@bongos/core 1.19.1000 → 1.19.1002

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1000",
-  "core_contract": "1.19.1000",
-  "source_commit": "418cf03d39cecaf2d846caa21fdb61edb6d8b0f3",
+  "core_version": "1.19.1002",
+  "core_contract": "1.19.1002",
+  "source_commit": "e0937954f00712025cbc3f2c9b8a400a35654037",
   "source_ref": "HEAD",
-  "built_at": "2026-09-24T01:30:19.307Z",
+  "built_at": "2026-09-24T15:24:05.587Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 521,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2408,
+    "functional_verbatim": 2410,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2955,
-  "tree_sha256": "7199a5097f99b2342ed5b37fc07050fa409594d5d006e6a72c3228e7b3f2f7dd",
+  "file_count": 2957,
+  "tree_sha256": "8a53ccc546dbeb0297ea0095d653db33cedcebd26e566f28b616cbd0e7cf980c",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2157,12 +2157,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "a92aafc05e0bf1434d96a9032b5b2d4b1d13177d9969ee02d9f6287777a64df7"
+      "sha256": "20ab80e06f03ad1c1f1f33e3f804d402d011bca4c7b2b9df0090269958009d92"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "36beb96ae7c9b5a49e02252ff10b222cfae14224eaf5ed639d7515f36a3f1f73"
+      "sha256": "51f4a9dd2fcd6d34bd3eaa08285acf9b7c9c1ccc294d1e616c1338607701439e"
     },
     {
       "path": "docs/architecture.md",
@@ -2722,7 +2722,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "a9c208d7638a739dbbe12a7b1ee4a52e4b3c4ad047a043ccf5e3e4ae262eb805"
+      "sha256": "9fa60f085e9a51dea701f575ca3f5ed132c2deec0c5a311b46d8bc5dec1079e0"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6634,6 +6634,11 @@
       "mode": "0000644",
       "sha256": "d2ff6733aaab0c009cfe2e90e756fa9742193dba7c5078c5e1d5fa2fd6ef6e8a"
     },
+    {
+      "path": "modules/provisioning/cost-ledger.js",
+      "mode": "0000644",
+      "sha256": "0f6a25220ce3786ba3d813bcba2e39ef902aa25ed4420264efaca36b9ddb3432"
+    },
     {
       "path": "modules/provisioning/credential-preflight.js",
       "mode": "0000644",
@@ -6827,7 +6832,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "5c409a38ac511fe0fa331a5f012c4eda8598d7e8532070e13a42ba707f934f27"
+      "sha256": "fba7da2883254cc0f7f2eafee6c437aeac00f97fb1f8a35acade67e48c6a6eff"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -6872,7 +6877,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "7738dad310a0de636739fecd9d98036c1d9e4381f7e972337fa8c01d59ccfe9c"
+      "sha256": "6f123553f9fd1f3d48f5356dcddb628c78660c10615f3d7e137f71bf2e7d0750"
     },
     {
       "path": "modules/provisioning/routes/repo-private.js",
@@ -8202,12 +8207,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "eb742b3a898d8b78fc95893d284f6db4151a98f35ddc81a131f16ff586466a98"
+      "sha256": "ce35548a4758316756e143ba9b49e1d860899d125a16a4b92ab1569174f5f3f0"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "130f3e4d93f2846e676c68bd54fb3a318311dfc0912ffa48994fcb2b941a2dfd"
+      "sha256": "eb8f4069bbf120c7d6322a857238a6c5fba334c8c2112738fcc97460e29bcbef"
     },
     {
       "path": "public-docs/index.html",
@@ -8857,7 +8862,7 @@
     {
       "path": "scripts/gds/gen-file-map.js",
       "mode": "0000644",
-      "sha256": "a8531787384fc528eb75dde142ca8d24982e47e226c934d6e692c53e6e738a0a"
+      "sha256": "ac2308077104c2ff899f4b12ff9da7baa965a9c0d3e4ef2f92e6bdf9d3613fb6"
     },
     {
       "path": "scripts/gds/gen-freshness.js",
@@ -10252,7 +10257,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "24c5dcae4a5e4be1d9c543791a1be89713e71e8f06150e414463e6064628e6b9"
+      "sha256": "7be77918a0d109201d7c85c399d36f8f88473314c8c9a433a8d08ff7db44776a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11517,7 +11522,7 @@
     {
       "path": "tests/file_map.mjs",
       "mode": "0000644",
-      "sha256": "e426eea6852d2ea63b79d27e17b71c53031ca65ee22644192eb4807df26f7482"
+      "sha256": "c6a7da467336246652fae6db5b5d7faa147e71ac1db89a66ec143dcf03bf8013"
     },
     {
       "path": "tests/filing_abuse_matrix.mjs",
@@ -13434,6 +13439,11 @@
       "mode": "0000644",
       "sha256": "406ea4d32fe1bbb7aa1f69e0c4dc967feb2fc43c8bf0f70848547fdc6faf8762"
     },
+    {
+      "path": "tests/provisioning_cost_ledger.mjs",
+      "mode": "0000644",
+      "sha256": "a0176f26c37067860379df4da0274646771c7d6c427d84fad0145763c7366152"
+    },
     {
       "path": "tests/provisioning_credential_preflight.mjs",
       "mode": "0000644",

package/docs/api/openapi.json

@@ -12819,7 +12819,7 @@
           "provisioning"
         ],
         "summary": "GET /provisioning/fleet/cost-ledger",
-        "description": "GET /provisioning/fleet/cost-ledger — per-instance monthly estimate + total. rank: archon — cost oversight across the fleet (the /boxes/cost-ledger precedent). Declared among the archon routes (archon-first) for correct auditor classification.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `provisioning.fleet.manage` (all required).",
+        "description": "GET /provisioning/fleet/cost-ledger — per-instance monthly cost to us + estimated cost to its owner, with totals. rank: archon — cost oversight across the fleet (the /boxes/cost-ledger precedent). Declared among the archon routes (archon-first) for correct auditor classification.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `provisioning.fleet.manage` (all required).",
         "x-rank": "metic+archon",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "x-permissions": [

package/docs/api-reference.md

@@ -515,7 +515,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 |---|---|---|---|---|
 | GET | `/api/bongos/provisioning/control-plane` | `archon` | — | GET /provisioning/control-plane — "which row is this platform, and where does it stand?" The deploy page's first call: the self row is cr… |
 | GET | `/api/bongos/provisioning/fleet` | `metic+archon` | — | GET /provisioning/fleet — the full instance roster across all owners. |
-| GET | `/api/bongos/provisioning/fleet/cost-ledger` | `metic+archon` | — | GET /provisioning/fleet/cost-ledger — per-instance monthly estimate + total. |
+| GET | `/api/bongos/provisioning/fleet/cost-ledger` | `metic+archon` | — | GET /provisioning/fleet/cost-ledger — per-instance monthly cost to us + estimated cost to its owner, with totals. |
 | GET | `/api/bongos/provisioning/github-app/callback` | `public` | — | GET /provisioning/github-app/callback?code=&state= — GitHub redirects the owner's BROWSER here after they approve the App Manifest (task … |
 | GET | `/api/bongos/provisioning/github-app/status` | `public` | — | GET /provisioning/github-app/status?state=<> — the PUBLIC progress read the onboarding callback page polls (task 2096) to know when setup… |
 | GET | `/api/bongos/provisioning/health` | `public` | — | GET /provisioning/health — liveness + the core version this module mounted against. |

package/docs/module-api-changelog.md

@@ -2474,5 +2474,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.998 with no explicit bump. run 35942048393. (task 1002620)
   1.19.1000 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.999 with no explicit bump. run 35943151697. (task 1002620)
+  1.19.1001 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1000 with no explicit bump. run 36016738965. (task 1002620)
+  1.19.1002 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1001 with no explicit bump. run 36019839845. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/cost-ledger.js

@@ -0,0 +1,74 @@
+'use strict';
+// The fleet cost ledger (GET /provisioning/fleet/cost-ledger) — VISIBILITY only (ADR 0111 §6).
+//
+// It asks two questions, one column each (task 1004148, ADR 0327). Before, one column
+// asked both and reported a confident $0 for every project:
+//   platform_monthly_usd — what a row costs US. A cloud-host runs on its owner's own
+//     account, so $0 is correct; the one thing we pay for is the control plane's box.
+//   owner_monthly_usd    — an ESTIMATE of the owner's own hosting bill, never ours.
+// null in either column means UNPRICED — the row names no plan we can price — and is
+// never folded into a total as 0.
+
+const { HOSTING_SHAPES, TIER_MONTHLY_USD } = require('./provisioning');
+
+// What a cloud-host's owner pays Render per month, keyed by the plan stored in `tier`:
+// web service + Postgres, ~$13 at the default plans (ADR 0327). No row names a plan yet;
+// the Render standup (task 1004183) writes one, and the pilot (task 1004142) confirms
+// these names and prices.
+const RENDER_PLAN_MONTHLY_USD = Object.freeze({
+  'starter+basic-256mb': 13,
+});
+
+function priceOf(table, key) {
+  return typeof key === 'string' && Object.hasOwn(table, key) ? table[key] : null;
+}
+
+function platformMonthlyUsd({ hostingShape, tier } = {}) {
+  // The box the projects share today is priced once, here, by its droplet size.
+  if (hostingShape === 'control-plane') return priceOf(TIER_MONTHLY_USD, tier);
+  return HOSTING_SHAPES.includes(hostingShape) ? 0 : null;
+}
+
+function ownerMonthlyUsd({ hostingShape, tier } = {}) {
+  if (hostingShape === 'cloud-host') return priceOf(RENDER_PLAN_MONTHLY_USD, tier);
+  // co-tenant shares our box and the control plane is ours: no owner is billed for either.
+  if (hostingShape === 'co-tenant' || hostingShape === 'control-plane') return 0;
+  return null; // byo-host runs on the owner's own machine, whose bill we cannot see
+}
+
+function columnTotal(instances, key) {
+  const priced = instances.map((i) => i[key]).filter((v) => v !== null);
+  const sum = priced.reduce((a, v) => a + v, 0);
+  return { monthly_usd: Number(sum.toFixed(4)), unpriced: instances.length - priced.length };
+}
+
+// Per-instance costs + a total per column, over the instances not torn down.
+async function costLedger(db, { limit = 500 } = {}) {
+  const { rows } = await db.query(
+    `SELECT pi.id, pi.slug, pi.hosting_shape, pi.tier, pi.status, b.github_login
+       FROM provisioning_instances pi
+       JOIN builders b ON b.id = pi.owner_builder_id
+      WHERE pi.status <> 'torn_down'
+      ORDER BY pi.updated_at DESC
+      LIMIT $1`,
+    [Math.min(Math.max(Number(limit) || 500, 1), 2000)]
+  );
+  const instances = rows.map((r) => {
+    const shape = { hostingShape: r.hosting_shape, tier: r.tier };
+    return {
+      id: r.id, slug: r.slug, owner: r.github_login,
+      hosting_shape: r.hosting_shape, tier: r.tier, status: r.status,
+      platform_monthly_usd: platformMonthlyUsd(shape),
+      owner_monthly_usd: ownerMonthlyUsd(shape),
+    };
+  });
+  return {
+    instances,
+    totals: {
+      platform: columnTotal(instances, 'platform_monthly_usd'),
+      owner: columnTotal(instances, 'owner_monthly_usd'),
+    },
+  };
+}
+
+module.exports = { RENDER_PLAN_MONTHLY_USD, platformMonthlyUsd, ownerMonthlyUsd, costLedger };

package/modules/provisioning/provisioning.js

@@ -307,9 +307,10 @@ function isValidSlug(slug) {
 // 'dedicated' was the only shape that priced above zero and provisioning_027 folded it into
 // 'cloud-host', so no row can carry it. ADR 0327 says a ledger of OUR spend "should read
 // ~$0 per cloud-host and be *correct*"; what an owner is worth telling is THEIR platform
-// cost, a different column — task 1004148. The 'dedicated' arm and the tier table stay
-// because this is pure and its tests call it with that value; the droplet code path is
-// task 1004185's to delete.
+// cost, a different column — ownerMonthlyUsd in cost-ledger.js, which the fleet ledger
+// reads instead of this stored value. The 'dedicated' arm and the tier table stay because
+// this is pure and its tests call it with that value; the droplet code path is task
+// 1004185's to delete.
 function costEstimateUsd({ hostingShape, tier } = {}) {
   if (hostingShape !== 'dedicated') return 0;
   // An ABSENT tier is not an unknown one. The runner substitutes its own default
@@ -1434,30 +1435,6 @@ async function planetChoicesForHosts(db, hosts) {
   return out;
 }
 
-// Fleet cost ledger (Archon): per-instance monthly estimate + a total, over the
-// instances that still cost something (not torn_down). VISIBILITY only (ADR 0111 §6).
-async function costLedger(db, { limit = 500 } = {}) {
-  const { rows } = await db.query(
-    `SELECT pi.id, pi.slug, pi.hosting_shape, pi.tier, pi.status,
-            pi.cost_estimate_usd, b.github_login
-       FROM provisioning_instances pi
-       JOIN builders b ON b.id = pi.owner_builder_id
-      WHERE pi.status <> 'torn_down'
-      ORDER BY pi.cost_estimate_usd DESC, pi.updated_at DESC
-      LIMIT $1`,
-    [Math.min(Math.max(Number(limit) || 500, 1), 2000)]
-  );
-  const totalMonthlyUsd = rows.reduce((a, r) => a + Number(r.cost_estimate_usd || 0), 0);
-  return {
-    instances: rows.map((r) => ({
-      id: r.id, slug: r.slug, owner: r.github_login,
-      hosting_shape: r.hosting_shape, tier: r.tier, status: r.status,
-      cost_estimate_usd: Number(r.cost_estimate_usd || 0),
-    })),
-    total_monthly_usd: Number(totalMonthlyUsd.toFixed(4)),
-  };
-}
-
 module.exports = {
   // constants
   INSTANCE_STATES, HOSTING_SHAPES, ONBOARD_MODES, PROJECT_TYPES, INTENT_ACTIONS, TEARDOWN_FROM,
@@ -1488,7 +1465,7 @@ module.exports = {
   recordSettingsPushOwed,
   createInstance, setInstanceStatus, updateInstanceDomain, clearReleasedDomains, updateInstanceSettings, updateInstanceDetail,
   enqueueIntent, enqueueTeardown, enqueueSettingsApply, enqueueRestart, getOpenIntent, claimNextIntent, resolveIntent,
-  recordEvent, instanceStateForSlug, planetChoicesForHosts, projectOwnedBy, costLedger,
+  recordEvent, instanceStateForSlug, planetChoicesForHosts, projectOwnedBy,
   // data access — GitHub App Manifest attempts (task 2080)
   createOAuthManifest, getOAuthManifestByState, attachManifestCode,
   getLatestOAuthManifestForInstance, claimNextOAuthManifest, resolveOAuthManifest,

package/modules/provisioning/routes/provisioning.js

@@ -29,7 +29,7 @@
 //     GET    /provisioning/instances/:id/invite-suggestions — who is worth inviting (R28, ADR 0251)
 //   Archon-scoped (requireRank('archon') — the fleet, the /boxes precedent):
 //     GET    /provisioning/fleet                    — the full instance roster + the box's slot `capacity` (ADR 0285)
-//     GET    /provisioning/fleet/cost-ledger        — per-instance + total cost estimate
+//     GET    /provisioning/fleet/cost-ledger        — per-instance cost to us + to its owner, with totals
 //     POST   /provisioning/instances/:id/force-teardown — tear down ANY instance
 //   public:
 //     GET    /provisioning/health                   — liveness + core version
@@ -49,6 +49,7 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const auth = api, { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
+const { costLedger } = require('../cost-ledger');
 const { onboardPlan, stepsForShape } = require('../onboard-plan');
 const { ALWAYS_ON_CORE, OPTIONAL_MODULES, starterBundleAnswerTable, optionalModules, effectiveModules } = require('../starter-bundles');
 const { recommendationsForDetails } = require('../recommendations');
@@ -214,14 +215,14 @@ module.exports = function provisioningRoutes() {
     }
   });
 
-  // GET /provisioning/fleet/cost-ledger — per-instance monthly estimate + total.
+  // GET /provisioning/fleet/cost-ledger — per-instance monthly cost to us + estimated cost to its owner, with totals.
   // rank: archon — cost oversight across the fleet (the /boxes/cost-ledger precedent).
   // Declared among the archon routes (archon-first) for correct auditor classification.
   router.get('/provisioning/fleet/cost-ledger', auth.requireBuilder, auth.requirePermission('provisioning.fleet.manage'), async (req, res) => {
     try {
       // R14 (#2001 / ADR 0119): shared helper; per-endpoint cap preserved (default 500, max 2000).
       const { limit } = api.parsePagination(req, { defaultLimit: 500, maxLimit: 2000 });
-      const out = await provisioning.costLedger(pool, { limit });
+      const out = await costLedger(pool, { limit });
       res.json(out);
     } catch (err) {
       log.error('[provisioning] GET /provisioning/fleet/cost-ledger', err);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1000",
+  "version": "1.19.1002",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1000",
+      "version": "1.19.1002",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1000",
+  "version": "1.19.1002",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/gen-file-map.js

@@ -13,7 +13,7 @@
 // and .claude/scheduled-tasks/ — are now GENERATED from what is on disk. The per-entry one-line
 // notes (the prose after the ←, which no directory walk can know) live in a sidecar,
 // docs/file-map.notes.json, the ONE place a human writes them. The contract enforced by --check:
-//   • every skill/routine dir on disk MUST have a note  → a new skill can't land undescribed;
+//   • every TRACKED skill/routine dir MUST have a note  → a new skill can't land undescribed;
 //   • every note MUST map to a dir that exists           → the map can't carry ghosts;
 //   • the rendered block MUST match what's committed      → no stale tree.
 // MODULE COVERAGE (task 1004066). The same honor system that let a skill land unmapped let a whole
@@ -41,6 +41,7 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
+const { execFileSync } = require('node:child_process');
 const { resolveInstanceRoot } = require('../../src/instance-config'); // ADR 0108 §1: configurable-root
 const { sameContent } = require('./gen-freshness'); // eol-insensitive freshness (CRLF checkouts)
 
@@ -87,6 +88,21 @@ function loadNotes() {
 const { readModuleSkillsManifest } = require('./claude-materialize.js');
 function materializedNames(absDir) { return new Set(Object.keys(readModuleSkillsManifest(absDir).skills)); }
 
+// The subdirs of `relDir` holding at least one TRACKED file (task 1004213). An untracked one is the
+// builder's own — a locally-installed plugin skill, or the empty husk a plugin extract leaves — and
+// listing it would publish one machine's tooling into a shared doc on every post-merge regen.
+// null when `root` is not the top of a git work tree (a packaged install, ADR 0108 §1): nothing to ask.
+function trackedSubdirs(root, relDir) {
+  const git = (args) => execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  try {
+    if (git(['rev-parse', '--show-prefix']).trim() !== '') return null;
+    return new Set(git(['ls-files', '-z', '--', relDir]).split('\0')
+      .map((p) => p.slice(relDir.length + 1).split('/'))
+      .filter((segs) => segs.length > 1)
+      .map((segs) => segs[0]));
+  } catch { return null; }
+}
+
 // Immediate subdirectories of an absolute dir, sorted by name (deterministic); materialised
 // module copies excluded.
 function listSubdirs(absDir) {
@@ -103,7 +119,9 @@ function listSubdirs(absDir) {
 // classes the freshness contract enforces (a dir with no note; a note with no dir).
 function buildSection(section, notes) {
   const absDir = path.join(REPO_ROOT, section.dir);
-  const names = listSubdirs(absDir);
+  const present = listSubdirs(absDir);
+  const tracked = trackedSubdirs(REPO_ROOT, section.dir);
+  const names = tracked ? present.filter((n) => tracked.has(n)) : present;
   const sectionNotes = (notes && notes[section.notesKey]) || {};
   const entries = names.map((name) => {
     // Skills + scheduled-tasks each carry a SKILL.md; label it explicitly when present (matches the
@@ -114,7 +132,8 @@ function buildSection(section, notes) {
     return { name, label, note };
   });
   const missing = entries.filter((e) => e.note == null).map((e) => `${section.dir}/${e.name}`);
-  const onDisk = new Set(names);
+  // A note is a ghost only when its dir is gone from disk — one not yet `git add`ed is not.
+  const onDisk = new Set(present);
   const stale = Object.keys(sectionNotes).filter((k) => !onDisk.has(k)).map((k) => `${section.notesKey}.${k}`);
   return { ...section, absDir, entries, missing, stale };
 }

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1000'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1002'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/file_map.mjs

@@ -3,7 +3,8 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { execFileSync } from 'node:child_process';
-import { readFileSync, existsSync, readdirSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { readFileSync, existsSync, readdirSync, mkdirSync, writeFileSync, rmSync, mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
@@ -40,8 +41,11 @@ test('EVERY skill + scheduled-task dir on disk is listed AND has a note — no s
     // A module skill materialised into this checkout (task 1003330) is an untracked copy the
     // module documents; the generator skips it by the manifest beside it, and so does this.
     const materialised = gen.materializedNames(path.join(ROOT, section.dir));
+    // An untracked dir is the builder's own (a plugin install, an empty husk — task 1004213).
+    const tracked = new Set(execFileSync('git', ['ls-files', '-z', '--', section.dir], { cwd: ROOT, encoding: 'utf8' })
+      .split('\0').map((p) => p.slice(section.dir.length + 1).split('/')).filter((s) => s.length > 1).map((s) => s[0]));
     const onDisk = readdirSync(path.join(ROOT, section.dir), { withFileTypes: true })
-      .filter((e) => e.isDirectory() && !e.name.startsWith('.') && !materialised.has(e.name))
+      .filter((e) => e.isDirectory() && !e.name.startsWith('.') && !materialised.has(e.name) && tracked.has(e.name))
       .map((e) => e.name)
       .sort();
     const listed = section.entries.map((e) => e.name).sort();
@@ -69,20 +73,68 @@ test('the generated blocks live between markers and carry one ← note per entry
   }
 });
 
-test('--check FAILS (exit 2) when a new skill has no note — a skill can no longer land undescribed', () => {
-  const probe = path.join(ROOT, '.claude', 'skills', '__filemap_test__');
+// A throwaway instance root (task 1004213). `new-skill` is staged, so git tracks it; `local-plugin`
+// is untracked with a SKILL.md, as a real plugin install is; `empty-husk` is the bare dir a plugin
+// extract leaves behind. The generator falls back to cwd for its root, so no env is needed.
+function fixtureRoot({ git }) {
+  const root = mkdtempSync(path.join(tmpdir(), 'file-map-'));
+  const skills = path.join(root, '.claude', 'skills');
+  for (const n of ['new-skill', 'local-plugin']) {
+    mkdirSync(path.join(skills, n), { recursive: true });
+    writeFileSync(path.join(skills, n, 'SKILL.md'), `---\nname: ${n}\n---\n`);
+  }
+  mkdirSync(path.join(skills, 'empty-husk'));
+  if (git) {
+    execFileSync('git', ['init', '-q'], { cwd: root, stdio: 'ignore' });
+    execFileSync('git', ['add', '.claude/skills/new-skill'], { cwd: root, stdio: 'ignore' });
+  }
+  return root;
+}
+const skillsSectionAt = (cwd) => JSON.parse(execFileSync(process.execPath,
+  ['-e', `process.stdout.write(JSON.stringify(require(${JSON.stringify(GEN)}).buildModel()))`],
+  { cwd, encoding: 'utf8' })).find((s) => s.id === 'skills');
+const skillNamesAt = (cwd) => skillsSectionAt(cwd).entries.map((e) => e.name);
+
+test('--check FAILS (exit 2) when a new tracked skill has no note — a skill can no longer land undescribed', () => {
+  const root = fixtureRoot({ git: true });
   try {
-    mkdirSync(probe, { recursive: true });
-    writeFileSync(path.join(probe, 'SKILL.md'), '---\nname: __filemap_test__\n---\n');
-    const r = run(['--check']);
+    let r;
+    try { execFileSync(process.execPath, [GEN, '--check'], { cwd: root, encoding: 'utf8', stdio: 'pipe' }); r = { code: 0, stderr: '' }; }
+    catch (e) { r = { code: e.status, stderr: String(e.stderr) }; }
     assert.equal(r.code, 2, 'an undescribed skill must fail the gate');
-    assert.match(r.stderr, /notes MISSING/);
-    assert.match(r.stderr, /__filemap_test__/);
+    assert.match(r.stderr, /notes MISSING for: \.claude\/skills\/new-skill(?! *,)/, 'the tracked skill, and only it, is missing a note');
+    assert.doesNotMatch(r.stderr, /local-plugin|empty-husk/);
   } finally {
-    rmSync(probe, { recursive: true, force: true });
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('an untracked skill dir is the builder\'s own — a plugin install and an empty husk never reach the map', () => {
+  const root = fixtureRoot({ git: true });
+  try {
+    assert.deepEqual(skillNamesAt(root), ['new-skill']);
+    // A note written before `git add` is not a ghost: its dir is on disk.
+    mkdirSync(path.join(root, 'docs'));
+    writeFileSync(path.join(root, 'docs', 'file-map.notes.json'), JSON.stringify({ skills: { 'local-plugin': 'x', gone: 'y' } }));
+    assert.deepEqual(skillsSectionAt(root).stale, ['skills.gone']);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('outside a git work tree (a packaged install) every dir on disk is still listed', () => {
+  const root = fixtureRoot({ git: false });
+  const parent = fixtureRoot({ git: true });
+  const nested = path.join(parent, 'instance');
+  try {
+    assert.deepEqual(skillNamesAt(root), ['empty-husk', 'local-plugin', 'new-skill']);
+    // A root that is a SUBDIR of some repo is not that repo's top: its files are not the repo's to judge.
+    mkdirSync(path.join(nested, '.claude', 'skills', 'inner'), { recursive: true });
+    assert.deepEqual(skillNamesAt(nested), ['inner']);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+    rmSync(parent, { recursive: true, force: true });
   }
-  // and clean again once removed
-  assert.equal(run(['--check']).code, 0, 'gate is clean after the probe dir is removed');
 });
 
 test('generation is deterministic + idempotent (a second run is a no-op)', () => {

package/tests/provisioning_cost_ledger.mjs

@@ -0,0 +1,98 @@
+// tests/provisioning_cost_ledger.mjs — the fleet cost ledger asks two questions, one
+// column each (task 1004148, ADR 0327): what a row costs US, and an estimate of what it
+// costs its OWNER. A row neither can price reads null (unpriced), never 0 — the old
+// single column reported a confident $0 for every project, with no way to tell
+// "costs nothing" from "we don't know".
+//
+// DB-free: CI has no Postgres, so costLedger runs against a recording fake.
+//
+// Run:  node tests/provisioning_cost_ledger.mjs
+import { strict as assert } from 'node:assert';
+import { makeRunner } from './helpers.mjs';
+import {
+  platformMonthlyUsd, ownerMonthlyUsd, costLedger, RENDER_PLAN_MONTHLY_USD,
+} from '../modules/provisioning/cost-ledger.js';
+
+const { test, summary } = makeRunner();
+
+const PLAN = Object.keys(RENDER_PLAN_MONTHLY_USD)[0];
+
+await test('a cloud-host with no plan named is unpriced for its owner, not $0', () => {
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'cloud-host', tier: null }), null);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'cloud-host' }), null);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'cloud-host', tier: '' }), null);
+});
+
+await test('a cloud-host on a named plan is priced from the plan table', () => {
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'cloud-host', tier: PLAN }), RENDER_PLAN_MONTHLY_USD[PLAN]);
+  assert.ok(RENDER_PLAN_MONTHLY_USD[PLAN] > 0);
+});
+
+await test('an unrecognised plan is unpriced, including an Object.prototype key', () => {
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'cloud-host', tier: 'pro-max+pro-64gb' }), null);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'cloud-host', tier: 'constructor' }), null);
+  assert.equal(platformMonthlyUsd({ hostingShape: 'control-plane', tier: 'toString' }), null);
+});
+
+await test('a cloud-host costs US a correct $0: it runs on its owner\'s own account', () => {
+  assert.equal(platformMonthlyUsd({ hostingShape: 'cloud-host', tier: PLAN }), 0);
+  assert.equal(platformMonthlyUsd({ hostingShape: 'cloud-host', tier: null }), 0);
+});
+
+await test('byo-host: $0 to us, and unpriced for the owner (their own machine)', () => {
+  assert.equal(platformMonthlyUsd({ hostingShape: 'byo-host' }), 0);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'byo-host' }), null);
+});
+
+await test('co-tenant shares our box: no owner is billed, and the box is priced once', () => {
+  assert.equal(platformMonthlyUsd({ hostingShape: 'co-tenant' }), 0);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'co-tenant' }), 0);
+});
+
+await test('the control plane is OUR cost, priced by its droplet size; no size is unpriced', () => {
+  assert.equal(platformMonthlyUsd({ hostingShape: 'control-plane', tier: 's-1vcpu-2gb' }), 12);
+  assert.equal(platformMonthlyUsd({ hostingShape: 'control-plane', tier: null }), null);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'control-plane', tier: 's-1vcpu-2gb' }), 0);
+});
+
+await test('an unknown shape is unpriced in both columns', () => {
+  assert.equal(platformMonthlyUsd({ hostingShape: 'dedicated', tier: 's-2vcpu-4gb' }), null);
+  assert.equal(ownerMonthlyUsd({ hostingShape: 'dedicated', tier: 's-2vcpu-4gb' }), null);
+});
+
+function recordingDb(rows) {
+  const calls = [];
+  return { calls, query: async (sql, params) => { calls.push({ sql, params }); return { rows }; } };
+}
+const row = (id, hosting_shape, tier = null) =>
+  ({ id, slug: `p${id}`, hosting_shape, tier, status: 'active', github_login: 'owner' });
+
+await test('the live fleet today: every total says how many rows it could not price', async () => {
+  // Measured 2026-09-24: the control plane (no size recorded) + five cloud-hosts (no plan).
+  const db = recordingDb([row(1, 'control-plane'), ...[2, 3, 4, 5, 6].map((id) => row(id, 'cloud-host'))]);
+  const out = await costLedger(db);
+  assert.deepEqual(out.totals.platform, { monthly_usd: 0, unpriced: 1 });
+  assert.deepEqual(out.totals.owner, { monthly_usd: 0, unpriced: 5 });
+  assert.equal(out.instances[0].platform_monthly_usd, null);
+  assert.equal(out.instances[1].owner_monthly_usd, null);
+});
+
+await test('totals sum only priced rows, per column', async () => {
+  const db = recordingDb([
+    row(1, 'control-plane', 's-1vcpu-2gb'), row(2, 'cloud-host', PLAN), row(3, 'cloud-host', PLAN),
+    row(4, 'cloud-host'), row(5, 'byo-host'),
+  ]);
+  const out = await costLedger(db);
+  assert.deepEqual(out.totals.platform, { monthly_usd: 12, unpriced: 0 });
+  assert.deepEqual(out.totals.owner, { monthly_usd: 2 * RENDER_PLAN_MONTHLY_USD[PLAN], unpriced: 2 });
+  assert.equal('cost_estimate_usd' in out.instances[0], false, 'the one-column-two-questions field is gone');
+});
+
+await test('the query skips torn-down rows and clamps the limit', async () => {
+  const db = recordingDb([]);
+  await costLedger(db, { limit: 99999 });
+  assert.match(db.calls[0].sql, /status <> 'torn_down'/);
+  assert.deepEqual(db.calls[0].params, [2000]);
+});
+
+summary();