@bongos/core 1.19.773 → 1.19.774

package/modules/provisioning/provisioning.js

@@ -58,7 +58,8 @@ const PROJECT_TYPES = ['game', 'research', 'business', 'non-profit', 'not-sure']
 // instance whose liveness probe says it is down — the settings-apply leg minus the
 // env patch. Its own action because no existing one fits: provision refuses
 // 'active' and settings-apply requires a value that actually changed.
-const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest', 'domain-attach', 'settings-apply', 'restart'];
+// 'disconnect' (task 1003249, migration provisioning_016): the owner's true delete — ./disconnect.js.
+const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest', 'domain-attach', 'settings-apply', 'restart', 'disconnect'];
 // Every state a teardown can be asked for — i.e. everything except the one
 // state where there is provably nothing left to release. DERIVED from
 // INSTANCE_STATES on purpose (task 1003042, walk finding N5): the old hand-kept
@@ -1489,8 +1490,7 @@ module.exports = {
   listActiveInstancesForLiveness, recordLivenessProbe, recordDnsNote, clearErrorNote,
   // data access — the owed-push marker (task 1003524)
   recordSettingsPushOwed,
-  createInstance, setInstanceStatus, updateInstanceDomain, updateInstanceSettings, updateInstanceDetail,
-  createInstance, setInstanceStatus, updateInstanceDomain, clearReleasedDomains, updateInstanceSettings,
+  createInstance, setInstanceStatus, updateInstanceDomain, clearReleasedDomains, updateInstanceSettings, updateInstanceDetail,
   enqueueIntent, enqueueTeardown, enqueueSettingsApply, enqueueRestart, getOpenIntent, claimNextIntent, resolveIntent,
   recordEvent, instanceStateForSlug, planetChoicesForHosts, projectOwnedBy, costLedger,
   // data access — GitHub App Manifest attempts (task 2080)

package/modules/provisioning/routes/disconnect.js

@@ -0,0 +1,63 @@
+// modules/provisioning/routes/disconnect.js — POST /provisioning/instances/:id/disconnect
+// (task 1003249, ADR 0290: "Disconnect from Bongos entirely").
+//
+// The web tier's half of the owner's true delete. Like every provisioning action it only
+// ENQUEUES; the control-plane runner does the destruction (ADR 0111 §2). Its own routes
+// file (declared in module.json) because routes/provisioning.js sits at the size ratchet.
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const { pool, validateOrRespond, parseId } = api;
+const provisioning = require('../provisioning');
+const disconnect = require('../disconnect');
+
+const log = api.logger('provisioning');
+
+module.exports = function buildDisconnectRouter() {
+  const router = express.Router();
+
+  // POST /provisioning/instances/:id/disconnect — rank: any authenticated builder (own
+  // resource); an archon may disconnect any project. 404 for anyone else, so another
+  // owner's id is never confirmed. The typed name is checked HERE, not only in the page:
+  // this erases a database, so a replayed or scripted request must carry the same proof
+  // the button does. No status gate — any state may be disconnected; the queue refuses
+  // while another run is open (disconnect.enqueueDisconnect).
+  router.post('/provisioning/instances/:id/disconnect', api.requireBuilder, async (req, res) => {
+    const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
+    if (!id) return;
+    if (validateOrRespond(req, res, { confirm_slug: { required: true, type: 'string', maxLength: 40 } })) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      const isOwner = !!inst && String(inst.owner_builder_id) === String(req.builder.id);
+      if (!inst || (!isOwner && req.builder.rank !== 'archon')) return res.fail('instance_not_found', 404);
+      if (String(req.body.confirm_slug).trim().toLowerCase() !== inst.slug) {
+        return res.fail('confirm_mismatch', { status: 400,
+          message: `Type the project's name exactly — ${inst.slug} — to disconnect it. Nothing was changed.` });
+      }
+      const actor = isOwner ? 'api:self' : `api:archon:${req.builder.id}`;
+      const r = await disconnect.enqueueDisconnect(pool, id, actor);
+      if (r.conflict) {
+        return res.fail('intent_conflict', { status: 409,
+          message: `A '${r.intent.action}' run is ${r.intent.state} for this project. Disconnecting waits for it to finish — try again once it has.`,
+          details: { action: r.intent.action, state: r.intent.state } });
+      }
+      if (r.created) {
+        await provisioning.recordEvent(pool, {
+          instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'disconnect',
+          detail: isOwner ? 'disconnect requested by owner' : `disconnect requested by archon ${req.builder.github_login || req.builder.id}`,
+          actor,
+        }).catch(() => {});
+      }
+      res.json({ ok: true, queued: r.created, action: 'disconnect', status: inst.status,
+        message: r.created
+          ? 'Queued. The platform takes the project down, erases its database and backups, and releases its name and address. It leaves your list when that is done.'
+          : 'A disconnect is already queued for this project.' });
+    } catch (err) {
+      log.error('[provisioning] POST /provisioning/instances/:id/disconnect', err);
+      res.fail('disconnect_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/provisioning/routes/provisioning.js

@@ -17,7 +17,7 @@
 //                                                      only shape that bills; ../paid-shape-gate.js.
 //                                                      An `adopt` ALSO passes the credential
 //                                                      preflight — ../credential-preflight.js,
-//                                                      task 1002909; greenfield is exempt)
+//                                                      task 1002909; greenfield is exempt; a full box → 409, ../capacity-gate.js)
 //     GET    /provisioning/instances               — list the caller's instances
 //     GET    /provisioning/instances/:id           — read one of the caller's instances
 //                                                     (also SELF-HEALS its catalog projection,
@@ -51,6 +51,7 @@ const { ALWAYS_ON_CORE, OPTIONAL_MODULES, starterBundleAnswerTable, optionalModu
 const { recommendationsForDetails } = require('../recommendations');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
 const { requireAuthorityForMeteredShape } = require('../paid-shape-gate');
+const { requireRoomOnBox } = require('../capacity-gate');   // a full box refused up front (task 1003938)
 const { adoptCredentialFault } = require('../credential-preflight');
 const catalogBridge = require('../catalog-bridge');
 const capacity = require('../capacity');   // the box's slot ceiling (ADR 0285, task 1003927)
@@ -299,10 +300,9 @@ module.exports = function provisioningRoutes() {
   });
 
   // POST /provisioning/instances — request a new instance. rank: any authenticated
-  // builder (own resource); a `dedicated` (metered) shape additionally requires
-  // provisioning.fleet.manage — see requireAuthorityForMeteredShape above.
-  // ENQUEUES a 'provision' intent + records the request;
-  // the runner (task P3) does the real standup. Idempotent on slug for the SAME
+  // builder (own resource); a `dedicated` (metered) shape also needs provisioning.fleet.manage
+  // (../paid-shape-gate.js), and a full shared box answers 409 box_full up front (../capacity-gate.js).
+  // ENQUEUES a 'provision' intent the runner (task P3) stands up. Idempotent on slug for the SAME
   // owner (re-request returns the existing row); a slug owned by ANOTHER builder → 409.
   // Body: { slug (required), target_ref?, hosting_shape? (co-tenant|dedicated),
   //         domain?, tier?, onboard_mode? (greenfield|adopt) }.
@@ -312,7 +312,7 @@ module.exports = function provisioningRoutes() {
   // ALREADY has, so the runner must clone + layer onto its history instead of pushing a
   // fresh tree at `main` (which an existing repo rejects as unrelated history). Absent →
   // 'greenfield', the safe default.
-  router.post('/provisioning/instances', auth.requireBuilder, requireAuthorityForMeteredShape(auth.requirePermission), async (req, res) => {
+  router.post('/provisioning/instances', auth.requireBuilder, requireAuthorityForMeteredShape(auth.requirePermission), requireRoomOnBox(pool, log), async (req, res) => {
     if (validateOrRespond(req, res, {
       slug: { required: true, type: 'string', maxLength: 40 },
       target_ref: { type: 'string', maxLength: 200 },

package/modules/public-landing/public/projects.html

@@ -939,7 +939,21 @@ summary{min-height:24px;padding:3px 0;}
              than letting the word "Delete" imply it. -->
         <details class="finePrint" id="mDelWhat">
           <summary>What this removes — and what it keeps</summary>
-          <p>Tearing down stops the project’s server and its nightly backups. It does <b>not</b> erase the project: it stays in your list marked <b>torn down</b> so you can bring it back, your repository on GitHub is untouched, and its database and existing backups are kept on purpose. There is no permanent-delete button — clearing a project’s database for good, and freeing its web address for another project, are done by hand today.</p>
+          <p>Tearing down stops the project’s server and its nightly backups. It does <b>not</b> erase the project: it stays in your list marked <b>torn down</b> so you can bring it back, your repository on GitHub is untouched, and its database and existing backups are kept on purpose. To erase it for good — its database, its backups and its web address — use <b>Disconnect from Bongos entirely</b> below.</p>
+        </details>
+      </div>
+      <!-- "Disconnect from Bongos entirely" (task 1003249, ADR 0290): the owner's TRUE
+           delete, in its own card after the ender so the reversible control never reads
+           as the destructive one. The fold is a sibling of the volatile slot, like
+           #mDelWhat, so no re-render can drop what it promises. -->
+      <div class="card mSec" id="mDisconnect">
+        <h2>Disconnect from Bongos entirely</h2>
+        <div id="mDisc"><p class="finePrint">Reading the project…</p></div>
+        <details class="finePrint" id="mDiscWhat">
+          <summary>What this erases — and what it keeps</summary>
+          <p><b>Erased for good:</b> the project’s server, its database and every nightly backup of it, its settings, its place on the map and the list of its members. Its name and web address are released, so another project can take them.</p>
+          <p><b>Kept:</b> your repository on GitHub, exactly as it is. If a GitHub sign-in app was registered for the project, that stays on your GitHub account too — remove it in your GitHub settings if you no longer want it.</p>
+          <p>This cannot be undone. To stop the project and keep everything, use <b>Take it offline</b> above instead.</p>
         </details>
       </div>
     </section>
@@ -5196,21 +5210,19 @@ summary{min-height:24px;padding:3px 0;}
      retention is deliberate on shared boxes; a dedicated machine takes its
      database with it). Copy follows the runner, never the other way around. */
   function teardownTruth(inst) {
-    /* the address line is NOT decoration: teardown has no DNS or Caddy leg, so
-       the hostname keeps resolving and serves an error page rather than going
-       quiet. The old copy promised the address goes silent, which was simply
-       untrue — and the rule above is that copy follows the runner. Releasing the
-       address is tracked separately (task 1002897); until then "reserved" is
-       both the honest word and the accurate one, since a revive re-uses exactly
-       this hostname. */
+    /* the address line is NOT decoration. Teardown now parks the hostname at a
+       dead address and removes its proxy block (task 1002897), so nothing answers
+       there — but the row keeps the address, because a revive re-uses exactly
+       this hostname. "Reserved" is the accurate word for that; "gone" would not be,
+       and neither is the old error-page promise, true only before the park. */
     /* pre-standup: at 'requested' nothing has been built, so the shape arms
        below would describe a server and a database that never existed. error
        and provisioning keep the built-world text on purpose — a run that failed
        partway may already have a database, a port and a DNS record. */
     if (inst && inst.status === 'requested') return 'Nothing has been stood up yet — this cancels the standup. Anything already on GitHub is untouched, and the name and web address stay reserved for this project.';
     return inst && inst.hosting_shape === 'dedicated'
-      ? 'This project has a machine to itself, so the machine goes away and its database goes with it. Your repository is untouched. Its web address stays reserved for this project and shows an error page until you bring it back. Nothing here erases a project.'
-      : 'The server goes away. Your repository is untouched. The database is kept, so bringing it back later restores its memory. Its web address stays reserved for this project and shows an error page until you bring it back. Nothing here erases a project.';
+      ? 'This project has a machine to itself, so the machine goes away and its database goes with it. Your repository is untouched. Its web address stays reserved for this project, and nothing answers there until you bring it back. Taking it offline erases nothing.'
+      : 'The server goes away. Your repository is untouched. The database is kept, so bringing it back later restores its memory. Its web address stays reserved for this project, and nothing answers there until you bring it back. Taking it offline erases nothing.';
   }
 
   /* onManage: the same facts, but the pointers name the controls THIS surface
@@ -5224,7 +5236,7 @@ summary{min-height:24px;padding:3px 0;}
        "nothing more will happen" (task 1003232) */
     if (inst.status === 'torn_down' || inst.status === 'tearing_down') {
       if (!inst.domain) return '';
-      return 'Its address, <code>' + esc(inst.domain) + '</code>, stays reserved for this project — it shows an error page until you bring it back.';
+      return 'Its address, <code>' + esc(inst.domain) + '</code>, stays reserved for this project — nothing answers there until you bring it back.';
     }
     if (inst.domain) {
       if (inst.status === 'active') {
@@ -5553,6 +5565,7 @@ summary{min-height:24px;padding:3px 0;}
        it: the delete section reads only status + open_intent, both already in
        hand, and a queued teardown must show up without a reload */
     renderDelete(inst);
+    renderDisconnect(inst);
     /* its address (task 1003355) is fetch-free too — the control it carries
        reads status + domain + open_intent, all already in hand */
     renderAddress(inst);
@@ -7026,6 +7039,12 @@ summary{min-height:24px;padding:3px 0;}
         '<p class="finePrint">This page updates when it starts.</p>');
       return;
     }
+    /* a queued disconnect takes the project offline itself; a teardown ask here would
+       only be refused by the server's open-run check (task 1003249) */
+    if (inst.open_intent && inst.open_intent.action === 'disconnect') {
+      delMsg('<p class="finePrint">A disconnect is queued for this project — taking it offline is part of it.</p>');
+      return;
+    }
     /* a project that never finished standing up still reaches here — that is
        the whole point of the widened gate; teardownTruth() scopes the copy to
        its status */
@@ -7116,6 +7135,92 @@ summary{min-height:24px;padding:3px 0;}
     if (t.hasAttribute('data-del-no')) { mDelAsking = null; if (manageInst) renderDelete(manageInst); }
   });
 
+  /* ── "Disconnect from Bongos entirely" (task 1003249, ADR 0290): the TRUE delete. The
+     ender's shape on purpose — the name typed back (and checked again by the SERVER, which
+     receives it as confirm_slug), a project-scoped guard so the minute tick never repaints
+     over a half-typed name, and every refusal in the server's own words. ── */
+  var mDiscAsking = null;
+
+  function discMsg(html) { $('mDisc').innerHTML = html; }
+
+  function renderDisconnect(inst) {
+    if (mDiscAsking && mDiscAsking === inst.slug) return;
+    var open = inst.open_intent;
+    if (open && open.action === 'disconnect') {
+      discMsg('<div class="addr">This project is being disconnected.</div>' +
+        '<p class="finePrint">When it finishes, the project leaves your list and this page can no longer find it.</p>');
+      return;
+    }
+    if (open) {
+      discMsg('<p class="plain">Disconnecting waits for the current ' + esc(open.action || '') + ' run to finish.</p>');
+      return;
+    }
+    discMsg('<p class="plain">Erase this project from the platform for good: its database and backups, its settings and its place on the map. Your repository on GitHub is kept.</p>' +
+      '<div class="actions"><button type="button" class="btn small danger" data-disc-ask>Disconnect entirely</button></div>');
+  }
+
+  function askDisconnect() {
+    var inst = manageInst;
+    if (!inst) return;
+    mDiscAsking = inst.slug;
+    discMsg('<div class="confirmRow"><span class="plain">Disconnect <b>' + esc(inst.slug) + '</b> from Bongos entirely? ' +
+      'Its database and backups are erased and this cannot be undone. Type the project’s name to confirm.</span></div>' +
+      '<div class="attach">' +
+      '<input type="text" id="mDiscName" autocomplete="off" spellcheck="false" maxlength="40" ' +
+      'aria-label="Type the project name to confirm the disconnect" placeholder="' + esc(inst.slug) + '">' +
+      '<button type="button" class="btn small danger" data-disc-yes disabled>Yes, disconnect it</button>' +
+      '<button type="button" class="linklike" data-disc-no>Keep it</button></div>');
+    var field = $('mDiscName');
+    if (field) field.focus();
+  }
+
+  function discTypedMatches() {
+    var field = $('mDiscName');
+    return !!(field && manageInst && field.value.trim() === manageInst.slug);
+  }
+
+  function doDisconnect() {
+    var inst = manageInst;
+    if (!inst || !discTypedMatches()) return;
+    var typed = $('mDiscName').value.trim();
+    mDiscAsking = null;
+    discMsg('<p class="finePrint">Asking…</p>');
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(inst.id) + '/disconnect', {
+      method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ confirm_slug: typed })
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) {
+          discMsg('<div class="projMsg ok">' + esc(data.message || 'Disconnect requested.') + '</div>');
+          loadManage(true); /* the queued run this page renders just changed */
+          return;
+        }
+        renderDisconnect(inst);
+        var e = apiError(data, res.status);
+        $('mDisc').insertAdjacentHTML('beforeend', '<div class="projMsg err">' +
+          (res.status === 401 ? signInAgain() : esc(e.message || 'The disconnect could not be queued — try again.')) + '</div>');
+      });
+    }).catch(function () {
+      renderDisconnect(inst);
+      $('mDisc').insertAdjacentHTML('beforeend',
+        '<div class="projMsg err">Couldn’t reach the platform — check your connection and try again.</div>');
+    });
+  }
+
+  $('mDisc').addEventListener('input', function (ev) {
+    if (!ev.target || ev.target.id !== 'mDiscName') return;
+    var yes = $('mDisc').querySelector('[data-disc-yes]');
+    if (yes) yes.disabled = !discTypedMatches();
+  });
+
+  $('mDisc').addEventListener('click', function (ev) {
+    var t = ev.target.closest && ev.target.closest('button');
+    if (!t) return;
+    if (t.hasAttribute('data-disc-ask')) return askDisconnect();
+    if (t.hasAttribute('data-disc-yes')) return doDisconnect();
+    if (t.hasAttribute('data-disc-no')) { mDiscAsking = null; if (manageInst) renderDisconnect(manageInst); }
+  });
+
   /* ── restart an unreachable project (task 1003238). Its own route, because
      PROVISION_ENQUEUE_FROM excludes 'active' — re-POSTing the slug the way
      Try again / Bring it back do would be refused on every press. Every

package/modules/public-landing/public/projects.probes.json

@@ -155,6 +155,9 @@
     { "name": "manage flows: the ender asks for the name typed back, queues the teardown, and the page re-reads the project as queued", "auth": true, "width": 1440, "url": "/projects?view=manage&id=105",
       "steps": [["wait",900],["click","[data-del-ask]"],["wait",200],["fill","#mDelName","mooring"],["wait",100],["click","[data-del-yes]"],["wait",900]],
       "expect": {"text":[["#mDel .addr","A teardown is queued for this project."],["#mName","mooring"]],"hidden":["#mDelName","[data-del-ask]"],"visible":["#mStrip .strip.flowDown"]} },
+    { "name": "manage flows: disconnect entirely asks for the name typed back, queues the true delete, and the page re-reads the project as being disconnected (task 1003249)", "auth": true, "width": 1440, "url": "/projects?view=manage&id=104",
+      "steps": [["wait",900],["click","[data-disc-ask]"],["wait",200],["fill","#mDiscName","old-lantern"],["wait",100],["click","[data-disc-yes]"],["wait",900]],
+      "expect": {"text":[["#mDisc .addr","This project is being disconnected."],["#mName","old-lantern"]],"hidden":["#mDiscName","[data-disc-ask]"]} },
     { "name": "the wizard driver (task 1003346): name, type, about, home (fresh; the stub grants repo access, so the new repository is named from the project), address (the handle's verdict), the review as a ledger, then the filing — the done panel with the standup rail and the human steps", "auth": true, "width": 1440, "url": "/projects?view=new",
       "steps": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#doCreate"],["wait",1500]],
       "expect": {"visible":["#panel-done","#liveProgress .prog","#liveProgress .prog .stages li.now","#humanSteps li"],"hidden":["#panel-review","#panel-name"],"text":[["#done-h","The drums are rolling"]],"attr":[["#panel-done","class","panel on"]]} },

package/modules/ui-design/kit/serve.js

@@ -157,6 +157,7 @@ function stamp(v) {
 const FLOW_RECEIPTS = {
   teardown: { queued: true, message: 'Teardown queued.' },
   restart: { queued: true, message: 'Restart queued.' },
+  disconnect: { queued: true, message: 'Queued. The platform takes the project down, erases its database and backups, and releases its name and address. It leaves your list when that is done.' },
   domain: { recorded: true, queued: true, message: 'Address recorded.' },
   // the wizard's filing (task 1003346): the receipt names the instance the page then polls — Harbor, the fixture's standing-up row — and the address the page promises is the one the server assigned
   provision: { queued: true, message: 'Queued. The platform picks it up from here.', instance: { id: 102, domain: 'mercury.cloudbongos.com' } },
@@ -220,10 +221,10 @@ function withPlanet(inst) {
 }
 function flowReceipt(rest, method) {
   if (method === 'POST' && rest === '/provisioning/instances') return FLOW_RECEIPTS.provision;
-  const m = rest.match(/^\/provisioning\/instances\/(\d+)\/(teardown|restart|domain)$/);
+  const m = rest.match(/^\/provisioning\/instances\/(\d+)\/(teardown|restart|domain|disconnect)$/);
   if (!m) return null;
   if (method !== 'POST') return null;
-  if (m[2] === 'teardown' || m[2] === 'restart') ASKED.set(m[1], m[2]);
+  if (m[2] === 'teardown' || m[2] === 'restart' || m[2] === 'disconnect') ASKED.set(m[1], m[2]);
   return FLOW_RECEIPTS[m[2]];
 }
 function withAsk(inst) {

package/modules/ui-design/module.json

@@ -6,6 +6,7 @@
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "contributes": { "skills": ["design", "design-sync", "figma-design-sync", "design-taste-frontend", "design-taste-frontend-v1", "high-end-visual-design", "redesign-existing-projects", "impeccable", "style", "minimalist-ui", "industrial-brutalist-ui", "gpt-taste", "stitch-design-taste", "image-to-code", "imagegen-frontend-web", "imagegen-frontend-mobile", "brandkit"], "disciplines": ["ui"] },
+  "declarativeSeams": { "skills": ["design", "design-sync", "figma-design-sync"] },
   "provides": [],
   "consumes": []
 }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.773",
+  "version": "1.19.774",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.773",
+      "version": "1.19.774",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.773",
+  "version": "1.19.774",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/address-park-sweep.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# scripts/gds/address-park-sweep.sh — park the addresses of projects torn down BEFORE
+# teardown learned to do it itself (task 1003947, the backfill half of task 1002897).
+#
+# WHY. Task 1002897 made a teardown remove its <slug>.caddy block and park its hostname
+# at the RFC 5737 blackhole. That only applies to teardowns run after the pin carries it,
+# so every earlier row still has its Caddy block proxying to a dead port and its A record
+# pointing at the platform: eleven hostnames answered 502 on 2026-09-16, while the hub
+# copy says "nothing answers there". This is that same teardown step, run once over the
+# ledger's torn-down rows. It does not re-run `provision.js teardown <slug>`, which would
+# rewrite each row's torn_down_at.
+#
+# The reserved-hostname rule, the zone and the apex come from the INSTALLED core (the
+# same helpers a teardown calls), so this sweep cannot disagree with what teardown parks.
+#
+# Run on the control plane as a sudoer:
+#   bash scripts/gds/address-park-sweep.sh            # survey only — read-only
+#   bash scripts/gds/address-park-sweep.sh --apply    # remove the snippets, reload Caddy, park the hostnames
+#
+# Left in place on purpose, even with --apply: each project's database, dumps and checkout,
+# and the row's domain + port (ADR 0181 — a revive re-uses that address).
+set -uo pipefail
+
+APPLY=0; [ "${1:-}" = "--apply" ] && APPLY=1
+DB="${PGDATABASE:-cloudbongos}"
+INSTANCE_DIR="${INSTANCE_DIR:-/home/lars/cloudbongos-instance}"
+SITES="${PROVISION_CADDY_SNIPPET_DIR:-/etc/caddy/sites}"
+BOX_ENV="${BOX_ENV:-/etc/cloudbongos/box.env}"
+
+rows=$(sudo -n -u lars psql -d "$DB" -tAF '|' -c "select slug, coalesce(domain, '') from provisioning_instances where status='torn_down' order by slug" 2>/dev/null) \
+  || { echo "cannot read provisioning_instances from $DB as lars"; exit 1; }
+
+# slug|domain|zone|reserved|blackhole per row, plus an apex line — from the installed core.
+plan=$(sudo -n -u lars env ROWS="$rows" bash -c 'cd "$1" && exec node -' _ "$INSTANCE_DIR" <<'JS'
+const core = './node_modules/@bongos/core';
+const { isReservedHostname } = require(`${core}/modules/provisioning/provisioning.js`);
+const { dnsReleaseEnv } = require(`${core}/scripts/gds/provision-net.js`);
+const apex = require(`${core}/scripts/gds/instance-apex.js`).instanceApex();
+console.log(`apex|${apex || ''}`);
+for (const line of String(process.env.ROWS || '').split('\n').filter(Boolean)) {
+  const [slug, domain] = line.split('|');
+  const env = domain ? dnsReleaseEnv(domain) : { CLOUDFLARE_ZONE: '', BOX_IP: '' };
+  console.log(['row', slug, domain || '', env.CLOUDFLARE_ZONE, domain && isReservedHostname(domain, apex) ? 1 : 0, env.BOX_IP].join('|'));
+}
+JS
+) || { echo "cannot load the installed core from $INSTANCE_DIR"; exit 1; }
+
+apex=$(printf '%s\n' "$plan" | awk -F'|' '$1 == "apex" {print $2}')
+[ -n "$apex" ] || { echo "the installed core names no apex — refusing: the reserved-hostname guard would be blind"; exit 1; }
+echo "== torn-down rows still holding a Caddy block or an unparked address (apex $apex) =="
+
+left=(); reload=0
+while IFS='|' read -r kind slug domain zone reserved blackhole; do
+  [ "$kind" = "row" ] || continue
+  # The slug grammar provisioning.isValidSlug enforces; anything else never reaches a command.
+  [[ "$slug" =~ ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$ ]] || continue
+  if [ -e "$SITES/$slug.caddy" ]; then
+    printf '  %-22s snippet %s\n' "$slug" "$SITES/$slug.caddy"
+    left+=("$slug:snippet")
+    if [ "$APPLY" = 1 ]; then sudo -n rm -f "$SITES/$slug.caddy" </dev/null && reload=1; fi
+  fi
+  [ -n "$domain" ] || continue
+  if [ "$reserved" = 1 ]; then printf '  %-22s %s is platform-reserved — never parked\n' "$slug" "$domain"; continue; fi
+  now=$(getent ahostsv4 "$domain" 2>/dev/null </dev/null | awk 'NR == 1 {print $1}')
+  [ -z "$now" ] || [ "$now" = "$blackhole" ] && continue
+  printf '  %-22s %s resolves to %s — park at %s (zone %s)\n' "$slug" "$domain" "$now" "$blackhole" "$zone"
+  left+=("$slug:dns")
+  [ "$APPLY" = 1 ] || continue
+  sudo -n -u lars bash -c 'set -a; . "$1"; set +a; BOX_HOSTNAME="$2" BOX_IP="$3" CLOUDFLARE_ZONE="$4" BOX_PROXIED=0 exec "$BOX_DNS_HOOK"' \
+    _ "$BOX_ENV" "$domain" "$blackhole" "$zone" </dev/null || echo "  ⚠ could not park $domain — re-run to retry"
+done <<< "$plan"
+
+[ "$reload" = 1 ] && { sudo -n systemctl reload caddy || echo "  ⚠ caddy reload failed — the removed blocks are still loaded"; }
+
+echo "== summary =="
+if [ "$APPLY" = 1 ]; then echo "  acted on (${#left[@]}): ${left[*]:-none}"; else echo "  left (${#left[@]}): ${left[*]:-none}"; fi
+if [ "$APPLY" = 1 ]; then echo "  (applied — re-run without --apply to confirm nothing is left; DNS may take a TTL to settle)";
+else echo "  (survey only — re-run with --apply to remove the snippets, reload Caddy and park the hostnames)"; fi

package/scripts/gds/cli-lib.js

@@ -1166,6 +1166,42 @@ function detectWorktreeName() {
   }
 }
 
+// ---- card richness (task 1002518) ------------------------------------------
+//
+// The one place a CLI turns a /me payload into "what should this card look
+// like": three booleans — print the card at all, write the widget, open its
+// summary — that emitCard consumes directly.
+//
+// WHY THIS READS THE PAYLOAD AND NEVER require()s render-prefs.js. The ladder
+// lives in modules/builder-settings/render-prefs.js, and requiring it from here
+// would work on a full checkout and BREAK on a task-scoped dev box, which
+// carries scripts/ and src/bongos/ but not every modules/ directory (task
+// 1003098 — tree-preflight exists precisely to fail an entry point that reaches
+// for module code, and start.js is one). So the server resolves the rung and
+// ships the answers on `render.flags`; this function only picks them up.
+//
+// TWO SERVER SHAPES, deliberately. `render.flags` is the ladder (task 1002518);
+// `render.widgets_enabled` is the boolean that predates it. A CLI newer than the
+// instance it is pointed at sees only the boolean — the /me payload is not
+// version-negotiated — so the fallback is not defensive padding, it is the
+// supported path against a pinned instance, and it reconstructs exactly what
+// that boolean has always meant: card always, widget iff true, never expanded.
+// An absent or failed /me lands on the same default.
+function cardFlagsFromMe(me) {
+  const render = me && me.data && me.data.render;
+  const f = render && render.flags;
+  if (f && typeof f === 'object') {
+    return {
+      level: typeof f.level === 'string' ? f.level : null,
+      showCard: f.showCard !== false,
+      showWidget: f.showWidget === true,
+      expanded: f.expanded === true,
+    };
+  }
+  const enabled = !render || render.widgets_enabled !== false;
+  return { level: null, showCard: true, showWidget: enabled, expanded: false };
+}
+
 module.exports = {
   API_BASE,
   detectWorktreeName,
@@ -1220,4 +1256,5 @@ module.exports = {
   printOnboardingNudge,
   printCostWarning,
   printNeedsNudge,
+  cardFlagsFromMe,
 };

package/scripts/gds/fitness-migration-contraction.js

@@ -0,0 +1,50 @@
+// scripts/gds/fitness-migration-contraction.js — the ONE shape of destructive DDL a
+// module migration may carry: an ACKNOWLEDGED contract-phase DROP COLUMN on its own
+// namespaced table (task 1003092; ADR 0083 §Module-owned migrations, amended; the
+// expand-then-contract pattern of ADR 0177).
+//
+// WHY. Check 11 in fitness.js keeps module migrations ADDITIVE: there is no down
+// path, "disable a module" means "stop applying", so a DROP can only be an accident.
+// That rule met its first legitimate exception the moment a module ran an
+// expand-then-contract rename (ADR 0177 §"the fifth use"): `platform_identity_010`
+// ADDed `membership_kind` beside the legacy `role` column and kept the pair in
+// lockstep; the CONTRACT phase has to DROP the legacy column, or the rename never
+// finishes and the shim outlives its release (ADR 0174's Lineage lesson). A drop
+// that a previous migration wrote down in advance is not an accident.
+//
+// THE SHAPE, AND WHY IT IS THIS NARROW. A statement is let through only when ALL of:
+//   1. the FILE carries the `-- forward-unsafe: <reason>` pragma — the same
+//      acknowledgement scripts/gds/lint-migrations.js requires of a core migration,
+//      so one vocabulary says "this destruction is deliberate" everywhere;
+//   2. the statement is EXACTLY `ALTER TABLE <t> DROP COLUMN [IF EXISTS] <c>` and
+//      nothing else — no second clause, no DROP TABLE, no TRUNCATE, no bare DROP
+//      CONSTRAINT (which stays a violation even with the pragma);
+//   3. <t> is inside the module's own namespace (or its grandfathered legacy set),
+//      the same test the namespace check applies to every ALTER.
+// The pragma does not turn the check off for the file: every OTHER destructive
+// statement in an acknowledged file is still flagged. PURE — no fs, no process.
+'use strict';
+
+// Same single-line acknowledgement lint-migrations.js captures (ACK_RE there).
+const ACK_RE = /^\s*--\s*forward-unsafe\s*:\s*(.+)$/im;
+
+// Exactly one column drop, on one table, and nothing else in the statement.
+const COLUMN_DROP_RE = /^\s*alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?("?[\w.]+"?)\s+drop\s+column\s+(?:if\s+exists\s+)?"?\w+"?\s*$/i;
+
+// Is the migration FILE acknowledged as forward-unsafe? Read on the RAW sql — the
+// pragma is a comment, and the destructive-DDL scan strips comments first.
+function acknowledgedContraction(rawSql) {
+  const m = ACK_RE.exec(String(rawSql == null ? '' : rawSql));
+  return m ? m[1].trim() : null;
+}
+
+// Is THIS statement the one allowed shape? `inNamespace(table)` is the caller's
+// namespace predicate (fitness.js owns the <key>_ / legacy-set rule).
+function isAcknowledgedColumnContraction(stmt, { acknowledged, inNamespace }) {
+  if (!acknowledged) return false;
+  const m = COLUMN_DROP_RE.exec(stmt);
+  if (!m) return false;
+  return inNamespace(m[1]);
+}
+
+module.exports = { acknowledgedContraction, isAcknowledgedColumnContraction };

package/scripts/gds/fitness.js

@@ -827,6 +827,12 @@ function isConstraintWidening(stmt, reAdded) {
   return reAdded.has(m[1].replace(/"/g, ''));            // re-added same-named constraint → widening
 }
 
+// The ONE destructive shape a module may carry: an ACKNOWLEDGED contract-phase
+// `ALTER TABLE <own table> DROP COLUMN <c>` (task 1003092 — the expand-then-contract
+// rename of ADR 0177 has to finish; ADR 0083 §Module-owned migrations, amended). The
+// pragma is read off the RAW sql (it is a comment); everything else here still runs.
+const { acknowledgedContraction, isAcknowledgedColumnContraction } = require('./fitness-migration-contraction.js');
+
 // Pure: violations for ONE module's migration SQL. Exported for the negative test.
 function moduleMigrationViolations(key, sql) {
   const ns = moduleNamespace(key);
@@ -835,8 +841,11 @@ function moduleMigrationViolations(key, sql) {
   const violations = [];
   // additive — scan per statement so an ALTER…DROP never spans a `;`
   const reAdded = reAddedConstraintNames(clean);
+  const acknowledged = acknowledgedContraction(sql);
+  const ownTable = (t) => inNamespace(t, ns, legacy);
   for (const stmt of clean.split(';')) {
     if (isConstraintWidening(stmt, reAdded)) continue; // additive CHECK-enum widening (task 1978)
+    if (isAcknowledgedColumnContraction(stmt, { acknowledged, inNamespace: ownTable })) continue; // contract phase (task 1003092)
     for (const d of DESTRUCTIVE_DDL) {
       if (d.re.test(stmt)) {
         violations.push(`module "${key}" migration uses destructive DDL (${d.label}) — module migrations must be ADDITIVE; disabling a module stops applying, it never drops (ADR 0083 §Decision #5).`);
@@ -1205,6 +1214,15 @@ const CHECKS = [
   // migrations: same shared, monotonic, human-allocated number line, and until this
   // landed only one of the two was enforced. An ADR number is a citation target, so a
   // duplicate is wrong forever (ADR 0195).
+  // Check 33 — task 1003819: a module declares what it contributes, and nothing
+  // checked that a declared seam is actually WIRED. verifyPortsSatisfied asks the
+  // opposite question (every `consumes` has a provider) and validateManifest checks
+  // only the SHAPE, so a contributes entry whose artifact was never shipped — or was
+  // renamed out from under the manifest — boots silent: every consumer skips it the
+  // same way it correctly skips a real declarative-only entry. CI, not boot: nothing
+  // crashes later, so a start-up refusal would trade an outage risk for a cosmetic
+  // one (ADR 0289). Rationale + the seam→consumer table live in that file.
+  require('./seam-wiring-guard.js').checkSeamWiring,
   require('./adr-namespace.js').checkAdrNumbering, require('./exec-path-guard.js').checkExecPathsStatic, // Check 32 — task 1003371 / B50: what the server EXECUTES, out of whose tree — the blind spot all three 2026-08-29 CRITICALs shared. Rationale + reviewed exemptions live in that file. Sharing Check 31's line (the 19c/19d + 23/24 precedent above): fitness.js is AT the 1,500 ratchet and a new check cannot afford a line until task 1003825 buys it back.
 ];
 

package/scripts/gds/land-watch.js

@@ -122,9 +122,15 @@ function buildShippedEnvelope(crumb, task) {
     title: inputs.title || (task && task.title) || `Task #${crumb.taskId}`,
     valueSummary: inputs.valueSummary || (task && task.value_summary) || '',
   });
+  // task 1002518: prefer the rung the shipping session actually resolved, so the
+  // later-rendered shipped card matches the one it printed. A breadcrumb written
+  // by an older CLI carries only `widgetsEnabled`, which still reads correctly.
+  const flags = (crumb.cardFlags && typeof crumb.cardFlags === 'object')
+    ? crumb.cardFlags
+    : { showWidget: crumb.widgetsEnabled !== false, expanded: false };
   return {
-    widgets_enabled: crumb.widgetsEnabled !== false,
-    html: shipCard.renderCardHtml(model),
+    widgets_enabled: flags.showWidget === true,
+    html: shipCard.renderCardHtml(model, { expanded: flags.expanded === true }),
     markdown: shipCard.renderMonospaceCard(model),
     warnings: [],
     title: `task_${crumb.taskId}_card`,