@bongos/core 1.19.1053 → 1.19.1054

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1053",
-  "core_contract": "1.19.1053",
-  "source_commit": "0283c8d5c7a227fed034f765f9cb6945d821849b",
+  "core_version": "1.19.1054",
+  "core_contract": "1.19.1054",
+  "source_commit": "16cad90499c802cd308487cec2c824589b064b95",
   "source_ref": "HEAD",
-  "built_at": "2026-09-28T04:00:21.518Z",
+  "built_at": "2026-09-28T04:35:28.546Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 542,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3078,
-  "tree_sha256": "17214f38e3942f908188baa54d5f09634b4997efa67f2e024f592a414a985980",
+  "tree_sha256": "b4fe4ba91ff03f9db59c7306f72e4f1898f4f5d0a168d05a228e0689c42765db",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2737,7 +2737,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "80a4955a66087c3dc785fe34342b05e70eecedaa5407c7e2339194d2b3faa40c"
+      "sha256": "cd63efa0d5860b1d1e150d0472ea95cc8285e58526aae6696f05dc803ca7cfea"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6897,7 +6897,7 @@
     {
       "path": "modules/provisioning/control-plane-guard.js",
       "mode": "0000644",
-      "sha256": "0bbe91cadfb2bec4c419aab26e728c239ff1772af2c3568203d8fba2fb99a2d6"
+      "sha256": "beb559945e2b00edfab521a65e2c8b91671a35e8a67f6d3be30d39a7a7d8118c"
     },
     {
       "path": "modules/provisioning/core-upgrade-authz.js",
@@ -7107,7 +7107,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "58cbd888fa2ddedb174e566b861efb1749d06928f8152514e9b09d99701592af"
+      "sha256": "1a4823ad0fde877d954faf5650942cb39ab063541433ac101cec04b7cb03d980"
     },
     {
       "path": "modules/provisioning/public-refusal.js",
@@ -8462,12 +8462,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7eb8fc349775c38e2543de963016c970a69df83e016b4aabd500342bf95ce95f"
+      "sha256": "7a222030251e4f1975d78ef3b4bf78d212aa17b80d001b6858f0dcf92bbf0d90"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c2ef2620835031338cda672c27b5fd4a0b493e29a21775ef72121c92c680e42d"
+      "sha256": "b4cf0e08cfe3dc1e5980144ff698d22ac1800712e3939a663d67845232d0b95c"
     },
     {
       "path": "public-docs/index.html",
@@ -8487,7 +8487,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "00467f680b00cb584d975bce06cd2d2388f2a84d176fae9ddd3532c47e846fa1"
+      "sha256": "b4125b6b8f4b390e216f8686281a0a98da09c2a405f662beb8368ef6dee81ce3"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9477,12 +9477,12 @@
     {
       "path": "scripts/gds/provision-units.js",
       "mode": "0000644",
-      "sha256": "1f7afb93c2176d1e0be0b43904b94c9c09c8444cdd399469ef430234c6317731"
+      "sha256": "b35e21dabea1b2b45242c4744a743926259e593e01fe337d464dc4545588309d"
     },
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "d6480d0690a7b2b464820acd9861ce9d09897b10ae815164444997208cf61227"
+      "sha256": "bb767eea3debd87ad13ea859d85267b5b6be88c2eadf3c3ac236408c58f84c23"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -10562,7 +10562,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7525ff0387590801ff96e841e396e275f6f9c0cc6c659ecb77ec687512dfc474"
+      "sha256": "b31a0374ebfe190599d53bfd40004328cc7bb1aa3906487c005a53718b990a21"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11527,7 +11527,7 @@
     {
       "path": "tests/core_upgrade_door.mjs",
       "mode": "0000644",
-      "sha256": "9e19834caee7747ae1e07499ec3119903be404b6d244dfe0598d6c7ad3793aa3"
+      "sha256": "52b55a04a99870a1501f2a422096337e3426a7624ec6e1728f291e426eb9567b"
     },
     {
       "path": "tests/core_upgrade_owner_door.mjs",
@@ -13952,7 +13952,7 @@
     {
       "path": "tests/provision_settings_apply.mjs",
       "mode": "0000644",
-      "sha256": "f56a140aa9a5093001e5d4de87e350704861ad91dc2ea5a8f9b993751f8bf4d1"
+      "sha256": "edcaec20fe9fe6ae0c6fd542516d10ffb3412ab009f356af3ee52abca939342b"
     },
     {
       "path": "tests/provision_teardown_address.mjs",
@@ -14072,7 +14072,7 @@
     {
       "path": "tests/provisioning_settings_apply.mjs",
       "mode": "0000644",
-      "sha256": "50e311793e3baaf96724507330e813211edf238049b9aedfe63c1ee629a33d35"
+      "sha256": "550f67b56dd92d413a1bafc70d76375df9c02d84f9d3e4dfd5789697ae0164f0"
     },
     {
       "path": "tests/provisioning_settings_env.mjs",

package/docs/module-api-changelog.md

@@ -2593,5 +2593,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1051 with no explicit bump. run 36372902384. (task 1002620)
   1.19.1053 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1052 with no explicit bump. run 36375859084. (task 1002620)
+  1.19.1054 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1053 with no explicit bump. run 36378326588. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/control-plane-guard.js

@@ -40,10 +40,23 @@ const { PublicRefusal } = require('./public-refusal');
 //                  the provisioning module — so its hall is the only one with an
 //                  Upgrade page at all. A preview that cannot run where the button
 //                  lives is not a preview (task 1004125).
+//   settings-apply
+//                — push a SAVED setting into the box's own web.env, then restart
+//                  (task 1004334). It is `restart` plus an in-place edit of the
+//                  settings lines, and nothing else: the runner leg re-reads the
+//                  file, replaces only the vocabulary keys (SETTINGS_VOCAB plus its
+//                  declared companions) and refuses outright if the file cannot be
+//                  read, so it cannot blank a credential, a port or the database
+//                  name. It deletes nothing, provisions nothing and moves no pin.
+//                  Refusing it here protected the box from nothing and left the
+//                  owner's saved settings on the platform's own row unable to reach
+//                  the live site — PATCH …/settings on this row stored 'off' while
+//                  cloudbongos.com kept reading 'strict', and the only remedy was a
+//                  hand edit on a machine the owner cannot reach.
 //
 // Adding to this list is a deliberate edit someone has to argue for. It is pinned
 // by name in tests/core_upgrade_door.mjs so it cannot grow as a side effect.
-const CONTROL_PLANE_ACTIONS = Object.freeze(['core-upgrade', 'core-upgrade-preflight', 'restart']);
+const CONTROL_PLANE_ACTIONS = Object.freeze(['core-upgrade', 'core-upgrade-preflight', 'restart', 'settings-apply']);
 
 /**
  * May this intent action be aimed at an instance of this hosting shape? PURE.

package/modules/provisioning/provisioning.js

@@ -104,8 +104,9 @@ const MAX_RELEASED_DOMAINS = 8;
 // excludes 'active' (task 1002691).
 const SETTINGS_APPLY_FROM = new Set(['active']);
 // The hosting shapes the runner has a write path to. 'byo-host' is absent (the owner runs
-// it, we reach into nothing) and so is 'control-plane' (the platform's own row).
-const SETTINGS_APPLY_SHAPES = new Set(['co-tenant', 'cloud-host']);
+// it, we reach into nothing). 'control-plane' is the runner's OWN box, admitted by name in
+// control-plane-guard.js (task 1004334) so a setting saved on the platform's row reaches it.
+const SETTINGS_APPLY_SHAPES = new Set(['co-tenant', 'cloud-host', 'control-plane']);
 // The ONE state a restart is meaningful from (task 1003238). Liveness is an
 // OVERLAY, not a seventh state — an instance the heartbeat cannot reach is still
 // 'active', and 'active' is exactly where a restart applies. Every earlier state
@@ -115,8 +116,8 @@ const SETTINGS_APPLY_SHAPES = new Set(['co-tenant', 'cloud-host']);
 // SETTINGS_APPLY_FROM: each action declaring its own gate is this module's
 // convention, and the two answer different questions.
 const RESTART_FROM = new Set(['active']);
-// Same reachability rule as the settings push, and the same set for the same reason:
-// the runner can only restart what it runs.
+// Same reachability rule as the settings push (the runner can only restart what it runs),
+// minus 'control-plane': task 1004334 gave the self row a settings push, not a restart door.
 const RESTART_SHAPES = new Set(['co-tenant', 'cloud-host']);
 
 // Per-project settings (task 1003040, goal 1000058): the known keys + their

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1053",
+  "version": "1.19.1054",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1053",
+      "version": "1.19.1054",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1053",
+  "version": "1.19.1054",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7619,5 +7619,11 @@
       "id": "1004328",
       "text": "Your thinking and the project map are now two separate pages that share only their drawing. Your thinking keeps just your own views, simple and your thinking, with your own tools: the list, recent, claude layer, my influence,"
     }
+  ],
+  "1.19.1054": [
+    {
+      "id": "1004334",
+      "text": "The platform can now apply a saved setting to its own site, not just to the projects it hosts. Turning the artist gate off on Cloud Bongos will actually reach cloudbongos.com: the platform updates its own settings file and res"
+    }
   ]
 }

package/scripts/gds/provision-units.js

@@ -304,9 +304,44 @@ function originEnvVarsFor(inst) {
   };
 }
 
-function settingsEnvVarsFor(inst) {
+// `envBody` is the web.env being patched; only the control-plane row reads it (see
+// selfEnvPrefix). Every other shape keeps the provisioned-instance prefix, unchanged.
+function settingsEnvVarsFor(inst, envBody) {
   const { settingsEnvVars } = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning')); // eslint-disable-line global-require
-  return settingsEnvVars(inst, provisionedEnvPrefix());
+  const prefix = inst && inst.hosting_shape === 'control-plane' ? selfEnvPrefix({ envBody }) : provisionedEnvPrefix();
+  return settingsEnvVars(inst, prefix);
+}
+
+// The env-var prefix the CONTROL PLANE's own web process resolves (task 1004334). The
+// self row is not a provisioned instance: it loads the pack src/branding.js loads, from
+// ITS instance root, so provisionedEnvPrefix() (the neutral pack's floor) is the wrong
+// question — a value written under a prefix the site does not resolve is read by
+// nothing, and the push would report success over a site that never changed.
+//
+// Precedence mirrors loadBranding: the instance pack is a <PREFIX>_BRANDING_FILE line in
+// the web.env being patched (the file the web service actually boots with) when there is
+// one, else <instanceRoot>/config/branding.json; under it sits the core's neutral pack,
+// then the fallback. The first that names an envPrefix wins. A wrong answer is not silent: the
+// leg's read-back (settingsConsumed) compares the live manifest after the restart and
+// records "still reports the OLD values".
+function selfEnvPrefix({ envBody = '', instanceRoot, readFile = (p) => fs.readFileSync(p, 'utf8') } = {}) {
+  const { FALLBACK_ENV_PREFIX, LEGACY_ENV_PREFIXES } = require('../../src/instance-config');
+  const root = instanceRoot || require('./provision-repo.js').selfInstanceRoot(); // eslint-disable-line global-require
+  const names = [FALLBACK_ENV_PREFIX, ...LEGACY_ENV_PREFIXES].map((p) => `${p}_BRANDING_FILE`);
+  const override = String(envBody || '').split(/\r?\n/)
+    .map((l) => /^([A-Z]+_BRANDING_FILE)=(.*)$/.exec(l.trim()))
+    .find((m) => m && names.includes(m[1]) && m[2].trim());
+  const candidates = [
+    override ? path.resolve(root, override[2].trim()) : path.join(root, 'config', 'branding.json'),
+    path.join(REPO_ROOT, ENV_PREFIX_PACK),
+  ];
+  for (const p of candidates) {
+    try {
+      const pack = JSON.parse(readFile(p));
+      if (pack && typeof pack.envPrefix === 'string' && pack.envPrefix) return pack.envPrefix;
+    } catch { /* absent or unreadable — the next candidate answers */ }
+  }
+  return FALLBACK_ENV_PREFIX;
 }
 
 // The instance's own public manifest — the settings read-back ADR 0190 names
@@ -375,6 +410,7 @@ module.exports = {
   instanceManifestCmd,
   originEnvVarsFor,
   provisionedEnvPrefix,
+  selfEnvPrefix,
   serviceUnit,
   serviceUnitPath,
   settingsConsumed,

package/scripts/gds/provision.js

@@ -875,12 +875,12 @@ async function domainAttachInstance(inst, deps) {
 // ---------------------------------------------------------------------------
 async function settingsApplyInstance(inst, deps) {
   const { db, provisioning, exec, writeFile, log, apply, privileged } = deps;
-  // Same box routing as domainAttachInstance: a standalone runs control-plane-local.
-  const standalone = inst.hosting_shape === 'cloud-host';
-  const boxExec = standalone ? (deps.controlExec || exec) : exec;
-  const boxWriteFile = standalone ? (deps.controlWriteFile || writeFile) : writeFile;
+  // A standalone runs control-plane-local; the control plane's own row IS this box (task 1004334).
+  const onControlBox = inst.hosting_shape === 'cloud-host' || inst.hosting_shape === 'control-plane';
+  const boxExec = onControlBox ? (deps.controlExec || exec) : exec;
+  const boxWriteFile = onControlBox ? (deps.controlWriteFile || writeFile) : writeFile;
   const sudoP = privileged ? 'sudo ' : '';
-  const vars = settingsEnvVarsFor(inst);
+  const vars = settingsEnvVarsFor(inst); // the self row's prefix is re-read from the live file at the write
   const shown = Object.entries(vars).map(([k, v]) => `${k}=${v}`).join(' ');
   log(`settings-apply ${inst.slug} (shape=${inst.hosting_shape}, status=${inst.status}): ${shown}`);
 
@@ -917,7 +917,7 @@ async function settingsApplyInstance(inst, deps) {
   }
   try {
     log('  [config] patch the settings lines of web.env in place (creds + origins untouched)');
-    boxWriteFile(webEnvPath(inst), upsertEnvVars(current, vars), { mode: 0o600, sudo: true });
+    boxWriteFile(webEnvPath(inst), upsertEnvVars(current, settingsEnvVarsFor(inst, current)), { mode: 0o600, sudo: true });
     log('  [service] restart so the memoized branding pack re-reads them');
     pmFor(deps).restartService(inst, { exec: boxExec, sudoP });
   } catch (e) {

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1053'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1054'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/core_upgrade_door.mjs

@@ -102,18 +102,32 @@ await t('the allow-list is exactly the acts that cannot destroy the box', () =>
   // dry run returns at pre-flight having moved no pin, run no npm and restarted
   // nothing, and the control plane is the only instance whose hall HAS an Upgrade
   // page — so refusing the preview there protected nothing and removed everything.
+  // Widened a second time, by 'settings-apply' (task 1004334), for the reason argued in
+  // the guard's own comment: it is restart plus an in-place edit of the settings lines,
+  // and without it a setting saved on the platform's row could never reach the live site.
   assert.deepEqual([...G.CONTROL_PLANE_ACTIONS].sort(),
-    ['core-upgrade', 'core-upgrade-preflight', 'restart']);
+    ['core-upgrade', 'core-upgrade-preflight', 'restart', 'settings-apply']);
 });
 
 await t('the preview is permitted on the control plane — the one row that can use it', () => {
   assert.equal(G.intentAllowedForShape('core-upgrade-preflight', 'control-plane'), true);
 });
 
+await t('the settings push is permitted on the control plane, and the guard says WHY by name (task 1004334)', () => {
+  assert.equal(G.intentAllowedForShape('settings-apply', 'control-plane'), true);
+  // The argument is part of the edit: an entry added without its reason is exactly the
+  // "grew as a side effect" this pin exists to stop.
+  const src = read('modules', 'provisioning', 'control-plane-guard.js');
+  const reason = src.slice(src.indexOf('//   settings-apply'), src.indexOf('const CONTROL_PLANE_ACTIONS'));
+  assert.ok(reason.length > 0 && src.includes('//   settings-apply'), 'the guard comment carries a settings-apply entry');
+  assert.match(reason, /task 1004334/, 'the reason names the task that argued it');
+  assert.match(reason, /deletes nothing/, 'the reason states the property that makes it safe');
+});
+
 await t('and widening it did NOT let the destructive acts through', () => {
   // The whole risk of arguing one action onto an allow-list is arguing four.
   for (const a of P.INTENT_ACTIONS) {
-    if (['core-upgrade', 'core-upgrade-preflight', 'restart'].includes(a)) continue;
+    if (['core-upgrade', 'core-upgrade-preflight', 'restart', 'settings-apply'].includes(a)) continue;
     assert.equal(G.intentAllowedForShape(a, 'control-plane'), false,
       `'${a}' must still be refused against the box the platform runs on`);
   }

package/tests/provision_settings_apply.mjs

@@ -315,6 +315,90 @@ await ta('the shape refusal: dedicated → ok:false with guidance naming the val
   assert.equal(writes.length, 0);
 });
 
+console.log('\nthe control plane\'s own row — the platform pushes a setting to itself (task 1004334):');
+
+const U = require('../scripts/gds/provision-units.js');
+const { FALLBACK_ENV_PREFIX } = require('../src/instance-config.js');
+
+t('selfEnvPrefix: the web.env BRANDING_FILE line wins, then the instance pack, then the neutral pack, then the fallback', () => {
+  const packs = (map) => (p) => {
+    const hit = Object.keys(map).find((k) => p.replace(/\\/g, '/').endsWith(k));
+    if (!hit) { const e = new Error('ENOENT'); e.code = 'ENOENT'; throw e; }
+    return JSON.stringify(map[hit]);
+  };
+  const neutral = { 'config/branding.neutral.json': { envPrefix: 'NEUTRALX' } };
+  const withOwn = { ...neutral, 'config/branding.json': { envPrefix: 'OWNPACK' }, 'packs/site.json': { envPrefix: 'OVERRIDE' } };
+  const root = '/srv/instance';
+  assert.equal(U.selfEnvPrefix({ envBody: 'PORT=1\nBONGOS_BRANDING_FILE=packs/site.json\n', instanceRoot: root, readFile: packs(withOwn) }), 'OVERRIDE');
+  assert.equal(U.selfEnvPrefix({ envBody: 'GDS_BRANDING_FILE=packs/site.json\r\n', instanceRoot: root, readFile: packs(withOwn) }), 'OVERRIDE', 'a legacy spelling still names the pack, as loadBranding reads it');
+  assert.equal(U.selfEnvPrefix({ envBody: 'PORT=1\n', instanceRoot: root, readFile: packs(withOwn) }), 'OWNPACK', 'no override → the instance root\'s config/branding.json');
+  assert.equal(U.selfEnvPrefix({ envBody: 'FOO_BRANDING_FILE=packs/site.json\n', instanceRoot: root, readFile: packs(withOwn) }), 'OWNPACK', 'an unknown prefix is not the branding knob');
+  assert.equal(U.selfEnvPrefix({ envBody: '# BONGOS_BRANDING_FILE=packs/site.json\n', instanceRoot: root, readFile: packs(withOwn) }), 'OWNPACK', 'a commented line is not set');
+  // loadBranding's own rule: an override that names a missing file loads NO instance pack,
+  // so the neutral one answers — config/branding.json is not consulted as a second chance.
+  assert.equal(U.selfEnvPrefix({ envBody: 'BONGOS_BRANDING_FILE=packs/gone.json\n', instanceRoot: root, readFile: packs(withOwn) }), 'NEUTRALX');
+  assert.equal(U.selfEnvPrefix({ envBody: '', instanceRoot: root, readFile: packs({ ...neutral, 'config/branding.json': { name: 'no prefix here' } }) }), 'NEUTRALX', 'a pack that names no envPrefix inherits the neutral one');
+  assert.equal(U.selfEnvPrefix({ envBody: '', instanceRoot: root, readFile: packs({}) }), FALLBACK_ENV_PREFIX, 'nothing readable → the fallback');
+});
+
+t('settingsEnvVarsFor: only the control-plane row reads the self prefix — every other shape is byte-identical to before', () => {
+  const body = 'BONGOS_BRANDING_FILE=/nowhere/at/all.json\n';
+  for (const shape of ['cloud-host', 'co-tenant']) {
+    assert.deepEqual(P.settingsEnvVarsFor({ ...activeStandalone, hosting_shape: shape }, body), P.settingsEnvVarsFor({ ...activeStandalone, hosting_shape: shape }), shape);
+    assert.ok(Object.keys(P.settingsEnvVarsFor({ ...activeStandalone, hosting_shape: shape }, body)).every((k) => k.startsWith(`${NEUTRAL_PREFIX}_`)), shape);
+  }
+});
+
+const selfRow = {
+  id: 41, slug: 'cloudbongos', hosting_shape: 'control-plane', status: 'active', owner_builder_id: 3,
+  port: 3002, domain: 'cloudbongos.com', settings: { artist_gate: 'off' },
+};
+
+await ta('--apply, the control-plane row: its OWN /etc/<slug>/web.env on the control-plane pair, under ITS pack\'s prefix, then restart <slug>; nothing else moves', async () => {
+  const fs = await import('node:fs');
+  const os = await import('node:os');
+  const path = await import('node:path');
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cp-pack-'));
+  const pack = path.join(dir, 'site.json');
+  fs.writeFileSync(pack, JSON.stringify({ envPrefix: 'CPSELF' }));
+  const selfEnv = `CPSELF_GITHUB_CLIENT_SECRET=keepme0123456789\nBONGOS_BRANDING_FILE=${pack}\nPORT=3002\nCPSELF_ARTIST_GATE=strict\nGITHUB_PUSH_TOKEN=keepme-too\n`;
+  const seen = { box: [], control: [] };
+  const mk = (bucket) => (cmd) => {
+    seen[bucket].push(cmd);
+    if (/\bcat /.test(cmd)) return { ok: true, stdout: selfEnv };
+    if (/api\/bongos\/instance/.test(cmd)) return { ok: true, stdout: manifestWith({ platformVisibility: 'public', joinability: 'apply', visibility: 'public', joinGrant: 'full', artistGate: 'off', spendPayer: 'none' }) };
+    return { ok: true, stdout: '{"ok":true}' };
+  };
+  try {
+    const { deps, writes, events } = recorder({ apply: true });
+    deps.exec = mk('box'); deps.controlExec = mk('control');
+    const r = await P.settingsApplyInstance(selfRow, deps);
+    assert.equal(r.ok, true, JSON.stringify(r));
+    assert.equal(r.consumed, true, 'the read-back saw the live site report the new value');
+    assert.equal(seen.box.length, 0, 'nothing runs on the co-hosting box executor — the self row IS the control plane');
+    assert.ok(seen.control.some((c) => /^cat \/etc\/cloudbongos\/web\.env$/.test(c)), seen.control.join(' | '));
+    assert.ok(seen.control.some((c) => /^systemctl restart cloudbongos$/.test(c)), 'the service the core-upgrade door already restarts');
+    assert.deepEqual(writes.map((w) => [w.via, w.path]), [['control', '/etc/cloudbongos/web.env']]);
+    const out = writes[0].body;
+    assert.match(out, /^CPSELF_ARTIST_GATE=off$/m, 'replaced IN PLACE under the prefix the site resolves');
+    assert.doesNotMatch(out, /^BONGOS_ARTIST_GATE=/m, 'not written under the provisioned floor, which this site would never read');
+    assert.match(out, /^CPSELF_GITHUB_CLIENT_SECRET=keepme0123456789$/m, 'creds untouched');
+    assert.match(out, /^GITHUB_PUSH_TOKEN=keepme-too$/m);
+    assert.match(out, /^PORT=3002$/m);
+    assert.ok(![...seen.control].some((c) => /systemctl (stop|disable)|caddy|box-dns|rm -|upgrade\.js|npm/.test(c)), 'settings only — no teardown, DNS, Caddy or pin legs');
+    assert.match(events[0].detail, /reads the new values/);
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+await ta('the control-plane row keeps every refusal of the leg: an unreadable web.env writes nothing and restarts nothing', async () => {
+  const { deps, cmds, writes } = recorder({ apply: true, readFails: true });
+  const r = await P.settingsApplyInstance(selfRow, deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /cannot read \/etc\/cloudbongos\/web\.env/);
+  assert.equal(writes.length, 0);
+  assert.ok(!cmds.some((c) => /restart/.test(c)), 'the platform is never restarted over a file it could not read');
+});
+
 console.log('\nthe verdict — recorded only when earned:');
 
 await ta('--apply success, manifest matches: consumed=true, event says it reads the new values, F19 latch released, domain-bearing PASS records no liveness verdict', async () => {

package/tests/provisioning_settings_apply.mjs

@@ -72,19 +72,30 @@ t('SETTINGS_APPLY_FROM is exactly {active} — the provision intent cannot stand
   assert.ok(!provisioning.PROVISION_ENQUEUE_FROM.has('active'), 'the premise the gate rests on');
 });
 
-t('SETTINGS_APPLY_SHAPES is the reachable pair, and the set is a subset of HOSTING_SHAPES', () => {
-  assert.deepEqual([...provisioning.SETTINGS_APPLY_SHAPES].sort(), ['cloud-host', 'co-tenant']);
+t('SETTINGS_APPLY_SHAPES is the reachable three, and the set is a subset of HOSTING_SHAPES', () => {
+  // 'control-plane' joined in task 1004334: the runner's OWN box, admitted by name in
+  // control-plane-guard.js, so a setting saved on the platform's row reaches the live site.
+  assert.deepEqual([...provisioning.SETTINGS_APPLY_SHAPES].sort(), ['cloud-host', 'co-tenant', 'control-plane']);
   for (const s of provisioning.SETTINGS_APPLY_SHAPES) assert.ok(provisioning.HOSTING_SHAPES.includes(s), s);
   // The exclusion this used to assert was 'dedicated', which task 1004182 removed from
   // HOSTING_SHAPES entirely — so that assertion became vacuously true and stopped testing
-  // anything. Name the shapes that DO exist and are still deliberately unreachable: nothing
-  // of ours runs a byo-host, and the control plane is not pushed settings by this path.
-  for (const unreachable of ['byo-host', 'control-plane']) {
+  // anything. Name the shape that DOES exist and is still deliberately unreachable:
+  // nothing of ours runs a byo-host.
+  for (const unreachable of ['byo-host']) {
     assert.ok(provisioning.HOSTING_SHAPES.includes(unreachable), `${unreachable} must be a real shape or this assertion is vacuous`);
     assert.ok(!provisioning.SETTINGS_APPLY_SHAPES.has(unreachable), unreachable);
   }
 });
 
+t('the two gates agree: every settings-apply shape is one the self-row guard lets a settings-apply through', () => {
+  // A shape on SETTINGS_APPLY_SHAPES that the guard refuses would make the route say
+  // "a restart is coming" and then answer the owner with control_plane_protected.
+  const G = require('../modules/provisioning/control-plane-guard.js');
+  for (const s of provisioning.SETTINGS_APPLY_SHAPES) assert.equal(G.intentAllowedForShape('settings-apply', s), true, s);
+  // and the restart door was NOT opened on the self row as a side effect
+  assert.ok(!provisioning.RESTART_SHAPES.has('control-plane'), 'task 1004334 widened the settings push only');
+});
+
 await ta('enqueueSettingsApply: a fresh intent → created:true; the INSERT carries the settings-apply action', async () => {
   const calls = [];
   const db = { query: async (sql, params) => { calls.push({ sql, params }); return { rows: [{ id: 1, action: params[1], state: 'pending' }] }; } };
@@ -104,6 +115,26 @@ await ta('enqueueSettingsApply: a fresh intent → created:true; the INSERT carr
   assert.deepEqual(insert.params, [18, 'settings-apply', 'api:self', null]);
 });
 
+await ta('enqueueSettingsApply on the CONTROL-PLANE row passes the self-row guard and INSERTs; a teardown on the same row is still refused (task 1004334)', async () => {
+  const selfRow = (calls) => ({ query: async (sql, params) => {
+    calls.push({ sql, params });
+    if (/SELECT hosting_shape FROM provisioning_instances/.test(sql)) return { rows: [{ hosting_shape: 'control-plane' }] };
+    return { rows: [{ id: 3, action: params[1], state: 'pending' }] };
+  } });
+  const calls = [];
+  const r = await provisioning.enqueueSettingsApply(selfRow(calls), 41, 'api:self');
+  assert.equal(r.created, true, 'the real guard (not a stub) admits the push onto the self row');
+  const insert = calls.find((c) => /INSERT INTO provisioning_intents/.test(c.sql));
+  assert.deepEqual(insert.params, [41, 'settings-apply', 'api:self', null]);
+  // Everything the guard existed to refuse is still refused through the same door.
+  for (const destructive of ['teardown', 'disconnect', 'provision', 'domain-attach', 'repo-private']) {
+    const seen = [];
+    await assert.rejects(provisioning.enqueueIntent(selfRow(seen), 41, destructive, 'api:self'),
+      (e) => e.code === 'control_plane_protected' && e.status === 409, destructive);
+    assert.ok(!seen.some((c) => /INSERT/.test(c.sql)), `${destructive}: nothing written`);
+  }
+});
+
 await ta('enqueueSettingsApply: an identical PENDING push already open → created:false, no conflict (it carries this change)', async () => {
   const db = { query: async (sql) => {
     if (/INSERT/.test(sql)) { const e = new Error('dup'); e.code = '23505'; throw e; }
@@ -260,6 +291,20 @@ await ta('ACTIVE co-tenant queues too; the Archon override names WHICH archon on
   assert.equal(events[0].actor, 'api:archon:999');
 });
 
+await ta('ACTIVE control-plane row (the platform itself): artist_gate off QUEUES a push and says a restart is coming (task 1004334)', async () => {
+  // The case TW01 hit: this save used to answer "runs on a machine the platform doesn't
+  // manage", stored 'off', and left the live site reading 'strict' with no way to apply it.
+  reset({ inst: { owner_builder_id: 7, slug: 'cloudbongos', status: 'active', hosting_shape: 'control-plane', domain: 'cloudbongos.com', port: 3002, settings: {} } });
+  const r = await patch('/provisioning/instances/41/settings', { artist_gate: 'off' });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.body.saved.artist_gate, 'off');
+  assert.deepEqual(updateCalls.map((c) => c.patch), [{ artist_gate: 'off' }]);
+  assert.equal(updateCalls[0].enqueuedSoFar, 0, 'the row is written before the intent the runner reads it through');
+  assert.deepEqual(enqueueCalls, [{ id: 41, requestedBy: 'api:self' }]);
+  receiptShape(r.body.push, { queued: true, restart: true, reachable: true });
+  assert.doesNotMatch(r.body.push.message, /doesn.t manage/, 'no longer the unreachable-machine sentence');
+});
+
 await ta('an identical PENDING push already open → 200, queued:false, "already queued … will carry this change"', async () => {
   reset();
   enqueueResult = { intent: { id: 5, action: 'settings-apply', state: 'pending' }, created: false };