@bongos/core 1.20.14 → 1.20.16

package/tests/provision.mjs

@@ -372,24 +372,6 @@ t('healthzCmd hits the instance port /healthz', () => {
   assert.match(P.healthzCmd(coTenant), /127\.0\.0\.1:3003\/healthz/);
 });
 
-t('dedicatedUserData bakes createdb + migrate + first-version seed into cloud-init (task 2119: dedicated must not diverge)', () => {
-  const ud = P.dedicatedUserData(coTenant);
-  assert.match(ud, /^#cloud-config/);
-  assert.match(ud, /createdb mercury/);
-  assert.match(ud, /MEDUSA_GDS_ONLY=1/);
-  // the seed rides cloud-init too, so a dedicated droplet also comes up able to take tasks
-  assert.match(ud, /INSERT INTO versions/, 'seed baked into cloud-init');
-  // it must be its OWN runcmd line AFTER migrate (the schema must exist first)
-  const lines = ud.split('\n');
-  const iMig = lines.findIndex((l) => /migrate\.sh/.test(l));
-  const iSeed = lines.findIndex((l) => /INSERT INTO versions/.test(l));
-  assert.ok(iMig >= 0 && iSeed > iMig, 'seed line comes after the migrate line');
-  // the seed line is a valid bash -lc "…" item: single-quoted -c arg, NO double quotes to break the YAML scalar
-  const seedLine = lines[iSeed];
-  assert.match(seedLine, /- \[ bash, -lc, "psql .*" \]/, 'well-formed cloud-init runcmd item');
-  assert.doesNotMatch(seedLine.replace(/^.*-lc, "/, '').replace(/" \]$/, ''), /"/, 'the seed command carries no inner double quotes');
-});
-
 console.log('\nport allocation:');
 
 t('nextFreePort skips reserved + taken, returns the lowest free ≥ base', () => {
@@ -440,7 +422,6 @@ function recorder({ apply = false } = {}) {
     },
     exec: (cmd) => { cmds.push(cmd); return { ok: true, stdout: '' }; },
     writeFile: (p) => { writes.push(p); return { ok: true }; },
-    doApi: null,
     // Stub the DNS token-scope preflight (task 1980) so the composition stays hermetic
     // (no real CF call). Default: reachable; a test overrides it to exercise the block.
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
@@ -1323,29 +1304,6 @@ await ta('provisionInstance is idempotent: an already-active instance is a no-op
   assert.equal(cmds.length, 0, 'no commands run for an active instance');
 });
 
-await ta('provisionInstance(dedicated) does NOT run local createdb/migrate/seed (they ride cloud-init)', async () => {
-  const { deps, cmds } = recorder();
-  await P.provisionInstance({ ...coTenant, hosting_shape: 'dedicated', tier: 's-2vcpu-4gb' }, deps);
-  assert.ok(!cmds.some((c) => /createdb/.test(c)), 'dedicated does not run createdb locally');
-  assert.ok(!cmds.some((c) => /INSERT INTO versions/.test(c)), 'dedicated does not run the version seed locally (it rides cloud-init)');
-});
-
-await ta('dedicatedUserData bakes the nightly backup: unit files (b64) + dir + timer enable (task 2213)', async () => {
-  const inst = { ...coTenant, hosting_shape: 'dedicated' };
-  const cloudInit = P.dedicatedUserData(inst);
-  // the two unit files land via write_files (base64, so no YAML block-scalar escaping)
-  assert.match(cloudInit, /write_files:/);
-  assert.match(cloudInit, new RegExp('path: ' + reEsc(P.backupServicePath(inst))));
-  assert.match(cloudInit, new RegExp('path: ' + reEsc(P.backupTimerPath(inst))));
-  assert.match(cloudInit, /encoding: b64/);
-  // the base64 content round-trips to a real unit carrying the right DB
-  const b64 = cloudInit.match(/content: ([A-Za-z0-9+/=]+)/)[1];
-  assert.match(Buffer.from(b64, 'base64').toString('utf8'), /Environment=GDS_BACKUP_DB=mercury/);
-  // and the dir is created + the timer enabled on first boot
-  assert.match(cloudInit, /install -d -o appsvc -g \$\(id -gn appsvc\) -m 0750 \/var\/backups\/gds/);
-  assert.match(cloudInit, /enable --now mercury mercury-db-backup\.timer/);
-});
-
 console.log('\nDNS UPSERT composition (P4, CONFIG override):');
 
 // A recorder that also captures each exec's env (so we can assert the DNS hook env).
@@ -1359,7 +1317,7 @@ function dnsRecorder({ apply = false } = {}) {
       clearReleasedDomains: async (_db, id) => { cleared.push(id); },
     },
     exec: (cmd, opts) => { cmds.push(cmd); envs.push(opts && opts.env); return { ok: true, stdout: '' }; },
-    writeFile: () => ({ ok: true }), doApi: null,
+    writeFile: () => ({ ok: true }),
     // Preflight (task 1980) stubbed reachable so --apply DNS tests reach the step-5
     // behavior they assert (the preflight itself is covered by its own test below).
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
@@ -1499,7 +1457,7 @@ await ta('cmdRunIntents (--apply) claims → provisions → resolves the intent
       claimNextOAuthManifest: async () => null,
       resolveOAuthManifest: async () => {},
     },
-    exec: () => ({ ok: true }), writeFile: () => ({ ok: true }), doApi: null,
+    exec: () => ({ ok: true }), writeFile: () => ({ ok: true }),
   };
   const r = await P.cmdRunIntents(deps);
   assert.equal(r.ran, 1);
@@ -1589,10 +1547,8 @@ await ta('placeManifestCreds (--apply): converts, rewrites web.env with the cred
   assert.ok(cmds.some((c) => /\/healthz/.test(c)), 'probes healthz');
 });
 
-await ta('placeManifestCreds rejects a dedicated droplet (no post-hoc exec path) and creds-less rows', async () => {
+await ta('placeManifestCreds rejects a creds-less row', async () => {
   const deps = { apply: true, log: () => {}, exec: () => ({ ok: true }), writeFile: () => ({}) };
-  const ded = await P.placeManifestCreds({ ...coTenant, hosting_shape: 'dedicated', domain: 'd.example.com' }, { github_code: 'C' }, deps);
-  assert.equal(ded.ok, false); assert.match(ded.error, /dedicated/);
   const noCode = await P.placeManifestCreds({ ...coTenant, domain: 'm.example.com' }, {}, deps);
   assert.equal(noCode.ok, false); assert.match(noCode.error, /no github_code/);
 });
@@ -1690,9 +1646,9 @@ await ta('a PRE-conversion failure stays retryable — the narrowing spared the
     apply: true, privileged: false, log: () => {}, sleep: async () => {},
     db: {}, exec: () => ({ ok: true, stdout: '' }), writeFile: () => ({ ok: true }),
     provisioning: {
-      claimNextOAuthManifest: async () => (claims++ === 0 ? { id: 22, instance_id: 1, github_code: 'C', attempts: 1 } : null),
-      // dedicated shape → placeManifestCreds refuses BEFORE converting (codeSpent absent)
-      getInstanceById: async () => ({ ...coTenant, hosting_shape: 'dedicated', domain: 'd.example.com' }),
+      // no github_code → placeManifestCreds refuses BEFORE converting (codeSpent absent)
+      claimNextOAuthManifest: async () => (claims++ === 0 ? { id: 22, instance_id: 1, github_code: null, attempts: 1 } : null),
+      getInstanceById: async () => ({ ...coTenant, domain: 'd.example.com' }),
       resolveOAuthManifest: async (_db, _id, status, patch = {}) => { resolves.push({ status, patch }); },
       recordEvent: async () => {},
     },
@@ -1772,7 +1728,6 @@ function privRecorder({ apply = false } = {}) {
     provisioning: { setInstanceStatus: async () => {}, recordEvent: async () => {} },
     exec: (cmd) => { cmds.push(cmd); return { ok: true, stdout: '' }; },
     writeFile: (p, _body, opts) => { writes.push({ p, opts: opts || {} }); return { ok: true }; },
-    doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
     checkCaddyWiring: () => null,
   };
@@ -1822,36 +1777,6 @@ await ta('teardownInstance(privileged): systemctl + rm-under-/etc are sudo-prefi
   assert.ok(idx(/daemon-reload/) < idx(/reset-failed/), 'reset-failed after the reload that forgets the file — reset first and the stopped unit could fail again');
 });
 
-await ta('teardownInstance(dedicated): no systemd steps at all, so no reset-failed either (its own droplet)', async () => {
-  const { deps, cmds } = recorder();
-  await P.teardownInstance({ ...coTenant, hosting_shape: 'dedicated', droplet_id: 9 }, deps);
-  assert.ok(!cmds.some((c) => /reset-failed|daemon-reload|disable --now/.test(c)), cmds.join(' | '));
-});
-
-// F6 (task 1002718): main() builds deps.doApi on first READ, so a caller must only read it
-// on a path that really calls DigitalOcean — a throwing getter proves the others never do.
-function doApiTripwire(deps) {
-  Object.defineProperty(deps, 'doApi', { get() { throw new Error('read deps.doApi on a path that makes no DO call'); } });
-  return deps;
-}
-
-await ta('teardownInstance(dedicated, no droplet_id) under --apply never reads deps.doApi (F6)', async () => {
-  const { deps } = recorder({ apply: true });
-  await P.teardownInstance({ ...coTenant, hosting_shape: 'dedicated', droplet_id: null }, doApiTripwire(deps));
-});
-
-await ta('provisionInstance(co-tenant) under --apply never reads deps.doApi (F6)', async () => {
-  const { deps } = recorder({ apply: true });
-  const r = await P.provisionInstance(coTenant, doApiTripwire(deps));
-  assert.ok(!/deps\.doApi/.test(String(r && r.error)), String(r && r.error));
-});
-
-t('main() constructs the DO client lazily — no DO_API_TOKEN needed until a DO call (F6)', () => {
-  const src = readFileSync(new URL('../scripts/gds/provision.js', import.meta.url), 'utf8');
-  assert.match(src, /get doApi\(\)/, 'deps.doApi is a getter');
-  assert.ok(!/doApi:\s*DoApi \? new DoApi/.test(src), 'no eager construction at deps build');
-});
-
 await ta('teardownInstance(default): NO sudo (bare, unchanged)', async () => {
   const { deps, cmds } = recorder();
   await P.teardownInstance(coTenant, deps);
@@ -1914,7 +1839,6 @@ await ta('provisionInstance(co-tenant, remote): box steps use the box `exec`, bu
       controlExec: (cmd) => { control.push(cmd); return { ok: true, stdout: '' }; },
       writeFile: () => ({ ok: true }),
       controlWriteFile: () => ({ ok: true }),
-      doApi: null,
       checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
       checkCaddyWiring: () => null,
     };
@@ -1946,7 +1870,6 @@ await ta('provisionInstance(standalone, remote): EVERY box step runs control-pla
       controlExec: (cmd, opts) => { control.push(cmd); if (opts && opts.env) dnsEnvs.push({ cmd, env: opts.env }); return { ok: true, stdout: '' }; },
       writeFile: (p) => { boxWrites.push(p); return { ok: true }; },                            // the REMOTE writer
       controlWriteFile: (p) => { controlWrites.push(p); return { ok: true }; },                 // the control-plane writer
-      doApi: null,
       checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
       checkCaddyWiring: () => null,
     };
@@ -1986,7 +1909,7 @@ await ta('provisionInstance(standalone, remote, --apply): FAILS LOUD when the co
       db: { query: async () => ({ rows: [] }) },
       provisioning: { setInstanceStatus: async () => {}, recordEvent: async () => {} },
       exec: () => ({ ok: true, stdout: '' }), controlExec: () => ({ ok: true, stdout: '' }),
-      writeFile: () => ({ ok: true }), controlWriteFile: () => ({ ok: true }), doApi: null,
+      writeFile: () => ({ ok: true }), controlWriteFile: () => ({ ok: true }),
       checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
       checkCaddyWiring: () => null,
     };
@@ -2006,7 +1929,7 @@ await ta('teardownInstance(standalone, remote): tears down on the CONTROL PLANE
     provisioning: { setInstanceStatus: async () => {}, recordEvent: async () => {} },
     exec: (cmd) => { box.push(cmd); return { ok: true }; },
     controlExec: (cmd) => { control.push(cmd); return { ok: true }; },
-    writeFile: () => ({ ok: true }), controlWriteFile: () => ({ ok: true }), doApi: null,
+    writeFile: () => ({ ok: true }), controlWriteFile: () => ({ ok: true }),
   };
   await P.teardownInstance({ ...coTenant, hosting_shape: 'cloud-host' }, deps);
   assert.ok(control.some((c) => /systemctl disable --now mercury/.test(c)), 'disable runs on the control plane');
@@ -2231,7 +2154,6 @@ function attachRecorder({ apply = false, envBody = WEB_ENV_ON_BOX } = {}) {
       return { ok: true, stdout: '' };
     },
     writeFile: (p, body) => { writes.push({ path: p, body }); return { ok: true }; },
-    doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
     checkCaddyWiring: () => null,
   };
@@ -2441,14 +2363,6 @@ await ta('domainAttachInstance: instance no longer active → clean no-op (provi
   }
 });
 
-await ta('domainAttachInstance: dedicated is not automated — ok:false with guidance, box untouched', async () => {
-  const { deps, cmds } = attachRecorder();
-  const r = await P.domainAttachInstance({ ...activeStandalone, hosting_shape: 'dedicated' }, deps);
-  assert.equal(r.ok, false);
-  assert.match(r.error, /dedicated/);
-  assert.equal(cmds.length, 0);
-});
-
 await ta('domainAttachInstance(--apply): a DNS preflight failure returns ok:false — never THROWS (a throw would flip the ACTIVE instance to error in the drain loop)', async () => {
   const savedHook = P.CONFIG.dnsHook; P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh';
   try {
@@ -2478,7 +2392,7 @@ await ta('cmdRunIntents (--apply) routes a domain-attach intent to the attach le
     // the attach leg patches web.env IN PLACE, so a `cat` must return a real file
     // — an empty one is a deliberate refusal (task 1003237)
     exec: (cmd) => ({ ok: true, stdout: /\bcat\b.*web\.env/.test(String(cmd)) ? 'PORT=3010\n' : '' }),
-    writeFile: () => ({ ok: true }), doApi: null,
+    writeFile: () => ({ ok: true }),
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
     checkCaddyWiring: () => null,
   };
@@ -2503,7 +2417,7 @@ await ta('cmdRunIntents (--apply): an UNKNOWN intent action never falls through
       resolveOAuthManifest: async () => {},
     },
     exec: (c) => { cmds.push(c); return { ok: true }; },
-    writeFile: () => ({ ok: true }), doApi: null,
+    writeFile: () => ({ ok: true }),
   };
   const r = await P.cmdRunIntents(deps);
   assert.equal(r.errors, 1, 'surfaced as an error, not silently executed');
@@ -2541,7 +2455,6 @@ function truthRecorder({ healthzFails = false } = {}) {
       return { ok: true, stdout: '' };
     },
     writeFile: () => ({ ok: true }),
-    doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
     checkCaddyWiring: () => null,
     getGithubToken: async () => null,
@@ -2615,7 +2528,7 @@ await ta('F19: a RETIRED intent records its reason on the instance without chang
       recordEvent: async () => {},
       claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
     },
-    exec: () => ({ ok: true }), writeFile: () => ({ ok: true }), doApi: null,
+    exec: () => ({ ok: true }), writeFile: () => ({ ok: true }),
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'z' }),
     checkCaddyWiring: () => null,
   };
@@ -2641,7 +2554,7 @@ await ta('F19: a NON-final failure re-pends the intent and writes nothing on the
       recordEvent: async () => {},
       claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
     },
-    exec: () => ({ ok: true }), writeFile: () => ({ ok: true }), doApi: null,
+    exec: () => ({ ok: true }), writeFile: () => ({ ok: true }),
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'z' }),
     checkCaddyWiring: () => null,
   };
@@ -3114,10 +3027,10 @@ t('dbRoleGrantsCmd: runs on the INSTANCE db and grants forward too — the migra
   assert.match(c, /GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO %I/);
 });
 
-t('BOTH role commands render with NO double quote — they have to survive a YAML double-quoted cloud-init scalar', () => {
+t('the role + seed commands render with NO double quote — they must survive `bash -s` over SSH unchanged', () => {
   const dq = String.fromCharCode(34);
-  for (const c of [P.dbRoleCmd(coTenant, { password: 'pw_ABC-123' }), P.dbRoleGrantsCmd(coTenant)]) {
-    assert.ok(!c.includes(dq), `a double-quoted identifier silently truncates the cloud-init line: ${c}`);
+  for (const c of [P.dbRoleCmd(coTenant, { password: 'pw_ABC-123' }), P.dbRoleGrantsCmd(coTenant), P.seedFirstVersionCmd(coTenant)]) {
+    assert.ok(!c.includes(dq), `a double-quoted identifier would need escaping on the remote shell: ${c}`);
   }
 });
 
@@ -3184,38 +3097,6 @@ t('webEnvBody: a CO-LOCATED instance (co-tenant or standalone) carries PGPOOL_MA
   assert.match(withCred, /^PGUSER=bongos-mercury$/m);
 });
 
-t('webEnvBody: a DEDICATED droplet has its own Postgres — no PGPOOL_MAX line, pg keeps its default', () => {
-  const b = P.webEnvBody({ ...coTenant, hosting_shape: 'dedicated' });
-  assert.doesNotMatch(b, /^PGPOOL_MAX=/m);
-  assert.match(b, /^PGDATABASE=mercury$/m);
-});
-
-t('dedicatedUserData: the droplet runs the SAME account + role steps, in the same order around the migrate', () => {
-  const ud = P.dedicatedUserData(coTenant);
-  const at = (needle) => ud.indexOf(needle);
-  assert.ok(at('useradd --system') > -1, 'the droplet creates the account too');
-  assert.ok(at('usermod -aG $(id -gn appsvc)') > -1);
-  assert.ok(at('useradd --system') < at('createdb mercury'), 'account before the DB');
-  assert.ok(at('migrate.sh') < at('CREATE ROLE %I'), 'the role grants must follow the migrate that created the tables');
-  assert.ok(at('CREATE ROLE %I') < at('GRANT ALL ON ALL TABLES'), 'role before its grants');
-});
-
-t('dedicatedUserData: NEVER bakes a password into cloud-init — DO retains user-data and serves it back', () => {
-  const ud = P.dedicatedUserData(coTenant);
-  // The dollar-quoted password literal dbRoleCmd uses. Its absence is the assertion.
-  assert.ok(!ud.includes('$p$'), 'a credential in user-data is a permanent copy we cannot lock down');
-  assert.match(ud, /CREATE ROLE %I WITH LOGIN\$f\$/, 'the role is still created, password-less (single-tenant droplet)');
-  assert.match(ud, /REVOKE CONNECT ON DATABASE %I FROM PUBLIC/, 'and PUBLIC still loses CONNECT');
-});
-
-t('dbRoleCmd(peerOnly): omits the PASSWORD clause entirely, and REFUSES a password', () => {
-  const c = P.dbRoleCmd(coTenant, { peerOnly: true });
-  assert.ok(!/PASSWORD/.test(c), 'no PASSWORD clause at all — not an empty one');
-  assert.match(c, /CREATE ROLE %I WITH LOGIN\$f\$/);
-  assert.match(c, /ALTER DATABASE %I OWNER TO %I/, 'ownership and the revoke are unchanged');
-  assert.throws(() => P.dbRoleCmd(coTenant, { peerOnly: true, password: 'pw_ABC' }), /peerOnly takes no password/);
-});
-
 t('dbRoleCmdShown: the label the runner logs names every effect and carries NO password', () => {
   const pw = P.generateDbPassword();
   const real = P.dbRoleCmd(coTenant, { password: pw });

package/tests/provision_account_identity.mjs

@@ -68,13 +68,11 @@ test('accountPlaneGap: a SILENT failure still names a cause — an empty stderr
   assert.match(gap, /failed \(Command failed: sh -c\)/, 'falls through the empty Buffer to the message');
 });
 
-test('accountPreflight: a dedicated droplet skips it, and a dry run asks the box nothing', () => {
+test('accountPreflight: a dry run asks the box nothing', () => {
   const cmds = [];
   const rec = (c) => { cmds.push(c); return isRoot(); };
-  assert.equal(accountPreflight({ exec: rec, apply: true, log: () => {}, shape: 'dedicated' }), null);
-  assert.deepEqual(cmds, [], 'cloud-init creates that account as root — nothing to ask');
   const lines = [];
-  assert.equal(accountPreflight({ exec: rec, apply: false, log: (m) => lines.push(m), shape: 'co-tenant' }), null);
+  assert.equal(accountPreflight({ exec: rec, apply: false, log: (m) => lines.push(m) }), null);
   assert.deepEqual(cmds, [], 'a dry run changes nothing and asks nothing');
   assert.match(lines.join('\n'), /would probe/, 'the plan says the probe is coming, rather than printing step 1c as though it works');
 });
@@ -100,7 +98,6 @@ function harness({ noRoot = false } = {}) {
     },
     exec,
     writeFile: (p) => { writes.push(p); return { ok: true }; },
-    doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
     checkCaddyWiring: () => null,
     getGithubToken: async () => null,

package/tests/provision_disconnect.mjs

@@ -14,7 +14,7 @@
 //     erase and the catalog forget succeeded, so a failure leaves a row the runner can retry
 //   • the dump erase matches the nightly filename EXACTLY, so `test` never erases `test-nk`
 //   • each shape erases where its data lives (cloud-host: control plane; co-tenant: the
-//     co-hosting box; dedicated: nothing — its droplet went whole)
+//     co-hosting box)
 //   • a dry run erases nothing and deletes nothing; an invalid slug is refused before any command
 //
 // Hermetic: recorded executors, a fake db, a fake catalog port. No shell, no Postgres.
@@ -69,7 +69,6 @@ function rig({ apply = true, privileged = false, failOn = null, catalogThrows =
     },
     exec: record('box'), controlExec: record('control'),
     writeFile: () => ({ ok: true }), controlWriteFile: () => ({ ok: true }),
-    doApi: { deleteDroplet: async (id) => { events.push({ where: 'do', cmd: `delete-droplet ${id}` }); } },
     projectCatalog: catalog ? {
       forgetOwnedProject: async (target, opts) => {
         events.push({ where: 'catalog', cmd: 'forget', target, pool: opts && opts.pool });
@@ -137,14 +136,6 @@ await ta('co-tenant: the erase runs on the co-hosting box, there is no per-proje
   assert.ok(!r.cmds('control').some((x) => /dropdb/.test(x)));
 });
 
-await ta('dedicated: its droplet went whole, so nothing is erased by command — the catalog and the row still go', async () => {
-  const r = rig();
-  const res = await D.disconnectInstance({ ...lantern, hosting_shape: 'dedicated', droplet_id: 9 }, r.deps);
-  assert.equal(res.ok, true);
-  assert.ok(!r.events.some((e) => /dropdb|rm -rf|userdel|find /.test(e.cmd || '')), r.events.map((e) => e.cmd).join('\n'));
-  assert.ok(r.at((e) => e.cmd === 'forget') >= 0 && r.at((e) => e.cmd === 'delete-row') >= 0);
-});
-
 console.log('\nthe dump erase is exact:');
 
 t('the nightly filename matches, and a project whose name merely STARTS with this one\'s does not', () => {

package/tests/provision_restart.mjs

@@ -20,7 +20,7 @@
 //     address), and the event text says which one was actually observed
 //   • a project that stays down is ok:true — a truthful observation for the card,
 //     not a failure to retry four more times
-//   • the state gate is a clean no-op; dedicated is refused with the command
+//   • the state gate is a clean no-op
 //   • cmdRunIntents routes 'restart' to this leg
 //
 // Run:  node tests/provision_restart.mjs
@@ -64,7 +64,6 @@ function recorder({ apply = true, healthzFails = false, privileged = false, rest
     },
     exec,
     writeFile: writer('box'), controlWriteFile: writer('control'),
-    doApi: null,
   };
   return { deps, cmds, writes, events, probes, cleared, logs };
 }
@@ -160,14 +159,6 @@ await ta('every non-active state is a clean no-op, not an error — a raced tear
   }
 });
 
-await ta('a dedicated droplet is refused with the exact command, and nothing is run', async () => {
-  const { deps, cmds } = recorder();
-  const r = await P.restartInstance({ ...activeStandalone, hosting_shape: 'dedicated' }, deps);
-  assert.equal(r.ok, false);
-  assert.match(r.error, /systemctl restart spike/);
-  assert.equal(cmds.length, 0);
-});
-
 await ta('dry-run runs no real work and observes nothing', async () => {
   const { deps, writes } = recorder({ apply: false });
   const r = await P.restartInstance(activeStandalone, deps);
@@ -212,7 +203,7 @@ await ta("cmdRunIntents (--apply) routes 'restart' to restartInstance and resolv
       claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
     },
     exec: (cmd) => { cmds.push(cmd); return /healthz/.test(cmd) ? { ok: true, stdout: '{}' } : { ok: true, stdout: '' }; },
-    writeFile: () => ({ ok: true }), doApi: null,
+    writeFile: () => ({ ok: true }),
   };
   const r = await P.cmdRunIntents(deps);
   assert.equal(r.errors, 0, JSON.stringify(r));
@@ -235,7 +226,7 @@ await ta('cmdRunIntents (--apply): a restart that throws re-pends and never mark
       claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
     },
     exec: (cmd) => { if (/systemctl restart/.test(cmd)) throw new Error('Command failed: sudo systemctl restart spike'); return { ok: true, stdout: '' }; },
-    writeFile: () => ({ ok: true }), doApi: null,
+    writeFile: () => ({ ok: true }),
   };
   const r = await P.cmdRunIntents(deps);
   assert.equal(r.errors, 1);

package/tests/provision_settings_apply.mjs

@@ -15,7 +15,7 @@
 //     the intent and never flips a healthy ACTIVE instance to 'error' (ADR 0190)
 //   • the verify asks the instance's own manifest whether it READ the values, and
 //     records only what it earned (true / false / unknown)
-//   • the state gate is a clean no-op; dedicated is refused with guidance
+//   • the state gate is a clean no-op
 //   • cmdRunIntents routes 'settings-apply' to this leg
 //
 // Run:  node tests/provision_settings_apply.mjs
@@ -193,7 +193,6 @@ function recorder({ apply = false, envBody = LIVE_ENV, readFails = false, health
     // a standalone must land on the CONTROL-PLANE writer (task 2074 routing) —
     // both writers record, tagged, so the choice is asserted, not assumed
     writeFile: writer('box'), controlWriteFile: writer('control'),
-    doApi: null,
   };
   return { deps, cmds, writes, events, probes, cleared, logs };
 }
@@ -304,17 +303,6 @@ await ta('the state gate: any non-active status is a clean no-op — ok:true noo
   }
 });
 
-await ta('the shape refusal: dedicated → ok:false with guidance naming the values + file; box untouched', async () => {
-  const { deps, cmds, writes } = recorder({ apply: true });
-  const r = await P.settingsApplyInstance({ ...activeStandalone, hosting_shape: 'dedicated' }, deps);
-  assert.equal(r.ok, false);
-  assert.match(r.error, /dedicated/);
-  assert.match(r.error, new RegExp(`${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY=gated`), 'the operator is told exactly what to set');
-  assert.match(r.error, /\/etc\/spike\/web\.env/);
-  assert.equal(cmds.length, 0);
-  assert.equal(writes.length, 0);
-});
-
 console.log('\nthe control plane\'s own row — the platform pushes a setting to itself (task 1004334):');
 
 const U = require('../scripts/gds/provision-units.js');
@@ -505,7 +493,7 @@ await ta("cmdRunIntents (--apply) routes a 'settings-apply' intent to the leg, w
       resolveOAuthManifest: async () => {},
     },
     exec: (cmd) => { cmds.push(cmd); return /\bcat /.test(cmd) ? { ok: true, stdout: LIVE_ENV } : /instance/.test(cmd) ? { ok: true, stdout: manifestWith({ platformVisibility: 'gated', joinability: 'open', visibility: 'public' }) } : { ok: true, stdout: '{"ok":true}' }; },
-    writeFile: (p, body) => { writes.push(body); return { ok: true }; }, doApi: null,
+    writeFile: (p, body) => { writes.push(body); return { ok: true }; },
   };
   const r = await P.cmdRunIntents(deps);
   assert.equal(r.ran, 1);
@@ -533,7 +521,7 @@ await ta('cmdRunIntents (--apply): a FAILED restart on attempt 1 re-pends the in
       if (/systemctl restart/.test(cmd)) throw new Error('Command failed: sudo systemctl restart spike');
       return { ok: true, stdout: '' };
     },
-    writeFile: () => ({ ok: true }), doApi: null,
+    writeFile: () => ({ ok: true }),
   };
   const r = await P.cmdRunIntents(deps);
   assert.equal(r.errors, 1);
@@ -544,27 +532,27 @@ await ta('cmdRunIntents (--apply): a FAILED restart on attempt 1 re-pends the in
   assert.equal(statusWrites.length, 0, 'a healthy ACTIVE instance is never marked broken over a settings push');
 });
 
-await ta('cmdRunIntents (--apply): a dedicated refusal RETIRES at the cap with the reason on the instance and NO status change', async () => {
+await ta('cmdRunIntents (--apply): a refused push (no web.env to patch) RETIRES at the cap with the reason on the instance and NO status change', async () => {
   let claims = 0; const resolved = []; const statusWrites = [];
   const deps = {
     apply: true, log: () => {}, sleep: async () => {},
     db: { query: async () => ({ rows: [] }) },
     provisioning: {
       claimNextIntent: async () => (claims++ === 0 ? { id: 13, instance_id: 18, action: 'settings-apply', attempts: P.MAX_INTENT_ATTEMPTS } : null),
-      getInstanceById: async () => ({ ...activeStandalone, hosting_shape: 'dedicated' }),
+      getInstanceById: async () => activeStandalone,   // exec reads back nothing → "cannot read web.env" refusal
       resolveIntent: async (_db, id, state, err) => { resolved.push({ id, state, err }); },
       setInstanceStatus: async (_db, _id, s, patch) => { statusWrites.push({ s, patch }); },
       recordEvent: async () => {},
       claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
     },
-    exec: () => ({ ok: true }), writeFile: () => ({ ok: true }), doApi: null,
+    exec: () => ({ ok: true }), writeFile: () => ({ ok: true }),
   };
   const r = await P.cmdRunIntents(deps);
   assert.equal(r.errors, 1);
   assert.equal(resolved[0].state, 'error');
   assert.equal(statusWrites.length, 1);
   assert.equal(statusWrites[0].s, 'active', 'a healthy instance is never marked broken over a refused push');
-  assert.match(statusWrites[0].patch.error_note, /dedicated/);
+  assert.match(statusWrites[0].patch.error_note, /cannot read/);
 });
 
 console.log('\nrenamedEnvCarry — the prelaunch password carried on the box (task 1004395):');

package/tests/provision_teardown_address.mjs

@@ -51,7 +51,6 @@ function rig({ apply = true, privileged = false, hookThrows = false } = {}) {
       return { ok: true, stdout: '' };
     },
     writeFile: () => ({ ok: true }), controlWriteFile: () => ({ ok: true }),
-    doApi: { deleteDroplet: async (id) => { events.push({ where: 'do', cmd: `delete ${id}` }); } },
   };
   const on = (where) => events.filter((e) => e.where === where).map((e) => e.cmd);
   const hookCalls = () => events.filter((e) => e.cmd === HOOK);
@@ -98,14 +97,6 @@ await ta('privileged: the rm under /etc and the reload are sudo-prefixed', async
   });
 });
 
-await ta('dedicated: no Caddy steps — the droplet (and its Caddy) is deleted whole', async () => {
-  await withHook(HOOK, async () => {
-    const r = rig();
-    await P.teardownInstance({ ...lantern, hosting_shape: 'dedicated', droplet_id: 9 }, r.deps);
-    assert.ok(!r.events.some((e) => /caddy/.test(e.cmd || '')), r.events.map((e) => e.cmd).join(' | '));
-  });
-});
-
 console.log('\nthe DNS leg:');
 
 await ta('the hostname is parked at the blackhole through the release env, from the control plane, before the row reads torn_down', async () => {
@@ -121,15 +112,6 @@ await ta('the hostname is parked at the blackhole through the release env, from
   });
 });
 
-await ta('dedicated: its hostname is parked too — the droplet IP it pointed at is gone', async () => {
-  await withHook(HOOK, async () => {
-    const r = rig();
-    await P.teardownInstance({ ...lantern, hosting_shape: 'dedicated', droplet_id: 9 }, r.deps);
-    assert.equal(r.hookCalls().length, 1);
-    assert.equal(r.hookCalls()[0].where, 'control');
-  });
-});
-
 await ta('best-effort: a hook that throws is logged and the row still reaches torn_down', async () => {
   await withHook(HOOK, async () => {
     const r = rig({ hookThrows: true });
@@ -218,7 +200,7 @@ await ta('the row keeps its domain and port, and a revive re-UPSERTs the SAME ho
         exec: () => ({ ok: true, stdout: '' }),
         controlExec: (cmd, opts) => { if (cmd === HOOK) dns.push(opts.env); return { ok: true, stdout: '' }; },
         writeFile: () => ({ ok: true }), controlWriteFile: (p) => { writes.push(p); return { ok: true }; },
-        doApi: null, checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
+        checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
       });
       assert.ok(dns.some((env) => env.BOX_HOSTNAME === 'lantern.cloudbongos.com' && env.BOX_IP === '198.51.100.20'), JSON.stringify(dns));
       assert.ok(writes.some((p) => p.endsWith('/lantern.caddy')), writes.join(' | '));