@bongos/core 1.19.536 → 1.19.537

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.536",
-  "core_contract": "1.19.536",
-  "source_commit": "91d912719b37497561bd71e9aff21b0d07128ce7",
+  "core_version": "1.19.537",
+  "core_contract": "1.19.537",
+  "source_commit": "171115727a6362835dd549dbed353a8bc817e4ee",
   "source_ref": "HEAD",
-  "built_at": "2026-09-04T15:11:58.158Z",
+  "built_at": "2026-09-04T15:20:04.870Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 439,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2458,
-  "tree_sha256": "d97db0f024e5887d1e765ab22ac86d124015c3a97cf3f44989b82c2d0f1493ac",
+  "tree_sha256": "2db763cfb805a63a9dd4a04cacedb717acd4aab6b9a8f3ce795a57f1bc49a0d4",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1762,7 +1762,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "b2ce137944f23684f4ba805d4bda73ba1ab7477279e2a24fbcd5c068f7a25bad"
+      "sha256": "8ae264d8c9983ff2841a8309c141b6fb57b395bb4b52894a4b49f58280d8fb1b"
     },
     {
       "path": "docs/architecture.md",
@@ -2637,7 +2637,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "1107b8275d73b7e9e3410a6153bee4107718272c3bc7c2471241ea9f5c076fc0"
+      "sha256": "1b719e47366fff0090cc4f3a18743953191d612e150e59a6c68e5d27c7b71624"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6112,7 +6112,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "d3d376a0aafc52dda55d9d2f2dcdc3d5baf9370a766cd4328cd00b314e897c99"
+      "sha256": "b073e5c362797e221f5e0f9ad322ee8e1c3206ea44ed98c527b3c1c7b696879c"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -6132,7 +6132,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "3528d699cb9c0f396eeda2e9fc26eb9b89c02e0b0ca34beeb20fd84c832f5241"
+      "sha256": "f9231eb18211a2586d2ee1919ff817ac5fa14f1ea5ad1906ad5c58437f6238f6"
     },
     {
       "path": "modules/provisioning/starter-bundles.js",
@@ -6147,7 +6147,7 @@
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
       "mode": "0000644",
-      "sha256": "4dceb82f4dbeb39128c66d666df0642aacb38988f7c6d01c55f6515bcd8ad798"
+      "sha256": "aac930ed566f9b6fb7ec9fa4e240f42025e854369a94f6a8c63aa20b5d1995a8"
     },
     {
       "path": "modules/provisioning/ui/.gitkeep",
@@ -7392,12 +7392,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "76834cd1d1173b36db4f414f60b9457e8eeb1682ca54f25f662e29254ea22bd9"
+      "sha256": "b52e9fc284a5e725c64604313074cc5b72653d3158a38ed20556a7a79d6649e8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c1ecc7233b18bd5b058b6af3757d7e2ae3a64fcef67ef6de2d743a72013c8602"
+      "sha256": "a035e8e7a14e9ebce98dada6fd2bad96f3f9f0028707412394714c9edd538b77"
     },
     {
       "path": "public-docs/index.html",
@@ -9082,7 +9082,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "aff15cb73c3ed3851d94ded69d4a75f9cf1e38dbe28146e51d6cd25c320f630e"
+      "sha256": "bbd37b696a4b36e1e5a572719a92e7a187b8653fcf360a658de83c43ef4e8331"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11407,7 +11407,7 @@
     {
       "path": "tests/provisioning_module_selection.mjs",
       "mode": "0000644",
-      "sha256": "a8cb68c1f21a7c6547ef382b4641b80c1c9e46a2aad415f75dbfde36224079fd"
+      "sha256": "92db65b8da5b849379bab03e70287239deab8b9a2b2e47b4574f12b8acac013e"
     },
     {
       "path": "tests/provisioning_onboard_mode.mjs",

package/docs/api/openapi.json

@@ -11555,7 +11555,7 @@
           "provisioning"
         ],
         "summary": "PATCH /provisioning/instances/:id/detail",
-        "description": "── The optional project detail (task 1002334, goal 1000046) ────────────── PATCH /provisioning/instances/:id/detail — answer (or re-answer) the wizard's OPTIONAL creation steps after creation. Body: any subset of { description, detail, modules }. rank: any authenticated builder (own resource; archon may change any — same gate as settings). THIS ROUTE IS WHAT MAKES THE STEP SKIPPABLE. Skipping at creation leaves the project dark-matter — off the map and un-joinable (ADR 0182 D4) — and that is a supported default only because there is a way back. Without this route \"optional\" would mean \"permanently unpublishable\", i.e. a dead end, which is precisely what criterion `proj-detail-interview` refuses. Deliberately NOT a settings-apply: nothing here is a policy the running instance obeys, so there is no web.env to patch and no restart to queue. The answers live on the platform row until a catalog row materializes (the provisioning_007 `type` precedent), and R16 (task 1002335) is the surface that reads `description` to compute publishability and name what is still missing. `modules` rides the SAME route for the same reason (BV1.R23, task 1002342, ADR 0245): step 4 of the wizard is skippable exactly as step 3 is, so it needs the same way back, and it lands on the same platform row under the same ownership gate. Only an ARRAY is a change — an omitted or null key leaves the column alone, so the \"never asked\" NULL (ADR 0240 §2) can never be written by a later edit. The always-on core stays unremovable by construction: badModuleSelection refuses its keys and `effectiveModules` re-adds it on read.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "── The optional project detail (task 1002334, goal 1000046) ────────────── PATCH /provisioning/instances/:id/detail — answer (or re-answer) the wizard's OPTIONAL creation steps after creation. Body: any subset of { description, detail, modules }. rank: any authenticated builder (own resource; archon may change any — same gate as settings). THIS ROUTE IS WHAT MAKES THE STEP SKIPPABLE. Skipping at creation leaves the project dark-matter — off the map and un-joinable (ADR 0182 D4) — and that is a supported default only because there is a way back. Without this route \"optional\" would mean \"permanently unpublishable\", i.e. a dead end, which is precisely what criterion `proj-detail-interview` refuses. Deliberately NOT a settings-apply: nothing here is a policy the running instance obeys, so there is no web.env to patch and no restart to queue. The answers live on the platform row until a catalog row materializes (the provisioning_007 `type` precedent), and R16 (task 1002335) is the surface that reads `description` to compute publishability and name what is still missing. `modules` rides the SAME route for the same reason (BV1.R23, task 1002342, ADR 0245): step 4 of the wizard is skippable exactly as step 3 is, so it needs the same way back, and it lands on the same platform row under the same ownership gate. Only an ARRAY is a change — an omitted or null key leaves the column alone, so the \"never asked\" NULL (ADR 0240 §2) can never be written by a later edit. The always-on core stays unremovable by construction: badModuleSelection refuses its keys and `effectiveModules` re-adds it on read. AN ANSWER CAN BE TAKEN BACK (task 1003577). `detail` merges, so before this the first `team_shape` an owner sent was permanent — and \"never answered\" is a state `effectiveModules` reads (ADR 0240), not merely the absence of one. Sending `detail: { <key>: null }` UN-ANSWERS that question: the key is dropped from the jsonb, so the row reads back exactly as one that was never asked and the bundle the answer moved moves back. Only null does it — an empty string or any other value is still refused as off-vocabulary, and `detail: {}` still changes nothing, because a form that collected no answers is not asking for any to be erased.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "parameters": [

package/docs/module-api-changelog.md

@@ -1521,5 +1521,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.534 with no explicit bump. run 33886686350. (task 1002620)
   1.19.536 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.535 with no explicit bump. run 33888048777. (task 1002620)
+  1.19.537 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.536 with no explicit bump. run 33888812605. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/provisioning.js

@@ -492,6 +492,26 @@ function normalizeProjectDetail(input) {
   return out;
 }
 
+// A detail PATCH split into what it SETS and what it CLEARS (task 1003577). An
+// explicit `null` for a known question means UN-ANSWER it — the JSON-merge-patch
+// convention (RFC 7396) this repo already uses for `description` on the same route
+// and for every builder-settings knob. It exists because a merging write can add an
+// answer but never take one back, which made "never answered" — the third value
+// ADR 0240 and `effectiveModules` both read — a state a project could leave once and
+// never return to. Everything else is unchanged: an off-vocabulary value is still
+// dropped rather than treated as a clear, and an empty patch still changes nothing.
+// PURE.
+function projectDetailPatch(input) {
+  const given = input && typeof input === 'object' && !Array.isArray(input) ? input : {};
+  const set = {};
+  const clear = [];
+  for (const [key, vocab] of Object.entries(PROJECT_DETAIL_VOCAB)) {
+    if (given[key] === null) clear.push(key);
+    else if (vocab.includes(given[key])) set[key] = given[key];
+  }
+  return { set, clear };
+}
+
 // What a row's detail answers READ as — the stored object filtered through the
 // same vocabulary, so a value that was valid when written and has since left the
 // vocabulary never leaks out of the read surface. Mirrors effectiveSettings, minus
@@ -661,6 +681,13 @@ async function updateInstanceSettings(db, id, patch) {
 // is the honest consequence of deleting half the identity gate, not a bug.
 // Undefined leaves the column alone.
 //
+// A merge alone could only ever ADD an answer, so `detail` also takes a PER-KEY null
+// as "un-answer this question" (task 1003577, RFC 7396's rule and `description`'s own
+// beside it): the key is DROPPED from the jsonb rather than stored as null, so the row
+// reads back exactly as one that was never asked — which is the state ADR 0240 and
+// `effectiveModules` treat as a distinct third value. `detail: {}` still changes
+// nothing, since a form that sends no answers is not asking for any to be erased.
+//
 // `modules` is the SAME way back for the wizard's other optional step (BV1.R23,
 // task 1002342, ADR 0245). It REPLACES like `description` and unlike `detail`: a
 // module selection is one whole list, so merging would make removing a module
@@ -675,8 +702,11 @@ async function updateInstanceDetail(db, id, { description, detail, modules } = {
     sets.push(`description = $${params.length}`);
   }
   if (detail !== undefined) {
-    params.push(JSON.stringify(normalizeProjectDetail(detail)));
-    sets.push(`detail = detail || $${params.length}::jsonb`);
+    const { set, clear } = projectDetailPatch(detail);
+    params.push(JSON.stringify(set));
+    const merged = params.length;
+    params.push(clear);
+    sets.push(`detail = (detail || $${merged}::jsonb) - $${params.length}::text[]`);
   }
   if (modules !== undefined) {
     const picked = normalizeModuleSelection(modules);
@@ -1211,7 +1241,7 @@ module.exports = {
   // pure
   isValidSlug, costEstimateUsd, publicInstance, normalizeHostname,
   defaultDomainForSlug, isReservedHostname, effectiveSettings, planetChoice,
-  normalizeDescription, normalizeProjectDetail, projectDetail,
+  normalizeDescription, normalizeProjectDetail, projectDetailPatch, projectDetail,
   // pure — GitHub App Manifest flow (task 2080)
   githubAppName, buildGithubAppManifest, manifestPostUrl, publicGithubApp,
   // data access

package/modules/provisioning/routes/provisioning.js

@@ -113,8 +113,13 @@ function badProjectDetail(detail) {
     if (!Object.prototype.hasOwnProperty.call(vocab, key)) {
       return { code: 'bad_detail', message: `Unknown detail answer "${key}" — the interview asks: ${Object.keys(vocab).join(', ')}.` };
     }
+    // An explicit null is the UN-ANSWER, not an off-vocabulary value (task 1003577):
+    // the merge-patch way back to "never answered". Only null — an empty string or any
+    // other sentinel stays a typo, so a caller trying to SET one is never silently
+    // read as having erased their answer.
+    if (value === null) continue;
     if (!vocab[key].includes(value)) {
-      return { code: 'bad_detail', message: `"${key}" must be one of: ${vocab[key].join(', ')}.` };
+      return { code: 'bad_detail', message: `"${key}" must be one of: ${vocab[key].join(', ')} — or null to un-answer it.` };
     }
   }
   return null;
@@ -682,6 +687,15 @@ module.exports = function provisioningRoutes() {
   // column alone, so the "never asked" NULL (ADR 0240 §2) can never be written by
   // a later edit. The always-on core stays unremovable by construction:
   // badModuleSelection refuses its keys and `effectiveModules` re-adds it on read.
+  //
+  // AN ANSWER CAN BE TAKEN BACK (task 1003577). `detail` merges, so before this the
+  // first `team_shape` an owner sent was permanent — and "never answered" is a state
+  // `effectiveModules` reads (ADR 0240), not merely the absence of one. Sending
+  // `detail: { <key>: null }` UN-ANSWERS that question: the key is dropped from the
+  // jsonb, so the row reads back exactly as one that was never asked and the bundle
+  // the answer moved moves back. Only null does it — an empty string or any other
+  // value is still refused as off-vocabulary, and `detail: {}` still changes nothing,
+  // because a form that collected no answers is not asking for any to be erased.
   router.patch('/provisioning/instances/:id/detail', auth.requireBuilder, async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;

package/modules/provisioning/tests/provisioning.mjs

@@ -323,12 +323,32 @@ t('normalizeProjectDetail: on-vocabulary keys only — an unknown key or value i
   assert.deepEqual(P.normalizeProjectDetail({ team_shape: 'community' }), { team_shape: 'community' });
   assert.deepEqual(P.normalizeProjectDetail({ team_shape: 'enormous' }), {}, 'an off-vocabulary answer is not stored');
   assert.deepEqual(P.normalizeProjectDetail({ favourite_colour: 'blue' }), {}, 'an unknown question is not stored');
+  assert.deepEqual(P.normalizeProjectDetail({ team_shape: null }), {},
+    'the un-answer (task 1003577) is a PATCH verb — at creation there is nothing to clear, so it just stores nothing');
   // skipping is the supported default, so every not-an-object shape reads as {}
   for (const skipped of [undefined, null, 'solo', ['solo'], 7]) {
     assert.deepEqual(P.normalizeProjectDetail(skipped), {}, 'a skipped interview stores {}');
   }
 });
 
+t('projectDetailPatch: an explicit null CLEARS the answer; an off-vocabulary value is still dropped (task 1003577)', () => {
+  // The way back to "never answered" — the third value effectiveModules reads
+  // (ADR 0240) and that a merging write could never reach again once written.
+  assert.deepEqual(P.projectDetailPatch({ team_shape: 'community' }), { set: { team_shape: 'community' }, clear: [] });
+  assert.deepEqual(P.projectDetailPatch({ team_shape: null }), { set: {}, clear: ['team_shape'] },
+    'null is the un-answer, not an off-vocabulary value');
+  assert.deepEqual(P.projectDetailPatch({ team_shape: 'enormous' }), { set: {}, clear: [] },
+    'an off-vocabulary answer neither stores nor clears — normalizeProjectDetail\'s rule is unchanged');
+  assert.deepEqual(P.projectDetailPatch({ team_shape: '' }), { set: {}, clear: [] },
+    'only null clears; an empty string is just another value the vocabulary refuses');
+  assert.deepEqual(P.projectDetailPatch({ favourite_colour: null }), { set: {}, clear: [] },
+    'an unknown question has no answer to clear');
+  // `{}` stays a no-op, which is RFC 7396's own rule and what a skipped step sends
+  for (const nothing of [{}, undefined, null, 'solo', ['solo'], 7]) {
+    assert.deepEqual(P.projectDetailPatch(nothing), { set: {}, clear: [] }, 'an empty patch changes nothing');
+  }
+});
+
 t('projectDetail: a stored value that has since LEFT the vocabulary never leaks out of the read surface', () => {
   assert.deepEqual(P.projectDetail({ detail: { team_shape: 'solo' } }), { team_shape: 'solo' });
   assert.deepEqual(P.projectDetail({ detail: { team_shape: 'guild' } }), {});
@@ -408,9 +428,16 @@ await ta('updateInstanceDetail: detail MERGES, description REPLACES, and neither
   const db = { query: async (q, p) => { sql = q; params = p; return { rows: [{ id: 18 }] }; } };
 
   await P.updateInstanceDetail(db, 18, { detail: { team_shape: 'small-team' } });
-  assert.ok(sql.includes('detail = detail || $2::jsonb'), 'one answer does not erase the others');
+  assert.ok(sql.includes('detail = (detail || $2::jsonb) - $3::text[]'), 'one answer does not erase the others');
   assert.ok(!sql.includes('description ='), 'an unsent description is left alone, never nulled');
-  assert.deepEqual(params, [18, JSON.stringify({ team_shape: 'small-team' })]);
+  assert.deepEqual(params, [18, JSON.stringify({ team_shape: 'small-team' }), []],
+    'nothing to clear, so the key-drop list is empty');
+
+  // The way back (task 1003577): an explicit null UN-ANSWERS the question, which a
+  // merging write alone could never do — `{}` merges to nothing and an off-vocabulary
+  // sentinel is dropped, so before this the first answer was permanent.
+  await P.updateInstanceDetail(db, 18, { detail: { team_shape: null } });
+  assert.deepEqual(params, [18, '{}', ['team_shape']], 'the key is DROPPED from the jsonb, not stored as null');
 
   await P.updateInstanceDetail(db, 18, { description: 'Filled in later.' });
   assert.ok(sql.includes('description = $2'), 'the way back for a skipped step');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.536",
+  "version": "1.19.537",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.536",
+      "version": "1.19.537",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.536",
+  "version": "1.19.537",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.536'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.537'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provisioning_module_selection.mjs

@@ -169,15 +169,20 @@ provisioning.createInstance = async (_db, args) => {
 provisioning.enqueueIntent = async (_db, id, action) => ({ intent: { id: 9, action, state: 'pending' }, created: true });
 provisioning.getOpenIntent = async () => null;
 provisioning.recordEvent = async () => {};
-// Mirrors the real statement: `detail = detail || $n::jsonb` MERGES the
-// normalized answers onto what is already stored. The row the route then hands
-// `effectiveModules` is that merged one, so a stub that returned the pre-patch
-// row would hide exactly the staleness this test exists to catch.
+// Mirrors the real statement: `detail = (detail || $n::jsonb) - $m::text[]` MERGES
+// the patch's answers onto what is already stored and DROPS the keys it explicitly
+// un-answered (task 1003577). The row the route then hands `effectiveModules` is
+// that merged one, so a stub that returned the pre-patch row would hide exactly the
+// staleness this test exists to catch — and one that only merged would hide the
+// clear, which is the whole way back to "never answered".
 provisioning.updateInstanceDetail = async (_db, _id, patch) => {
   lastUpdatedRow = { ...detailRow };
   if (patch.description !== undefined) lastUpdatedRow.description = patch.description;
   if (patch.detail !== undefined) {
-    lastUpdatedRow.detail = { ...(detailRow.detail || {}), ...provisioning.normalizeProjectDetail(patch.detail) };
+    const { set, clear } = provisioning.projectDetailPatch(patch.detail);
+    const next = { ...(detailRow.detail || {}), ...set };
+    for (const key of clear) delete next[key];
+    lastUpdatedRow.detail = next;
   }
   // `modules` REPLACES and is normalized on the way in — the real statement's
   // `modules = $n::jsonb` over normalizeModuleSelection (BV1.R23, task 1002342).
@@ -502,6 +507,110 @@ await ta('PATCH /detail: another builder’s project is a 404, not a module chan
   detailRow = null; lastUpdatedRow = null;
 });
 
+// ── Un-answering the interview ─────────────────────────────────────────────
+// Task 1003577. `effectiveModules` reads three states off a row and "nobody said"
+// is one of them, but a MERGING write could only ever add an answer: `{}` merged to
+// nothing and `null` was dropped by the vocabulary, so the first `team_shape` an
+// owner ever sent was permanent and the bundle it moved could never move back. An
+// explicit per-key `null` is now the un-answer (RFC 7396, and `description`'s own
+// rule on this same route), and the read-back has to resolve as a never-answered row
+// — not merely "close to one".
+
+await ta('PATCH /detail: answer then CLEAR — the row reads back exactly as one that was never asked', async () => {
+  // Arrange — a game project that skipped the picker, so its modules resolve from
+  // the bundle and the interview answer is the only thing that can move them.
+  const virgin = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: null, detail: {} };
+  const neverAnswered = effectiveModules(virgin);
+  assert.equal(neverAnswered.source, 'bundle', 'the fixture really is an unanswered project');
+
+  detailRow = { ...virgin };
+  lastUpdatedRow = null;
+  const answered = await patch('/provisioning/instances/41/detail', { detail: { team_shape: 'solo' } });
+  assert.equal(answered.status, 200, answered.raw);
+  assert.deepEqual(answered.body.detail, { team_shape: 'solo' });
+  assert.notDeepEqual(answered.body.modules.selected, neverAnswered.selected,
+    'the fixture is only meaningful if the answer really moved the bundle');
+
+  // Act — the owner takes it back
+  detailRow = lastUpdatedRow;
+  lastUpdatedRow = null;
+  const cleared = await patch('/provisioning/instances/41/detail', { detail: { team_shape: null } });
+
+  // Assert — the stored answer is GONE, not stored as null, and every derived read
+  // is the unanswered one again
+  assert.equal(cleared.status, 200, cleared.raw);
+  assert.ok(!('team_shape' in lastUpdatedRow.detail), 'the key left the jsonb entirely');
+  assert.deepEqual(cleared.body.detail, {}, 'and the read surface says the interview is unanswered');
+  assert.deepEqual(cleared.body.modules, neverAnswered, 'source, preset and adjustments are the never-answered ones');
+  assert.equal(cleared.body.modules.source, 'bundle');
+  assert.deepEqual(cleared.body.modules.selected, bundleForProjectType('game').bundle, 'the UNADJUSTED preset');
+  assert.deepEqual(cleared.body.modules.adjustments, [], 'no rule fired, so nothing claims to have');
+  assert.deepEqual(cleared.body.publish, answered.body.publish, 'clearing an answer is not a publish change');
+  detailRow = null; lastUpdatedRow = null;
+});
+
+await ta('PATCH /detail: clearing one key leaves every other stored key alone', async () => {
+  // The statement drops the named key rather than replacing the column, so an answer
+  // the patch never mentioned survives — including one stored before it left the
+  // vocabulary, which `projectDetail` filters on READ and must not silently delete.
+  detailRow = {
+    id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: null,
+    detail: { team_shape: 'community', legacy_answer: 'kept' },
+  };
+  lastUpdatedRow = null;
+
+  const res = await patch('/provisioning/instances/41/detail', { detail: { team_shape: null } });
+
+  assert.equal(res.status, 200, res.raw);
+  assert.deepEqual(lastUpdatedRow.detail, { legacy_answer: 'kept' }, 'only the nulled key was dropped');
+  assert.deepEqual(res.body.detail, {}, 'and the read still filters the survivor through the vocabulary');
+  detailRow = null; lastUpdatedRow = null;
+});
+
+await ta('PATCH /detail: an off-vocabulary value is still REFUSED, never mistaken for a clear', async () => {
+  // Only null un-answers. A typo, an empty string or any other sentinel is the
+  // loud-validation case badProjectDetail was written for — silently treating one as
+  // "clear" would erase an answer the caller was trying to set.
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: null, detail: { team_shape: 'solo' } };
+  for (const value of ['enormous', '', 0, false]) {
+    lastUpdatedRow = null;
+    const res = await patch('/provisioning/instances/41/detail', { detail: { team_shape: value } });
+    assert.equal(res.status, 400, `${JSON.stringify(value)} → ${res.raw}`);
+    assert.equal(res.body.error.code, 'bad_detail');
+    assert.match(res.body.error.message, /solo/, 'the message names the answers it does take');
+    assert.equal(lastUpdatedRow, null, 'a refused write touches nothing');
+  }
+  detailRow = null; lastUpdatedRow = null;
+});
+
+await ta('POST /instances: a null answer at CREATION is accepted and stores nothing — there is nothing to un-answer yet', async () => {
+  // badProjectDetail is shared with the create route, so the un-answer verb must not
+  // become a 400 there. Nothing to clear at creation, so it simply reads as no answer.
+  lastCreateArgs = null; existingRow = null;
+
+  const res = await post('/provisioning/instances', {
+    slug: 'mercury', hosting_shape: 'standalone', type: 'game', detail: { team_shape: null },
+  });
+
+  assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
+  assert.deepEqual(res.body.instance.detail, {}, 'the row is born unanswered, as it would be with no detail at all');
+});
+
+await ta('PATCH /detail: an EMPTY detail patch still changes nothing — a skipped form is not an erase', async () => {
+  // RFC 7396's own rule, and the one ADR 0240 leans on: `{}` is the shape a form
+  // sends when it collected no answers, so making it erase would un-answer the
+  // interview every time an owner saved the step without touching it.
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: null, detail: { team_shape: 'solo' } };
+  lastUpdatedRow = null;
+
+  const res = await patch('/provisioning/instances/41/detail', { detail: {} });
+
+  assert.equal(res.status, 200, res.raw);
+  assert.deepEqual(lastUpdatedRow.detail, { team_shape: 'solo' }, 'the stored answer survives an empty patch');
+  assert.deepEqual(res.body.detail, { team_shape: 'solo' });
+  detailRow = null; lastUpdatedRow = null;
+});
+
 server.close();
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);