@bongos/core 1.19.142 → 1.19.144

package/public-landing/projects.html

@@ -80,7 +80,7 @@ h1[tabindex="-1"]:focus{outline:none;}
 .wizField small{font-weight:500;color:var(--ink-faint);}
 #view-new input[type=text]{
   width:100%;font-family:var(--font-body);font-size:17px;font-weight:600;color:var(--ink);
-  background:var(--bg-card);border:2px solid var(--line);border-radius:14px;padding:13px 16px;outline:none;
+  background:var(--bg-card);border:2px solid var(--ctl-line);border-radius:14px;padding:13px 16px;outline:none;
   transition:border-color .15s ease, box-shadow .15s ease;
 }
 /* no fade toward the card — a 70% mix washed placeholders to 2.89:1 (task 1002749) */
@@ -255,6 +255,10 @@ h1[tabindex="-1"]:focus{outline:none;}
 .addrConfirm.optedOut{border-color:var(--line);background:var(--bg);}
 .addrConfirm.optedOut .addrBig{color:var(--ink-soft);}
 .addrConfirm.optedOut>p{color:var(--ink-faint);}
+/* the handle is not free (task 1002898 N10) — a refusal must not be painted into the
+   green confirmation box that means "yours" */
+.addrConfirm.unavailable{border-color:color-mix(in srgb,var(--err) 45%,var(--bg-card));background:var(--bg);}
+.addrConfirm.unavailable .addrBig{color:var(--err);}
 .addrBig{font-family:var(--font-display);font-weight:700;font-size:19px;letter-spacing:-0.3px;line-height:1.4;}
 .addrBig code{font-family:var(--font-mono);font-size:15px;background:var(--bg-deep);border-radius:8px;padding:2px 9px;color:var(--accent-deep);word-break:break-all;}
 .addrConfirm>p{font-size:13.5px;font-weight:500;color:var(--ink-soft);line-height:1.5;margin-top:6px;}
@@ -713,8 +717,14 @@ h1[tabindex="-1"]:focus{outline:none;}
           </section>
 
           <!-- step 4 · address — a CONFIRMATION, not a form (task 1002704: every project
-               gets its slug subdomain assigned up front; opt-out lives in the disclosure).
-               The domainless default was a proven dead-end (QA walk, task 1002702). -->
+               gets its slug subdomain assigned up front). The domainless default was a
+               proven dead-end (QA walk, task 1002702).
+               Three choices, all legible without opening anything (task 1002898 N8):
+               the assigned address is stated, and BOTH alternatives sit under it — the
+               bring-your-own domain behind its disclosure, the no-address opt-out in the
+               open. The opt-out used to live INSIDE the "domain I own" fold, i.e. the
+               choice for NO address was hidden under a fold labelled the opposite
+               choice; the owner read the step as "weird" and never found it. -->
           <section class="panel" id="panel-address" aria-labelledby="addr-h">
             <h1 id="addr-h">Its address in the sky</h1>
             <p class="lede">The handle names your project on the platform — and its address comes with it. Sign-in, sharing, everything just works from the moment it stands up.</p>
@@ -733,11 +743,11 @@ h1[tabindex="-1"]:focus{outline:none;}
                       <input type="text" id="f-domain" placeholder="mercury.example.com" autocomplete="off" maxlength="253" spellcheck="false">
                       <div class="hint" id="h-domain">&nbsp;</div>
                     </label>
-                    <label class="addrOpt"><input type="checkbox" id="f-noaddr">
-                      <span>Start without an address — possible, but sign-in on your project can’t be set up until it has one.</span>
-                    </label>
                   </div>
                 </details>
+                <label class="addrOpt"><input type="checkbox" id="f-noaddr">
+                  <span>Start without an address — possible, but sign-in on your project can’t be set up until it has one.</span>
+                </label>
               </div>
               <div class="nav">
                 <button type="button" class="btn ghost" data-back="3">← Back</button>
@@ -2113,30 +2123,101 @@ h1[tabindex="-1"]:focus{outline:none;}
       if (state.noAddress) return '';
       return assignedDomain() || '';
     }
+    /* What the create POST may CARRY, as opposed to what the panel displays: only a
+       bring-your-own domain. The assigned <slug>.<apex> default is the server's to
+       apply (task 1002704) and re-asserting it here is what task 1002898 N2 closes —
+       apexBase() falls back to guessing from location.hostname, and a guess that
+       disagrees with the server's apex (a subdomain hub like get.<apex>) is refused
+       as an under-apex squat. Omit it and the server assigns the right one. */
+    function byoDomain() {
+      return state.domain && looksLikeDomain(state.domain) ? state.domain : '';
+    }
+
+    /* ── slug availability (task 1002898 N10) ──
+       The panel promised '<slug>.<apex> — yours from the moment it stands up' on FORMAT
+       validation alone, so a collision surfaced only as a 409 at the final Create click.
+       GET /provisioning/slug-available answers the same question the create route will,
+       and the promise is now made only once the server has said the handle is free.
+       This NARROWS the race, it does not close it — the 409 at create is still the only
+       authority — so an unanswered check degrades to naming the address WITHOUT the
+       ownership promise, never to guessing in either direction. */
+    var slugAvail = { slug: '', state: 'unknown' };  /* unknown | checking | free | taken | yours | reserved */
+    var slugCheckT = 0;
+    var slugCheckGen = 0;
+    /* Only trust a verdict that belongs to the handle currently in the field. */
+    function slugAvailState() {
+      return slugAvail.slug === state.slug ? slugAvail.state : 'unknown';
+    }
+    /* Debounced, and generation-guarded because a cleared timer cannot cancel a chain
+       already mid-fetch — each chain carries the generation it was born under, so an
+       orphaned answer goes quiet instead of overwriting a newer one (the manifest-poll
+       idiom below). The caller re-renders; this only sets state. */
+    function checkSlugAvailable() {
+      clearTimeout(slugCheckT);
+      slugCheckGen += 1;
+      var slug = state.slug;
+      if (!validSlug(slug)) { slugAvail = { slug: slug, state: 'unknown' }; return; }
+      slugAvail = { slug: slug, state: 'checking' };
+      var myGen = slugCheckGen;
+      slugCheckT = setTimeout(function () {
+        fetch(API + '/provisioning/slug-available?slug=' + encodeURIComponent(slug), { credentials: 'same-origin' })
+          .then(function (res) { if (!res.ok) throw new Error('soft'); return res.json(); })
+          .then(function (d) {
+            if (myGen !== slugCheckGen) return;
+            slugAvail = { slug: slug, state: d.available ? 'free' : (d.reason || 'taken') };
+            renderAddrPanel();
+          })
+          .catch(function () {
+            if (myGen !== slugCheckGen) return;
+            /* no answer is NOT a free answer — back to the format-only wording */
+            slugAvail = { slug: slug, state: 'unknown' };
+            renderAddrPanel();
+          });
+      }, 400);
+    }
     function renderAddrPanel() {
       var box = $('addrConfirm');
       if (!box) return;
       var assigned = assignedDomain();
       var custom = state.domain && looksLikeDomain(state.domain) ? state.domain : '';
-      box.classList.toggle('optedOut', state.noAddress && !custom);
       var big = $('addrAssigned');
       var note = $('addrAssignedNote');
+      /* the verdict only bears on the ASSIGNED address — a chosen domain or the
+         opt-out settles the step without it */
+      var avail = !custom && !state.noAddress && assigned ? slugAvailState() : 'unknown';
+      box.classList.toggle('optedOut', state.noAddress && !custom);
+      box.classList.toggle('unavailable', avail === 'taken' || avail === 'yours' || avail === 'reserved');
       if (custom) {
         big.innerHTML = '<code>' + esc(custom) + '</code> — your own domain, wired up for you.';
         note.textContent = 'DNS pointing happens after the standup; the card on your projects page walks you through it.';
       } else if (state.noAddress) {
         big.textContent = 'Starting without an address.';
         note.textContent = 'Sign-in on your project can’t be set up until it has one — add it any time from your projects page.';
-      } else if (assigned) {
+      } else if (assigned && avail === 'free') {
         big.innerHTML = '<code>' + esc(assigned) + '</code> — yours from the moment it stands up.';
         note.textContent = 'Sign-in, sharing, everything just works. You can point a domain you own at it any time.';
+      } else if (assigned && avail === 'taken') {
+        big.innerHTML = '<code>' + esc(assigned) + '</code> — already taken.';
+        note.textContent = 'Another project on the platform holds that handle. Pick a different one.';
+      } else if (assigned && avail === 'yours') {
+        big.innerHTML = '<code>' + esc(assigned) + '</code> — you already have that one.';
+        note.textContent = 'That handle belongs to one of your own projects. Pick a different one to start something new.';
+      } else if (assigned && avail === 'reserved') {
+        big.innerHTML = '<code>' + esc(assigned) + '</code> — reserved by the platform.';
+        note.textContent = 'That address is the platform’s own. Pick a different handle, or bring a domain you own.';
+      } else if (assigned && avail === 'checking') {
+        big.innerHTML = '<code>' + esc(assigned) + '</code> — checking that it’s free…';
+        note.textContent = 'One moment.';
+      } else if (assigned) {
+        /* the check didn’t answer — name the address, promise nothing about it */
+        big.innerHTML = '<code>' + esc(assigned) + '</code> — the address it would take.';
+        note.textContent = 'We couldn’t check whether that handle is free just now — you’ll know for certain when you create it.';
       } else if (!validSlug(state.slug)) {
         big.textContent = 'Pick a handle above and the address comes with it.';
         note.textContent = '';
       } else {
         /* dotless host (local dev): nothing sane to auto-assign — the domain
-           field IS the step here, so unfold it (a folded disclosure made the
-           opt-out checkbox unreachable-by-default; owner walk, 2026-08-12) */
+           field IS the step here, so unfold it */
         big.textContent = 'No address is assigned on this host.';
         note.textContent = 'Add a domain you own below, or start without one.';
         $('addrCustom').open = true;
@@ -2202,7 +2283,10 @@ h1[tabindex="-1"]:focus{outline:none;}
          (a pre-auth probe 401s for strangers and, worse, could seed the
          draft's owner with myLogin()'s placeholder) */
       if (step === 3) { syncHome(); if (authKnown) ensureRepoAccess(); }
-      if (step === 4) renderAddrPanel();
+      /* re-check on every entry, not just on typing: a resumed draft arrives here with
+         a handle nobody has asked the server about, and a handle free ten minutes ago
+         may not be now (task 1002898 N10) */
+      if (step === 4) { checkSlugAvailable(); renderAddrPanel(); }
       if (step === 5) renderReview();
     }
 
@@ -2427,6 +2511,7 @@ h1[tabindex="-1"]:focus{outline:none;}
       if (!state.slug) { h.innerHTML = '&nbsp;'; h.className = 'hint'; this.classList.remove('bad'); }
       else if (validSlug(state.slug)) { h.textContent = 'Nice — that works.'; h.className = 'hint ok'; this.classList.remove('bad'); }
       else { h.textContent = '2–40 lowercase letters, numbers, or dashes; no leading/trailing/double dash.'; h.className = 'hint err'; this.classList.add('bad'); }
+      checkSlugAvailable();
       renderAddrPanel();
       saveDraft();
     });
@@ -2481,6 +2566,23 @@ h1[tabindex="-1"]:focus{outline:none;}
           return false;
         }
         if (state.domain && !looksLikeDomain(state.domain)) return false;
+        /* A handle the server has already said is not free would only 409 at Create —
+           stop here instead (task 1002898 N10). ONLY a definite negative blocks:
+           'unknown' and 'checking' must never gate the step, because the check is
+           advisory and the 409 remains the authority. A chosen domain or the opt-out
+           settles the address another way, so the block does not apply there. */
+        if (!state.domain && !state.noAddress) {
+          var av = slugAvailState();
+          if (av === 'taken' || av === 'yours' || av === 'reserved') {
+            $('h-slug').textContent = av === 'taken'
+              ? 'That handle is already taken — pick a different one.'
+              : av === 'yours'
+                ? 'You already have a project with that handle — pick a different one.'
+                : 'That handle is reserved by the platform — pick a different one.';
+            $('h-slug').className = 'hint err'; $('f-slug').classList.add('bad');
+            return false;
+          }
+        }
         /* no auto-assigned address (dotless host): going domainless must be an
            EXPLICIT choice — a domain, or the opt-out box. Never silent. */
         if (!resolvedDomain() && !state.noAddress) {
@@ -2593,10 +2695,15 @@ h1[tabindex="-1"]:focus{outline:none;}
             slug: state.slug,
             type: state.projType || undefined,
             hosting_shape: 'standalone',
-            domain: resolvedDomain() || undefined,
-            /* The server now defaults an omitted domain to the assigned address
-               (task 1002704), so the opt-out must travel explicitly — an absent
-               domain no longer means "none". */
+            /* ONLY a bring-your-own domain travels (task 1002898 N2). The server owns
+               the assigned <slug>.<apex> default (task 1002704) and applies it to an
+               omitted domain, so re-sending our own derived copy could only disagree
+               with it — apexBase() may be guessing from location.hostname, and a guess
+               that lands under the apex but isn't the server's assignment is refused
+               as a squat. Omitting it is how the default is now requested. */
+            domain: byoDomain() || undefined,
+            /* An absent domain means "assign me the default", so the opt-out must
+               travel explicitly — it is the only thing that means "none". */
             no_address: state.noAddress ? true : undefined,
             target_ref: state.owner + '/' + state.repo,
             /* LOAD-BEARING for the control-plane runner, not just for the checklist we
@@ -2618,9 +2725,14 @@ h1[tabindex="-1"]:focus{outline:none;}
         });
       }).then(function (data) {
         try {
+          /* The address the instance ACTUALLY holds, read off the create response —
+             not our preview of it (task 1002898 N2). The server owns the assigned
+             default, so its answer is the only one the done panel may promise; a
+             client-derived copy could name an address that was never assigned. */
+          var madeDomain = (data.instance && data.instance.domain) || '';
           sessionStorage.setItem(CREATED_KEY, JSON.stringify({
-            id: data.instance && data.instance.id, slug: state.slug, domain: resolvedDomain(),
-            noaddr: !!state.noAddress,
+            id: data.instance && data.instance.id, slug: state.slug, domain: madeDomain,
+            noaddr: !madeDomain,
             mode: state.mode, name: state.name, at: Date.now()
           }));
           sessionStorage.removeItem(DRAFT_KEY);

package/src/module-api.js

@@ -711,8 +711,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.140 with no explicit bump. run 31892484952. (task 1002620)
 //   1.19.142 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.141 with no explicit bump. run 31893298770. (task 1002620)
+//   1.19.143 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.142 with no explicit bump. run 31893905320. (task 1002620)
+//   1.19.144 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.143 with no explicit bump. run 31894547582. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.142'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.144'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/cosmos_token_contrast.mjs

@@ -19,6 +19,17 @@ const CSS = path.join(
 );
 const src = fs.readFileSync(CSS, 'utf8');
 
+// The two sheets that actually ship, comment-stripped. Several static guards
+// below read these instead of resolved colors, so they are declared here beside
+// `src` rather than beside their first consumer — as source-order constants they
+// were only reachable because node:test defers a test body past module
+// evaluation, which is a thin thing to rest on.
+const cssSrc = src.replace(/\/\*[\s\S]*?\*\//g, '');
+const pageSrc = fs
+  .readFileSync(path.join(path.dirname(CSS), '..', 'projects.html'), 'utf8')
+  .replace(/<!--[\s\S]*?-->/g, '')
+  .replace(/\/\*[\s\S]*?\*\//g, '');
+
 // ── parse ────────────────────────────────────────────────────────────────────
 const declarations = (body) => {
   const out = {};
@@ -207,6 +218,15 @@ const PAIRS = [
   // must still measure (19px/700 headline = large text, 3.0)
   ['optedOut .addrBig (large) on --bg', 'var(--ink-soft)',      'var(--bg)',            3.0],
   ['addrOpt warning on --bg',           'var(--warn)',          'var(--bg)',            4.5],
+  // ?view=mine (task 1002823) — both surfaces traded a subtree opacity for muted
+  // tokens, so the tokens themselves now carry the de-emphasis and must measure.
+  // The two pill rows are the pair that proves the split: one mute cannot serve
+  // both grounds, because on the pressed --accent fill no ink token clears 4.5
+  // (--ink is the best at 3.70 light / 4.05 dark) and only the button's #fff does.
+  ['.filters .n count, resting pill',   'var(--ink-faint)',     CARD,                   4.5],
+  ['.filters .n count, pressed pill',   '#ffffff',              'var(--accent)',        4.5],
+  ['.proj.gone name (muted)',           'var(--ink-soft)',      CARD,                   4.5],
+  ['.proj.gone meta (dim removed)',     'var(--ink-faint)',     CARD,                   4.5],
   // lifecycle strip: 12px/700
   ['.strip .slbl idle',                 'var(--ink-faint)',     CARD,                   4.5],
   ['.strip .slbl now/done',             'color-mix(in srgb,var(--sea) 40%,var(--ink))',       CARD, 4.5],
@@ -227,6 +247,23 @@ const PAIRS = [
   ['typeCard heading · business',       'color-mix(in srgb,var(--terracotta) 40%,var(--ink))', 'color-mix(in srgb,var(--terracotta) 9%,var(--bg-card))', 4.5],
   ['typeCard heading · non-profit',     'color-mix(in srgb,var(--gold-soft) 40%,var(--ink))',  'color-mix(in srgb,var(--gold-soft) 9%,var(--bg-card))',  4.5],
   ['typeCard heading · not-sure',       'color-mix(in srgb,var(--rule-soft) 40%,var(--ink))',  'color-mix(in srgb,var(--rule-soft) 9%,var(--bg-card))',  4.5],
+  // --ctl-line (task 1002824): the ONLY rows in this file that measure a border
+  // token as a FOREGROUND. WCAG 1.4.11 asks 3:1 of the boundary that IDENTIFIES
+  // a control, and a text field has nothing else to identify it — its --bg-card
+  // fill is 1.02:1 on the card it sits in, so the border IS the boundary. Both
+  // adjacent colors are measured: the --card outside and the fill inside.
+  //
+  // --line stays exactly where it is and is deliberately NOT held to this bar.
+  // It is a CARD hairline (1.16:1 light / 1.09:1 dark) drawing .review,
+  // .humanSteps>li, .kv, .ghlist, the unselected .tpill and the .choice cards.
+  // Two washed-down variants of it are likewise EXEMPT because they are
+  // DECORATIVE, not identifying: .humanSteps>li.slocked (55% line mix, ~1.06:1 —
+  // task 1002751) says "locked" through its number chip and muted text, and
+  // .proj.gone (the same mix — task 1002823) says "torn down" through its
+  // ghosted orb, its chip and a line of copy. Neither border carries state on
+  // its own, so raising them would buy nothing and restyle every card.
+  ['--ctl-line boundary on the card',   'var(--ctl-line)',      'var(--card)',          3.0],
+  ['--ctl-line boundary vs input fill', 'var(--ctl-line)',      CARD,                   3.0],
   ['?view=new input ::placeholder',     'var(--ink-faint)',     CARD,                   4.5],
   ['?view=new .ghlist .hint on deep',   'var(--ink-faint)',     'var(--bg-deep)',       4.5],
   ['--chrome-accent wordmark',          'var(--chrome-accent)', 'var(--page-bg)',       4.5],
@@ -351,6 +388,25 @@ test('no text link is left painting --accent-deep', () => {
   assert.deepEqual(strays, [], `\n  ${strays.join('\n  ')}\n`);
 });
 
+test('no text-entry control draws its boundary with --line', () => {
+  // The companion to the --ctl-line PAIRS rows: the token only helps the rules
+  // that take it, and these live in two sheets (cosmos.css owns .attach and
+  // .mineBar .search, projects.html owns the wizard's own #view-new fields), so
+  // fixing one sheet leaves the other invisible. Text-entry selectors only —
+  // --line is still correct for every card, list and pill it draws, which is the
+  // whole reason this became a second token instead of a change to --line.
+  const strays = [];
+  for (const [where, text] of [['cosmos.css', cssSrc], ['projects.html', pageSrc]]) {
+    for (const m of text.matchAll(/([^{}@]+)\{([^{}]*)\}/g)) {
+      if (!/\b(?:input|textarea|select)\b|\.search\b/.test(m[1])) continue;
+      if (/border(?:-color|-\w+)?\s*:[^;]*var\(\s*--line\s*\)/.test(m[2])) {
+        strays.push(`${where}: ${m[1].trim().slice(0, 70)}`);
+      }
+    }
+  }
+  assert.deepEqual(strays, [], `\n  ${strays.join('\n  ')}\n`);
+});
+
 // The gate's LOCKED sky palette — deliberately absent from COLOR_VARS, so a
 // branding pack can never re-theme these. Dark GROUNDS are allowed (dark mode IS
 // the gate's space, by design); text painted with one shows Cloud Bongos orange
@@ -402,11 +458,6 @@ test('dark blocks never re-point a token at the locked space palette', () => {
 // Known limits, accepted: @keyframes bodies, animation-fill-mode resting
 // values, and JS-set inline opacity are out of static reach — never make an
 // animation or script the resting presenter of text or a state mark.
-const pageSrc = fs
-  .readFileSync(path.join(path.dirname(CSS), '..', 'projects.html'), 'utf8')
-  .replace(/<!--[\s\S]*?-->/g, '')
-  .replace(/\/\*[\s\S]*?\*\//g, '');
-const cssSrc = src.replace(/\/\*[\s\S]*?\*\//g, '');
 const dimsBelowFull = (body) => {
   const m = body.match(/opacity\s*:\s*([\d.]+%?)/);
   if (!m) return false;
@@ -416,9 +467,12 @@ const dimsBelowFull = (body) => {
 
 test('text is never dimmed by subtree opacity', () => {
   // Two nets. (1) Anywhere in either sheet: a rule that declares BOTH a color
-  // and a sub-1 opacity is dimmed text by construction. (2) The create flow's
-  // known text containers may not carry opacity at all — this also catches
-  // ancestor dims (.createSplit) that net 1 can't see.
+  // and a sub-1 opacity is dimmed text by construction. (2) The known text
+  // containers may not carry opacity at all — this also catches ancestor dims
+  // (.createSplit, .proj.gone) and blocks that declare NO color of their own,
+  // which is exactly how .filters .n and .proj.gone survived net 1 into task
+  // 1002823. Graphics are deliberately absent from the list: .orb.ghost and
+  // .worldOrb.dim carry no text and their opacity IS the state cue.
   const offenders = [];
   for (const [where, text] of [['cosmos.css', cssSrc], ['projects.html', pageSrc]]) {
     for (const m of text.matchAll(/([^{}@]+)\{([^{}]*)\}/g)) {
@@ -427,7 +481,7 @@ test('text is never dimmed by subtree opacity', () => {
       }
     }
   }
-  for (const sel of ['\\.humanSteps', '\\.addrConfirm', '\\.prog\\b', '\\.choice', '\\.review', '\\.createSplit', '\\.chip \\.rec']) {
+  for (const sel of ['\\.humanSteps', '\\.addrConfirm', '\\.prog\\b', '\\.choice', '\\.review', '\\.createSplit', '\\.chip \\.rec', '\\.filters', '\\.proj\\b']) {
     for (const text of [cssSrc, pageSrc]) {
       for (const m of text.matchAll(new RegExp(`${sel}[^{}]*\\{([^}]*)\\}`, 'g'))) {
         if (dimsBelowFull(m[1])) offenders.push(`text container dimmed: ${m[0].slice(0, 90)}`);

package/tests/provisioning_slug_available.mjs

@@ -0,0 +1,243 @@
+// tests/provisioning_slug_available.mjs
+//
+// GET /provisioning/slug-available (task 1002898 N10). The create wizard declared
+// '<slug>.<apex> — yours from the moment it stands up' on FORMAT validation alone;
+// no availability route existed anywhere, so a collision surfaced only as a 409 at
+// the final Create click. This route answers the same question POST
+// /provisioning/instances will, and the panel now waits for it before promising.
+//
+// The contract under test is AGREEMENT with the create route — the route is only
+// worth having if its three refusals match the three ways create actually answers:
+//   taken    → another builder holds the slug   → create 409s slug_taken
+//   yours    → the CALLER holds it              → create is an idempotent re-request
+//   reserved → row free, <slug>.<apex> reserved → create 400s domain_reserved
+// plus the same trim+lowercase normalization and the same isValidSlug bar, and the
+// same byte-exact `slug text UNIQUE` lookup (no lower(slug), which would over-report).
+//
+// Also pinned: it requires a session (NOT public — the answer is a yes/no about every
+// project slug on the instance) and it is rate-limited (same reason).
+//
+// DB-free: data-access fns are stubbed on the cached module object (the
+// provisioning_default_domain.mjs harness). No network.
+//
+// Run:  node tests/provisioning_slug_available.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ── harness ─────────────────────────────────────────────────────────────────
+let slugHolder = null;        // what getInstanceBySlug returns
+let lookedUp = [];            // the exact string the route handed the lookup
+provisioning.getInstanceBySlug = async (_db, s) => { lookedUp.push(s); return slugHolder; };
+
+const api = require('../src/module-api.js');
+let authOk = true;            // flipped to prove the route is gated, not public
+api.requireBuilder = (req, res, next) => {
+  if (!authOk) return res.status(401).json({ error: { code: 'unauthenticated' } });
+  req.builder = { id: 7, github_login: 'owner' };
+  next();
+};
+api.requirePermission = () => (_req, _res, next) => next();
+let brandingDomains = { publicOrigin: 'https://cb.test', instanceBase: 'cloudbongos.com' };
+api.branding = () => ({ domains: brandingDomains, identity: { productName: 'Cloud Bongos' } });
+
+const express = require('express');
+const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
+
+// Each app gets its OWN router — and therefore its own fresh rate-limit bucket, so
+// the limiter test cannot be starved (or starve) the correctness tests.
+function mount() {
+  const app = express();
+  app.use(express.json());
+  app.use((_req, res, next) => {
+    res.fail = (code, opts, details) => {
+      const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+      res.status(status).json({ error: { code, ...(typeof opts === 'object' ? opts : {}), ...(details || {}) } });
+    };
+    next();
+  });
+  app.use('/api/bongos', provisioningRoutes());
+  return app;
+}
+
+const server = mount().listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function get(path, origin = base) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(`${origin}${path}`, { method: 'GET' }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => {
+        let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ }
+        resolve({ status: res.statusCode, body: j, raw: d, headers: res.headers });
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+const heldBy = (ownerId) => ({ id: 41, owner_builder_id: ownerId, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com' });
+
+function reset() {
+  slugHolder = null;
+  lookedUp = [];
+  authOk = true;
+  brandingDomains = { publicOrigin: 'https://cb.test', instanceBase: 'cloudbongos.com' };
+}
+
+// ── the answer, and its agreement with the create route ─────────────────────
+console.log('GET /provisioning/slug-available — the verdict:');
+
+await ta('a free handle → available, with the address create would assign', async () => {
+  reset();
+  const res = await get('/provisioning/slug-available?slug=spike');
+  assert.equal(res.status, 200, res.raw);
+  assert.deepEqual(res.body, { slug: 'spike', available: true, reason: null, address: 'spike.cloudbongos.com' });
+});
+
+await ta("held by ANOTHER builder → taken (the create route's 409 slug_taken)", async () => {
+  reset();
+  slugHolder = heldBy(99);
+  const res = await get('/provisioning/slug-available?slug=spike');
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.available, false);
+  assert.equal(res.body.reason, 'taken');
+});
+
+await ta("held by the CALLER → 'yours', never 'taken' — create re-requests it, it is not a new project", async () => {
+  reset();
+  slugHolder = heldBy(7);
+  const res = await get('/provisioning/slug-available?slug=spike');
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.available, false);
+  assert.equal(res.body.reason, 'yours', 'the caller must not be told a stranger holds it');
+});
+
+await ta('the holder row NEVER travels — only the verdict', async () => {
+  reset();
+  slugHolder = heldBy(99);
+  const res = await get('/provisioning/slug-available?slug=spike');
+  assert.deepEqual(Object.keys(res.body).sort(), ['address', 'available', 'reason', 'slug']);
+  assert.doesNotMatch(res.raw, /owner_builder_id|status|"id"/, 'no instance shape may leak');
+});
+
+await ta("a free row whose <slug>.<apex> is platform-reserved → 'reserved' (create 400s domain_reserved)", async () => {
+  reset();
+  const res = await get('/provisioning/slug-available?slug=www');
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.available, false);
+  assert.equal(res.body.reason, 'reserved');
+  // agrees with the helper the create route itself calls
+  assert.equal(provisioning.isReservedHostname('www.cloudbongos.com', 'cloudbongos.com'), true);
+});
+
+await ta('a taken row wins over reserved — the row is the uniqueness rule', async () => {
+  reset();
+  slugHolder = heldBy(99);
+  const res = await get('/provisioning/slug-available?slug=www');
+  assert.equal(res.body.reason, 'taken');
+});
+
+// ── normalization: the same sequence the create route runs ──────────────────
+console.log('\nnormalization — must match the create route byte for byte:');
+
+await ta('trim + lowercase before the lookup, exactly as create does', async () => {
+  reset();
+  const res = await get('/provisioning/slug-available?slug=%20%20SPIKE%20%20');
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.slug, 'spike', 'the normalized handle is echoed back');
+  assert.deepEqual(lookedUp, ['spike'], 'the UNIQUE index is byte-exact — the lookup must be too');
+});
+
+await ta('an invalid handle → 400 bad_slug, the same bar and reason string as create', async () => {
+  for (const bad of ['a', '-bad', 'bad-', 'do--uble', 'Nope!', '', 'x'.repeat(41)]) {
+    reset();
+    const res = await get(`/provisioning/slug-available?slug=${encodeURIComponent(bad)}`);
+    assert.equal(res.status, 400, `${JSON.stringify(bad)} → ${res.raw}`);
+    assert.equal(res.body.error.code, 'bad_slug');
+    assert.match(res.body.error.reason, /lowercase, 2–40 chars/);
+  }
+});
+
+await ta('a missing slug param → 400 bad_slug, never a lookup', async () => {
+  reset();
+  const res = await get('/provisioning/slug-available');
+  assert.equal(res.status, 400, res.raw);
+  assert.equal(res.body.error.code, 'bad_slug');
+  assert.deepEqual(lookedUp, [], 'nothing may reach the database');
+});
+
+await ta('a blank apex (self-host) still answers availability, with no address to promise', async () => {
+  reset();
+  brandingDomains = { publicOrigin: 'https://cb.test', instanceBase: '' };
+  const res = await get('/provisioning/slug-available?slug=www');
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.address, null, 'nothing to assign → nothing to name');
+  assert.equal(res.body.available, true, 'with no apex there is no reserved address to collide with');
+});
+
+// ── the gate + the throttle ─────────────────────────────────────────────────
+console.log('\nthe gate and the throttle — it is an enumeration oracle:');
+
+await ta('requires a session — this route is NOT public', async () => {
+  reset();
+  authOk = false;
+  const res = await get('/provisioning/slug-available?slug=spike');
+  assert.equal(res.status, 401, res.raw);
+  assert.deepEqual(lookedUp, [], 'an unauthenticated caller learns nothing');
+});
+
+await ta('the limiter keys on the BUILDER, not the IP — one office address cannot starve itself', async () => {
+  reset();
+  const RL = require('../modules/provisioning/rate-limit.js');
+  // default key is still the IP (the public tls-check/status limiters depend on it)
+  assert.equal(RL.clientIp({ ip: '203.0.113.7' }), '203.0.113.7');
+  const seen = [];
+  const limiter = RL.makeAskRateLimiter({ max: 1, key: (req) => `b:${req.builder.id}` });
+  const runFor = (id) => new Promise((resolve) => {
+    const res = { set() {}, status(c) { this._c = c; return this; }, json(b) { resolve({ status: this._c, body: b }); } };
+    limiter({ ip: '203.0.113.7', builder: { id } }, res, () => { seen.push(id); resolve({ status: 200 }); });
+  });
+  assert.equal((await runFor(7)).status, 200, 'builder 7 gets its first call');
+  assert.equal((await runFor(7)).status, 429, 'and is throttled on its second');
+  assert.equal((await runFor(8)).status, 200,
+    'a DIFFERENT builder on the same IP still gets through — the bucket is per-builder');
+  assert.deepEqual(seen, [7, 8]);
+});
+
+await ta('rate-limited — a crawler is shed with 429 + Retry-After', async () => {
+  reset();
+  const rlServer = mount().listen(0);
+  await new Promise((r) => rlServer.once('listening', r));
+  const rlBase = `http://127.0.0.1:${rlServer.address().port}/api/bongos`;
+  try {
+    let limited = null;
+    // the limiter's cap is 30/min/IP; walk past it and the next answer must be 429
+    for (let i = 0; i < 40 && !limited; i++) {
+      const res = await get(`/provisioning/slug-available?slug=spike${i}`, rlBase);
+      if (res.status === 429) limited = res;
+    }
+    assert.ok(limited, 'the route must stop answering under a flood');
+    assert.equal(limited.body.error, 'rate_limited');
+    assert.ok(Number(limited.headers['retry-after']) > 0, 'Retry-After must tell the caller when');
+  } finally {
+    rlServer.close();
+  }
+});
+
+server.close();
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);