@shipfox/api-runners 10.0.0 → 10.2.0

package/src/db/job-executions.test.ts

@@ -27,6 +27,7 @@ import {
 } from './job-executions.js';
 import {runnersOutbox} from './schema/outbox.js';
 import {pendingJobExecutions} from './schema/pending-job-executions.js';
+import {providerRunners} from './schema/runner-instances.js';
 import {runnerSessions} from './schema/runner-sessions.js';
 import {runningJobExecutions} from './schema/running-job-executions.js';
 
@@ -408,10 +409,20 @@ describe('claimPendingJobExecution', () => {
   it('does not spend a claim when a capped session polls an empty queue', async () => {
     const provisionerId = crypto.randomUUID();
     const providerRunnerId = `provisioned-runner-${crypto.randomUUID()}`;
+    const runnerInstanceId = crypto.randomUUID();
     await db()
       .update(runnerSessions)
       .set({registrationTokenKind: 'ephemeral', maxClaims: 1, provisionerId, providerRunnerId})
       .where(eq(runnerSessions.id, runnerSessionId));
+    await db().insert(providerRunners).values({
+      id: runnerInstanceId,
+      workspaceId,
+      provisionerId,
+      providerRunnerId,
+      labels: sessionLabels,
+      state: 'running',
+      reportedAt: new Date(),
+    });
 
     const empty = await claimPendingJobExecution({workspaceId, runnerSessionId, maxClaims: 1});
 
@@ -431,6 +442,12 @@ describe('claimPendingJobExecution', () => {
       .where(eq(runnerSessions.id, runnerSessionId));
     expect(claimed?.jobId).toBe(created.jobId);
     expect(afterClaim?.claimsUsed).toBe(1);
+
+    const [runner] = await db()
+      .select({firstClaimedAt: providerRunners.firstClaimedAt})
+      .from(providerRunners)
+      .where(eq(providerRunners.id, runnerInstanceId));
+    expect(runner?.firstClaimedAt).toBeInstanceOf(Date);
   });
 
   it('allows a manual session to claim repeatedly', async () => {

package/src/db/job-executions.ts

@@ -34,6 +34,7 @@ import type {Tx} from './db.js';
 import {db} from './db.js';
 import {runnersOutbox} from './schema/outbox.js';
 import {pendingJobExecutions} from './schema/pending-job-executions.js';
+import {providerRunners} from './schema/runner-instances.js';
 import {runnerSessions} from './schema/runner-sessions.js';
 import {runningJobExecutions} from './schema/running-job-executions.js';
 
@@ -174,6 +175,7 @@ export async function claimPendingJobExecution(params: {
   return await db().transaction(async (tx) => {
     let provisionerId: string | null = null;
     let providerRunnerId: string | null = null;
+    let runnerInstanceId: string | null = null;
 
     if (params.maxClaims !== null) {
       const [session] = await tx
@@ -181,6 +183,7 @@ export async function claimPendingJobExecution(params: {
           maxClaims: runnerSessions.maxClaims,
           claimsUsed: runnerSessions.claimsUsed,
           revokedAt: runnerSessions.revokedAt,
+          runnerInstanceId: runnerSessions.runnerInstanceId,
           provisionerId: runnerSessions.provisionerId,
           providerRunnerId: runnerSessions.providerRunnerId,
         })
@@ -200,6 +203,7 @@ export async function claimPendingJobExecution(params: {
 
       // Ephemeral sessions are the only capped sessions, and the DB check keeps
       // their provisioned-runner link present as a pair.
+      runnerInstanceId = session.runnerInstanceId;
       provisionerId = session.provisionerId;
       providerRunnerId = session.providerRunnerId;
     }
@@ -250,6 +254,24 @@ export async function claimPendingJobExecution(params: {
     const claimed = inserted[0];
     if (!claimed) return null;
 
+    const runnerInstanceCondition = runnerInstanceId
+      ? eq(providerRunners.id, runnerInstanceId)
+      : provisionerId && providerRunnerId
+        ? and(
+            eq(providerRunners.provisionerId, provisionerId),
+            eq(providerRunners.providerRunnerId, providerRunnerId),
+          )
+        : null;
+    if (runnerInstanceCondition) {
+      await tx
+        .update(providerRunners)
+        .set({
+          firstClaimedAt: sql`coalesce(${providerRunners.firstClaimedAt}, ${claimed.claimedAt})`,
+          updatedAt: sql`now()`,
+        })
+        .where(runnerInstanceCondition);
+    }
+
     if (params.maxClaims !== null) {
       await tx
         .update(runnerSessions)

package/src/db/provisioner-tokens.ts

@@ -1,16 +1,27 @@
-import {and, desc, eq, gt, inArray, isNull, or, sql} from 'drizzle-orm';
+import type {
+  AdministrationActionEvent,
+  AdministrationActionEventMap,
+} from '@shipfox/api-common-dto';
+import {type TimestampIdCursor, timestampIdCursorWhere} from '@shipfox/node-drizzle';
+import {writeOutboxEvent} from '@shipfox/node-outbox';
+import {and, desc, eq, gt, inArray, isNotNull, isNull, lte, or, type SQL, sql} from 'drizzle-orm';
 import type {
   ActiveProvisionerToken,
   ProvisionerScope,
   ProvisionerToken,
 } from '#core/entities/provisioner-token.js';
+import {ProvisionerAdminIdempotencyKeyReuseError} from '#core/errors.js';
 import {db} from './db.js';
+import {runnersAdminCommandResults} from './schema/admin-command-results.js';
+import {runnersOutbox} from './schema/outbox.js';
 import {provisionerTokens, toProvisionerToken} from './schema/provisioner-tokens.js';
 import {runnerActivationTokens} from './schema/runner-activation-tokens.js';
 import {runnerBootstrapTokens, runnerControlSessions} from './schema/runner-control-sessions.js';
 import {providerRunners} from './schema/runner-instances.js';
 import {runnerSessions} from './schema/runner-sessions.js';
 
+type Tx = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];
+
 export interface CreateProvisionerTokenParams {
   scope: ProvisionerScope;
   workspaceId?: string | undefined;
@@ -21,10 +32,7 @@ export interface CreateProvisionerTokenParams {
   expiresAt?: Date | undefined;
 }
 
-async function cascadeProvisionerRevocation(
-  tx: Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0],
-  provisionerId: string,
-) {
+async function cascadeProvisionerRevocation(tx: Tx, provisionerId: string) {
   await tx
     .update(runnerBootstrapTokens)
     .set({revokedAt: sql`now()`})
@@ -75,10 +83,8 @@ async function cascadeProvisionerRevocation(
     );
 }
 
-export async function createProvisionerToken(
-  params: CreateProvisionerTokenParams,
-): Promise<ProvisionerToken> {
-  const rows = await db()
+async function insertProvisionerToken(tx: Tx, params: CreateProvisionerTokenParams) {
+  const rows = await tx
     .insert(provisionerTokens)
     .values({
       scope: params.scope,
@@ -93,9 +99,135 @@ export async function createProvisionerToken(
 
   const row = rows[0];
   if (!row) throw new Error('Insert returned no rows');
+  return row;
+}
+
+export async function createProvisionerToken(
+  params: CreateProvisionerTokenParams,
+): Promise<ProvisionerToken> {
+  const row = await db().transaction((tx) => insertProvisionerToken(tx, params));
   return toProvisionerToken(row);
 }
 
+interface AuditedProvisionerTokenCommandParams {
+  actorId: string;
+  command: string;
+  correlationId: string;
+  idempotencyKeyFingerprint: string;
+  requestFingerprint: string;
+  event: (tokenId: string) => AdministrationActionEvent;
+}
+
+async function lockAdminCommand(
+  tx: Tx,
+  params: Pick<AuditedProvisionerTokenCommandParams, 'actorId' | 'idempotencyKeyFingerprint'>,
+): Promise<void> {
+  await tx.execute(
+    sql`select pg_advisory_xact_lock(hashtext(${`runners_admin_command:${params.actorId}:${params.idempotencyKeyFingerprint}`}))`,
+  );
+}
+
+async function loadAdminCommandResult(
+  tx: Tx,
+  params: Pick<
+    AuditedProvisionerTokenCommandParams,
+    'actorId' | 'idempotencyKeyFingerprint' | 'requestFingerprint'
+  > & {command: string},
+) {
+  const rows = await tx
+    .select()
+    .from(runnersAdminCommandResults)
+    .where(
+      and(
+        eq(runnersAdminCommandResults.actorId, params.actorId),
+        eq(runnersAdminCommandResults.idempotencyKeyFingerprint, params.idempotencyKeyFingerprint),
+      ),
+    )
+    .limit(1);
+  const result = rows[0];
+  if (!result) return undefined;
+  if (
+    result.command !== params.command ||
+    result.requestFingerprint !== params.requestFingerprint
+  ) {
+    throw new ProvisionerAdminIdempotencyKeyReuseError();
+  }
+  return result;
+}
+
+async function storeAdminCommandResult(
+  tx: Tx,
+  params: AuditedProvisionerTokenCommandParams,
+  result: {provisionerTokenId: string; correlationId: string},
+): Promise<void> {
+  await tx.insert(runnersAdminCommandResults).values({
+    actorId: params.actorId,
+    idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,
+    command: params.command,
+    requestFingerprint: params.requestFingerprint,
+    result,
+  });
+}
+
+async function writeAdministrationAction(tx: Tx, event: AdministrationActionEvent): Promise<void> {
+  await writeOutboxEvent<AdministrationActionEventMap>(tx, runnersOutbox, {
+    type: 'administration.action.performed',
+    payload: event,
+  });
+}
+
+export async function createInstallationProvisionerTokenWithAudit(
+  params: AuditedProvisionerTokenCommandParams & {
+    name?: string | undefined;
+    ttlSeconds?: number | undefined;
+    hashedToken: string;
+    prefix: string;
+  },
+): Promise<{token: ProvisionerToken; correlationId: string; replayed: boolean}> {
+  const command = 'runners.provisioner_token.create';
+  return await db().transaction(async (tx) => {
+    await lockAdminCommand(tx, params);
+    const existing = await loadAdminCommandResult(tx, {
+      actorId: params.actorId,
+      idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,
+      requestFingerprint: params.requestFingerprint,
+      command,
+    });
+    if (existing) {
+      const rows = await tx
+        .select()
+        .from(provisionerTokens)
+        .where(eq(provisionerTokens.id, existing.result.provisionerTokenId))
+        .limit(1);
+      const row = rows[0];
+      if (!row) throw new Error('Idempotent provisioner token result is missing');
+      return {
+        token: toProvisionerToken(row),
+        correlationId: existing.result.correlationId,
+        replayed: true,
+      };
+    }
+
+    const expiresAt =
+      params.ttlSeconds === undefined ? undefined : new Date(Date.now() + params.ttlSeconds * 1000);
+    const row = await insertProvisionerToken(tx, {
+      scope: 'installation',
+      hashedToken: params.hashedToken,
+      prefix: params.prefix,
+      createdByUserId: params.actorId,
+      name: params.name,
+      expiresAt,
+    });
+    const event = params.event(row.id);
+    await writeAdministrationAction(tx, event);
+    await storeAdminCommandResult(tx, params, {
+      provisionerTokenId: row.id,
+      correlationId: event.correlationId,
+    });
+    return {token: toProvisionerToken(row), correlationId: event.correlationId, replayed: false};
+  });
+}
+
 export async function revokeInstallationProvisionerToken(params: {
   tokenId: string;
   revokedByUserId: string;
@@ -132,6 +264,128 @@ export async function revokeInstallationProvisionerToken(params: {
   return existingRow ? toProvisionerToken(existingRow) : undefined;
 }
 
+export async function revokeInstallationProvisionerTokenWithAudit(
+  params: AuditedProvisionerTokenCommandParams & {tokenId: string},
+): Promise<{token: ProvisionerToken; correlationId: string; replayed: boolean} | undefined> {
+  const command = 'runners.provisioner_token.revoke';
+  return await db().transaction(async (tx) => {
+    await lockAdminCommand(tx, params);
+    const existing = await loadAdminCommandResult(tx, {
+      actorId: params.actorId,
+      idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,
+      requestFingerprint: params.requestFingerprint,
+      command,
+    });
+    if (existing) {
+      const rows = await tx
+        .select()
+        .from(provisionerTokens)
+        .where(eq(provisionerTokens.id, existing.result.provisionerTokenId))
+        .limit(1);
+      const row = rows[0];
+      if (!row) throw new Error('Idempotent provisioner token result is missing');
+      return {
+        token: toProvisionerToken(row),
+        correlationId: existing.result.correlationId,
+        replayed: true,
+      };
+    }
+
+    const updatedRows = await tx
+      .update(provisionerTokens)
+      .set({revokedAt: new Date(), revokedByUserId: params.actorId, updatedAt: new Date()})
+      .where(
+        and(
+          eq(provisionerTokens.id, params.tokenId),
+          eq(provisionerTokens.scope, 'installation'),
+          isNull(provisionerTokens.revokedAt),
+        ),
+      )
+      .returning();
+    const row = updatedRows[0];
+    if (row) await cascadeProvisionerRevocation(tx, params.tokenId);
+
+    const existingRows = row
+      ? [row]
+      : await tx
+          .select()
+          .from(provisionerTokens)
+          .where(
+            and(
+              eq(provisionerTokens.id, params.tokenId),
+              eq(provisionerTokens.scope, 'installation'),
+            ),
+          )
+          .limit(1);
+    const tokenRow = existingRows[0];
+    if (!tokenRow) return undefined;
+
+    const changed = row !== undefined;
+    const event = changed ? params.event(tokenRow.id) : undefined;
+    if (event) await writeAdministrationAction(tx, event);
+    await storeAdminCommandResult(tx, params, {
+      provisionerTokenId: tokenRow.id,
+      correlationId: event?.correlationId ?? params.correlationId,
+    });
+    return {
+      token: toProvisionerToken(tokenRow),
+      correlationId: event?.correlationId ?? params.correlationId,
+      replayed: false,
+    };
+  });
+}
+
+export type InstallationProvisionerTokenStatus = 'active' | 'expired' | 'revoked';
+
+export interface ListInstallationProvisionerTokensParams {
+  limit: number;
+  cursor?: TimestampIdCursor | undefined;
+  status?: InstallationProvisionerTokenStatus | undefined;
+}
+
+export async function listInstallationProvisionerTokens(
+  params: ListInstallationProvisionerTokensParams,
+): Promise<{tokens: ProvisionerToken[]; nextCursor: TimestampIdCursor | null}> {
+  const conditions: SQL[] = [eq(provisionerTokens.scope, 'installation')];
+  const cursor = timestampIdCursorWhere({
+    timestampColumn: provisionerTokens.createdAt,
+    idColumn: provisionerTokens.id,
+    cursor: params.cursor,
+  });
+  if (cursor) conditions.push(cursor);
+
+  if (params.status === 'active') {
+    conditions.push(isNull(provisionerTokens.revokedAt));
+    const activeExpiry = or(
+      isNull(provisionerTokens.expiresAt),
+      gt(provisionerTokens.expiresAt, sql`now()`),
+    );
+    if (activeExpiry) conditions.push(activeExpiry);
+  }
+  if (params.status === 'expired') {
+    conditions.push(
+      isNull(provisionerTokens.revokedAt),
+      isNotNull(provisionerTokens.expiresAt),
+      lte(provisionerTokens.expiresAt, sql`now()`),
+    );
+  }
+  if (params.status === 'revoked') conditions.push(isNotNull(provisionerTokens.revokedAt));
+
+  const rows = await db()
+    .select()
+    .from(provisionerTokens)
+    .where(and(...conditions))
+    .orderBy(desc(provisionerTokens.createdAt), desc(provisionerTokens.id))
+    .limit(params.limit + 1);
+  const pageRows = rows.length > params.limit ? rows.slice(0, params.limit) : rows;
+  const last = pageRows.at(-1);
+  return {
+    tokens: pageRows.map(toProvisionerToken),
+    nextCursor:
+      rows.length > params.limit && last ? {createdAt: last.createdAt, id: last.id} : null,
+  };
+}
+
 export async function listUsableProvisionerTokensByWorkspaceId(
   workspaceId: string,
 ): Promise<ProvisionerToken[]> {

package/src/db/reservations.test.ts

@@ -1,12 +1,16 @@
 import {and, eq, inArray, or, sql, sum} from 'drizzle-orm';
 import {db} from '#db/db.js';
 import {
+  deleteExpiredReservations,
   deleteReservationsByIds,
   pollDemandAndReserve,
   pollInstallationDemandAndReserve,
   releaseReservationUnits,
 } from '#db/reservations.js';
 import {reservations} from '#db/schema/reservations.js';
+import {runnerActivationTokens} from '#db/schema/runner-activation-tokens.js';
+import {runnerControlSessions} from '#db/schema/runner-control-sessions.js';
+import {providerRunners} from '#db/schema/runner-instances.js';
 import {pendingJobFactory, reservationFactory} from '#test/index.js';
 
 describe('pollDemandAndReserve', () => {
@@ -34,6 +38,131 @@ describe('pollDemandAndReserve', () => {
     expect(result.stats[0]).toMatchObject({labels: ['linux'], queued: 50, reserved: 20});
   });
 
+  it('binds the oldest matching enrolled runners to a new reservation', async () => {
+    const olderRunner = await createIdleRunner({
+      labels: ['linux'],
+      createdAt: new Date('2026-01-01T00:00:00.000Z'),
+    });
+    const newerRunner = await createIdleRunner({
+      labels: ['linux'],
+      createdAt: new Date('2026-01-02T00:00:00.000Z'),
+    });
+    const unmatchedRunner = await createIdleRunner({
+      labels: ['macos'],
+      createdAt: new Date('2026-01-03T00:00:00.000Z'),
+    });
+    await createPendingJobs(2, ['linux']);
+
+    const result = await pollDemandAndReserve({
+      workspaceId,
+      provisionerId,
+      maxReservations: 2,
+      ttlSeconds: 60,
+      templates: [template('linux', ['linux'], 2)],
+    });
+
+    const rows = await db()
+      .select()
+      .from(providerRunners)
+      .where(inArray(providerRunners.id, [olderRunner.id, newerRunner.id, unmatchedRunner.id]));
+    const rowsById = new Map(rows.map((row) => [row.id, row]));
+    const reservationId = result.reservations[0]?.reservationId;
+
+    expect(reservationId).toEqual(expect.any(String));
+    expect(rowsById.get(olderRunner.id)).toMatchObject({
+      workspaceId,
+      reservationId,
+      assignedAt: expect.any(Date),
+    });
+    expect(rowsById.get(newerRunner.id)).toMatchObject({
+      workspaceId,
+      reservationId,
+      assignedAt: expect.any(Date),
+    });
+    expect(rowsById.get(unmatchedRunner.id)).toMatchObject({
+      workspaceId: null,
+      reservationId: null,
+      assignedAt: null,
+    });
+  });
+
+  it('does not bind a running runner without an active control session', async () => {
+    const [runner] = await db()
+      .insert(providerRunners)
+      .values({
+        provisionerId,
+        providerRunnerId: 'un-enrolled-runner',
+        labels: ['linux'],
+        state: 'running',
+        reportedAt: new Date(),
+      })
+      .returning();
+    if (!runner) throw new Error('Expected runner instance');
+    await createPendingJobs(1, ['linux']);
+
+    const result = await pollDemandAndReserve({
+      workspaceId,
+      provisionerId,
+      maxReservations: 1,
+      ttlSeconds: 60,
+      templates: [template('linux', ['linux'], 1)],
+    });
+
+    const [storedRunner] = await db()
+      .select()
+      .from(providerRunners)
+      .where(eq(providerRunners.id, runner.id));
+    expect(result.reservations[0]?.count).toBe(1);
+    expect(storedRunner).toMatchObject({workspaceId: null, reservationId: null});
+  });
+
+  it('does not bind a runner with an expired control session', async () => {
+    const runner = await createIdleRunner({
+      labels: ['linux'],
+      controlSessionExpiresAt: new Date(Date.now() - 60_000),
+    });
+    await createPendingJobs(1, ['linux']);
+
+    const result = await pollDemandAndReserve({
+      workspaceId,
+      provisionerId,
+      maxReservations: 1,
+      ttlSeconds: 60,
+      templates: [template('linux', ['linux'], 1)],
+    });
+
+    const [storedRunner] = await db()
+      .select()
+      .from(providerRunners)
+      .where(eq(providerRunners.id, runner.id));
+    expect(result.reservations[0]?.count).toBe(1);
+    expect(storedRunner).toMatchObject({workspaceId: null, reservationId: null});
+  });
+
+  it('does not grant another reservation after idle runners are covered', async () => {
+    await createIdleRunner({labels: ['linux']});
+    await createPendingJobs(1, ['linux']);
+
+    const firstResult = await pollDemandAndReserve({
+      workspaceId,
+      provisionerId,
+      maxReservations: 1,
+      ttlSeconds: 60,
+      templates: [template('linux', ['linux'], 1)],
+    });
+    const secondResult = await pollDemandAndReserve({
+      workspaceId,
+      provisionerId,
+      maxReservations: 1,
+      ttlSeconds: 60,
+      templates: [template('linux', ['linux'], 1)],
+    });
+
+    expect(firstResult.reservations).toHaveLength(1);
+    expect(secondResult.reservations).toEqual([]);
+    expect(secondResult.stats[0]).toMatchObject({queued: 1, reserved: 1});
+  });
+
   it('allocates overlapping label sets most-specific-first', async () => {
     await createPendingJobs(2, ['linux']);
     await createPendingJobs(1, ['linux', 'gpu']);
@@ -288,6 +417,98 @@ describe('pollDemandAndReserve', () => {
     expect(remaining[0]?.requiredLabels).toEqual(['macos']);
   });
 
+  it('unbinds prewarmed runners and revokes activation tokens when deleting a reservation', async () => {
+    const runner = await createIdleRunner({labels: ['linux']});
+    await createPendingJobs(1, ['linux']);
+
+    const result = await pollDemandAndReserve({
+      workspaceId,
+      provisionerId,
+      maxReservations: 1,
+      ttlSeconds: 60,
+      templates: [template('linux', ['linux'], 1)],
+    });
+    const reservationId = result.reservations[0]?.reservationId;
+    if (!reservationId) throw new Error('Expected reservation');
+
+    const [activationToken] = await db()
+      .insert(runnerActivationTokens)
+      .values({
+        runnerInstanceId: runner.id,
+        hashedToken: crypto.randomUUID(),
+        prefix: 'test',
+        expiresAt: new Date(Date.now() + 60_000),
+      })
+      .returning();
+    if (!activationToken) throw new Error('Expected activation token');
+
+    const deleted = await deleteReservationsByIds([reservationId]);
+
+    const [storedRunner] = await db()
+      .select()
+      .from(providerRunners)
+      .where(eq(providerRunners.id, runner.id));
+    const [storedToken] = await db()
+      .select()
+      .from(runnerActivationTokens)
+      .where(eq(runnerActivationTokens.id, activationToken.id));
+    expect(deleted).toBe(1);
+    expect(storedRunner).toMatchObject({
+      workspaceId: null,
+      reservationId: null,
+      assignedAt: null,
+    });
+    expect(storedToken?.revokedAt).toBeInstanceOf(Date);
+  });
+
+  it('unbinds prewarmed runners and revokes activation tokens when deleting expired reservations', async () => {
+    const runner = await createIdleRunner({labels: ['linux']});
+    await createPendingJobs(1, ['linux']);
+
+    const result = await pollDemandAndReserve({
+      workspaceId,
+      provisionerId,
+      maxReservations: 1,
+      ttlSeconds: 60,
+      templates: [template('linux', ['linux'], 1)],
+    });
+    const reservationId = result.reservations[0]?.reservationId;
+    if (!reservationId) throw new Error('Expected reservation');
+
+    await db()
+      .update(reservations)
+      .set({expiresAt: new Date(Date.now() - 60_000)})
+      .where(eq(reservations.id, reservationId));
+    const [activationToken] = await db()
+      .insert(runnerActivationTokens)
+      .values({
+        runnerInstanceId: runner.id,
+        hashedToken: crypto.randomUUID(),
+        prefix: 'test',
+        expiresAt: new Date(Date.now() + 60_000),
+      })
+      .returning();
+    if (!activationToken) throw new Error('Expected activation token');
+
+    const deleted = await deleteExpiredReservations();
+
+    const [storedRunner] = await db()
+      .select()
+      .from(providerRunners)
+      .where(eq(providerRunners.id, runner.id));
+    const [storedToken] = await db()
+      .select()
+      .from(runnerActivationTokens)
+      .where(eq(runnerActivationTokens.id, activationToken.id));
+    expect(deleted).toBeGreaterThanOrEqual(1);
+    expect(storedRunner).toMatchObject({
+      workspaceId: null,
+      reservationId: null,
+      assignedAt: null,
+    });
+    expect(storedToken?.revokedAt).toBeInstanceOf(Date);
+  });
+
   it('decrements reservation units inside a caller transaction', async () => {
     await reservationFactory.create({
       workspaceId,
@@ -420,6 +641,38 @@ describe('pollDemandAndReserve', () => {
     }
   }
 
+  async function createIdleRunner(params: {
+    labels: string[];
+    createdAt?: Date;
+    controlSessionExpiresAt?: Date;
+  }) {
+    const createdAt = params.createdAt ?? new Date();
+    const [runner] = await db()
+      .insert(providerRunners)
+      .values({
+        provisionerId,
+        providerRunnerId: crypto.randomUUID(),
+        labels: params.labels,
+        state: 'running',
+        reportedAt: createdAt,
+        createdAt,
+        updatedAt: createdAt,
+      })
+      .returning();
+    if (!runner) throw new Error('Expected runner instance');
+
+    await db()
+      .insert(runnerControlSessions)
+      .values({
+        runnerInstanceId: runner.id,
+        provisionerId,
+        hashedToken: crypto.randomUUID(),
+        prefix: 'test',
+        expiresAt: params.controlSessionExpiresAt ?? new Date(Date.now() + 60_000),
+      });
+    return runner;
+  }
+
   async function activeReservedCount(): Promise<number> {
     const [row] = await db()
       .select({value: sum(reservations.count)})