@bongos/core 1.19.772 → 1.19.774

package/modules/provisioning/disconnect.js

@@ -0,0 +1,35 @@
+// modules/provisioning/disconnect.js — the queue half of "Disconnect from Bongos
+// entirely" (task 1003249, ADR 0290).
+//
+// A teardown keeps the database, backups and address (ADR 0181); a disconnect erases
+// them and deletes the row, so the name, port and address are reusable. The web tier
+// only enqueues it; scripts/gds/provision-disconnect.js is the runner leg that does it.
+//
+// Its own file because provisioning.js sits at the size ratchet. It reaches the queue
+// through the provisioning module OBJECT, so a test can stub getOpenIntent/enqueueIntent.
+'use strict';
+
+const provisioning = require('./provisioning');
+
+// Queue a disconnect. Unlike a teardown it SUPERSEDES NOTHING: any other open intent —
+// even a pending one — refuses it with { conflict: 'open_intent' }, because a
+// destructive run must never race a standup or a teardown that is about to start.
+// An open disconnect makes a repeat idempotent. The partial unique index
+// ux_provisioning_intents_open stays the arbiter if two requests interleave.
+async function enqueueDisconnect(db, instanceId, requestedBy) {
+  const open = await provisioning.getOpenIntent(db, instanceId);
+  if (open) return open.action === 'disconnect' ? { intent: open, created: false } : { intent: open, created: false, conflict: 'open_intent' };
+  const r = await provisioning.enqueueIntent(db, instanceId, 'disconnect', requestedBy);
+  if (r.created || r.intent.action === 'disconnect') return r;
+  return { ...r, conflict: 'open_intent' };
+}
+
+// Delete the provisioning row. Its intents, events and OAuth-manifest attempts go with it
+// (ON DELETE CASCADE), including the running disconnect intent itself — which is why the
+// runner resolving that intent afterwards is a harmless no-op. Returns the rows removed.
+async function deleteInstance(db, instanceId) {
+  const { rowCount } = await db.query('DELETE FROM provisioning_instances WHERE id = $1', [instanceId]);
+  return rowCount;
+}
+
+module.exports = { enqueueDisconnect, deleteInstance };

package/modules/provisioning/migrations/provisioning_016_disconnect.sql

@@ -0,0 +1,21 @@
+-- provisioning_016_disconnect.sql — the disconnect intent action (task 1003249,
+-- ADR 0290: "Disconnect from Bongos entirely").
+--
+-- WHY. A teardown deliberately keeps a project's database, backups and address
+-- (ADR 0181), so "Take it offline" is always reversible. The owner asked for a
+-- separate, owner-initiated true delete: tear down, drop the database and its
+-- dumps, retire the catalog + membership rows, and delete the provisioning row so
+-- the name, port and address are reusable. It is destructive, so it runs where
+-- every destructive leg runs — on the control-plane runner, which remains the sole
+-- token-holder (ADR 0111 §2). The web tier only ENQUEUES it.
+--
+-- Widening a CHECK enum is additive (permits MORE values; no row changes) — the
+-- provisioning_003/005/010/011 precedent. Applied only when the provisioning module
+-- is enabled. Safe to re-run. Keep INTENT_ACTIONS in provisioning.js in lockstep.
+
+ALTER TABLE provisioning_intents DROP CONSTRAINT IF EXISTS provisioning_intents_action_check;
+ALTER TABLE provisioning_intents ADD CONSTRAINT provisioning_intents_action_check
+  CHECK (action IN ('provision', 'teardown', 'oauth-manifest', 'domain-attach', 'settings-apply', 'restart', 'disconnect'));
+
+INSERT INTO schema_migrations (version) VALUES ('provisioning_016_disconnect')
+  ON CONFLICT (version) DO NOTHING;

package/modules/provisioning/module.json

@@ -10,7 +10,7 @@
   "maintainer": "Off the Boats maintainers",
   "maintenance": { "status": "core-maintained" },
   "contributes": {
-    "routes": ["provisioning"],
+    "routes": ["provisioning", "disconnect"],
     "migrations": true,
     "pollers": ["liveness-sweep", "catalog-backfill"]
   },

package/modules/provisioning/provisioning.js

@@ -58,7 +58,8 @@ const PROJECT_TYPES = ['game', 'research', 'business', 'non-profit', 'not-sure']
 // instance whose liveness probe says it is down — the settings-apply leg minus the
 // env patch. Its own action because no existing one fits: provision refuses
 // 'active' and settings-apply requires a value that actually changed.
-const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest', 'domain-attach', 'settings-apply', 'restart'];
+// 'disconnect' (task 1003249, migration provisioning_016): the owner's true delete — ./disconnect.js.
+const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest', 'domain-attach', 'settings-apply', 'restart', 'disconnect'];
 // Every state a teardown can be asked for — i.e. everything except the one
 // state where there is provably nothing left to release. DERIVED from
 // INSTANCE_STATES on purpose (task 1003042, walk finding N5): the old hand-kept
@@ -1489,8 +1490,7 @@ module.exports = {
   listActiveInstancesForLiveness, recordLivenessProbe, recordDnsNote, clearErrorNote,
   // data access — the owed-push marker (task 1003524)
   recordSettingsPushOwed,
-  createInstance, setInstanceStatus, updateInstanceDomain, updateInstanceSettings, updateInstanceDetail,
-  createInstance, setInstanceStatus, updateInstanceDomain, clearReleasedDomains, updateInstanceSettings,
+  createInstance, setInstanceStatus, updateInstanceDomain, clearReleasedDomains, updateInstanceSettings, updateInstanceDetail,
   enqueueIntent, enqueueTeardown, enqueueSettingsApply, enqueueRestart, getOpenIntent, claimNextIntent, resolveIntent,
   recordEvent, instanceStateForSlug, planetChoicesForHosts, projectOwnedBy, costLedger,
   // data access — GitHub App Manifest attempts (task 2080)

package/modules/provisioning/routes/disconnect.js

@@ -0,0 +1,63 @@
+// modules/provisioning/routes/disconnect.js — POST /provisioning/instances/:id/disconnect
+// (task 1003249, ADR 0290: "Disconnect from Bongos entirely").
+//
+// The web tier's half of the owner's true delete. Like every provisioning action it only
+// ENQUEUES; the control-plane runner does the destruction (ADR 0111 §2). Its own routes
+// file (declared in module.json) because routes/provisioning.js sits at the size ratchet.
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const { pool, validateOrRespond, parseId } = api;
+const provisioning = require('../provisioning');
+const disconnect = require('../disconnect');
+
+const log = api.logger('provisioning');
+
+module.exports = function buildDisconnectRouter() {
+  const router = express.Router();
+
+  // POST /provisioning/instances/:id/disconnect — rank: any authenticated builder (own
+  // resource); an archon may disconnect any project. 404 for anyone else, so another
+  // owner's id is never confirmed. The typed name is checked HERE, not only in the page:
+  // this erases a database, so a replayed or scripted request must carry the same proof
+  // the button does. No status gate — any state may be disconnected; the queue refuses
+  // while another run is open (disconnect.enqueueDisconnect).
+  router.post('/provisioning/instances/:id/disconnect', api.requireBuilder, async (req, res) => {
+    const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
+    if (!id) return;
+    if (validateOrRespond(req, res, { confirm_slug: { required: true, type: 'string', maxLength: 40 } })) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      const isOwner = !!inst && String(inst.owner_builder_id) === String(req.builder.id);
+      if (!inst || (!isOwner && req.builder.rank !== 'archon')) return res.fail('instance_not_found', 404);
+      if (String(req.body.confirm_slug).trim().toLowerCase() !== inst.slug) {
+        return res.fail('confirm_mismatch', { status: 400,
+          message: `Type the project's name exactly — ${inst.slug} — to disconnect it. Nothing was changed.` });
+      }
+      const actor = isOwner ? 'api:self' : `api:archon:${req.builder.id}`;
+      const r = await disconnect.enqueueDisconnect(pool, id, actor);
+      if (r.conflict) {
+        return res.fail('intent_conflict', { status: 409,
+          message: `A '${r.intent.action}' run is ${r.intent.state} for this project. Disconnecting waits for it to finish — try again once it has.`,
+          details: { action: r.intent.action, state: r.intent.state } });
+      }
+      if (r.created) {
+        await provisioning.recordEvent(pool, {
+          instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'disconnect',
+          detail: isOwner ? 'disconnect requested by owner' : `disconnect requested by archon ${req.builder.github_login || req.builder.id}`,
+          actor,
+        }).catch(() => {});
+      }
+      res.json({ ok: true, queued: r.created, action: 'disconnect', status: inst.status,
+        message: r.created
+          ? 'Queued. The platform takes the project down, erases its database and backups, and releases its name and address. It leaves your list when that is done.'
+          : 'A disconnect is already queued for this project.' });
+    } catch (err) {
+      log.error('[provisioning] POST /provisioning/instances/:id/disconnect', err);
+      res.fail('disconnect_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/provisioning/routes/provisioning.js

@@ -17,7 +17,7 @@
 //                                                      only shape that bills; ../paid-shape-gate.js.
 //                                                      An `adopt` ALSO passes the credential
 //                                                      preflight — ../credential-preflight.js,
-//                                                      task 1002909; greenfield is exempt)
+//                                                      task 1002909; greenfield is exempt; a full box → 409, ../capacity-gate.js)
 //     GET    /provisioning/instances               — list the caller's instances
 //     GET    /provisioning/instances/:id           — read one of the caller's instances
 //                                                     (also SELF-HEALS its catalog projection,
@@ -51,6 +51,7 @@ const { ALWAYS_ON_CORE, OPTIONAL_MODULES, starterBundleAnswerTable, optionalModu
 const { recommendationsForDetails } = require('../recommendations');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
 const { requireAuthorityForMeteredShape } = require('../paid-shape-gate');
+const { requireRoomOnBox } = require('../capacity-gate');   // a full box refused up front (task 1003938)
 const { adoptCredentialFault } = require('../credential-preflight');
 const catalogBridge = require('../catalog-bridge');
 const capacity = require('../capacity');   // the box's slot ceiling (ADR 0285, task 1003927)
@@ -299,10 +300,9 @@ module.exports = function provisioningRoutes() {
   });
 
   // POST /provisioning/instances — request a new instance. rank: any authenticated
-  // builder (own resource); a `dedicated` (metered) shape additionally requires
-  // provisioning.fleet.manage — see requireAuthorityForMeteredShape above.
-  // ENQUEUES a 'provision' intent + records the request;
-  // the runner (task P3) does the real standup. Idempotent on slug for the SAME
+  // builder (own resource); a `dedicated` (metered) shape also needs provisioning.fleet.manage
+  // (../paid-shape-gate.js), and a full shared box answers 409 box_full up front (../capacity-gate.js).
+  // ENQUEUES a 'provision' intent the runner (task P3) stands up. Idempotent on slug for the SAME
   // owner (re-request returns the existing row); a slug owned by ANOTHER builder → 409.
   // Body: { slug (required), target_ref?, hosting_shape? (co-tenant|dedicated),
   //         domain?, tier?, onboard_mode? (greenfield|adopt) }.
@@ -312,7 +312,7 @@ module.exports = function provisioningRoutes() {
   // ALREADY has, so the runner must clone + layer onto its history instead of pushing a
   // fresh tree at `main` (which an existing repo rejects as unrelated history). Absent →
   // 'greenfield', the safe default.
-  router.post('/provisioning/instances', auth.requireBuilder, requireAuthorityForMeteredShape(auth.requirePermission), async (req, res) => {
+  router.post('/provisioning/instances', auth.requireBuilder, requireAuthorityForMeteredShape(auth.requirePermission), requireRoomOnBox(pool, log), async (req, res) => {
     if (validateOrRespond(req, res, {
       slug: { required: true, type: 'string', maxLength: 40 },
       target_ref: { type: 'string', maxLength: 200 },

package/modules/public-landing/public/projects.html

@@ -939,7 +939,21 @@ summary{min-height:24px;padding:3px 0;}
              than letting the word "Delete" imply it. -->
         <details class="finePrint" id="mDelWhat">
           <summary>What this removes — and what it keeps</summary>
-          <p>Tearing down stops the project’s server and its nightly backups. It does <b>not</b> erase the project: it stays in your list marked <b>torn down</b> so you can bring it back, your repository on GitHub is untouched, and its database and existing backups are kept on purpose. There is no permanent-delete button — clearing a project’s database for good, and freeing its web address for another project, are done by hand today.</p>
+          <p>Tearing down stops the project’s server and its nightly backups. It does <b>not</b> erase the project: it stays in your list marked <b>torn down</b> so you can bring it back, your repository on GitHub is untouched, and its database and existing backups are kept on purpose. To erase it for good — its database, its backups and its web address — use <b>Disconnect from Bongos entirely</b> below.</p>
+        </details>
+      </div>
+      <!-- "Disconnect from Bongos entirely" (task 1003249, ADR 0290): the owner's TRUE
+           delete, in its own card after the ender so the reversible control never reads
+           as the destructive one. The fold is a sibling of the volatile slot, like
+           #mDelWhat, so no re-render can drop what it promises. -->
+      <div class="card mSec" id="mDisconnect">
+        <h2>Disconnect from Bongos entirely</h2>
+        <div id="mDisc"><p class="finePrint">Reading the project…</p></div>
+        <details class="finePrint" id="mDiscWhat">
+          <summary>What this erases — and what it keeps</summary>
+          <p><b>Erased for good:</b> the project’s server, its database and every nightly backup of it, its settings, its place on the map and the list of its members. Its name and web address are released, so another project can take them.</p>
+          <p><b>Kept:</b> your repository on GitHub, exactly as it is. If a GitHub sign-in app was registered for the project, that stays on your GitHub account too — remove it in your GitHub settings if you no longer want it.</p>
+          <p>This cannot be undone. To stop the project and keep everything, use <b>Take it offline</b> above instead.</p>
         </details>
       </div>
     </section>
@@ -5196,21 +5210,19 @@ summary{min-height:24px;padding:3px 0;}
      retention is deliberate on shared boxes; a dedicated machine takes its
      database with it). Copy follows the runner, never the other way around. */
   function teardownTruth(inst) {
-    /* the address line is NOT decoration: teardown has no DNS or Caddy leg, so
-       the hostname keeps resolving and serves an error page rather than going
-       quiet. The old copy promised the address goes silent, which was simply
-       untrue — and the rule above is that copy follows the runner. Releasing the
-       address is tracked separately (task 1002897); until then "reserved" is
-       both the honest word and the accurate one, since a revive re-uses exactly
-       this hostname. */
+    /* the address line is NOT decoration. Teardown now parks the hostname at a
+       dead address and removes its proxy block (task 1002897), so nothing answers
+       there — but the row keeps the address, because a revive re-uses exactly
+       this hostname. "Reserved" is the accurate word for that; "gone" would not be,
+       and neither is the old error-page promise, true only before the park. */
     /* pre-standup: at 'requested' nothing has been built, so the shape arms
        below would describe a server and a database that never existed. error
        and provisioning keep the built-world text on purpose — a run that failed
        partway may already have a database, a port and a DNS record. */
     if (inst && inst.status === 'requested') return 'Nothing has been stood up yet — this cancels the standup. Anything already on GitHub is untouched, and the name and web address stay reserved for this project.';
     return inst && inst.hosting_shape === 'dedicated'
-      ? 'This project has a machine to itself, so the machine goes away and its database goes with it. Your repository is untouched. Its web address stays reserved for this project and shows an error page until you bring it back. Nothing here erases a project.'
-      : 'The server goes away. Your repository is untouched. The database is kept, so bringing it back later restores its memory. Its web address stays reserved for this project and shows an error page until you bring it back. Nothing here erases a project.';
+      ? 'This project has a machine to itself, so the machine goes away and its database goes with it. Your repository is untouched. Its web address stays reserved for this project, and nothing answers there until you bring it back. Taking it offline erases nothing.'
+      : 'The server goes away. Your repository is untouched. The database is kept, so bringing it back later restores its memory. Its web address stays reserved for this project, and nothing answers there until you bring it back. Taking it offline erases nothing.';
   }
 
   /* onManage: the same facts, but the pointers name the controls THIS surface
@@ -5224,7 +5236,7 @@ summary{min-height:24px;padding:3px 0;}
        "nothing more will happen" (task 1003232) */
     if (inst.status === 'torn_down' || inst.status === 'tearing_down') {
       if (!inst.domain) return '';
-      return 'Its address, <code>' + esc(inst.domain) + '</code>, stays reserved for this project — it shows an error page until you bring it back.';
+      return 'Its address, <code>' + esc(inst.domain) + '</code>, stays reserved for this project — nothing answers there until you bring it back.';
     }
     if (inst.domain) {
       if (inst.status === 'active') {
@@ -5553,6 +5565,7 @@ summary{min-height:24px;padding:3px 0;}
        it: the delete section reads only status + open_intent, both already in
        hand, and a queued teardown must show up without a reload */
     renderDelete(inst);
+    renderDisconnect(inst);
     /* its address (task 1003355) is fetch-free too — the control it carries
        reads status + domain + open_intent, all already in hand */
     renderAddress(inst);
@@ -7026,6 +7039,12 @@ summary{min-height:24px;padding:3px 0;}
         '<p class="finePrint">This page updates when it starts.</p>');
       return;
     }
+    /* a queued disconnect takes the project offline itself; a teardown ask here would
+       only be refused by the server's open-run check (task 1003249) */
+    if (inst.open_intent && inst.open_intent.action === 'disconnect') {
+      delMsg('<p class="finePrint">A disconnect is queued for this project — taking it offline is part of it.</p>');
+      return;
+    }
     /* a project that never finished standing up still reaches here — that is
        the whole point of the widened gate; teardownTruth() scopes the copy to
        its status */
@@ -7116,6 +7135,92 @@ summary{min-height:24px;padding:3px 0;}
     if (t.hasAttribute('data-del-no')) { mDelAsking = null; if (manageInst) renderDelete(manageInst); }
   });
 
+  /* ── "Disconnect from Bongos entirely" (task 1003249, ADR 0290): the TRUE delete. The
+     ender's shape on purpose — the name typed back (and checked again by the SERVER, which
+     receives it as confirm_slug), a project-scoped guard so the minute tick never repaints
+     over a half-typed name, and every refusal in the server's own words. ── */
+  var mDiscAsking = null;
+
+  function discMsg(html) { $('mDisc').innerHTML = html; }
+
+  function renderDisconnect(inst) {
+    if (mDiscAsking && mDiscAsking === inst.slug) return;
+    var open = inst.open_intent;
+    if (open && open.action === 'disconnect') {
+      discMsg('<div class="addr">This project is being disconnected.</div>' +
+        '<p class="finePrint">When it finishes, the project leaves your list and this page can no longer find it.</p>');
+      return;
+    }
+    if (open) {
+      discMsg('<p class="plain">Disconnecting waits for the current ' + esc(open.action || '') + ' run to finish.</p>');
+      return;
+    }
+    discMsg('<p class="plain">Erase this project from the platform for good: its database and backups, its settings and its place on the map. Your repository on GitHub is kept.</p>' +
+      '<div class="actions"><button type="button" class="btn small danger" data-disc-ask>Disconnect entirely</button></div>');
+  }
+
+  function askDisconnect() {
+    var inst = manageInst;
+    if (!inst) return;
+    mDiscAsking = inst.slug;
+    discMsg('<div class="confirmRow"><span class="plain">Disconnect <b>' + esc(inst.slug) + '</b> from Bongos entirely? ' +
+      'Its database and backups are erased and this cannot be undone. Type the project’s name to confirm.</span></div>' +
+      '<div class="attach">' +
+      '<input type="text" id="mDiscName" autocomplete="off" spellcheck="false" maxlength="40" ' +
+      'aria-label="Type the project name to confirm the disconnect" placeholder="' + esc(inst.slug) + '">' +
+      '<button type="button" class="btn small danger" data-disc-yes disabled>Yes, disconnect it</button>' +
+      '<button type="button" class="linklike" data-disc-no>Keep it</button></div>');
+    var field = $('mDiscName');
+    if (field) field.focus();
+  }
+
+  function discTypedMatches() {
+    var field = $('mDiscName');
+    return !!(field && manageInst && field.value.trim() === manageInst.slug);
+  }
+
+  function doDisconnect() {
+    var inst = manageInst;
+    if (!inst || !discTypedMatches()) return;
+    var typed = $('mDiscName').value.trim();
+    mDiscAsking = null;
+    discMsg('<p class="finePrint">Asking…</p>');
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(inst.id) + '/disconnect', {
+      method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ confirm_slug: typed })
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) {
+          discMsg('<div class="projMsg ok">' + esc(data.message || 'Disconnect requested.') + '</div>');
+          loadManage(true); /* the queued run this page renders just changed */
+          return;
+        }
+        renderDisconnect(inst);
+        var e = apiError(data, res.status);
+        $('mDisc').insertAdjacentHTML('beforeend', '<div class="projMsg err">' +
+          (res.status === 401 ? signInAgain() : esc(e.message || 'The disconnect could not be queued — try again.')) + '</div>');
+      });
+    }).catch(function () {
+      renderDisconnect(inst);
+      $('mDisc').insertAdjacentHTML('beforeend',
+        '<div class="projMsg err">Couldn’t reach the platform — check your connection and try again.</div>');
+    });
+  }
+
+  $('mDisc').addEventListener('input', function (ev) {
+    if (!ev.target || ev.target.id !== 'mDiscName') return;
+    var yes = $('mDisc').querySelector('[data-disc-yes]');
+    if (yes) yes.disabled = !discTypedMatches();
+  });
+
+  $('mDisc').addEventListener('click', function (ev) {
+    var t = ev.target.closest && ev.target.closest('button');
+    if (!t) return;
+    if (t.hasAttribute('data-disc-ask')) return askDisconnect();
+    if (t.hasAttribute('data-disc-yes')) return doDisconnect();
+    if (t.hasAttribute('data-disc-no')) { mDiscAsking = null; if (manageInst) renderDisconnect(manageInst); }
+  });
+
   /* ── restart an unreachable project (task 1003238). Its own route, because
      PROVISION_ENQUEUE_FROM excludes 'active' — re-POSTing the slug the way
      Try again / Bring it back do would be refused on every press. Every

package/modules/public-landing/public/projects.probes.json

@@ -155,6 +155,9 @@
     { "name": "manage flows: the ender asks for the name typed back, queues the teardown, and the page re-reads the project as queued", "auth": true, "width": 1440, "url": "/projects?view=manage&id=105",
       "steps": [["wait",900],["click","[data-del-ask]"],["wait",200],["fill","#mDelName","mooring"],["wait",100],["click","[data-del-yes]"],["wait",900]],
       "expect": {"text":[["#mDel .addr","A teardown is queued for this project."],["#mName","mooring"]],"hidden":["#mDelName","[data-del-ask]"],"visible":["#mStrip .strip.flowDown"]} },
+    { "name": "manage flows: disconnect entirely asks for the name typed back, queues the true delete, and the page re-reads the project as being disconnected (task 1003249)", "auth": true, "width": 1440, "url": "/projects?view=manage&id=104",
+      "steps": [["wait",900],["click","[data-disc-ask]"],["wait",200],["fill","#mDiscName","old-lantern"],["wait",100],["click","[data-disc-yes]"],["wait",900]],
+      "expect": {"text":[["#mDisc .addr","This project is being disconnected."],["#mName","old-lantern"]],"hidden":["#mDiscName","[data-disc-ask]"]} },
     { "name": "the wizard driver (task 1003346): name, type, about, home (fresh; the stub grants repo access, so the new repository is named from the project), address (the handle's verdict), the review as a ledger, then the filing — the done panel with the standup rail and the human steps", "auth": true, "width": 1440, "url": "/projects?view=new",
       "steps": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#doCreate"],["wait",1500]],
       "expect": {"visible":["#panel-done","#liveProgress .prog","#liveProgress .prog .stages li.now","#humanSteps li"],"hidden":["#panel-review","#panel-name"],"text":[["#done-h","The drums are rolling"]],"attr":[["#panel-done","class","panel on"]]} },

package/modules/ui-design/kit/serve.js

@@ -157,6 +157,7 @@ function stamp(v) {
 const FLOW_RECEIPTS = {
   teardown: { queued: true, message: 'Teardown queued.' },
   restart: { queued: true, message: 'Restart queued.' },
+  disconnect: { queued: true, message: 'Queued. The platform takes the project down, erases its database and backups, and releases its name and address. It leaves your list when that is done.' },
   domain: { recorded: true, queued: true, message: 'Address recorded.' },
   // the wizard's filing (task 1003346): the receipt names the instance the page then polls — Harbor, the fixture's standing-up row — and the address the page promises is the one the server assigned
   provision: { queued: true, message: 'Queued. The platform picks it up from here.', instance: { id: 102, domain: 'mercury.cloudbongos.com' } },
@@ -220,10 +221,10 @@ function withPlanet(inst) {
 }
 function flowReceipt(rest, method) {
   if (method === 'POST' && rest === '/provisioning/instances') return FLOW_RECEIPTS.provision;
-  const m = rest.match(/^\/provisioning\/instances\/(\d+)\/(teardown|restart|domain)$/);
+  const m = rest.match(/^\/provisioning\/instances\/(\d+)\/(teardown|restart|domain|disconnect)$/);
   if (!m) return null;
   if (method !== 'POST') return null;
-  if (m[2] === 'teardown' || m[2] === 'restart') ASKED.set(m[1], m[2]);
+  if (m[2] === 'teardown' || m[2] === 'restart' || m[2] === 'disconnect') ASKED.set(m[1], m[2]);
   return FLOW_RECEIPTS[m[2]];
 }
 function withAsk(inst) {

package/modules/ui-design/module.json

@@ -6,6 +6,7 @@
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "contributes": { "skills": ["design", "design-sync", "figma-design-sync", "design-taste-frontend", "design-taste-frontend-v1", "high-end-visual-design", "redesign-existing-projects", "impeccable", "style", "minimalist-ui", "industrial-brutalist-ui", "gpt-taste", "stitch-design-taste", "image-to-code", "imagegen-frontend-web", "imagegen-frontend-mobile", "brandkit"], "disciplines": ["ui"] },
+  "declarativeSeams": { "skills": ["design", "design-sync", "figma-design-sync"] },
   "provides": [],
   "consumes": []
 }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.772",
+  "version": "1.19.774",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.772",
+      "version": "1.19.774",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.772",
+  "version": "1.19.774",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/address-park-sweep.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# scripts/gds/address-park-sweep.sh — park the addresses of projects torn down BEFORE
+# teardown learned to do it itself (task 1003947, the backfill half of task 1002897).
+#
+# WHY. Task 1002897 made a teardown remove its <slug>.caddy block and park its hostname
+# at the RFC 5737 blackhole. That only applies to teardowns run after the pin carries it,
+# so every earlier row still has its Caddy block proxying to a dead port and its A record
+# pointing at the platform: eleven hostnames answered 502 on 2026-09-16, while the hub
+# copy says "nothing answers there". This is that same teardown step, run once over the
+# ledger's torn-down rows. It does not re-run `provision.js teardown <slug>`, which would
+# rewrite each row's torn_down_at.
+#
+# The reserved-hostname rule, the zone and the apex come from the INSTALLED core (the
+# same helpers a teardown calls), so this sweep cannot disagree with what teardown parks.
+#
+# Run on the control plane as a sudoer:
+#   bash scripts/gds/address-park-sweep.sh            # survey only — read-only
+#   bash scripts/gds/address-park-sweep.sh --apply    # remove the snippets, reload Caddy, park the hostnames
+#
+# Left in place on purpose, even with --apply: each project's database, dumps and checkout,
+# and the row's domain + port (ADR 0181 — a revive re-uses that address).
+set -uo pipefail
+
+APPLY=0; [ "${1:-}" = "--apply" ] && APPLY=1
+DB="${PGDATABASE:-cloudbongos}"
+INSTANCE_DIR="${INSTANCE_DIR:-/home/lars/cloudbongos-instance}"
+SITES="${PROVISION_CADDY_SNIPPET_DIR:-/etc/caddy/sites}"
+BOX_ENV="${BOX_ENV:-/etc/cloudbongos/box.env}"
+
+rows=$(sudo -n -u lars psql -d "$DB" -tAF '|' -c "select slug, coalesce(domain, '') from provisioning_instances where status='torn_down' order by slug" 2>/dev/null) \
+  || { echo "cannot read provisioning_instances from $DB as lars"; exit 1; }
+
+# slug|domain|zone|reserved|blackhole per row, plus an apex line — from the installed core.
+plan=$(sudo -n -u lars env ROWS="$rows" bash -c 'cd "$1" && exec node -' _ "$INSTANCE_DIR" <<'JS'
+const core = './node_modules/@bongos/core';
+const { isReservedHostname } = require(`${core}/modules/provisioning/provisioning.js`);
+const { dnsReleaseEnv } = require(`${core}/scripts/gds/provision-net.js`);
+const apex = require(`${core}/scripts/gds/instance-apex.js`).instanceApex();
+console.log(`apex|${apex || ''}`);
+for (const line of String(process.env.ROWS || '').split('\n').filter(Boolean)) {
+  const [slug, domain] = line.split('|');
+  const env = domain ? dnsReleaseEnv(domain) : { CLOUDFLARE_ZONE: '', BOX_IP: '' };
+  console.log(['row', slug, domain || '', env.CLOUDFLARE_ZONE, domain && isReservedHostname(domain, apex) ? 1 : 0, env.BOX_IP].join('|'));
+}
+JS
+) || { echo "cannot load the installed core from $INSTANCE_DIR"; exit 1; }
+
+apex=$(printf '%s\n' "$plan" | awk -F'|' '$1 == "apex" {print $2}')
+[ -n "$apex" ] || { echo "the installed core names no apex — refusing: the reserved-hostname guard would be blind"; exit 1; }
+echo "== torn-down rows still holding a Caddy block or an unparked address (apex $apex) =="
+
+left=(); reload=0
+while IFS='|' read -r kind slug domain zone reserved blackhole; do
+  [ "$kind" = "row" ] || continue
+  # The slug grammar provisioning.isValidSlug enforces; anything else never reaches a command.
+  [[ "$slug" =~ ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$ ]] || continue
+  if [ -e "$SITES/$slug.caddy" ]; then
+    printf '  %-22s snippet %s\n' "$slug" "$SITES/$slug.caddy"
+    left+=("$slug:snippet")
+    if [ "$APPLY" = 1 ]; then sudo -n rm -f "$SITES/$slug.caddy" </dev/null && reload=1; fi
+  fi
+  [ -n "$domain" ] || continue
+  if [ "$reserved" = 1 ]; then printf '  %-22s %s is platform-reserved — never parked\n' "$slug" "$domain"; continue; fi
+  now=$(getent ahostsv4 "$domain" 2>/dev/null </dev/null | awk 'NR == 1 {print $1}')
+  [ -z "$now" ] || [ "$now" = "$blackhole" ] && continue
+  printf '  %-22s %s resolves to %s — park at %s (zone %s)\n' "$slug" "$domain" "$now" "$blackhole" "$zone"
+  left+=("$slug:dns")
+  [ "$APPLY" = 1 ] || continue
+  sudo -n -u lars bash -c 'set -a; . "$1"; set +a; BOX_HOSTNAME="$2" BOX_IP="$3" CLOUDFLARE_ZONE="$4" BOX_PROXIED=0 exec "$BOX_DNS_HOOK"' \
+    _ "$BOX_ENV" "$domain" "$blackhole" "$zone" </dev/null || echo "  ⚠ could not park $domain — re-run to retry"
+done <<< "$plan"
+
+[ "$reload" = 1 ] && { sudo -n systemctl reload caddy || echo "  ⚠ caddy reload failed — the removed blocks are still loaded"; }
+
+echo "== summary =="
+if [ "$APPLY" = 1 ]; then echo "  acted on (${#left[@]}): ${left[*]:-none}"; else echo "  left (${#left[@]}): ${left[*]:-none}"; fi
+if [ "$APPLY" = 1 ]; then echo "  (applied — re-run without --apply to confirm nothing is left; DNS may take a TTL to settle)";
+else echo "  (survey only — re-run with --apply to remove the snippets, reload Caddy and park the hostnames)"; fi

package/scripts/gds/audit-deps.js

@@ -25,6 +25,8 @@ const { resolveDefaultVersion } = require('./version-select.js');
 // task 1003153 — the DEAD-edge detector core, shared with the claim refusal so
 // "abandoned dependency" means one thing across the CLI, the route and this audit.
 const { findStrandedTasks } = require('../../modules/lifecycle/dead-deps.js');
+// task 1003752 — the route's page bound + the first-page offset rule, declared once.
+const { TASK_LIST_MAX_LIMIT, buildTaskPageQuery } = require('../../modules/lifecycle/task-list-limits.js');
 
 // Lifecycle statuses that count as "open" (auditable) vs "an unshipped blocker".
 const OPEN = new Set(['ready', 'backlog', 'active', 'blocked']);
@@ -81,6 +83,34 @@ function findMissingDeps(tasks, { open = OPEN, isBlocker = isUnshippedBlocker }
   return out;
 }
 
+// Read the WHOLE task corpus, one allowed page at a time (task 1003752). This
+// was a single `limit: 3000` read, which GET /tasks caps at TASK_LIST_MAX_LIMIT
+// (1000) — so it 400'd on every run and the detector below never saw a single
+// task. Paging is not a nicety here: the corpus passed one page long ago (3610
+// rows on 2026-09-16), so even a legal `limit: 1000` would silently UNDER-read,
+// which in a detector is the same failure wearing a success exit code.
+//
+// `getPage(query)` is injected rather than closed over so the loop is testable
+// with no API; it returns the { ok, status, data } shape cliClient gives back.
+// Dedupes by id: listTasks orders by `priority NULLS LAST, created_at, id`, so
+// pages are stable — but a detector whose whole job is surfacing rows nobody
+// can see must not be the thing that loses one.
+async function fetchAllTasks(getPage, { query = {}, pageSize = TASK_LIST_MAX_LIMIT, maxPages = 100 } = {}) {
+  const byId = new Map();
+  let offset = 0;
+  for (let page = 0; page < maxPages; page++) {
+    const q = buildTaskPageQuery({ ...query, limit: pageSize, offset });
+    const r = await getPage(q);
+    if (!r || !r.ok) throw new Error(`HTTP ${r && r.status}`);
+    const rows = (r.data && r.data.tasks) || [];
+    for (const t of rows) byId.set(String(t.id), t);
+    // A short page is the end of the table. Compare against the CLAMPED size
+    // the route actually honoured, never the size the caller asked for.
+    if (rows.length < q.limit) return [...byId.values()];
+    offset += q.limit;
+  }
+  throw new Error(`more than ${maxPages} pages of tasks — refusing to loop forever`);
+}
 // --stranded (task 1003153): the INVERSE audit. findMissingDeps asks "which edge
 // is MISSING"; this asks "which existing edge is DEAD" — a live task gated by an
 // ABANDONED dependency. That edge can never satisfy (an abandoned task can never
@@ -91,9 +121,13 @@ function findMissingDeps(tasks, { open = OPEN, isBlocker = isUnshippedBlocker }
 // Exits 1 when anything is stranded, so a sweep or CI leg can gate on it.
 async function reportStranded({ asJson }) {
   const api = await cliClient();
-  const r = await api.tasks.getTasks({ query: { include: 'deps', limit: 3000 } });
-  if (!r.ok) { console.error(`audit-deps: could not list tasks (${r.status})`); process.exit(1); }
-  const all = r.data.tasks || [];
+  let all;
+  try {
+    all = await fetchAllTasks((query) => api.tasks.getTasks({ query }), { query: { include: 'deps' } });
+  } catch (e) {
+    console.error(`audit-deps: could not list tasks (${e.message})`);
+    process.exit(1);
+  }
   const stranded = findStrandedTasks(all);
 
   // Context worth stating even at zero: abandoned tasks that still CARRY
@@ -174,7 +208,7 @@ async function main() {
   console.log('NB: advisory only. Backfill `high` edges by hand (POST /tasks/:id/dependencies) after reading both tasks; a wrong edge gates the dependent.');
 }
 
-module.exports = { findMissingDeps, classify, OPEN, isUnshippedBlocker, HOTSPOTS, reportStranded };
+module.exports = { findMissingDeps, classify, OPEN, isUnshippedBlocker, HOTSPOTS, reportStranded, fetchAllTasks };
 
 if (require.main === module) {
   main().catch((e) => { console.error('audit-deps:', e.message); process.exit(1); });