@bongos/core 1.19.401 → 1.19.402

package/modules/provisioning/routes/provisioning.js

@@ -265,6 +265,17 @@ module.exports = function provisioningRoutes() {
     max: 30,
     key: (req) => (req.builder ? `b:${req.builder.id}` : clientIp(req)),
   });
+  // Limiter for the domain attach/re-point write (task 1003237). Signed-in and
+  // own-scoped, but since a re-point became possible each call can queue an
+  // address the RUNNER later releases with a call against the SHARED control-plane
+  // Cloudflare token — so an unthrottled owner can spend a platform-wide budget,
+  // not merely their own. Keyed on the BUILDER for the same reason as the slug
+  // check: per-IP would starve co-located builders while an attacker rotates IPs.
+  // A founder gives a project an address, or corrects it, a handful of times ever.
+  const domainWriteRateLimit = makeAskRateLimiter({
+    max: 10,
+    key: (req) => (req.builder ? `b:${req.builder.id}` : clientIp(req)),
+  });
 
   // Route ORDER is deliberate (the box.js precedent): the Archon-gated routes are
   // declared FIRST, then the any-builder routes. The route-rank auditor
@@ -859,9 +870,11 @@ module.exports = function provisioningRoutes() {
   // Validates + records the domain; for an already-ACTIVE instance it also enqueues
   // a 'domain-attach' intent the control-plane runner drains (web tier holds no
   // cloud tokens — ADR 0111 §2). A requested/error instance only records it: the
-  // (re)provision run wires the domain itself. Re-pointing an existing address is
-  // out of scope — refuse truthfully. Body: { domain (required) }.
-  router.post('/provisioning/instances/:id/domain', auth.requireBuilder, async (req, res) => {
+  // (re)provision run wires the domain itself. A bring-your-own address may be
+  // RE-POINTED (task 1003237, ADR 0200): the same guards the first attach applies
+  // decide it, and the address it moved off is queued for release.
+  // Body: { domain (required) }.
+  router.post('/provisioning/instances/:id/domain', auth.requireBuilder, domainWriteRateLimit, async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     if (validateOrRespond(req, res, { domain: { required: true, type: 'string', maxLength: 253 } })) return;
@@ -919,15 +932,20 @@ module.exports = function provisioningRoutes() {
         return res.json({ ok: true, changed: false, queued: false, domain: inst.domain,
           message: 'This instance already has that address.' });
       }
-      // A platform-ASSIGNED address may be upgraded away to a bring-your-own
-      // domain — that upgrade path is half the task-1002704 decision (the old
-      // record lingers in DNS, the idea-1000710 class). A genuine BYO address
-      // stays un-re-pointable, as before.
-      if (current && current !== assignedDefault) {
-        return res.fail('domain_already_set', { status: 409,
-          message: `This instance is already addressed as '${inst.domain}' — re-pointing an existing address is not supported here.`,
-          details: { current: inst.domain } });
-      }
+      // A mistyped bring-your-own address can be CORRECTED (task 1003237, owner
+      // decision 2026-08-28 / ADR 0200): the address is the founder's, and the
+      // guards above — reserved, in-apex squat — plus the uniqueness check below
+      // are exactly the ones the first attach applied, so a re-point needs no
+      // weaker rule and gets no stronger one. The address it moves OFF is queued
+      // for release (`releasing`): leaving a hostname UPSERTed at platform infra
+      // for a project that no longer answers there is the leak ADR 0181 §2 named.
+      // Only a BYO address is released, and only from a state that actually STOOD
+      // UP: a platform-ASSIGNED <slug>.<apex> is the platform's own name for this
+      // slug and the revive path re-uses it (ADR 0181 §2), while a 'requested'
+      // instance never had an A record written for the address it is leaving —
+      // parking that name would CREATE a junk record rather than release one.
+      const releasing = current && current !== assignedDefault
+        && provisioning.DOMAIN_RELEASE_FROM.has(inst.status) ? current : null;
       const holder = await provisioning.getInstanceByDomain(pool, domain);
       if (holder && String(holder.id) !== String(inst.id)) {
         return res.fail('domain_taken', { status: 409, message: 'That address is already in use by another instance.' });
@@ -938,8 +956,9 @@ module.exports = function provisioningRoutes() {
           details: { status: inst.status } });
       }
       // Record BEFORE enqueueing: the runner reads the row's domain, so the intent
-      // must never race ahead of the column it wires.
-      await provisioning.updateInstanceDomain(pool, id, domain);
+      // must never race ahead of the column it wires. The release queue rides the
+      // SAME statement — see updateInstanceDomain.
+      await provisioning.updateInstanceDomain(pool, id, domain, releasing);
       let queued = false;
       if (inst.status === 'active') {
         const { intent, created } = await provisioning.enqueueIntent(pool, id, 'domain-attach', 'api:self');
@@ -957,22 +976,30 @@ module.exports = function provisioningRoutes() {
             instanceId: id, ownerBuilderId: req.builder.id, event: 'domain',
             detail: `domain ${domain} recorded (attach already queued)`, actor: 'api:self',
           }).catch(() => {});
-          return res.json({ ok: true, changed: true, queued: false, domain,
+          return res.json({ ok: true, changed: true, queued: false, domain, replaced: releasing,
             message: 'That address is already being wired for this instance.' });
         }
       }
+      const moved = releasing ? ` (moved off ${releasing}, queued for release)` : '';
       await provisioning.recordEvent(pool, {
         instanceId: id, ownerBuilderId: req.builder.id, event: 'domain',
-        detail: queued ? `domain ${domain} recorded + attach queued` : `domain ${domain} recorded (wired at provision)`,
+        detail: (queued ? `domain ${domain} recorded + attach queued` : `domain ${domain} recorded (wired at provision)`) + moved,
         actor: 'api:self',
       }).catch(() => {});
-      res.json({ ok: true, changed: true, queued, domain,
-        // State-only sentence (task 1002720 / F16): the web tier holds no cloud
-        // tokens and cannot know whether a DNS hook exists on the runner, so
-        // "it will answer there shortly" was a promise it could not keep.
-        message: queued
-          ? 'Your instance is being wired to its new address — this card will show whether it answers.'
-          : 'Address recorded — it will be wired when the instance is provisioned.' });
+      // State-only sentences (task 1002720 / F16): the web tier holds no cloud
+      // tokens and cannot know whether a DNS hook exists on the runner, so "it
+      // will answer there shortly" was a promise it could not keep. The re-point
+      // sentences name the old address in the same voice — what they say has
+      // ALREADY happened is the recording, not the unwiring. One lookup rather
+      // than a nested ternary, so each of the four states reads as its own line.
+      const MESSAGES = {
+        'queued:repoint': `Your project is being wired to ${domain}; ${releasing} is being let go.`,
+        'queued:first': 'Your instance is being wired to its new address — this card will show whether it answers.',
+        'recorded:repoint': `Address changed to ${domain} — it will be wired, and ${releasing} let go, when the instance is provisioned.`,
+        'recorded:first': 'Address recorded — it will be wired when the instance is provisioned.',
+      };
+      res.json({ ok: true, changed: true, queued, domain, replaced: releasing,
+        message: MESSAGES[`${queued ? 'queued' : 'recorded'}:${releasing ? 'repoint' : 'first'}`] });
     } catch (err) {
       log.error('[provisioning] POST /provisioning/instances/:id/domain', err);
       res.fail('domain_attach_failed', { status: 500, message: 'internal error' });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.401",
+  "version": "1.19.402",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.401",
+      "version": "1.19.402",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.401",
+  "version": "1.19.402",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -404,6 +404,8 @@ a.orb{cursor:pointer;}
 .attachFold{margin-top:12px;}
 .attachFold summary{cursor:pointer;width:fit-content;font-size:13px;font-weight:700;color:var(--ink-faint);}
 .attachFold summary:hover,.attachFold[open] summary{color:var(--ink-soft);}
+.attachNote{margin:8px 0 0;font-size:13px;line-height:1.45;color:var(--ink-faint);}
+.attachNote code{font-family:var(--font-mono);}
 .projMsg{font-size:13.5px;font-weight:600;margin-top:10px;min-height:18px;color:var(--ink-soft);line-height:1.5;}
 .projMsg.ok{color:var(--ok);}
 .projMsg.err{color:var(--err);}

package/public-landing/projects.html

@@ -4022,8 +4022,12 @@ summary{min-height:24px;padding:3px 0;}
        (error_note, no intent in flight) can re-send its own domain — the route
        re-enqueues the attach for exactly this shape */
     if (inst.status === 'active' && inst.domain && inst.error_note && !inst.open_intent) return true;
-    return (!inst.domain || inst.domain === assignedDefaultFor(inst)) &&
-      (inst.status === 'requested' || inst.status === 'error' || inst.status === 'active');
+    /* every address here is now correctable (task 1003237): none (give it one),
+       the platform-assigned <slug>.<apex> (upgrade away from it), and — since the
+       owner decision of 2026-08-28 — a bring-your-own address that was mistyped.
+       The server's guards (reserved, in-apex squat, already held by another
+       project) are unchanged and stay the authority; this is only the door. */
+    return inst.status === 'requested' || inst.status === 'error' || inst.status === 'active';
   }
   /* re-enqueue doors: Try again on snagged, Bring it back on torn down —
      both re-POST the slug (the server's PROVISION_ENQUEUE_FROM gate) */
@@ -4237,13 +4241,30 @@ summary{min-height:24px;padding:3px 0;}
        be refused (intent_conflict), so the fold waits for the run to land */
     if (inst.open_intent && inst.open_intent.action === 'domain-attach') return '';
     var rekick = inst.status === 'active' && inst.domain && inst.error_note;
+    /* the CORRECTION door (task 1003237): the project already answers on an
+       address the founder brought, and it can be changed. The field carries the
+       current one so a typo is fixed by editing it, not retyped from scratch —
+       the re-kick door's shape, for the same reason. The platform-assigned
+       <slug>.<apex> is NOT a correction: moving off it is the upgrade the fold
+       already offered, and the field stays empty for the domain being brought. */
+    var byo = inst.domain && inst.domain !== assignedDefaultFor(inst);
+    var repoint = !rekick && byo;
+    var prefill = rekick || repoint;
+    var label = rekick ? 'Try the address again'
+      : repoint ? 'Use a different domain'
+      : inst.domain ? 'Use a domain I own' : 'Give it an address';
     return '<details class="attachFold"' + (rekick ? ' open' : '') + '>' +
-      '<summary>' + (rekick ? 'Try the address again' : inst.domain ? 'Use a domain I own' : 'Give it an address') + '</summary>' +
+      '<summary>' + label + '</summary>' +
       '<div class="attach">' +
       '<input type="text" id="dom-' + iid + '" placeholder="myproject.example.com" autocomplete="off" spellcheck="false" maxlength="253" aria-label="A domain you own, for ' + esc(inst.slug) + '"' +
-      (rekick ? ' value="' + esc(inst.domain) + '"' : '') + '>' +
+      (prefill ? ' value="' + esc(inst.domain) + '"' : '') + '>' +
       '<button type="button" class="btn small" data-attach="' + iid + '">' +
-      (rekick ? 'Try the address again' : 'Use this domain') + '</button></div></details>';
+      (rekick ? 'Try the address again' : repoint ? 'Change the address' : 'Use this domain') + '</button></div>' +
+      /* true in every state the fold renders in: a REQUESTED project never
+         answered anywhere yet, so "stops answering" would be a claim about a
+         thing that never happened (the F16 rule) */
+      (repoint ? '<p class="attachNote">Changing it lets <code>' + esc(inst.domain) + '</code> go — this project won’t use that address any more.</p>' : '') +
+      '</details>';
   }
 
   function renderCard(inst) {
@@ -5427,8 +5448,6 @@ summary{min-height:24px;padding:3px 0;}
           msg(id, 'That doesn’t look like a usable address — ' + esc(e.details.reason || 'use a real hostname like myproject.example.com') + '.', 'err');
         } else if (e.code === 'domain_taken') {
           msg(id, esc(e.message || 'That address is already in use by another project.'), 'err');
-        } else if (e.code === 'domain_already_set') {
-          msg(id, esc(e.message || 'This project already has an address — re-pointing isn’t supported here.'), 'err');
         } else if (e.code === 'domain_not_attachable') {
           msg(id, esc(e.message || 'An address can be attached once the instance settles.'), 'err');
         } else if (e.code === 'intent_conflict') {

package/scripts/gds/provision-net.js

@@ -118,6 +118,37 @@ function dnsUpsertEnv(inst, { publicIp, zone, proxied = false } = {}) {
   };
 }
 
+// The RFC 5737 TEST-NET-1 sentinel a released hostname is parked at (task
+// 1003237) — the shape scripts/gds/box-infra.js proved for a torn-down box
+// (idea 309 / task 1234). 192.0.2.1 is reserved for documentation and is
+// GUARANTEED never routable, so a name parked here can never dial platform
+// infra or a recycled address.
+const DNS_BLACKHOLE_IP = '192.0.2.1';
+
+// The env a RELEASE invocation of the DNS hook needs: the abandoned hostname,
+// parked at the blackhole sentinel. A re-point (task 1003237) leaves the old
+// address UPSERTed at the platform's IP for a project that no longer answers
+// there — the ADR 0181 §2 leak — and this is how the runner lets it go.
+//
+// REPOINT, not delete, for the reason box-infra.js records: deleting a name
+// opens an NXDOMAIN window that resolvers negative-cache for the zone's SOA
+// neg-TTL (~30 min, not editable), so a client that queried mid-gap stays
+// broken long after. A name that always resolves — to a guaranteed-dead host —
+// has nothing to negative-cache. It also needs only the UPSERT contract every
+// BOX_DNS_HOOK implements, so no hook grows a new mode for this.
+//
+// proxied=0: a parked record must never ride the Cloudflare edge, which would
+// answer for it. Takes a bare `hostname` rather than an instance — the whole
+// point is that the row has already moved on. PURE.
+function dnsReleaseEnv(hostname, { zone } = {}) {
+  return {
+    BOX_HOSTNAME: hostname,
+    BOX_IP: DNS_BLACKHOLE_IP,
+    CLOUDFLARE_ZONE: zone || zoneForDomain(hostname),
+    BOX_PROXIED: '0',
+  };
+}
+
 // ── DNS token-scope PREFLIGHT (task 1980) ────────────────────────────────────
 // Onboarding a NEW project on a domain the control-plane's Cloudflare token does NOT
 // cover fails LATE: the DNS UPSERT (step 5) errors mid-provision (the Emersonian
@@ -208,10 +239,12 @@ function healthzCmd(inst) {
 
 module.exports = {
   CF_API_BASE,
+  DNS_BLACKHOLE_IP,
   caddyBlock,
   caddySnippetPath,
   checkDnsTokenScope,
   classifyZoneScope,
+  dnsReleaseEnv,
   dnsUpsertEnv,
   federateInstance,
   federationHubOrigin,

package/scripts/gds/provision-units.js

@@ -240,6 +240,23 @@ function webEnvPath(inst, { etcBase = CONFIG.etcBase } = {}) {
 // The settings env vars the runner pushes to a RUNNING instance (task 1003140):
 // the module's settingsEnvVars under the prefix the instance actually resolves —
 // the same pair webEnvBody writes at standup, so standup and push cannot drift.
+// The four origin overrides web.env carries for an addressed instance — the
+// domain-dependent half of webEnvBody, on its own so domain-attach can patch
+// exactly those lines IN PLACE (task 1003237). A single-host instance has no
+// dedicated builders./status. subdomain, so all four point at the one host.
+// Empty for a domainless instance: there is no origin to assert, and writing
+// `=` over a real one would take the hall down. PURE.
+function originEnvVarsFor(inst) {
+  if (!inst || !inst.domain) return {};
+  const prefix = provisionedEnvPrefix(), origin = `https://${inst.domain}`;
+  return {
+    [`${prefix}_PUBLIC_ORIGIN`]: origin,
+    [`${prefix}_BUILDERS_ORIGIN`]: origin,
+    [`${prefix}_STATUS_ORIGIN`]: origin,
+    [`${prefix}_OAUTH_ORIGIN`]: origin,
+  };
+}
+
 function settingsEnvVarsFor(inst) {
   const { settingsEnvVars } = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning')); // eslint-disable-line global-require
   return settingsEnvVars(inst, provisionedEnvPrefix());
@@ -309,6 +326,7 @@ module.exports = {
   backupTimerPath,
   backupUnitName,
   instanceManifestCmd,
+  originEnvVarsFor,
   provisionedEnvPrefix,
   serviceUnit,
   serviceUnitPath,

package/scripts/gds/provision.js

@@ -51,8 +51,8 @@ const crypto = require('node:crypto');
 
 const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
 const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
-const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
-const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, shouldFederate, zoneForDomain } = require('./provision-net.js');
+const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
+const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, shouldFederate, zoneForDomain } = require('./provision-net.js');
 
 function makeExec({ apply, log = console.log, remoteHost = null, remoteCwd = null, sshOpts = '' }) {
   // `shown` (task 1003140): what to LOG in place of the command text — for a command
@@ -464,6 +464,12 @@ async function provisionInstance(inst, deps) {
     }
   }
 
+  // A re-point on a PRE-ACTIVE instance records its release here and never
+  // reaches the attach leg (that one no-ops for anything but 'active'), so this
+  // run owns the drain — and an `error` row is frequently a partial standup that
+  // already UPSERTed the address it is now leaving (ADR 0181 §1, task 1003237).
+  await releaseAbandonedDomains(inst, { controlExec, log, apply, db, provisioning });
+
   // ── step 6: Caddy per-instance site snippet + reload ──────────────────────
   // Write the instance's OWN <slug>.caddy snippet (idempotent overwrite via the
   // injected writeFile — no read-modify-append to a shared Caddyfile), then reload.
@@ -557,6 +563,57 @@ runcmd:
 `;
 }
 
+// The addresses a re-point left behind and this run still owes a release on
+// (task 1003237). The one guard this tier can make on its own, and the one that
+// matters: the address the instance is CURRENTLY on is never released, so a row
+// that somehow queued its own domain can never blackhole a live project.
+// Keeping a platform-assigned <slug>.<apex> off the queue is the ENQUEUE site's
+// job — the web tier knows the apex, this runner does not (ADR 0181 §2). PURE.
+function releasableDomains(inst) {
+  const here = String((inst && inst.domain) || '').toLowerCase();
+  return (Array.isArray(inst && inst.released_domains) ? inst.released_domains : [])
+    .map((d) => String(d || '').toLowerCase())
+    .filter((d) => d && d !== here);
+}
+
+// Park every address a re-point moved off at the blackhole sentinel, then empty
+// the queue (task 1003237, ADR 0200). Called by BOTH legs that wire a domain —
+// domain-attach for an ACTIVE instance, and the provision run that owns
+// PRE-ACTIVE ones, since an `error` row is frequently a partial standup that
+// already UPSERTed the address it is now leaving (ADR 0181 §1).
+//
+// BEST-EFFORT in the teardown sense: a hook that fails leaves the queue intact
+// so the next run retries, and never fails the wiring that already landed. EVERY
+// queued address is attempted — one host whose zone the token cannot reach must
+// not strand the others behind it — and the queue is emptied only when all of
+// them landed; a re-park of an address already at the sentinel is an idempotent
+// UPSERT, so retrying the whole list costs nothing but the call. The list is
+// capped at the enqueue site (MAX_RELEASED_DOMAINS), which is what bounds this
+// loop. Returns the first host that failed, or null. Runs on the CONTROL PLANE —
+// the hook needs the Cloudflare token, which never leaves it (ADR 0111 §2).
+async function releaseAbandonedDomains(inst, { controlExec, log, apply, db, provisioning }) {
+  const hosts = releasableDomains(inst);
+  if (!hosts.length) return null;
+  if (!CONFIG.dnsHook) {
+    log(`  [dns] cannot release ${hosts.join(', ')} (BOX_DNS_HOOK unset) — remove their A records manually`);
+    return null;
+  }
+  let firstFailed = null;
+  for (const host of hosts) {
+    const relEnv = dnsReleaseEnv(host);
+    log(`  [dns] release ${host} -> ${relEnv.BOX_IP} (blackhole, zone ${relEnv.CLOUDFLARE_ZONE}) via ${CONFIG.dnsHook}`);
+    if (!apply) continue;
+    try { controlExec(CONFIG.dnsHook, { env: relEnv }); }
+    catch (e) {
+      log(`  ⚠ could not release ${host}: ${(e && e.message) || e} — its A record still points here`);
+      if (!firstFailed) firstFailed = host;
+    }
+  }
+  if (firstFailed) return firstFailed;
+  if (apply && provisioning.clearReleasedDomains) await provisioning.clearReleasedDomains(db, inst.id).catch(() => {});
+  return null;
+}
+
 // ---------------------------------------------------------------------------
 // Attach a late-arriving domain to an ALREADY-ACTIVE instance (task 1002692):
 // re-assert exactly the domain-dependent runbook legs — web.env origins (+ a
@@ -565,6 +622,18 @@ runcmd:
 // RETURN { ok:false } instead of throwing: the drain loop's catch flips the
 // instance to 'error', which must never happen to a healthy ACTIVE instance
 // over a domain hiccup.
+//
+// This leg ALSO carries a RE-POINT (task 1003237, ADR 0200) — the same intent,
+// because the wiring is the same wiring. Two things follow from that:
+//   • The origin lines are patched IN PLACE (upsertEnvVars), never regenerated
+//     from the row. A template re-write via webEnvBody would blank the OAuth
+//     creds placeManifestCreds placed, the App private key and the federation
+//     block — none of which the row knows (ADR 0190 §2). A first attach was
+//     MASKED by wizard order (address first, GitHub App second); a re-point runs
+//     on a project the founder is already signed in to, so the same move would
+//     break sign-in on the exact project they just corrected (idea 1000842).
+//   • Every address on the row's release queue is parked at the blackhole
+//     sentinel AFTER the new one is wired — best-effort, never fatal.
 // ---------------------------------------------------------------------------
 async function domainAttachInstance(inst, deps) {
   const { db, provisioning, exec, writeFile, log, apply, privileged } = deps;
@@ -603,8 +672,22 @@ async function domainAttachInstance(inst, deps) {
     ? (CONFIG.controlPlaneIp || (CONFIG.remoteHost ? null : CONFIG.publicIp))
     : CONFIG.publicIp;
 
-  log('  [config] re-write per-instance web.env (origins now carry the domain)');
-  boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation: null, ownerLogin: await ownerLoginOf(inst, deps.db) }), { mode: 0o600, sudo: true });
+  // Patch ONLY the origin lines (the settingsApplyInstance shape, ADR 0190 §2).
+  // Dry-run has no file to read, so it PLANS the patch rather than writing a
+  // synthetic body. An unreadable or empty file is refused, never "patched":
+  // writing four origins over a missing PORT/PGDATABASE would take the instance
+  // down — and this leg runs against instances that are ALREADY serving.
+  const origins = originEnvVarsFor(inst);
+  const read = boxExec(`${sudoP}cat ${webEnvPath(inst)}`, { allowFail: true });
+  const currentEnv = String((read && read.stdout) || '');
+  if (!apply) {
+    log(`  [config] would patch ${Object.keys(origins).join(', ')} in ${webEnvPath(inst)} in place (creds + federation untouched)`);
+  } else if (!read || read.softFailed || !currentEnv.trim()) {
+    return { ok: false, error: `cannot read ${webEnvPath(inst)} — nothing to patch (was this instance provisioned by the runner?)` };
+  } else {
+    log('  [config] patch the origin lines of web.env in place (creds + federation untouched)');
+    boxWriteFile(webEnvPath(inst), upsertEnvVars(currentEnv, origins), { mode: 0o600, sudo: true });
+  }
   log('  [service] restart to pick up the new origins');
   boxExec(`${sudoP}systemctl restart ${inst.slug}`);
 
@@ -629,10 +712,19 @@ async function domainAttachInstance(inst, deps) {
     log(`  [dns] skipped (BOX_DNS_HOOK unset) — point ${inst.domain}'s A record at ${recordIp || 'this server'} manually`);
   }
 
+  // The snippet is per-SLUG and always carries the CURRENT domain, so a re-point
+  // takes the old vhost away in the same write — Caddy stops serving the old host
+  // (and tls-check stops vouching for it) with no separate un-wire step.
   log('  [caddy] write site snippet + reload');
   boxWriteFile(caddySnippetPath(inst), caddyBlock(inst), { mode: 0o644, sudo: true });
   boxExec(`${sudoP}systemctl reload caddy`, { allowFail: true });
 
+  // Release what the re-point moved off, AFTER the new address is wired: the DNS
+  // record is the only half of an abandoned address the platform still holds, and
+  // it points at platform infra.
+  const releaseFailed = await releaseAbandonedDomains(inst, { controlExec, log, apply, db, provisioning });
+  if (releaseFailed) return { ok: true, releaseFailed };
+
   log('  [healthz] verify the instance answers');
   boxExec(healthzCmd(inst), { allowFail: true });
 
@@ -1337,7 +1429,7 @@ module.exports = {
   caddyBlock, caddySnippetPath, healthzCmd, dedicatedUserData, nextFreePort,
   // executors + orchestration (injectable deps for tests)
   makeExec, makeWriteFile, allocatePort, boundLocalPorts, provisionInstance, teardownInstance,
-  domainAttachInstance, cmdRunIntents, cmdReconcile, cmdStatus,
+  domainAttachInstance, releasableDomains, cmdRunIntents, cmdReconcile, cmdStatus,
   // live settings push (task 1003140) + the in-place env patch + read-back it rides on
   settingsApplyInstance, upsertEnvVars, settingsEnvVarsFor, settingsConsumed, instanceManifestCmd,
   // restart an unreachable ACTIVE instance (task 1003238) — the settings leg minus the env patch

package/src/module-api.js

@@ -1242,8 +1242,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.399 with no explicit bump. run 33201979306. (task 1002620)
 //   1.19.401 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.400 with no explicit bump. run 33205015717. (task 1002620)
+//   1.19.402 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.401 with no explicit bump. run 33206226800. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.401'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.402'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub_pre_uat.mjs

@@ -335,11 +335,37 @@ test('the F19 re-kick door survives the fold: open, pre-filled, one button', ()
   const fold = fn('attachFold');
   assert.match(fold, /var rekick = inst\.status === 'active' && inst\.domain && inst\.error_note;/);
   assert.match(fold, /\(rekick \? ' open' : ''\)/, 'the fold opens on its own for a stalled address');
-  assert.match(fold, /\(rekick \? ' value="' \+ esc\(inst\.domain\) \+ '"' : ''\)/, 'pre-filled with the address that stalled');
-  assert.match(fold, /rekick \? 'Try the address again' : 'Use this domain'/, 'and the button says what it does');
+  assert.match(fold, /\(prefill \? ' value="' \+ esc\(inst\.domain\) \+ '"' : ''\)/, 'pre-filled with the address in play');
+  assert.match(fold, /var prefill = rekick \|\| repoint;/, 'a stalled address and a correctable one both arrive in the field');
+  assert.match(fold, /rekick \? 'Try the address again' : repoint \? 'Change the address' : 'Use this domain'/, 'and the button says what it does');
   assert.match(fn('canAttachDomain'), /inst\.status === 'active' && inst\.domain && inst\.error_note && !inst\.open_intent\) return true;/, 'the route-side re-kick gate is untouched');
 });
 
+test('the correction door: a bring-your-own address can be changed, and the fold says what that costs (task 1003237)', () => {
+  const fold = fn('attachFold');
+  // the three doors are told apart by what the project is actually addressed as
+  assert.match(fold, /var byo = inst\.domain && inst\.domain !== assignedDefaultFor\(inst\);/,
+    'the platform-assigned <slug>.<apex> is NOT a correction — moving off it is the upgrade the fold already offered');
+  assert.match(fold, /var repoint = !rekick && byo;/, 'a stalled address keeps the F19 door, which is louder');
+  assert.match(fold, /'Use a different domain'/, 'the summary names the correction');
+  assert.match(fold, /attachNote/, 'and the consequence is stated where the button is');
+  assert.match(fold, /won’t use that address any more/, 'letting the old address go is SAID, not discovered');
+  // the door itself: an addressed, live project is no longer excluded
+  const gate = fn('canAttachDomain');
+  assert.doesNotMatch(gate, /!inst\.domain \|\| inst\.domain === assignedDefaultFor\(inst\)/,
+    'the "only a domainless or platform-addressed project may attach" clause is what the re-point removes');
+  assert.match(gate, /inst\.status === 'requested' \|\| inst\.status === 'error' \|\| inst\.status === 'active'/,
+    'state is still the gate — a mid-flight or torn-down project has nothing to point a domain at');
+  assert.match(COSMOS, /\.attachNote\{/, 'the note is styled');
+  assert.doesNotMatch((COSMOS.match(/\.attachNote[^\n]*/g) || []).join('\n'), /#[0-9a-f]{3,8}\b/i,
+    'and paints from tokens, so dark mode needs no twin');
+});
+
+test('the retired refusal is gone from the card: domain_already_set can no longer be returned', () => {
+  assert.doesNotMatch(HUB, /domain_already_set/,
+    'the server stopped sending it (task 1003237) — a branch for it would be unreachable copy');
+});
+
 test('a heartbeat re-render keeps an open fold open and a half-typed domain typed', () => {
   const card = fn('renderCard');
   assert.match(card, /var keepOpen = !!\(oldFold && oldFold\.open\);/);