@bongos/core 1.19.59 → 1.19.61

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.59",
-  "core_contract": "1.19.59",
-  "source_commit": "e93244fafbe4236b1b90218f03c70c92bfd0becb",
+  "core_version": "1.19.61",
+  "core_contract": "1.19.61",
+  "source_commit": "073b10995781fbdfae0a9da943fa8755002e51bf",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T23:37:01.674Z",
+  "built_at": "2026-08-12T00:24:52.611Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 291,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1217,
+    "functional_verbatim": 1220,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1529,
-  "tree_sha256": "0f793cd7617fce56439932f68de11239e7639d28e50f8d9ee485ba8a602a5f30",
+  "file_count": 1532,
+  "tree_sha256": "c4d2ff9c96e88bf23e2c2c1acf1593d174589a1b9beeb7b3b12d61c65bb84113",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "8aeb1aaf87db169788d5e17a671846526a1c89f184ee6ff0425730ecea71fb8a"
+      "sha256": "36eb537043097dc8e05307adc06d893a2c5ceb8cceb63f24b64ade001a0a2640"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "724bfb1a3647a316226f32b1b62f56e30dba8df28a2ccfadb1dcbaaff65e7197"
+      "sha256": "ad598bf38511e3e7bd9f25a82987126cd71cfe76ac8275ddee2bcd90eb8e6a11"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "e4efb5ad8e209a5c27c9a85f42e920915a7d7b91491197b03a52f85091319247"
+      "sha256": "43823273ec587b104f3e0296614ae8ea6c4dc5c96261dbbb359ae39c21cf4e79"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "5c89524ec76f5f5df365a188541d50aa31167ae7920124baf562fb32ad30632c"
+      "sha256": "4deeae55ba58483557310d768a63df7cd75a1219137539b7ccbbf4481f09f5d9"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "ff501fe93dd31785d2acb8e55c9b664128065d7acf2862fb91af0800274619de"
+      "sha256": "6d441799f948513f840394bd382dba7e601e79a07fb7591bcb0e05aea2edd2a9"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1307,12 +1307,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "27e9c0ab46db5386833b9e03bcff0dae31f4606882e845e7e830f9ef6f2550b5"
+      "sha256": "a30007778606ce90b8e31470d926047a372c72b93022f54023937cfd4c5b5fc0"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "0076d08133c342fa905fa90682e606eefa02747d5b11aea9f0bdb3563b293f76"
+      "sha256": "0e7646ee148453ef5d6d51b3434253b76f35628ee6c36681dbf6e7b27dd20c6f"
     },
     {
       "path": "docs/architecture.md",
@@ -2552,7 +2552,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "e4efb5ad8e209a5c27c9a85f42e920915a7d7b91491197b03a52f85091319247"
+      "sha256": "43823273ec587b104f3e0296614ae8ea6c4dc5c96261dbbb359ae39c21cf4e79"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -3719,6 +3719,11 @@
       "mode": "0000644",
       "sha256": "c25101daed13fc22ba3f132b2dac59c782fa564fa4bc22a6a5169e6644109b3a"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_005_domain_attach.sql",
+      "mode": "0000644",
+      "sha256": "230e8a9df147495ee5113c1400c582e9e39e3286baab7e01ce7684e1b1c7860c"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -3732,7 +3737,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "468557062f75a9a02e3cab53103389d7ecaaede6528b60587e51a71ce9dfecf5"
+      "sha256": "48c047c48579a1cb5cc6b36c2148bcab5c1736a16c4c73c0741a8998bfe922cd"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -3742,7 +3747,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "f48562d5f17e0ea9934b4ca96c84e1ac0fc448819a8fff54227045e52aa98731"
+      "sha256": "a490a4b4b607a302533bac6fedbc39a0153d57e35a086bcc20079fbefc6815e5"
     },
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
@@ -4032,12 +4037,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f2e15bf06d0e8080e47aeea514dfc26dc267c14a96d32fe805cb240491f0baad"
+      "sha256": "9b320dfef27bca09c1ab23bb85c04b499724208dad01a608763f18b9c4e1d1b4"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c3feb3c561c5bf96e9580673b6995835a0d5674f54f96c8b3109fc304e090556"
+      "sha256": "d1720c6790a6aa61a091335cf8873dac1e75dfbb1250c7d484395c95fd8825c6"
     },
     {
       "path": "public-docs/index.html",
@@ -5007,7 +5012,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "93a5c4a6d6f76cf1fa8ca4c902b19d6ef94f9147488f1c01d3413f692a196942"
+      "sha256": "e4108117dbe8dd6493ba41ed053fe8648424ca127b1c26505aa6f6702b2dd94c"
     },
     {
       "path": "scripts/gds/publish-manifest.js",
@@ -5657,7 +5662,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a02eb4c1cfa272d700a9776652612143de38566cd86208f059ed1d0fed24934b"
+      "sha256": "0126fe1e9af95f3daee985c7a9859e19b5937e023d6a54927b6c5dd7055a83ec"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -7137,7 +7142,12 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "6f47c2a9c43fbef9b26090c9ca794a67bbca279f5bc79db625f26fa43775d4b7"
+      "sha256": "bd8e111c2d5614f79086c5f8298cec6ffdcb7ab57b94565457520d85df0c24a8"
+    },
+    {
+      "path": "tests/provisioning_domain_attach.mjs",
+      "mode": "0000644",
+      "sha256": "241e1b208abbd54a625af050d541344186d93806846a1e7f1cbb0f93dfbab802"
     },
     {
       "path": "tests/provisioning_github_app_routes.mjs",
@@ -7149,6 +7159,11 @@
       "mode": "0000644",
       "sha256": "9a41d64fba3a8cc8ffdbccb0aea363ca6ccb63909cfeefd4bd0b05ebab052403"
     },
+    {
+      "path": "tests/provisioning_teardown_intent.mjs",
+      "mode": "0000644",
+      "sha256": "c5ebacf7e29be4e6afecedf5b8593eef750d497e0c502cfa2be92a89b2cff0a1"
+    },
     {
       "path": "tests/pruned_lockfile_integrity.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 268 operations across 45 resource groups
+- 269 operations across 45 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -523,6 +523,8 @@ function createClient(opts = {}) {
       postProvisioningInstances: (args) => request("POST", "/provisioning/instances", { hasBody: true }, args),
       // GET /provisioning/instances/{id} — rank: any-builder — GET /provisioning/instances/:id
       getProvisioningInstancesId: (args) => request("GET", "/provisioning/instances/{id}", { hasBody: false }, args),
+      // POST /provisioning/instances/{id}/domain — rank: any-builder — POST /provisioning/instances/:id/domain
+      postProvisioningInstancesIdDomain: (args) => request("POST", "/provisioning/instances/{id}/domain", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/force-teardown — rank: metic+archon — POST /provisioning/instances/:id/force-teardown
       postProvisioningInstancesIdForceTeardown: (args) => request("POST", "/provisioning/instances/{id}/force-teardown", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/github-app — rank: any-builder — POST /provisioning/instances/:id/github-app

package/clients/bongos-client/index.cjs

@@ -522,6 +522,8 @@ function createClient(opts = {}) {
       postProvisioningInstances: (args) => request("POST", "/provisioning/instances", { hasBody: true }, args),
       // GET /provisioning/instances/{id} — rank: any-builder — GET /provisioning/instances/:id
       getProvisioningInstancesId: (args) => request("GET", "/provisioning/instances/{id}", { hasBody: false }, args),
+      // POST /provisioning/instances/{id}/domain — rank: any-builder — POST /provisioning/instances/:id/domain
+      postProvisioningInstancesIdDomain: (args) => request("POST", "/provisioning/instances/{id}/domain", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/force-teardown — rank: metic+archon — POST /provisioning/instances/:id/force-teardown
       postProvisioningInstancesIdForceTeardown: (args) => request("POST", "/provisioning/instances/{id}/force-teardown", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/github-app — rank: any-builder — POST /provisioning/instances/:id/github-app

package/clients/bongos-client/index.d.ts

@@ -246,10 +246,12 @@ export interface PostOverrideRequestsIdDecideRequest { decision: string; note?:
 export interface PostProjectsInviteRequest { client_id: string; github_login: string }
 export interface PostProjectsRequest { origin: string; name: string; tagline?: string; art_url?: string }
 export interface PostProjectsResponse { project: unknown }
-export interface PostProvisioningInstancesIdForceTeardownResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; message: unknown }
+export interface PostProvisioningInstancesIdDomainRequest { domain: string }
+export interface PostProvisioningInstancesIdDomainResponse { ok: boolean; changed: boolean; queued: unknown; domain: unknown; message: unknown }
+export interface PostProvisioningInstancesIdForceTeardownResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; superseded: unknown; message: unknown }
 export interface PostProvisioningInstancesIdGithubAppRequest { account?: string }
 export interface PostProvisioningInstancesIdGithubAppResponse { state: unknown; account: unknown; post_url: unknown; personal_url: unknown; org_url: unknown; org_login: unknown; manifest: unknown; redirect_url: unknown; expires_at: unknown }
-export interface PostProvisioningInstancesIdTeardownResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; message: unknown }
+export interface PostProvisioningInstancesIdTeardownResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; superseded: unknown; message: unknown }
 export interface PostProvisioningInstancesRequest { slug: string; target_ref?: string; hosting_shape?: string; domain?: string; tier?: string; onboard_mode?: string }
 export interface PostSearchMarkRequest { chunk_id?: StringifiableId; useful?: unknown }
 export interface PostSearchRequest { expand?: unknown; q?: string; source_kind?: string; limit?: unknown }
@@ -756,6 +758,8 @@ export interface BongosClient {
     postProvisioningInstances(args: RequestArgs & { body: PostProvisioningInstancesRequest }): Promise<ApiResponse>;
     /** GET /provisioning/instances/{id} — rank: any-builder */
     getProvisioningInstancesId(args?: RequestArgs): Promise<GetProvisioningInstancesIdResponse>;
+    /** POST /provisioning/instances/{id}/domain — rank: any-builder */
+    postProvisioningInstancesIdDomain(args: RequestArgs & { body: PostProvisioningInstancesIdDomainRequest }): Promise<PostProvisioningInstancesIdDomainResponse>;
     /** POST /provisioning/instances/{id}/force-teardown — rank: metic+archon */
     postProvisioningInstancesIdForceTeardown(args?: RequestArgs): Promise<PostProvisioningInstancesIdForceTeardownResponse>;
     /** POST /provisioning/instances/{id}/github-app — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -519,6 +519,8 @@ export function createClient(opts = {}) {
       postProvisioningInstances: (args) => request("POST", "/provisioning/instances", { hasBody: true }, args),
       // GET /provisioning/instances/{id} — rank: any-builder — GET /provisioning/instances/:id
       getProvisioningInstancesId: (args) => request("GET", "/provisioning/instances/{id}", { hasBody: false }, args),
+      // POST /provisioning/instances/{id}/domain — rank: any-builder — POST /provisioning/instances/:id/domain
+      postProvisioningInstancesIdDomain: (args) => request("POST", "/provisioning/instances/{id}/domain", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/force-teardown — rank: metic+archon — POST /provisioning/instances/:id/force-teardown
       postProvisioningInstancesIdForceTeardown: (args) => request("POST", "/provisioning/instances/{id}/force-teardown", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/github-app — rank: any-builder — POST /provisioning/instances/:id/github-app

package/docs/api/openapi.json

@@ -8493,6 +8493,69 @@
         ]
       }
     },
+    "/provisioning/instances/{id}/domain": {
+      "post": {
+        "operationId": "post_provisioning_instances_id_domain",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "POST /provisioning/instances/:id/domain",
+        "description": "POST /provisioning/instances/:id/domain — give the caller's OWN instance its address (task 1002692, gap 5: no path existed to add a domain after creation). Validates + records the domain; for an already-ACTIVE instance it also enqueues a 'domain-attach' intent the control-plane runner drains (web tier holds no cloud tokens — ADR 0111 §2). A requested/error instance only records it: the (re)provision run wires the domain itself. Re-pointing an existing address is out of scope — refuse truthfully. Body: { domain (required) }.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/provisioning/routes/provisioning.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostProvisioningInstancesIdDomainRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostProvisioningInstancesIdDomainResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/provisioning/instances/{id}/force-teardown": {
       "post": {
         "operationId": "post_provisioning_instances_id_force_teardown",
@@ -15628,6 +15691,40 @@
           "project"
         ]
       },
+      "PostProvisioningInstancesIdDomainRequest": {
+        "type": "object",
+        "properties": {
+          "domain": {
+            "type": "string",
+            "maxLength": 253
+          }
+        },
+        "required": [
+          "domain"
+        ],
+        "additionalProperties": false
+      },
+      "PostProvisioningInstancesIdDomainResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "changed": {
+            "type": "boolean"
+          },
+          "queued": {},
+          "domain": {},
+          "message": {}
+        },
+        "required": [
+          "ok",
+          "changed",
+          "queued",
+          "domain",
+          "message"
+        ]
+      },
       "PostProvisioningInstancesIdForceTeardownResponse": {
         "type": "object",
         "properties": {
@@ -15637,6 +15734,7 @@
           "queued": {},
           "action": {},
           "status": {},
+          "superseded": {},
           "message": {}
         },
         "required": [
@@ -15644,6 +15742,7 @@
           "queued",
           "action",
           "status",
+          "superseded",
           "message"
         ]
       },
@@ -15691,6 +15790,7 @@
           "queued": {},
           "action": {},
           "status": {},
+          "superseded": {},
           "message": {}
         },
         "required": [
@@ -15698,6 +15798,7 @@
           "queued",
           "action",
           "status",
+          "superseded",
           "message"
         ]
       },
@@ -16871,9 +16972,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 268,
-  "x-schema-count": 300,
+  "x-endpoint-count": 269,
+  "x-schema-count": 302,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 203,
+  "x-response-schemas": 204,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 268 endpoints across 44 route files.
+> **Generated from the live route files** — the route file is authoritative. 269 endpoints across 44 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -358,7 +358,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/projects/featured` | `public` | — | a curated public showcase; no auth by design. |
 | POST | `/api/bongos/projects/invite` | `metic+archon` | `client_id`, `github_login` | invite a builder into a project (ADR 0141 §5, task #1002115). |
 
-## `provisioning` (13)
+## `provisioning` (14)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -370,6 +370,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/provisioning/instances` | `any-builder` | — | GET /provisioning/instances — the caller's own instances + each open intent. |
 | POST | `/api/bongos/provisioning/instances` | `any-builder` | `slug`, `target_ref`, `hosting_shape`, `domain`, `tier`, `onboard_mode` | POST /provisioning/instances — request a new instance. |
 | GET | `/api/bongos/provisioning/instances/:id` | `any-builder` | — | GET /provisioning/instances/:id — read one of the caller's own instances. |
+| POST | `/api/bongos/provisioning/instances/:id/domain` | `any-builder` | `domain` | POST /provisioning/instances/:id/domain — give the caller's OWN instance its address (task 1002692, gap 5: no path existed to add a domai… |
 | POST | `/api/bongos/provisioning/instances/:id/force-teardown` | `metic+archon` | — | POST /provisioning/instances/:id/force-teardown — Archon tears down ANY instance. |
 | POST | `/api/bongos/provisioning/instances/:id/github-app` | `any-builder` | `account` | POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 01… |
 | POST | `/api/bongos/provisioning/instances/:id/teardown` | `any-builder` | — | POST /provisioning/instances/:id/teardown — request teardown of the caller's OWN instance. |

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -522,6 +522,8 @@ function createClient(opts = {}) {
       postProvisioningInstances: (args) => request("POST", "/provisioning/instances", { hasBody: true }, args),
       // GET /provisioning/instances/{id} — rank: any-builder — GET /provisioning/instances/:id
       getProvisioningInstancesId: (args) => request("GET", "/provisioning/instances/{id}", { hasBody: false }, args),
+      // POST /provisioning/instances/{id}/domain — rank: any-builder — POST /provisioning/instances/:id/domain
+      postProvisioningInstancesIdDomain: (args) => request("POST", "/provisioning/instances/{id}/domain", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/force-teardown — rank: metic+archon — POST /provisioning/instances/:id/force-teardown
       postProvisioningInstancesIdForceTeardown: (args) => request("POST", "/provisioning/instances/{id}/force-teardown", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/github-app — rank: any-builder — POST /provisioning/instances/:id/github-app

package/modules/provisioning/migrations/provisioning_005_domain_attach.sql

@@ -0,0 +1,20 @@
+-- provisioning_005_domain_attach.sql — the domain-attach intent action
+-- (task 1002692, gap 5 of the creation-flow audit / idea 1000677).
+--
+-- WHY. No path existed to give an EXISTING instance its address: a slug re-request
+-- silently dropped the domain in the body, and a domainless instance stayed
+-- domainless forever — which also blocked GitHub sign-in (the github-app manifest
+-- route requires a domain). The new owner-scoped POST /provisioning/instances/:id/
+-- domain records the domain and, for an already-ACTIVE instance, enqueues a
+-- 'domain-attach' intent; the control-plane runner (the sole token-holder, ADR 0111
+-- §2) re-asserts the domain-dependent standup legs (web.env origins + service
+-- restart, Cloudflare A-record UPSERT, Caddy snippet + reload, healthz). The web
+-- tier still only ENQUEUES — the trust boundary is unchanged.
+--
+-- Widening a CHECK enum is additive (permits MORE values; no row changes) — the
+-- provisioning_003 precedent. Applied only when the provisioning module is enabled.
+-- Safe to re-run. Keep INTENT_ACTIONS in provisioning.js in lockstep.
+
+ALTER TABLE provisioning_intents DROP CONSTRAINT IF EXISTS provisioning_intents_action_check;
+ALTER TABLE provisioning_intents ADD CONSTRAINT provisioning_intents_action_check
+  CHECK (action IN ('provision', 'teardown', 'oauth-manifest', 'domain-attach'));

package/modules/provisioning/provisioning.js

@@ -33,11 +33,25 @@ const ONBOARD_MODES = ['greenfield', 'adopt'];
 // conversion. Today the runner drains it by scanning provisioning_oauth_manifests
 // (drainOAuthManifests), not the intent queue, but it stays a valid action so the
 // widened CHECK (migration provisioning_003) and this list never drift.
-const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest'];
+// 'domain-attach' (task 1002692, migration provisioning_005): re-assert the
+// domain-dependent standup legs for an already-ACTIVE instance that was just
+// given its address via POST /provisioning/instances/:id/domain.
+const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest', 'domain-attach'];
 // The states from which a teardown is meaningful (there is something to reclaim).
 // Mirrors dev-box canTransition('deprovision', …): a requested/torn_down/error
 // instance has nothing running to tear down via the happy path.
 const TEARDOWN_FROM = new Set(['provisioning', 'active', 'tearing_down']);
+// The states from which (re)enqueueing a 'provision' intent is meaningful. An
+// 'active' instance needs no standup — blindly re-enqueueing one on a slug
+// re-request left a stale open provision intent that then blocked the owner's
+// teardown on the action-blind ux_provisioning_intents_open (task 1002691);
+// 'tearing_down' is mid-reclaim (any open slot belongs to the teardown).
+const PROVISION_ENQUEUE_FROM = new Set(['requested', 'provisioning', 'error', 'torn_down']);
+// The states from which attaching a domain is meaningful (task 1002692): 'active'
+// needs a 'domain-attach' intent (the runner re-asserts the domain legs);
+// 'requested'/'error' only record it — the (re)provision run wires the domain
+// itself. Mid-flight or torn-down states refuse truthfully.
+const DOMAIN_ATTACH_FROM = new Set(['requested', 'error', 'active']);
 
 // Monthly cost estimate (USD) for a dedicated droplet tier — VISIBILITY only
 // (ADR 0111 §6), never a bill. A small local table so this module needs no
@@ -248,6 +262,29 @@ async function getInstanceBySlug(db, slug) {
   return rows[0] || null;
 }
 
+// The instance currently holding `domain` (case-insensitive), if any — backs the
+// domain-attach route's uniqueness check so one owner's address can never silently
+// shadow another's (task 1002692). Caller normalizes; matching is defensive anyway.
+async function getInstanceByDomain(db, domain) {
+  if (!domain) return null;
+  const { rows } = await db.query(
+    `SELECT * FROM provisioning_instances WHERE lower(domain) = $1 LIMIT 1`,
+    [String(domain).toLowerCase()]
+  );
+  return rows[0] || null;
+}
+
+// Record an instance's domain — the ONLY column this touches (task 1002692). Status
+// changes stay setInstanceStatus's job; keeping this narrow means the domain-attach
+// route can never drift an instance's lifecycle as a side effect.
+async function updateInstanceDomain(db, id, domain) {
+  const { rows } = await db.query(
+    `UPDATE provisioning_instances SET domain = $2, updated_at = now() WHERE id = $1 RETURNING *`,
+    [id, domain]
+  );
+  return rows[0] || null;
+}
+
 // The caller's own instances, newest first.
 async function listInstancesForOwner(db, ownerBuilderId) {
   const { rows } = await db.query(
@@ -350,6 +387,31 @@ async function enqueueIntent(db, instanceId, action, requestedBy) {
   }
 }
 
+// Queue a teardown, superseding a stale PENDING provision intent if one holds the
+// open slot (task 1002691: ux_provisioning_intents_open is action-blind, so the old
+// blind enqueue collided with such an intent and the API falsely said "teardown
+// already queued" — the instance leaked). A pending provision is flipped to 'error'
+// (the state CHECK has no 'superseded'; last_error says why) so the runner never
+// stands it up. A RUNNING provision is mid-flight infra work and is never yanked —
+// the caller gets { conflict: 'open_intent' } with the blocking intent so the route
+// can answer truthfully. Each statement is atomic and the index stays the arbiter:
+// any interleaving with the runner or a concurrent enqueue lands on one of these
+// truthful outcomes.
+async function enqueueTeardown(db, instanceId, requestedBy) {
+  const { rows: superseded } = await db.query(
+    `UPDATE provisioning_intents
+        SET state = 'error', last_error = 'superseded: teardown requested',
+            updated_at = now(), resolved_at = now()
+      WHERE instance_id = $1 AND action = 'provision' AND state = 'pending'
+      RETURNING id`,
+    [instanceId]
+  );
+  const { intent, created } = await enqueueIntent(db, instanceId, 'teardown', requestedBy);
+  if (created) return { intent, created: true, superseded: superseded.length > 0 };
+  if (intent.action === 'teardown') return { intent, created: false, superseded: false };
+  return { intent, created: false, superseded: false, conflict: 'open_intent' };
+}
+
 // The instance's currently-open (pending|running) intent, if any.
 async function getOpenIntent(db, instanceId) {
   const { rows } = await db.query(
@@ -540,16 +602,16 @@ async function costLedger(db, { limit = 500 } = {}) {
 module.exports = {
   // constants
   INSTANCE_STATES, HOSTING_SHAPES, ONBOARD_MODES, INTENT_ACTIONS, TEARDOWN_FROM,
-  TIER_MONTHLY_USD, CERT_ELIGIBLE_STATES,
+  PROVISION_ENQUEUE_FROM, DOMAIN_ATTACH_FROM, TIER_MONTHLY_USD, CERT_ELIGIBLE_STATES,
   // pure
   isValidSlug, costEstimateUsd, publicInstance, normalizeHostname,
   // pure — GitHub App Manifest flow (task 2080)
   githubAppName, buildGithubAppManifest, manifestPostUrl,
   // data access
   isProvisionedHostname,
-  getInstanceById, getInstanceBySlug, listInstancesForOwner, listAllInstances,
-  createInstance, setInstanceStatus,
-  enqueueIntent, getOpenIntent, claimNextIntent, resolveIntent,
+  getInstanceById, getInstanceBySlug, getInstanceByDomain, listInstancesForOwner, listAllInstances,
+  createInstance, setInstanceStatus, updateInstanceDomain,
+  enqueueIntent, enqueueTeardown, getOpenIntent, claimNextIntent, resolveIntent,
   recordEvent, instanceStateForSlug, costLedger,
   // data access — GitHub App Manifest attempts (task 2080)
   createOAuthManifest, getOAuthManifestByState, attachManifestCode,