@bongos/core 1.19.775 → 1.19.777

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.775",
-  "core_contract": "1.19.775",
-  "source_commit": "02a65922112e4360b309af219912dfbaae134134",
+  "core_version": "1.19.777",
+  "core_contract": "1.19.777",
+  "source_commit": "8c4c3db04491300feb300426c07f7d4bce19f981",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T18:20:46.880Z",
+  "built_at": "2026-09-16T18:55:13.712Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 486,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2151,
+    "functional_verbatim": 2153,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2662,
-  "tree_sha256": "98ff660bb87b9156a0e2535a91c5edf19a13b27736ca5c2a95982ce6e64f0ba4",
+  "file_count": 2664,
+  "tree_sha256": "48b4056d95f14a44152bbeafa4b8208f71b3bbb6890cb8fff14b4b5a70f27b10",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1957,7 +1957,7 @@
     {
       "path": "docs/adr/0290-disconnect-is-the-owner-initiated-exception-to-address-retention.md",
       "mode": "0000644",
-      "sha256": "a9558eccfabc69b85388c0aa7e7f1604d9dd7fa946c1761155cb8077d4c58d72"
+      "sha256": "37ab80018f5d9e6fdb35271be80ca07f10e6e593ef33b9a7a0a30fe9ea8c5fb3"
     },
     {
       "path": "docs/adr/README.md",
@@ -2527,7 +2527,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "0868d9c27813842952237812a33990e846e6d8019be740290ee1ac49f3b19e0a"
+      "sha256": "48accd0cc072b560c546805d257d6ac9695ec17a3702aa7434c17b6eb632f819"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6309,6 +6309,11 @@
       "mode": "0000644",
       "sha256": "aba202502cffe31a031facd7b8e902315b81729d42028d857fa913754f2f0a7b"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_017_domain_lookup_index.sql",
+      "mode": "0000644",
+      "sha256": "69fa8f9cdc3c9ec272c318226558254267ae63ef2ffa68ab93a89a3ab5d782a2"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -7627,12 +7632,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6be6f24971120806165359b15deb4042a43de963b54a09c1c25108383a11197c"
+      "sha256": "620248e6545e156fd98d84b9dc29bdad59a77be39ba3e761a90d62d385255f4d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "14e4c485f0795f8138ff062f0e1bf92740ddc2349117f8ef0d35570f4a9b672e"
+      "sha256": "d4ebe23ce76cdf1091ce8ab656a5199df19fb171768a947ff7cad259f9262dfd"
     },
     {
       "path": "public-docs/index.html",
@@ -7987,7 +7992,7 @@
     {
       "path": "scripts/gds/db-backup-nightly.sh",
       "mode": "0000644",
-      "sha256": "ff4785dbde6a5c52036ce4c4aacca317c62e725f49d3e32201909ec444d85d44"
+      "sha256": "93f0b743b90a0cfdc91806ecb10da20456b98c0fac0f2b8eb3d690bccf79e532"
     },
     {
       "path": "scripts/gds/db-backup-offsite.sh",
@@ -8487,7 +8492,7 @@
     {
       "path": "scripts/gds/provision-disconnect.js",
       "mode": "0000644",
-      "sha256": "c849ceda1769145879cb8da61186a39beb1ea48bfe1cd3eb0406eb668052aadb"
+      "sha256": "81cdd20b43aa1fc8b39a4fa06aada292aa00e84724feb803ba96bf15ce92cca9"
     },
     {
       "path": "scripts/gds/provision-net.js",
@@ -9492,7 +9497,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "885acafa5a2527e8ede987295a14a562feaa93dc6c9bdc2e2284e6d5d98c2999"
+      "sha256": "3791abffec940edb90c976525b388d122d16ff5613c1ee1a487d6e9f1ad1a1e0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10357,7 +10362,7 @@
     {
       "path": "tests/db_backup_nightly.mjs",
       "mode": "0000644",
-      "sha256": "020dc551d105cc4a29e0f9c750a03cd14a91511d3edc47eb6719a1e430461936"
+      "sha256": "cb731d19610530cc07457271aed57d5e04bec3d42bf85f246601b6cbdd02b3fd"
     },
     {
       "path": "tests/dead_deps.mjs",
@@ -12229,6 +12234,11 @@
       "mode": "0000644",
       "sha256": "62ea8ffc2c21c351289dc7f96cab38fcd5824afba1fed0df7a545cd5df9e396c"
     },
+    {
+      "path": "tests/provisioning_domain_lookup_index.mjs",
+      "mode": "0000644",
+      "sha256": "77110372442881ea3beaa59f25d08128e0dd2b92c49a78779567454ec8298d38"
+    },
     {
       "path": "tests/provisioning_domain_unique.mjs",
       "mode": "0000644",

package/docs/adr/0290-disconnect-is-the-owner-initiated-exception-to-address-retention.md

@@ -35,6 +35,6 @@ A failed erase or catalog step returns a retryable `{ ok:false }`; a teardown th
 - The manage page's copy changed with the capability. The teardown truth now ends "Taking it offline erases nothing." rather than "Nothing here erases a project.", and the fold points at the new card instead of admitting the capability is missing.
 - The `project.catalog` port has three verbs. `tests/catalog_only_client.mjs` still pins the list.
 - If the runner dies mid-disconnect, the reconcile sweep re-enqueues a *teardown* for a `tearing_down` row, not a disconnect. The project is left offline, with its row, and the owner presses Disconnect again. This is accepted rather than giving the reconcile a memory of intent.
-- The nightly prune's `<db>-*.sql.gz` glob can still reach a longer-named sibling's dumps older than 30 days. It is filed as its own row, not fixed here.
+- The nightly prune's `<db>-*.sql.gz` glob could still reach a longer-named sibling's dumps older than 30 days. It was filed as its own row and fixed in [task 1003948](https://cloudbongos.com/builders#/task/1003948): the prune and its retained count now match the same exact filename.
 
 Proofs: `tests/provisioning_disconnect.mjs` (queue + route), `tests/provision_disconnect.mjs` (runner order, shapes, failure, guards), `tests/project_catalog_forget.mjs` (claim rules), `tests/hub_disconnect_ui.mjs` + the kit probe (the card).

package/docs/module-api-changelog.md

@@ -2024,5 +2024,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.773 with no explicit bump. run 35132992149. (task 1002620)
   1.19.775 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.774 with no explicit bump. run 35133750943. (task 1002620)
+  1.19.776 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.775 with no explicit bump. run 35135604764. (task 1002620)
+  1.19.777 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.776 with no explicit bump. run 35137334438. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/migrations/provisioning_017_domain_lookup_index.sql

@@ -0,0 +1,20 @@
+-- provisioning_017_domain_lookup_index.sql — an index every lower(domain) read can
+-- use (task 1003541; grader minor on PR 451, task 1003347).
+--
+-- WHY. Every address read in provisioning.js matches `lower(domain)`, and the only
+-- index on that expression is provisioning_015's UNIQUE one, which is PARTIAL on
+-- status <> 'torn_down' (ADR 0181 D2 keeps a torn-down address for the revive
+-- path). A query that does not also exclude torn-down rows cannot use a partial
+-- index, so planetChoicesForHosts — the provisioning.projectPlanets seam behind
+-- every public /projects/featured read — scanned the whole table. It keeps
+-- torn-down rows on purpose (an offline project still shows its owner's planet),
+-- so the fix is an index, not a narrower query.
+--
+-- Non-unique and non-partial: uniqueness stays provisioning_015's job. Additive,
+-- no row changes. Applied only when the provisioning module is enabled. Safe to re-run.
+
+CREATE INDEX IF NOT EXISTS ix_provisioning_instances_lower_domain
+  ON provisioning_instances (lower(domain));
+
+INSERT INTO schema_migrations (version) VALUES ('provisioning_017_domain_lookup_index')
+  ON CONFLICT (version) DO NOTHING;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.775",
+  "version": "1.19.777",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.775",
+      "version": "1.19.777",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.775",
+  "version": "1.19.777",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/db-backup-nightly.sh

@@ -3,7 +3,7 @@
 #
 # Runs as user `lars` via the gds-db-backup.timer systemd unit (see
 # scripts/gds/gds-db-backup.timer + .service in this repo). Output lands
-# in /var/backups/gds/ as YYYY-MM-DD-HHMMSS.sql.gz (UTC timestamp), and
+# in /var/backups/gds/ as <db>-YYYY-MM-DDTHHMMSSZ.sql.gz (UTC timestamp), and
 # files older than 30 days are pruned.
 #
 # Authentication: peer auth via the local Unix socket — the invoking unix
@@ -59,6 +59,10 @@ RETENTION_DAYS="${GDS_BACKUP_RETENTION_DAYS:-30}"
 # Timestamp format. UTC so dumps sort sanely regardless of TZ.
 TS=$(date -u +"%Y-%m-%dT%H%M%SZ")
 OUT="${BACKUP_DIR}/${DB_NAME}-${TS}.sql.gz"
+# Exactly the name above. Every project's unit shares BACKUP_DIR, so a looser
+# `${DB_NAME}-*` would let `test` prune and count `test-nk`'s dumps (task 1003948).
+D='[0-9]'
+DUMP_GLOB="${DB_NAME}-${D}${D}${D}${D}-${D}${D}-${D}${D}T${D}${D}${D}${D}${D}${D}Z.sql.gz"
 
 # ---- preconditions ----------------------------------------------------------
 
@@ -173,7 +177,7 @@ fi
 # Done AFTER the new dump lands so a streak of failed runs can't erase
 # everything: we never delete on a day we didn't successfully dump.
 PRUNED=$(find "$BACKUP_DIR" -maxdepth 1 -type f \
-    -name "${DB_NAME}-*.sql.gz" \
+    -name "$DUMP_GLOB" \
     -mtime +"${RETENTION_DAYS}" \
     -print -delete | wc -l)
 
@@ -183,5 +187,5 @@ fi
 
 # ---- emit a one-line summary for journald + monitoring ---------------------
 
-REMAINING=$(find "$BACKUP_DIR" -maxdepth 1 -type f -name "${DB_NAME}-*.sql.gz" | wc -l)
+REMAINING=$(find "$BACKUP_DIR" -maxdepth 1 -type f -name "$DUMP_GLOB" | wc -l)
 echo "[$(date -u +%FT%TZ)] gds-db-backup: ok · ${REMAINING} dump(s) retained · ${BYTES} bytes latest"

package/scripts/gds/provision-disconnect.js

@@ -28,8 +28,8 @@ const { catalogOriginForInstance, ownerGithubIdForInstance } = require('../../mo
 const { deleteInstance } = require('../../modules/provisioning/disconnect.js');
 
 // The dump filename db-backup-nightly.sh writes — <db>-YYYY-MM-DDTHHMMSSZ.sql.gz — matched
-// EXACTLY. The nightly prune's own `<db>-*.sql.gz` would let a project named `test` erase
-// `test-nk`'s dumps, which is harmless for a 30-day prune and unacceptable for an erase. PURE.
+// EXACTLY, as the nightly prune's DUMP_GLOB does (task 1003948): a looser `<db>-*.sql.gz` would
+// let a project named `test` erase `test-nk`'s dumps. PURE.
 function dumpGlob(inst) {
   const d = '[0-9]';
   return `${dbName(inst)}-${d.repeat(4)}-${d.repeat(2)}-${d.repeat(2)}T${d.repeat(6)}Z.sql.gz`;

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.775'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.777'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/db_backup_nightly.mjs

@@ -29,12 +29,19 @@ const ENV = 'gds_backup_'.toUpperCase();
 // A fake pg_dump: a plain-format dump of `rows` rows, closed the way pg_dump closes one
 // (including the \unrestrict line patched servers append) unless it is `cut` short, and
 // exiting `exitCode`.
-function runBackup({ rows = 40, cut = false, exitCode = 0, env = {} } = {}) {
+// `seed` pre-places dumps in the shared dir as [filename, ageInDays].
+function runBackup({ rows = 40, cut = false, exitCode = 0, env = {}, seed = [] } = {}) {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'db-backup-'));
   const bin = path.join(tmp, 'bin');
   const dir = path.join(tmp, 'backups');
   fs.mkdirSync(bin);
   fs.mkdirSync(dir);
+  for (const [name, ageDays] of seed) {
+    const f = path.join(dir, name);
+    fs.writeFileSync(f, '');
+    const t = new Date(Date.now() - ageDays * 86400000);
+    fs.utimesSync(f, t, t);
+  }
   const body = Array.from({ length: rows }, (_, i) => `INSERT INTO public.t VALUES (${i});`).join('\n');
   const close = cut ? '' : '\n--\n-- PostgreSQL database dump complete\n--\n\n\\unrestrict abc123\n';
   fs.writeFileSync(path.join(bin, 'pg_dump'),
@@ -73,6 +80,19 @@ test('an explicit operator size floor is still enforced', { skip }, () => {
   assert.match(r.stderr, /floor/);
 });
 
+test('the prune and the count reach only this database\'s own dumps, never a longer-named sibling\'s (task 1003948)', { skip }, () => {
+  const r = runBackup({ seed: [
+    ['smallproj-2026-01-01T000000Z.sql.gz', 40],
+    ['smallproj-nk-2026-01-01T000000Z.sql.gz', 40],
+    ['smallproj-2-2026-09-01T000000Z.sql.gz', 2],
+  ] });
+  assert.equal(r.status, 0, r.stderr);
+  assert.ok(!r.dumps.includes('smallproj-2026-01-01T000000Z.sql.gz'), 'its own expired dump is pruned');
+  assert.ok(r.dumps.includes('smallproj-nk-2026-01-01T000000Z.sql.gz'), 'a sibling\'s expired dump is left for the sibling\'s own unit');
+  assert.match(r.stdout, /pruned 1 dump\(s\)/);
+  assert.match(r.stdout, /ok · 1 dump\(s\) retained/, 'the count is this database\'s dumps only');
+});
+
 test('no fixed size floor is baked in for every instance', () => {
   const src = fs.readFileSync(SCRIPT, 'utf8');
   assert.doesNotMatch(src, new RegExp(`${ENV}MIN_BYTES:-[1-9]`), 'a default floor fails every database smaller than it');

package/tests/provisioning_domain_lookup_index.mjs

@@ -0,0 +1,85 @@
+// tests/provisioning_domain_lookup_index.mjs
+//
+// The index behind the planet seam's address read (task 1003541).
+//
+// planetChoicesForHosts — the provisioning.projectPlanets port every public
+// /projects/featured read calls — matches lower(domain) and deliberately keeps
+// torn-down rows, because the catalog still lists an offline project and its
+// owner's planet should still draw. provisioning_015's lower(domain) index is
+// PARTIAL on status <> 'torn_down', which such a query cannot use, so the read
+// scanned the whole table. provisioning_017 adds the index it can use.
+//
+// These tests hold the pair together: the migration's expression and the seam's
+// predicate must stay the same expression, and the seam must not "fix" the scan by
+// quietly dropping torn-down rows.
+//
+// DB-free: the seam runs against a fake `db` that records its SQL. Postgres is not
+// asked to EXPLAIN; there is no DB lane in CI (task 1003381).
+//
+// Run:  node tests/provisioning_domain_lookup_index.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const SQL = fs.readFileSync(new URL('../modules/provisioning/migrations/provisioning_017_domain_lookup_index.sql', import.meta.url), 'utf8');
+const CREATE = (SQL.match(/CREATE[\s\S]*?;/) || [''])[0];
+
+console.log('the migration — provisioning_017_domain_lookup_index.sql:');
+
+t('indexes lower(domain), the expression every address read matches', () => {
+  assert.match(CREATE, /CREATE INDEX IF NOT EXISTS ix_provisioning_instances_lower_domain\s+ON provisioning_instances \(lower\(domain\)\)/);
+});
+
+t('is neither UNIQUE nor PARTIAL — uniqueness stays provisioning_015\'s, and a partial index is what the seam could not use', () => {
+  assert.doesNotMatch(CREATE, /UNIQUE/);
+  assert.doesNotMatch(CREATE, /WHERE/);
+});
+
+t('self-registers and is safe to re-run', () => {
+  assert.match(SQL, /INSERT INTO schema_migrations \(version\) VALUES \('provisioning_017_domain_lookup_index'\)\s+ON CONFLICT \(version\) DO NOTHING/);
+});
+
+console.log('\nthe seam — planetChoicesForHosts:');
+
+function recordingDb(rows = []) {
+  const calls = [];
+  return { calls, query: async (sql, params) => { calls.push({ sql, params }); return { rows }; } };
+}
+
+await ta('matches on the same lower(domain) expression the index is built on, with the hosts lowercased', async () => {
+  const db = recordingDb();
+  await provisioning.planetChoicesForHosts(db, ['Mercury.Example.com', 'mercury.example.com', '']);
+  assert.equal(db.calls.length, 1);
+  assert.match(db.calls[0].sql, /lower\(domain\) = ANY\(\$1\)/);
+  assert.deepEqual(db.calls[0].params, [['mercury.example.com']]);
+});
+
+await ta('keeps torn-down rows — an offline project still draws its owner\'s planet', async () => {
+  const db = recordingDb([{ host: 'lantern.example.com', status: 'torn_down', settings: { planet_template: 'blob-tint' }, updated_at: '2026-09-16' }]);
+  const out = await provisioning.planetChoicesForHosts(db, ['lantern.example.com']);
+  assert.doesNotMatch(db.calls[0].sql, /status/, 'no status filter — that would change what the map draws, not just how fast');
+  assert.equal(out['lantern.example.com'].planet_template, 'blob-tint');
+});
+
+await ta('no hosts asks nothing', async () => {
+  const db = recordingDb();
+  assert.deepEqual(await provisioning.planetChoicesForHosts(db, []), {});
+  assert.equal(db.calls.length, 0);
+});
+
+console.log(`\nprovisioning_domain_lookup_index: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);