@bongos/core 1.19.773 → 1.19.775

package/modules/provisioning/provisioning.js

@@ -58,7 +58,8 @@ const PROJECT_TYPES = ['game', 'research', 'business', 'non-profit', 'not-sure']
 // instance whose liveness probe says it is down — the settings-apply leg minus the
 // env patch. Its own action because no existing one fits: provision refuses
 // 'active' and settings-apply requires a value that actually changed.
-const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest', 'domain-attach', 'settings-apply', 'restart'];
+// 'disconnect' (task 1003249, migration provisioning_016): the owner's true delete — ./disconnect.js.
+const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest', 'domain-attach', 'settings-apply', 'restart', 'disconnect'];
 // Every state a teardown can be asked for — i.e. everything except the one
 // state where there is provably nothing left to release. DERIVED from
 // INSTANCE_STATES on purpose (task 1003042, walk finding N5): the old hand-kept
@@ -1489,8 +1490,7 @@ module.exports = {
   listActiveInstancesForLiveness, recordLivenessProbe, recordDnsNote, clearErrorNote,
   // data access — the owed-push marker (task 1003524)
   recordSettingsPushOwed,
-  createInstance, setInstanceStatus, updateInstanceDomain, updateInstanceSettings, updateInstanceDetail,
-  createInstance, setInstanceStatus, updateInstanceDomain, clearReleasedDomains, updateInstanceSettings,
+  createInstance, setInstanceStatus, updateInstanceDomain, clearReleasedDomains, updateInstanceSettings, updateInstanceDetail,
   enqueueIntent, enqueueTeardown, enqueueSettingsApply, enqueueRestart, getOpenIntent, claimNextIntent, resolveIntent,
   recordEvent, instanceStateForSlug, planetChoicesForHosts, projectOwnedBy, costLedger,
   // data access — GitHub App Manifest attempts (task 2080)

package/modules/provisioning/routes/disconnect.js

@@ -0,0 +1,63 @@
+// modules/provisioning/routes/disconnect.js — POST /provisioning/instances/:id/disconnect
+// (task 1003249, ADR 0290: "Disconnect from Bongos entirely").
+//
+// The web tier's half of the owner's true delete. Like every provisioning action it only
+// ENQUEUES; the control-plane runner does the destruction (ADR 0111 §2). Its own routes
+// file (declared in module.json) because routes/provisioning.js sits at the size ratchet.
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const { pool, validateOrRespond, parseId } = api;
+const provisioning = require('../provisioning');
+const disconnect = require('../disconnect');
+
+const log = api.logger('provisioning');
+
+module.exports = function buildDisconnectRouter() {
+  const router = express.Router();
+
+  // POST /provisioning/instances/:id/disconnect — rank: any authenticated builder (own
+  // resource); an archon may disconnect any project. 404 for anyone else, so another
+  // owner's id is never confirmed. The typed name is checked HERE, not only in the page:
+  // this erases a database, so a replayed or scripted request must carry the same proof
+  // the button does. No status gate — any state may be disconnected; the queue refuses
+  // while another run is open (disconnect.enqueueDisconnect).
+  router.post('/provisioning/instances/:id/disconnect', api.requireBuilder, async (req, res) => {
+    const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
+    if (!id) return;
+    if (validateOrRespond(req, res, { confirm_slug: { required: true, type: 'string', maxLength: 40 } })) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      const isOwner = !!inst && String(inst.owner_builder_id) === String(req.builder.id);
+      if (!inst || (!isOwner && req.builder.rank !== 'archon')) return res.fail('instance_not_found', 404);
+      if (String(req.body.confirm_slug).trim().toLowerCase() !== inst.slug) {
+        return res.fail('confirm_mismatch', { status: 400,
+          message: `Type the project's name exactly — ${inst.slug} — to disconnect it. Nothing was changed.` });
+      }
+      const actor = isOwner ? 'api:self' : `api:archon:${req.builder.id}`;
+      const r = await disconnect.enqueueDisconnect(pool, id, actor);
+      if (r.conflict) {
+        return res.fail('intent_conflict', { status: 409,
+          message: `A '${r.intent.action}' run is ${r.intent.state} for this project. Disconnecting waits for it to finish — try again once it has.`,
+          details: { action: r.intent.action, state: r.intent.state } });
+      }
+      if (r.created) {
+        await provisioning.recordEvent(pool, {
+          instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'disconnect',
+          detail: isOwner ? 'disconnect requested by owner' : `disconnect requested by archon ${req.builder.github_login || req.builder.id}`,
+          actor,
+        }).catch(() => {});
+      }
+      res.json({ ok: true, queued: r.created, action: 'disconnect', status: inst.status,
+        message: r.created
+          ? 'Queued. The platform takes the project down, erases its database and backups, and releases its name and address. It leaves your list when that is done.'
+          : 'A disconnect is already queued for this project.' });
+    } catch (err) {
+      log.error('[provisioning] POST /provisioning/instances/:id/disconnect', err);
+      res.fail('disconnect_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/provisioning/routes/provisioning.js

@@ -17,7 +17,7 @@
 //                                                      only shape that bills; ../paid-shape-gate.js.
 //                                                      An `adopt` ALSO passes the credential
 //                                                      preflight — ../credential-preflight.js,
-//                                                      task 1002909; greenfield is exempt)
+//                                                      task 1002909; greenfield is exempt; a full box → 409, ../capacity-gate.js)
 //     GET    /provisioning/instances               — list the caller's instances
 //     GET    /provisioning/instances/:id           — read one of the caller's instances
 //                                                     (also SELF-HEALS its catalog projection,
@@ -51,6 +51,7 @@ const { ALWAYS_ON_CORE, OPTIONAL_MODULES, starterBundleAnswerTable, optionalModu
 const { recommendationsForDetails } = require('../recommendations');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
 const { requireAuthorityForMeteredShape } = require('../paid-shape-gate');
+const { requireRoomOnBox } = require('../capacity-gate');   // a full box refused up front (task 1003938)
 const { adoptCredentialFault } = require('../credential-preflight');
 const catalogBridge = require('../catalog-bridge');
 const capacity = require('../capacity');   // the box's slot ceiling (ADR 0285, task 1003927)
@@ -299,10 +300,9 @@ module.exports = function provisioningRoutes() {
   });
 
   // POST /provisioning/instances — request a new instance. rank: any authenticated
-  // builder (own resource); a `dedicated` (metered) shape additionally requires
-  // provisioning.fleet.manage — see requireAuthorityForMeteredShape above.
-  // ENQUEUES a 'provision' intent + records the request;
-  // the runner (task P3) does the real standup. Idempotent on slug for the SAME
+  // builder (own resource); a `dedicated` (metered) shape also needs provisioning.fleet.manage
+  // (../paid-shape-gate.js), and a full shared box answers 409 box_full up front (../capacity-gate.js).
+  // ENQUEUES a 'provision' intent the runner (task P3) stands up. Idempotent on slug for the SAME
   // owner (re-request returns the existing row); a slug owned by ANOTHER builder → 409.
   // Body: { slug (required), target_ref?, hosting_shape? (co-tenant|dedicated),
   //         domain?, tier?, onboard_mode? (greenfield|adopt) }.
@@ -312,7 +312,7 @@ module.exports = function provisioningRoutes() {
   // ALREADY has, so the runner must clone + layer onto its history instead of pushing a
   // fresh tree at `main` (which an existing repo rejects as unrelated history). Absent →
   // 'greenfield', the safe default.
-  router.post('/provisioning/instances', auth.requireBuilder, requireAuthorityForMeteredShape(auth.requirePermission), async (req, res) => {
+  router.post('/provisioning/instances', auth.requireBuilder, requireAuthorityForMeteredShape(auth.requirePermission), requireRoomOnBox(pool, log), async (req, res) => {
     if (validateOrRespond(req, res, {
       slug: { required: true, type: 'string', maxLength: 40 },
       target_ref: { type: 'string', maxLength: 200 },

package/modules/provisioning/starter-bundles.js

@@ -70,6 +70,21 @@ const ALWAYS_ON_CORE = Object.freeze([
 // refuse them by construction rather than by anyone remembering.
 const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning']);
 
+// Modules that were once offered and are being WITHDRAWN. A retired key is still
+// a module on disk — its manifest, routes and tables are deleted by later tasks —
+// but it must stop being OFFERED the moment the withdrawal starts, or an owner
+// creating a project today opts into something that is on its way out.
+//
+// WHY A LIST AND NOT JUST DELETING THE ROW. The integrity test below pins
+// OPTIONAL_MODULES against the on-disk `default: false` manifests, so that a new
+// opt-in module cannot ship without owner-facing copy. Dropping a row while its
+// manifest is still on disk would trip exactly that guard. Naming the withdrawal
+// keeps the guard honest in both directions: the catalog may omit a RETIRED
+// module and may omit nothing else. The entry is deleted when the module is
+// (goal 1000091, task 1003892) — at which point the manifest is gone and the
+// plain drift check covers it again.
+const RETIRED_MODULES = Object.freeze(['dev-box']);
+
 // The OPT-IN catalog as the creation picker renders it (BV1.R20, task 1002339):
 // every module an owner may actually choose, in the order the picker lists them,
 // with copy written for someone who has met none of them.
@@ -90,11 +105,6 @@ const OPTIONAL_MODULES = Object.freeze([
     label: 'Extra agents',
     summary: 'More AI agents alongside the ones every project gets, for reading, research and review.',
   }),
-  Object.freeze({
-    key: 'dev-box',
-    label: 'Dev boxes',
-    summary: 'A cloud workspace where a change can be tried out before anyone else sees it. Nothing is charged until someone asks for one.',
-  }),
   Object.freeze({
     key: 'discord',
     label: 'Discord',
@@ -122,8 +132,10 @@ const OPTIONAL_MODULE_KEYS = Object.freeze(OPTIONAL_MODULES.map((m) => m.key));
 // stay there. Decision: ADR 0243 (BV1.R22, task 1002341).
 //
 // Deliberately tiny: ADR 0237 already made the per-type preset the opinion, and
-// today's opt-in catalog is three modules wide — so this table's job is to correct
-// a preset the owner's answer contradicts, not to re-derive it.
+// today's opt-in catalog is two modules wide — so this table's job is to correct
+// a preset the owner's answer contradicts, not to re-derive it. The two rules that
+// added and removed `dev-box` by team shape went with the module (task 1003886):
+// a rule about a module nobody can select adjusts nothing.
 //
 // A rule may only ever name an OPT-IN module. Adding or removing an always-on one
 // would be a toggle that toggles nothing (ADR 0237 §3's argument, and
@@ -136,20 +148,6 @@ const TEAM_SHAPE_RULES = Object.freeze([
     module: 'discord',
     reason: 'You said an open community is building this, so somewhere for it to gather is switched on.',
   }),
-  Object.freeze({
-    id: 'a-team-shares-one-environment',
-    teamShape: 'small-team',
-    effect: 'add',
-    module: 'dev-box',
-    reason: 'A small team gets one shared environment to build in, so nobody is debugging their own laptop.',
-  }),
-  Object.freeze({
-    id: 'building-alone-needs-no-shared-environment',
-    teamShape: 'solo',
-    effect: 'remove',
-    module: 'dev-box',
-    reason: 'You are building this alone, so the shared cloud environment is off — your own machine is the setup.',
-  }),
 ]);
 
 // The team shapes the rules above can fire on. Derived from the table rather than
@@ -167,16 +165,17 @@ const RULED_TEAM_SHAPES = Object.freeze([...new Set(TEAM_SHAPE_RULES.map((r) =>
 // here has not met any of these modules yet.
 //
 // The lists are SHORT on purpose. A preselect an owner has to audit is worse than
-// none, and today's opt-in catalog is genuinely small (`agents`, `dev-box`,
-// `discord`); a bundle grows as the catalog does, which is exactly why this is a
-// declaration and not a rule engine. Enabling `dev-box` opens the door to a cloud
-// dev environment — it provisions nothing and bills nothing until a builder asks
-// for a box — so preselecting it costs the owner nothing but a toggle.
+// none, and today's opt-in catalog is genuinely small (`agents`, `discord`); a
+// bundle grows as the catalog does, which is exactly why this is a declaration and
+// not a rule engine. `dev-box` was preselected by the game and business bundles
+// until it was retired (goal 1000091, task 1003886) — withdrawing it left both
+// bundles one module wide, which is the floor working as intended, not a gap to
+// backfill with a module an owner did not ask for.
 const STARTER_BUNDLES = Object.freeze({
   game: Object.freeze({
     label: 'Game starter',
-    summary: 'Somewhere for players to gather, and a place to walk a change through before anyone plays it.',
-    modules: Object.freeze(['dev-box', 'discord']),
+    summary: 'Somewhere for players to gather, hear what you are building, and send their ideas back.',
+    modules: Object.freeze(['discord']),
   }),
   research: Object.freeze({
     label: 'Research starter',
@@ -185,8 +184,8 @@ const STARTER_BUNDLES = Object.freeze({
   }),
   business: Object.freeze({
     label: 'Business starter',
-    summary: 'A place to try a change before customers see it, and agents to look it over first.',
-    modules: Object.freeze(['agents', 'dev-box']),
+    summary: 'Extra agents to look a change over before customers ever see it.',
+    modules: Object.freeze(['agents']),
   }),
   'non-profit': Object.freeze({
     label: 'Non-profit starter',
@@ -259,6 +258,8 @@ function adjustBundle(bundle, teamShape) {
   for (const rule of TEAM_SHAPE_RULES) {
     if (rule.teamShape !== teamShape) continue;
     if (rule.effect === 'add' && !held.has(rule.module)) held.add(rule.module);
+    // `remove` is declared but named by no live rule since dev-box was retired
+    // (task 1003886). Kept for the next rule that needs it, not exercised today.
     else if (rule.effect === 'remove' && held.has(rule.module)) held.delete(rule.module);
     else continue;
     adjustments.push({ rule: rule.id, effect: rule.effect, module: rule.module, reason: rule.reason });
@@ -374,6 +375,7 @@ function effectiveModules(row) {
 module.exports = {
   ALWAYS_ON_CORE,
   HUB_ONLY_MODULES,
+  RETIRED_MODULES,
   OPTIONAL_MODULES,
   STARTER_BUNDLES,
   TEAM_SHAPE_RULES,

package/modules/public-landing/public/projects.html

@@ -939,7 +939,21 @@ summary{min-height:24px;padding:3px 0;}
              than letting the word "Delete" imply it. -->
         <details class="finePrint" id="mDelWhat">
           <summary>What this removes — and what it keeps</summary>
-          <p>Tearing down stops the project’s server and its nightly backups. It does <b>not</b> erase the project: it stays in your list marked <b>torn down</b> so you can bring it back, your repository on GitHub is untouched, and its database and existing backups are kept on purpose. There is no permanent-delete button — clearing a project’s database for good, and freeing its web address for another project, are done by hand today.</p>
+          <p>Tearing down stops the project’s server and its nightly backups. It does <b>not</b> erase the project: it stays in your list marked <b>torn down</b> so you can bring it back, your repository on GitHub is untouched, and its database and existing backups are kept on purpose. To erase it for good — its database, its backups and its web address — use <b>Disconnect from Bongos entirely</b> below.</p>
+        </details>
+      </div>
+      <!-- "Disconnect from Bongos entirely" (task 1003249, ADR 0290): the owner's TRUE
+           delete, in its own card after the ender so the reversible control never reads
+           as the destructive one. The fold is a sibling of the volatile slot, like
+           #mDelWhat, so no re-render can drop what it promises. -->
+      <div class="card mSec" id="mDisconnect">
+        <h2>Disconnect from Bongos entirely</h2>
+        <div id="mDisc"><p class="finePrint">Reading the project…</p></div>
+        <details class="finePrint" id="mDiscWhat">
+          <summary>What this erases — and what it keeps</summary>
+          <p><b>Erased for good:</b> the project’s server, its database and every nightly backup of it, its settings, its place on the map and the list of its members. Its name and web address are released, so another project can take them.</p>
+          <p><b>Kept:</b> your repository on GitHub, exactly as it is. If a GitHub sign-in app was registered for the project, that stays on your GitHub account too — remove it in your GitHub settings if you no longer want it.</p>
+          <p>This cannot be undone. To stop the project and keep everything, use <b>Take it offline</b> above instead.</p>
         </details>
       </div>
     </section>
@@ -5196,21 +5210,19 @@ summary{min-height:24px;padding:3px 0;}
      retention is deliberate on shared boxes; a dedicated machine takes its
      database with it). Copy follows the runner, never the other way around. */
   function teardownTruth(inst) {
-    /* the address line is NOT decoration: teardown has no DNS or Caddy leg, so
-       the hostname keeps resolving and serves an error page rather than going
-       quiet. The old copy promised the address goes silent, which was simply
-       untrue — and the rule above is that copy follows the runner. Releasing the
-       address is tracked separately (task 1002897); until then "reserved" is
-       both the honest word and the accurate one, since a revive re-uses exactly
-       this hostname. */
+    /* the address line is NOT decoration. Teardown now parks the hostname at a
+       dead address and removes its proxy block (task 1002897), so nothing answers
+       there — but the row keeps the address, because a revive re-uses exactly
+       this hostname. "Reserved" is the accurate word for that; "gone" would not be,
+       and neither is the old error-page promise, true only before the park. */
     /* pre-standup: at 'requested' nothing has been built, so the shape arms
        below would describe a server and a database that never existed. error
        and provisioning keep the built-world text on purpose — a run that failed
        partway may already have a database, a port and a DNS record. */
     if (inst && inst.status === 'requested') return 'Nothing has been stood up yet — this cancels the standup. Anything already on GitHub is untouched, and the name and web address stay reserved for this project.';
     return inst && inst.hosting_shape === 'dedicated'
-      ? 'This project has a machine to itself, so the machine goes away and its database goes with it. Your repository is untouched. Its web address stays reserved for this project and shows an error page until you bring it back. Nothing here erases a project.'
-      : 'The server goes away. Your repository is untouched. The database is kept, so bringing it back later restores its memory. Its web address stays reserved for this project and shows an error page until you bring it back. Nothing here erases a project.';
+      ? 'This project has a machine to itself, so the machine goes away and its database goes with it. Your repository is untouched. Its web address stays reserved for this project, and nothing answers there until you bring it back. Taking it offline erases nothing.'
+      : 'The server goes away. Your repository is untouched. The database is kept, so bringing it back later restores its memory. Its web address stays reserved for this project, and nothing answers there until you bring it back. Taking it offline erases nothing.';
   }
 
   /* onManage: the same facts, but the pointers name the controls THIS surface
@@ -5224,7 +5236,7 @@ summary{min-height:24px;padding:3px 0;}
        "nothing more will happen" (task 1003232) */
     if (inst.status === 'torn_down' || inst.status === 'tearing_down') {
       if (!inst.domain) return '';
-      return 'Its address, <code>' + esc(inst.domain) + '</code>, stays reserved for this project — it shows an error page until you bring it back.';
+      return 'Its address, <code>' + esc(inst.domain) + '</code>, stays reserved for this project — nothing answers there until you bring it back.';
     }
     if (inst.domain) {
       if (inst.status === 'active') {
@@ -5553,6 +5565,7 @@ summary{min-height:24px;padding:3px 0;}
        it: the delete section reads only status + open_intent, both already in
        hand, and a queued teardown must show up without a reload */
     renderDelete(inst);
+    renderDisconnect(inst);
     /* its address (task 1003355) is fetch-free too — the control it carries
        reads status + domain + open_intent, all already in hand */
     renderAddress(inst);
@@ -7026,6 +7039,12 @@ summary{min-height:24px;padding:3px 0;}
         '<p class="finePrint">This page updates when it starts.</p>');
       return;
     }
+    /* a queued disconnect takes the project offline itself; a teardown ask here would
+       only be refused by the server's open-run check (task 1003249) */
+    if (inst.open_intent && inst.open_intent.action === 'disconnect') {
+      delMsg('<p class="finePrint">A disconnect is queued for this project — taking it offline is part of it.</p>');
+      return;
+    }
     /* a project that never finished standing up still reaches here — that is
        the whole point of the widened gate; teardownTruth() scopes the copy to
        its status */
@@ -7116,6 +7135,92 @@ summary{min-height:24px;padding:3px 0;}
     if (t.hasAttribute('data-del-no')) { mDelAsking = null; if (manageInst) renderDelete(manageInst); }
   });
 
+  /* ── "Disconnect from Bongos entirely" (task 1003249, ADR 0290): the TRUE delete. The
+     ender's shape on purpose — the name typed back (and checked again by the SERVER, which
+     receives it as confirm_slug), a project-scoped guard so the minute tick never repaints
+     over a half-typed name, and every refusal in the server's own words. ── */
+  var mDiscAsking = null;
+
+  function discMsg(html) { $('mDisc').innerHTML = html; }
+
+  function renderDisconnect(inst) {
+    if (mDiscAsking && mDiscAsking === inst.slug) return;
+    var open = inst.open_intent;
+    if (open && open.action === 'disconnect') {
+      discMsg('<div class="addr">This project is being disconnected.</div>' +
+        '<p class="finePrint">When it finishes, the project leaves your list and this page can no longer find it.</p>');
+      return;
+    }
+    if (open) {
+      discMsg('<p class="plain">Disconnecting waits for the current ' + esc(open.action || '') + ' run to finish.</p>');
+      return;
+    }
+    discMsg('<p class="plain">Erase this project from the platform for good: its database and backups, its settings and its place on the map. Your repository on GitHub is kept.</p>' +
+      '<div class="actions"><button type="button" class="btn small danger" data-disc-ask>Disconnect entirely</button></div>');
+  }
+
+  function askDisconnect() {
+    var inst = manageInst;
+    if (!inst) return;
+    mDiscAsking = inst.slug;
+    discMsg('<div class="confirmRow"><span class="plain">Disconnect <b>' + esc(inst.slug) + '</b> from Bongos entirely? ' +
+      'Its database and backups are erased and this cannot be undone. Type the project’s name to confirm.</span></div>' +
+      '<div class="attach">' +
+      '<input type="text" id="mDiscName" autocomplete="off" spellcheck="false" maxlength="40" ' +
+      'aria-label="Type the project name to confirm the disconnect" placeholder="' + esc(inst.slug) + '">' +
+      '<button type="button" class="btn small danger" data-disc-yes disabled>Yes, disconnect it</button>' +
+      '<button type="button" class="linklike" data-disc-no>Keep it</button></div>');
+    var field = $('mDiscName');
+    if (field) field.focus();
+  }
+
+  function discTypedMatches() {
+    var field = $('mDiscName');
+    return !!(field && manageInst && field.value.trim() === manageInst.slug);
+  }
+
+  function doDisconnect() {
+    var inst = manageInst;
+    if (!inst || !discTypedMatches()) return;
+    var typed = $('mDiscName').value.trim();
+    mDiscAsking = null;
+    discMsg('<p class="finePrint">Asking…</p>');
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(inst.id) + '/disconnect', {
+      method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ confirm_slug: typed })
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) {
+          discMsg('<div class="projMsg ok">' + esc(data.message || 'Disconnect requested.') + '</div>');
+          loadManage(true); /* the queued run this page renders just changed */
+          return;
+        }
+        renderDisconnect(inst);
+        var e = apiError(data, res.status);
+        $('mDisc').insertAdjacentHTML('beforeend', '<div class="projMsg err">' +
+          (res.status === 401 ? signInAgain() : esc(e.message || 'The disconnect could not be queued — try again.')) + '</div>');
+      });
+    }).catch(function () {
+      renderDisconnect(inst);
+      $('mDisc').insertAdjacentHTML('beforeend',
+        '<div class="projMsg err">Couldn’t reach the platform — check your connection and try again.</div>');
+    });
+  }
+
+  $('mDisc').addEventListener('input', function (ev) {
+    if (!ev.target || ev.target.id !== 'mDiscName') return;
+    var yes = $('mDisc').querySelector('[data-disc-yes]');
+    if (yes) yes.disabled = !discTypedMatches();
+  });
+
+  $('mDisc').addEventListener('click', function (ev) {
+    var t = ev.target.closest && ev.target.closest('button');
+    if (!t) return;
+    if (t.hasAttribute('data-disc-ask')) return askDisconnect();
+    if (t.hasAttribute('data-disc-yes')) return doDisconnect();
+    if (t.hasAttribute('data-disc-no')) { mDiscAsking = null; if (manageInst) renderDisconnect(manageInst); }
+  });
+
   /* ── restart an unreachable project (task 1003238). Its own route, because
      PROVISION_ENQUEUE_FROM excludes 'active' — re-POSTing the slug the way
      Try again / Bring it back do would be refused on every press. Every

package/modules/public-landing/public/projects.probes.json

@@ -155,6 +155,9 @@
     { "name": "manage flows: the ender asks for the name typed back, queues the teardown, and the page re-reads the project as queued", "auth": true, "width": 1440, "url": "/projects?view=manage&id=105",
       "steps": [["wait",900],["click","[data-del-ask]"],["wait",200],["fill","#mDelName","mooring"],["wait",100],["click","[data-del-yes]"],["wait",900]],
       "expect": {"text":[["#mDel .addr","A teardown is queued for this project."],["#mName","mooring"]],"hidden":["#mDelName","[data-del-ask]"],"visible":["#mStrip .strip.flowDown"]} },
+    { "name": "manage flows: disconnect entirely asks for the name typed back, queues the true delete, and the page re-reads the project as being disconnected (task 1003249)", "auth": true, "width": 1440, "url": "/projects?view=manage&id=104",
+      "steps": [["wait",900],["click","[data-disc-ask]"],["wait",200],["fill","#mDiscName","old-lantern"],["wait",100],["click","[data-disc-yes]"],["wait",900]],
+      "expect": {"text":[["#mDisc .addr","This project is being disconnected."],["#mName","old-lantern"]],"hidden":["#mDiscName","[data-disc-ask]"]} },
     { "name": "the wizard driver (task 1003346): name, type, about, home (fresh; the stub grants repo access, so the new repository is named from the project), address (the handle's verdict), the review as a ledger, then the filing — the done panel with the standup rail and the human steps", "auth": true, "width": 1440, "url": "/projects?view=new",
       "steps": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#doCreate"],["wait",1500]],
       "expect": {"visible":["#panel-done","#liveProgress .prog","#liveProgress .prog .stages li.now","#humanSteps li"],"hidden":["#panel-review","#panel-name"],"text":[["#done-h","The drums are rolling"]],"attr":[["#panel-done","class","panel on"]]} },

package/modules/ui-design/kit/serve.js

@@ -121,15 +121,14 @@ const STARTER_BUNDLES_FIXTURE = {
     'security', 'sessions', 'status-ui', 'ui-design',
   ],
   bundles: [
-    { type: 'game', bundle: ['dev-box', 'discord'] },
+    { type: 'game', bundle: ['discord'] },
     { type: 'research', bundle: ['agents'] },
-    { type: 'business', bundle: ['agents', 'dev-box'] },
+    { type: 'business', bundle: ['agents'] },
     { type: 'non-profit', bundle: ['discord'] },
     { type: 'not-sure', bundle: [] },
   ],
   optional: [
     { key: 'agents', label: 'Extra agents', summary: 'More AI agents alongside the ones every project gets, for reading, research and review.' },
-    { key: 'dev-box', label: 'Dev boxes', summary: 'A cloud workspace where a change can be tried out before anyone else sees it. Nothing is charged until someone asks for one.' },
     { key: 'discord', label: 'Discord', summary: 'A Discord server that carries your build news, and lets people send ideas and bug reports back.' },
   ],
 };
@@ -157,6 +156,7 @@ function stamp(v) {
 const FLOW_RECEIPTS = {
   teardown: { queued: true, message: 'Teardown queued.' },
   restart: { queued: true, message: 'Restart queued.' },
+  disconnect: { queued: true, message: 'Queued. The platform takes the project down, erases its database and backups, and releases its name and address. It leaves your list when that is done.' },
   domain: { recorded: true, queued: true, message: 'Address recorded.' },
   // the wizard's filing (task 1003346): the receipt names the instance the page then polls — Harbor, the fixture's standing-up row — and the address the page promises is the one the server assigned
   provision: { queued: true, message: 'Queued. The platform picks it up from here.', instance: { id: 102, domain: 'mercury.cloudbongos.com' } },
@@ -220,10 +220,10 @@ function withPlanet(inst) {
 }
 function flowReceipt(rest, method) {
   if (method === 'POST' && rest === '/provisioning/instances') return FLOW_RECEIPTS.provision;
-  const m = rest.match(/^\/provisioning\/instances\/(\d+)\/(teardown|restart|domain)$/);
+  const m = rest.match(/^\/provisioning\/instances\/(\d+)\/(teardown|restart|domain|disconnect)$/);
   if (!m) return null;
   if (method !== 'POST') return null;
-  if (m[2] === 'teardown' || m[2] === 'restart') ASKED.set(m[1], m[2]);
+  if (m[2] === 'teardown' || m[2] === 'restart' || m[2] === 'disconnect') ASKED.set(m[1], m[2]);
   return FLOW_RECEIPTS[m[2]];
 }
 function withAsk(inst) {

package/modules/ui-design/module.json

@@ -6,6 +6,7 @@
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "contributes": { "skills": ["design", "design-sync", "figma-design-sync", "design-taste-frontend", "design-taste-frontend-v1", "high-end-visual-design", "redesign-existing-projects", "impeccable", "style", "minimalist-ui", "industrial-brutalist-ui", "gpt-taste", "stitch-design-taste", "image-to-code", "imagegen-frontend-web", "imagegen-frontend-mobile", "brandkit"], "disciplines": ["ui"] },
+  "declarativeSeams": { "skills": ["design", "design-sync", "figma-design-sync"] },
   "provides": [],
   "consumes": []
 }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.773",
+  "version": "1.19.775",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.773",
+      "version": "1.19.775",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.773",
+  "version": "1.19.775",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/address-park-sweep.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# scripts/gds/address-park-sweep.sh — park the addresses of projects torn down BEFORE
+# teardown learned to do it itself (task 1003947, the backfill half of task 1002897).
+#
+# WHY. Task 1002897 made a teardown remove its <slug>.caddy block and park its hostname
+# at the RFC 5737 blackhole. That only applies to teardowns run after the pin carries it,
+# so every earlier row still has its Caddy block proxying to a dead port and its A record
+# pointing at the platform: eleven hostnames answered 502 on 2026-09-16, while the hub
+# copy says "nothing answers there". This is that same teardown step, run once over the
+# ledger's torn-down rows. It does not re-run `provision.js teardown <slug>`, which would
+# rewrite each row's torn_down_at.
+#
+# The reserved-hostname rule, the zone and the apex come from the INSTALLED core (the
+# same helpers a teardown calls), so this sweep cannot disagree with what teardown parks.
+#
+# Run on the control plane as a sudoer:
+#   bash scripts/gds/address-park-sweep.sh            # survey only — read-only
+#   bash scripts/gds/address-park-sweep.sh --apply    # remove the snippets, reload Caddy, park the hostnames
+#
+# Left in place on purpose, even with --apply: each project's database, dumps and checkout,
+# and the row's domain + port (ADR 0181 — a revive re-uses that address).
+set -uo pipefail
+
+APPLY=0; [ "${1:-}" = "--apply" ] && APPLY=1
+DB="${PGDATABASE:-cloudbongos}"
+INSTANCE_DIR="${INSTANCE_DIR:-/home/lars/cloudbongos-instance}"
+SITES="${PROVISION_CADDY_SNIPPET_DIR:-/etc/caddy/sites}"
+BOX_ENV="${BOX_ENV:-/etc/cloudbongos/box.env}"
+
+rows=$(sudo -n -u lars psql -d "$DB" -tAF '|' -c "select slug, coalesce(domain, '') from provisioning_instances where status='torn_down' order by slug" 2>/dev/null) \
+  || { echo "cannot read provisioning_instances from $DB as lars"; exit 1; }
+
+# slug|domain|zone|reserved|blackhole per row, plus an apex line — from the installed core.
+plan=$(sudo -n -u lars env ROWS="$rows" bash -c 'cd "$1" && exec node -' _ "$INSTANCE_DIR" <<'JS'
+const core = './node_modules/@bongos/core';
+const { isReservedHostname } = require(`${core}/modules/provisioning/provisioning.js`);
+const { dnsReleaseEnv } = require(`${core}/scripts/gds/provision-net.js`);
+const apex = require(`${core}/scripts/gds/instance-apex.js`).instanceApex();
+console.log(`apex|${apex || ''}`);
+for (const line of String(process.env.ROWS || '').split('\n').filter(Boolean)) {
+  const [slug, domain] = line.split('|');
+  const env = domain ? dnsReleaseEnv(domain) : { CLOUDFLARE_ZONE: '', BOX_IP: '' };
+  console.log(['row', slug, domain || '', env.CLOUDFLARE_ZONE, domain && isReservedHostname(domain, apex) ? 1 : 0, env.BOX_IP].join('|'));
+}
+JS
+) || { echo "cannot load the installed core from $INSTANCE_DIR"; exit 1; }
+
+apex=$(printf '%s\n' "$plan" | awk -F'|' '$1 == "apex" {print $2}')
+[ -n "$apex" ] || { echo "the installed core names no apex — refusing: the reserved-hostname guard would be blind"; exit 1; }
+echo "== torn-down rows still holding a Caddy block or an unparked address (apex $apex) =="
+
+left=(); reload=0
+while IFS='|' read -r kind slug domain zone reserved blackhole; do
+  [ "$kind" = "row" ] || continue
+  # The slug grammar provisioning.isValidSlug enforces; anything else never reaches a command.
+  [[ "$slug" =~ ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$ ]] || continue
+  if [ -e "$SITES/$slug.caddy" ]; then
+    printf '  %-22s snippet %s\n' "$slug" "$SITES/$slug.caddy"
+    left+=("$slug:snippet")
+    if [ "$APPLY" = 1 ]; then sudo -n rm -f "$SITES/$slug.caddy" </dev/null && reload=1; fi
+  fi
+  [ -n "$domain" ] || continue
+  if [ "$reserved" = 1 ]; then printf '  %-22s %s is platform-reserved — never parked\n' "$slug" "$domain"; continue; fi
+  now=$(getent ahostsv4 "$domain" 2>/dev/null </dev/null | awk 'NR == 1 {print $1}')
+  [ -z "$now" ] || [ "$now" = "$blackhole" ] && continue
+  printf '  %-22s %s resolves to %s — park at %s (zone %s)\n' "$slug" "$domain" "$now" "$blackhole" "$zone"
+  left+=("$slug:dns")
+  [ "$APPLY" = 1 ] || continue
+  sudo -n -u lars bash -c 'set -a; . "$1"; set +a; BOX_HOSTNAME="$2" BOX_IP="$3" CLOUDFLARE_ZONE="$4" BOX_PROXIED=0 exec "$BOX_DNS_HOOK"' \
+    _ "$BOX_ENV" "$domain" "$blackhole" "$zone" </dev/null || echo "  ⚠ could not park $domain — re-run to retry"
+done <<< "$plan"
+
+[ "$reload" = 1 ] && { sudo -n systemctl reload caddy || echo "  ⚠ caddy reload failed — the removed blocks are still loaded"; }
+
+echo "== summary =="
+if [ "$APPLY" = 1 ]; then echo "  acted on (${#left[@]}): ${left[*]:-none}"; else echo "  left (${#left[@]}): ${left[*]:-none}"; fi
+if [ "$APPLY" = 1 ]; then echo "  (applied — re-run without --apply to confirm nothing is left; DNS may take a TTL to settle)";
+else echo "  (survey only — re-run with --apply to remove the snippets, reload Caddy and park the hostnames)"; fi