@bongos/core 1.19.401 → 1.19.403

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.401",
-  "core_contract": "1.19.401",
-  "source_commit": "494fdf45a93c1c44dc65ff546a878dc438a41795",
+  "core_version": "1.19.403",
+  "core_contract": "1.19.403",
+  "source_commit": "59efd083f3bfbf52a8da49727c16d3487acd0717",
   "source_ref": "HEAD",
-  "built_at": "2026-08-28T19:42:36.030Z",
+  "built_at": "2026-08-28T20:35:12.999Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 349,
+    "docs_redacted": 350,
     "agent_docs_stubbed": 23,
-    "functional_verbatim": 1661,
+    "functional_verbatim": 1662,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2033,
-  "tree_sha256": "69d6fb41fcd2f221fa41f7bf0758ce822d237a17025fd14716a2d590584e8470",
+  "file_count": 2035,
+  "tree_sha256": "ff41a19b163222f7501bcc6e1b9f9a8fa612c43aff15a0af618ac8527f19cdaa",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -372,7 +372,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "1edab64d6ab54ccf2e4605b0272f7f692fd6c020c24415a0abc9fdb1d2ac24fb"
+      "sha256": "cbe0ba674f055e30fea6c74dd1fd9eaed2333219610b76d3dcada33bce3939b6"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1499,10 +1499,15 @@
       "mode": "0000644",
       "sha256": "999c2eb382b51317a4f1fbf7a615855be7baeded04cf03c4e1a411b2f98386cd"
     },
+    {
+      "path": "docs/adr/0200-re-point-a-bring-your-own-domain.md",
+      "mode": "0000644",
+      "sha256": "d73c7f4ebaf18bf81e461532144422b8d343698c50964687c52b13301af42c66"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "823b42a6811419c2a89e3b09e7049ca0e3eea5bcafb87e463e7d7762ae7cd9e4"
+      "sha256": "870abce88d6282c54c7818ba9d643639c866704a8f7e982afb0717c39c6dc9a0"
     },
     {
       "path": "docs/api-reference.md",
@@ -1512,7 +1517,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "3d48a3120bc31be0516645a8d0f730042678b921108f94d548f4e37adfa5aa88"
+      "sha256": "be970356181398e6f11fc8cad05c2190091aeb06cf5ceaf577a8a6bb86f0b375"
     },
     {
       "path": "docs/architecture.md",
@@ -1537,12 +1542,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "faaea55cd3cce42b2a8b083eb9b5c6431829633063ef26d228321a343c07031d"
+      "sha256": "c8ffa819bae7285b8586ae031b6589b24e64584a262cf26df8b346a30333f05d"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "9f47691c38c3acdc3f5178326c11ff591372a09d6f725b2e8c7421c08181c65f"
+      "sha256": "b0734640552c625d24ad070a830fe6bd36021830ed474cd739ab9b5fbb2eea56"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -1782,7 +1787,7 @@
     {
       "path": "docs/design/projects-hub-direction-v2.md",
       "mode": "0000644",
-      "sha256": "f5f6f96d25e308d417b3f07f74bf978287136feee6041c5cba0052110de240ba"
+      "sha256": "a6867fcaf7663cd308cc82abae779c96f7d67b1eb0011d96d31ced0e17c64c18"
     },
     {
       "path": "docs/design/projects-hub-direction.md",
@@ -4752,12 +4757,12 @@
     {
       "path": "modules/platform-identity/project-stats.js",
       "mode": "0000644",
-      "sha256": "f3d8b2ed8bc5a32dabcbdd628fd4a504a8d91e2e2ea282a2ad2c88083f88b4e8"
+      "sha256": "2e898799632a2b5c2ead9cb44fa0b8029fcb6d217f7d5f26c8a39b34c75bbea7"
     },
     {
       "path": "modules/platform-identity/routes/my-projects.js",
       "mode": "0000644",
-      "sha256": "fc948963cef6f7ef71b488cc5627310b6b217f3f62e13030b4da42a08e92796c"
+      "sha256": "7e8c7b272f273719329ba5755dc88fe2a1359c1281150162ed9396512db33b3b"
     },
     {
       "path": "modules/platform-identity/routes/profile.js",
@@ -4767,7 +4772,7 @@
     {
       "path": "modules/platform-identity/routes/projects.js",
       "mode": "0000644",
-      "sha256": "fc7be0e85b029ae4cd252ad9978bf64d481b743d1fc99143cf8c6bb250636bda"
+      "sha256": "0e1aa7209b6442e1cc363b9a661da28c48776efd4c100f0b8e701cb96925be22"
     },
     {
       "path": "modules/platform-identity/routes/public-profile.js",
@@ -4854,6 +4859,11 @@
       "mode": "0000644",
       "sha256": "99b0e59f165255643ba4d2a9e9c200985a7d4b162d93c1d169b0f738e9e09c77"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_012_domain_repoint.sql",
+      "mode": "0000644",
+      "sha256": "74c46df38eab2b8c0f59b2da423691b170e3e85a7ec9857fad239b912bca99f4"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -4872,7 +4882,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "e2b1f1a1f7146a1a76d5704671b0418026d4d6063e4c267eef47f9e618e5addb"
+      "sha256": "82c2502ad0c535a1faa43b167735d988527b54149778e5e796c1306139e760f9"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -4882,7 +4892,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "2b15cecbbd0cf685398248ba754519b2a1f70ce808684f7c5152361eee57d230"
+      "sha256": "bdf000da67e09dfa3bc394d7c3d7dbbd9e65fe4a653cc558291c5806f2ca46ca"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -5222,7 +5232,7 @@
     {
       "path": "modules/ui-design/kit/fixtures/featured.json",
       "mode": "0000644",
-      "sha256": "a5e075d343bc7d29e69896ba90de2fc96e2aeb5765f09e193cb26926b4ae697d"
+      "sha256": "f5d843cd881778afa835686ddc2adac253e705b37be063ce96892517436b6413"
     },
     {
       "path": "modules/ui-design/kit/fixtures/leaderboard.json",
@@ -5237,7 +5247,7 @@
     {
       "path": "modules/ui-design/kit/fixtures/my-projects.json",
       "mode": "0000644",
-      "sha256": "ff0195be4b19616f30fccde0dc980a47329587124bfac08158b1e8741386fc1b"
+      "sha256": "05655ce99323e2174446477a4b3fbb8611f9e1a2a34a7f7b5bd947e9e661c593"
     },
     {
       "path": "modules/ui-design/kit/fixtures/progress.json",
@@ -5272,7 +5282,7 @@
     {
       "path": "modules/ui-design/kit/serve.js",
       "mode": "0000644",
-      "sha256": "f1d349f681525b78abb47df98bf26a1f7470a72b00b8d5696d5453bb936647c8"
+      "sha256": "de42b4d4f908ebdf9b3a181b54d09d8541124a0d35a05d29ddea24233ecca641"
     },
     {
       "path": "modules/ui-design/module.json",
@@ -5317,12 +5327,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ea047a4dacaa121f8dcd2364ed4662afc6481bf3621b4b0d97177850323e9e95"
+      "sha256": "05858abe161f6ca2a6b106547449d3848028e58d99061ea02680cfa68acdea9f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "20b5e0d78a663b2f4b4f971fef83d5c6dcf6f29ef1bab85047bf2db1a780fac3"
+      "sha256": "699f703451266b17963d5de5f9e4106f3f2fe21afc59019cb8f05f09abd4d118"
     },
     {
       "path": "public-docs/index.html",
@@ -5562,7 +5572,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "c501e37928da15145ff50aeeaa2cc4a65da4be1ea5b46552f1513890d1839a79"
+      "sha256": "d6eb8b2d965d528f1c0af9366ff93902afae3edacf2207526a074827a8913cfd"
     },
     {
       "path": "public-landing/assets/verro-medallion.png",
@@ -5672,17 +5682,17 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "6f47097b83fa5c731e7376b821d0169983693ee4b9afc2e36f1f1568dab3386b"
+      "sha256": "2ddf92250375f1a9c2c15328feb0d3e7eeb95670f329eb08d0e6b3a8a1c6b0e0"
     },
     {
       "path": "public-landing/projects.probes.json",
       "mode": "0000644",
-      "sha256": "575c26d518572918be76a2f9be72b69ad4b9bbf00338cb35f99b54e8b62cda5d"
+      "sha256": "87dfa686a4c794e1dcdee05829c07a6849df91f1fbc6b0cd2ca9b3cdaa548235"
     },
     {
       "path": "public-landing/projects.states.json",
       "mode": "0000644",
-      "sha256": "3635ff9375079be30e515358f118895119be53aeb60296cf8dd0d6f73b1b3ed1"
+      "sha256": "a4b418dc93d4f24c6a6f5312801b414beef576eae6eb070a4371507a2a876f26"
     },
     {
       "path": "public-landing/terms.html",
@@ -6447,7 +6457,7 @@
     {
       "path": "scripts/gds/provision-net.js",
       "mode": "0000644",
-      "sha256": "6ace73f27f37f5ec4807d92203dab42e11e114b1f87f2384f227be3f5440b490"
+      "sha256": "18c03ffa9cb4ec417ca527928a2146fa72630eada173c7e207dbad513af70acc"
     },
     {
       "path": "scripts/gds/provision-repo.js",
@@ -6457,12 +6467,12 @@
     {
       "path": "scripts/gds/provision-units.js",
       "mode": "0000644",
-      "sha256": "5e65be1f313f387cbf97116c678b54cbf4616e0580a42afc98860982f4f14bfe"
+      "sha256": "14ef8b2a3581c93b27983d0e566b5cc317d1a5d3b6367ff8eb7ffef7e0b3f54d"
     },
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "abb85df9aab1f21a09a85fd430acca0261a1602a4b23ad0048e159aeda33f22e"
+      "sha256": "2fdb42802ae0bbefe79427d7e9a5d5967a89cb2ce757b2df5f49e9da25e60703"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -7337,7 +7347,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "fb406cb394cef97523266f7603559314da44839a80d7c9d29b21e3159f8b1f23"
+      "sha256": "711b77fdf5d91c9b90985f8693765776cb5acfe022bd3d70e4b2ca440c5a70ed"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7922,7 +7932,7 @@
     {
       "path": "tests/cosmos_token_contrast.mjs",
       "mode": "0000644",
-      "sha256": "f0622c3c880e39eaa715122748aead92d746ccfa193080a8e09d24aae713082a"
+      "sha256": "6e13a6d5a059684d98e350075f59b7180544bf72509dd82cc0d89b5963fe7014"
     },
     {
       "path": "tests/cost.mjs",
@@ -9337,7 +9347,7 @@
     {
       "path": "tests/project_stats.mjs",
       "mode": "0000644",
-      "sha256": "6bd78c47b6dbbdd81f862df8afdc0b514e27f0ffb71d14161ac8feb19f9fbe19"
+      "sha256": "8cb5533aca29727c317450cf5730f309cdb5540265f8c150a8ea2242c7ef5656"
     },
     {
       "path": "tests/project_visibility_db.mjs",
@@ -9347,12 +9357,12 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "3fc8fe5486a6eb86287a8d93262d6c55d7e8f166d4fab4c6a95e5fc65cd1a5ad"
+      "sha256": "56e5e0968838a82984bf46923349e5dc9caa8e9437cf68dd910a67445689c1ef"
     },
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "462839095ba235057036b2e05b40f3214b7d18b2714f4ce6d5f1e05a207ad37b"
+      "sha256": "b99f0b272d40f655726597ca14546fda9799130522cbae70ce663094d8bd6efd"
     },
     {
       "path": "tests/promote_goal_id.mjs",
@@ -9367,7 +9377,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "0fc6c6626b43458c2e065322bec5a2ecd87e50a44abd2838d81ff0f0b6abeae7"
+      "sha256": "32f6a64ed1da1fcfe703f16ee171592262268b24eb833a171d1b5e289ad3e804"
     },
     {
       "path": "tests/provision_restart.mjs",
@@ -9382,12 +9392,12 @@
     {
       "path": "tests/provisioning_default_domain.mjs",
       "mode": "0000644",
-      "sha256": "1403cc764270e796b985cc0dc38cbf498001e4726b2bfe53020cc55d12d1ca66"
+      "sha256": "735fc1f7f3cc4b0215a23706f50ef33301cf784fb45dda096e664d306ae47565"
     },
     {
       "path": "tests/provisioning_domain_attach.mjs",
       "mode": "0000644",
-      "sha256": "856f434c8e1a8e8ad549c81689f1bbe27ff555e4ba08f9b485c3e9d46838a4a5"
+      "sha256": "62ea8ffc2c21c351289dc7f96cab38fcd5824afba1fed0df7a545cd5df9e396c"
     },
     {
       "path": "tests/provisioning_github_app_routes.mjs",
@@ -9442,7 +9452,7 @@
     {
       "path": "tests/public_landing_projects.mjs",
       "mode": "0000644",
-      "sha256": "232ac3f8206850957852c5d855f72cfc94f272ef8e0493410376903e2ae06176"
+      "sha256": "6b03476a51dc69314415038b4648ff433bf1f7a811523f9e1ac0e8bffc2faf6c"
     },
     {
       "path": "tests/public_mirror_export.mjs",

package/clients/bongos-client/index.d.ts

@@ -299,7 +299,7 @@ export interface PostProjectsInviteRequest { client_id: string; github_login: st
 export interface PostProjectsRequest { origin: string; name: string; tagline?: string; description?: string; art_url?: string; type?: string }
 export interface PostProjectsResponse { project: unknown }
 export interface PostProvisioningInstancesIdDomainRequest { domain: string }
-export interface PostProvisioningInstancesIdDomainResponse { ok: boolean; changed: boolean; queued: unknown; domain: unknown; message: unknown }
+export interface PostProvisioningInstancesIdDomainResponse { ok: boolean; changed: boolean; queued: unknown; domain: unknown; message: unknown; replaced?: unknown }
 export interface PostProvisioningInstancesIdForceTeardownResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; superseded: unknown; message: unknown }
 export interface PostProvisioningInstancesIdGithubAppRequest { account?: string }
 export interface PostProvisioningInstancesIdGithubAppResponse { state: unknown; account: unknown; post_url: unknown; personal_url: unknown; org_url: unknown; org_login: unknown; manifest: unknown; redirect_url: unknown; expires_at: unknown }

package/docs/adr/0200-re-point-a-bring-your-own-domain.md

@@ -0,0 +1,105 @@
+# ADR 0200 — A mistyped bring-your-own domain can be corrected, the address it leaves is released to a blackhole, and the attach leg stops regenerating web.env from the row
+
+- **Status:** accepted
+- **Date:** 2026-08-28
+- **Task:** [task 1003237](https://cloudbongos.com/builders#/task/1003237) (goal 1000058 — the non-cloudbongos project lifecycle)
+- **Relates to:** ADR 0111 (provisioning trust boundary), ADR 0190 (settings-apply in-place env patch — the hazard this ADR pays off), ADR 0181 (teardown state gate + address retention — the half this one does *not* touch), ADR 0133 (GitHub App Manifest cred placement), task 1002692 (the attach route), task 1002704 (the in-apex squat rule), task 1002897 (teardown never reclaims the address), task 1002720 (F16/F19 truthfulness), idea 1000842 (the `webEnvBody` hazard)
+
+## Context
+
+`POST /provisioning/instances/:id/domain` refused a second address with a deliberate `409 domain_already_set`, and its comment recorded the policy in as many words: *"A genuine BYO address stays un-re-pointable, as before."* The redesign direction §8 said the opposite — *"attach/change stays for custom domains."* The pre-UAT hub review (2026-08-24) filed the contradiction as a decision rather than a UI tweak, because rendering a field that always 409s would be worse than rendering none.
+
+The founder-facing shape of the gap: a founder types their domain into the create wizard, mistypes one character, and the project stands up permanently addressed at a hostname they do not own — with no path back except tearing the project down and starting over.
+
+Three things made this more than a route edit.
+
+**The address is held in more than one place.** ADR 0181 §2 decided that a *torn-down* project keeps its `port` **and** its `domain`, because the two are one coupled decision: release the port while a stale Caddy block still answers, and a later instance handed that port begins serving under the torn-down project's hostname — one owner's project under another owner's name. A re-point is the opposite case (the owner has *asked* to leave the address), so it must release, and releasing means knowing what "release" consists of.
+
+**The runner could not see what was left behind.** The web tier overwrites `domain` the instant it records the new one, and the runner — the only tier holding a DNS token (ADR 0111 §2) — reads the row. Without a carrier, an abandoned hostname's A record would sit pointed at platform infra with nothing left in the row to say so.
+
+**`domainAttachInstance` re-wrote `web.env` from the template.** ADR 0190 §"Why the in-place patch is load-bearing" named this: `webEnvBody(inst, …)` regenerates the file **from the row**, and the row knows neither the OAuth client id/secret `placeManifestCreds` fetched (ADR 0133), nor the App private key, nor the federation block. Today it is masked by wizard order — the address is attached *before* the GitHub App exists, so there is nothing yet to blank. **A re-point is not masked.** It runs on a project the founder is already signed in to, so the same move would break sign-in on the exact project they had just corrected. This was the hazard that made the task's scope "fix it here or depend on the fix."
+
+## Decision
+
+### 1. A bring-your-own address may be re-pointed, under the guards the first attach already applied
+
+The `409 domain_already_set` is gone. A re-point runs the same gauntlet a first attach runs, in the same order, with no clause added and none weakened:
+
+- `normalizeHostname` must yield a real multi-label host (`400 bad_domain`);
+- `isReservedHostname` refuses a platform-reserved name (`400 domain_reserved`);
+- inside the platform apex, the only address an instance may hold is its own `<slug>.<apex>` — the task-1002704 squat rule (`400 domain_reserved`);
+- `getInstanceByDomain` refuses an address another instance holds (`409 domain_taken`);
+- `DOMAIN_ATTACH_FROM` still gates on state, and already admitted `active` (`409 domain_not_attachable`).
+
+The platform-assigned `<slug>.<apex>` is **not** re-pointable in the sense that matters: it is the platform's own name for that slug, it cannot be pointed anywhere else, and the squat rule is what enforces that. What changes is only that a *founder-supplied* address is no longer permanent.
+
+An `active` instance re-points through a `domain-attach` intent — the same intent, because the wiring is the same wiring, and `DOMAIN_ATTACH_FROM` already admitted `active`. A `requested`/`error` instance only records it; its next provision run wires the domain itself.
+
+### 2. The address it leaves is released — parked at a blackhole, not deleted
+
+`provisioning_012` adds `released_domains text[]`, written in the **same statement** as the new domain (`updateInstanceDomain`'s third argument). A re-point that recorded the new address but crashed before queueing the old one would leave a hostname aimed at platform infra with nothing in the row to say so; one statement makes that unrepresentable.
+
+An **array**, not a scalar: a founder who mistypes once can mistype twice, and a scalar would silently drop the middle address. The runner drains the whole list and empties it (`clearReleasedDomains`).
+
+Only a **BYO** address is ever queued, and only from a state that actually stood up (`DOMAIN_RELEASE_FROM = {error, active}`). Two exclusions, for two different reasons:
+
+- The platform-assigned `<slug>.<apex>` — the upgrade path task 1002704 already allowed — queues nothing: that name is the platform's own, and the revive path re-uses it (ADR 0181 §2).
+- A `requested` instance queues nothing either: it has never stood up, so nothing ever wrote an A record for the address it is leaving. Parking that name would **create** a junk record in the owner's zone rather than release one — the inverse of the leak this exists to close. An `error` row is frequently a *partial* standup that did write it (ADR 0181 §1), so it counts.
+
+The web tier decides both, because it is the tier that knows the apex and the lifecycle state.
+
+**The queue is capped (`MAX_RELEASED_DOMAINS`), and the route that fills it is throttled.** The runner drains this list **synchronously, one <redacted> call per entry**, and every re-point is a write an authenticated owner can repeat — `normalizeHostname` checks a hostname's *shape*, never that it exists. So an uncapped array is a resource-exhaustion vector against a **platform-wide** resource (the control plane's DNS token and rate limit, and the drain loop itself), not merely against the owner's own project. Two bounds, at different layers:
+
+- **The cap is enforced in `updateInstanceDomain`'s own SQL**, not trusted from the caller: past the bound the append is dropped, keeping the entries most likely to name a hostname the platform really wired. Dropping is the deliberate failure mode; growing without bound is not.
+- **The route carries a per-builder limiter** (the task-1002898 slug-check shape — keyed on the builder, since per-IP starves co-located builders while an attacker rotates IPs). It had none before: until this task the route could only *record* an address, and recording had no downstream cost.
+
+Release is **a repoint to `192.0.2.1`, not a delete.** This is the shape `scripts/gds/box-infra.js` already proved for a torn-down box (idea 309 → task 1234), adopted here for its two reasons:
+
+- **No NXDOMAIN window.** Deleting a name opens a gap that resolvers negative-cache for the zone's SOA neg-TTL (~30 min on Cloudflare, not builder-editable), so a client that queried mid-gap stays broken long after. A name that always resolves — to a host RFC 5737 guarantees is never routable — has nothing to negative-cache.
+- **No new hook contract.** `BOX_DNS_HOOK` is an operator-supplied script and the core cannot assume it implements a delete mode. A release expressed as an UPSERT needs only the contract every hook already implements.
+
+Two halves of the address release themselves and need no separate step, which is worth writing down because it is why this leg is as small as it is: the Caddy snippet is per-**slug** and always carries the *current* domain, so the same write that wires the new host takes the old vhost away; and `/provisioning/tls-check` answers from the row, so on-demand TLS stops being minted for the old name the moment the row moves.
+
+### 3. Both legs that wire a domain drain the queue
+
+`domainAttachInstance` owns an `active` instance. It deliberately no-ops for anything else ("provision owns pre-active domains"), so a re-point on a `requested`/`error` project would queue a release nothing ever drained — and an `error` row is frequently a *partial standup* that already UPSERTed the address it is now leaving (ADR 0181 §1). `provisionInstance` therefore drains the same queue after its own DNS step, through the same `releaseAbandonedDomains` helper. One implementation, two callers.
+
+### 4. The release is best-effort, and the queue is the retry
+
+Every queued address is attempted — one host whose zone the token cannot reach must not strand the others behind it — and the queue is emptied only when all of them landed. Re-parking an address already at the sentinel is an idempotent UPSERT, so retrying the whole list costs nothing but the call. A hook that fails returns `ok: true` with `releaseFailed` naming the first host that did, and **does not** clear the queue — so the next attach retries it. A release that failed must never fail a re-point that has already landed; the founder's project is answering at its new address, and re-pending the intent would restart that work four more times and end by stamping an `error_note` over a correction that worked. With no hook configured at all, the outstanding manual step is **logged by name** rather than swallowed (the F16 rule).
+
+### 5. `domainAttachInstance` patches `web.env` in place
+
+The leg now reads the file and patches **only** the four `<PREFIX>_*_ORIGIN` lines through `upsertEnvVars` — the `settingsApplyInstance` shape (ADR 0190 §2), with the same refusals:
+
+- a dry run **plans** the patch and writes nothing, rather than writing a synthetic body that would read as the exact overwrite this change exists to prevent;
+- an unreadable or empty file is **refused** (`ok: false`), never patched — four origin lines written over a missing `PORT`/`PGDATABASE` would take down an instance that is *already serving*.
+
+`originEnvVarsFor(inst)` (pure, in `provision-units.js`) is the domain-dependent half of `webEnvBody`, factored out so the two can never drift. `webEnvBody` remains the right thing for a **first** provision, where there is no file yet and nothing to preserve.
+
+This closes idea 1000842 for the attach path. `placeManifestCreds` still writes a full `webEnvBody` — correctly, since it is the tier that *holds* the creds it is placing.
+
+### 6. A changed address clears the liveness overlay
+
+`last_verified_at`/`last_verified_up` are a verdict on an **address** (task 1002696). Carrying them across a re-point would let the card say *"Answering at `right.example.com` — last answered 2 minutes ago"* when only `typo.example.com` was ever probed. Both are set to NULL when — and only when — the domain actually changes, guarded in SQL so an idempotent re-record can never blank a good probe. NULL means "never probed", which is the truth for a name nothing has asked yet; the sweep re-probes within minutes.
+
+### 7. The card gains a third door, and says what it costs
+
+`canAttachDomain` no longer excludes an addressed project. The fold now reads its label from what the project is actually addressed as: **Give it an address** (none), **Use a domain I own** (on the platform-assigned name), **Use a different domain** (on a BYO name), and the F19 **Try the address again** door keeps its louder, self-opening shape. The correction door pre-fills the current address — a typo is corrected by editing one character, not by retyping the whole hostname — and carries one line under the button: *"Changing it lets `<host>` go — it stops answering for this project."* Letting the old address go is said where the decision is made, not discovered afterwards.
+
+## Consequences
+
+- **A mistyped domain is no longer a reason to tear a project down and start over** — the founder-facing point of the whole task.
+- **The `webEnvBody` hazard is paid off on the attach path**, which also makes the *first* attach safer than it was: it was only ever masked by wizard order, and nothing enforced that order.
+- **An abandoned address stops reaching platform infra.** It resolves to a dead end rather than 404ing off the platform's own edge, and it is immediately re-claimable by any instance, since the uniqueness check reads the row.
+- **The parked record is left in the founder's zone.** A true `DELETE` is available to an operator through the hook's own `BOX_DNS_DELETE` mode; the platform does not reach for it, for the neg-TTL reason above. If a founder wants the name gone entirely, that is a change in their own DNS.
+- **[Task 1002897](https://cloudbongos.com/builders#/task/1002897) (teardown never reclaims the address) can reuse this seam** — `dnsReleaseEnv` + `DNS_BLACKHOLE_IP` are exported and shape-agnostic. It still owns the questions this ADR does not answer: whether a torn-down address 404s or serves an honest "this project ended" page, and whether the port is released with it. **ADR 0181 §2's retention decision is untouched here**: a torn-down project still keeps its address, deliberately, because the revive path re-uses it.
+- **A re-point costs a service restart**, like every other change that reaches a running instance's memoized branding pack (ADR 0190 §3).
+- **The cap can, in principle, drop an address.** Only past `MAX_RELEASED_DOMAINS` queued releases on one instance — a state a founder correcting a typo cannot reach, and one the route's limiter makes slow to reach deliberately. The dropped hostname keeps its record until an operator removes it; that is strictly better than letting one owner queue unbounded work against the shared token.
+
+## Alternatives considered
+
+- **Amend direction §8 and make the card say the address is fixed once set.** The task's other branch. Rejected by the owner: a founder who mistypes a domain would have no path back but teardown, which loses the project's database and repo wiring for a one-character error.
+- **Delete the old A record instead of parking it.** Cleaner in the founder's zone, but re-opens the NXDOMAIN negative-cache window the box lane already learned to avoid (idea 309), and assumes a hook mode the core cannot guarantee.
+- **Sequence this task behind 1002897.** The owner's decision allowed either order. Carving the release leg here was chosen because the hazard in §4 is on *this* path and a re-point that leaked its old address would ship a known leak in the name of ordering.
+- **A `previous_domain` scalar instead of an array.** One column less, but it silently drops the middle address when a founder corrects twice before the runner drains — the exact user this feature is for.

package/docs/adr/README.md

@@ -287,5 +287,6 @@ This keeps the decision history honest and traceable.
 | 0197 | [**The ui-design module: design is a platform capability; the instance owns its world** ([task 1003324](https://cloudbongos.com/builders#/task/1003324), goal 1000080 — the first of the five ui-design tasks scoped with the owner 2026-08-28). ADR 0081 put the tool-agnostic design layer in core as Cloud Bongos's machinery; the whole-frontend pass then built the chrome world on it and left the three things a builder needs — the contract and its tooling, a way to look before shipping, the taste and the looks — scattered across core, scratchpads and personal skill installs. The owner's reframing: this is NOT the front door, it is a PLATFORM capability every builder on every instance gets, and Cloud Bongos's front door is its first customer, not its owner. Decisions: (1) `modules/ui-design/` is a default-on core-domain module beside grading/economy/memory — it ships METHOD, never a world; (2) ADR 0081's layer moves in (`src/ui/adapters/` → `adapters/`, the three `scripts/gds/` CLIs → `scripts/`, `docs/design-contract.md` → `docs/`) while `config/design-tokens.*`, `design-sources.json` and `DESIGN.md` STAY out as the host boundary — the ADR 0062 §7 split written for design; (3) declaration-only: three contributed skills, no routes/port/migrations, so `GET /modules` lists it and disabling it withdraws the skills and touches no served surface — and NO `ui` discipline yet, because the hall settings page and newcomer-restock don't know it; (4) the `/design` playbook is finally written — `discipline-modes.json` had routed `ui` tasks to a skill that did not exist since task 1267; (5) the module CLAUDE.md draws the platform FLOORS (the Fifteen Rule, the dark twins, no page `:root`, the 24px floor, AA in both modes, the Kill Switch) against the instance's WORLD (its packs + DESIGN.md), tightenable and never loosenable; (6) the CLIs keep thin `scripts/gds/` shims — the form `claude-materialize` rewrites to `bongos exec` on a packaged core, the form `doc-cli-guard` resolves, and the carve precedent — while inside the module they walk up from `__dirname` instead of the computed `require()` into `src/instance-config.js` the static boundary scanner could not see; (7) three reserved homes, each README'd for the task that fills it, the vendoring policy pointed at the skills task's ADR; (8) `public-landing` keeps its own key. Rejected: leaving the layer in core; moving the token files in; the module owning the front door; module-hosted CLIs with no shims; contributing the `ui` discipline now.](<redacted>.md) | modules / design system |
 | 0199 | [**An unreachable ACTIVE project gets a restart of its own, not a re-provision — and the restart never claims the verdict its probe cannot reach** ([task 1003238](https://cloudbongos.com/builders#/task/1003238), goal 1000058). The liveness overlay (task 1002696) could report a project unreachable while its status stayed `active`, and that reading came with no action: `PROVISION_ENQUEUE_FROM` deliberately excludes `active` (task 1002691 — a blind re-enqueue left a stale provision intent blocking the owner’s own teardown), so the card’s existing *Try again* / *Bring it back* doors 409 on an active project by construction, and `settings-apply` — the only leg that runs from `active` — refuses unless a stored value actually changed, which is exactly the case a stuck project does not have. Decisions: (1) a `restart` intent (migration `provisioning_011`, `INTENT_ACTIONS` in lockstep) behind `RESTART_FROM = {active}` + `RESTART_SHAPES = {co-tenant, standalone}`; the web tier still only ENQUEUES (ADR 0111 §2). (2) `restartInstance` is `settingsApplyInstance` MINUS the env patch — one `systemctl restart`, then the same patient healthz budget; it reads and writes no file, so ADR 0190’s in-place-patch hazard cannot arise. (3) The `probeIsVerdict` narrowness carries over and is load-bearing: the liveness sweep probes the PUBLIC `https://<domain>/healthz` while the runner verifies LOOPBACK, so a project can answer here while DNS/Caddy/TLS is what is broken — no up-verdict is written for a domained instance, and the event says “answering on the box; whether its public address answers is for the next sweep to say” rather than a sentence the still-`unreachable` card would contradict. (4) A project that stays down is `ok:true` — the restart RAN; re-pending it to the attempt cap would restart a broken project four more times and end by stamping an `error_note` over the owner’s own action. Only a THROW returns `ok:false`, and it returns rather than throws because the drain loop’s catch would relabel a merely-unreachable instance `error` (ADR 0190 §2). (5) `enqueueRestart` is idempotent against its own kind in EITHER open state — where it differs from the settings push, which must refuse to ride a RUNNING sibling that may have read the row already; a restart carries no payload, so one already running IS the ask. (6) A pending restart joins the teardown’s supersede list, more sharply than its siblings since the owner reaches for Restart exactly when they might next give up and delete. (7) The door shows only at `active && last_verified_up === false && shape !== dedicated && !open_intent`, mirrored on card and manage page; `null` (never probed) is NOT `false` and raises no door. (8) Every refusal names the action that IS available there, the state gate is checked before the shape gate, and no branch promises a duration (F16). The `INTENT_ACTIONS`↔migration set-equality assertion moved to the NEWEST migration’s test — pinned to 010 it would fail for every future action. Rejected: widening `PROVISION_ENQUEUE_FROM`; re-sending unchanged settings to borrow their restart; reporting a loopback pass as “answering again”; retrying a restart that left the project down; a Restart door on every active card.](<redacted>.md) | provisioning / project lifecycle |
 | 0198 | [**Third-party skill vendoring: a scan verdict the session cannot override, a licence allowlist, a provenance sidecar, one preamble block, and no auto-update** ([task 1003321](https://cloudbongos.com/builders#/task/1003321), goal 1000080 — the second of the five ui-design tasks). Twelve design skills installed on one builder's machine were to become the `ui-design` module's vendored set. Both origins reduced to DANGEROUS under `/scan-before-install` at the default tier: `Leonxlnx/taste-skill` on one floor critical (an injection-phrase hit the panel identifies as a filename placeholder) with a caution panel; `pbakaus/impeccable` on three floor criticals and a panel that upheld shipped PostToolUse/Stop hooks written into five harness configs, a child agent spawned with permissions bypassed from a loopback HTTP route, a directive telling the model to disregard its harness system prompt, a page-embedded live-server token and an unverified remote bundle download. DECISION: the scan verdict is the gate and a session cannot override it — `dangerous` lands a rebuild spec (a GDS task), never a copy, and vendoring one anyway is an owner ADR plus a test amendment; a licence allowlist (Apache-2.0, MIT, BSD-2/3, CC-BY-4.0); a `PROVENANCE.md` sidecar with the full pinned sha; ONE preamble block (`skills/PREAMBLE.md`, byte-identical, fenced by two markers so an upstream refresh is a three-way merge) that reads the instance's world before any taste rule; `skills/vendor/<name>/` as the home because `fitness-ratchets.js` already exempts `vendor/` from the first-party budgets; the manifest stays the single declaration and `claude-materialize.js` step 1b lands a declared module skill — sidecar included — in every instance's `.claude/skills/` and withdraws it with the module; no auto-update; the playwright plugin a documented prerequisite. The roster ships EMPTY and that is the policy working: the machinery is proven by fixture (`tests/ui_design_skills.mjs`), the twelve are named in `/design` with their verdicts, two rebuild-spec tasks hold the documented functionality. Rejected: treating the placeholder hit as a false positive; scanning a fork or subtree; vendoring impeccable with the hooks stripped; `.claude/skills/` as the home; a second roster file.](<redacted>.md) | modules / design system / security |
+| 0200 | [**A mistyped bring-your-own domain can be corrected — the address it leaves is released to a blackhole, and the attach leg stops regenerating web.env from the row** ([task 1003237](https://cloudbongos.com/builders#/task/1003237), goal 1000058). `POST /provisioning/instances/:id/domain` refused a second address with a deliberate `409 domain_already_set` ("A genuine BYO address stays un-re-pointable, as before") while direction §8 said "attach/change stays for custom domains" — so a founder who mistyped one character in the create wizard was permanently addressed at a hostname they did not own, with no path back but teardown. Decisions: (1) a BYO address re-points under the guards the FIRST attach already applied — `isReservedHostname`, the task-1002704 in-apex squat rule, `getInstanceByDomain` uniqueness, `DOMAIN_ATTACH_FROM` (which already admitted `active`) — none added, none weakened; the platform-assigned `<slug>.<apex>` is un-re-pointable because the squat rule says so. (2) The address it leaves is RELEASED: `provisioning_012` adds `released_domains text[]`, written in the SAME statement as the new domain (a crash between the two would leave a hostname aimed at platform infra with nothing in the row to say so), an ARRAY because a founder can mistype twice before the runner drains. Only a BYO address is queued — the assigned `<slug>.<apex>` is the platform’s own name and the revive path re-uses it (ADR 0181 §2). (3) Release is a REPOINT to `192.0.2.1` (RFC 5737 TEST-NET-1), not a delete — the box lane’s idea-309 shape: a delete opens an NXDOMAIN window resolvers negative-cache for the zone’s SOA neg-TTL (~30 min, not editable), and an UPSERT needs only the contract every operator `BOX_DNS_HOOK` already implements. The Caddy vhost and the tls-check allow-list release THEMSELVES (the snippet is per-slug and carries the current domain; tls-check answers from the row). (4) A failed release is `ok:true` + `releaseFailed`, and KEEPS the queue so the next attach retries — a release that failed must never fail a re-point that already landed. (5) `domainAttachInstance` now patches web.env IN PLACE via `upsertEnvVars`/`originEnvVarsFor`, closing the ADR 0190 §2 hazard (idea 1000842) on this path: the template re-write regenerated the file FROM THE ROW, blanking the OAuth creds `placeManifestCreds` placed, the App private key and the federation block — masked for a FIRST attach by wizard order, and NOT masked for a re-point, which runs on a project the founder is already signed in to. Dry-run plans; an unreadable/empty file is refused, never patched. (6) A CHANGED domain clears `last_verified_{at,up}` — the overlay is a verdict on an ADDRESS (task 1002696), so carrying it would let the card claim the new name "last answered 2 minutes ago" when only the old one was ever probed (F16). (7) The card gains a third door — *Use a different domain*, pre-filled so a typo is edited not retyped — and says what it costs where the button is. Rejected: amending direction §8 to call the address fixed; deleting the old record; sequencing behind task 1002897; a `previous_domain` scalar (drops the middle address).](<redacted>.md) | provisioning / project lifecycle |
 
 > ⚠️ **Numbering collisions are now machine-enforced, not narrated.** Twenty numbers are shared by two ADRs each — assigned in parallel sessions before anything checked. The files keep their filenames (renumbering would break every existing citation, and a number once assigned is never reused), and this table disambiguates each pair as `NNNN-a` / `NNNN-b`. The authoritative list is `LEGACY_DUPLICATE_ADRS` in [`scripts/gds/adr-namespace.js`](../../scripts/gds/adr-namespace.js), frozen by exact filename: a **new** collision — or a third file joining a legacy number, or a rename of either half — hard-fails the `unit` CI gate, as does an index row that points at no file or an ADR with no row. The list may only shrink. This paragraph used to narrate the collisions one by one and had fallen eight behind reality; see [ADR 0195](<redacted>.md) for why the check exists and why the pairs are grandfathered rather than renumbered.

package/docs/api/openapi.json

@@ -10425,7 +10425,7 @@
           "provisioning"
         ],
         "summary": "POST /provisioning/instances/:id/domain",
-        "description": "POST /provisioning/instances/:id/domain — give the caller's OWN instance its address (task 1002692, gap 5: no path existed to add a domain after creation). Validates + records the domain; for an already-ACTIVE instance it also enqueues a 'domain-attach' intent the control-plane runner drains (web tier holds no cloud tokens — ADR 0111 §2). A requested/error instance only records it: the (re)provision run wires the domain itself. Re-pointing an existing address is out of scope — refuse truthfully. Body: { domain (required) }.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "POST /provisioning/instances/:id/domain — give the caller's OWN instance its address (task 1002692, gap 5: no path existed to add a domain after creation). Validates + records the domain; for an already-ACTIVE instance it also enqueues a 'domain-attach' intent the control-plane runner drains (web tier holds no cloud tokens — ADR 0111 §2). A requested/error instance only records it: the (re)provision run wires the domain itself. A bring-your-own address may be RE-POINTED (task 1003237, ADR 0200): the same guards the first attach applies decide it, and the address it moved off is queued for release. Body: { domain (required) }.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "parameters": [
@@ -19147,7 +19147,8 @@
           },
           "queued": {},
           "domain": {},
-          "message": {}
+          "message": {},
+          "replaced": {}
         },
         "required": [
           "ok",