@bongos/core 1.19.950 → 1.19.951

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.950",
-  "core_contract": "1.19.950",
-  "source_commit": "b332b91c550367626b416cf9edd7e689d7e5f061",
+  "core_version": "1.19.951",
+  "core_contract": "1.19.951",
+  "source_commit": "52686c08170a959adbd2fff6681162b3b3e248ae",
   "source_ref": "HEAD",
-  "built_at": "2026-09-22T03:31:42.605Z",
+  "built_at": "2026-09-22T04:02:59.605Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 513,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2347,
+    "functional_verbatim": 2350,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2886,
-  "tree_sha256": "0faab48c30a2ae5ab6fce64aec38fc54571056bfe7f3fa566f4336818100fd1c",
+  "file_count": 2889,
+  "tree_sha256": "4c573e93b9c8147a0c7657ef1f9c43b7e3a0e37d6254e65502e205f91a77fdb0",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2687,7 +2687,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "1b1d7162b5d86bf679ed7a8bbf6d0a354eb382f88ef896651211856ab7fda2dc"
+      "sha256": "707238093af0e4b56e36139173b6d46d7ffd33a86c348181a40dc74083821738"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6517,12 +6517,12 @@
     {
       "path": "modules/provisioning/capacity-gate.js",
       "mode": "0000644",
-      "sha256": "28dfe87a6aa6a6a7ef15dfda3a845c5d6cb442ff7489c851308eb474c1043836"
+      "sha256": "5d0d3eb34c68620b785803a40df416872e6a606cf6e144a9d2793f88bc231cb8"
     },
     {
       "path": "modules/provisioning/capacity.js",
       "mode": "0000644",
-      "sha256": "1a2b3bd97a2e0c0068c6200a71dabb692e90723ee1ff63a56775f2b91e1cb208"
+      "sha256": "56a2be9188fa0d8785174e6e91547c10266c3b6859fcad00aebd5739de4f366f"
     },
     {
       "path": "modules/provisioning/catalog-bridge.js",
@@ -6649,6 +6649,11 @@
       "mode": "0000644",
       "sha256": "cdc3e8992d1e4273a472b826f208736235c8a3b16a700de33a7705cdae99ef9e"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_021_byo_host_shape.sql",
+      "mode": "0000644",
+      "sha256": "cde8a3a4c66c17d17c4e18866f11600a06073377de41d5ed70cd93185cd78d6d"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -6657,12 +6662,12 @@
     {
       "path": "modules/provisioning/onboard-plan.js",
       "mode": "0000644",
-      "sha256": "3c36bb1b163a35492ccd3d231e50039bded945fbccac076166c70a67767a687d"
+      "sha256": "c67f592415bb9c81e3eef658a7352c2bc47dfb4056b2cdef52f772e5021d28cf"
     },
     {
       "path": "modules/provisioning/paid-shape-gate.js",
       "mode": "0000644",
-      "sha256": "7c08e627e228bec400e9e2dc204418a6995a4668eb6c1817ae59f20f77cbe71e"
+      "sha256": "cceda07080d1175a3629ebb2105e36220a2c2728768f2c6eb691f0269479a002"
     },
     {
       "path": "modules/provisioning/pollers/catalog-backfill.js",
@@ -6682,7 +6687,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "cfd57a109b12ecc629422c16a4db85fe2daf1700dcae60df2885701e5eecd5cc"
+      "sha256": "82bb265d63bb882468bbb609faa60a783ccf7dfeec5cd4595550586c37131bda"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -6717,7 +6722,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "63919aad35ff1f47c4981e5e5c1f1c08d79eb0de9588e0c3ba2c5ed488167211"
+      "sha256": "a10d9ac50f6be584c33a6bb559ad9d0431c2ac7f4655c23fcdf47baedf540cd2"
     },
     {
       "path": "modules/provisioning/seams.js",
@@ -7242,7 +7247,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "8de1601446961430e081632ad410a22a21665749d9acbc0b6f7f9c7a6b9d92c9"
+      "sha256": "dab97906f2db723c0ec00aaf1a7930b7e0051098e6102704f65a6d0c705543ff"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -8042,12 +8047,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ef28356c6251d661ff78b1446e9ddc3e13770144c862634da5a8d91ef7ba6e51"
+      "sha256": "14465332b60fa42b702654bd0dd552e8b332b3c17cc969bfe08c3cd8a720320a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "fe67ef68895ddb7bc5c2a507a7f57fa4d3b683611e557cba82be40f3641013e3"
+      "sha256": "f7f40ce54ba7eddac00919f6407ee95888c15a87e3fc526450b64a00365cd913"
     },
     {
       "path": "public-docs/index.html",
@@ -8767,7 +8772,7 @@
     {
       "path": "scripts/gds/init.js",
       "mode": "0000644",
-      "sha256": "f24475957efcba217133ef05c297e5a9f11d78ae884a6e7286084723d9daf912"
+      "sha256": "d18b93dc0ac9136cfae79d98cd3506cb12d94fce30829a39dfb15f880770b93e"
     },
     {
       "path": "scripts/gds/install-git-hooks.js",
@@ -8974,6 +8979,11 @@
       "mode": "0000644",
       "sha256": "b0e2c14720e8258eba4d4ef7f69cc2bcbb26c3be312deb891383dce7a1dbf71e"
     },
+    {
+      "path": "scripts/gds/provision-byo-host.js",
+      "mode": "0000644",
+      "sha256": "92ef1fa760b90ece9781abe6d3c75abf84ff39cbb8b42194cca367bab7821269"
+    },
     {
       "path": "scripts/gds/provision-capacity.js",
       "mode": "0000644",
@@ -9027,7 +9037,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "e879686d5fcadfd32eb1dfc4e1640fc229cc4f0afc78615681964484e8457c1f"
+      "sha256": "1d92b6cbbfb544328a8bacd29cb492445508617298c251872d846bb7ab5a180a"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -10047,7 +10057,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "107e4e25c1f869c19259c01752fecc19c138790c60981256651663823345c049"
+      "sha256": "156e1f0be121fb3fa396c32374f1ab8d0540f1d6c42a8aee28d05b5429a14115"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12277,7 +12287,7 @@
     {
       "path": "tests/init.mjs",
       "mode": "0000644",
-      "sha256": "26629f6a3882b35f6844b8f0f9af9221e53a0906bb89401e8e23b3e5aee8d1f0"
+      "sha256": "9feeee7dbc2f1ae59a0af7eadbb521b74f114ce83e3f45ffdef59c1f8fdf25ec"
     },
     {
       "path": "tests/instance_config.mjs",
@@ -13062,7 +13072,7 @@
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "5095bb2c890d89337c819fc3fc07fe26507f0bd78607b2b49239bccf23419aa3"
+      "sha256": "19e1b68463ddccb1a1155e1adfb3d4c130711745030183fb1d27650f1bfe5444"
     },
     {
       "path": "tests/promote_deps_gate.mjs",
@@ -13104,6 +13114,11 @@
       "mode": "0000644",
       "sha256": "9f62eea1b43a478334a83df52d0e81a3b3b67f4c4eea54680d2d8db3b25ee513"
     },
+    {
+      "path": "tests/provision_byo_host.mjs",
+      "mode": "0000644",
+      "sha256": "79c33863862966ef0d7a0f4d9dc2290596a4f98da2796083b9319c24a6bfc26e"
+    },
     {
       "path": "tests/provision_caddy_wiring.mjs",
       "mode": "0000644",
@@ -13137,12 +13152,12 @@
     {
       "path": "tests/provisioning_capacity.mjs",
       "mode": "0000644",
-      "sha256": "bcb976ab17508d1af34ea0c775d25765f336f534d79de9442b2fbc6712fa2a28"
+      "sha256": "7a48fb54dce89efa207d7dd254a8a5ef70c6b1958b6ed2be198a73e76bb74327"
     },
     {
       "path": "tests/provisioning_capacity_gate.mjs",
       "mode": "0000644",
-      "sha256": "d95439f89702862e45cf1c0b238aa5a463e81b584d7dca70d91863547bee6642"
+      "sha256": "363405d0f78714e9e3c29ee6ce64a1735a96fdaa95c631930743019daf8e26ff"
     },
     {
       "path": "tests/provisioning_credential_preflight.mjs",
@@ -13182,17 +13197,17 @@
     {
       "path": "tests/provisioning_module_selection.mjs",
       "mode": "0000644",
-      "sha256": "540e9b5b158a5623525924403bcef444f87fe0364591cd9c6b9e0a55f4f6295c"
+      "sha256": "8eaa3b40b38cbc294836ac3c4905f6a0a7c4a04e9c68d443e503f479a735c839"
     },
     {
       "path": "tests/provisioning_onboard_mode.mjs",
       "mode": "0000644",
-      "sha256": "f7a01aa6ed190c1ad544d91312909b081446a7fc2b6ef339f3ba8fa4d59f0306"
+      "sha256": "96c7ea0d646151393767061f042082f006007390ff652c7c649fd9151ab2ed61"
     },
     {
       "path": "tests/provisioning_paid_shape_gate.mjs",
       "mode": "0000644",
-      "sha256": "19961880545fe8f6c9eaf79095aa0d08f7862409109d581cac828f0f20b1be69"
+      "sha256": "859a44a139cfc7a52bc534dac8dc52f1203d60d5bdaac34e64834b6838e128fe"
     },
     {
       "path": "tests/provisioning_recommendations.mjs",

package/docs/module-api-changelog.md

@@ -2374,5 +2374,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.948 with no explicit bump. run 35675336642. (task 1002620)
   1.19.950 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.949 with no explicit bump. run 35683452297. (task 1002620)
+  1.19.951 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.950 with no explicit bump. run 35685346231. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/capacity-gate.js

@@ -26,7 +26,13 @@ function requireRoomOnBox(db, log) {
   return async function capacityGate(req, res, next) {
     const body = req.body || {};
     // The handler's own default and validation: a malformed request gets its 400 there.
-    const shape = body.hosting_shape || 'co-tenant';
+    // The absent-shape default MUST match createInstance's coercion and the paid-shape
+    // gate's, or this gate prices a request against a shape the row will not take. It
+    // was 'co-tenant' until ADR 0323; that shape lands on the control plane, so after the
+    // default moved to 'byo-host' — which runs on the OWNER's machine and takes no slot
+    // here — a shapeless create on a full box would have been refused box_full for
+    // capacity it never consumes. Three places default this; they agree deliberately.
+    const shape = body.hosting_shape || 'byo-host';
     const slug = String(body.slug || '').trim().toLowerCase();
     if (!provisioning.HOSTING_SHAPES.includes(shape) || !provisioning.isValidSlug(slug)) return next();
     const target = capacity.placementBox(shape, { remoteHost: process.env.PROVISION_REMOTE_HOST || null });

package/modules/provisioning/capacity.js

@@ -68,8 +68,14 @@ function parseMeminfo(text) {
 // local (task 2074); a co-tenant runs on the remote co-hosting box only when the
 // runner is in remote-exec mode (ADR 0130), else here. A dedicated droplet is its
 // own box and has no shared ceiling → null (no preflight).
+//
+// A 'byo-host' (ADR 0323) also answers null, for a stronger reason than dedicated's:
+// the owner supplies the machine, so the platform has no box to place it on and no
+// memory of its own to spend. It can never be refused for capacity, and it must never
+// consume a slot that a cloud-host would otherwise get — which is what returning null
+// here buys, since PLACED_STATES counting keys off the shapes a box declares.
 function placementBox(hostingShape, { remoteHost = null } = {}) {
-  if (hostingShape === 'dedicated') return null;
+  if (hostingShape === 'dedicated' || hostingShape === 'byo-host') return null;
   if (hostingShape === 'co-tenant' && remoteHost) {
     return { box: 'overflow', shapes: ['co-tenant'], fixedMb: FIXED_MB.overflow };
   }

package/modules/provisioning/migrations/provisioning_021_byo_host_shape.sql

@@ -0,0 +1,37 @@
+-- provisioning_021 — admit the 'byo-host' hosting shape (ADR 0323, task 1004141).
+--
+-- "Bring your own host": the OWNER runs the instance on their own machine, VPS or
+-- platform account. The platform stands up nothing and reaches into nothing, so the
+-- row is a record of an instance we do not operate — liveness is the ADR 0252 pull
+-- against an owner-supplied origin.
+--
+-- A CHECK-ENUM WIDENING, and nothing else. `DROP CONSTRAINT IF EXISTS` paired with a
+-- re-`ADD CONSTRAINT` of the SAME name in the SAME migration only ever PERMITS more
+-- values: no existing row changes and no data is lost, which is why fitness.js
+-- (isConstraintWidening) treats this exact shape as additive rather than destructive.
+-- The precedent is provisioning_002, which admitted 'standalone' the same way.
+--
+-- 'co-tenant' STAYS IN THE SET even though ADR 0323 retires it. Retirement closes the
+-- DOOR, not the record: one torn-down row still carries that value, and dropping it
+-- from the constraint would make a historical row violate its own table. The door is
+-- closed in code instead — paid-shape-gate.js lists it UNREQUESTABLE, so no new row can
+-- ever take it, while the old one stays readable. A shape that is storable but never
+-- grantable again is exactly what that set is for.
+--
+-- The two managed shapes keep their OLD stored spellings ('standalone', 'dedicated')
+-- on purpose. ADR 0323 renames them owner-facing to "cloud host" and "dedicated cloud
+-- host", but about half the code reading those values is landlord machinery that task
+-- 1004142 deletes when it moves them to a managed platform, and renaming a call site a
+-- task before deleting it is work done twice. That task carries the data rename with
+-- those files already open.
+
+ALTER TABLE provisioning_instances DROP CONSTRAINT IF EXISTS provisioning_instances_hosting_shape_check;
+ALTER TABLE provisioning_instances ADD CONSTRAINT provisioning_instances_hosting_shape_check
+  CHECK (hosting_shape IN ('byo-host', 'co-tenant', 'dedicated', 'standalone', 'control-plane'));
+
+-- The COLUMN default was 'co-tenant' (provisioning_001), which is now a retired shape.
+-- Every insert today goes through createInstance, which always passes an explicit shape,
+-- so nothing currently relies on this default — which is exactly why it is worth moving
+-- now rather than leaving a loaded gun for the first insert that ever omits the column.
+-- Changing a DEFAULT rewrites no existing row.
+ALTER TABLE provisioning_instances ALTER COLUMN hosting_shape SET DEFAULT 'byo-host';

package/modules/provisioning/onboard-plan.js

@@ -34,11 +34,18 @@
 // `shapes` (task 1002696; direction §7 — a surface renders only steps somebody real
 // will perform on THIS instance's shape). The control-plane shapes (standalone /
 // co-tenant / dedicated) have the platform's runner performing every 'auto' leg;
-// 'self-host' has no runner, so the runner-performed legs are absent from its plan —
-// a self-host form must never promise them (QA walk finding, task 1002717). Steps
-// with no `shapes` apply everywhere. Filter with stepsForShape().
+// 'byo-host' has no runner, so the runner-performed legs are absent from its plan —
+// a bring-your-own-host form must never promise them (QA walk finding, task 1002717).
+// Steps with no `shapes` apply everywhere. Filter with stepsForShape().
+//
+// 'byo-host' REPLACED the plan-only spelling 'self-host' here (ADR 0323, task 1004141).
+// That value was this file's own invention and had no callers anywhere else, so it was
+// a second vocabulary for a concept the hosting shapes now name directly — and two words
+// for one thing is how a filter starts silently matching nothing. The shape is absent
+// from CONTROL_PLANE_SHAPES, which is what drops the runner-performed legs from its plan
+// BY CONSTRUCTION rather than by a list someone has to remember to update.
 const CONTROL_PLANE_SHAPES = ['standalone', 'co-tenant', 'dedicated'];
-const ALL_SHAPES = [...CONTROL_PLANE_SHAPES, 'self-host'];
+const ALL_SHAPES = [...CONTROL_PLANE_SHAPES, 'byo-host'];
 
 function onboardPlan(mode = 'greenfield', opts = {}) {
   const adopt = mode === 'adopt';

package/modules/provisioning/paid-shape-gate.js

@@ -13,8 +13,15 @@
 // the shapes it accepts is actually that front door. The others each hand the caller
 // something the platform pays for or trusts:
 //
-//   co-tenant     — the front door. Co-tenants on infrastructure the platform already
-//                   runs; `costEstimateUsd` is 0. No authority required, ever.
+//   byo-host      — the front door since ADR 0323. The OWNER supplies the host, so the
+//                   platform pays nothing and runs none of the caller's code. No
+//                   authority required, ever. This is the shape that replaced 'co-tenant'
+//                   as the free option, and it is a STRONGER front door than co-tenant
+//                   was: co-tenant was free of charge but still ran on our box, whereas
+//                   this one never touches it.
+//   co-tenant     — RETIRED (ADR 0323). Was the free front door; ran on the platform's
+//                   own box, which is why the name could not be carried over to
+//                   bring-your-own-host. Now UNREQUESTABLE — see below.
 //   dedicated     — allocates a real droplet (`scripts/gds/provision.js`), billed
 //                   monthly, defaulting to s-2vcpu-4gb when no tier is named.
 //   standalone    — runs the caller's OWN repo on the platform's box. The unit's
@@ -61,11 +68,11 @@
 const provisioning = require('./provisioning.js');
 
 // The shapes any authenticated builder may request with no permission at all. This is
-// the whole allow-list, and it is deliberately one entry long: co-tenant is the front
+// the whole allow-list, and it is deliberately one entry long: byo-host is the front
 // door, and the front door is the only thing that should be free. `tests/
 // provisioning_paid_shape_gate.mjs` pins HOSTING_SHAPES against this set so a new shape
 // cannot be added without someone deciding, in writing, which side of the line it is on.
-const OPEN_SHAPES = Object.freeze(new Set(['co-tenant']));
+const OPEN_SHAPES = Object.freeze(new Set(['byo-host']));
 
 // Shapes that are not requestable through this route AT ALL — no permission admits them,
 // because there is no rank at which "ask the API for a second control plane" is a
@@ -75,7 +82,13 @@ const OPEN_SHAPES = Object.freeze(new Set(['co-tenant']));
 // `WHERE hosting_shape = 'control-plane' LIMIT 1`, so a second row makes "which machine
 // is the control plane" a question with a caller-influenced answer. Refused by name, at
 // the door, for the same reason control-plane-guard.js refuses by name.
-const UNREQUESTABLE_SHAPES = Object.freeze(new Set(['control-plane']));
+// 'co-tenant' joins it for a different reason (ADR 0323): it is RETIRED, not secret.
+// It remains a valid stored value because a torn-down row still carries it, so it cannot
+// simply leave HOSTING_SHAPES without making that row's history unreadable — and a shape
+// that is storable but must never be granted again is exactly what 'unrequestable' means.
+// Refusing it here rather than deleting the value is what makes the retirement complete
+// without rewriting the past.
+const UNREQUESTABLE_SHAPES = Object.freeze(new Set(['control-plane', 'co-tenant']));
 
 // shapeAuthority — what does this wire value demand? PURE. Returns one of:
 //   'open'          → admit with no permission
@@ -88,7 +101,7 @@ const UNREQUESTABLE_SHAPES = Object.freeze(new Set(['control-plane']));
 //
 // 'defer' is safe despite looking like a hole: the validator runs immediately after this
 // middleware and refuses anything outside HOSTING_SHAPES, and `createInstance` coerces an
-// unrecognised shape to 'co-tenant' rather than storing it. There is no path by which a
+// unrecognised shape to 'byo-host' rather than storing it. There is no path by which a
 // deferred value becomes a privileged row.
 //
 // Matches the exact wire value — a case or whitespace variant of a privileged shape is
@@ -96,7 +109,7 @@ const UNREQUESTABLE_SHAPES = Object.freeze(new Set(['control-plane']));
 // admitted as a cheap one.
 function shapeAuthority(rawShape) {
   const shape = rawShape === undefined || rawShape === null || rawShape === ''
-    ? 'co-tenant' // an absent shape is the documented default, and it is the open one
+    ? 'byo-host' // an absent shape is the documented default, and it is the open one
     : rawShape;
   if (typeof shape !== 'string') return 'defer';
   if (!provisioning.HOSTING_SHAPES.includes(shape)) return 'defer';
@@ -115,9 +128,25 @@ function requireAuthorityForShape(requirePermission) {
     const verdict = shapeAuthority(req.body && req.body.hosting_shape);
     if (verdict === 'open' || verdict === 'defer') return next();
     if (verdict === 'unrequestable') {
+      // Two shapes land here for different reasons, so the message names which.
+      //
+      // It names STORED VALUES and never an owner-facing label, deliberately. The
+      // stored value → owner-facing name translation lives in exactly one place —
+      // SHAPE_LABEL in modules/public-landing/public/projects.html (ADR 0323, and this
+      // module's CLAUDE.md says so) — and an API error string is the worst possible
+      // second copy of it: the next person to rename the product renames the label map
+      // and a wizard heading, and this sentence keeps selling a name that no longer
+      // exists. The right register for a 403 is the wire vocabulary the caller sent,
+      // which is also what `details.requestable` already hands them; a UI that wants to
+      // say it in product words has SHAPE_LABEL for exactly that. The guard against it
+      // creeping back is an assertion, not this comment — see
+      // ../../tests/provisioning_paid_shape_gate.mjs.
+      const retired = req.body.hosting_shape === 'co-tenant';
       return res.fail('shape_not_requestable', {
         status: 403,
-        message: 'The control plane enrolls its own row; it cannot be requested through this route.',
+        message: retired
+          ? "That hosting shape has been retired and can no longer be requested. Ask for one of the shapes in `requestable` instead: `byo-host` runs on a host you supply, and the rest are stood up for you."
+          : 'The control plane enrolls its own row; it cannot be requested through this route.',
         details: { hosting_shape: req.body.hosting_shape, requestable: [...provisioning.HOSTING_SHAPES].filter((s) => !UNREQUESTABLE_SHAPES.has(s)) },
       });
     }

package/modules/provisioning/provisioning.js

@@ -24,11 +24,8 @@ const { normalizeModuleSelection, effectiveModules } = require('./starter-bundle
 // Constants (mirror the CHECK constraints in provisioning_001_tables.sql)
 // ---------------------------------------------------------------------------
 const INSTANCE_STATES = ['requested', 'provisioning', 'active', 'tearing_down', 'torn_down', 'error'];
-// co-tenant  — a process + DB on THIS control-plane checkout (shared box, $0)
-// dedicated  — its own DigitalOcean droplet (priced by tier)
-// standalone — its OWN repo checkout + pinned @cloudbongos/core npm dep, co-located on
-//              the box (ADR 0108 destination model; owner-hosted, $0). See provision.js.
-const HOSTING_SHAPES = ['co-tenant', 'dedicated', 'standalone', 'control-plane'];
+// Shapes, owner-facing names + why the spellings differ: ADR 0323 + this module's CLAUDE.md.
+const HOSTING_SHAPES = ['byo-host', 'co-tenant', 'dedicated', 'standalone', 'control-plane'];
 // How the instance's repo was onboarded (migration provisioning_004, ADR 0121):
 //   greenfield — a fresh EMPTY repo; the runner scaffolds it and pushes the first commit
 //   adopt      — a repo the owner ALREADY has; the runner must LAYER onto it, preserving
@@ -1061,7 +1058,10 @@ async function listAllInstances(db, { status } = {}) {
 // decide (same owner → idempotent re-request; different owner → 409). Never
 // silently reassigns ownership.
 async function createInstance(db, { ownerBuilderId, slug, targetRef, hostingShape, domain, dbName, port, tier, onboardMode, type, description, detail, modules }) {
-  const shape = HOSTING_SHAPES.includes(hostingShape) ? hostingShape : 'co-tenant';
+  // Unknown/absent coerces to the shape that costs nothing and trusts nothing. Was
+  // 'co-tenant' (then the free front door); that shape is now retired + unrequestable,
+  // so coercing to it would mint a row no caller is allowed to ask for.
+  const shape = HOSTING_SHAPES.includes(hostingShape) ? hostingShape : 'byo-host';
   // Unknown/absent → 'greenfield', matching the column default. Falling back to the
   // SAFE mode matters: greenfield refuses to push over existing history (no --force
   // anywhere), whereas defaulting an unknown value to 'adopt' would put the layering

package/modules/provisioning/routes/provisioning.js

@@ -12,10 +12,12 @@
 //
 //   own-scoped (requireBuilder — the caller's OWN instances):
 //     POST   /provisioning/instances               — request a new instance
-//                                                     (only `co-tenant` is free; every other
-//                                                      shape ALSO needs provisioning.fleet.manage,
-//                                                      and `control-plane` is not requestable at
-//                                                      all; ../paid-shape-gate.js.
+//                                                     (only `byo-host` is free — ADR 0323 made it
+//                                                      the front door; every other shape ALSO
+//                                                      needs provisioning.fleet.manage, and
+//                                                      `control-plane` and the RETIRED `co-tenant`
+//                                                      are not requestable at all;
+//                                                      ../paid-shape-gate.js.
 //                                                      An `adopt` ALSO passes the credential
 //                                                      preflight — ../credential-preflight.js,
 //                                                      task 1002909; greenfield is exempt; a full box → 409, ../capacity-gate.js)
@@ -331,7 +333,15 @@ module.exports = function provisioningRoutes() {
     if (!provisioning.isValidSlug(slug)) {
       return res.fail('bad_slug', 400, { reason: 'lowercase, 2–40 chars of [a-z0-9-], no leading/trailing/double dash' });
     }
-    const shape = body.hosting_shape || 'co-tenant';
+    // FOURTH and last place that resolves an absent shape, and they must all agree:
+    // this route, paid-shape-gate.js's authority lookup, capacity-gate.js's placement
+    // lookup, and createInstance's coercion. Until ADR 0323 they agreed on 'co-tenant'.
+    // When that shape was retired this line was the hole: the gate admits an absent
+    // shape as 'byo-host' (open), and then a stale default here would hand createInstance
+    // a literal 'co-tenant' — which IS in HOSTING_SHAPES, so the coercion never fires and
+    // the validator never complains, and a shapeless create quietly stores the one shape
+    // no caller is allowed to request. Nothing would have errored.
+    const shape = body.hosting_shape || 'byo-host';
     if (!provisioning.HOSTING_SHAPES.includes(shape)) {
       return res.fail('bad_hosting_shape', 400, { valid: provisioning.HOSTING_SHAPES });
     }

package/modules/public-landing/public/projects.html

@@ -3934,7 +3934,9 @@ summary{min-height:24px;padding:3px 0;}
         ['Address', resolvedDomain()
           ? '<code>' + esc(resolvedDomain()) + '</code>'
           : '<em style="font-weight:600;color:var(--warn)">none — sign-in stays locked until it has one</em>'],
-        ['Shape', 'Its own server, running the platform’s current release']
+        /* The wizard creates hosting_shape 'standalone', whose owner-facing name is
+           "cloud host" (ADR 0323) — we stand it up and run it for them. */
+        ['Shape', 'Cloud host — we stand it up and run it for you, on the platform’s current release']
       ];
       $('reviewList').innerHTML = rows.map(function (r) {
         return '<li><span class="k">' + r[0] + '</span><span class="v">' + r[1] + '</span></li>';
@@ -5205,7 +5207,20 @@ summary{min-height:24px;padding:3px 0;}
 
   /* ── rendering ───────────────────────────────────────────────────────── */
 
-  var SHAPE_LABEL = { standalone: 'its own server', 'co-tenant': 'shared server', dedicated: 'its own server' };
+  /* The owner-facing name of each hosting shape (ADR 0323). This map IS the translation
+     between the stored value and the word the owner reads: 'standalone' and 'dedicated'
+     keep their old spellings in the database on purpose (task 1004142 renames the data),
+     so this is the ONLY place that difference should ever be visible. Read as a noun
+     phrase — it lands in a meta list and in the "server" ledger row.
+     'co-tenant' is retired and unrequestable, but one torn-down row still carries it,
+     so it keeps a label rather than falling through to the raw value. */
+  var SHAPE_LABEL = {
+    'byo-host': 'your own host',
+    standalone: 'cloud host',
+    dedicated: 'dedicated cloud host',
+    'co-tenant': 'shared server (retired)',
+    'control-plane': 'the control plane'
+  };
   /* what a teardown ACTUALLY does, per hosting shape (F17 — the DECIDED policy:
      retention is deliberate on shared boxes; a dedicated machine takes its
      database with it). Copy follows the runner, never the other way around. */

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.950",
+  "version": "1.19.951",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.950",
+      "version": "1.19.951",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.950",
+  "version": "1.19.951",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/init.js

@@ -87,7 +87,13 @@ const KNOWN_MODULES = ['game', 'art-pipeline', 'discord', 'dev-box'];
 // request (POST /provisioning/instances validates slug/shape, and returns 404 when
 // the module isn't enabled on the target instance — init then falls back to filing
 // the manual production-topology task). ADR 0111 §3.
-const HOSTING_SHAPES = ['co-tenant', 'dedicated', 'standalone'];
+// ADR 0323: 'byo-host' is the free front door and the default; 'co-tenant' is RETIRED
+// and the server refuses it outright, so it is absent here DELIBERATELY. Leaving it in
+// would let init write a spec the create route then 403s — a local list that accepts
+// more than the server does is worse than no list, because the refusal arrives a step
+// later with no useful message. Dropping it means `--shape co-tenant` fails here, naming
+// the shapes that work.
+const HOSTING_SHAPES = ['byo-host', 'dedicated', 'standalone'];
 
 // The Cloud Bongos core npm package an instance pins as a dependency (ADR 0108).
 // `bongos init --adopt` LAYERS this onto an existing repo's package.json; `bongos
@@ -205,11 +211,11 @@ function provisioningSlug(spec) {
 // block). THE ADR 0111 §3 ARM: infra answers become a real provisioning REQUEST (a
 // provisioning_intents row the control-plane runner drains) instead of only a manual
 // runbook task. Pure — no I/O; the caller POSTs it. Shape defaults to the cheapest
-// co-tenant ($0) per the budget DNA (ADR 0111 §6).
+// byo-host ($0 to us — the owner supplies the host) per the budget DNA (ADR 0323).
 function provisioningRequest(spec) {
   const p = spec && spec.provisioning;
   if (!isObj(p)) return null;
-  const shape = HOSTING_SHAPES.includes(p.shape) ? p.shape : 'co-tenant';
+  const shape = HOSTING_SHAPES.includes(p.shape) ? p.shape : 'byo-host';
   const body = { slug: provisioningSlug(spec), hosting_shape: shape };
   if (p.domain) body.domain = String(p.domain).trim();
   if (p.targetRef) body.target_ref = String(p.targetRef).trim();
@@ -334,12 +340,12 @@ function normalizeSpec(raw = {}) {
   spec.modules = Array.isArray(spec.modules) ? spec.modules.filter((m) => KNOWN_MODULES.includes(m)) : [];
   if (!spec.version.status) spec.version.status = 'building';
   // Provisioning (ADR 0111 §3) — a block ⇒ the owner opted in. Coerce the shape to a
-  // known value (default the cheapest co-tenant) and trim the free-text refs; drop the
+  // known value (default byo-host, the free front door) and trim the free-text refs; drop the
   // block entirely when absent so provisioningRequest() reads it as "not requested".
   if (isObj(spec.provisioning)) {
     const p = spec.provisioning;
     spec.provisioning = {
-      shape: HOSTING_SHAPES.includes(p.shape) ? p.shape : 'co-tenant',
+      shape: HOSTING_SHAPES.includes(p.shape) ? p.shape : 'byo-host',
       ...(p.slug ? { slug: String(p.slug).trim() } : {}),
       ...(p.domain ? { domain: String(p.domain).trim() } : {}),
       ...(p.targetRef ? { targetRef: String(p.targetRef).trim() } : {}),
@@ -446,13 +452,20 @@ async function interview({ adopt = false } = {}) {
     let provisioning;
     const wantProv = (await ask(rl, '  Provision production hosting now? (y/N)', 'N')).toLowerCase();
     if (wantProv === 'y' || wantProv === 'yes') {
-      const shape = (await ask(rl, '  Hosting shape? (co-tenant = share an existing box, $0 / dedicated = its own droplet / standalone = its own repo + pinned @bongos/core, ADR 0108)', 'co-tenant')).toLowerCase();
+      // Describes each shape by WHAT IT DOES and never by its owner-facing product
+      // name. The stored value → owner-facing label translation lives in exactly one
+      // place — SHAPE_LABEL in modules/public-landing/public/projects.html (ADR 0323,
+      // and this module's CLAUDE.md says so) — so glossing '"cloud host"' here would
+      // be a second copy of it, in a file no designer renaming the product would
+      // think to open. A CLI prompt naming the stored value it is about to write is
+      // the right register anyway: this asks for a column value, not for a purchase.
+      const shape = (await ask(rl, '  Hosting shape? (byo-host = you run it on your own host / standalone = its own repo + pinned @bongos/core on the platform\'s box / dedicated = the same on its own droplet, priced by tier)', 'byo-host')).toLowerCase();
       const domain = await ask(rl, '  Domain you own — bring-your-own (blank = the platform assigns <slug>.<its apex> when configured)?');
       const targetRef = await ask(rl, '  Target credential ref? (which control-plane creds the runner should use; optional)');
       let tier = '';
       if (shape === 'dedicated') tier = await ask(rl, '  Droplet tier? (e.g. s-1vcpu-2gb; optional)');
       provisioning = {
-        shape: HOSTING_SHAPES.includes(shape) ? shape : 'co-tenant',
+        shape: HOSTING_SHAPES.includes(shape) ? shape : 'byo-host',
         domain: domain || undefined,
         targetRef: targetRef || undefined,
         tier: tier || undefined,

package/scripts/gds/provision-byo-host.js

@@ -0,0 +1,68 @@
+'use strict';
+
+// scripts/gds/provision-byo-host.js — the runner's answer for a 'byo-host' instance:
+// stand up NOTHING (ADR 0323, task 1004141).
+//
+// "Bring your own host" means the OWNER runs the instance — their machine, their VPS,
+// their own platform account. The platform's only job is to hold the record, so the
+// runner's job here is defined ENTIRELY BY WHAT IT MUST NOT DO: no port allocation, no
+// database or role, no `web.env` under /etc, no systemd unit, no Caddy snippet, no DNS
+// record, no cloud API call, no shell on anybody's box.
+//
+// WHY IT IS A GUARD AND NOT A CASE IN THE SWITCH. `provisionInstance` runs four
+// preflights before it mutates anything — box capacity, ingress, unix accounts, Caddy
+// wiring — and every one of them asks a question about a machine the platform owns. On
+// a byo-host row the honest answer to each is not "pass" or "fail" but "not ours to
+// ask", so the shape has to return ABOVE them, not be handled after them. That is why
+// the caller's line sits immediately under the already-active idempotency check.
+//
+// WHAT IT PREVENTED. Before this existed the shape fell through to the shared
+// co-tenant/standalone standup. `standalone` is false for it, so boxExec was the
+// CONTROL PLANE's own shell: the runner would have allocated a port, run createdb,
+// written env under /etc, installed a unit and a Caddy snippet and reloaded the proxy —
+// standing up, on our box, the one shape whose entire promise is that we never do.
+// Nothing would have errored. A silent success is the failure mode, which is why the
+// proof (`tests/provision_byo_host.mjs`) asserts ABSENCE — no exec, no write, no port,
+// no database — instead of asserting that the right steps ran.
+//
+// WHY THE ROW STILL GOES 'active'. `active` records that the platform has nothing left
+// to do, not that the platform is running it. Liveness for this shape is the ADR 0252
+// pull against the owner-supplied origin: the ~5-minute liveness sweep probes it by
+// domain and only ever writes the overlay columns, never `status`, so the card earns its
+// verdict from an observation rather than from our runner's say-so.
+//
+// Its own file because scripts/gds/provision.js sits at the 1500-line oversized-file
+// ratchet — the same reason provision-net.js, provision-units.js and
+// provision-core-upgrade.js were carved out.
+
+// The stored value. A literal, not a regex or a prefix match: a near-miss must reach the
+// standup's own validation rather than be quietly treated as the shape we skip.
+const BYO_HOST_SHAPE = 'byo-host';
+
+function isByoHost(hostingShape) {
+  return hostingShape === BYO_HOST_SHAPE;
+}
+
+// Record a byo-host instance as provisioned without touching any box. Reaches the
+// database ONLY through the injected `provisioning` port (the status flip + the audit
+// event) — it takes no executor and no writeFile, so there is nothing here that could
+// mutate a machine even by mistake.
+async function recordByoHost(inst, { db, provisioning, log, apply }) {
+  log('  [byo-host] the owner runs this one — no port, no database, no unit, no Caddy snippet, no DNS');
+  if (!apply) {
+    log('  [byo-host] would mark it active without touching any box');
+    return { ok: true, byoHost: true, stoodUp: false };
+  }
+  // error_note: null — a stale note from an earlier failed run must not ride into the
+  // active state (the same clearing the co-tenant/standalone tail does).
+  await provisioning.setInstanceStatus(db, inst.id, 'active', { error_note: null, provisioned_at: new Date().toISOString() });
+  await provisioning.recordEvent(db, {
+    instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: 'active',
+    detail: 'byo-host — the owner supplies the host; the platform stood up nothing',
+    actor: 'runner',
+  });
+  log(`  ✓ ${inst.slug} recorded (byo-host) — nothing was stood up`);
+  return { ok: true, byoHost: true, stoodUp: false };
+}
+
+module.exports = { BYO_HOST_SHAPE, isByoHost, recordByoHost };

package/scripts/gds/provision.js

@@ -59,6 +59,7 @@ const { installedCoreVersion, runnerBanner } = require('./runner-drift.js');
 const { teardownInstance } = require('./provision-teardown.js');
 const { disconnectInstance } = require('./provision-disconnect.js');
 const { coreUpgradeInstance, preflightCoreUpgrade, snapshotAllCoreVersions } = require('./provision-core-upgrade.js'); // the owner's deploy door, ADR 0293
+const { isByoHost, recordByoHost } = require('./provision-byo-host.js'); // stand up NOTHING for a byo-host row, ADR 0323
 
 // WHAT supervises an instance's service (ADR 0306). systemd on every box we run — the
 // seam exists so a plane without systemd is not a dead end. Injectable for tests.
@@ -250,6 +251,7 @@ async function provisionInstance(inst, deps) {
   // Idempotency: an already-active instance is a no-op success (re-drained intent).
   if (inst.status === 'active') { log('  already active — nothing to do'); return { ok: true, already: true }; }
 
+  if (isByoHost(inst.hosting_shape)) return recordByoHost(inst, deps); // stand up NOTHING, ABOVE every preflight — reasoning in provision-byo-host.js's header (ADR 0323)
   // ── preflight: DNS token scope (task 1980) ─────────────────────────────────
   // BEFORE committing to the address (allocating a port / creating a droplet / the
   // step-5 DNS UPSERT), verify the control-plane Cloudflare token can actually reach

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.950'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.951'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/init.mjs

@@ -239,14 +239,16 @@ test('provisioningSlug: derives from productName, clamps to 40, strips trailing
 test('provisioningRequest: null unless opted in; builds the POST body when opted in', () => {
   assert.equal(init.provisioningRequest(fullSpec()), null);              // no block → not requested
   const co = init.provisioningRequest(provSpec({}));                     // empty block = opted in, defaults
-  assert.deepEqual(co, { slug: 'cloud-bongos', hosting_shape: 'co-tenant' });
+  assert.deepEqual(co, { slug: 'cloud-bongos', hosting_shape: 'byo-host' });
   const full = init.provisioningRequest(provSpec({ shape: 'dedicated', domain: 'example.com', targetRef: 'do:main', tier: 's-1vcpu-2gb' }));
   assert.deepEqual(full, { slug: 'cloud-bongos', hosting_shape: 'dedicated', domain: 'example.com', target_ref: 'do:main', tier: 's-1vcpu-2gb' });
 });
 
-test('provisioningRequest: unknown shape falls back to the cheapest co-tenant', () => {
-  // normalizeSpec coerces a bad shape → co-tenant (the budget default, ADR 0111 §6).
-  assert.equal(init.provisioningRequest(provSpec({ shape: 'kubernetes' })).hosting_shape, 'co-tenant');
+test('provisioningRequest: unknown shape falls back to byo-host, the free front door', () => {
+  // normalizeSpec coerces a bad shape → byo-host (ADR 0323; was co-tenant, which that
+  // decision retired — the server now refuses it, so falling back to it would write a
+  // spec the create route rejects a step later).
+  assert.equal(init.provisioningRequest(provSpec({ shape: 'kubernetes' })).hosting_shape, 'byo-host');
 });
 
 test('kickoffTasks: provisioning requested → production-topology is AUTOMATED (dropped), manual steps stay', () => {
@@ -264,7 +266,7 @@ test('kickoffTasks: provisioning requested → production-topology is AUTOMATED
 test('normalizeSpec: coerces the provisioning block; drops it when absent', () => {
   assert.equal(init.normalizeSpec({}).provisioning, undefined);
   const n = init.normalizeSpec({ provisioning: { shape: 'DEDICATED', domain: '  Example.com  ', junk: 1 } });
-  assert.equal(n.provisioning.shape, 'co-tenant');                       // unknown shape (case) → default
+  assert.equal(n.provisioning.shape, 'byo-host');                        // unknown shape (case) → default
   assert.equal(n.provisioning.domain, 'Example.com');                    // trimmed
   assert.equal(n.provisioning.junk, undefined);                          // stray field dropped
 });
@@ -651,14 +653,14 @@ async function runSeedTests() {
 
   await at('seedViaApi: provisioning 404 (module off) → falls back to the manual production-topology task', async () => {
     const api = fakeApi([['/provisioning/instances', { ok: false, status: 404, data: { error: 'not_found' } }]]);
-    const out = await init.seedViaApi(provSpec({ shape: 'co-tenant' }), { log: () => {}, api });
+    const out = await init.seedViaApi(provSpec({ shape: 'byo-host' }), { log: () => {}, api });
     assert.equal(out.provisioned, false);
     assert.ok(findTaskPost(api, /Production topology/), 'filed the manual fallback task');
   });
 
   await at('seedViaApi: provisioning error → also files the fallback task', async () => {
     const api = fakeApi([['/provisioning/instances', { ok: false, status: 500, data: {} }]]);
-    const out = await init.seedViaApi(provSpec({ shape: 'co-tenant' }), { log: () => {}, api });
+    const out = await init.seedViaApi(provSpec({ shape: 'byo-host' }), { log: () => {}, api });
     assert.equal(out.provisioned, false);
     assert.ok(findTaskPost(api, /Production topology/), 'filed the manual fallback task on error');
   });

package/tests/projects_hub_pre_uat.mjs

@@ -237,7 +237,11 @@ test('no wall-clock promises, no operator vocabulary on the stranger’s path',
   assert.doesNotMatch(HUB, /about five minutes/, 'the empty state');
   assert.doesNotMatch(HUB, /a runner does the real work/, 'the mine fine print');
   assert.doesNotMatch(SCRIPT, /pinned platform core/, 'the review Shape row');
-  assert.match(SCRIPT, /\['Shape', 'Its own server, running the platform’s current release'\]/);
+  /* The wizard creates hosting_shape 'standalone', whose owner-facing name became
+     "cloud host" at ADR 0323 — "its own server" was ambiguous between that shape and
+     a dedicated one, and said nothing about WHO runs it. The assertion still guards the
+     same property this test is about: owner vocabulary, and no wall-clock promise. */
+  assert.match(SCRIPT, /\['Shape', 'Cloud host — we stand it up and run it for you, on the platform’s current release'\]/);
   assert.doesNotMatch(HUB, /\/new-project<\/code> assistant/, 'the done panel’s closing line');
   assert.match(HUB, /Sign-in switches on after the GitHub steps|switch sign-in on/, 'the address step does not promise sign-in "just works"');
   assert.doesNotMatch(HUB, /Sign-in, sharing, everything just works/);

package/tests/provision_byo_host.mjs

@@ -0,0 +1,122 @@
+// tests/provision_byo_host.mjs — the runner stands up NOTHING for a 'byo-host'
+// instance (ADR 0323, task 1004141).
+//
+// PROVES ABSENCE, not that the right steps ran, and that is the whole point. The
+// shape's promise is negative — the owner supplies the host, so the platform must
+// allocate no port, create no database, write no file, install no unit, touch no
+// proxy and publish no DNS record. Asserting "the byo-host path ran" would pass
+// just as happily if the co-tenant standup ran underneath it, which is exactly the
+// bug this file exists to catch: before the branch, 'byo-host' fell through to the
+// shared standup on the CONTROL PLANE's own shell and nothing errored.
+//
+// Hermetic: every executor is a spy that RECORDS instead of acting, so a single
+// stray command shows up as a failed assertion rather than as a mutated box.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const P = require('../scripts/gds/provision.js');
+
+const byoHost = {
+  id: 42, slug: 'mercury', hosting_shape: 'byo-host', status: 'requested',
+  owner_builder_id: 7, port: null, db_name: null, domain: 'mercury.example.com',
+};
+
+// Spies for every way provisionInstance can reach a machine or a record. `exec`
+// and `writeFile` THROW rather than return, so a leaked step fails loudly with the
+// command in the message instead of being silently collected and forgotten.
+function harness({ apply = true } = {}) {
+  const queries = [], statuses = [], events = [], logs = [];
+  const boom = (what) => (arg) => { throw new Error(`byo-host must not ${what}: ${String(arg).slice(0, 200)}`); };
+  const deps = {
+    apply, log: (m) => logs.push(String(m)), sleep: async () => {},
+    db: { query: async (sql, params) => { queries.push({ sql, params }); return { rows: [] }; } },
+    provisioning: {
+      setInstanceStatus: async (_db, id, status, patch = {}) => { statuses.push({ id, status, patch }); },
+      recordEvent: async (_db, e) => { events.push(e); },
+      recordLivenessProbe: async () => { throw new Error('byo-host must not record a loopback liveness probe'); },
+      recordDnsNote: async () => { throw new Error('byo-host must not write a DNS note'); },
+      clearReleasedDomains: async () => { throw new Error('byo-host must not release domains'); },
+      allocatePort: async () => { throw new Error('byo-host must not allocate a port'); },
+    },
+    exec: boom('run a command'),
+    controlExec: boom('run a control-plane command'),
+    writeFile: boom('write a file'),
+    controlWriteFile: boom('write a control-plane file'),
+    doApi: () => { throw new Error('byo-host must not call a cloud API'); },
+    checkDnsTokenScope: async () => { throw new Error('byo-host must not preflight a DNS zone'); },
+    checkCaddyWiring: () => { throw new Error('byo-host must not inspect Caddy'); },
+    ingressPlaneGap: () => { throw new Error('byo-host must not probe this plane for ingress'); },
+    accountPlaneGap: () => { throw new Error('byo-host must not probe this plane for unix accounts'); },
+    getGithubToken: async () => { throw new Error('byo-host must not need a repo credential'); },
+  };
+  return { deps, queries, statuses, events, logs };
+}
+
+test('a byo-host provision touches no box: no exec, no file, no port, no database, no DNS', async () => {
+  const h = harness();
+  const r = await P.provisionInstance(byoHost, h.deps);
+  assert.equal(r.ok, true);
+  assert.equal(r.stoodUp, false, 'the result says plainly that nothing was stood up');
+  assert.equal(r.byoHost, true);
+  // Absence: the only DB work is the status flip + the event, both through the
+  // provisioning port. No raw query — a port allocation, a createdb or a
+  // capacity count would each have to go through db.query to happen at all.
+  assert.deepEqual(h.queries, [], 'no direct SQL — capacity counting, port allocation and the DB steps all query');
+  assert.equal(r.port, undefined, 'no port is reported because none is allocated');
+});
+
+test('the row reaches active with provisioned_at set, and nothing else is patched', async () => {
+  const h = harness();
+  await P.provisionInstance(byoHost, h.deps);
+  assert.equal(h.statuses.length, 1);
+  const [{ id, status, patch }] = h.statuses;
+  assert.equal(id, 42);
+  assert.equal(status, 'active', "'active' means the platform has nothing left to do, not that it runs it");
+  assert.equal(patch.error_note, null, 'a stale note from an earlier failed run must not ride into active');
+  assert.ok(patch.provisioned_at, 'the record carries when the platform finished with it');
+  assert.equal(patch.port, undefined, 'no port is stored');
+  assert.equal(patch.db_name, undefined, 'no database is named');
+  assert.equal(h.events.length, 1);
+  assert.equal(h.events[0].event, 'active');
+  assert.match(h.events[0].detail, /byo-host/, 'the audit trail says which shape, so the absence is readable later');
+  assert.equal(h.events[0].actor, 'runner');
+});
+
+test('a dry run writes nothing at all — not even the status', async () => {
+  const h = harness({ apply: false });
+  const r = await P.provisionInstance(byoHost, h.deps);
+  assert.equal(r.ok, true);
+  assert.equal(r.stoodUp, false);
+  assert.deepEqual(h.statuses, []);
+  assert.deepEqual(h.events, []);
+  assert.ok(h.logs.some((l) => /would mark it active/.test(l)), 'a dry run still says what it would do');
+});
+
+test('the branch is keyed on the shape, not on a missing port — a domainless row behaves the same', async () => {
+  const h = harness();
+  const r = await P.provisionInstance({ ...byoHost, domain: null }, h.deps);
+  assert.equal(r.ok, true);
+  assert.equal(r.stoodUp, false);
+  assert.equal(h.statuses[0].status, 'active');
+});
+
+test('an already-active byo-host row stays a plain idempotent no-op', async () => {
+  const h = harness();
+  const r = await P.provisionInstance({ ...byoHost, status: 'active' }, h.deps);
+  assert.deepEqual(r, { ok: true, already: true });
+  assert.deepEqual(h.statuses, [], 're-draining an intent must not re-stamp provisioned_at');
+});
+
+test('the shape is absent from the runner shapes that DO get stood up', () => {
+  // The guard is above every preflight, so the proof that it cannot be reordered
+  // by accident is that the co-tenant/standalone standup is unreachable for it.
+  // Any other shape still reaches the first executor — that is the control.
+  const h = harness();
+  return assert.rejects(
+    P.provisionInstance({ ...byoHost, hosting_shape: 'standalone', domain: null }, h.deps),
+    /byo-host must not/,
+    'a non-byo-host shape still reaches the box steps — the branch is shape-scoped, not a global off switch',
+  );
+});

package/tests/provisioning_capacity.mjs

@@ -84,6 +84,11 @@ t('placementBox: standalone → control plane always; co-tenant → the remote b
   assert.deepEqual(placementBox('co-tenant', {}), { box: 'control-plane', shapes: ['standalone', 'co-tenant'], fixedMb: 750 });
   assert.deepEqual(placementBox('co-tenant', { remoteHost: 'cohost' }), { box: 'overflow', shapes: ['co-tenant'], fixedMb: 630 });
   assert.equal(placementBox('dedicated', {}), null);
+  // ADR 0323: a byo-host runs on the owner's own machine, so it has no box of ours and
+  // no shared ceiling — null for a STRONGER reason than dedicated's (dedicated is our
+  // droplet, just not a shared one). remoteHost must not change that answer.
+  assert.equal(placementBox('byo-host', {}), null);
+  assert.equal(placementBox('byo-host', { remoteHost: 'cohost' }), null);
 });
 
 t('placementVerdict: the ceiling refuses at N of N, the floor refuses under 256 MB free, an unmeasured floor cannot refuse', () => {

package/tests/provisioning_capacity_gate.mjs

@@ -122,11 +122,21 @@ await ta('a box with one slot left admits the create', async () => {
   assert.equal(lastCreateArgs && lastCreateArgs.slug, 'lantern');
 });
 
-await ta('an absent shape (the co-tenant default) on a local box is counted too', async () => {
+await ta('an absent shape takes the byo-host default, so a full box does NOT refuse it', async () => {
+  // This assertion INVERTED at task 1004141 (ADR 0323), and the inversion is the point.
+  // The default used to be 'co-tenant', which lands on the control plane, so a shapeless
+  // create was counted against the ceiling and could be refused box_full. The default is
+  // now 'byo-host', which runs on the owner's own machine and consumes nothing here — so
+  // refusing it for OUR capacity would be refusing a project that costs us no memory.
+  //
+  // The real trap this pins: THREE places resolve an absent shape — createInstance's
+  // coercion, paid-shape-gate's authority lookup, and this gate's placement lookup. If
+  // they disagree, the gate prices a request against a shape the row will not take, and
+  // nothing errors; you just get a 409 on a create that should have succeeded.
   reset({ count: 15 });
   const res = await post({ slug: 'lantern', no_address: true });
-  assert.equal(res.status, 409, res.raw);
-  assert.equal(res.body.error.code, 'box_full');
+  assert.equal(res.status, 201, res.raw);
+  assert.equal(capacityReads, 0, 'a shape with no box of ours must not even read the count');
 });
 
 // ── boxes the web tier cannot count are the runner's ──────────────────────────────
@@ -138,15 +148,25 @@ await ta('dedicated is its own box: never refused here, and the count is never r
   assert.equal(capacityReads, 0);
 });
 
-await ta('a co-tenant under remote-exec lands on a box this host cannot measure: admitted', async () => {
+await ta('byo-host runs on the OWNER\'s machine: never refused here, and the count is never read', async () => {
+  // ADR 0323's new shape, and the strongest form of "not our box": there is no machine
+  // of ours to place it on at all, so a full control plane must not refuse it and the
+  // count must not even be read. A full box turning away the one shape that costs us
+  // nothing would be the worst possible refusal.
   reset({ count: 15 });
-  process.env.PROVISION_REMOTE_HOST = 'overflow.example';
-  const res = await post({ slug: 'lantern', hosting_shape: 'co-tenant', no_address: true });
+  const res = await post({ slug: 'lantern', hosting_shape: 'byo-host', no_address: true });
   assert.equal(res.status, 201, res.raw);
   assert.equal(capacityReads, 0);
-  delete process.env.PROVISION_REMOTE_HOST;
 });
 
+// The co-tenant-under-remote-exec case this file used to assert HERE is now unreachable
+// through the route: ADR 0323 retires that shape and paid-shape-gate.js refuses it
+// before the capacity gate runs, so a route-level assertion would only ever be proving
+// the 403. The placement rule itself is still live — the runner reads it for the rows
+// that already carry the shape — and stays pinned at unit level in
+// tests/provisioning_capacity.mjs ('placementBox: … co-tenant → the remote box only
+// under remote-exec'). Moved rather than deleted, per the live-code rule.
+
 await ta('the live-memory floor is left to the runner: slots free + memory tight still admits', async () => {
   reset({ count: 3, mem: MEMINFO_TIGHT });
   const res = await post(WIZARD);

package/tests/provisioning_module_selection.mjs

@@ -235,7 +235,7 @@ await ta('POST /instances: the picker\'s ids ride the create request through to
 
   // Act — the body the wizard files
   const res = await post('/provisioning/instances', {
-    slug: 'mercury', hosting_shape: 'co-tenant', type: 'game', modules: ['agents', 'discord'],
+    slug: 'mercury', hosting_shape: 'byo-host', type: 'game', modules: ['agents', 'discord'],
   });
 
   // Assert
@@ -245,7 +245,7 @@ await ta('POST /instances: the picker\'s ids ride the create request through to
 
 await ta('POST /instances: an omitted modules key is still a valid create — skipping is supported, not an error', async () => {
   lastCreateArgs = null; existingRow = null;
-  const res = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'co-tenant', type: 'game' });
+  const res = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'byo-host', type: 'game' });
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
   assert.equal(lastCreateArgs.modules, undefined, 'nothing is invented on the owner\'s behalf');
   // …and the receipt already carries the set they will actually get.
@@ -255,7 +255,7 @@ await ta('POST /instances: an omitted modules key is still a valid create — sk
 
 await ta('POST /instances: an explicit empty selection is accepted as an answer', async () => {
   lastCreateArgs = null; existingRow = null;
-  const res = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'co-tenant', type: 'game', modules: [] });
+  const res = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'byo-host', type: 'game', modules: [] });
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
   assert.deepEqual(lastCreateArgs.modules, []);
 });
@@ -266,7 +266,7 @@ await ta('POST /instances: an unknown module is REFUSED and named, never silentl
   // prevent, and the reason badProjectDetail was written beside this.
   existingRow = null;
   const res = await post('/provisioning/instances', {
-    slug: 'mercury', hosting_shape: 'co-tenant', modules: ['discrod'],
+    slug: 'mercury', hosting_shape: 'byo-host', modules: ['discrod'],
   });
   assert.equal(res.status, 400, res.raw);
   assert.equal(res.body.error.code, 'bad_modules');
@@ -277,7 +277,7 @@ await ta('POST /instances: an unknown module is REFUSED and named, never silentl
 await ta('POST /instances: naming an always-on module is refused with the reason, not the generic miss', async () => {
   existingRow = null;
   const res = await post('/provisioning/instances', {
-    slug: 'mercury', hosting_shape: 'co-tenant', modules: ['memory'],
+    slug: 'mercury', hosting_shape: 'byo-host', modules: ['memory'],
   });
   assert.equal(res.status, 400, res.raw);
   assert.equal(res.body.error.code, 'bad_modules');
@@ -286,11 +286,11 @@ await ta('POST /instances: naming an always-on module is refused with the reason
 
 await ta('POST /instances: modules must be an array of strings', async () => {
   existingRow = null;
-  const notArray = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'co-tenant', modules: 'discord' });
+  const notArray = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'byo-host', modules: 'discord' });
   assert.equal(notArray.status, 400, notArray.raw);
   assert.equal(notArray.body.error.code, 'validation_failed');
 
-  const notStrings = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'co-tenant', modules: [7] });
+  const notStrings = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'byo-host', modules: [7] });
   assert.equal(notStrings.status, 400, notStrings.raw);
   assert.equal(notStrings.body.error.code, 'validation_failed');
 });
@@ -301,7 +301,7 @@ await ta('POST /instances: a re-request never changes an existing project\'s mod
   // to hunt for one.
   existingRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: ['agents'], detail: {} };
   const res = await post('/provisioning/instances', {
-    slug: 'mercury', hosting_shape: 'co-tenant', modules: ['discord'],
+    slug: 'mercury', hosting_shape: 'byo-host', modules: ['discord'],
   });
   assert.equal(res.status, 200, res.raw);
   assert.ok(res.body.modules_ignored, 'the dropped answer is reported, not swallowed');
@@ -589,7 +589,7 @@ await ta('POST /instances: a null answer at CREATION is accepted and stores noth
   lastCreateArgs = null; existingRow = null;
 
   const res = await post('/provisioning/instances', {
-    slug: 'mercury', hosting_shape: 'co-tenant', type: 'game', detail: { team_shape: null },
+    slug: 'mercury', hosting_shape: 'byo-host', type: 'game', detail: { team_shape: null },
   });
 
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);

package/tests/provisioning_onboard_mode.mjs

@@ -150,7 +150,7 @@ function post(path, body) {
 await ta('POST /instances: onboard_mode=adopt is threaded through to createInstance', async () => {
   lastCreateArgs = null;
   const res = await post('/provisioning/instances', {
-    slug: 'demo', hosting_shape: 'co-tenant', target_ref: 'example-owner/demo', onboard_mode: 'adopt',
+    slug: 'demo', hosting_shape: 'byo-host', target_ref: 'example-owner/demo', onboard_mode: 'adopt',
   });
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
   assert.equal(lastCreateArgs && lastCreateArgs.onboardMode, 'adopt');
@@ -158,7 +158,7 @@ await ta('POST /instances: onboard_mode=adopt is threaded through to createInsta
 
 await ta('POST /instances: onboard_mode absent → greenfield (unchanged behavior for every existing caller)', async () => {
   lastCreateArgs = null;
-  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'co-tenant' });
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'byo-host' });
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
   assert.equal(lastCreateArgs && lastCreateArgs.onboardMode, 'greenfield');
 });
@@ -167,7 +167,7 @@ await ta('POST /instances: an unknown onboard_mode is REFUSED (never silently co
   // Coercing here would be worse than refusing: the caller believes it asked for one thing
   // and the runner does another. The route names the valid set so the client can fix itself.
   const res = await post('/provisioning/instances', {
-    slug: 'demo', hosting_shape: 'co-tenant', target_ref: 'a/b', onboard_mode: 'brownfield',
+    slug: 'demo', hosting_shape: 'byo-host', target_ref: 'a/b', onboard_mode: 'brownfield',
   });
   assert.equal(res.status, 400);
   assert.equal(res.body.error.code, 'bad_onboard_mode');
@@ -204,8 +204,8 @@ await ta('POST /instances: adopt WITHOUT target_ref is refused — there is no r
   // Without target_ref the runner would fall back to greenfield behavior on a row labelled
   // adopt. Refuse at the door rather than store a lie.
   for (const body of [
-    { slug: 'demo', hosting_shape: 'co-tenant', onboard_mode: 'adopt' },
-    { slug: 'demo', hosting_shape: 'co-tenant', onboard_mode: 'adopt', target_ref: '   ' },
+    { slug: 'demo', hosting_shape: 'byo-host', onboard_mode: 'adopt' },
+    { slug: 'demo', hosting_shape: 'byo-host', onboard_mode: 'adopt', target_ref: '   ' },
   ]) {
     const res = await post('/provisioning/instances', body);
     assert.equal(res.status, 400, `expected 400 for ${JSON.stringify(body)}`);

package/tests/provisioning_paid_shape_gate.mjs

@@ -11,7 +11,8 @@
 // provisioning.fleet.manage.
 //
 // The fix gates the SHAPE, not the route: ordinary project creation must not require a rank,
-// so `co-tenant` — the front door — stays open to any authenticated builder. Everything else
+// so the front door — `byo-host` since ADR 0323, `co-tenant` before it — stays open to any
+// authenticated builder. Everything else
 // demands provisioning.fleet.manage, deliberately the same atom that already guards the fleet
 // cost-ledger and force-teardown, since spending on the fleet and managing the fleet are one
 // authority.
@@ -110,17 +111,79 @@ function post(path, body) {
 
 // ── the front door stays open — this is the half a careless fix would break ───────
 
-await ta('co-tenant (and an absent shape, which defaults to it) stays open with no permission', async () => {
+await ta('byo-host (and an absent shape, which defaults to it) stays open with no permission', async () => {
+  // ADR 0323 moved the front door from 'co-tenant' to 'byo-host'. It is a STRONGER
+  // front door: co-tenant cost nothing to invoice but still ran the caller's process on
+  // our box, whereas byo-host runs on the owner's own machine and never touches ours.
+  // The absent-shape case is the one a careless fix breaks — createInstance coerces an
+  // unknown or missing shape to byo-host, and if the gate's own default disagreed with
+  // that coercion the wizard's shapeless create would 403 instead of 201.
   for (const body of [
-    { slug: 'demo', hosting_shape: 'co-tenant', no_address: true },
+    { slug: 'demo', hosting_shape: 'byo-host', no_address: true },
     { slug: 'demo', no_address: true },
   ]) {
     held = [];
+    lastCreateArgs = null;
     const res = await post('/provisioning/instances', body);
     assert.equal(res.status, 201, `expected 201 for ${JSON.stringify(body)}, got ${res.status} ${res.raw}`);
+    // Assert the STORED shape, not just the status. A 201 alone does not prove the row is
+    // right: the create route resolves an absent shape independently of this gate, and at
+    // task 1004141 that default was briefly still 'co-tenant' — the gate admitted the
+    // request as byo-host and the route stored the retired shape, with no error anywhere.
+    // Checking the status only is what let that through.
+    assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'byo-host',
+      `${JSON.stringify(body)} must STORE byo-host, got ${lastCreateArgs && lastCreateArgs.hostingShape}`);
   }
 });
 
+await ta('co-tenant is RETIRED: refused for every caller, and not as a permission problem', async () => {
+  // ADR 0323 retires the shape whose name meant "a process on OUR box" — the opposite
+  // of bring-your-own-host, so the name could not be carried over. It stays a valid
+  // STORED value (one torn-down row carries it, and HOSTING_SHAPES still lists it) but
+  // becomes UNREQUESTABLE, which is the difference between closing a door and rewriting
+  // the record. The refusal must NOT be a 403-for-want-of-permission: no rank admits a
+  // retired shape, so granting fleet.manage must not open it either.
+  held = [];
+  lastCreateArgs = null;
+  let res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'co-tenant', no_address: true });
+  assert.equal(res.status, 403, `expected 403, got ${res.status} ${res.raw}`);
+  assert.equal(res.body.error.code, 'shape_not_requestable');
+  assert.equal(lastCreateArgs, null, 'a retired shape must not create a row');
+
+  held = ['provisioning.fleet.manage'];
+  res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'co-tenant', no_address: true });
+  assert.equal(res.status, 403, `every permission still must not admit it, got ${res.status} ${res.raw}`);
+  assert.equal(res.body.error.code, 'shape_not_requestable');
+});
+
+await ta('the refusal speaks WIRE vocabulary — no owner-facing label is translated here', async () => {
+  // The single-translation invariant, ENFORCED rather than stated. ADR 0323 puts the
+  // stored value → owner-facing name map in exactly one place (SHAPE_LABEL in
+  // modules/public-landing/public/projects.html), and an API error string is the worst
+  // place for a second copy: whoever renames the product next will change the label map
+  // and a wizard heading, and a sentence buried in a 403 will go on selling a name that
+  // no longer exists, with nothing failing. This assertion is what fails instead.
+  //
+  // It checks BOTH unrequestable shapes, because the retired one is the tempting case —
+  // it is the refusal that wants to suggest an alternative, which is exactly where a
+  // product name creeps in. Suggesting one is fine; `details.requestable` already does
+  // it in stored values, and the message points at that field.
+  held = [];
+  for (const shape of ['co-tenant', 'control-plane']) {
+    const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: shape, no_address: true });
+    assert.equal(res.status, 403, `expected 403 for ${shape}, got ${res.status} ${res.raw}`);
+    const message = res.body.error.message || '';
+    for (const label of ['bring your own host', 'cloud host', 'dedicated cloud host']) {
+      assert.ok(!message.toLowerCase().includes(label),
+        `the ${shape} refusal translates a stored value into the owner-facing label "${label}" — that map lives only in projects.html's SHAPE_LABEL (ADR 0323): ${message}`);
+    }
+  }
+  // And the caller is still told what they CAN ask for, in the vocabulary they sent.
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'co-tenant', no_address: true });
+  assert.deepEqual([...res.body.error.details.requestable].sort(), ['byo-host', 'dedicated', 'standalone'],
+    'a refusal that names no alternative is a dead end — the stored values are the alternative');
+});
+
 // ── standalone runs the caller's OWN code on the platform's box (task 1003370) ────
 
 await ta('standalone: REFUSED for a builder without provisioning.fleet.manage', async () => {
@@ -232,20 +295,27 @@ await ta('HOSTING_SHAPES is pinned, so a new shape forces a written decision abo
   // POST for a second control plane until task 1003370.
   //
   // So the question this list now forces is the one that generalises. The gate is an
-  // allow-list: `co-tenant` needs nothing, `control-plane` is refused outright, and
+  // allow-list: `byo-host` needs nothing, `control-plane` and `co-tenant` are refused
+  // outright (for different reasons — never-yours vs retired), and
   // EVERY other shape — including one added after this file was last read — demands
   // provisioning.fleet.manage by omission. A fifth shape therefore arrives already
   // gated, and this assertion is the prompt to confirm that is what was wanted
   // rather than the thing that has to catch the hole.
+  //
+  // It fired a SECOND time at task 1004141 (ADR 0323), which added 'byo-host' and
+  // retired 'co-tenant'. That retirement is why the list below still carries a shape
+  // no caller may request: the value stays storable so one torn-down row remains
+  // readable, and the door is shut in UNREQUESTABLE_SHAPES instead. Dropping it from
+  // HOSTING_SHAPES would make that historical row violate its own CHECK constraint.
   assert.deepEqual([...provisioning.HOSTING_SHAPES].sort(),
-    ['co-tenant', 'control-plane', 'dedicated', 'standalone']);
+    ['byo-host', 'co-tenant', 'control-plane', 'dedicated', 'standalone']);
 });
 
 await ta('an unknown shape is answered by the validator, not by the gate', () => {
   // The gate DEFERS anything outside HOSTING_SHAPES so a typo gets `bad_hosting_shape`
   // naming the valid set, rather than a 403 about a permission the caller would not
   // have needed. Deferring is safe: the validator refuses it microseconds later, and
-  // createInstance coerces an unrecognised shape to co-tenant rather than storing it,
+  // createInstance coerces an unrecognised shape to byo-host rather than storing it,
   // so no deferred value can become a privileged row.
   return post('/provisioning/instances', { slug: 'demo', hosting_shape: 'co-tenamt', no_address: true })
     .then((res) => {