@bongos/core 1.19.999 → 1.19.1001

package/tests/provisioning_capacity.mjs

@@ -78,17 +78,23 @@ t('ceilingFor: an explicit override wins; an unmeasured box falls to the ADR sma
   assert.equal(DEFAULT_CEILING, 15);
 });
 
-t('placementBox: standalone → control plane always; co-tenant → the remote box only under remote-exec; dedicated → no shared box', () => {
-  assert.deepEqual(placementBox('standalone', {}), { box: 'control-plane', shapes: ['standalone', 'co-tenant'], fixedMb: 750 });
-  assert.deepEqual(placementBox('standalone', { remoteHost: 'cohost' }), { box: 'control-plane', shapes: ['standalone'], fixedMb: 750 });
-  assert.deepEqual(placementBox('co-tenant', {}), { box: 'control-plane', shapes: ['standalone', 'co-tenant'], fixedMb: 750 });
+t('placementBox: cloud-host → control plane always; co-tenant → the remote box only under remote-exec; byo-host → no box of ours', () => {
+  assert.deepEqual(placementBox('cloud-host', {}), { box: 'control-plane', shapes: ['cloud-host', 'co-tenant'], fixedMb: 750 });
+  assert.deepEqual(placementBox('cloud-host', { remoteHost: 'cohost' }), { box: 'control-plane', shapes: ['cloud-host'], fixedMb: 750 });
+  assert.deepEqual(placementBox('co-tenant', {}), { box: 'control-plane', shapes: ['cloud-host', 'co-tenant'], fixedMb: 750 });
   assert.deepEqual(placementBox('co-tenant', { remoteHost: 'cohost' }), { box: 'overflow', shapes: ['co-tenant'], fixedMb: 630 });
-  assert.equal(placementBox('dedicated', {}), null);
-  // ADR 0323: a byo-host runs on the owner's own machine, so it has no box of ours and
-  // no shared ceiling — null for a STRONGER reason than dedicated's (dedicated is our
-  // droplet, just not a shared one). remoteHost must not change that answer.
+  // ADR 0323: a byo-host runs on the owner's own machine, so it has no box of ours and no
+  // shared ceiling. This used to be one of TWO null answers — 'dedicated' was the other,
+  // null for a weaker reason (our droplet, just not a shared one) — until ADR 0327
+  // decision 4 removed that shape. remoteHost must not change the answer.
   assert.equal(placementBox('byo-host', {}), null);
   assert.equal(placementBox('byo-host', { remoteHost: 'cohost' }), null);
+  // Everything else still falls through to the control-plane box — including the
+  // 'control-plane' row itself, which is unchanged by this rename. So 'byo-host' is now the
+  // ONLY null answer, where there used to be two; the skip reason it produces is named for
+  // the question ('no-shared-box') rather than for the shape, so removing the other one did
+  // not leave a label naming a shape that no longer exists.
+  assert.deepEqual(placementBox('control-plane', {}), { box: 'control-plane', shapes: ['cloud-host', 'co-tenant'], fixedMb: 750 });
 });
 
 t('placementVerdict: the ceiling refuses at N of N, the floor refuses under 256 MB free, an unmeasured floor cannot refuse', () => {
@@ -119,14 +125,14 @@ t('capacitySummary: resize_due at 80% (12 of 15), remaining never negative, verd
 
 await ta('countPlaced counts ONLY provisioning + active rows of the box\'s shapes, and can exclude the row being re-run', async () => {
   const db = fakeDb(10);
-  assert.equal(await countPlaced(db, ['standalone']), 10);
-  assert.deepEqual(db.queries[0].params, [['standalone'], PLACED_STATES]);
+  assert.equal(await countPlaced(db, ['cloud-host']), 10);
+  assert.deepEqual(db.queries[0].params, [['cloud-host'], PLACED_STATES]);
   assert.deepEqual(PLACED_STATES, ['provisioning', 'active'], 'error rows hold no running unit (live fleet, 2026-09-16) and must not take a slot');
   assert.doesNotMatch(db.queries[0].sql, /id <>/, 'no exclusion unless asked');
-  await countPlaced(db, ['standalone', 'co-tenant'], { excludeId: 42 });
+  await countPlaced(db, ['cloud-host', 'co-tenant'], { excludeId: 42 });
   assert.match(db.queries[1].sql, /id <> \$3/);
-  assert.deepEqual(db.queries[1].params, [['standalone', 'co-tenant'], PLACED_STATES, 42]);
-  assert.equal(await countPlaced({ query: async () => ({ rows: [] }) }, ['standalone']), 0, 'a recording fake with no rows reads 0, not NaN');
+  assert.deepEqual(db.queries[1].params, [['cloud-host', 'co-tenant'], PLACED_STATES, 42]);
+  assert.equal(await countPlaced({ query: async () => ({ rows: [] }) }, ['cloud-host']), 0, 'a recording fake with no rows reads 0, not NaN');
 });
 
 await ta('fleetCapacity (the API + CLI summary) measures THIS host and counts the control plane\'s shapes', async () => {
@@ -135,7 +141,7 @@ await ta('fleetCapacity (the API + CLI summary) measures THIS host and counts th
   const c = await fleetCapacity(db, { meminfo: MEMINFO_2GB, remoteHost: null });
   assert.equal(c.box, 'control-plane'); assert.equal(c.placed, 10); assert.equal(c.ceiling, 15); assert.equal(c.source, 'measured');
   assert.equal(c.mem_available_mb, 1108); assert.equal(c.resize_due, false); assert.equal(c.verdict.ok, true);
-  assert.deepEqual(db.queries[0].params[0], ['standalone', 'co-tenant']);
+  assert.deepEqual(db.queries[0].params[0], ['cloud-host', 'co-tenant']);
   const remote = await fleetCapacity(fakeDb(3), { meminfo: MEMINFO_4GB, remoteHost: 'cohost' });
   assert.equal(remote.ceiling, 39, 'the control plane\'s own 4 GB ceiling, not the overflow box\'s');
   // The env override reaches the summary, and is read per call.
@@ -147,7 +153,7 @@ await ta('fleetCapacity (the API + CLI summary) measures THIS host and counts th
 
 console.log('\nthe runner preflight (scripts/gds/provision-capacity.js):');
 
-const standalone = { id: 7, slug: 'lantern', hosting_shape: 'standalone', status: 'requested', owner_builder_id: 3, port: null, db_name: 'lantern', domain: null };
+const cloudHost = { id: 7, slug: 'lantern', hosting_shape: 'cloud-host', status: 'requested', owner_builder_id: 3, port: null, db_name: 'lantern', domain: null };
 
 // Recording deps: which executor was asked, what was logged, which events landed.
 function preflightDeps({ apply = true, placed = 10, controlMeminfo = MEMINFO_2GB, boxMeminfo = MEMINFO_4GB } = {}) {
@@ -164,11 +170,11 @@ function preflightDeps({ apply = true, placed = 10, controlMeminfo = MEMINFO_2GB
   };
 }
 
-await ta('a standalone with room: ok, measured on the CONTROL executor, the count excludes its own row', async () => {
+await ta('a cloud-host with room: ok, measured on the CONTROL executor, the count excludes its own row', async () => {
   const h = preflightDeps({ placed: 10 });
-  const r = await capacityPreflight(standalone, h.deps);
+  const r = await capacityPreflight(cloudHost, h.deps);
   assert.equal(r.ok, true);
-  assert.deepEqual(h.asked, [['control', MEMINFO_CMD]], 'a standalone runs control-plane-local, so its box is measured there');
+  assert.deepEqual(h.asked, [['control', MEMINFO_CMD]], 'a cloud-host runs control-plane-local, so its box is measured there');
   assert.equal(r.ceiling, 15); assert.equal(r.source, 'measured'); assert.equal(r.placed, 10);
   assert.deepEqual(h.deps.db.queries[0].params[2], 7, 'the row being provisioned never counts itself');
   assert.equal(h.events.length, 0, 'nothing to record when it fits');
@@ -177,7 +183,7 @@ await ta('a standalone with room: ok, measured on the CONTROL executor, the coun
 
 await ta('a full box REFUSES with the owner-readable reason, records placement-refused, and returns (never throws)', async () => {
   const h = preflightDeps({ placed: 15 });
-  const r = await capacityPreflight(standalone, h.deps);
+  const r = await capacityPreflight(cloudHost, h.deps);
   assert.equal(r.ok, false);
   assert.match(r.error, /15 of 15 project slots are taken/);
   assert.equal(h.events.length, 1);
@@ -189,7 +195,7 @@ await ta('a full box REFUSES with the owner-readable reason, records placement-r
 
 await ta('the live memory floor refuses even with slots to spare (a stray unit the ledger cannot see)', async () => {
   const h = preflightDeps({ placed: 10, controlMeminfo: MEMINFO_TIGHT });
-  const r = await capacityPreflight(standalone, h.deps);
+  const r = await capacityPreflight(cloudHost, h.deps);
   assert.equal(r.ok, false);
   assert.equal(r.verdict.wall, 'memory');
   assert.match(r.error, /117 MB of memory free/);
@@ -198,7 +204,7 @@ await ta('the live memory floor refuses even with slots to spare (a stray unit t
 
 await ta('at 80% it still places, but the log names the resize trigger', async () => {
   const h = preflightDeps({ placed: 12 });
-  const r = await capacityPreflight(standalone, h.deps);
+  const r = await capacityPreflight(cloudHost, h.deps);
   assert.equal(r.ok, true); assert.equal(r.resize_due, true);
   assert.ok(h.logs.some((l) => /at or past 80%: schedule the resize \(task 1003923\)/.test(l)), h.logs.join(' | '));
 });
@@ -209,35 +215,35 @@ await ta('a co-tenant under remote-exec is measured on the BOX executor against
   CONFIG.remoteHost = 'cohost';
   try {
     const h = preflightDeps({ placed: 40 });
-    const r = await capacityPreflight({ ...standalone, hosting_shape: 'co-tenant' }, h.deps);
+    const r = await capacityPreflight({ ...cloudHost, hosting_shape: 'co-tenant' }, h.deps);
     assert.deepEqual(h.asked, [['box', MEMINFO_CMD]]);
     assert.equal(r.box, 'overflow'); assert.equal(r.ceiling, 41); assert.equal(r.ok, true);
     assert.deepEqual(h.deps.db.queries[0].params[0], ['co-tenant'], 'only the shapes that share that box count');
   } finally { CONFIG.remoteHost = prior; }
 });
 
-await ta('a dedicated droplet is its own box: no measurement, no count, no refusal', async () => {
+await ta('a shape with no box of ours: no measurement, no count, no refusal', async () => {
   const h = preflightDeps({ placed: 99 });
-  const r = await capacityPreflight({ ...standalone, hosting_shape: 'dedicated' }, h.deps);
-  assert.deepEqual(r, { ok: true, skipped: 'dedicated' });
+  const r = await capacityPreflight({ ...cloudHost, hosting_shape: 'byo-host' }, h.deps);
+  assert.deepEqual(r, { ok: true, skipped: 'no-shared-box' });
   assert.equal(h.asked.length, 0); assert.equal(h.deps.db.queries.length, 0);
 });
 
 await ta('dry-run measures nothing and refuses nothing, even on a full box; an unmeasured --apply falls to the default and warns', async () => {
   const dry = preflightDeps({ apply: false, placed: 15 });
-  const r = await capacityPreflight(standalone, dry.deps);
+  const r = await capacityPreflight(cloudHost, dry.deps);
   assert.equal(r.ok, true); assert.equal(r.dryRun, true);
   assert.equal(dry.events.length, 0);
   assert.ok(dry.logs.some((l) => /would refuse if full/.test(l)));
   // --apply with an executor that answers no stdout (a fake, or a box without procfs)
   const blind = preflightDeps({ placed: 3, controlMeminfo: '' });
-  const b = await capacityPreflight(standalone, blind.deps);
+  const b = await capacityPreflight(cloudHost, blind.deps);
   assert.equal(b.ok, true); assert.equal(b.source, 'default'); assert.equal(b.ceiling, DEFAULT_CEILING);
   assert.ok(blind.logs.some((l) => /could not measure the box.*PROVISION_BOX_CEILING/.test(l)), blind.logs.join(' | '));
   // …and an executor that throws is the same as one that answers nothing.
   const throwing = preflightDeps({ placed: 3 });
   throwing.deps.controlExec = () => { throw new Error('ssh down'); };
-  assert.equal((await capacityPreflight(standalone, throwing.deps)).source, 'default');
+  assert.equal((await capacityPreflight(cloudHost, throwing.deps)).source, 'default');
 });
 
 await ta('statusCapacityLine prints "box at N of M" for the CLI', async () => {
@@ -272,7 +278,7 @@ function recorder({ apply, placed, meminfo = MEMINFO_2GB }) {
 
 await ta('provisionInstance(--apply) on a full box returns ok:false BEFORE any status write or standup command', async () => {
   const h = recorder({ apply: true, placed: 15 });
-  const r = await P.provisionInstance(standalone, h.deps);
+  const r = await P.provisionInstance(cloudHost, h.deps);
   assert.equal(r.ok, false);
   assert.match(r.error, /15 of 15 project slots/);
   assert.deepEqual(h.statuses, [], 'never flipped to provisioning — a project that was not placed is not "provisioning"');
@@ -283,7 +289,7 @@ await ta('provisionInstance(--apply) on a full box returns ok:false BEFORE any s
 
 await ta('provisionInstance(--apply) with room proceeds into the runbook exactly as before', async () => {
   const h = recorder({ apply: true, placed: 10 });
-  const r = await P.provisionInstance({ ...standalone, hosting_shape: 'co-tenant', port: 3003 }, h.deps);
+  const r = await P.provisionInstance({ ...cloudHost, hosting_shape: 'co-tenant', port: 3003 }, h.deps);
   assert.equal(r.ok, true);
   assert.equal(h.statuses[0], 'provisioning');
   assert.equal(h.cmds[0], MEMINFO_CMD, 'measured first');
@@ -292,7 +298,7 @@ await ta('provisionInstance(--apply) with room proceeds into the runbook exactly
 
 await ta('provisionInstance(dry-run) on a full box still prints the whole plan — dry-run places nothing, so it refuses nothing', async () => {
   const h = recorder({ apply: false, placed: 15 });
-  const r = await P.provisionInstance({ ...standalone, hosting_shape: 'co-tenant', port: 3003 }, h.deps);
+  const r = await P.provisionInstance({ ...cloudHost, hosting_shape: 'co-tenant', port: 3003 }, h.deps);
   assert.equal(r.ok, true);
   assert.ok(h.cmds.some((c) => /createdb lantern/.test(c)));
 });
@@ -306,7 +312,7 @@ await ta('cmdRunIntents: a refused placement retires onto the card as error_note
     db: fakeDb(15),
     provisioning: {
       claimNextIntent: async () => (claims++ === 0 ? { id: 9, instance_id: 7, action: 'provision', attempts: P.MAX_INTENT_ATTEMPTS } : null),
-      getInstanceById: async () => ({ ...standalone }),
+      getInstanceById: async () => ({ ...cloudHost }),
       resolveIntent: async (_db, id, state, err) => { resolved.push({ id, state, err }); },
       setInstanceStatus: async (_db, id, status, patch) => { statusWrites.push({ id, status, patch }); },
       recordEvent: async (_db, e) => { events.push(e); },
@@ -335,7 +341,7 @@ await ta('cmdRunIntents: below the attempt cap a refusal goes back to pending wi
     apply: true, log: () => {}, db,
     provisioning: {
       claimNextIntent: async () => (claims++ === 0 ? { id: 9, instance_id: 7, action: 'provision', attempts: 1 } : null),
-      getInstanceById: async () => ({ ...standalone }),
+      getInstanceById: async () => ({ ...cloudHost }),
       resolveIntent: async () => { throw new Error('must not resolve on a retryable refusal'); },
       setInstanceStatus: async () => { throw new Error('must not touch the instance on a retryable refusal'); },
       recordEvent: async () => {},
@@ -357,7 +363,7 @@ console.log('\nthe fleet API carries the same summary:');
 // Stub the route's data access at the same seams tests/provisioning_paid_shape_gate.mjs
 // uses; the capacity module object is shared with the route through the require cache.
 const provisioning = require('../modules/provisioning/provisioning.js');
-provisioning.listAllInstances = async () => [{ id: 1, owner_builder_id: 7, slug: 'lantern', status: 'active', hosting_shape: 'standalone', settings: {}, detail: {}, github_login: 'o', display_name: 'O', rank: 'archon' }];
+provisioning.listAllInstances = async () => [{ id: 1, owner_builder_id: 7, slug: 'lantern', status: 'active', hosting_shape: 'cloud-host', settings: {}, detail: {}, github_login: 'o', display_name: 'O', rank: 'archon' }];
 const api = require('../src/module-api.js');
 api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
 api.requirePermission = () => (_req, _res, next) => next();

package/tests/provisioning_capacity_gate.mjs

@@ -8,7 +8,7 @@
 // naming N of M, before any row or intent exists.
 //
 // What these tests pin: the refusal lands before createInstance; a box the web tier cannot
-// count (dedicated, a remote co-host) is never refused here; a re-request of a row that
+// count (a remote co-host, or byo-host) is never refused here; a re-request of a row that
 // already holds its slot stays idempotent, while a revive (which takes a slot) is counted;
 // the live-memory floor stays the runner's; and a capacity read that fails ADMITS, because
 // the runner remains the wall.
@@ -100,7 +100,7 @@ function reset({ count = 0, row = null, mem = MEMINFO_2GB, fails = false } = {})
   delete process.env.PROVISION_REMOTE_HOST;
 }
 
-const WIZARD = { slug: 'lantern', hosting_shape: 'standalone', no_address: true };
+const WIZARD = { slug: 'lantern', hosting_shape: 'cloud-host', no_address: true };
 
 // ── the wall ──────────────────────────────────────────────────────────────────────
 
@@ -141,13 +141,6 @@ await ta('an absent shape takes the byo-host default, so a full box does NOT ref
 
 // ── boxes the web tier cannot count are the runner's ──────────────────────────────
 
-await ta('dedicated is its own box: never refused here, and the count is never read', async () => {
-  reset({ count: 15 });
-  const res = await post({ slug: 'lantern', hosting_shape: 'dedicated', no_address: true });
-  assert.equal(res.status, 201, res.raw);
-  assert.equal(capacityReads, 0);
-});
-
 await ta('byo-host runs on the OWNER\'s machine: never refused here, and the count is never read', async () => {
   // ADR 0323's new shape, and the strongest form of "not our box": there is no machine
   // of ours to place it on at all, so a full control plane must not refuse it and the
@@ -176,14 +169,14 @@ await ta('the live-memory floor is left to the runner: slots free + memory tight
 // ── re-requests ───────────────────────────────────────────────────────────────────
 
 await ta('a re-request of the owner\'s ACTIVE project on a full box stays idempotent (no box_full)', async () => {
-  reset({ count: 15, row: { id: 42, owner_builder_id: 7, slug: 'lantern', hosting_shape: 'standalone', status: 'active' } });
+  reset({ count: 15, row: { id: 42, owner_builder_id: 7, slug: 'lantern', hosting_shape: 'cloud-host', status: 'active' } });
   const res = await post(WIZARD);
   assert.notEqual(res.status, 409, res.raw);
   assert.ok(res.status < 300, res.raw);
 });
 
 await ta('a revive of a torn-down project takes a slot, so a full box refuses it', async () => {
-  reset({ count: 15, row: { id: 42, owner_builder_id: 7, slug: 'lantern', hosting_shape: 'standalone', status: 'torn_down' } });
+  reset({ count: 15, row: { id: 42, owner_builder_id: 7, slug: 'lantern', hosting_shape: 'cloud-host', status: 'torn_down' } });
   const res = await post(WIZARD);
   assert.equal(res.status, 409, res.raw);
   assert.equal(res.body.error.code, 'box_full');
@@ -199,7 +192,7 @@ await ta('a capacity read that fails ADMITS — the runner remains the wall', as
 });
 
 await ta('a malformed slug or shape gets the handler\'s 400, not box_full', async () => {
-  for (const body of [{ slug: 'Bad Slug!', hosting_shape: 'standalone' }, { slug: 'lantern', hosting_shape: 'giant' }]) {
+  for (const body of [{ slug: 'Bad Slug!', hosting_shape: 'cloud-host' }, { slug: 'lantern', hosting_shape: 'giant' }]) {
     reset({ count: 15 });
     const res = await post(body);
     assert.equal(res.status, 400, `${JSON.stringify(body)} → ${res.raw}`);

package/tests/provisioning_cost_ledger.mjs

@@ -0,0 +1,98 @@
+// tests/provisioning_cost_ledger.mjs — the fleet cost ledger asks two questions, one
+// column each (task 1004148, ADR 0327): what a row costs US, and an estimate of what it
+// costs its OWNER. A row neither can price reads null (unpriced), never 0 — the old
+// single column reported a confident $0 for every project, with no way to tell
+// "costs nothing" from "we don't know".
+//
+// DB-free: CI has no Postgres, so costLedger runs against a recording fake.
+//
+// Run:  node tests/provisioning_cost_ledger.mjs
+import { strict as assert } from 'node:assert';
+import { makeRunner } from './helpers.mjs';
+import {
+  platformMonthlyUsd, ownerMonthlyUsd, costLedger, RENDER_PLAN_MONTHLY_USD,
+} from '../modules/provisioning/cost-ledger.js';
+
+const { test, summary } = makeRunner();
+
+const PLAN = Object.keys(RENDER_PLAN_MONTHLY_USD)[0];
+
+await test('a cloud-host with no plan named is unpriced for its owner, not $0', () => {
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'cloud-host', tier: null }), null);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'cloud-host' }), null);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'cloud-host', tier: '' }), null);
+});
+
+await test('a cloud-host on a named plan is priced from the plan table', () => {
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'cloud-host', tier: PLAN }), RENDER_PLAN_MONTHLY_USD[PLAN]);
+  assert.ok(RENDER_PLAN_MONTHLY_USD[PLAN] > 0);
+});
+
+await test('an unrecognised plan is unpriced, including an Object.prototype key', () => {
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'cloud-host', tier: 'pro-max+pro-64gb' }), null);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'cloud-host', tier: 'constructor' }), null);
+  assert.equal(platformMonthlyUsd({ hostingShape: 'control-plane', tier: 'toString' }), null);
+});
+
+await test('a cloud-host costs US a correct $0: it runs on its owner\'s own account', () => {
+  assert.equal(platformMonthlyUsd({ hostingShape: 'cloud-host', tier: PLAN }), 0);
+  assert.equal(platformMonthlyUsd({ hostingShape: 'cloud-host', tier: null }), 0);
+});
+
+await test('byo-host: $0 to us, and unpriced for the owner (their own machine)', () => {
+  assert.equal(platformMonthlyUsd({ hostingShape: 'byo-host' }), 0);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'byo-host' }), null);
+});
+
+await test('co-tenant shares our box: no owner is billed, and the box is priced once', () => {
+  assert.equal(platformMonthlyUsd({ hostingShape: 'co-tenant' }), 0);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'co-tenant' }), 0);
+});
+
+await test('the control plane is OUR cost, priced by its droplet size; no size is unpriced', () => {
+  assert.equal(platformMonthlyUsd({ hostingShape: 'control-plane', tier: 's-1vcpu-2gb' }), 12);
+  assert.equal(platformMonthlyUsd({ hostingShape: 'control-plane', tier: null }), null);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'control-plane', tier: 's-1vcpu-2gb' }), 0);
+});
+
+await test('an unknown shape is unpriced in both columns', () => {
+  assert.equal(platformMonthlyUsd({ hostingShape: 'dedicated', tier: 's-2vcpu-4gb' }), null);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'dedicated', tier: 's-2vcpu-4gb' }), null);
+});
+
+function recordingDb(rows) {
+  const calls = [];
+  return { calls, query: async (sql, params) => { calls.push({ sql, params }); return { rows }; } };
+}
+const row = (id, hosting_shape, tier = null) =>
+  ({ id, slug: `p${id}`, hosting_shape, tier, status: 'active', github_login: 'owner' });
+
+await test('the live fleet today: every total says how many rows it could not price', async () => {
+  // Measured 2026-09-24: the control plane (no size recorded) + five cloud-hosts (no plan).
+  const db = recordingDb([row(1, 'control-plane'), ...[2, 3, 4, 5, 6].map((id) => row(id, 'cloud-host'))]);
+  const out = await costLedger(db);
+  assert.deepEqual(out.totals.platform, { monthly_usd: 0, unpriced: 1 });
+  assert.deepEqual(out.totals.owner, { monthly_usd: 0, unpriced: 5 });
+  assert.equal(out.instances[0].platform_monthly_usd, null);
+  assert.equal(out.instances[1].owner_monthly_usd, null);
+});
+
+await test('totals sum only priced rows, per column', async () => {
+  const db = recordingDb([
+    row(1, 'control-plane', 's-1vcpu-2gb'), row(2, 'cloud-host', PLAN), row(3, 'cloud-host', PLAN),
+    row(4, 'cloud-host'), row(5, 'byo-host'),
+  ]);
+  const out = await costLedger(db);
+  assert.deepEqual(out.totals.platform, { monthly_usd: 12, unpriced: 0 });
+  assert.deepEqual(out.totals.owner, { monthly_usd: 2 * RENDER_PLAN_MONTHLY_USD[PLAN], unpriced: 2 });
+  assert.equal('cost_estimate_usd' in out.instances[0], false, 'the one-column-two-questions field is gone');
+});
+
+await test('the query skips torn-down rows and clamps the limit', async () => {
+  const db = recordingDb([]);
+  await costLedger(db, { limit: 99999 });
+  assert.match(db.calls[0].sql, /status <> 'torn_down'/);
+  assert.deepEqual(db.calls[0].params, [2000]);
+});
+
+summary();

package/tests/provisioning_default_domain.mjs

@@ -133,7 +133,7 @@ function post(path, body = {}) {
 }
 
 const freshRow = (over = {}) => ({
-  id: 41, owner_builder_id: 7, slug: 'spike', status: 'requested', hosting_shape: 'standalone',
+  id: 41, owner_builder_id: 7, slug: 'spike', status: 'requested', hosting_shape: 'cloud-host',
   domain: 'spike.cloudbongos.com', onboard_mode: 'greenfield', type: null, created_at: '', updated_at: '', ...over,
 });
 

package/tests/provisioning_domain_attach.mjs

@@ -192,7 +192,7 @@ function reset({ inst, holder } = {}) {
 console.log('\nPOST /provisioning/instances/:id/domain — give an existing instance its address:');
 
 await ta('ACTIVE domainless instance: domain is validated, recorded, and a domain-attach intent queues', async () => {
-  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'standalone', domain: null } });
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'cloud-host', domain: null } });
   const res = await post('/provisioning/instances/18/domain', { domain: 'Spike.CloudBongos.com.' });
   assert.equal(res.status, 200, res.raw);
   assert.equal(res.body.ok, true);
@@ -419,7 +419,7 @@ console.log('\nPOST /provisioning/instances — slug re-requests are truthful ab
 await ta('re-request with a domain on an existing instance SAYS the domain was ignored (and where to send it)', async () => {
   reset();
   createResult = { instance: { id: 18, owner_builder_id: 7, slug: 'spike', status: 'active', domain: null }, created: false };
-  const res = await post('/provisioning/instances', { slug: 'spike', hosting_shape: 'standalone', domain: 'spike.cloudbongos.com' });
+  const res = await post('/provisioning/instances', { slug: 'spike', hosting_shape: 'cloud-host', domain: 'spike.cloudbongos.com' });
   assert.equal(res.status, 200, res.raw);
   assert.ok(res.body.domain_ignored, 'the drop is surfaced, not silent');
   assert.equal(res.body.domain_ignored.requested, 'spike.cloudbongos.com');
@@ -429,7 +429,7 @@ await ta('re-request with a domain on an existing instance SAYS the domain was i
 await ta('re-request with the SAME domain the instance already has → no ignored flag (nothing was dropped)', async () => {
   reset();
   createResult = { instance: { id: 18, owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com' }, created: false };
-  const res = await post('/provisioning/instances', { slug: 'spike', hosting_shape: 'standalone', domain: 'spike.cloudbongos.com' });
+  const res = await post('/provisioning/instances', { slug: 'spike', hosting_shape: 'cloud-host', domain: 'spike.cloudbongos.com' });
   assert.equal(res.status, 200, res.raw);
   assert.equal(res.body.domain_ignored, undefined);
 });
@@ -437,7 +437,7 @@ await ta('re-request with the SAME domain the instance already has → no ignore
 await ta('a fresh create with a domain is untouched (the domain is stored at creation — nothing ignored)', async () => {
   reset();
   createResult = { instance: { id: 43, owner_builder_id: 7, slug: 'new', status: 'requested', domain: 'new.cloudbongos.com' }, created: true };
-  const res = await post('/provisioning/instances', { slug: 'new', hosting_shape: 'standalone', domain: 'new.cloudbongos.com' });
+  const res = await post('/provisioning/instances', { slug: 'new', hosting_shape: 'cloud-host', domain: 'new.cloudbongos.com' });
   assert.equal(res.status, 201, res.raw);
   assert.equal(res.body.domain_ignored, undefined);
 });

package/tests/provisioning_domain_unique.mjs

@@ -249,7 +249,7 @@ console.log('\nPOST /provisioning/instances/:id/domain — the index refusing a
 
 await ta('the index catching the race answers domain_taken 409, and nothing is queued', async () => {
   reset();
-  instance = { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'standalone', domain: null };
+  instance = { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'cloud-host', domain: null };
   updateThrows = DOMAIN_VIOLATION();
   const res = await post('/provisioning/instances/18/domain', { domain: 'mercury.example.com' });
   assert.equal(res.status, 409, res.raw);
@@ -260,7 +260,7 @@ await ta('the index catching the race answers domain_taken 409, and nothing is q
 
 await ta('any OTHER failure on attach is still the honest 500', async () => {
   reset();
-  instance = { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'standalone', domain: null };
+  instance = { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'cloud-host', domain: null };
   updateThrows = Object.assign(new Error('connection terminated'), { code: '57P01' });
   const res = await post('/provisioning/instances/18/domain', { domain: 'mercury.example.com' });
   assert.equal(res.status, 500, res.raw);

package/tests/provisioning_error_note_scope.mjs

@@ -30,7 +30,7 @@ const provisioning = require('../modules/provisioning/provisioning.js');
 const { test, summary } = makeRunner();
 
 const activeStandalone = {
-  id: 18, slug: 'spike', hosting_shape: 'standalone', status: 'active', owner_builder_id: 7,
+  id: 18, slug: 'spike', hosting_shape: 'cloud-host', status: 'active', owner_builder_id: 7,
   port: 3010, db_name: 'spike', domain: null, target_ref: 'jaxri/spike-harbor',
 };
 

package/tests/provisioning_module_selection.mjs

@@ -74,7 +74,7 @@ await ta('createInstance: a chosen set is stored as a jsonb array, in catalog or
 
   // Act
   await provisioning.createInstance(db, {
-    ownerBuilderId: 7, slug: 'demo', hostingShape: 'standalone', type: 'game',
+    ownerBuilderId: 7, slug: 'demo', hostingShape: 'cloud-host', type: 'game',
     modules: ['discord', 'agents'],
   });
 
@@ -90,7 +90,7 @@ await ta('createInstance: NO answer stores NULL — the skip has to stay readabl
   for (const modules of [undefined, null, 'discord', 42]) {
     const db = recordingDb();
     await provisioning.createInstance(db, {
-      ownerBuilderId: 7, slug: 'demo', hostingShape: 'standalone', type: 'game', modules,
+      ownerBuilderId: 7, slug: 'demo', hostingShape: 'cloud-host', type: 'game', modules,
     });
     const params = insertParams(db);
     assert.equal(params[13], null, `modules=${JSON.stringify(modules)} stores NULL, not an empty list`);
@@ -100,7 +100,7 @@ await ta('createInstance: NO answer stores NULL — the skip has to stay readabl
 await ta('createInstance: an explicit empty answer is stored, and is NOT the same as absent', async () => {
   const db = recordingDb();
   await provisioning.createInstance(db, {
-    ownerBuilderId: 7, slug: 'demo', hostingShape: 'standalone', type: 'game', modules: [],
+    ownerBuilderId: 7, slug: 'demo', hostingShape: 'cloud-host', type: 'game', modules: [],
   });
   assert.equal(insertParams(db)[13], '[]', 'the owner said none of them, and the row says so');
 });
@@ -110,7 +110,7 @@ await ta('createInstance: the always-on core is never written into the selection
   // the column disagree with ALWAYS_ON_CORE the day a manifest flips its default.
   const db = recordingDb();
   await provisioning.createInstance(db, {
-    ownerBuilderId: 7, slug: 'demo', hostingShape: 'standalone', modules: ['memory', 'discord', 'provisioning'],
+    ownerBuilderId: 7, slug: 'demo', hostingShape: 'cloud-host', modules: ['memory', 'discord', 'provisioning'],
   });
   assert.equal(insertParams(db)[13], JSON.stringify(['discord']));
 });
@@ -164,7 +164,7 @@ provisioning.createInstance = async (_db, args) => {
   lastCreateArgs = args;
   return existingRow
     ? { instance: existingRow, created: false }
-    : { instance: { id: 41, owner_builder_id: 7, slug: args.slug, status: 'requested', hosting_shape: 'standalone', type: args.type || null, detail: {} }, created: true };
+    : { instance: { id: 41, owner_builder_id: 7, slug: args.slug, status: 'requested', hosting_shape: 'cloud-host', type: args.type || null, detail: {} }, created: true };
 };
 provisioning.enqueueIntent = async (_db, id, action) => ({ intent: { id: 9, action, state: 'pending' }, created: true });
 provisioning.getOpenIntent = async () => null;

package/tests/provisioning_onboard_mode.mjs

@@ -53,7 +53,7 @@ await ta('createInstance: onboardMode "adopt" is persisted', async () => {
   const db = recordingDb();
   await provisioning.createInstance(db, {
     ownerBuilderId: 7, slug: 'demo', targetRef: 'example-owner/demo',
-    hostingShape: 'standalone', onboardMode: 'adopt',
+    hostingShape: 'cloud-host', onboardMode: 'adopt',
   });
   const insert = db.calls.find((c) => /INSERT INTO provisioning_instances/i.test(c.text));
   assert.ok(insert, 'issued an INSERT');
@@ -68,7 +68,7 @@ await ta('createInstance: absent / unknown onboardMode → greenfield, the SAFE
   for (const mode of [undefined, null, '', 'ADOPT', 'brownfield', 'nonsense']) {
     const db = recordingDb();
     await provisioning.createInstance(db, {
-      ownerBuilderId: 7, slug: 'demo', hostingShape: 'standalone', onboardMode: mode,
+      ownerBuilderId: 7, slug: 'demo', hostingShape: 'cloud-host', onboardMode: mode,
     });
     const insert = db.calls.find((c) => /INSERT INTO provisioning_instances/i.test(c.text));
     assert.ok(insert.params.includes('greenfield'), `onboardMode=${JSON.stringify(mode)} → greenfield`);