@bongos/core 1.19.401 → 1.19.403

package/docs/design/projects-hub-direction-v2.md

@@ -144,3 +144,19 @@ Three mastheads, rendered dark and light at 1440 / 390 / 320 (ALL CLEAN) and mea
 - Task 1003301 (the poster card): the ledger grammar above is the card's facts strip, too.
 - Task 1003319 (the planets): the masthead object rides the same crop maths the orbs will take.
 - The mine view and the wizard are the next views to take a masthead in the picked treatment.
+
+## 10. The poster card is built (task 1003301)
+
+**Date:** 2026-08-28 · the v2 card (§7) built into `public-landing/projects.html` + `cosmos.css`, rendered through the kit before and after (`node modules/ui-design/kit/render.js --page /projects`, both modes, 1440 / 390 / 320) — ALL CLEAN; the probes green including seven new card probes.
+
+**What was built, region by region (every one a direct child of the card, the C6 slice rule):** the 5:2 banner as a bare `<img>` (`object-fit: cover`, top corners on the card's radius; a broken image demotes to the no-art layout through one error listener); the two figures as leader-line callouts ON the art from 561px (one feathered patch of the card ground per callout — a mask, not a shadow — set 44px in from the card's edges so the feather is never clipped flat on the paper card) and as the two-up band under 561 or with no art; the accent disc surviving, half over the banner's lower edge, ringed 4px in the card ground; the name at 32px/300, the tagline, the relationship as a mono `--label-face` label (no accent: a fact, not a control); up to five 28px faces at −8px overlap ringed in the card ground, `+N` counted against `builders`; the facts as the 1003332 ledger (mono label left, tabular value right, one `rule-soft` hairline per row); one accent door (`open site →`, 48px, lowercase) and the hall entry beside it as an underlined `accent-deep` text link with the hall glyph. `.projCard` is `min(560px, 100%)`, one `rule` hairline, no shadow, `container-type: inline-size` so the disc and the callouts measure the card.
+
+**The degradation ladder, as shipped:** no art → no banner, the disc where it always was; no faces → the row absent; one figure null → the other stands alone; both null → the band hidden; a fact with no answer hides label and value together; everything null → disc, name, tagline, **the address**, listed, one door. The address is the one difference from the ladder as written in task 1003258: `Runs` on the poster is the project's address (§7), which the catalog always knows, so the floor card carries a Runs row the tags-based card did not. The table keeps the module list in its Runs column.
+
+**The feed (§6 closed):** `modules/platform-identity/project-stats.js` reads four feeds per origin inside the one `Promise.allSettled` — the leaderboard now also yields `faces`; `/public/recent-shipped?days=30` yields `shipped_30d` + `shipped_30d_capped` (200 rows with `?days` honoured, 30 on an older core: the "N+" rule); and the project's API discovery index (`GET /api/bongos`, ADR 0114) yields `hall_origin`. **A decision made on the way:** task 1003301 said the hall address would be "resolved from the project's provisioning record" — no such column exists (provisioning writes `BUILDERS_ORIGIN = PUBLIC_ORIGIN` into the instance's own `web.env` and never round-trips it), and the record could only ever say "same host". The discovery index is the project answering for itself, on the same basis as builders and tags, and it is null where the hall is the site's own host (the address gate) or where the project does not say. One frozen `NULL_STATS` carries every key. The platform's own card answers by the same rule client-side (its leaderboard for faces, its own `recent-shipped?days=30` for the figure), and its hall comes from the DOM: the server-stamped `#selfHall` anchor in its table row, dropped whole by the stamp when a pack names no hall.
+
+**The hall entry, three surfaces → two:** the card's door and the table row's glyph (riding the existing door cell, so the six-cell parity holds), both **member-gated AND address-gated** through one derivation (`hallUrlOf`, through `safeHttpUrl`). The mine-view card is untouched (task 1003301's scope; goal 1000059 R7 adds its manage door). The platform's own row carries the glyph only for a signed-in member.
+
+**Not done, on purpose:** the platform card has no banner — the mock used the landing's social card as "the platform's art in the only sense it has one", but that image carries the landing's own headline and reads as a screenshot inside the card; the kit fixture uses a text-free plate instead. Whether the platform should carry a real `art_url` is the owner's call.
+
+**Owner notes received during the build (filed as task 1003333, the landing hero):** the two doors sit too high and central; the three hero figures with their leader lines leave the landing (they fit the projects page — this card keeps the grammar); the large chrome plates should drift slowly like a lava lamp in place of the small bubble.

package/modules/platform-identity/project-stats.js

@@ -1,5 +1,6 @@
-// modules/platform-identity/project-stats.js — real Builders + Tags for the hub
-// catalog, read from each project's OWN public API (task 1002771).
+// modules/platform-identity/project-stats.js — real Builders + Tags (task 1002771)
+// and, since task 1003301, the poster card's faces, shipped-in-30-days figure and
+// hall address for the hub catalog, all read from each project's OWN public API.
 //
 // WHY THE DATA IS NOT HERE. The apex catalog stores four fields (origin, name,
 // tagline, art_url) and nothing else; the membership and activity tables that
@@ -13,6 +14,10 @@
 // /api/bongos/public/* surface, and the hub's server can read it instance-to-
 // instance with no CORS involved. The project itself is the authority on its own
 // builder count, which is a better source than anything the apex could infer.
+// The same holds for its hall address: no hub table stores one (provisioning
+// collapses every origin to the domain), but the instance's API discovery index
+// (GET /api/bongos, ADR 0114) advertises `hall` — the project answering for
+// itself, on the same basis as builders and tags.
 //
 // SCALE, recorded so it is not rediscovered: this PULL model is right for a
 // handful and fine for a few dozen behind the cache. It does not scale to
@@ -30,6 +35,23 @@ const TTL_MS = 10 * 60 * 1000;   // owner's choice, 2026-08-13
 const FETCH_TIMEOUT_MS = 2500;   // per request
 const COLD_DEADLINE_MS = 3000;   // total wait a COLD cache may cost a page load
 
+// The card's figure window and its faces row (task 1003301). The remote
+// recent-shipped feed is row-capped: 200 when it honours `?days=`, 30 when an
+// older core ignores the parameter — the cap is where a count becomes "N+".
+const SHIPPED_WINDOW_DAYS = 30;
+const SHIPPED_CAP_WINDOWED = 200;
+const SHIPPED_CAP_LEGACY = 30;
+const FACES_MAX = 5;
+const URL_MAX = 300;
+
+// ONE null shape for every way a project can fail to answer (the refresh catch
+// AND the read fallback). A key missing here ships as undefined, which
+// JSON.stringify drops, which silently changes the wire shape (task 1003258).
+const NULL_STATS = Object.freeze({
+  builders: null, tags: null, owner: null, owner_avatar: null,
+  faces: null, shipped_30d: null, shipped_30d_capped: null, hall_origin: null,
+});
+
 const _cache = new Map();        // origin → { at, stats }
 const _inflight = new Map();     // origin → Promise (collapses concurrent refreshes)
 
@@ -58,6 +80,14 @@ function isSystemAccount(login) {
   return /-system$/.test(String(login || ''));
 }
 
+// httpUrl — a third-party string becomes a URL only when it is http(s), and only
+// up to a length cap; anything else is null. Every avatar, face, art and hall
+// address the hub relays passes here (the client scheme-checks again before a
+// value becomes a src or an href).
+function httpUrl(raw, max = URL_MAX) {
+  return typeof raw === 'string' && /^https?:\/\//.test(raw) ? raw.slice(0, max) : null;
+}
+
 // ── SSRF GUARD ──
 // This is the one place the server makes an outbound request to an address that
 // came out of the database, so it is the one place that has to assume the address
@@ -109,14 +139,23 @@ async function assertPublicHost(hostname) {
   }
 }
 
-function publicUrl(origin, route) {
+// siteUrl — the origin as a URL, http(s) only. Throws on anything else, which is
+// the one path that reaches the cached-failure literal synchronously.
+function siteUrl(origin) {
   const u = new URL(origin);
   if (u.protocol !== 'https:' && u.protocol !== 'http:') throw new Error('bad scheme');
-  return new URL(`/api/bongos/public/${route}`, u).href;
+  return u;
+}
+function apiUrl(origin, route) {
+  return new URL(route, siteUrl(origin)).href;
+}
+function publicUrl(origin, route) {
+  return apiUrl(origin, `/api/bongos/public/${route}`);
 }
 
+// The guard has already run for this sweep's host (fetchStats resolves each
+// origin ONCE, not once per feed); this only fetches.
 async function getJson(url) {
-  await assertPublicHost(new URL(url).hostname);
   const res = await fetch(url, {
     signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
     headers: { accept: 'application/json' },
@@ -126,48 +165,92 @@ async function getJson(url) {
   return res.json();
 }
 
-// One project's stats. Either half may fail on its own — a project whose
+// leaderboardStats — builders, owner and faces from the project's OWN leaderboard.
+// The archon row IS the instance's owner — the project's own authority answering
+// for itself, from a payload already in hand (ADR 0170). The catalog's
+// owner_github_id ("advisory attribution (not an authority)") stays unread.
+// Caveat: the leaderboard is credits-ordered and page-capped, so a zero-credit
+// archon on a very large instance can fall off it — that renders as no owner
+// shown, never as a wrong one. The payload is third-party: accept only a
+// plausible login string (GitHub caps logins at 39 chars; 64 leaves headroom
+// without hosting a novel) and only http(s) avatar URLs.
+function leaderboardStats(rows) {
+  const people = rows.filter((b) => !isSystemAccount(b?.github_login));
+  const arch = people.find((b) => b?.rank === 'archon');
+  const login = arch?.github_login;
+  const owner = typeof login === 'string' && login ? login.slice(0, 64) : null;
+  return {
+    builders: people.length,
+    owner,
+    owner_avatar: owner ? httpUrl(arch?.avatar_url) : null,
+    // the faces row: the first five people with a usable avatar, in the feed's
+    // credits order; the card counts the rest against `builders` as +N
+    faces: people.map((b) => httpUrl(b?.avatar_url)).filter(Boolean).slice(0, FACES_MAX),
+  };
+}
+
+// shippedStats — how many tasks the project shipped in the last 30 days, and
+// whether that count sat at the feed's row cap (the card renders "N+" then). The
+// window is applied here from shipped_at even when the remote honoured `?days=`,
+// so an older core that ignores the parameter still yields a true number.
+function shippedStats(body) {
+  const rows = Array.isArray(body?.tasks) ? body.tasks : [];
+  const since = Date.now() - SHIPPED_WINDOW_DAYS * 24 * 60 * 60 * 1000;
+  const inWindow = rows.filter((t) => {
+    const ts = Date.parse(t?.shipped_at);
+    return Number.isFinite(ts) && ts >= since;
+  }).length;
+  const cap = body?.days === SHIPPED_WINDOW_DAYS ? SHIPPED_CAP_WINDOWED : SHIPPED_CAP_LEGACY;
+  return { shipped_30d: inWindow, shipped_30d_capped: rows.length >= cap && inWindow === rows.length };
+}
+
+// hallOrigin — the project's builders' hall address when it is genuinely a
+// different host from the site; null on a single-host instance (the hall is at
+// <site>/builders, where the site's own door already leads) and null when the
+// project does not say. Task 1003257, owner decision (a): a door only where it
+// opens somewhere else.
+function hallOrigin(index, origin) {
+  const hall = httpUrl(index?.hall);
+  if (!hall) return null;
+  try {
+    return new URL(hall).host.toLowerCase() === siteUrl(origin).host.toLowerCase() ? null : hall;
+  } catch {
+    return null;
+  }
+}
+
+// One project's stats. Every quarter may fail on its own — a project whose
 // leaderboard is down can still report its modules — so they settle independently
-// and a missing half is null (an em dash) rather than a discarded pair.
+// inside ONE allSettled (sequential awaits would turn the per-request ceiling into
+// a serial cost that blows the cold-load deadline), and a missing quarter is null
+// rather than a discarded whole.
 async function fetchStats(origin) {
-  const [lb, mods] = await Promise.allSettled([
+  await assertPublicHost(siteUrl(origin).hostname);   // once per sweep, not once per feed
+  const [lb, mods, ships, index] = await Promise.allSettled([
     getJson(publicUrl(origin, 'leaderboard')),
     getJson(publicUrl(origin, 'modules')),
+    getJson(publicUrl(origin, `recent-shipped?days=${SHIPPED_WINDOW_DAYS}`)),
+    getJson(apiUrl(origin, '/api/bongos')),
   ]);
 
-  let builders = null;
-  let owner = null;
-  let ownerAvatar = null;
+  const stats = { ...NULL_STATS };
   if (lb.status === 'fulfilled' && Array.isArray(lb.value?.leaderboard)) {
-    const people = lb.value.leaderboard.filter((b) => !isSystemAccount(b?.github_login));
-    builders = people.length;
-    // The archon row IS the instance's owner — the project's own authority
-    // answering for itself, from a payload already in hand (ADR 0170). The
-    // catalog's owner_github_id ("advisory attribution (not an authority)")
-    // stays unread. Caveat: the leaderboard is credits-ordered and page-capped,
-    // so a zero-credit archon on a very large instance can fall off it — that
-    // renders as no owner shown, never as a wrong one.
-    // The payload is third-party: accept only a plausible login string (GitHub
-    // caps logins at 39 chars; 64 leaves headroom without hosting a novel),
-    // and only an http(s) avatar URL — the client scheme-checks again before
-    // it becomes an <img>.
-    const arch = people.find((b) => b?.rank === 'archon');
-    const login = arch?.github_login;
-    owner = typeof login === 'string' && login ? login.slice(0, 64) : null;
-    const av = arch?.avatar_url;
-    ownerAvatar = owner && typeof av === 'string' && /^https?:\/\//.test(av) ? av.slice(0, 300) : null;
+    Object.assign(stats, leaderboardStats(lb.value.leaderboard));
   }
-
-  let tags = null;
   if (mods.status === 'fulfilled' && mods.value?.enabled && typeof mods.value.enabled === 'object') {
     const core = coreModules();
-    tags = Object.entries(mods.value.enabled)
+    stats.tags = Object.entries(mods.value.enabled)
       .filter(([key, on]) => on === true && !core.has(key))
       .map(([key]) => key)
       .sort();
   }
-
-  return { builders, tags, owner, owner_avatar: ownerAvatar };
+  if (ships.status === 'fulfilled' && Array.isArray(ships.value?.tasks)) {
+    Object.assign(stats, shippedStats(ships.value));
+  }
+  if (index.status === 'fulfilled') {
+    stats.hall_origin = hallOrigin(index.value, origin);
+  }
+  return stats;
 }
 
 function refresh(origin) {
@@ -181,9 +264,8 @@ function refresh(origin) {
       // Remember the FAILURE for a full TTL too. Without this a permanently
       // unreachable project is re-fetched on every request and pays the timeout
       // every time — the exact way one dead project slows the whole page.
-      const stats = { builders: null, tags: null, owner: null, owner_avatar: null };
-      _cache.set(origin, { at: Date.now(), stats });
-      return stats;
+      _cache.set(origin, { at: Date.now(), stats: NULL_STATS });
+      return NULL_STATS;
     })
     .finally(() => _inflight.delete(origin));
   _inflight.set(origin, p);
@@ -215,11 +297,14 @@ async function getProjectStats(origins = []) {
   // null-prototype: an origin literally equal to '__proto__' would otherwise
   // retarget the object's prototype instead of adding a key
   const out = Object.create(null);
-  for (const origin of origins) out[origin] = _cache.get(origin)?.stats || { builders: null, tags: null, owner: null, owner_avatar: null };
+  for (const origin of origins) out[origin] = _cache.get(origin)?.stats || NULL_STATS;
   return out;
 }
 
 // tests
 function _reset() { _cache.clear(); _inflight.clear(); _coreModules = null; }
 
-module.exports = { getProjectStats, isSystemAccount, coreModules, blockedReason, assertPublicHost, _reset, TTL_MS };
+module.exports = {
+  getProjectStats, isSystemAccount, coreModules, blockedReason, assertPublicHost, httpUrl,
+  NULL_STATS, SHIPPED_WINDOW_DAYS, FACES_MAX, _reset, TTL_MS,
+};

package/modules/platform-identity/routes/my-projects.js

@@ -15,6 +15,7 @@
 const express = require('express');
 const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
+const projectStats = require('../project-stats');
 
 const { pool, requireBuilder, validateOrRespond, userAgent } = api;
 
@@ -87,6 +88,17 @@ module.exports = function myProjectsRoutes() {
   router.get('/my-projects', requireBuilder, async (req, res) => {
     try {
       const rows = await pi.listMembershipsForAccount(req.builder.github_id, { pool });
+      // hall_origin per membership (task 1003301): the project's own hall
+      // address where it differs from its site, null otherwise — read from the
+      // project's API discovery index through the same cached enrichment the
+      // catalog uses (no hub table stores it). Best-effort: a project that does
+      // not answer gets null, never a failed listing.
+      let stats = {};
+      try {
+        stats = await projectStats.getProjectStats(rows.map((m) => m.project_origin).filter(Boolean));
+      } catch (err) {
+        api.logger('platform-identity').error(`my-projects hall enrichment failed (non-fatal): ${err && err.message}`);
+      }
       const owned = [];
       const building = [];
       for (const m of rows) {
@@ -94,6 +106,7 @@ module.exports = function myProjectsRoutes() {
           client_id: m.client_id,
           name: m.project_name || m.project_origin || m.client_id,
           origin: m.project_origin || null,
+          hall_origin: (m.project_origin && stats[m.project_origin]?.hall_origin) || null,
           membership_kind: m.membership_kind,
           joined_at: m.joined_at,
           last_active: m.last_active,

package/modules/platform-identity/routes/projects.js

@@ -122,13 +122,16 @@ module.exports = function projectsRoutes() {
       } catch (err) {
         console.error('[platform-identity] project stats enrichment failed (non-fatal):', err.message);
       }
+      // The enrichment's keys (builders, tags, owner, owner_avatar, faces,
+      // shipped_30d, shipped_30d_capped, hall_origin) never collide with the
+      // catalog's; a project that did not answer carries the ONE shared null
+      // shape, so the wire never drops a key. art_url is catalog text an Archon
+      // typed — scheme-checked here, and again on the client, before it is a src.
       res.json({
         projects: projects.map((p) => ({
           ...p,
-          builders: stats[p.origin]?.builders ?? null,
-          tags: stats[p.origin]?.tags ?? null,
-          owner: stats[p.origin]?.owner ?? null,
-          owner_avatar: stats[p.origin]?.owner_avatar ?? null,
+          art_url: projectStats.httpUrl(p.art_url, 2048),
+          ...(stats[p.origin] || projectStats.NULL_STATS),
         })),
       });
     } catch (err) {

package/modules/provisioning/migrations/provisioning_012_domain_repoint.sql

@@ -0,0 +1,35 @@
+-- provisioning_012_domain_repoint.sql — the addresses a re-point still owes a
+-- release on (task 1003237, goal 1000058: a mistyped bring-your-own domain can
+-- be corrected).
+--
+-- WHY. Re-pointing an instance overwrites `domain`, so the address it moved OFF
+-- is gone from the row the instant the web tier records the new one — and the
+-- runner, which is the only tier holding a DNS token, would never learn that a
+-- hostname it once UPSERTed at the platform's IP is now abandoned. ADR 0181 §2
+-- keeps a torn-down project's address deliberately; an address the owner has
+-- explicitly moved off is the opposite case, and leaving its A record aimed at
+-- platform infra is the leak this column closes.
+--
+-- An ARRAY, not a single column: a founder correcting a typo can correct it
+-- twice before the runner drains the first attach, and a scalar would silently
+-- drop the middle address. The runner releases each entry and empties the list.
+--
+-- Only a BYO address is ever appended here, and only from a state that actually
+-- STOOD UP (DOMAIN_RELEASE_FROM = {error, active}). The platform-assigned
+-- <slug>.<apex> is the platform's own name for this slug and the revive path
+-- re-uses it (ADR 0181 §2); a 'requested' instance never had an A record written
+-- for the address it is leaving, so parking that name would CREATE a junk record
+-- rather than release one.
+--
+-- BOUNDED at MAX_RELEASED_DOMAINS by updateInstanceDomain's own SQL. The runner
+-- drains this list synchronously against the SHARED control-plane Cloudflare
+-- token, so an unbounded array would be a platform-wide resource-exhaustion
+-- vector reachable by any owner re-pointing their own project in a loop.
+--
+-- OVERLAY, NOT A STATE (the provisioning_006 rule): defaulted, never written by
+-- the lifecycle. Empty = nothing outstanding. Safe to re-run.
+ALTER TABLE provisioning_instances
+  ADD COLUMN IF NOT EXISTS released_domains text[] NOT NULL DEFAULT '{}';
+
+INSERT INTO schema_migrations (version) VALUES ('provisioning_012_domain_repoint')
+ON CONFLICT (version) DO NOTHING;

package/modules/provisioning/provisioning.js

@@ -77,6 +77,17 @@ const PROVISION_ENQUEUE_FROM = new Set(['requested', 'provisioning', 'error', 't
 // 'requested'/'error' only record it — the (re)provision run wires the domain
 // itself. Mid-flight or torn-down states refuse truthfully.
 const DOMAIN_ATTACH_FROM = new Set(['requested', 'error', 'active']);
+// The states in which a re-point has an address worth RELEASING (task 1003237).
+// A 'requested' instance has never stood up, so nothing ever wrote an A record for
+// the address it is leaving — parking that name at the blackhole would CREATE a
+// junk record in the owner's zone rather than release one. An 'error' row is
+// frequently a PARTIAL standup that did write it (ADR 0181 §1), so it counts.
+const DOMAIN_RELEASE_FROM = new Set(['error', 'active']);
+// How many abandoned addresses one instance may have queued for release at once.
+// The runner drains them synchronously against the shared control-plane Cloudflare
+// token, so this is a platform-wide bound, not a per-owner nicety. A real
+// correction queues one; the cap only ever binds on abuse.
+const MAX_RELEASED_DOMAINS = 8;
 // The ONE state a settings push is meaningful from (task 1003140). A pre-active
 // instance needs no push — standup writes the same values from the same
 // effectiveSettings() row — and a torn-down one has nothing to restart. The
@@ -468,13 +479,61 @@ async function updateInstanceSettings(db, id, patch) {
   return rows[0] || null;
 }
 
-// Record an instance's domain — the ONLY column this touches (task 1002692). Status
-// changes stay setInstanceStatus's job; keeping this narrow means the domain-attach
-// route can never drift an instance's lifecycle as a side effect.
-async function updateInstanceDomain(db, id, domain) {
+// Record an instance's domain — the ONLY columns this touches (task 1002692;
+// `releasing` added by task 1003237). Status changes stay setInstanceStatus's job;
+// keeping this narrow means the domain-attach route can never drift an instance's
+// lifecycle as a side effect.
+//
+// `releasing` is the BYO address this instance is moving OFF, appended to the
+// release queue in the SAME statement as the new domain — a re-point that
+// recorded the new address but crashed before queueing the old one would leave a
+// hostname pointed at platform infra with nothing left in the row to say so.
+// Appended, never replaced: two corrections before the runner drains the first
+// must both get released (provisioning_012). null/undefined ⇒ the queue is left
+// exactly as it stands, so a first attach touches nothing.
+//
+// CAPPED at MAX_RELEASED_DOMAINS, enforced here in SQL rather than trusted from
+// the caller. The runner drains this list SYNCHRONOUSLY, one shared-Cloudflare-token
+// call per entry, so an unbounded array is a resource-exhaustion vector against the
+// whole platform — not just the owner's own project — and every re-point is a write
+// an authenticated owner can repeat. Past the cap the append is dropped: the entries
+// already queued are the ones most likely to name a hostname the platform really
+// wired, and a real correction never comes close to the cap (the route also throttles
+// the caller). Dropping is the deliberate failure mode — growing without bound is not.
+//
+// A CHANGED domain also clears the liveness overlay. The overlay is a verdict on
+// an ADDRESS (task 1002696), so carrying it across a re-point would let the card
+// say "answering at <the new address>, last answered 2 minutes ago" when only the
+// OLD address was ever probed — the exact false claim the F16 rule forbids. NULL
+// is "never probed", which is the truth for a name nothing has asked yet; the
+// sweep re-probes within minutes. Guarded in SQL on the value actually changing,
+// so an idempotent re-record can never blank a good probe.
+async function updateInstanceDomain(db, id, domain, releasing = null) {
+  const host = releasing ? String(releasing).toLowerCase() : null;
   const { rows } = await db.query(
-    `UPDATE provisioning_instances SET domain = $2, updated_at = now() WHERE id = $1 RETURNING *`,
-    [id, domain]
+    `UPDATE provisioning_instances
+        SET domain = $2,
+            released_domains = CASE
+              WHEN $3::text IS NULL OR $3 = ANY(released_domains) THEN released_domains
+              WHEN coalesce(array_length(released_domains, 1), 0) >= $4 THEN released_domains
+              ELSE array_append(released_domains, $3)
+            END,
+            last_verified_at = CASE WHEN domain IS DISTINCT FROM $2 THEN NULL ELSE last_verified_at END,
+            last_verified_up = CASE WHEN domain IS DISTINCT FROM $2 THEN NULL ELSE last_verified_up END,
+            updated_at = now()
+      WHERE id = $1 RETURNING *`,
+    [id, domain, host, MAX_RELEASED_DOMAINS]
+  );
+  return rows[0] || null;
+}
+
+// Empty the release queue once the runner has actually released every address on
+// it (task 1003237). Same narrowness rule as clearErrorNote: no status, no
+// updated_at — draining a queue is not an owner-visible change to the project.
+async function clearReleasedDomains(db, id) {
+  const { rows } = await db.query(
+    `UPDATE provisioning_instances SET released_domains = '{}' WHERE id = $1 RETURNING id`,
+    [id]
   );
   return rows[0] || null;
 }
@@ -896,7 +955,8 @@ module.exports = {
   // constants
   INSTANCE_STATES, HOSTING_SHAPES, ONBOARD_MODES, PROJECT_TYPES, INTENT_ACTIONS, TEARDOWN_FROM,
   settingsEnvLines, settingsEnvVars,
-  PROVISION_ENQUEUE_FROM, DOMAIN_ATTACH_FROM, SETTINGS_APPLY_FROM, SETTINGS_APPLY_SHAPES,
+  PROVISION_ENQUEUE_FROM, DOMAIN_ATTACH_FROM, DOMAIN_RELEASE_FROM, MAX_RELEASED_DOMAINS,
+  SETTINGS_APPLY_FROM, SETTINGS_APPLY_SHAPES,
   RESTART_FROM, RESTART_SHAPES,
   TIER_MONTHLY_USD, CERT_ELIGIBLE_STATES,
   SETTINGS_VOCAB, DEFAULT_SETTINGS,
@@ -910,7 +970,7 @@ module.exports = {
   getInstanceById, getInstanceBySlug, getInstanceByDomain, listInstancesForOwner, listAllInstances,
   // data access — verification overlay (task 1002696)
   listActiveInstancesForLiveness, recordLivenessProbe, recordDnsNote, clearErrorNote,
-  createInstance, setInstanceStatus, updateInstanceDomain, updateInstanceSettings,
+  createInstance, setInstanceStatus, updateInstanceDomain, clearReleasedDomains, updateInstanceSettings,
   enqueueIntent, enqueueTeardown, enqueueSettingsApply, enqueueRestart, getOpenIntent, claimNextIntent, resolveIntent,
   recordEvent, instanceStateForSlug, costLedger,
   // data access — GitHub App Manifest attempts (task 2080)

package/modules/provisioning/routes/provisioning.js

@@ -265,6 +265,17 @@ module.exports = function provisioningRoutes() {
     max: 30,
     key: (req) => (req.builder ? `b:${req.builder.id}` : clientIp(req)),
   });
+  // Limiter for the domain attach/re-point write (task 1003237). Signed-in and
+  // own-scoped, but since a re-point became possible each call can queue an
+  // address the RUNNER later releases with a call against the SHARED control-plane
+  // Cloudflare token — so an unthrottled owner can spend a platform-wide budget,
+  // not merely their own. Keyed on the BUILDER for the same reason as the slug
+  // check: per-IP would starve co-located builders while an attacker rotates IPs.
+  // A founder gives a project an address, or corrects it, a handful of times ever.
+  const domainWriteRateLimit = makeAskRateLimiter({
+    max: 10,
+    key: (req) => (req.builder ? `b:${req.builder.id}` : clientIp(req)),
+  });
 
   // Route ORDER is deliberate (the box.js precedent): the Archon-gated routes are
   // declared FIRST, then the any-builder routes. The route-rank auditor
@@ -859,9 +870,11 @@ module.exports = function provisioningRoutes() {
   // Validates + records the domain; for an already-ACTIVE instance it also enqueues
   // a 'domain-attach' intent the control-plane runner drains (web tier holds no
   // cloud tokens — ADR 0111 §2). A requested/error instance only records it: the
-  // (re)provision run wires the domain itself. Re-pointing an existing address is
-  // out of scope — refuse truthfully. Body: { domain (required) }.
-  router.post('/provisioning/instances/:id/domain', auth.requireBuilder, async (req, res) => {
+  // (re)provision run wires the domain itself. A bring-your-own address may be
+  // RE-POINTED (task 1003237, ADR 0200): the same guards the first attach applies
+  // decide it, and the address it moved off is queued for release.
+  // Body: { domain (required) }.
+  router.post('/provisioning/instances/:id/domain', auth.requireBuilder, domainWriteRateLimit, async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     if (validateOrRespond(req, res, { domain: { required: true, type: 'string', maxLength: 253 } })) return;
@@ -919,15 +932,20 @@ module.exports = function provisioningRoutes() {
         return res.json({ ok: true, changed: false, queued: false, domain: inst.domain,
           message: 'This instance already has that address.' });
       }
-      // A platform-ASSIGNED address may be upgraded away to a bring-your-own
-      // domain — that upgrade path is half the task-1002704 decision (the old
-      // record lingers in DNS, the idea-1000710 class). A genuine BYO address
-      // stays un-re-pointable, as before.
-      if (current && current !== assignedDefault) {
-        return res.fail('domain_already_set', { status: 409,
-          message: `This instance is already addressed as '${inst.domain}' — re-pointing an existing address is not supported here.`,
-          details: { current: inst.domain } });
-      }
+      // A mistyped bring-your-own address can be CORRECTED (task 1003237, owner
+      // decision 2026-08-28 / ADR 0200): the address is the founder's, and the
+      // guards above — reserved, in-apex squat — plus the uniqueness check below
+      // are exactly the ones the first attach applied, so a re-point needs no
+      // weaker rule and gets no stronger one. The address it moves OFF is queued
+      // for release (`releasing`): leaving a hostname UPSERTed at platform infra
+      // for a project that no longer answers there is the leak ADR 0181 §2 named.
+      // Only a BYO address is released, and only from a state that actually STOOD
+      // UP: a platform-ASSIGNED <slug>.<apex> is the platform's own name for this
+      // slug and the revive path re-uses it (ADR 0181 §2), while a 'requested'
+      // instance never had an A record written for the address it is leaving —
+      // parking that name would CREATE a junk record rather than release one.
+      const releasing = current && current !== assignedDefault
+        && provisioning.DOMAIN_RELEASE_FROM.has(inst.status) ? current : null;
       const holder = await provisioning.getInstanceByDomain(pool, domain);
       if (holder && String(holder.id) !== String(inst.id)) {
         return res.fail('domain_taken', { status: 409, message: 'That address is already in use by another instance.' });
@@ -938,8 +956,9 @@ module.exports = function provisioningRoutes() {
           details: { status: inst.status } });
       }
       // Record BEFORE enqueueing: the runner reads the row's domain, so the intent
-      // must never race ahead of the column it wires.
-      await provisioning.updateInstanceDomain(pool, id, domain);
+      // must never race ahead of the column it wires. The release queue rides the
+      // SAME statement — see updateInstanceDomain.
+      await provisioning.updateInstanceDomain(pool, id, domain, releasing);
       let queued = false;
       if (inst.status === 'active') {
         const { intent, created } = await provisioning.enqueueIntent(pool, id, 'domain-attach', 'api:self');
@@ -957,22 +976,30 @@ module.exports = function provisioningRoutes() {
             instanceId: id, ownerBuilderId: req.builder.id, event: 'domain',
             detail: `domain ${domain} recorded (attach already queued)`, actor: 'api:self',
           }).catch(() => {});
-          return res.json({ ok: true, changed: true, queued: false, domain,
+          return res.json({ ok: true, changed: true, queued: false, domain, replaced: releasing,
             message: 'That address is already being wired for this instance.' });
         }
       }
+      const moved = releasing ? ` (moved off ${releasing}, queued for release)` : '';
       await provisioning.recordEvent(pool, {
         instanceId: id, ownerBuilderId: req.builder.id, event: 'domain',
-        detail: queued ? `domain ${domain} recorded + attach queued` : `domain ${domain} recorded (wired at provision)`,
+        detail: (queued ? `domain ${domain} recorded + attach queued` : `domain ${domain} recorded (wired at provision)`) + moved,
         actor: 'api:self',
       }).catch(() => {});
-      res.json({ ok: true, changed: true, queued, domain,
-        // State-only sentence (task 1002720 / F16): the web tier holds no cloud
-        // tokens and cannot know whether a DNS hook exists on the runner, so
-        // "it will answer there shortly" was a promise it could not keep.
-        message: queued
-          ? 'Your instance is being wired to its new address — this card will show whether it answers.'
-          : 'Address recorded — it will be wired when the instance is provisioned.' });
+      // State-only sentences (task 1002720 / F16): the web tier holds no cloud
+      // tokens and cannot know whether a DNS hook exists on the runner, so "it
+      // will answer there shortly" was a promise it could not keep. The re-point
+      // sentences name the old address in the same voice — what they say has
+      // ALREADY happened is the recording, not the unwiring. One lookup rather
+      // than a nested ternary, so each of the four states reads as its own line.
+      const MESSAGES = {
+        'queued:repoint': `Your project is being wired to ${domain}; ${releasing} is being let go.`,
+        'queued:first': 'Your instance is being wired to its new address — this card will show whether it answers.',
+        'recorded:repoint': `Address changed to ${domain} — it will be wired, and ${releasing} let go, when the instance is provisioned.`,
+        'recorded:first': 'Address recorded — it will be wired when the instance is provisioned.',
+      };
+      res.json({ ok: true, changed: true, queued, domain, replaced: releasing,
+        message: MESSAGES[`${queued ? 'queued' : 'recorded'}:${releasing ? 'repoint' : 'first'}`] });
     } catch (err) {
       log.error('[provisioning] POST /provisioning/instances/:id/domain', err);
       res.fail('domain_attach_failed', { status: 500, message: 'internal error' });

package/modules/ui-design/kit/fixtures/featured.json

@@ -1 +1 @@
-{"projects":[{"origin":"https://amazonprimea.com","name":"Off the Boats","tagline":"A singular shop, and a broader videogame in a persistent ancient Greek world that collides with modern day commerce & products.","art_url":null,"type":"game","created_at":"2026-07-15T22:12:57.732Z","builders":11,"tags":["art-pipeline","character-anim","demo","game"],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4"},{"origin":"https://demo.cloudbongos.com","name":"Demo","tagline":"A live demo instance on Cloud Bongos.","art_url":null,"type":null,"created_at":"2026-07-14T19:16:38.160Z","builders":1,"tags":[],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4"},{"origin":"https://emersonian-circles.cloudbongos.com","name":"Emersonian Circles","tagline":"An independent project built on Cloud Bongos.","art_url":null,"type":null,"created_at":"2026-07-25T02:21:55.641Z","builders":1,"tags":[],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4"}]}
+{"projects":[{"origin":"https://amazonprimea.com","name":"Off the Boats","tagline":"A singular shop, and a broader videogame in a persistent ancient Greek world that collides with modern day commerce & products.","art_url":"/assets/world/r2-chrome-blob-one.jpg","type":"game","created_at":"2026-07-15T22:12:57.732Z","builders":11,"tags":["art-pipeline","character-anim","demo","game"],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4","faces":["https://avatars.githubusercontent.com/u/283020391?v=4","https://avatars.githubusercontent.com/u/64553469?v=4","https://avatars.githubusercontent.com/u/290184380?v=4","https://avatars.githubusercontent.com/u/295990394?v=4","https://avatars.githubusercontent.com/u/35337514?v=4"],"shipped_30d":0,"shipped_30d_capped":false,"hall_origin":"https://builders.amazonprimea.com"},{"origin":"https://demo.cloudbongos.com","name":"Demo","tagline":"A live demo instance on Cloud Bongos.","art_url":null,"type":null,"created_at":"2026-07-14T19:16:38.160Z","builders":null,"tags":null,"owner":null,"owner_avatar":null,"faces":null,"shipped_30d":null,"shipped_30d_capped":null,"hall_origin":null},{"origin":"https://emersonian-circles.cloudbongos.com","name":"Emersonian Circles","tagline":"An independent project built on Cloud Bongos.","art_url":null,"type":null,"created_at":"2026-07-25T02:21:55.641Z","builders":1,"tags":[],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4","faces":[],"shipped_30d":30,"shipped_30d_capped":true,"hall_origin":null}]}

package/modules/ui-design/kit/fixtures/my-projects.json

@@ -1 +1 @@
-{"owned":[],"building":[]}
+{"owned":[],"building":[{"client_id":"otb","name":"Off the Boats","origin":"https://amazonprimea.com","hall_origin":"https://builders.amazonprimea.com","membership_kind":"member","joined_at":"2026-07-20T10:00:00.000Z","last_active":"2026-08-27T18:00:00.000Z"},{"client_id":"emersonian","name":"Emersonian Circles","origin":"https://emersonian-circles.cloudbongos.com","hall_origin":null,"membership_kind":"member","joined_at":"2026-07-26T10:00:00.000Z","last_active":"2026-08-20T18:00:00.000Z"}]}

package/modules/ui-design/kit/serve.js

@@ -99,12 +99,23 @@ const AUTHED = { '/my-projects': 'my-projects' };
 const UNAUTH = { error: { code: 'unauthenticated', message: 'unauthenticated' } };
 
 function json(res, status, body) { res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' }); res.end(JSON.stringify(body)); }
-function fixture(name, res) {
+function fixture(name, res, origin) {
   if (FAIL.has(name)) return json(res, 500, { error: { code: 'stub_failure', message: `FAIL=${name}` } });
   const file = path.join(FIXTURES, name + '.json');
   if (!fs.existsSync(file)) return json(res, 404, { error: { code: 'no_fixture', message: name } });
   res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store' });
-  res.end(fs.readFileSync(file));
+  res.end(name === 'featured' ? JSON.stringify(featured(file, origin)) : fs.readFileSync(file));
+}
+// A project's art in the featured fixture may be root-relative (the surface's
+// own /assets/…, served by this stub) — the page accepts only an http(s) art
+// URL, so it is absolutised to this origin per request, as the builder's
+// avatar is (see me()).
+function featured(file, origin) {
+  const body = JSON.parse(fs.readFileSync(file, 'utf8'));
+  for (const p of body.projects || []) {
+    if (typeof p.art_url === 'string' && p.art_url.startsWith('/')) p.art_url = origin + p.art_url;
+  }
+  return body;
 }
 function proxy(req, res) {
   const origin = (liveOrigin === '1' ? '' : liveOrigin).replace(/\/$/, '');
@@ -142,7 +153,7 @@ const server = http.createServer((req, res) => {
   const apiMatch = p.match(/^\/api\/(gds|bongos)(\/.*)$/);
   if (apiMatch) {
     const rest = apiMatch[2];
-    if (FEEDS[rest]) return LIVE ? proxy(req, res) : fixture(FEEDS[rest], res);
+    if (FEEDS[rest]) return LIVE ? proxy(req, res) : fixture(FEEDS[rest], res, origin);
     if (rest === '/me') return AUTH ? json(res, 200, me(origin)) : json(res, 401, UNAUTH);
     if (AUTHED[rest]) return AUTH ? fixture(AUTHED[rest], res) : json(res, 401, UNAUTH);
     if (rest === '/provisioning/instances') return AUTH ? json(res, 200, { instances: [] }) : json(res, 401, UNAUTH);