@bongos/core 1.19.949 → 1.19.951

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.949",
-  "core_contract": "1.19.949",
-  "source_commit": "b167833627e1c0360613322d616a6e288ea083a0",
+  "core_version": "1.19.951",
+  "core_contract": "1.19.951",
+  "source_commit": "52686c08170a959adbd2fff6681162b3b3e248ae",
   "source_ref": "HEAD",
-  "built_at": "2026-09-22T01:20:15.264Z",
+  "built_at": "2026-09-22T04:02:59.605Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 513,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2347,
+    "functional_verbatim": 2350,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2886,
-  "tree_sha256": "76d08b0cd0d4045e4ecadf3d9571fbcbc63cf5aebc7d33edf787c30a0c7978de",
+  "file_count": 2889,
+  "tree_sha256": "4c573e93b9c8147a0c7657ef1f9c43b7e3a0e37d6254e65502e205f91a77fdb0",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2687,7 +2687,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "29e0651fa0f5cb469d61cc13ff096ef772a07006f2e8d53e2d6119b3b3f194fb"
+      "sha256": "707238093af0e4b56e36139173b6d46d7ffd33a86c348181a40dc74083821738"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6517,12 +6517,12 @@
     {
       "path": "modules/provisioning/capacity-gate.js",
       "mode": "0000644",
-      "sha256": "28dfe87a6aa6a6a7ef15dfda3a845c5d6cb442ff7489c851308eb474c1043836"
+      "sha256": "5d0d3eb34c68620b785803a40df416872e6a606cf6e144a9d2793f88bc231cb8"
     },
     {
       "path": "modules/provisioning/capacity.js",
       "mode": "0000644",
-      "sha256": "1a2b3bd97a2e0c0068c6200a71dabb692e90723ee1ff63a56775f2b91e1cb208"
+      "sha256": "56a2be9188fa0d8785174e6e91547c10266c3b6859fcad00aebd5739de4f366f"
     },
     {
       "path": "modules/provisioning/catalog-bridge.js",
@@ -6649,6 +6649,11 @@
       "mode": "0000644",
       "sha256": "cdc3e8992d1e4273a472b826f208736235c8a3b16a700de33a7705cdae99ef9e"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_021_byo_host_shape.sql",
+      "mode": "0000644",
+      "sha256": "cde8a3a4c66c17d17c4e18866f11600a06073377de41d5ed70cd93185cd78d6d"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -6657,12 +6662,12 @@
     {
       "path": "modules/provisioning/onboard-plan.js",
       "mode": "0000644",
-      "sha256": "3c36bb1b163a35492ccd3d231e50039bded945fbccac076166c70a67767a687d"
+      "sha256": "c67f592415bb9c81e3eef658a7352c2bc47dfb4056b2cdef52f772e5021d28cf"
     },
     {
       "path": "modules/provisioning/paid-shape-gate.js",
       "mode": "0000644",
-      "sha256": "7c08e627e228bec400e9e2dc204418a6995a4668eb6c1817ae59f20f77cbe71e"
+      "sha256": "cceda07080d1175a3629ebb2105e36220a2c2728768f2c6eb691f0269479a002"
     },
     {
       "path": "modules/provisioning/pollers/catalog-backfill.js",
@@ -6682,7 +6687,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "cfd57a109b12ecc629422c16a4db85fe2daf1700dcae60df2885701e5eecd5cc"
+      "sha256": "82bb265d63bb882468bbb609faa60a783ccf7dfeec5cd4595550586c37131bda"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -6717,7 +6722,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "63919aad35ff1f47c4981e5e5c1f1c08d79eb0de9588e0c3ba2c5ed488167211"
+      "sha256": "a10d9ac50f6be584c33a6bb559ad9d0431c2ac7f4655c23fcdf47baedf540cd2"
     },
     {
       "path": "modules/provisioning/seams.js",
@@ -7242,7 +7247,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "8de1601446961430e081632ad410a22a21665749d9acbc0b6f7f9c7a6b9d92c9"
+      "sha256": "dab97906f2db723c0ec00aaf1a7930b7e0051098e6102704f65a6d0c705543ff"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -8042,12 +8047,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c2e5171010f3ceab561e381ba14d2d76649b8bca170450a8db18edde40bf6228"
+      "sha256": "14465332b60fa42b702654bd0dd552e8b332b3c17cc969bfe08c3cd8a720320a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f7988eef8fb6aceffb3357949ab178209d7e340281f00f926334fd3456ef57c1"
+      "sha256": "f7f40ce54ba7eddac00919f6407ee95888c15a87e3fc526450b64a00365cd913"
     },
     {
       "path": "public-docs/index.html",
@@ -8767,7 +8772,7 @@
     {
       "path": "scripts/gds/init.js",
       "mode": "0000644",
-      "sha256": "f24475957efcba217133ef05c297e5a9f11d78ae884a6e7286084723d9daf912"
+      "sha256": "d18b93dc0ac9136cfae79d98cd3506cb12d94fce30829a39dfb15f880770b93e"
     },
     {
       "path": "scripts/gds/install-git-hooks.js",
@@ -8974,6 +8979,11 @@
       "mode": "0000644",
       "sha256": "b0e2c14720e8258eba4d4ef7f69cc2bcbb26c3be312deb891383dce7a1dbf71e"
     },
+    {
+      "path": "scripts/gds/provision-byo-host.js",
+      "mode": "0000644",
+      "sha256": "92ef1fa760b90ece9781abe6d3c75abf84ff39cbb8b42194cca367bab7821269"
+    },
     {
       "path": "scripts/gds/provision-capacity.js",
       "mode": "0000644",
@@ -9027,7 +9037,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "e879686d5fcadfd32eb1dfc4e1640fc229cc4f0afc78615681964484e8457c1f"
+      "sha256": "1d92b6cbbfb544328a8bacd29cb492445508617298c251872d846bb7ab5a180a"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -9852,7 +9862,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "36da288c8087ebd653c0b208a02414ea55d09da53df22cb4fc3d281941756ec7"
+      "sha256": "8cb783238eaf296a3d057537b829ec14c7d3d65f380874af18861d6262cffb10"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -10047,7 +10057,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3fbfb8061f3fdf5fbc1d7426db7eb5dd6b8ec4acaab02eab9489c0d443792b09"
+      "sha256": "156e1f0be121fb3fa396c32374f1ab8d0540f1d6c42a8aee28d05b5429a14115"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12277,7 +12287,7 @@
     {
       "path": "tests/init.mjs",
       "mode": "0000644",
-      "sha256": "26629f6a3882b35f6844b8f0f9af9221e53a0906bb89401e8e23b3e5aee8d1f0"
+      "sha256": "9feeee7dbc2f1ae59a0af7eadbb521b74f114ce83e3f45ffdef59c1f8fdf25ec"
     },
     {
       "path": "tests/instance_config.mjs",
@@ -13062,7 +13072,7 @@
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "5095bb2c890d89337c819fc3fc07fe26507f0bd78607b2b49239bccf23419aa3"
+      "sha256": "19e1b68463ddccb1a1155e1adfb3d4c130711745030183fb1d27650f1bfe5444"
     },
     {
       "path": "tests/promote_deps_gate.mjs",
@@ -13104,6 +13114,11 @@
       "mode": "0000644",
       "sha256": "9f62eea1b43a478334a83df52d0e81a3b3b67f4c4eea54680d2d8db3b25ee513"
     },
+    {
+      "path": "tests/provision_byo_host.mjs",
+      "mode": "0000644",
+      "sha256": "79c33863862966ef0d7a0f4d9dc2290596a4f98da2796083b9319c24a6bfc26e"
+    },
     {
       "path": "tests/provision_caddy_wiring.mjs",
       "mode": "0000644",
@@ -13137,12 +13152,12 @@
     {
       "path": "tests/provisioning_capacity.mjs",
       "mode": "0000644",
-      "sha256": "bcb976ab17508d1af34ea0c775d25765f336f534d79de9442b2fbc6712fa2a28"
+      "sha256": "7a48fb54dce89efa207d7dd254a8a5ef70c6b1958b6ed2be198a73e76bb74327"
     },
     {
       "path": "tests/provisioning_capacity_gate.mjs",
       "mode": "0000644",
-      "sha256": "d95439f89702862e45cf1c0b238aa5a463e81b584d7dca70d91863547bee6642"
+      "sha256": "363405d0f78714e9e3c29ee6ce64a1735a96fdaa95c631930743019daf8e26ff"
     },
     {
       "path": "tests/provisioning_credential_preflight.mjs",
@@ -13182,17 +13197,17 @@
     {
       "path": "tests/provisioning_module_selection.mjs",
       "mode": "0000644",
-      "sha256": "540e9b5b158a5623525924403bcef444f87fe0364591cd9c6b9e0a55f4f6295c"
+      "sha256": "8eaa3b40b38cbc294836ac3c4905f6a0a7c4a04e9c68d443e503f479a735c839"
     },
     {
       "path": "tests/provisioning_onboard_mode.mjs",
       "mode": "0000644",
-      "sha256": "f7a01aa6ed190c1ad544d91312909b081446a7fc2b6ef339f3ba8fa4d59f0306"
+      "sha256": "96c7ea0d646151393767061f042082f006007390ff652c7c649fd9151ab2ed61"
     },
     {
       "path": "tests/provisioning_paid_shape_gate.mjs",
       "mode": "0000644",
-      "sha256": "19961880545fe8f6c9eaf79095aa0d08f7862409109d581cac828f0f20b1be69"
+      "sha256": "859a44a139cfc7a52bc534dac8dc52f1203d60d5bdaac34e64834b6838e128fe"
     },
     {
       "path": "tests/provisioning_recommendations.mjs",

package/docs/module-api-changelog.md

@@ -2372,5 +2372,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.947 with no explicit bump. run 35671807404. (task 1002620)
   1.19.949 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.948 with no explicit bump. run 35675336642. (task 1002620)
+  1.19.950 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.949 with no explicit bump. run 35683452297. (task 1002620)
+  1.19.951 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.950 with no explicit bump. run 35685346231. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/capacity-gate.js

@@ -26,7 +26,13 @@ function requireRoomOnBox(db, log) {
   return async function capacityGate(req, res, next) {
     const body = req.body || {};
     // The handler's own default and validation: a malformed request gets its 400 there.
-    const shape = body.hosting_shape || 'co-tenant';
+    // The absent-shape default MUST match createInstance's coercion and the paid-shape
+    // gate's, or this gate prices a request against a shape the row will not take. It
+    // was 'co-tenant' until ADR 0323; that shape lands on the control plane, so after the
+    // default moved to 'byo-host' — which runs on the OWNER's machine and takes no slot
+    // here — a shapeless create on a full box would have been refused box_full for
+    // capacity it never consumes. Three places default this; they agree deliberately.
+    const shape = body.hosting_shape || 'byo-host';
     const slug = String(body.slug || '').trim().toLowerCase();
     if (!provisioning.HOSTING_SHAPES.includes(shape) || !provisioning.isValidSlug(slug)) return next();
     const target = capacity.placementBox(shape, { remoteHost: process.env.PROVISION_REMOTE_HOST || null });

package/modules/provisioning/capacity.js

@@ -68,8 +68,14 @@ function parseMeminfo(text) {
 // local (task 2074); a co-tenant runs on the remote co-hosting box only when the
 // runner is in remote-exec mode (ADR 0130), else here. A dedicated droplet is its
 // own box and has no shared ceiling → null (no preflight).
+//
+// A 'byo-host' (ADR 0323) also answers null, for a stronger reason than dedicated's:
+// the owner supplies the machine, so the platform has no box to place it on and no
+// memory of its own to spend. It can never be refused for capacity, and it must never
+// consume a slot that a cloud-host would otherwise get — which is what returning null
+// here buys, since PLACED_STATES counting keys off the shapes a box declares.
 function placementBox(hostingShape, { remoteHost = null } = {}) {
-  if (hostingShape === 'dedicated') return null;
+  if (hostingShape === 'dedicated' || hostingShape === 'byo-host') return null;
   if (hostingShape === 'co-tenant' && remoteHost) {
     return { box: 'overflow', shapes: ['co-tenant'], fixedMb: FIXED_MB.overflow };
   }

package/modules/provisioning/migrations/provisioning_021_byo_host_shape.sql

@@ -0,0 +1,37 @@
+-- provisioning_021 — admit the 'byo-host' hosting shape (ADR 0323, task 1004141).
+--
+-- "Bring your own host": the OWNER runs the instance on their own machine, VPS or
+-- platform account. The platform stands up nothing and reaches into nothing, so the
+-- row is a record of an instance we do not operate — liveness is the ADR 0252 pull
+-- against an owner-supplied origin.
+--
+-- A CHECK-ENUM WIDENING, and nothing else. `DROP CONSTRAINT IF EXISTS` paired with a
+-- re-`ADD CONSTRAINT` of the SAME name in the SAME migration only ever PERMITS more
+-- values: no existing row changes and no data is lost, which is why fitness.js
+-- (isConstraintWidening) treats this exact shape as additive rather than destructive.
+-- The precedent is provisioning_002, which admitted 'standalone' the same way.
+--
+-- 'co-tenant' STAYS IN THE SET even though ADR 0323 retires it. Retirement closes the
+-- DOOR, not the record: one torn-down row still carries that value, and dropping it
+-- from the constraint would make a historical row violate its own table. The door is
+-- closed in code instead — paid-shape-gate.js lists it UNREQUESTABLE, so no new row can
+-- ever take it, while the old one stays readable. A shape that is storable but never
+-- grantable again is exactly what that set is for.
+--
+-- The two managed shapes keep their OLD stored spellings ('standalone', 'dedicated')
+-- on purpose. ADR 0323 renames them owner-facing to "cloud host" and "dedicated cloud
+-- host", but about half the code reading those values is landlord machinery that task
+-- 1004142 deletes when it moves them to a managed platform, and renaming a call site a
+-- task before deleting it is work done twice. That task carries the data rename with
+-- those files already open.
+
+ALTER TABLE provisioning_instances DROP CONSTRAINT IF EXISTS provisioning_instances_hosting_shape_check;
+ALTER TABLE provisioning_instances ADD CONSTRAINT provisioning_instances_hosting_shape_check
+  CHECK (hosting_shape IN ('byo-host', 'co-tenant', 'dedicated', 'standalone', 'control-plane'));
+
+-- The COLUMN default was 'co-tenant' (provisioning_001), which is now a retired shape.
+-- Every insert today goes through createInstance, which always passes an explicit shape,
+-- so nothing currently relies on this default — which is exactly why it is worth moving
+-- now rather than leaving a loaded gun for the first insert that ever omits the column.
+-- Changing a DEFAULT rewrites no existing row.
+ALTER TABLE provisioning_instances ALTER COLUMN hosting_shape SET DEFAULT 'byo-host';

package/modules/provisioning/onboard-plan.js

@@ -34,11 +34,18 @@
 // `shapes` (task 1002696; direction §7 — a surface renders only steps somebody real
 // will perform on THIS instance's shape). The control-plane shapes (standalone /
 // co-tenant / dedicated) have the platform's runner performing every 'auto' leg;
-// 'self-host' has no runner, so the runner-performed legs are absent from its plan —
-// a self-host form must never promise them (QA walk finding, task 1002717). Steps
-// with no `shapes` apply everywhere. Filter with stepsForShape().
+// 'byo-host' has no runner, so the runner-performed legs are absent from its plan —
+// a bring-your-own-host form must never promise them (QA walk finding, task 1002717).
+// Steps with no `shapes` apply everywhere. Filter with stepsForShape().
+//
+// 'byo-host' REPLACED the plan-only spelling 'self-host' here (ADR 0323, task 1004141).
+// That value was this file's own invention and had no callers anywhere else, so it was
+// a second vocabulary for a concept the hosting shapes now name directly — and two words
+// for one thing is how a filter starts silently matching nothing. The shape is absent
+// from CONTROL_PLANE_SHAPES, which is what drops the runner-performed legs from its plan
+// BY CONSTRUCTION rather than by a list someone has to remember to update.
 const CONTROL_PLANE_SHAPES = ['standalone', 'co-tenant', 'dedicated'];
-const ALL_SHAPES = [...CONTROL_PLANE_SHAPES, 'self-host'];
+const ALL_SHAPES = [...CONTROL_PLANE_SHAPES, 'byo-host'];
 
 function onboardPlan(mode = 'greenfield', opts = {}) {
   const adopt = mode === 'adopt';

package/modules/provisioning/paid-shape-gate.js

@@ -13,8 +13,15 @@
 // the shapes it accepts is actually that front door. The others each hand the caller
 // something the platform pays for or trusts:
 //
-//   co-tenant     — the front door. Co-tenants on infrastructure the platform already
-//                   runs; `costEstimateUsd` is 0. No authority required, ever.
+//   byo-host      — the front door since ADR 0323. The OWNER supplies the host, so the
+//                   platform pays nothing and runs none of the caller's code. No
+//                   authority required, ever. This is the shape that replaced 'co-tenant'
+//                   as the free option, and it is a STRONGER front door than co-tenant
+//                   was: co-tenant was free of charge but still ran on our box, whereas
+//                   this one never touches it.
+//   co-tenant     — RETIRED (ADR 0323). Was the free front door; ran on the platform's
+//                   own box, which is why the name could not be carried over to
+//                   bring-your-own-host. Now UNREQUESTABLE — see below.
 //   dedicated     — allocates a real droplet (`scripts/gds/provision.js`), billed
 //                   monthly, defaulting to s-2vcpu-4gb when no tier is named.
 //   standalone    — runs the caller's OWN repo on the platform's box. The unit's
@@ -61,11 +68,11 @@
 const provisioning = require('./provisioning.js');
 
 // The shapes any authenticated builder may request with no permission at all. This is
-// the whole allow-list, and it is deliberately one entry long: co-tenant is the front
+// the whole allow-list, and it is deliberately one entry long: byo-host is the front
 // door, and the front door is the only thing that should be free. `tests/
 // provisioning_paid_shape_gate.mjs` pins HOSTING_SHAPES against this set so a new shape
 // cannot be added without someone deciding, in writing, which side of the line it is on.
-const OPEN_SHAPES = Object.freeze(new Set(['co-tenant']));
+const OPEN_SHAPES = Object.freeze(new Set(['byo-host']));
 
 // Shapes that are not requestable through this route AT ALL — no permission admits them,
 // because there is no rank at which "ask the API for a second control plane" is a
@@ -75,7 +82,13 @@ const OPEN_SHAPES = Object.freeze(new Set(['co-tenant']));
 // `WHERE hosting_shape = 'control-plane' LIMIT 1`, so a second row makes "which machine
 // is the control plane" a question with a caller-influenced answer. Refused by name, at
 // the door, for the same reason control-plane-guard.js refuses by name.
-const UNREQUESTABLE_SHAPES = Object.freeze(new Set(['control-plane']));
+// 'co-tenant' joins it for a different reason (ADR 0323): it is RETIRED, not secret.
+// It remains a valid stored value because a torn-down row still carries it, so it cannot
+// simply leave HOSTING_SHAPES without making that row's history unreadable — and a shape
+// that is storable but must never be granted again is exactly what 'unrequestable' means.
+// Refusing it here rather than deleting the value is what makes the retirement complete
+// without rewriting the past.
+const UNREQUESTABLE_SHAPES = Object.freeze(new Set(['control-plane', 'co-tenant']));
 
 // shapeAuthority — what does this wire value demand? PURE. Returns one of:
 //   'open'          → admit with no permission
@@ -88,7 +101,7 @@ const UNREQUESTABLE_SHAPES = Object.freeze(new Set(['control-plane']));
 //
 // 'defer' is safe despite looking like a hole: the validator runs immediately after this
 // middleware and refuses anything outside HOSTING_SHAPES, and `createInstance` coerces an
-// unrecognised shape to 'co-tenant' rather than storing it. There is no path by which a
+// unrecognised shape to 'byo-host' rather than storing it. There is no path by which a
 // deferred value becomes a privileged row.
 //
 // Matches the exact wire value — a case or whitespace variant of a privileged shape is
@@ -96,7 +109,7 @@ const UNREQUESTABLE_SHAPES = Object.freeze(new Set(['control-plane']));
 // admitted as a cheap one.
 function shapeAuthority(rawShape) {
   const shape = rawShape === undefined || rawShape === null || rawShape === ''
-    ? 'co-tenant' // an absent shape is the documented default, and it is the open one
+    ? 'byo-host' // an absent shape is the documented default, and it is the open one
     : rawShape;
   if (typeof shape !== 'string') return 'defer';
   if (!provisioning.HOSTING_SHAPES.includes(shape)) return 'defer';
@@ -115,9 +128,25 @@ function requireAuthorityForShape(requirePermission) {
     const verdict = shapeAuthority(req.body && req.body.hosting_shape);
     if (verdict === 'open' || verdict === 'defer') return next();
     if (verdict === 'unrequestable') {
+      // Two shapes land here for different reasons, so the message names which.
+      //
+      // It names STORED VALUES and never an owner-facing label, deliberately. The
+      // stored value → owner-facing name translation lives in exactly one place —
+      // SHAPE_LABEL in modules/public-landing/public/projects.html (ADR 0323, and this
+      // module's CLAUDE.md says so) — and an API error string is the worst possible
+      // second copy of it: the next person to rename the product renames the label map
+      // and a wizard heading, and this sentence keeps selling a name that no longer
+      // exists. The right register for a 403 is the wire vocabulary the caller sent,
+      // which is also what `details.requestable` already hands them; a UI that wants to
+      // say it in product words has SHAPE_LABEL for exactly that. The guard against it
+      // creeping back is an assertion, not this comment — see
+      // ../../tests/provisioning_paid_shape_gate.mjs.
+      const retired = req.body.hosting_shape === 'co-tenant';
       return res.fail('shape_not_requestable', {
         status: 403,
-        message: 'The control plane enrolls its own row; it cannot be requested through this route.',
+        message: retired
+          ? "That hosting shape has been retired and can no longer be requested. Ask for one of the shapes in `requestable` instead: `byo-host` runs on a host you supply, and the rest are stood up for you."
+          : 'The control plane enrolls its own row; it cannot be requested through this route.',
         details: { hosting_shape: req.body.hosting_shape, requestable: [...provisioning.HOSTING_SHAPES].filter((s) => !UNREQUESTABLE_SHAPES.has(s)) },
       });
     }

package/modules/provisioning/provisioning.js

@@ -24,11 +24,8 @@ const { normalizeModuleSelection, effectiveModules } = require('./starter-bundle
 // Constants (mirror the CHECK constraints in provisioning_001_tables.sql)
 // ---------------------------------------------------------------------------
 const INSTANCE_STATES = ['requested', 'provisioning', 'active', 'tearing_down', 'torn_down', 'error'];
-// co-tenant  — a process + DB on THIS control-plane checkout (shared box, $0)
-// dedicated  — its own DigitalOcean droplet (priced by tier)
-// standalone — its OWN repo checkout + pinned @cloudbongos/core npm dep, co-located on
-//              the box (ADR 0108 destination model; owner-hosted, $0). See provision.js.
-const HOSTING_SHAPES = ['co-tenant', 'dedicated', 'standalone', 'control-plane'];
+// Shapes, owner-facing names + why the spellings differ: ADR 0323 + this module's CLAUDE.md.
+const HOSTING_SHAPES = ['byo-host', 'co-tenant', 'dedicated', 'standalone', 'control-plane'];
 // How the instance's repo was onboarded (migration provisioning_004, ADR 0121):
 //   greenfield — a fresh EMPTY repo; the runner scaffolds it and pushes the first commit
 //   adopt      — a repo the owner ALREADY has; the runner must LAYER onto it, preserving
@@ -1061,7 +1058,10 @@ async function listAllInstances(db, { status } = {}) {
 // decide (same owner → idempotent re-request; different owner → 409). Never
 // silently reassigns ownership.
 async function createInstance(db, { ownerBuilderId, slug, targetRef, hostingShape, domain, dbName, port, tier, onboardMode, type, description, detail, modules }) {
-  const shape = HOSTING_SHAPES.includes(hostingShape) ? hostingShape : 'co-tenant';
+  // Unknown/absent coerces to the shape that costs nothing and trusts nothing. Was
+  // 'co-tenant' (then the free front door); that shape is now retired + unrequestable,
+  // so coercing to it would mint a row no caller is allowed to ask for.
+  const shape = HOSTING_SHAPES.includes(hostingShape) ? hostingShape : 'byo-host';
   // Unknown/absent → 'greenfield', matching the column default. Falling back to the
   // SAFE mode matters: greenfield refuses to push over existing history (no --force
   // anywhere), whereas defaulting an unknown value to 'adopt' would put the layering

package/modules/provisioning/routes/provisioning.js

@@ -12,10 +12,12 @@
 //
 //   own-scoped (requireBuilder — the caller's OWN instances):
 //     POST   /provisioning/instances               — request a new instance
-//                                                     (only `co-tenant` is free; every other
-//                                                      shape ALSO needs provisioning.fleet.manage,
-//                                                      and `control-plane` is not requestable at
-//                                                      all; ../paid-shape-gate.js.
+//                                                     (only `byo-host` is free — ADR 0323 made it
+//                                                      the front door; every other shape ALSO
+//                                                      needs provisioning.fleet.manage, and
+//                                                      `control-plane` and the RETIRED `co-tenant`
+//                                                      are not requestable at all;
+//                                                      ../paid-shape-gate.js.
 //                                                      An `adopt` ALSO passes the credential
 //                                                      preflight — ../credential-preflight.js,
 //                                                      task 1002909; greenfield is exempt; a full box → 409, ../capacity-gate.js)
@@ -331,7 +333,15 @@ module.exports = function provisioningRoutes() {
     if (!provisioning.isValidSlug(slug)) {
       return res.fail('bad_slug', 400, { reason: 'lowercase, 2–40 chars of [a-z0-9-], no leading/trailing/double dash' });
     }
-    const shape = body.hosting_shape || 'co-tenant';
+    // FOURTH and last place that resolves an absent shape, and they must all agree:
+    // this route, paid-shape-gate.js's authority lookup, capacity-gate.js's placement
+    // lookup, and createInstance's coercion. Until ADR 0323 they agreed on 'co-tenant'.
+    // When that shape was retired this line was the hole: the gate admits an absent
+    // shape as 'byo-host' (open), and then a stale default here would hand createInstance
+    // a literal 'co-tenant' — which IS in HOSTING_SHAPES, so the coercion never fires and
+    // the validator never complains, and a shapeless create quietly stores the one shape
+    // no caller is allowed to request. Nothing would have errored.
+    const shape = body.hosting_shape || 'byo-host';
     if (!provisioning.HOSTING_SHAPES.includes(shape)) {
       return res.fail('bad_hosting_shape', 400, { valid: provisioning.HOSTING_SHAPES });
     }

package/modules/public-landing/public/projects.html

@@ -3934,7 +3934,9 @@ summary{min-height:24px;padding:3px 0;}
         ['Address', resolvedDomain()
           ? '<code>' + esc(resolvedDomain()) + '</code>'
           : '<em style="font-weight:600;color:var(--warn)">none — sign-in stays locked until it has one</em>'],
-        ['Shape', 'Its own server, running the platform’s current release']
+        /* The wizard creates hosting_shape 'standalone', whose owner-facing name is
+           "cloud host" (ADR 0323) — we stand it up and run it for them. */
+        ['Shape', 'Cloud host — we stand it up and run it for you, on the platform’s current release']
       ];
       $('reviewList').innerHTML = rows.map(function (r) {
         return '<li><span class="k">' + r[0] + '</span><span class="v">' + r[1] + '</span></li>';
@@ -5205,7 +5207,20 @@ summary{min-height:24px;padding:3px 0;}
 
   /* ── rendering ───────────────────────────────────────────────────────── */
 
-  var SHAPE_LABEL = { standalone: 'its own server', 'co-tenant': 'shared server', dedicated: 'its own server' };
+  /* The owner-facing name of each hosting shape (ADR 0323). This map IS the translation
+     between the stored value and the word the owner reads: 'standalone' and 'dedicated'
+     keep their old spellings in the database on purpose (task 1004142 renames the data),
+     so this is the ONLY place that difference should ever be visible. Read as a noun
+     phrase — it lands in a meta list and in the "server" ledger row.
+     'co-tenant' is retired and unrequestable, but one torn-down row still carries it,
+     so it keeps a label rather than falling through to the raw value. */
+  var SHAPE_LABEL = {
+    'byo-host': 'your own host',
+    standalone: 'cloud host',
+    dedicated: 'dedicated cloud host',
+    'co-tenant': 'shared server (retired)',
+    'control-plane': 'the control plane'
+  };
   /* what a teardown ACTUALLY does, per hosting shape (F17 — the DECIDED policy:
      retention is deliberate on shared boxes; a dedicated machine takes its
      database with it). Copy follows the runner, never the other way around. */

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.949",
+  "version": "1.19.951",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.949",
+      "version": "1.19.951",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.949",
+  "version": "1.19.951",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/init.js

@@ -87,7 +87,13 @@ const KNOWN_MODULES = ['game', 'art-pipeline', 'discord', 'dev-box'];
 // request (POST /provisioning/instances validates slug/shape, and returns 404 when
 // the module isn't enabled on the target instance — init then falls back to filing
 // the manual production-topology task). ADR 0111 §3.
-const HOSTING_SHAPES = ['co-tenant', 'dedicated', 'standalone'];
+// ADR 0323: 'byo-host' is the free front door and the default; 'co-tenant' is RETIRED
+// and the server refuses it outright, so it is absent here DELIBERATELY. Leaving it in
+// would let init write a spec the create route then 403s — a local list that accepts
+// more than the server does is worse than no list, because the refusal arrives a step
+// later with no useful message. Dropping it means `--shape co-tenant` fails here, naming
+// the shapes that work.
+const HOSTING_SHAPES = ['byo-host', 'dedicated', 'standalone'];
 
 // The Cloud Bongos core npm package an instance pins as a dependency (ADR 0108).
 // `bongos init --adopt` LAYERS this onto an existing repo's package.json; `bongos
@@ -205,11 +211,11 @@ function provisioningSlug(spec) {
 // block). THE ADR 0111 §3 ARM: infra answers become a real provisioning REQUEST (a
 // provisioning_intents row the control-plane runner drains) instead of only a manual
 // runbook task. Pure — no I/O; the caller POSTs it. Shape defaults to the cheapest
-// co-tenant ($0) per the budget DNA (ADR 0111 §6).
+// byo-host ($0 to us — the owner supplies the host) per the budget DNA (ADR 0323).
 function provisioningRequest(spec) {
   const p = spec && spec.provisioning;
   if (!isObj(p)) return null;
-  const shape = HOSTING_SHAPES.includes(p.shape) ? p.shape : 'co-tenant';
+  const shape = HOSTING_SHAPES.includes(p.shape) ? p.shape : 'byo-host';
   const body = { slug: provisioningSlug(spec), hosting_shape: shape };
   if (p.domain) body.domain = String(p.domain).trim();
   if (p.targetRef) body.target_ref = String(p.targetRef).trim();
@@ -334,12 +340,12 @@ function normalizeSpec(raw = {}) {
   spec.modules = Array.isArray(spec.modules) ? spec.modules.filter((m) => KNOWN_MODULES.includes(m)) : [];
   if (!spec.version.status) spec.version.status = 'building';
   // Provisioning (ADR 0111 §3) — a block ⇒ the owner opted in. Coerce the shape to a
-  // known value (default the cheapest co-tenant) and trim the free-text refs; drop the
+  // known value (default byo-host, the free front door) and trim the free-text refs; drop the
   // block entirely when absent so provisioningRequest() reads it as "not requested".
   if (isObj(spec.provisioning)) {
     const p = spec.provisioning;
     spec.provisioning = {
-      shape: HOSTING_SHAPES.includes(p.shape) ? p.shape : 'co-tenant',
+      shape: HOSTING_SHAPES.includes(p.shape) ? p.shape : 'byo-host',
       ...(p.slug ? { slug: String(p.slug).trim() } : {}),
       ...(p.domain ? { domain: String(p.domain).trim() } : {}),
       ...(p.targetRef ? { targetRef: String(p.targetRef).trim() } : {}),
@@ -446,13 +452,20 @@ async function interview({ adopt = false } = {}) {
     let provisioning;
     const wantProv = (await ask(rl, '  Provision production hosting now? (y/N)', 'N')).toLowerCase();
     if (wantProv === 'y' || wantProv === 'yes') {
-      const shape = (await ask(rl, '  Hosting shape? (co-tenant = share an existing box, $0 / dedicated = its own droplet / standalone = its own repo + pinned @bongos/core, ADR 0108)', 'co-tenant')).toLowerCase();
+      // Describes each shape by WHAT IT DOES and never by its owner-facing product
+      // name. The stored value → owner-facing label translation lives in exactly one
+      // place — SHAPE_LABEL in modules/public-landing/public/projects.html (ADR 0323,
+      // and this module's CLAUDE.md says so) — so glossing '"cloud host"' here would
+      // be a second copy of it, in a file no designer renaming the product would
+      // think to open. A CLI prompt naming the stored value it is about to write is
+      // the right register anyway: this asks for a column value, not for a purchase.
+      const shape = (await ask(rl, '  Hosting shape? (byo-host = you run it on your own host / standalone = its own repo + pinned @bongos/core on the platform\'s box / dedicated = the same on its own droplet, priced by tier)', 'byo-host')).toLowerCase();
       const domain = await ask(rl, '  Domain you own — bring-your-own (blank = the platform assigns <slug>.<its apex> when configured)?');
       const targetRef = await ask(rl, '  Target credential ref? (which control-plane creds the runner should use; optional)');
       let tier = '';
       if (shape === 'dedicated') tier = await ask(rl, '  Droplet tier? (e.g. s-1vcpu-2gb; optional)');
       provisioning = {
-        shape: HOSTING_SHAPES.includes(shape) ? shape : 'co-tenant',
+        shape: HOSTING_SHAPES.includes(shape) ? shape : 'byo-host',
         domain: domain || undefined,
         targetRef: targetRef || undefined,
         tier: tier || undefined,