Add provisioning + DB consistency bug to API outstanding and pre-launch checklist

OPEN_THREADS.md

@@ -147,6 +147,17 @@ Outstanding:
 - Headscale auth key generation
 - **Velocity resync endpoint** — `POST /api/velocity/resync` to re-register all running containers after Velocity restart
 
+**Provisioning + DB Consistency (Active Bug — needs audit before launch):**
+- Duplicate server creation occurring during single requests
+- Inconsistent / failed server termination
+- DB state drifting from actual Proxmox + agent state
+- BullMQ jobs may be executing more than once — missing deduplication / idempotency keys
+- VMID and port allocation not confirmed to be transactionally safe
+- Create endpoint not confirmed idempotent or guarded against double execution
+- Delete flow not confirmed to handle partial failures (container already gone)
+- DNS-based routing must not be used as source of truth — DB is the source of truth
+- See `SCRATCH/debug-provisioning-consistency.md` for full audit plan
+
 ---
 
 ## Portal (zpac-portal)
@@ -233,6 +244,7 @@ Outstanding before launch:
 - **Billing endpoints** — add back to API
 - **Stress testing** — k6 IDE session load test + Minecraft bot test + **code-server memory baseline**
 - **OPNsense audit** — both routers need systematic validation
+- **Provisioning + DB consistency audit** — duplicate creation, state drift, BullMQ idempotency
 - Remove `testdaemon` binary from zpac-portal repo root
 
 ---