@bongos/core 1.19.400 → 1.19.402

package/tests/landing_page.mjs

@@ -475,14 +475,17 @@ test('the bar is markup: the mark, the Projects trigger, the mode glyph, the sig
   assert.match(PAGE_CSS, /\.topbar\{position:relative;z-index:50;height:var\(--top-h\);display:flex;align-items:center;gap:22px;\s*padding:0 26px;background:var\(--bg\);border-bottom:1px solid var\(--rule\)\}/, 'the page ground closed by one hairline, z-index unified with the hub');
 });
 
-test('the Projects band deep-links the hub\'s views; About and Docs sit under a hairline; no item is current here', () => {
+test('the Projects band deep-links the hub\'s views; About and Docs are footer links, not band items; no item is current here', () => {
   const body = HTML.split('<body>')[1].split('<script>')[0];
   assert.match(body, /<div class="menuBand" id="menuProjects" data-menu="projects" hidden>/);
   assert.match(body, /<a class="bandT" href="\/projects\?view=map">Sky<\/a>/);
   assert.match(body, /<a class="bandT" href="\/projects\?view=map&amp;sub=table">Table<\/a>/, 'the Table item lands on the table (the hub reads sub=table on boot)');
   assert.match(body, /<li class="bandCell" id="mineCell" hidden><a class="bandT" href="\/projects\?view=mine">Your projects<\/a>/, 'member-gated: hidden until the session resolves');
   assert.match(body, /<a class="bandT" href="\/projects\?view=new">New project<\/a>/);
-  assert.match(body, /<ul class="bandRow bandMore">\s*<li class="bandCell"><a class="bandT" href="#about">About<\/a><\/li>\s*<li class="bandCell"><a class="bandT" href="\/docs">Docs<\/a><\/li>/, 'About and Docs under the hairline (§5)');
+  // About and Docs are site pages, not project views (owner, 2026-08-28; task 1003332):
+  // they left the band for the footer row, beside Privacy / Terms / Contact
+  assert.doesNotMatch(body, /bandMore|<a class="bandT" href="#about">|<a class="bandT" href="\/docs">/, 'About and Docs are not in the Projects band');
+  assert.match(body, /<a href="#about">About<\/a>\s*<a href="\/docs">Docs<\/a>\s*<a href="\/privacy">Privacy<\/a>/, 'About and Docs open the footer row');
   assert.match(body, /<section class="band" id="about">/, 'About has a real anchor: the lifecycle band');
   assert.doesNotMatch(body.split('<main')[0], /aria-current/, 'the landing is none of those views');
   // the profile band: the person, My projects, the deferred slot, Sign out as the honest anchor
@@ -496,9 +499,10 @@ test('the Projects band deep-links the hub\'s views; About and Docs sit under a
     assert.ok(body.includes('>' + copy + '<'), `"${copy}" is only reachable with scripting on`);
   }
   // the menu container is .menuBand: .band is this page's own content sections
-  assert.match(PAGE_CSS, /\.menuBand\{position:relative;z-index:49;background:var\(--bg-card\);border-bottom:1px solid var\(--rule\);/);
+  // the bands OVERLAY the page (task 1003332): absolute at the bar's height, so the hero never reflows
+  assert.match(PAGE_CSS, /\.menuBand\{position:absolute;left:0;right:0;top:var\(--top-h\);z-index:49;background:var\(--bg-card\);border-bottom:1px solid var\(--rule\);/);
   assert.doesNotMatch(PAGE_CSS, /\.band\{[^}]*animation:bandIn/, 'the menu rule never lands on the content bands');
-  assert.match(PAGE_CSS, /\.bandMore \.bandT\{font-size:17px;font-weight:400;min-height:24px;display:inline-flex;align-items:center\}/, 'the About/Docs links clear the 24px floor');
+  assert.doesNotMatch(PAGE_CSS, /\.bandMore/, 'the About/Docs rung left the sheet with the markup');
 });
 
 test('the bands are one disclosure: Escape returns focus, arrows cycle, Tab out closes, one closes the other', () => {

package/tests/projects_hub.mjs

@@ -49,7 +49,14 @@ test('the Projects band carries the views; Home is gone and the mark is the way
   assert.match(HUB, /href="\?view=map" data-nav="map" data-sub="sky" aria-current="page">Sky<\/a>/);
   assert.match(HUB, /href="\?view=map&amp;sub=table" data-nav="map" data-sub="table">Table<\/a>/);
   assert.match(SCRIPT, /get\('sub'\) === 'table'\) setSub\('table'\);/, 'the Table deep link lands on the table');
-  assert.match(HUB, /<a class="bandT" href="\/#about">About<\/a>/, 'About sits under the hairline (§5)');
+  // setView rewrites the URL to ?view=<v>; the boot query must be captured BEFORE it
+  // runs or sub=table is gone by the time it is read (task 1003332)
+  assert.match(SCRIPT, /var bootQ = new URLSearchParams\(location\.search\);\s*setView\(viewFromUrl\(\)\);[\s\S]{0,400}?if \(bootQ\.get\('sub'\) === 'table'\) setSub\('table'\);/, 'the boot query is read once, before setView');
+  // About and Docs are site pages, not project views (owner, 2026-08-28; task 1003332):
+  // they left the band for the footer row, beside Privacy / Terms / Contact
+  assert.doesNotMatch(HUB, /bandMore|<a class="bandT" href="\/#about">|<a class="bandT" href="\/docs">/, 'About and Docs are not in the Projects band');
+  assert.match(HUB, /<nav class="footNav" aria-label="Site"><a href="\/#about">About<\/a><a href="\/docs">Docs<\/a><a href="\/privacy">Privacy<\/a>/, 'About and Docs open the footer row');
+  assert.doesNotMatch(COSMOS, /\.bandMore/, 'the About/Docs rung left cosmos with the markup');
   assert.doesNotMatch(HUB, /id="sub-sky"|id="sub-table"|class="toolbar"|class="seg"/, 'the toolbar and its seg are retired');
   assert.doesNotMatch(SCRIPT, /dataset\.nav === 'home'/, 'no dead Home branch in the router');
   assert.match(SCRIPT, /if \(a\.dataset\.sub\) setSub\(a\.dataset\.sub\);/, 'a band item may pick the map sub-view');
@@ -138,6 +145,10 @@ test('the bands: one disclosure, two instances — Escape returns focus, the car
   assert.match(HUB, /<div class="menuBand" id="menuProjects" data-menu="projects" hidden>/);
   assert.match(HUB, /<div class="menuBand" id="menuProfile" data-menu="profile" hidden>/);
   assert.doesNotMatch(HUB, /role="menu"|aria-haspopup/, 'plain links in a disclosure — announced as what ships');
+  // the bands OVERLAY the page (owner, 2026-08-28; task 1003332): absolute against the
+  // document at the bar's height, so opening one never reflows the sky, the table or the footer
+  assert.match(COSMOS, /\.menuBand\{position:absolute;left:0;right:0;top:var\(--top-h\);z-index:49;background:var\(--bg-card\);border-bottom:1px solid var\(--rule\);/, 'a band is a layer under the bar, never a push');
+  assert.doesNotMatch(COSMOS, /PUSHES the page/, 'the sheet no longer describes the push-down');
   assert.match(SCRIPT, /function closeMenus\(\) \{[\s\S]*?if \(inside && trig\) trig\.focus\(\);/, 'focus restoration is a property of the close, not of one caller');
   assert.match(SCRIPT, /if \(ev\.key === 'Escape' && !openBand\(\)\) closeCard\(\);/, 'the card yields Escape to an open band');
   assert.match(SCRIPT, /function setView\(v, focus\) \{[\s\S]*?\$\('qWrap'\)\.hidden = \$\('qToggle'\)\.hidden = \(v !== 'map'\);/, 'the search hides off the map in the router');
@@ -525,6 +536,22 @@ test('no sort control is offered for a column that cannot sort', () => {
   }
 });
 
+test('the table is in the world: a masthead, then ledger rows — no panel, no shadow, the accent only on the row\'s door (task 1003332)', () => {
+  // the owner's pick from three rendered treatments: the view title in the display
+  // voice and one chrome object; the title is two words ("every project", the owner cut ", as rows")
+  assert.match(HUB, /<div class="tblMast">\s*<h2 class="tblTitle">every project<\/h2>\s*<span class="mastObj" aria-hidden="true"><\/span>\s*<\/div>\s*<table class="tbl">/, 'one masthead ahead of the table');
+  assert.doesNotMatch(HUB, /tblMast--t[123]|data-tbl|mastCallouts|mastField/, 'the render round\'s switch and the unpicked mastheads left with the pick');
+  assert.match(COSMOS, /\.tbl\{width:100%;border-collapse:collapse;background:none;\}/, 'the rows sit on the page ground — no card');
+  assert.doesNotMatch((COSMOS.match(/\.tbl\{[^}]*\}/) || [''])[0], /border-radius|box-shadow/, 'no radius, no shadow on the table');
+  assert.match(COSMOS, /\.tbl td\{padding:17px 14px;border-bottom:1px solid var\(--rule-soft\);/, 'ledger rows: hairlines');
+  assert.match(COSMOS, /\.tbl tbody tr:hover td\{border-bottom-color:var\(--ink-faint\);\}/, 'hover is the hairline taking ink, not an accent tint');
+  assert.match(COSMOS, /\.rowGo\{[^}]*color:var\(--accent-deep\);text-decoration:underline;/, 'the row\'s door is accent text');
+  assert.match(HUB, /<a class="rowGo" href="\/">Open →<\/a>/, 'the self row\'s door');
+  assert.match(SCRIPT, /'<a class="rowGo" href="' \+ esc\(safeHttpUrl\(p\.origin\)\)/, 'the generated rows\' door');
+  assert.match(COSMOS, /\.mastObj\{display:block;--dia:clamp\(96px,10vw,132px\);[^}]*background-image:var\(--plate-set-cut\);/, 'the object is the set\'s small bead by token, in both modes');
+  assert.doesNotMatch(COSMOS, /mix-blend-mode:var\(--mast/, 'the cutout needs no blend — the view wrap is a stacking context');
+});
+
 test('every live column keeps its styling — .colType included since task 1002772', () => {
   for (const live of ['.tbl .num', '.tbl .tags', '.colTags', '.colType', '.typeTag']) {
     assert.ok(COSMOS.includes(live), `${live} styles a column that renders real data`);

package/tests/projects_hub_pre_uat.mjs

@@ -335,11 +335,37 @@ test('the F19 re-kick door survives the fold: open, pre-filled, one button', ()
   const fold = fn('attachFold');
   assert.match(fold, /var rekick = inst\.status === 'active' && inst\.domain && inst\.error_note;/);
   assert.match(fold, /\(rekick \? ' open' : ''\)/, 'the fold opens on its own for a stalled address');
-  assert.match(fold, /\(rekick \? ' value="' \+ esc\(inst\.domain\) \+ '"' : ''\)/, 'pre-filled with the address that stalled');
-  assert.match(fold, /rekick \? 'Try the address again' : 'Use this domain'/, 'and the button says what it does');
+  assert.match(fold, /\(prefill \? ' value="' \+ esc\(inst\.domain\) \+ '"' : ''\)/, 'pre-filled with the address in play');
+  assert.match(fold, /var prefill = rekick \|\| repoint;/, 'a stalled address and a correctable one both arrive in the field');
+  assert.match(fold, /rekick \? 'Try the address again' : repoint \? 'Change the address' : 'Use this domain'/, 'and the button says what it does');
   assert.match(fn('canAttachDomain'), /inst\.status === 'active' && inst\.domain && inst\.error_note && !inst\.open_intent\) return true;/, 'the route-side re-kick gate is untouched');
 });
 
+test('the correction door: a bring-your-own address can be changed, and the fold says what that costs (task 1003237)', () => {
+  const fold = fn('attachFold');
+  // the three doors are told apart by what the project is actually addressed as
+  assert.match(fold, /var byo = inst\.domain && inst\.domain !== assignedDefaultFor\(inst\);/,
+    'the platform-assigned <slug>.<apex> is NOT a correction — moving off it is the upgrade the fold already offered');
+  assert.match(fold, /var repoint = !rekick && byo;/, 'a stalled address keeps the F19 door, which is louder');
+  assert.match(fold, /'Use a different domain'/, 'the summary names the correction');
+  assert.match(fold, /attachNote/, 'and the consequence is stated where the button is');
+  assert.match(fold, /won’t use that address any more/, 'letting the old address go is SAID, not discovered');
+  // the door itself: an addressed, live project is no longer excluded
+  const gate = fn('canAttachDomain');
+  assert.doesNotMatch(gate, /!inst\.domain \|\| inst\.domain === assignedDefaultFor\(inst\)/,
+    'the "only a domainless or platform-addressed project may attach" clause is what the re-point removes');
+  assert.match(gate, /inst\.status === 'requested' \|\| inst\.status === 'error' \|\| inst\.status === 'active'/,
+    'state is still the gate — a mid-flight or torn-down project has nothing to point a domain at');
+  assert.match(COSMOS, /\.attachNote\{/, 'the note is styled');
+  assert.doesNotMatch((COSMOS.match(/\.attachNote[^\n]*/g) || []).join('\n'), /#[0-9a-f]{3,8}\b/i,
+    'and paints from tokens, so dark mode needs no twin');
+});
+
+test('the retired refusal is gone from the card: domain_already_set can no longer be returned', () => {
+  assert.doesNotMatch(HUB, /domain_already_set/,
+    'the server stopped sending it (task 1003237) — a branch for it would be unreachable copy');
+});
+
 test('a heartbeat re-render keeps an open fold open and a half-typed domain typed', () => {
   const card = fn('renderCard');
   assert.match(card, /var keepOpen = !!\(oldFold && oldFold\.open\);/);

package/tests/provision.mjs

@@ -965,18 +965,21 @@ console.log('\nDNS UPSERT composition (P4, CONFIG override):');
 
 // A recorder that also captures each exec's env (so we can assert the DNS hook env).
 function dnsRecorder({ apply = false } = {}) {
-  const cmds = [], envs = [];
+  const cmds = [], envs = [], cleared = [];
   const deps = {
     apply, log: () => {},
     db: { query: async () => ({ rows: [] }) },
-    provisioning: { setInstanceStatus: async () => {}, recordEvent: async () => {} },
+    provisioning: {
+      setInstanceStatus: async () => {}, recordEvent: async () => {},
+      clearReleasedDomains: async (_db, id) => { cleared.push(id); },
+    },
     exec: (cmd, opts) => { cmds.push(cmd); envs.push(opts && opts.env); return { ok: true, stdout: '' }; },
     writeFile: () => ({ ok: true }), doApi: null,
     // Preflight (task 1980) stubbed reachable so --apply DNS tests reach the step-5
     // behavior they assert (the preflight itself is covered by its own test below).
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
   };
-  return { deps, cmds, envs };
+  return { deps, cmds, envs, cleared };
 }
 
 await ta('a co-tenant WITH a domain UPSERTs DNS: the hook is invoked BY PATH with the control-plane env (proxied=false)', async () => {
@@ -1008,6 +1011,40 @@ await ta('--apply THROWS if a domain has no target IP (task-1180: never report s
   } finally { P.CONFIG.publicIp = savedIp; P.CONFIG.dnsHook = savedHook; }
 });
 
+await ta('the PROVISION run drains the release queue too — a re-point on a pre-active project never reaches the attach leg (task 1003237)', async () => {
+  const savedIp = P.CONFIG.publicIp, savedHook = P.CONFIG.dnsHook;
+  P.CONFIG.publicIp = '203.0.113.5';
+  P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh';
+  try {
+    // an `error` row is frequently a PARTIAL standup (ADR 0181 §1): it may already
+    // have UPSERTed the address it is now leaving, and domainAttachInstance no-ops
+    // for anything but 'active', so this run is the only one that can let it go
+    const { deps, cmds, envs, cleared } = dnsRecorder({ apply: true });
+    await P.provisionInstance(
+      { ...coTenant, domain: 'right.example.com', released_domains: ['typo.example.com'] }, deps);
+    const hooks = cmds.map((c, i) => i).filter((i) => cmds[i] === '/opt/infra/box-dns-cloudflare.sh');
+    assert.equal(hooks.length, 2, 'one UPSERT for the new address, one RELEASE for the old');
+    assert.equal(envs[hooks[0]].BOX_HOSTNAME, 'right.example.com');
+    assert.equal(envs[hooks[0]].BOX_IP, '203.0.113.5');
+    assert.equal(envs[hooks[1]].BOX_HOSTNAME, 'typo.example.com');
+    assert.equal(envs[hooks[1]].BOX_IP, '192.0.2.1', 'parked at the blackhole, not left pointing here');
+    assert.deepEqual(cleared, [coTenant.id], 'and the queue is drained');
+  } finally { P.CONFIG.publicIp = savedIp; P.CONFIG.dnsHook = savedHook; }
+});
+
+await ta('a provision with an EMPTY release queue never invokes the hook twice', async () => {
+  const savedIp = P.CONFIG.publicIp, savedHook = P.CONFIG.dnsHook;
+  P.CONFIG.publicIp = '203.0.113.5';
+  P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh';
+  try {
+    const { deps, cmds, cleared } = dnsRecorder({ apply: true });
+    await P.provisionInstance({ ...coTenant, domain: 'right.example.com' }, deps);
+    assert.equal(cmds.filter((c) => c === '/opt/infra/box-dns-cloudflare.sh').length, 1,
+      'the ordinary standup is unchanged — no release, no extra call');
+    assert.deepEqual(cleared, [], 'and an empty queue is never "drained"');
+  } finally { P.CONFIG.publicIp = savedIp; P.CONFIG.dnsHook = savedHook; }
+});
+
 await ta('no domain → DNS is skipped even with a hook + IP configured', async () => {
   const savedIp = P.CONFIG.publicIp, savedHook = P.CONFIG.dnsHook;
   P.CONFIG.publicIp = '203.0.113.5';
@@ -1698,21 +1735,45 @@ console.log('\ndomain-attach leg (task 1002692 — give an ACTIVE instance its l
 // Recorder for the attach leg: captures commands (with env), file writes (with
 // bodies), and recorded events. No status writes to capture — domain-attach must
 // never touch the instance lifecycle.
-function attachRecorder({ apply = false } = {}) {
-  const cmds = [], envs = [], writes = [], events = [], dnsNotes = [];
+// `envBody` is what a `cat <web.env>` returns — the attach leg patches the origin
+// lines IN PLACE (task 1003237), so a test that cares about the write has to hand
+// it a file to patch. Default: the shape a manifest-onboarded instance really has
+// — creds and a federation block the ROW does not know, which a template re-write
+// would blank (ADR 0190 §2 / idea 1000842). Values are obvious fixtures.
+const WEB_ENV_ON_BOX = [
+  'PORT=3010',
+  'PGDATABASE=spike',
+  `${NEUTRAL_PREFIX}_PUBLIC_ORIGIN=https://old.example.com`,
+  `${NEUTRAL_PREFIX}_BUILDERS_ORIGIN=https://old.example.com`,
+  `${NEUTRAL_PREFIX}_OAUTH_CLIENT_ID=Iv1.fixture-client-id`,
+  `${NEUTRAL_PREFIX}_OAUTH_CLIENT_SECRET=fixture-secret-placed-by-the-manifest-flow`,
+  'GITHUB_APP_PRIVATE_KEY=fixture-pem-flattened-to-one-line',
+  `${NEUTRAL_PREFIX}_HUB_CLIENT_SECRET=fixture-federation-secret`,
+  '',
+].join('\n');
+
+function attachRecorder({ apply = false, envBody = WEB_ENV_ON_BOX } = {}) {
+  const cmds = [], envs = [], writes = [], events = [], dnsNotes = [], cleared = [];
   const deps = {
     apply, log: () => {},
     db: { query: async () => ({ rows: [] }) },
     provisioning: {
       recordEvent: async (_db, e) => { events.push(e); },
       recordDnsNote: async (_db, id, note) => { dnsNotes.push({ id, note }); },
+      clearReleasedDomains: async (_db, id) => { cleared.push(id); },
+    },
+    exec: (cmd, opts = {}) => {
+      cmds.push(cmd); envs.push((opts && opts.env) || null);
+      if (/\bcat\b.*web\.env/.test(cmd)) {
+        return envBody === null ? { ok: false, softFailed: true, stdout: '' } : { ok: true, stdout: envBody };
+      }
+      return { ok: true, stdout: '' };
     },
-    exec: (cmd, opts = {}) => { cmds.push(cmd); envs.push((opts && opts.env) || null); return { ok: true, stdout: '' }; },
     writeFile: (p, body) => { writes.push({ path: p, body }); return { ok: true }; },
     doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
   };
-  return { deps, cmds, envs, writes, events, dnsNotes };
+  return { deps, cmds, envs, writes, events, dnsNotes, cleared };
 }
 
 const activeStandalone = {
@@ -1720,17 +1781,19 @@ const activeStandalone = {
   port: 3010, db_name: 'spike', domain: 'spike.cloudbongos.com', target_ref: 'jaxri/spike-harbor',
 };
 
-await ta('domainAttachInstance(active standalone): env re-write → restart → DNS upsert → caddy → healthz', async () => {
+await ta('domainAttachInstance(active standalone, --apply): env patch → restart → DNS upsert → caddy → healthz', async () => {
   const savedPub = P.CONFIG.publicIp, savedHook = P.CONFIG.dnsHook;
   P.CONFIG.publicIp = '203.0.113.5';
   P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh';
   try {
-    const { deps, cmds, envs, writes } = attachRecorder();
+    const { deps, cmds, envs, writes } = attachRecorder({ apply: true });
     const r = await P.domainAttachInstance(activeStandalone, deps);
     assert.equal(r.ok, true);
     const env = writes.find((w) => /\/spike\/web\.env$/.test(w.path));
-    assert.ok(env, 're-writes web.env');
-    assert.match(env.body, /https:\/\/spike\.cloudbongos\.com/, 'the new address reaches the origins');
+    assert.ok(env, 'writes web.env');
+    assert.match(env.body, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_PUBLIC_ORIGIN=https://spike\\.cloudbongos\\.com`),
+      'the new address reaches the origins');
+    assert.doesNotMatch(env.body, /old\.example\.com/, 'the stale origins are replaced, not appended');
     const joined = cmds.join('\n');
     assert.match(joined, /systemctl restart spike/, 'RESTART (not reload) so the process re-reads its env');
     const di = cmds.indexOf('/opt/infra/box-dns-cloudflare.sh');
@@ -1745,6 +1808,113 @@ await ta('domainAttachInstance(active standalone): env re-write → restart →
   } finally { P.CONFIG.publicIp = savedPub; P.CONFIG.dnsHook = savedHook; }
 });
 
+// -- the web.env hazard this leg used to carry (task 1003237, idea 1000842) -----
+// domainAttachInstance re-wrote web.env from the TEMPLATE (webEnvBody), which
+// regenerates the file FROM THE ROW — and the row knows neither the OAuth creds
+// placeManifestCreds fetched, nor the App private key, nor the federation block.
+// A first attach was masked by wizard order (address first, GitHub App second).
+// A RE-POINT is not masked: it runs on a project the founder is already signed
+// in to, so the same move would break sign-in on the project they just corrected.
+
+await ta('domainAttachInstance(--apply): patches ONLY the origin lines — creds, App key and federation survive', async () => {
+  const savedHook = P.CONFIG.dnsHook; P.CONFIG.dnsHook = '';
+  try {
+    const { deps, writes } = attachRecorder({ apply: true });
+    const r = await P.domainAttachInstance(activeStandalone, deps);
+    assert.equal(r.ok, true);
+    const env = writes.find((w) => /\/spike\/web\.env$/.test(w.path));
+    const P_ = reEsc(NEUTRAL_PREFIX);
+    assert.match(env.body, new RegExp(`${P_}_OAUTH_CLIENT_ID=Iv1\\.fixture-client-id`), 'the manifest-placed client id survives');
+    assert.match(env.body, new RegExp(`${P_}_OAUTH_CLIENT_SECRET=fixture-secret-placed-by-the-manifest-flow`), 'the client secret survives');
+    assert.match(env.body, /GITHUB_APP_PRIVATE_KEY=fixture-pem-flattened-to-one-line/, 'the App private key survives');
+    assert.match(env.body, new RegExp(`${P_}_HUB_CLIENT_SECRET=fixture-federation-secret`), 'the federation block survives');
+    assert.match(env.body, /^PORT=3010$/m, 'and every unrelated line is untouched');
+    assert.match(env.body, new RegExp(`${P_}_STATUS_ORIGIN=https://spike\\.cloudbongos\\.com`), 'a missing origin line is APPENDED');
+  } finally { P.CONFIG.dnsHook = savedHook; }
+});
+
+await ta('domainAttachInstance(--apply): an unreadable web.env is REFUSED, never "patched" over', async () => {
+  const { deps, writes } = attachRecorder({ apply: true, envBody: null });
+  const r = await P.domainAttachInstance(activeStandalone, deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /cannot read/i);
+  assert.equal(writes.length, 0, 'four origins over a missing PORT/PGDATABASE would take the instance down');
+});
+
+await ta('domainAttachInstance(dry-run): PLANS the patch — nothing is written', async () => {
+  const { deps, writes } = attachRecorder();
+  const r = await P.domainAttachInstance(activeStandalone, deps);
+  assert.equal(r.ok, true);
+  assert.ok(!writes.some((w) => /web\.env$/.test(w.path)), 'a dry run must not write a synthetic body');
+});
+
+// -- releasing what a re-point moved off (task 1003237, ADR 0200) --------------
+
+await ta('releasableDomains: the queue, minus the address the instance is CURRENTLY on', () => {
+  assert.deepEqual(P.releasableDomains({ domain: 'right.example.com', released_domains: ['TYPO.example.com'] }),
+    ['typo.example.com'], 'normalized, so a case difference can never dodge the release');
+  assert.deepEqual(P.releasableDomains({ domain: 'right.example.com', released_domains: ['right.example.com'] }),
+    [], 'a row that somehow queued its own domain can never blackhole a live project');
+  assert.deepEqual(P.releasableDomains({ domain: 'x.example.com' }), [], 'no queue is not a crash');
+  assert.deepEqual(P.releasableDomains({ domain: 'x.example.com', released_domains: ['a.example.com', '', 'b.example.com'] }),
+    ['a.example.com', 'b.example.com'], 'every abandoned address is released, not just the last');
+});
+
+await ta('domainAttachInstance(--apply): a re-point parks the old address at the blackhole, AFTER wiring the new one', async () => {
+  const savedPub = P.CONFIG.publicIp, savedHook = P.CONFIG.dnsHook;
+  P.CONFIG.publicIp = '203.0.113.5';
+  P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh';
+  try {
+    const { deps, cmds, envs, cleared } = attachRecorder({ apply: true });
+    const r = await P.domainAttachInstance({ ...activeStandalone, released_domains: ['typo.example.com'] }, deps);
+    assert.equal(r.ok, true);
+    const hooks = cmds.map((c, i) => i).filter((i) => cmds[i] === '/opt/infra/box-dns-cloudflare.sh');
+    assert.equal(hooks.length, 2, 'one UPSERT for the new address, one RELEASE for the old');
+    assert.equal(envs[hooks[0]].BOX_HOSTNAME, 'spike.cloudbongos.com');
+    assert.equal(envs[hooks[0]].BOX_IP, '203.0.113.5', 'the new address is wired first');
+    assert.equal(envs[hooks[1]].BOX_HOSTNAME, 'typo.example.com');
+    assert.equal(envs[hooks[1]].BOX_IP, '192.0.2.1', 'RFC 5737 TEST-NET-1 — guaranteed never routable');
+    assert.equal(envs[hooks[1]].BOX_PROXIED, '0', 'a parked record must never ride the CF edge');
+    assert.equal(envs[hooks[1]].CLOUDFLARE_ZONE, 'example.com', 'the zone is derived from the OLD host, not the row');
+    const caddy = cmds.findIndex((c) => /reload caddy/.test(c));
+    assert.ok(caddy >= 0 && caddy < hooks[1], 'the old vhost is gone before its record is parked');
+    assert.deepEqual(cleared, [18], 'the queue is drained only once every address on it was released');
+  } finally { P.CONFIG.publicIp = savedPub; P.CONFIG.dnsHook = savedHook; }
+});
+
+await ta('domainAttachInstance(--apply): a release the hook REFUSES keeps the queue — ok:true, the re-point still stands', async () => {
+  const savedPub = P.CONFIG.publicIp, savedHook = P.CONFIG.dnsHook;
+  P.CONFIG.publicIp = '203.0.113.5';
+  P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh';
+  try {
+    const { deps, cleared } = attachRecorder({ apply: true });
+    let seen = 0;
+    const inner = deps.exec;
+    deps.exec = (cmd, opts) => {
+      if (cmd === '/opt/infra/box-dns-cloudflare.sh' && ++seen === 2) throw new Error('cloudflare said no');
+      return inner(cmd, opts);
+    };
+    const r = await P.domainAttachInstance({ ...activeStandalone, released_domains: ['typo.example.com'] }, deps);
+    assert.equal(r.ok, true, 'a failed release must never fail a re-point that already landed');
+    assert.equal(r.releaseFailed, 'typo.example.com');
+    assert.deepEqual(cleared, [], 'the queue survives, so the next attach retries the release');
+  } finally { P.CONFIG.publicIp = savedPub; P.CONFIG.dnsHook = savedHook; }
+});
+
+await ta('domainAttachInstance(--apply): no DNS hook → the release is named for the operator, and the queue is kept', async () => {
+  const savedHook = P.CONFIG.dnsHook; P.CONFIG.dnsHook = '';
+  try {
+    const lines = [];
+    const { deps, cleared } = attachRecorder({ apply: true });
+    deps.log = (m) => lines.push(String(m));
+    const r = await P.domainAttachInstance({ ...activeStandalone, released_domains: ['typo.example.com'] }, deps);
+    assert.equal(r.ok, true);
+    assert.ok(lines.some((l) => /typo\.example\.com/.test(l) && /BOX_DNS_HOOK unset/.test(l)),
+      'the outstanding manual step is SAID, not swallowed');
+    assert.deepEqual(cleared, [], 'nothing was released, so nothing is marked released');
+  } finally { P.CONFIG.dnsHook = savedHook; }
+});
+
 await ta('domainAttachInstance: no domain recorded → ok:false, nothing runs', async () => {
   const { deps, cmds } = attachRecorder();
   const r = await P.domainAttachInstance({ ...activeStandalone, domain: null }, deps);
@@ -1797,7 +1967,10 @@ await ta('cmdRunIntents (--apply) routes a domain-attach intent to the attach le
       claimNextOAuthManifest: async () => null,
       resolveOAuthManifest: async () => {},
     },
-    exec: () => ({ ok: true }), writeFile: () => ({ ok: true }), doApi: null,
+    // the attach leg patches web.env IN PLACE, so a `cat` must return a real file
+    // — an empty one is a deliberate refusal (task 1003237)
+    exec: (cmd) => ({ ok: true, stdout: /\bcat\b.*web\.env/.test(String(cmd)) ? 'PORT=3010\n' : '' }),
+    writeFile: () => ({ ok: true }), doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
   };
   const r = await P.cmdRunIntents(deps);

package/tests/provisioning_default_domain.mjs

@@ -318,12 +318,14 @@ await ta('re-pointing AWAY from the platform-assigned address → recorded + dom
   assert.deepEqual(enqueueCalls.map((c) => c.action), ['domain-attach']);
 });
 
-await ta('a genuine bring-your-own address still refuses to re-point (unchanged)', async () => {
+await ta('a genuine bring-your-own address RE-POINTS, and the one it leaves is queued for release (task 1003237)', async () => {
   reset();
   provisioning.getInstanceById = async (_db, id) => freshRow({ id, domain: 'spike.example.com', status: 'active' });
   const res = await post('/provisioning/instances/41/domain', { domain: 'another.example.com' });
-  assert.equal(res.status, 409, res.raw);
-  assert.equal(res.body.error.code, 'domain_already_set');
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.domain, 'another.example.com');
+  assert.equal(res.body.replaced, 'spike.example.com',
+    'the owner decision of 2026-08-28: a mistyped BYO address is correctable, and the old one is let go');
 });
 
 server.close();