@bongos/core 1.20.82 → 1.21.1

package/tests/session_transcript.mjs

@@ -0,0 +1,273 @@
+// tests/session_transcript.mjs — ADR 0051 / task 1001004: full-transcript capture.
+//
+// Proves, DB-free (the db seam is stubbed like session_caps.mjs):
+//   1. buildSessionTranscript keeps prompts, assistant text, tool calls AND results
+//      — the content the thin digest threw away — and a PLANTED SECRET in every
+//      position (prompt, reply, tool input, tool result) never survives.
+//   2. Size bounds: a field is capped, and an over-ceiling transcript keeps head +
+//      tail and says it truncated.
+//   3. PUT /sessions/:sid/transcript: owner forced to the caller, bad shapes 400,
+//      no owned digest row → 404.
+//   4. GET /sessions/:id/transcript: owner reads own; a stranger gets 404; an
+//      Archon reads cross-builder ONLY after an audit row is written, and a failed
+//      audit withholds the content (fail-closed).
+//
+// Run:  node tests/session_transcript.mjs
+import { strict as assert } from 'node:assert';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+const auth = require('../src/module-api');
+const db = require('../modules/sessions/db.js');
+const economySeams = require('../src/module-seams.js');
+if (!economySeams.hasProvider('reward')) economySeams.registerProvider('reward', require('../modules/economy/reward.js'));
+const buildSessionsRouter = require('../modules/sessions/routes/sessions.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const { buildSessionTranscript, MAX_FIELD_CHARS } = require('../scripts/gds/session-transcript-build.js');
+
+let passed = 0; let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.stack || e.message}`); }
+}
+
+// ---- Layer 1: the pure builder ----
+console.log('buildSessionTranscript:');
+// Fake credentials assembled at runtime so no secret-shaped literal sits in source.
+const KEY = ['sk', 'ant', 'api03', 'ABCDEFGHIJKLMNOPQRSTUVWX'].join('-');
+const GH = ['ghp', 'abcdefghijklmnopqrstuvwxyz0123456789'].join('_');
+const entries = [
+  { type: 'user', timestamp: '2026-10-01T10:00:00Z', message: { content: `please use ${KEY} to deploy` } },
+  { type: 'assistant', timestamp: '2026-10-01T10:00:05Z', message: { id: 'm1', content: [
+    { type: 'thinking', thinking: 'internal' },
+    { type: 'text', text: `I will export TOKEN=${GH} now` },
+    { type: 'tool_use', name: 'Bash', input: { command: `curl -H "Authorization: Bearer ${KEY}" x` } },
+  ] } },
+  { type: 'user', timestamp: '2026-10-01T10:00:09Z', message: { content: [
+    { type: 'tool_result', content: `output with ${GH}`, is_error: true },
+    { type: 'text', text: 'thanks' },
+  ] } },
+  { type: 'assistant', message: { id: 'm2', content: [{ type: 'thinking', thinking: 'only thinking' }] } },
+];
+
+await t('keeps prompts, assistant text, tool calls and results', () => {
+  const r = buildSessionTranscript(entries);
+  assert.equal(r.turns.length, 3, 'the thinking-only line is dropped');
+  assert.match(r.turns[0].text, /please use/);
+  assert.equal(r.turns[1].role, 'assistant');
+  assert.match(r.turns[1].text, /I will export/);
+  assert.equal(r.turns[1].tool_calls[0].name, 'Bash');
+  assert.ok(r.turns[1].tool_calls[0].input.includes('curl'));
+  assert.equal(r.turns[2].tool_results[0].is_error, true);
+  assert.equal(r.turns[2].text, 'thanks');
+  assert.ok(!JSON.stringify(r.turns).includes('internal'), 'thinking is not captured');
+});
+
+await t('a planted secret in ANY position never survives', () => {
+  const out = JSON.stringify(buildSessionTranscript(entries).turns);
+  assert.ok(!out.includes(KEY), 'Anthropic key leaked');
+  assert.ok(!out.includes(GH), 'GitHub token leaked');
+  const withLiteral = buildSessionTranscript([
+    { type: 'user', message: { content: 'my token is literal-session-token-123 ok' } },
+  ], { extraSecrets: ['literal-session-token-123'] });
+  assert.ok(!JSON.stringify(withLiteral.turns).includes('literal-session-token-123'), 'literal extra secret leaked');
+});
+
+await t('NUL bytes are stripped (Postgres jsonb rejects them)', () => {
+  const r = buildSessionTranscript([{ type: 'user', message: { content: 'a\0b' } }]);
+  assert.equal(r.turns[0].text, 'ab');
+});
+
+await t('one oversized field is capped and says so', () => {
+  const r = buildSessionTranscript([{ type: 'user', message: { content: 'word '.repeat(MAX_FIELD_CHARS) } }]);
+  assert.ok(r.turns[0].text.length < MAX_FIELD_CHARS + 100);
+  assert.match(r.turns[0].text, /\[\+\d+ chars\]$/);
+});
+
+await t('over the byte ceiling keeps head + tail, drops the middle, flags truncated', () => {
+  const many = [];
+  for (let n = 0; n < 200; n++) many.push({ type: 'user', message: { content: `turn-${n} ${'x '.repeat(500)}` } });
+  const r = buildSessionTranscript(many, { maxBytes: 50 * 1024 });
+  assert.equal(r.truncated, true);
+  assert.equal(r.turnCount, 200);
+  assert.ok(r.turns.length < 200);
+  assert.match(r.turns[0].text, /^turn-0 /);
+  assert.match(r.turns[r.turns.length - 1].text, /^turn-199 /);
+  assert.ok(r.byteSize <= 50 * 1024);
+});
+
+await t('a credential straddling the field cap is redacted whole, not sliced', () => {
+  const key = ['sk', 'ant', 'api03', 'ZYXWVUTSRQPONMLKJIHGFEDCBA'].join('-');
+  const text = 'a '.repeat((MAX_FIELD_CHARS - 10) / 2) + key + ' tail';
+  const out = buildSessionTranscript([{ type: 'user', message: { content: text } }]).turns[0].text;
+  assert.ok(!out.includes(key.slice(0, 14)), 'a fragment of the credential survived the cap');
+});
+
+await t('over the turn-count ceiling is trimmed to it and flagged', () => {
+  const many = Array.from({ length: 50 }, (_, n) => ({ type: 'user', message: { content: `t${n}` } }));
+  const r = buildSessionTranscript(many, { maxTurns: 10 });
+  assert.equal(r.truncated, true);
+  assert.ok(r.turns.length <= 10);
+  assert.equal(r.turns[0].text, 't0');
+  assert.equal(r.turns[r.turns.length - 1].text, 't49');
+});
+
+await t('a turn with many max-size tool calls is shrunk under the route per-turn cap', () => {
+  const big = 'word '.repeat(MAX_FIELD_CHARS);
+  const content = Array.from({ length: 20 }, () => ({ type: 'tool_use', name: 'Bash', input: { command: big } }));
+  const r = buildSessionTranscript([{ type: 'assistant', message: { id: 'x', content } }]);
+  const bytes = Buffer.byteLength(JSON.stringify(r.turns[0]), 'utf8');
+  assert.ok(bytes <= 256 * 1024, `turn is ${bytes} bytes`);
+  assert.equal(r.turns[0].tool_calls.length, 20, 'every call is still recorded');
+});
+
+await t('byteSize is the number the route measures (turns + commas + brackets)', () => {
+  const r = buildSessionTranscript(entries);
+  const real = Buffer.byteLength(JSON.stringify(r.turns), 'utf8');
+  assert.ok(r.byteSize >= real && r.byteSize <= real + 1, 'same conservative count the route uses');
+});
+
+await t('an under-ceiling transcript is not marked truncated', () => {
+  assert.equal(buildSessionTranscript(entries).truncated, false);
+});
+
+// ---- Layer 2: the routes ----
+console.log('\ntranscript routes (real router, fake auth, stubbed db):');
+const orig = {
+  requireBuilder: auth.requireBuilder, insertAuditLog: auth.insertAuditLog,
+  upsert: db.upsertSessionTranscript, get: db.getSessionTranscript,
+};
+let caller = { id: 7, rank: 'xenos' };
+const calls = { upserts: [], audits: [] };
+let auditShouldFail = false;
+let stored = null; // what getSessionTranscript returns
+auth.requireBuilder = (req, _res, next) => { req.builder = caller; next(); };
+auth.insertAuditLog = async (row) => { if (auditShouldFail) throw new Error('audit down'); calls.audits.push(row); };
+db.upsertSessionTranscript = async (args) => { calls.upserts.push(args); return args.sessionId === 'owned' ? { session_id: args.sessionId, turn_count: args.turnCount } : null; };
+db.getSessionTranscript = async () => stored;
+
+const app = express();
+app.use(attachFail);
+app.use('/api/gds', buildSessionsRouter());
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const base = `http://127.0.0.1:${server.address().port}/api/gds`;
+const send = (method, path, body) => fetch(base + path, {
+  method, headers: { 'content-type': 'application/json' }, body: body ? JSON.stringify(body) : undefined,
+});
+
+await t('PUT stores for the CALLER (owner forced), 201', async () => {
+  calls.upserts = [];
+  const r = await send('PUT', '/sessions/owned/transcript', { turns: [{ i: 0, role: 'user', text: 'hi' }] });
+  assert.equal(r.status, 201, await r.clone().text());
+  assert.equal(calls.upserts[0].builderId, 7, 'owner is the caller');
+  assert.equal(calls.upserts[0].sessionId, 'owned');
+});
+await t('PUT cannot smuggle a builder_id (unknown field → 400, no write)', async () => {
+  calls.upserts = [];
+  const r = await send('PUT', '/sessions/owned/transcript', { turns: [], builder_id: 999 });
+  assert.equal(r.status, 400);
+  assert.equal(calls.upserts.length, 0);
+});
+await t('PUT for a session the caller has no digest for → 404', async () => {
+  const r = await send('PUT', '/sessions/someone-elses/transcript', { turns: [{ i: 0 }] });
+  assert.equal(r.status, 404);
+});
+await t('PUT stores the turns serialized ONCE and the byte count it measured', async () => {
+  calls.upserts = [];
+  await send('PUT', '/sessions/owned/transcript', { turns: [{ i: 0, text: 'a' }, { i: 1, text: 'b' }] });
+  assert.equal(calls.upserts[0].turnsJson, '[{"i":0,"text":"a"},{"i":1,"text":"b"}]');
+  assert.equal(calls.upserts[0].turnCount, 2);
+});
+await t('PUT: one over-cap turn → 413, no write', async () => {
+  calls.upserts = [];
+  const r = await send('PUT', '/sessions/owned/transcript', { turns: [{ i: 0, text: 'x'.repeat(300 * 1024) }] });
+  assert.equal(r.status, 413);
+  assert.equal(calls.upserts.length, 0);
+});
+await t('PUT: a total over the byte cap → 413, no write', async () => {
+  calls.upserts = [];
+  const turn = { text: 'y'.repeat(200 * 1024) };
+  const r = await send('PUT', '/sessions/owned/transcript', { turns: Array.from({ length: 70 }, () => turn) });
+  assert.equal(r.status, 413);
+  assert.equal(calls.upserts.length, 0);
+});
+await t('PUT with a non-object turn → 400, no write', async () => {
+  calls.upserts = [];
+  const r = await send('PUT', '/sessions/owned/transcript', { turns: ['nope'] });
+  assert.equal(r.status, 400);
+  assert.equal(calls.upserts.length, 0);
+});
+await t('PUT with a missing turns array → 400', async () => {
+  assert.equal((await send('PUT', '/sessions/owned/transcript', {})).status, 400);
+});
+await t('PUT with a path-like session id → 400', async () => {
+  assert.equal((await send('PUT', '/sessions/a.b/transcript', { turns: [] })).status, 400);
+});
+
+stored = { id: 5, session_id: 's', builder_id: 7, turns: [{ i: 0, role: 'user', text: 'secret-ish prose' }] };
+await t('GET: the owner reads their own, with no audit row', async () => {
+  calls.audits = [];
+  const r = await send('GET', '/sessions/5/transcript');
+  assert.equal(r.status, 200);
+  assert.equal((await r.json()).transcript.turns[0].text, 'secret-ish prose');
+  assert.equal(calls.audits.length, 0);
+});
+await t('GET: a non-owner non-Archon gets 404, not 403 (no existence oracle)', async () => {
+  caller = { id: 8, rank: 'metic' };
+  assert.equal((await send('GET', '/sessions/5/transcript')).status, 404);
+});
+await t('GET: an Archon reads cross-builder AFTER an audit row is written', async () => {
+  caller = { id: 1, rank: 'archon' }; calls.audits = [];
+  const r = await send('GET', '/sessions/5/transcript');
+  assert.equal(r.status, 200);
+  assert.equal(calls.audits.length, 1);
+  assert.equal(calls.audits[0].requestBodyRedacted.action, 'bfg_session_read');
+  assert.equal(calls.audits[0].requestBodyRedacted.target, 'transcript:5');
+});
+await t('GET: a failed audit write WITHHOLDS the transcript (fail-closed)', async () => {
+  auditShouldFail = true;
+  const r = await send('GET', '/sessions/5/transcript');
+  const text = await r.text();
+  assert.equal(r.status, 500);
+  assert.ok(!text.includes('secret-ish prose'), 'content must not be served without an audit row');
+  auditShouldFail = false;
+});
+await t('GET: an absent transcript → 404', async () => {
+  stored = null;
+  assert.equal((await send('GET', '/sessions/5/transcript')).status, 404);
+});
+
+// ---- Layer 3: the real SQL, captured through a patched pool.query ----
+console.log('\nsession_transcripts SQL (captured pool.query):');
+const { pool } = require('../src/module-api');
+const origQuery = pool.query;
+const captured = [];
+pool.query = async (sql, params) => { captured.push({ sql, params }); return { rows: [] }; };
+db.upsertSessionTranscript = orig.upsert; db.getSessionTranscript = orig.get;
+await t('upsert is created only FROM the caller own session_records row', async () => {
+  captured.length = 0;
+  await db.upsertSessionTranscript({ sessionId: 's1', builderId: 7, turnsJson: '[]', turnCount: 0 });
+  const { sql, params } = captured[0];
+  assert.ok(sql.replace(/\s+/g, ' ').includes('FROM session_records sr WHERE sr.session_id = $1 AND sr.builder_id = $2'));
+  assert.ok(sql.includes("WHERE session_transcripts.builder_id = EXCLUDED.builder_id"));
+  assert.equal(params[0], 's1'); assert.equal(params[1], 7);
+});
+await t('read pages in SQL and clamps offset/limit', async () => {
+  captured.length = 0;
+  await db.getSessionTranscript(5, { offset: -9, limit: 999999 });
+  assert.ok(captured[0].sql.includes("jsonb_array_elements(st.turns) WITH ORDINALITY"));
+  assert.deepEqual(captured[0].params, [5, 0, 2000]);
+  captured.length = 0;
+  await db.getSessionTranscript(5, {});
+  assert.deepEqual(captured[0].params, [5, 0, 500]);
+});
+pool.query = origQuery;
+
+Object.assign(auth, { requireBuilder: orig.requireBuilder, insertAuditLog: orig.insertAuditLog });
+db.upsertSessionTranscript = orig.upsert; db.getSessionTranscript = orig.get;
+server.close();
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/ui_design_kit.mjs

@@ -34,7 +34,7 @@ test('the platform floors are a pinned list — a floor cannot vanish quietly',
 });
 
 test('the shipped states files validate and sit beside the page they name', () => {
-  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/projects-empty.states.json', 'modules/public-landing/public/index.states.json', 'modules/public-landing/public/account.states.json', 'modules/public-landing/public/account-private.states.json', 'modules/hall-ui/public/ranks.states.json']) {
+  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/projects-empty.states.json', 'modules/public-landing/public/projects-dns-pending.states.json','modules/public-landing/public/index.states.json', 'modules/public-landing/public/account.states.json', 'modules/public-landing/public/account-private.states.json', 'modules/hall-ui/public/ranks.states.json']) {
     const json = readJson(rel);
     const v = lib.validateStatesFile(json);
     assert.deepEqual(v.errors, [], `${rel}: ${v.errors.join('; ')}`);

package/tests/upgrade_commit_identity.mjs

@@ -0,0 +1,89 @@
+// tests/upgrade_commit_identity.mjs
+//
+// task 1004514: a landed core move left its pin STAGED but uncommitted whenever the project's
+// git named nobody (no user.name/user.email in the repo or for the account the move runs as).
+// `git commit` refused, persistPin reported "could not commit", the move still landed, and the
+// NEXT move read those leftovers as a dirty tree. Seen live on cloudbongos.com, 2026-10-01.
+//
+// These run persistPin against a REAL repo with every identity source switched off (global
+// config pointed at /dev/null, system config disabled, invented identities refused), so the refusal is git's own. The first
+// test proves the environment really does refuse; without it the fix test could pass vacuously.
+//
+// Run:  node --test tests/upgrade_commit_identity.mjs
+
+import { test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const { persistPin } = require('../scripts/gds/upgrade.js');
+const { commitIdentityEnv } = require('../scripts/gds/upgrade-commit-identity.js');
+
+// user.useConfigOnly: git on a Mac invents an identity from the hostname, where the box's git
+// refuses; this makes every machine refuse the way the box did.
+const ISOLATE = { GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1',
+  GIT_CONFIG_COUNT: '1', GIT_CONFIG_KEY_0: 'user.useConfigOnly', GIT_CONFIG_VALUE_0: 'true' };
+const IDENTITY_VARS = ['GIT_AUTHOR_NAME', 'GIT_AUTHOR_EMAIL', 'GIT_COMMITTER_NAME', 'GIT_COMMITTER_EMAIL', 'EMAIL'];
+let saved;
+const dirs = [];
+
+before(() => {
+  saved = Object.fromEntries([...Object.keys(ISOLATE), ...IDENTITY_VARS].map((k) => [k, process.env[k]]));
+  Object.assign(process.env, ISOLATE);
+  for (const k of IDENTITY_VARS) delete process.env[k];
+});
+after(() => {
+  for (const [k, v] of Object.entries(saved)) { if (v === undefined) delete process.env[k]; else process.env[k] = v; }
+  for (const d of dirs) rmSync(d, { recursive: true, force: true });
+});
+
+const git = (cwd, ...args) => spawnSync('git', args, { cwd, encoding: 'utf8' });
+
+// A repo whose first commit carries a one-off identity, then names nobody — the live shape.
+function repoWithPinChange({ identity = null } = {}) {
+  const dir = mkdtempSync(join(tmpdir(), 'pin-identity-'));
+  dirs.push(dir);
+  git(dir, 'init', '-q', '-b', 'main');
+  if (identity) { git(dir, 'config', 'user.name', identity.name); git(dir, 'config', 'user.email', identity.email); }
+  writeFileSync(join(dir, 'package.json'), '{"dependencies":{"@bongos/core":"1.20.77"}}\n');
+  writeFileSync(join(dir, 'package-lock.json'), '{}\n');
+  git(dir, '-c', 'user.name=scaffold', '-c', 'user.email=scaffold@example.invalid', 'add', '-A');
+  git(dir, '-c', 'user.name=scaffold', '-c', 'user.email=scaffold@example.invalid', 'commit', '-qm', 'scaffold');
+  writeFileSync(join(dir, 'package.json'), '{"dependencies":{"@bongos/core":"1.20.78"}}\n');
+  return dir;
+}
+
+const quiet = () => {};
+const pin = (dir) => persistPin({ instanceDir: dir, fromVersion: '1.20.77', toVersion: '1.20.78', commitPin: true, push: false }, spawnSync, quiet, quiet);
+
+test('the environment really names nobody: a plain commit is refused', () => {
+  const dir = repoWithPinChange();
+  git(dir, 'add', 'package.json');
+  const r = git(dir, 'commit', '-m', 'probe');
+  assert.notEqual(r.status, 0, 'git must refuse here, or the next test proves nothing');
+});
+
+test('a repo that names nobody still gets its pin committed, signed as the provisioner', () => {
+  const dir = repoWithPinChange();
+  const r = pin(dir);
+  assert.equal(r.committed, true, `persistPin: ${JSON.stringify(r)}`);
+  assert.equal(git(dir, 'status', '--porcelain').stdout, '', 'nothing staged or left behind for the next move');
+  const who = git(dir, 'log', '-1', '--format=%an <%ae>|%s').stdout.trim();
+  assert.match(who, /^Cloud Bongos <bot@[^>]+>\|pin @bongos\/core 1\.20\.78 \(was 1\.20\.77\)$/);
+});
+
+test('a repo that names someone keeps signing as them', () => {
+  const dir = repoWithPinChange({ identity: { name: 'Owner Person', email: 'owner@example.invalid' } });
+  assert.equal(commitIdentityEnv(dir, spawnSync), null, 'no fallback when git already has an answer');
+  assert.equal(pin(dir).committed, true);
+  assert.equal(git(dir, 'log', '-1', '--format=%an <%ae>').stdout.trim(), 'Owner Person <owner@example.invalid>');
+});
+
+test('an identity the caller already put in the env is not replaced', () => {
+  const dir = repoWithPinChange();
+  assert.equal(commitIdentityEnv(dir, spawnSync, { ...process.env, GIT_AUTHOR_EMAIL: 'ci@example.invalid' }), null);
+});

package/tests/wizard_demo.mjs

@@ -111,14 +111,21 @@ let created = null;
 let started = null;
 provisioning.getInstanceBySlug = async () => null;
 provisioning.getInstanceByDomain = async () => null;
+// The order the create does things in (task 1004506): the birth stamp and the demo
+// marker must both be on the row BEFORE the provision intent exists, so the runner's
+// web.env carries them. 'old-one' stands for a project that already existed.
+const order = [];
+const birth = require('../modules/provisioning/birth.js');
+birth.stampBirth = async (_db, id) => { order.push(`birth:${id}`); };
 provisioning.createInstance = async (_db, args) => {
   created = args;
-  return { instance: { id: 41, owner_builder_id: 7, slug: args.slug, status: 'requested', hosting_shape: 'byo-host', detail: args.detail || {} }, created: true };
+  const fresh = args.slug !== 'old-one';
+  return { instance: { id: 41, owner_builder_id: 7, slug: args.slug, status: fresh ? 'requested' : 'active', hosting_shape: 'byo-host', detail: args.detail || {} }, created: fresh };
 };
-provisioning.enqueueIntent = async (_db, _id, action) => ({ intent: { id: 9, action, state: 'pending' }, created: true });
+provisioning.enqueueIntent = async (_db, _id, action) => { order.push(`enqueue:${action}`); return { intent: { id: 9, action, state: 'pending' }, created: true }; };
 provisioning.getOpenIntent = async () => null;
 provisioning.recordEvent = async () => {};
-demo.startDemoProject = async (_db, _p, id, d) => { started = { id, d }; return null; };
+demo.startDemoProject = async (_db, _p, id, d) => { started = { id, d }; order.push(`demo:${id}`); return null; };
 api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
 let stored = null;
 provisioning.getInstanceById = async (_db, id) => (id === 41 ? { id: 41, owner_builder_id: 7, demo: stored } : null);
@@ -158,6 +165,25 @@ test('the create files a normal project marked demo, with the demo\'s picked ans
   assert.equal((await post('/provisioning/instances', { slug: 'bad-demo', hosting_shape: 'byo-host', demo: { people: 99, hours_each: 4 } })).status, 400);
 });
 
+test('a new project is stamped born, once, before its provision intent; an existing one never is (task 1004506)', async () => {
+  order.length = 0;
+  assert.equal((await post('/provisioning/instances', { slug: 'born-demo', hosting_shape: 'byo-host', demo: { people: 2, hours_each: 3 } })).status, 201);
+  assert.deepEqual(order, ['birth:41', 'demo:41', 'enqueue:provision'], 'the marker and the demo box are on the row before the runner can read it');
+  order.length = 0;
+  assert.equal((await post('/provisioning/instances', { slug: 'born-real', hosting_shape: 'byo-host' })).status, 201);
+  assert.deepEqual(order, ['birth:41', 'enqueue:provision'], 'a real project is born too, with no demo box');
+  order.length = 0;
+  const again = await post('/provisioning/instances', { slug: 'old-one', hosting_shape: 'byo-host' });
+  assert.ok(again.status < 300, JSON.stringify(again.body));
+  assert.ok(!order.some((o) => o.startsWith('birth:') || o.startsWith('demo:')), 'a re-request of a project that already exists is never born (spec D8)');
+  const keep = birth.stampBirth;
+  birth.stampBirth = async () => { throw new Error('db hiccup'); };
+  try {
+    assert.equal((await post('/provisioning/instances', { slug: 'unlucky', hosting_shape: 'byo-host' })).status, 201,
+      'a missed marker costs the project its genesis, never its creation');
+  } finally { birth.stampBirth = keep; }
+});
+
 test('keep your planet? over the route: the owner answers once', async () => {
   stored = demo.demoRecord({ people: 3, hours_each: 4 }, new Date(Date.now() - 5 * 3600000));
   const r = await post('/provisioning/instances/41/demo', { outcome: 'kept' });