MODULES = [
   'agents',
-  'builder-settings',
   'dev-box',
   'devsecops',
   'government',
@@ -632,9 +645,16 @@ test('adopting the unowned paths did NOT change which modules are protected', ()
   for (const k of ['kernel', 'lifecycle', 'dev-box', 'devsecops', 'methodology']) {
     assert.equal(scope.scopeForModule(k).protected, true, `${k} was already protected and must stay so`);
   }
-  // and the ADR 0314 nine are still exactly the nine — PROTECTED_MODULES above
-  // is the by-name pin; this states the intent of THIS task against it.
-  assert.equal(scope.protectedModules().length, 9, 'adoption must not change the size of the protected set');
+  // and the adoption changed no COUNT either. Pinned against PROTECTED_MODULES
+  // rather than a literal, so the by-name pin above stays the single place the
+  // set is spelled out: a deliberate departure (ADR 0318 removing
+  // builder-settings) edits one list, while an ACCIDENTAL widening still reds
+  // both this and the by-name test. A literal here duplicated the roster and
+  // made an intended change look like two unrelated failures.
+  assert.equal(
+    scope.protectedModules().length, PROTECTED_MODULES.length,
+    'adoption must not change the size of the protected set',
+  );
 });
 
 test('the probe trap: matchOne takes an ARRAY, and a string reports everything unowned', () => {
@@ -651,3 +671,76 @@ test('the probe trap: matchOne takes an ARRAY, and a string reports everything u
     'a STRING second argument must not be mistaken for a working query',
   );
 });
+
+// --- ADR 0318: the GET /me aggregator is kernel territory (task 1004110) ---
+
+test('the GET /me aggregator is owned by kernel, not by builder-settings', () => {
+  // The affinity listing that made a whole module Archon-only. MODULE_GLOBS put
+  // src/bongos/routes/me.js under builder-settings and said in the same comment
+  // that the aggregator stays a thin CORE facade - so the glob was task affinity,
+  // never an ownership claim, and isProtected() could not tell the two apart.
+  const ME = 'src/bongos/routes/me.js';
+  assert.ok(
+    matchOne(ME, scope.scopeForModule('kernel').globs),
+    'kernel must own the /me aggregator - it is the core read facade over ten module ports',
+  );
+  assert.equal(
+    matchOne(ME, scope.scopeForModule('builder-settings').globs), null,
+    'builder-settings must NOT own /me: it is one of the ten ports the facade resolves, not its home',
+  );
+});
+
+test('builder-settings is not protected, and its own territory is what says so', () => {
+  assert.equal(
+    scope.scopeForModule('builder-settings').protected, false,
+    'builder-settings derived protected on the me.js affinity listing alone - removing it is the whole point of ADR 0318',
+  );
+  // Prove the module did not simply lose its territory on the way: it still owns
+  // its own directory, and that directory is genuinely not protected. Without
+  // this, blanking the globs entirely would pass the assertion above.
+  assert.ok(
+    matchOne('modules/builder-settings/interaction-prefs.js', scope.scopeForModule('builder-settings').globs),
+    'builder-settings must still own its own module directory',
+  );
+});
+
+test('unprotecting builder-settings did NOT open the path wall on /me', () => {
+  // The half that would make this a false success, mirroring the ADR 0314 test
+  // above. The module flag decides who may CREATE a goal over the territory; the
+  // per-file wall decides who may WRITE it. Only the first was meant to move.
+  const ME = 'src/bongos/routes/me.js';
+  assert.ok(
+    touchesOverlap([ME], PROTECTED_GLOBS),
+    'fixture assumption: /me is still a protected surface via the src/bongos/routes/ prefix',
+  );
+  assert.equal(gsc.scopeSubset(['kernel'], [ME]).ok, true, 'fixture assumption: kernel now owns /me');
+  const r = gsc.check(['kernel'], [ME], 'thetes');
+  assert.equal(r.ok, false, 'a sub-Metic builder must still be refused on /me');
+  assert.equal(r.code, 'protected_path', '/me must be refused BY THE PATH WALL, not by scope');
+  assert.equal(gsc.check(['kernel'], [ME], 'metic').ok, true, 'a Metic must still be able to author on /me');
+});
+
+test('every file under src/bongos/routes/ is protected by the blanket prefix AND NOTHING ELSE', () => {
+  // The measurement that killed the other option on task 1004110, pinned so the
+  // next reader does not have to re-derive it. Narrowing the blanket
+  // src/bongos/routes/ prefix looks like a small change and is not: it is the
+  // ONLY protection every route file has, auth.js and core-update.js included.
+  //
+  // If this reds because a route gained its own PROTECTED_GLOBS entry, that is
+  // fine and the exemption should be stated deliberately. If it reds because the
+  // blanket entry went away, read task 1004116 before touching anything.
+  const BLANKET = 'src/bongos/routes/';
+  assert.ok(PROTECTED_GLOBS.includes(BLANKET), 'the blanket route prefix must still be a protected glob');
+  const others = PROTECTED_GLOBS.filter((g) => g !== BLANKET);
+  const dir = path.join(ROOT, 'src', 'bongos', 'routes');
+  const files = fs.readdirSync(dir).filter((f) => f.endsWith('.js') || f.endsWith('.md'));
+  assert.ok(files.length >= 18, 'expected the route directory to still be populated, saw ' + files.length);
+  for (const f of files) {
+    const rel = BLANKET + f;
+    assert.ok(touchesOverlap([rel], PROTECTED_GLOBS), rel + ' must be protected');
+    assert.deepEqual(
+      others.filter((g) => matchOne(rel, [g])), [],
+      rel + ' is protected by the blanket prefix alone - narrowing the prefix would leave it unwalled',
+    );
+  }
+});

package/tests/provision_account_identity.mjs

@@ -0,0 +1,135 @@
+// tests/provision_account_identity.mjs — a plane that cannot create a per-instance unix
+// account is refused, not handed a shared uid (task 1004018, ADR 0317). ADR 0281 makes an
+// instance's identity its own account; the self-host image runs `USER node` with no sudo,
+// where `useradd` cannot run at all. Before this, that plane crashed mid-provision at step
+// 1c — or, once someone gives the container a front door, would have quietly co-located
+// every child under one uid. Hermetic: exec is a fake, nothing touches a box.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const P = require('../scripts/gds/provision.js');
+const { accountPlaneGap, accountPreflight } = require('../scripts/gds/provision-repo.js');
+
+const PROBE = `sh -c 'test "$(id -u)" = 0'`;
+const isRoot = () => ({ ok: true, stdout: '' });
+// What a shell that RAN reports: exit 1 from `test`, or 127 when sudo is not installed.
+// execSync ALWAYS sets stderr to a Buffer, empty when the command failed silently — the
+// fakes carry it because a fake that omits it hides a message with no cause in it.
+const answered = (status, msg, stderr = '') => () => {
+  const e = new Error(msg); e.status = status; e.stderr = Buffer.from(stderr); throw e;
+};
+const unreachable = () => {
+  const e = new Error('Command failed'); e.status = 255;
+  e.stderr = Buffer.from('ssh: connect to host box port 22: Connection timed out'); throw e;
+};
+
+test('accountPlaneGap: a runner that reaches root passes; one that cannot is named as sharing a uid', () => {
+  const cmds = [];
+  assert.equal(accountPlaneGap((c) => { cmds.push(c); return isRoot(); }), null);
+  assert.deepEqual(cmds, [PROBE], 'one read-only command, no mutation');
+  const gap = accountPlaneGap(answered(1, 'Command failed'));
+  assert.match(gap, /cannot create a per-instance unix account/);
+  assert.match(gap, /one uid/, 'names the consequence, not just the failed command');
+  assert.match(gap, /ADR 0281/);
+});
+
+test('accountPlaneGap: the probe runs the SAME escalation step 1c will, so a pass is evidence', () => {
+  const cmds = [];
+  const rec = (c) => { cmds.push(c); return isRoot(); };
+  accountPlaneGap(rec, { privileged: true });
+  accountPlaneGap(rec, { privileged: false });
+  assert.deepEqual(cmds, [`sudo ${PROBE}`, PROBE]);
+  // sh -c, not a bare `test`: under sudo an outer-shell expansion would answer about the
+  // unprivileged user and pass on exactly the plane this refuses.
+  assert.ok(cmds.every((c) => /sh -c '/.test(c)), 'the command substitution runs INSIDE the escalation');
+});
+
+test('accountPlaneGap: only a shell that answered proves it — a transport failure says it could not confirm', () => {
+  const unsure = accountPlaneGap(unreachable);
+  assert.match(unsure, /could not confirm/);
+  assert.doesNotMatch(unsure, /Provision from a host/, 'a network blip is never diagnosed as a plane property');
+  assert.match(unsure, /Connection timed out/, 'the real cause leads');
+  // The container's two real shapes, both proof.
+  assert.match(accountPlaneGap(answered(127, 'Command failed', 'sh: 1: sudo: not found'), { privileged: true }), /sudo: not found/);
+  assert.match(accountPlaneGap(answered(1, 'Command failed')), /cannot create a per-instance unix account/);
+});
+
+test('accountPlaneGap: a SILENT failure still names a cause — an empty stderr is not a blank reason', () => {
+  // The commonest refusal there is: `test` exits 1 and writes nothing. execSync hands back a
+  // zero-length stderr Buffer, which is truthy and String()s to '' — so a naive
+  // `e.stderr || e.message` prints "failed ()" and tells the operator nothing.
+  const gap = accountPlaneGap(answered(1, 'Command failed: sh -c'));
+  assert.doesNotMatch(gap, /failed \(\)/, 'the parenthetical exists to name the cause');
+  assert.match(gap, /failed \(Command failed: sh -c\)/, 'falls through the empty Buffer to the message');
+});
+
+test('accountPreflight: a dedicated droplet skips it, and a dry run asks the box nothing', () => {
+  const cmds = [];
+  const rec = (c) => { cmds.push(c); return isRoot(); };
+  assert.equal(accountPreflight({ exec: rec, apply: true, log: () => {}, shape: 'dedicated' }), null);
+  assert.deepEqual(cmds, [], 'cloud-init creates that account as root — nothing to ask');
+  const lines = [];
+  assert.equal(accountPreflight({ exec: rec, apply: false, log: (m) => lines.push(m), shape: 'co-tenant' }), null);
+  assert.deepEqual(cmds, [], 'a dry run changes nothing and asks nothing');
+  assert.match(lines.join('\n'), /would probe/, 'the plan says the probe is coming, rather than printing step 1c as though it works');
+});
+
+// -- the runner leg ---------------------------------------------------------
+
+const coTenant = { id: 1, slug: 'mercury', hosting_shape: 'co-tenant', status: 'requested', owner_builder_id: 7, port: 3003, db_name: 'mercury', domain: null };
+
+// `noRoot` is the self-host image: USER node, no sudo, so the probe's shell answers 127.
+function harness({ noRoot = false } = {}) {
+  const cmds = [], writes = [], statuses = [];
+  const exec = (cmd) => {
+    cmds.push(cmd);
+    if (noRoot && cmd.includes('id -u')) { const e = new Error('sh: 1: sudo: not found'); e.status = 127; throw e; }
+    return { ok: true, stdout: '' };
+  };
+  const deps = {
+    apply: true, privileged: true, log: () => {}, sleep: async () => {},
+    db: { query: async () => ({ rows: [] }) },
+    provisioning: {
+      setInstanceStatus: async (_db, _id, s) => { statuses.push(s); }, recordEvent: async () => {},
+      recordDnsNote: async () => {}, clearReleasedDomains: async () => {},
+    },
+    exec,
+    writeFile: (p) => { writes.push(p); return { ok: true }; },
+    doApi: null,
+    checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
+    checkCaddyWiring: () => null,
+    getGithubToken: async () => null,
+  };
+  return { deps, cmds, writes, statuses, ran: (re) => cmds.some((c) => re.test(c)) };
+}
+
+test('provision: a plane that cannot give the child its own account is refused before a single write', async () => {
+  const h = harness({ noRoot: true });
+  const r = await P.provisionInstance(coTenant, h.deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /^Account preflight failed: /);
+  assert.match(r.error, /one uid/);
+  assert.equal(h.writes.length, 0, 'nothing written — not web.env, not the unit');
+  assert.ok(!h.ran(/useradd/), 'the useradd that cannot work is never attempted');
+  assert.ok(!h.ran(/createdb/), 'no database either — the refusal precedes every mutation');
+  assert.deepEqual(h.statuses, [], 'the instance never flips to provisioning');
+});
+
+test('provision: the probe runs BEFORE step 1c, so the refusal replaces the crash rather than following it', async () => {
+  const h = harness({ noRoot: true });
+  await P.provisionInstance(coTenant, h.deps);
+  assert.equal(h.cmds.filter((c) => c.includes('id -u')).length, 1, 'asked once');
+  assert.ok(h.cmds[h.cmds.length - 1].includes('id -u'), 'the probe is the last thing the box was asked');
+});
+
+test('provision: a box where the runner reaches root is unchanged — the live server still provisions', async () => {
+  const h = harness();
+  const r = await P.provisionInstance(coTenant, h.deps);
+  assert.equal(r.ok, true);
+  assert.ok(h.ran(/useradd --system/), 'step 1c still creates the per-instance account');
+  assert.ok(h.ran(/createdb mercury/));
+  const idx = (re) => h.cmds.findIndex((c) => re.test(c));
+  assert.ok(idx(/id -u.*= 0/) < idx(/useradd --system/), 'the probe precedes the account it guards');
+});