@bongos/core 1.19.401 → 1.19.402

package/tests/provision.mjs

@@ -965,18 +965,21 @@ console.log('\nDNS UPSERT composition (P4, CONFIG override):');
 
 // A recorder that also captures each exec's env (so we can assert the DNS hook env).
 function dnsRecorder({ apply = false } = {}) {
-  const cmds = [], envs = [];
+  const cmds = [], envs = [], cleared = [];
   const deps = {
     apply, log: () => {},
     db: { query: async () => ({ rows: [] }) },
-    provisioning: { setInstanceStatus: async () => {}, recordEvent: async () => {} },
+    provisioning: {
+      setInstanceStatus: async () => {}, recordEvent: async () => {},
+      clearReleasedDomains: async (_db, id) => { cleared.push(id); },
+    },
     exec: (cmd, opts) => { cmds.push(cmd); envs.push(opts && opts.env); return { ok: true, stdout: '' }; },
     writeFile: () => ({ ok: true }), doApi: null,
     // Preflight (task 1980) stubbed reachable so --apply DNS tests reach the step-5
     // behavior they assert (the preflight itself is covered by its own test below).
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
   };
-  return { deps, cmds, envs };
+  return { deps, cmds, envs, cleared };
 }
 
 await ta('a co-tenant WITH a domain UPSERTs DNS: the hook is invoked BY PATH with the control-plane env (proxied=false)', async () => {
@@ -1008,6 +1011,40 @@ await ta('--apply THROWS if a domain has no target IP (task-1180: never report s
   } finally { P.CONFIG.publicIp = savedIp; P.CONFIG.dnsHook = savedHook; }
 });
 
+await ta('the PROVISION run drains the release queue too — a re-point on a pre-active project never reaches the attach leg (task 1003237)', async () => {
+  const savedIp = P.CONFIG.publicIp, savedHook = P.CONFIG.dnsHook;
+  P.CONFIG.publicIp = '203.0.113.5';
+  P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh';
+  try {
+    // an `error` row is frequently a PARTIAL standup (ADR 0181 §1): it may already
+    // have UPSERTed the address it is now leaving, and domainAttachInstance no-ops
+    // for anything but 'active', so this run is the only one that can let it go
+    const { deps, cmds, envs, cleared } = dnsRecorder({ apply: true });
+    await P.provisionInstance(
+      { ...coTenant, domain: 'right.example.com', released_domains: ['typo.example.com'] }, deps);
+    const hooks = cmds.map((c, i) => i).filter((i) => cmds[i] === '/opt/infra/box-dns-cloudflare.sh');
+    assert.equal(hooks.length, 2, 'one UPSERT for the new address, one RELEASE for the old');
+    assert.equal(envs[hooks[0]].BOX_HOSTNAME, 'right.example.com');
+    assert.equal(envs[hooks[0]].BOX_IP, '203.0.113.5');
+    assert.equal(envs[hooks[1]].BOX_HOSTNAME, 'typo.example.com');
+    assert.equal(envs[hooks[1]].BOX_IP, '192.0.2.1', 'parked at the blackhole, not left pointing here');
+    assert.deepEqual(cleared, [coTenant.id], 'and the queue is drained');
+  } finally { P.CONFIG.publicIp = savedIp; P.CONFIG.dnsHook = savedHook; }
+});
+
+await ta('a provision with an EMPTY release queue never invokes the hook twice', async () => {
+  const savedIp = P.CONFIG.publicIp, savedHook = P.CONFIG.dnsHook;
+  P.CONFIG.publicIp = '203.0.113.5';
+  P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh';
+  try {
+    const { deps, cmds, cleared } = dnsRecorder({ apply: true });
+    await P.provisionInstance({ ...coTenant, domain: 'right.example.com' }, deps);
+    assert.equal(cmds.filter((c) => c === '/opt/infra/box-dns-cloudflare.sh').length, 1,
+      'the ordinary standup is unchanged — no release, no extra call');
+    assert.deepEqual(cleared, [], 'and an empty queue is never "drained"');
+  } finally { P.CONFIG.publicIp = savedIp; P.CONFIG.dnsHook = savedHook; }
+});
+
 await ta('no domain → DNS is skipped even with a hook + IP configured', async () => {
   const savedIp = P.CONFIG.publicIp, savedHook = P.CONFIG.dnsHook;
   P.CONFIG.publicIp = '203.0.113.5';
@@ -1698,21 +1735,45 @@ console.log('\ndomain-attach leg (task 1002692 — give an ACTIVE instance its l
 // Recorder for the attach leg: captures commands (with env), file writes (with
 // bodies), and recorded events. No status writes to capture — domain-attach must
 // never touch the instance lifecycle.
-function attachRecorder({ apply = false } = {}) {
-  const cmds = [], envs = [], writes = [], events = [], dnsNotes = [];
+// `envBody` is what a `cat <web.env>` returns — the attach leg patches the origin
+// lines IN PLACE (task 1003237), so a test that cares about the write has to hand
+// it a file to patch. Default: the shape a manifest-onboarded instance really has
+// — creds and a federation block the ROW does not know, which a template re-write
+// would blank (ADR 0190 §2 / idea 1000842). Values are obvious fixtures.
+const WEB_ENV_ON_BOX = [
+  'PORT=3010',
+  'PGDATABASE=spike',
+  `${NEUTRAL_PREFIX}_PUBLIC_ORIGIN=https://old.example.com`,
+  `${NEUTRAL_PREFIX}_BUILDERS_ORIGIN=https://old.example.com`,
+  `${NEUTRAL_PREFIX}_OAUTH_CLIENT_ID=Iv1.fixture-client-id`,
+  `${NEUTRAL_PREFIX}_OAUTH_CLIENT_SECRET=fixture-secret-placed-by-the-manifest-flow`,
+  'GITHUB_APP_PRIVATE_KEY=fixture-pem-flattened-to-one-line',
+  `${NEUTRAL_PREFIX}_HUB_CLIENT_SECRET=fixture-federation-secret`,
+  '',
+].join('\n');
+
+function attachRecorder({ apply = false, envBody = WEB_ENV_ON_BOX } = {}) {
+  const cmds = [], envs = [], writes = [], events = [], dnsNotes = [], cleared = [];
   const deps = {
     apply, log: () => {},
     db: { query: async () => ({ rows: [] }) },
     provisioning: {
       recordEvent: async (_db, e) => { events.push(e); },
       recordDnsNote: async (_db, id, note) => { dnsNotes.push({ id, note }); },
+      clearReleasedDomains: async (_db, id) => { cleared.push(id); },
+    },
+    exec: (cmd, opts = {}) => {
+      cmds.push(cmd); envs.push((opts && opts.env) || null);
+      if (/\bcat\b.*web\.env/.test(cmd)) {
+        return envBody === null ? { ok: false, softFailed: true, stdout: '' } : { ok: true, stdout: envBody };
+      }
+      return { ok: true, stdout: '' };
     },
-    exec: (cmd, opts = {}) => { cmds.push(cmd); envs.push((opts && opts.env) || null); return { ok: true, stdout: '' }; },
     writeFile: (p, body) => { writes.push({ path: p, body }); return { ok: true }; },
     doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
   };
-  return { deps, cmds, envs, writes, events, dnsNotes };
+  return { deps, cmds, envs, writes, events, dnsNotes, cleared };
 }
 
 const activeStandalone = {
@@ -1720,17 +1781,19 @@ const activeStandalone = {
   port: 3010, db_name: 'spike', domain: 'spike.cloudbongos.com', target_ref: 'jaxri/spike-harbor',
 };
 
-await ta('domainAttachInstance(active standalone): env re-write → restart → DNS upsert → caddy → healthz', async () => {
+await ta('domainAttachInstance(active standalone, --apply): env patch → restart → DNS upsert → caddy → healthz', async () => {
   const savedPub = P.CONFIG.publicIp, savedHook = P.CONFIG.dnsHook;
   P.CONFIG.publicIp = '203.0.113.5';
   P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh';
   try {
-    const { deps, cmds, envs, writes } = attachRecorder();
+    const { deps, cmds, envs, writes } = attachRecorder({ apply: true });
     const r = await P.domainAttachInstance(activeStandalone, deps);
     assert.equal(r.ok, true);
     const env = writes.find((w) => /\/spike\/web\.env$/.test(w.path));
-    assert.ok(env, 're-writes web.env');
-    assert.match(env.body, /https:\/\/spike\.cloudbongos\.com/, 'the new address reaches the origins');
+    assert.ok(env, 'writes web.env');
+    assert.match(env.body, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_PUBLIC_ORIGIN=https://spike\\.cloudbongos\\.com`),
+      'the new address reaches the origins');
+    assert.doesNotMatch(env.body, /old\.example\.com/, 'the stale origins are replaced, not appended');
     const joined = cmds.join('\n');
     assert.match(joined, /systemctl restart spike/, 'RESTART (not reload) so the process re-reads its env');
     const di = cmds.indexOf('/opt/infra/box-dns-cloudflare.sh');
@@ -1745,6 +1808,113 @@ await ta('domainAttachInstance(active standalone): env re-write → restart →
   } finally { P.CONFIG.publicIp = savedPub; P.CONFIG.dnsHook = savedHook; }
 });
 
+// -- the web.env hazard this leg used to carry (task 1003237, idea 1000842) -----
+// domainAttachInstance re-wrote web.env from the TEMPLATE (webEnvBody), which
+// regenerates the file FROM THE ROW — and the row knows neither the OAuth creds
+// placeManifestCreds fetched, nor the App private key, nor the federation block.
+// A first attach was masked by wizard order (address first, GitHub App second).
+// A RE-POINT is not masked: it runs on a project the founder is already signed
+// in to, so the same move would break sign-in on the project they just corrected.
+
+await ta('domainAttachInstance(--apply): patches ONLY the origin lines — creds, App key and federation survive', async () => {
+  const savedHook = P.CONFIG.dnsHook; P.CONFIG.dnsHook = '';
+  try {
+    const { deps, writes } = attachRecorder({ apply: true });
+    const r = await P.domainAttachInstance(activeStandalone, deps);
+    assert.equal(r.ok, true);
+    const env = writes.find((w) => /\/spike\/web\.env$/.test(w.path));
+    const P_ = reEsc(NEUTRAL_PREFIX);
+    assert.match(env.body, new RegExp(`${P_}_OAUTH_CLIENT_ID=Iv1\\.fixture-client-id`), 'the manifest-placed client id survives');
+    assert.match(env.body, new RegExp(`${P_}_OAUTH_CLIENT_SECRET=fixture-secret-placed-by-the-manifest-flow`), 'the client secret survives');
+    assert.match(env.body, /GITHUB_APP_PRIVATE_KEY=fixture-pem-flattened-to-one-line/, 'the App private key survives');
+    assert.match(env.body, new RegExp(`${P_}_HUB_CLIENT_SECRET=fixture-federation-secret`), 'the federation block survives');
+    assert.match(env.body, /^PORT=3010$/m, 'and every unrelated line is untouched');
+    assert.match(env.body, new RegExp(`${P_}_STATUS_ORIGIN=https://spike\\.cloudbongos\\.com`), 'a missing origin line is APPENDED');
+  } finally { P.CONFIG.dnsHook = savedHook; }
+});
+
+await ta('domainAttachInstance(--apply): an unreadable web.env is REFUSED, never "patched" over', async () => {
+  const { deps, writes } = attachRecorder({ apply: true, envBody: null });
+  const r = await P.domainAttachInstance(activeStandalone, deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /cannot read/i);
+  assert.equal(writes.length, 0, 'four origins over a missing PORT/PGDATABASE would take the instance down');
+});
+
+await ta('domainAttachInstance(dry-run): PLANS the patch — nothing is written', async () => {
+  const { deps, writes } = attachRecorder();
+  const r = await P.domainAttachInstance(activeStandalone, deps);
+  assert.equal(r.ok, true);
+  assert.ok(!writes.some((w) => /web\.env$/.test(w.path)), 'a dry run must not write a synthetic body');
+});
+
+// -- releasing what a re-point moved off (task 1003237, ADR 0200) --------------
+
+await ta('releasableDomains: the queue, minus the address the instance is CURRENTLY on', () => {
+  assert.deepEqual(P.releasableDomains({ domain: 'right.example.com', released_domains: ['TYPO.example.com'] }),
+    ['typo.example.com'], 'normalized, so a case difference can never dodge the release');
+  assert.deepEqual(P.releasableDomains({ domain: 'right.example.com', released_domains: ['right.example.com'] }),
+    [], 'a row that somehow queued its own domain can never blackhole a live project');
+  assert.deepEqual(P.releasableDomains({ domain: 'x.example.com' }), [], 'no queue is not a crash');
+  assert.deepEqual(P.releasableDomains({ domain: 'x.example.com', released_domains: ['a.example.com', '', 'b.example.com'] }),
+    ['a.example.com', 'b.example.com'], 'every abandoned address is released, not just the last');
+});
+
+await ta('domainAttachInstance(--apply): a re-point parks the old address at the blackhole, AFTER wiring the new one', async () => {
+  const savedPub = P.CONFIG.publicIp, savedHook = P.CONFIG.dnsHook;
+  P.CONFIG.publicIp = '203.0.113.5';
+  P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh';
+  try {
+    const { deps, cmds, envs, cleared } = attachRecorder({ apply: true });
+    const r = await P.domainAttachInstance({ ...activeStandalone, released_domains: ['typo.example.com'] }, deps);
+    assert.equal(r.ok, true);
+    const hooks = cmds.map((c, i) => i).filter((i) => cmds[i] === '/opt/infra/box-dns-cloudflare.sh');
+    assert.equal(hooks.length, 2, 'one UPSERT for the new address, one RELEASE for the old');
+    assert.equal(envs[hooks[0]].BOX_HOSTNAME, 'spike.cloudbongos.com');
+    assert.equal(envs[hooks[0]].BOX_IP, '203.0.113.5', 'the new address is wired first');
+    assert.equal(envs[hooks[1]].BOX_HOSTNAME, 'typo.example.com');
+    assert.equal(envs[hooks[1]].BOX_IP, '192.0.2.1', 'RFC 5737 TEST-NET-1 — guaranteed never routable');
+    assert.equal(envs[hooks[1]].BOX_PROXIED, '0', 'a parked record must never ride the CF edge');
+    assert.equal(envs[hooks[1]].CLOUDFLARE_ZONE, 'example.com', 'the zone is derived from the OLD host, not the row');
+    const caddy = cmds.findIndex((c) => /reload caddy/.test(c));
+    assert.ok(caddy >= 0 && caddy < hooks[1], 'the old vhost is gone before its record is parked');
+    assert.deepEqual(cleared, [18], 'the queue is drained only once every address on it was released');
+  } finally { P.CONFIG.publicIp = savedPub; P.CONFIG.dnsHook = savedHook; }
+});
+
+await ta('domainAttachInstance(--apply): a release the hook REFUSES keeps the queue — ok:true, the re-point still stands', async () => {
+  const savedPub = P.CONFIG.publicIp, savedHook = P.CONFIG.dnsHook;
+  P.CONFIG.publicIp = '203.0.113.5';
+  P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh';
+  try {
+    const { deps, cleared } = attachRecorder({ apply: true });
+    let seen = 0;
+    const inner = deps.exec;
+    deps.exec = (cmd, opts) => {
+      if (cmd === '/opt/infra/box-dns-cloudflare.sh' && ++seen === 2) throw new Error('cloudflare said no');
+      return inner(cmd, opts);
+    };
+    const r = await P.domainAttachInstance({ ...activeStandalone, released_domains: ['typo.example.com'] }, deps);
+    assert.equal(r.ok, true, 'a failed release must never fail a re-point that already landed');
+    assert.equal(r.releaseFailed, 'typo.example.com');
+    assert.deepEqual(cleared, [], 'the queue survives, so the next attach retries the release');
+  } finally { P.CONFIG.publicIp = savedPub; P.CONFIG.dnsHook = savedHook; }
+});
+
+await ta('domainAttachInstance(--apply): no DNS hook → the release is named for the operator, and the queue is kept', async () => {
+  const savedHook = P.CONFIG.dnsHook; P.CONFIG.dnsHook = '';
+  try {
+    const lines = [];
+    const { deps, cleared } = attachRecorder({ apply: true });
+    deps.log = (m) => lines.push(String(m));
+    const r = await P.domainAttachInstance({ ...activeStandalone, released_domains: ['typo.example.com'] }, deps);
+    assert.equal(r.ok, true);
+    assert.ok(lines.some((l) => /typo\.example\.com/.test(l) && /BOX_DNS_HOOK unset/.test(l)),
+      'the outstanding manual step is SAID, not swallowed');
+    assert.deepEqual(cleared, [], 'nothing was released, so nothing is marked released');
+  } finally { P.CONFIG.dnsHook = savedHook; }
+});
+
 await ta('domainAttachInstance: no domain recorded → ok:false, nothing runs', async () => {
   const { deps, cmds } = attachRecorder();
   const r = await P.domainAttachInstance({ ...activeStandalone, domain: null }, deps);
@@ -1797,7 +1967,10 @@ await ta('cmdRunIntents (--apply) routes a domain-attach intent to the attach le
       claimNextOAuthManifest: async () => null,
       resolveOAuthManifest: async () => {},
     },
-    exec: () => ({ ok: true }), writeFile: () => ({ ok: true }), doApi: null,
+    // the attach leg patches web.env IN PLACE, so a `cat` must return a real file
+    // — an empty one is a deliberate refusal (task 1003237)
+    exec: (cmd) => ({ ok: true, stdout: /\bcat\b.*web\.env/.test(String(cmd)) ? 'PORT=3010\n' : '' }),
+    writeFile: () => ({ ok: true }), doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
   };
   const r = await P.cmdRunIntents(deps);

package/tests/provisioning_default_domain.mjs

@@ -318,12 +318,14 @@ await ta('re-pointing AWAY from the platform-assigned address → recorded + dom
   assert.deepEqual(enqueueCalls.map((c) => c.action), ['domain-attach']);
 });
 
-await ta('a genuine bring-your-own address still refuses to re-point (unchanged)', async () => {
+await ta('a genuine bring-your-own address RE-POINTS, and the one it leaves is queued for release (task 1003237)', async () => {
   reset();
   provisioning.getInstanceById = async (_db, id) => freshRow({ id, domain: 'spike.example.com', status: 'active' });
   const res = await post('/provisioning/instances/41/domain', { domain: 'another.example.com' });
-  assert.equal(res.status, 409, res.raw);
-  assert.equal(res.body.error.code, 'domain_already_set');
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.domain, 'another.example.com');
+  assert.equal(res.body.replaced, 'spike.example.com',
+    'the owner decision of 2026-08-28: a mistyped BYO address is correctable, and the old one is let go');
 });
 
 server.close();

package/tests/provisioning_domain_attach.mjs

@@ -41,7 +41,7 @@ async function ta(name, fn) {
 
 console.log('service slice — updateInstanceDomain / getInstanceByDomain:');
 
-await ta('updateInstanceDomain: parameterized UPDATE of only the domain (+updated_at), returns the row', async () => {
+await ta('updateInstanceDomain: parameterized UPDATE of the domain + the release queue, returns the row', async () => {
   const calls = [];
   const db = { query: async (sql, params) => {
     calls.push({ sql, params });
@@ -50,8 +50,34 @@ await ta('updateInstanceDomain: parameterized UPDATE of only the domain (+update
   const row = await provisioning.updateInstanceDomain(db, 18, 'spike.cloudbongos.com');
   assert.equal(row.domain, 'spike.cloudbongos.com');
   assert.match(calls[0].sql, /UPDATE provisioning_instances/);
-  assert.match(calls[0].sql, /SET domain = \$2, updated_at = now\(\)/, 'touches ONLY the domain column');
-  assert.deepEqual(calls[0].params, [18, 'spike.cloudbongos.com']);
+  assert.match(calls[0].sql, /SET domain = \$2/);
+  assert.match(calls[0].sql, /released_domains/, 'the release queue rides the SAME statement (task 1003237)');
+  assert.match(calls[0].sql, /last_verified_up = CASE WHEN domain IS DISTINCT FROM \$2 THEN NULL/,
+    'a CHANGED address has never been probed - the overlay must not describe the address it left (F16)');
+  assert.doesNotMatch(calls[0].sql, /status/, 'still never drifts the lifecycle');
+  assert.match(calls[0].sql, /array_length\(released_domains, 1\), 0\) >= \$4/,
+    'the queue is CAPPED in SQL, not trusted from the caller - the runner drains it against a shared token');
+  assert.deepEqual(calls[0].params, [18, 'spike.cloudbongos.com', null, provisioning.MAX_RELEASED_DOMAINS],
+    'no `releasing` means a null 3rd param, and the CASE leaves the queue exactly as it stands');
+});
+
+await ta('updateInstanceDomain: a re-point APPENDS the old address, lowercased, and never duplicates it', async () => {
+  const calls = [];
+  const db = { query: async (sql, params) => { calls.push({ sql, params }); return { rows: [{ id: 18 }] }; } };
+  await provisioning.updateInstanceDomain(db, 18, 'right.example.com', 'TYPO.example.com');
+  assert.deepEqual(calls[0].params, [18, 'right.example.com', 'typo.example.com', provisioning.MAX_RELEASED_DOMAINS]);
+  assert.match(calls[0].sql, /array_append\(released_domains, \$3\)/, 'appends — a second correction must not drop the first');
+  assert.match(calls[0].sql, /\$3 = ANY\(released_domains\)/, 'idempotent: a retry never queues the same address twice');
+});
+
+await ta('clearReleasedDomains: empties the queue and touches nothing else', async () => {
+  const calls = [];
+  const db = { query: async (sql, params) => { calls.push({ sql, params }); return { rows: [{ id: 18 }] }; } };
+  await provisioning.clearReleasedDomains(db, 18);
+  assert.match(calls[0].sql, /SET released_domains = '\{\}'/);
+  assert.doesNotMatch(calls[0].sql, /updated_at|status|domain = /,
+    'draining a queue is not an owner-visible change (the clearErrorNote rule)');
+  assert.deepEqual(calls[0].params, [18]);
 });
 
 await ta('getInstanceByDomain: case-insensitive exact match, parameterized', async () => {
@@ -80,8 +106,8 @@ let createResult = null;         // what createInstance reports (re-request test
 let manifestRows = [];
 provisioning.getInstanceById = async (_db, id) => (instance ? { ...instance, id } : null);
 provisioning.getInstanceByDomain = async (_db, d) => domainHolder;
-provisioning.updateInstanceDomain = async (_db, id, domain) => {
-  updateCalls.push({ id, domain });
+provisioning.updateInstanceDomain = async (_db, id, domain, releasing = null) => {
+  updateCalls.push({ id, domain, releasing });
   instance = { ...instance, domain };
   return { ...instance, id };
 };
@@ -100,10 +126,24 @@ const api = require('../src/module-api.js');
 api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
 api.requirePermission = () => (_req, _res, next) => next();
 api.branding = () => ({
-  domains: { publicOrigin: 'https://cb.test' },
+  // instanceBase is the platform APEX the route's reserved + in-apex-squat guards
+  // read (instanceApex()). Set here so the re-point suite below can exercise them
+  // against a real apex instead of the guard-free '' the stub used to imply.
+  domains: { publicOrigin: 'https://cb.test', instanceBase: 'cb.test' },
   identity: { productName: 'Cloud Bongos' },
 });
 
+// The domain route is rate-limited PER BUILDER (task 1003237) and every test in
+// this file posts as builder 7, so the real cap would throttle the suite rather
+// than the behaviour each test is about. Raise it for the shared app below —
+// `limiterMax = null` restores the route's own number, which the dedicated
+// limiter test at the end of this file uses to exercise the real 429.
+const rateLimit = require('../modules/provisioning/rate-limit.js');
+const realMakeAskRateLimiter = rateLimit.makeAskRateLimiter;
+let limiterMax = 10_000;
+rateLimit.makeAskRateLimiter = (opts = {}) =>
+  realMakeAskRateLimiter({ ...opts, ...(limiterMax === null ? {} : { max: limiterMax }) });
+
 const express = require('express');
 const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
 const app = express();
@@ -121,10 +161,12 @@ const server = app.listen(0);
 await new Promise((r) => server.once('listening', r));
 const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
 
-function post(path, body = {}) {
+function post(path, body = {}) { return postTo(base, path, body); }
+
+function postTo(origin, path, body = {}) {
   return new Promise((resolve, reject) => {
     const payload = JSON.stringify(body);
-    const req = http.request(`${base}${path}`, {
+    const req = http.request(`${origin}${path}`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
     }, (res) => {
@@ -137,9 +179,9 @@ function post(path, body = {}) {
   });
 }
 
-function reset({ inst } = {}) {
+function reset({ inst, holder } = {}) {
   instance = inst || null;
-  domainHolder = null;
+  domainHolder = holder || null;
   updateCalls = [];
   enqueueCalls = [];
   enqueueResult = null;
@@ -155,7 +197,7 @@ await ta('ACTIVE domainless instance: domain is validated, recorded, and a domai
   assert.equal(res.status, 200, res.raw);
   assert.equal(res.body.ok, true);
   assert.equal(res.body.domain, 'spike.cloudbongos.com', 'normalized before storing');
-  assert.deepEqual(updateCalls, [{ id: 18, domain: 'spike.cloudbongos.com' }]);
+  assert.deepEqual(updateCalls, [{ id: 18, domain: 'spike.cloudbongos.com', releasing: null }]);
   assert.deepEqual(enqueueCalls.map((c) => c.action), ['domain-attach']);
   assert.equal(res.body.queued, true);
 });
@@ -229,21 +271,91 @@ await ta('re-kick honors enqueueIntent created:false — a racing enqueue is nev
   } finally { provisioning.enqueueIntent = savedEnqueue; }
 });
 
-await ta('a DIFFERENT domain already set is a truthful 409 domain_already_set (re-pointing is not this route)', async () => {
-  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'old.cloudbongos.com' } });
-  const res = await post('/provisioning/instances/18/domain', { domain: 'new.cloudbongos.com' });
+// -- the re-point (task 1003237, owner decision 2026-08-28 / ADR 0200) --------
+// A mistyped bring-your-own address used to be a permanent 409 domain_already_set.
+// It is now correctable, under exactly the guards the FIRST attach applied. The
+// apex here is cb.test (the harness's branding publicOrigin), so "inside the
+// apex" means *.cb.test.
+
+await ta('a DIFFERENT bring-your-own domain RE-POINTS — the address changes and the old one is queued for release', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'typo.example.com' } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'right.example.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.changed, true);
+  assert.equal(res.body.queued, true, 'an ACTIVE instance re-points via a domain-attach intent');
+  assert.equal(res.body.domain, 'right.example.com');
+  assert.equal(res.body.replaced, 'typo.example.com', 'the response NAMES what is being let go');
+  assert.deepEqual(updateCalls, [{ id: 18, domain: 'right.example.com', releasing: 'typo.example.com' }],
+    'the new address and the release ride ONE write');
+  assert.match(res.body.message, /right\.example\.com/);
+  assert.match(res.body.message, /typo\.example\.com/, 'the sentence says the old address is going');
+  assert.deepEqual(enqueueCalls.map((c) => c.action), ['domain-attach']);
+});
+
+await ta('a re-point onto a PLATFORM-RESERVED name is refused — the first attach guard, unweakened', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'typo.example.com' } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'cb.test' });
+  assert.equal(res.status, 400, res.raw);
+  assert.equal(res.body.error.code, 'domain_reserved');
+  assert.equal(updateCalls.length, 0, 'nothing was written - the old address still stands');
+});
+
+await ta('a re-point INSIDE the platform apex is refused as a squat (task 1002704) — except this slug own default', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'typo.example.com' } });
+  const squat = await post('/provisioning/instances/18/domain', { domain: 'someone-else.cb.test' });
+  assert.equal(squat.status, 400, squat.raw);
+  assert.equal(squat.body.error.code, 'domain_reserved');
+  assert.equal(updateCalls.length, 0);
+
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'typo.example.com' } });
+  const own = await post('/provisioning/instances/18/domain', { domain: 'spike.cb.test' });
+  assert.equal(own.status, 200, own.raw);
+  assert.deepEqual(updateCalls, [{ id: 18, domain: 'spike.cb.test', releasing: 'typo.example.com' }],
+    'falling back to the assigned default still releases the BYO address it left');
+});
+
+await ta('a re-point onto an address ANOTHER project holds is a truthful 409 domain_taken', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'typo.example.com' },
+    holder: { id: 99, slug: 'other' } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'taken.example.com' });
   assert.equal(res.status, 409, res.raw);
-  assert.equal(res.body.error.code, 'domain_already_set');
-  assert.equal(res.body.error.details.current, 'old.cloudbongos.com', 'names the current address');
+  assert.equal(res.body.error.code, 'domain_taken');
   assert.equal(updateCalls.length, 0);
 });
 
+await ta('moving OFF the platform-assigned <slug>.<apex> queues NO release — that name is the platform own (ADR 0181)', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cb.test' } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'mine.example.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.replaced, null, 'the assigned default is never released - the revive path re-uses it');
+  assert.deepEqual(updateCalls, [{ id: 18, domain: 'mine.example.com', releasing: null }]);
+});
+
+await ta('a re-point on a REQUESTED instance records without an intent, and releases NOTHING — it never stood up', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'requested', domain: 'typo.example.com' } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'right.example.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.queued, false);
+  assert.equal(res.body.replaced, null,
+    'nothing ever wrote an A record for the address it is leaving - parking that name would CREATE a junk record, not release one');
+  assert.deepEqual(updateCalls, [{ id: 18, domain: 'right.example.com', releasing: null }]);
+  assert.deepEqual(enqueueCalls, [], 'nothing to re-assert on an instance that has not stood up');
+});
+
+await ta("an ERROR instance DOES release — a failed standup is frequently a PARTIAL one that already wrote the record (ADR 0181)", async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'error', domain: 'typo.example.com' } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'right.example.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.replaced, 'typo.example.com');
+  assert.deepEqual(updateCalls, [{ id: 18, domain: 'right.example.com', releasing: 'typo.example.com' }]);
+});
+
 await ta('REQUESTED instance: domain records with NO intent — the provision run wires it', async () => {
   reset({ inst: { owner_builder_id: 7, slug: 'fresh', status: 'requested', domain: null } });
   const res = await post('/provisioning/instances/18/domain', { domain: 'fresh.cloudbongos.com' });
   assert.equal(res.status, 200, res.raw);
   assert.equal(res.body.queued, false);
-  assert.deepEqual(updateCalls, [{ id: 18, domain: 'fresh.cloudbongos.com' }]);
+  assert.deepEqual(updateCalls, [{ id: 18, domain: 'fresh.cloudbongos.com', releasing: null }]);
   assert.equal(enqueueCalls.length, 0, 'provision will wire it — no separate intent');
 });
 
@@ -310,6 +422,43 @@ await ta('a fresh create with a domain is untouched (the domain is stored at cre
   assert.equal(res.body.domain_ignored, undefined);
 });
 
+console.log('\nPOST /provisioning/instances/:id/domain — the write is throttled per builder:');
+
+await ta('the re-point write is rate-limited on the BUILDER, so one owner cannot spend the platform-wide DNS budget', async () => {
+  // A re-point QUEUES an address the runner later releases with a call against the
+  // SHARED control-plane Cloudflare token, so an unthrottled owner spends a
+  // platform resource, not merely their own. Keyed on the builder, not the IP:
+  // per-IP starves co-located builders while an attacker rotates IPs.
+  limiterMax = null;                       // the route's own number, whatever it is
+  const limited = express();
+  limited.use(express.json());
+  limited.use((_req, res, next) => {
+    res.fail = (code, opts, details) => {
+      const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+      res.status(status).json({ error: { code, ...(typeof opts === 'object' ? opts : {}), ...(details || {}) } });
+    };
+    next();
+  });
+  limited.use('/api/bongos', provisioningRoutes());
+  const srv = limited.listen(0);
+  await new Promise((r) => srv.once('listening', r));
+  const at = `http://127.0.0.1:${srv.address().port}/api/bongos`;
+  try {
+    reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'typo.example.com' } });
+    let sawLimit = false;
+    // well past any sane cap for a human correcting one typo
+    for (let i = 0; i < 60 && !sawLimit; i++) {
+      const res = await postTo(at, `/provisioning/instances/18/domain?i=${i}`, { domain: `h${i}.example.com` });
+      if (res.status === 429) {
+        sawLimit = true;
+        assert.equal(res.body.error.code || res.body.error, 'rate_limited');
+        assert.ok(i > 0, 'a first call is never throttled');
+      }
+    }
+    assert.ok(sawLimit, 'the route must shed a flood — an unthrottled owner can queue unbounded DNS work');
+  } finally { srv.close(); limiterMax = 10_000; }
+});
+
 console.log('\nPOST /provisioning/instances/:id/github-app — accepts the newly-addressed instance:');
 
 await ta('domainless instance still 409s domain_required; once addressed, the manifest mints', async () => {

package/tests/public_landing_projects.mjs

@@ -95,11 +95,15 @@ test('every truthful refusal the API can give is mapped to human copy, never swa
     'not_teardownable',       // teardown refused for the real state
     'bad_domain',             // malformed hostname
     'domain_taken',           // another instance already answers there
-    'domain_already_set',     // re-pointing is not this surface
+    'domain_reserved',        // the platform's own name, or a squat inside its apex
     'domain_not_attachable',  // mid-flight/torn-down states refuse truthfully
   ]) {
     assert.match(body, new RegExp(code), `the page must handle '${code}' explicitly`);
   }
+  // retired with the re-point (task 1003237): the server no longer sends it, so a
+  // branch for it would be copy the founder can never reach
+  assert.doesNotMatch(body, /domain_already_set/,
+    'the refusal the re-point removed must not linger as dead copy');
 });
 
 test('a domainless instance gets an honest no-address state', async () => {