@bongos/core 1.19.779 → 1.19.781

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.779",
-  "core_contract": "1.19.779",
-  "source_commit": "1b37b29ce2a7832804f9b44a6982ea25b57643e3",
+  "core_version": "1.19.781",
+  "core_contract": "1.19.781",
+  "source_commit": "d45eac660796500d874b2c6381eb9c07be462935",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T20:08:25.581Z",
+  "built_at": "2026-09-16T21:03:10.547Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 482,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2660,
-  "tree_sha256": "dbb45ccb2f44e4771d7a73e06e5ac46faea7115961c48cac9da3877e62f2e61c",
+  "tree_sha256": "76c1ea968399be1d516e7abf97ecbd1b1fe812033d8ff2ddf81901b15c0aff15",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1492,7 +1492,7 @@
     {
       "path": "docs/adr/0200-re-point-a-bring-your-own-domain.md",
       "mode": "0000644",
-      "sha256": "d73c7f4ebaf18bf81e461532144422b8d343698c50964687c52b13301af42c66"
+      "sha256": "b2b9495e54389f959c30def7986121d386151371e6204f676dced1a2e25f0312"
     },
     {
       "path": "docs/adr/0201-cross-project-application-vouched-row-live-record.md",
@@ -2507,7 +2507,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "b5409eae5a7466352e67fee988116c208a7c748e5dd88052f8a2b45a8e58f907"
+      "sha256": "cf5cab9a32c28dae4029b2d175cd06e6a45f33114c0203392f478e8ee5d7e34f"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6352,7 +6352,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "5644a8afbee6c04976abd6ecab14ae5e6636a6de21fb4a4ab398cb7004b98f70"
+      "sha256": "616fa85cebc85241a1283b3493caaa2bb93a20b18ea6ea8e9b9fd0969f2ccc49"
     },
     {
       "path": "modules/provisioning/starter-bundles.js",
@@ -6867,7 +6867,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "61598d6f9c4cb90656fe3570e1e299f3e7e1a7d7ec5a6589f75c5b0356d03df6"
+      "sha256": "e187b9ed50a30d49ff5f40a91ddf8ff9879adfe6b62ee809115903e029c4bf18"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -7612,12 +7612,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "73c88d2a70b9f77171344eb76f4c5c9f2ecbbc4d1a1b6b3008d636e974b01f9b"
+      "sha256": "649f45c7edc727a1e32796caefe1848113a53872e435be1befbd23167e4a71a4"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "4c30d22b31621113b656c60c5a7d71d70fc1544326be0d506ca16a242783defd"
+      "sha256": "71490018201c33eea331cb3aaa42d97bc024754b83b4b8d6622ec8aa736bdc30"
     },
     {
       "path": "public-docs/index.html",
@@ -8502,7 +8502,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "f57b0699b8ba548d91f1c4fdf978a50a57501f47595caaf293dad9041eb7636f"
+      "sha256": "9744a8493b15537c1789f7270cf5d9679b5ecf40d685f5857e27b21f34ae8690"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -9477,7 +9477,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3a9d2a54bc76ea41d67b42be5f2c07da60fcdeec3bbed8f23111163dfa17f1ff"
+      "sha256": "ae9fcf83cce465b20cd9d5fc34f88c58decace92ebfaf3fd0f2d477d8b46bc16"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12137,7 +12137,7 @@
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "15ce0b2e70b94dbc1325929461ff55ec952b6e35845d8de4feb0440239a77854"
+      "sha256": "5095bb2c890d89337c819fc3fc07fe26507f0bd78607b2b49239bccf23419aa3"
     },
     {
       "path": "tests/promote_goal_id.mjs",
@@ -12157,7 +12157,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "5f7ec2483f8564dc9561f0becdfc36166bca5021b7f964db6d6e40d62108e041"
+      "sha256": "151d6a8b22f3d12b766a4ab1a0402c70e9b91c6a1d9f75f658b9d60937d652df"
     },
     {
       "path": "tests/provision_disconnect.mjs",
@@ -12212,7 +12212,7 @@
     {
       "path": "tests/provisioning_domain_attach.mjs",
       "mode": "0000644",
-      "sha256": "62ea8ffc2c21c351289dc7f96cab38fcd5824afba1fed0df7a545cd5df9e396c"
+      "sha256": "8a5bc0b4b1ab854cb1c5dc2d8c4a1330f38c445455651e2de15b258938acc6ef"
     },
     {
       "path": "tests/provisioning_domain_lookup_index.mjs",

package/docs/adr/0200-re-point-a-bring-your-own-domain.md

@@ -48,6 +48,8 @@ Only a **BYO** address is ever queued, and only from a state that actually stood
 
 The web tier decides both, because it is the tier that knows the apex and the lifecycle state.
 
+> **Amendment (owner, 2026-09-16, task 1002902): the first exclusion is withdrawn.** An upgrade off the platform-assigned `<slug>.<apex>` now queues that name for release like any other address a project moves off; only the `requested` exclusion remains. The revive argument did not hold for this path. A revive re-uses the row's *current* address, which after an upgrade is the BYO name, not the assigned one. Teardown already parks whatever address the row holds (task 1002897). A project that moves back onto its assigned name re-UPSERTs it in the same attach, and `releasableDomains` never releases the address a row is on. Keeping the name meant leaving a record aimed at platform infra with no vhost behind it, which is the leak §2 exists to close. The route releases the row's own `current` value and never derives one, so a mis-derived name cannot park another project's record, and the squat rule keeps `<slug>.<apex>` usable only by that slug's own project. The manage card's "lets `<host>` go" line now shows on the upgrade too.
+
 **The queue is capped (`MAX_RELEASED_DOMAINS`), and the route that fills it is throttled.** The runner drains this list **synchronously, one <redacted> call per entry**, and every re-point is a write an authenticated owner can repeat — `normalizeHostname` checks a hostname's *shape*, never that it exists. So an uncapped array is a resource-exhaustion vector against a **platform-wide** resource (the control plane's DNS token and rate limit, and the drain loop itself), not merely against the owner's own project. Two bounds, at different layers:
 
 - **The cap is enforced in `updateInstanceDomain`'s own SQL**, not trusted from the caller: past the bound the append is dropped, keeping the entries most likely to name a hostname the platform really wired. Dropping is the deliberate failure mode; growing without bound is not.

package/docs/module-api-changelog.md

@@ -2032,5 +2032,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.777 with no explicit bump. run 35139523999. (task 1002620)
   1.19.779 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.778 with no explicit bump. run 35144678111. (task 1002620)
+  1.19.780 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.779 with no explicit bump. run 35147229585. (task 1002620)
+  1.19.781 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.780 with no explicit bump. run 35150109281. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/routes/provisioning.js

@@ -1162,13 +1162,12 @@ module.exports = function provisioningRoutes() {
       // weaker rule and gets no stronger one. The address it moves OFF is queued
       // for release (`releasing`): leaving a hostname UPSERTed at platform infra
       // for a project that no longer answers there is the leak ADR 0181 §2 named.
-      // Only a BYO address is released, and only from a state that actually STOOD
-      // UP: a platform-ASSIGNED <slug>.<apex> is the platform's own name for this
-      // slug and the revive path re-uses it (ADR 0181 §2), while a 'requested'
-      // instance never had an A record written for the address it is leaving —
-      // parking that name would CREATE a junk record rather than release one.
-      const releasing = current && current !== assignedDefault
-        && provisioning.DOMAIN_RELEASE_FROM.has(inst.status) ? current : null;
+      // That includes the platform-ASSIGNED <slug>.<apex> an upgrade leaves (task
+      // 1002902, amending ADR 0200): moving back onto it re-UPSERTs it, and a revive
+      // re-uses the row's CURRENT name. Only from a state that actually STOOD UP: a
+      // 'requested' instance never had an A record written for the address it is
+      // leaving — parking that name would CREATE a junk record rather than release one.
+      const releasing = current && provisioning.DOMAIN_RELEASE_FROM.has(inst.status) ? current : null;
       const holder = await provisioning.getInstanceByDomain(pool, domain);
       if (holder && String(holder.id) !== String(inst.id)) return res.fail('domain_taken', { status: 409, message: 'That address is already in use by another instance.' });
       if (!provisioning.DOMAIN_ATTACH_FROM.has(inst.status)) {

package/modules/public-landing/public/projects.html

@@ -5721,7 +5721,9 @@ summary{min-height:24px;padding:3px 0;}
       /* true in every state this renders in: a REQUESTED project never answered
          anywhere yet, so "stops answering" would be a claim about a thing that
          never happened (the F16 rule) */
-      (repoint ? '<p class="attachNote">Changing it lets <code>' + esc(inst.domain) + '</code> go — this project won’t use that address any more.</p>' : '') +
+      /* the assigned <slug>.<apex> is let go too (task 1002902), so the upgrade says so */
+      (!rekick && inst.domain ? '<p class="attachNote">' + (repoint ? 'Changing it' : 'Using a domain you own') +
+        ' lets <code>' + esc(inst.domain) + '</code> go — this project won’t use that address any more.</p>' : '') +
       '<div class="projMsg' + (mDomNote && mDomNote.cls ? ' ' + mDomNote.cls : '') + '" id="mDomMsg" role="status" aria-live="polite">' +
       (mDomNote ? mDomNote.html : '') + '</div>';
     var field = $('mDomName');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.779",
+  "version": "1.19.781",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.779",
+      "version": "1.19.781",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.779",
+  "version": "1.19.781",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision.js

@@ -625,8 +625,8 @@ ${roleLines}  - [ bash, -lc, "install -d -o ${APP_USER} -g ${APP_USER} -m 0750 $
 // (task 1003237). The one guard this tier can make on its own, and the one that
 // matters: the address the instance is CURRENTLY on is never released, so a row
 // that somehow queued its own domain can never blackhole a live project.
-// Keeping a platform-assigned <slug>.<apex> off the queue is the ENQUEUE site's
-// job — the web tier knows the apex, this runner does not (ADR 0181 §2). PURE.
+// WHICH addresses reach the queue is the ENQUEUE site's job (the route's
+// `releasing`, ADR 0200 as amended by task 1002902). PURE.
 function releasableDomains(inst) {
   const here = String((inst && inst.domain) || '').toLowerCase();
   return (Array.isArray(inst && inst.released_domains) ? inst.released_domains : [])

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.779'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.781'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub_pre_uat.mjs

@@ -393,6 +393,9 @@ test('the correction door: a bring-your-own address can be changed, and the sect
   assert.match(fold, /repoint \? 'It answers on an address you brought\./, 'the lead names the correction');
   assert.match(fold, /attachNote/, 'and the consequence is stated where the button is');
   assert.match(fold, /won’t use that address any more/, 'letting the old address go is SAID, not discovered');
+  // task 1002902: the upgrade off the platform-assigned address lets that name go too
+  assert.match(fold, /\(!rekick && inst\.domain \? '<p class="attachNote">' \+ \(repoint \? 'Changing it' : 'Using a domain you own'\)/,
+    'the note shows for the assigned-address upgrade as well as a correction, and never on the F19 re-kick');
   // the door itself: an addressed, live project is no longer excluded
   const gate = fn('canAttachDomain');
   assert.doesNotMatch(gate, /!inst\.domain \|\| inst\.domain === assignedDefaultFor\(inst\)/,

package/tests/provision.mjs

@@ -1963,6 +1963,10 @@ await ta('releasableDomains: the queue, minus the address the instance is CURREN
   assert.deepEqual(P.releasableDomains({ domain: 'x.example.com' }), [], 'no queue is not a crash');
   assert.deepEqual(P.releasableDomains({ domain: 'x.example.com', released_domains: ['a.example.com', '', 'b.example.com'] }),
     ['a.example.com', 'b.example.com'], 'every abandoned address is released, not just the last');
+  // task 1002902: the route now queues the platform-assigned <slug>.<apex> an upgrade
+  // leaves, so the runner must not second-guess an in-apex name the web tier queued.
+  assert.deepEqual(P.releasableDomains({ domain: 'mine.example.com', released_domains: ['spike.cloudbongos.com'] }),
+    ['spike.cloudbongos.com'], 'an assigned address the project moved off is released like any other');
 });
 
 await ta('domainAttachInstance(--apply): a re-point parks the old address at the blackhole, AFTER wiring the new one', async () => {

package/tests/provisioning_domain_attach.mjs

@@ -323,11 +323,20 @@ await ta('a re-point onto an address ANOTHER project holds is a truthful 409 dom
   assert.equal(updateCalls.length, 0);
 });
 
-await ta('moving OFF the platform-assigned <slug>.<apex> queues NO release — that name is the platform own (ADR 0181)', async () => {
+await ta('moving OFF the platform-assigned <slug>.<apex> releases it too — nothing is left answering there (task 1002902)', async () => {
   reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cb.test' } });
   const res = await post('/provisioning/instances/18/domain', { domain: 'mine.example.com' });
   assert.equal(res.status, 200, res.raw);
-  assert.equal(res.body.replaced, null, 'the assigned default is never released - the revive path re-uses it');
+  assert.equal(res.body.replaced, 'spike.cb.test', 'the upgrade names the assigned address it lets go');
+  assert.deepEqual(updateCalls, [{ id: 18, domain: 'mine.example.com', releasing: 'spike.cb.test' }]);
+  assert.match(res.body.message, /spike\.cb\.test is being let go/, 'and says so in the response');
+});
+
+await ta('an upgrade off the assigned address on a REQUESTED instance still releases nothing — no record was ever written', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'requested', domain: 'spike.cb.test' } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'mine.example.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.replaced, null);
   assert.deepEqual(updateCalls, [{ id: 18, domain: 'mine.example.com', releasing: null }]);
 });