@bongos/core 1.19.950 → 1.19.952

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.950",
-  "core_contract": "1.19.950",
-  "source_commit": "b332b91c550367626b416cf9edd7e689d7e5f061",
+  "core_version": "1.19.952",
+  "core_contract": "1.19.952",
+  "source_commit": "76560f7026937d8fcb87e98f1cbb582781a7852a",
   "source_ref": "HEAD",
-  "built_at": "2026-09-22T03:31:42.605Z",
+  "built_at": "2026-09-22T04:20:21.435Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 513,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2347,
+    "functional_verbatim": 2350,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2886,
-  "tree_sha256": "0faab48c30a2ae5ab6fce64aec38fc54571056bfe7f3fa566f4336818100fd1c",
+  "file_count": 2889,
+  "tree_sha256": "b5e1b32c4cf3b07a161044a90c080241342270c91f71fcc551b02670ad0dd720",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2687,7 +2687,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "1b1d7162b5d86bf679ed7a8bbf6d0a354eb382f88ef896651211856ab7fda2dc"
+      "sha256": "961a09f17879832bc7fa1e4607a41bddcc1a2d08e0c9ce55c1e5de6ba5af822e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6517,12 +6517,12 @@
     {
       "path": "modules/provisioning/capacity-gate.js",
       "mode": "0000644",
-      "sha256": "28dfe87a6aa6a6a7ef15dfda3a845c5d6cb442ff7489c851308eb474c1043836"
+      "sha256": "5d0d3eb34c68620b785803a40df416872e6a606cf6e144a9d2793f88bc231cb8"
     },
     {
       "path": "modules/provisioning/capacity.js",
       "mode": "0000644",
-      "sha256": "1a2b3bd97a2e0c0068c6200a71dabb692e90723ee1ff63a56775f2b91e1cb208"
+      "sha256": "56a2be9188fa0d8785174e6e91547c10266c3b6859fcad00aebd5739de4f366f"
     },
     {
       "path": "modules/provisioning/catalog-bridge.js",
@@ -6649,6 +6649,11 @@
       "mode": "0000644",
       "sha256": "cdc3e8992d1e4273a472b826f208736235c8a3b16a700de33a7705cdae99ef9e"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_021_byo_host_shape.sql",
+      "mode": "0000644",
+      "sha256": "cde8a3a4c66c17d17c4e18866f11600a06073377de41d5ed70cd93185cd78d6d"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -6657,12 +6662,12 @@
     {
       "path": "modules/provisioning/onboard-plan.js",
       "mode": "0000644",
-      "sha256": "3c36bb1b163a35492ccd3d231e50039bded945fbccac076166c70a67767a687d"
+      "sha256": "c67f592415bb9c81e3eef658a7352c2bc47dfb4056b2cdef52f772e5021d28cf"
     },
     {
       "path": "modules/provisioning/paid-shape-gate.js",
       "mode": "0000644",
-      "sha256": "7c08e627e228bec400e9e2dc204418a6995a4668eb6c1817ae59f20f77cbe71e"
+      "sha256": "cceda07080d1175a3629ebb2105e36220a2c2728768f2c6eb691f0269479a002"
     },
     {
       "path": "modules/provisioning/pollers/catalog-backfill.js",
@@ -6682,7 +6687,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "cfd57a109b12ecc629422c16a4db85fe2daf1700dcae60df2885701e5eecd5cc"
+      "sha256": "82bb265d63bb882468bbb609faa60a783ccf7dfeec5cd4595550586c37131bda"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -6717,7 +6722,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "63919aad35ff1f47c4981e5e5c1f1c08d79eb0de9588e0c3ba2c5ed488167211"
+      "sha256": "a10d9ac50f6be584c33a6bb559ad9d0431c2ac7f4655c23fcdf47baedf540cd2"
     },
     {
       "path": "modules/provisioning/seams.js",
@@ -7242,7 +7247,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "8de1601446961430e081632ad410a22a21665749d9acbc0b6f7f9c7a6b9d92c9"
+      "sha256": "dab97906f2db723c0ec00aaf1a7930b7e0051098e6102704f65a6d0c705543ff"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -8042,12 +8047,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ef28356c6251d661ff78b1446e9ddc3e13770144c862634da5a8d91ef7ba6e51"
+      "sha256": "09603574afd51f32c16292e9b19bd8bd8c8c57927721d5187229f414aeae1144"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "fe67ef68895ddb7bc5c2a507a7f57fa4d3b683611e557cba82be40f3641013e3"
+      "sha256": "7a932995f95a2d638f25c48b9b1312f29682ac863cf8b35b4ebe58e515cd42f1"
     },
     {
       "path": "public-docs/index.html",
@@ -8122,7 +8127,7 @@
     {
       "path": "scripts/gds/adopt-preflight.js",
       "mode": "0000644",
-      "sha256": "1e2c8a70aec49eaa0d95a9cbf37145fa1c851b46e2ec27f72f773d4198356ab9"
+      "sha256": "9b16bbd8ceb60b801f042ad955b22b67c5703ce6dc8505bf333cefffbd3f37ae"
     },
     {
       "path": "scripts/gds/adr-namespace.js",
@@ -8502,7 +8507,7 @@
     {
       "path": "scripts/gds/device-flow-help.js",
       "mode": "0000644",
-      "sha256": "802b8875e2aa7e51b1b95800aae461c5d289d7684ef57e6da95bebc458aa0f5e"
+      "sha256": "843c7ec13103f121b5ff0056ba8d547dd20da837b5a04ef37c74bf4069411c38"
     },
     {
       "path": "scripts/gds/diagnose-achievements.js",
@@ -8767,7 +8772,7 @@
     {
       "path": "scripts/gds/init.js",
       "mode": "0000644",
-      "sha256": "f24475957efcba217133ef05c297e5a9f11d78ae884a6e7286084723d9daf912"
+      "sha256": "529a6af81068f10cd8eeb4738f4d2fd17aec41f40c4dd3195909828e4656fe28"
     },
     {
       "path": "scripts/gds/install-git-hooks.js",
@@ -8842,7 +8847,7 @@
     {
       "path": "scripts/gds/login.js",
       "mode": "0000644",
-      "sha256": "fcb70ddb8175d4cbbfd3217dcb9352e6280d5597c8caffe88a6399b54041e93b"
+      "sha256": "a5502a11527ac903446e13536e78900c3af82b3382757a547e2561761ef7e396"
     },
     {
       "path": "scripts/gds/main-audit.js",
@@ -8974,6 +8979,11 @@
       "mode": "0000644",
       "sha256": "b0e2c14720e8258eba4d4ef7f69cc2bcbb26c3be312deb891383dce7a1dbf71e"
     },
+    {
+      "path": "scripts/gds/provision-byo-host.js",
+      "mode": "0000644",
+      "sha256": "92ef1fa760b90ece9781abe6d3c75abf84ff39cbb8b42194cca367bab7821269"
+    },
     {
       "path": "scripts/gds/provision-capacity.js",
       "mode": "0000644",
@@ -9027,7 +9037,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "e879686d5fcadfd32eb1dfc4e1640fc229cc4f0afc78615681964484e8457c1f"
+      "sha256": "1d92b6cbbfb544328a8bacd29cb492445508617298c251872d846bb7ab5a180a"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -9352,7 +9362,7 @@
     {
       "path": "scripts/gds/setup.js",
       "mode": "0000644",
-      "sha256": "79027b353a20b02c363d691ba30eda7d3456b8a081199ddc2c2559162523d66c"
+      "sha256": "edbebc4a0f4557cc8fc9dd0eb7115379a2fd0e34247725180cfb8eccb1cb0a18"
     },
     {
       "path": "scripts/gds/ship-check.js",
@@ -10047,7 +10057,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "107e4e25c1f869c19259c01752fecc19c138790c60981256651663823345c049"
+      "sha256": "e780332ee4be93e25030115f0a32c91e121aa0f9080e8f2abb0df1c0f3064eb0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10167,7 +10177,7 @@
     {
       "path": "tests/adopt_preflight.mjs",
       "mode": "0000644",
-      "sha256": "2489a19e7c36f53c4046a4a6fab54a55dbdfe8da6daa3452316f9e0abea01742"
+      "sha256": "c31b72a08ca2007497e6c44108f0de35aaea6d3cd1fd1a54e65162a8bf555012"
     },
     {
       "path": "tests/adr_renumber_integrity.mjs",
@@ -10602,7 +10612,7 @@
     {
       "path": "tests/bongos_login.mjs",
       "mode": "0000644",
-      "sha256": "149d3b80bb3fce785ffb33bda72ebb30a66c31b374de5977f2283bc713c98441"
+      "sha256": "1e95957f3c780b4054128000e0deefc76e4df41c3076da76d2fbd187b47c95d2"
     },
     {
       "path": "tests/box_access.mjs",
@@ -11137,7 +11147,7 @@
     {
       "path": "tests/discord_approvals.mjs",
       "mode": "0000644",
-      "sha256": "748ec9bb00437eea0cb6692a8ca042f3d19c2ff7704cb2f2f79e195d459f1559"
+      "sha256": "6f5e924b108a8738f3c7d4a97057049167a7a88a6f4af997321cd8585df3038b"
     },
     {
       "path": "tests/discord_autojoin.mjs",
@@ -12277,7 +12287,7 @@
     {
       "path": "tests/init.mjs",
       "mode": "0000644",
-      "sha256": "26629f6a3882b35f6844b8f0f9af9221e53a0906bb89401e8e23b3e5aee8d1f0"
+      "sha256": "9feeee7dbc2f1ae59a0af7eadbb521b74f114ce83e3f45ffdef59c1f8fdf25ec"
     },
     {
       "path": "tests/instance_config.mjs",
@@ -12617,7 +12627,7 @@
     {
       "path": "tests/module_api.mjs",
       "mode": "0000644",
-      "sha256": "53aa3732865dfce17a3216390b057dae825a6a7a8056309f3f31654c06636bee"
+      "sha256": "868942895e19730936594efb9f0fb69e4e511397ed738c05e0b27073c01846f7"
     },
     {
       "path": "tests/module_api_lazy.mjs",
@@ -13062,7 +13072,7 @@
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "5095bb2c890d89337c819fc3fc07fe26507f0bd78607b2b49239bccf23419aa3"
+      "sha256": "19e1b68463ddccb1a1155e1adfb3d4c130711745030183fb1d27650f1bfe5444"
     },
     {
       "path": "tests/promote_deps_gate.mjs",
@@ -13104,6 +13114,11 @@
       "mode": "0000644",
       "sha256": "9f62eea1b43a478334a83df52d0e81a3b3b67f4c4eea54680d2d8db3b25ee513"
     },
+    {
+      "path": "tests/provision_byo_host.mjs",
+      "mode": "0000644",
+      "sha256": "79c33863862966ef0d7a0f4d9dc2290596a4f98da2796083b9319c24a6bfc26e"
+    },
     {
       "path": "tests/provision_caddy_wiring.mjs",
       "mode": "0000644",
@@ -13137,12 +13152,12 @@
     {
       "path": "tests/provisioning_capacity.mjs",
       "mode": "0000644",
-      "sha256": "bcb976ab17508d1af34ea0c775d25765f336f534d79de9442b2fbc6712fa2a28"
+      "sha256": "7a48fb54dce89efa207d7dd254a8a5ef70c6b1958b6ed2be198a73e76bb74327"
     },
     {
       "path": "tests/provisioning_capacity_gate.mjs",
       "mode": "0000644",
-      "sha256": "d95439f89702862e45cf1c0b238aa5a463e81b584d7dca70d91863547bee6642"
+      "sha256": "363405d0f78714e9e3c29ee6ce64a1735a96fdaa95c631930743019daf8e26ff"
     },
     {
       "path": "tests/provisioning_credential_preflight.mjs",
@@ -13182,17 +13197,17 @@
     {
       "path": "tests/provisioning_module_selection.mjs",
       "mode": "0000644",
-      "sha256": "540e9b5b158a5623525924403bcef444f87fe0364591cd9c6b9e0a55f4f6295c"
+      "sha256": "8eaa3b40b38cbc294836ac3c4905f6a0a7c4a04e9c68d443e503f479a735c839"
     },
     {
       "path": "tests/provisioning_onboard_mode.mjs",
       "mode": "0000644",
-      "sha256": "f7a01aa6ed190c1ad544d91312909b081446a7fc2b6ef339f3ba8fa4d59f0306"
+      "sha256": "96c7ea0d646151393767061f042082f006007390ff652c7c649fd9151ab2ed61"
     },
     {
       "path": "tests/provisioning_paid_shape_gate.mjs",
       "mode": "0000644",
-      "sha256": "19961880545fe8f6c9eaf79095aa0d08f7862409109d581cac828f0f20b1be69"
+      "sha256": "859a44a139cfc7a52bc534dac8dc52f1203d60d5bdaac34e64834b6838e128fe"
     },
     {
       "path": "tests/provisioning_recommendations.mjs",

package/docs/module-api-changelog.md

@@ -2374,5 +2374,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.948 with no explicit bump. run 35675336642. (task 1002620)
   1.19.950 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.949 with no explicit bump. run 35683452297. (task 1002620)
+  1.19.951 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.950 with no explicit bump. run 35685346231. (task 1002620)
+  1.19.952 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.951 with no explicit bump. run 35686469735. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/capacity-gate.js

@@ -26,7 +26,13 @@ function requireRoomOnBox(db, log) {
   return async function capacityGate(req, res, next) {
     const body = req.body || {};
     // The handler's own default and validation: a malformed request gets its 400 there.
-    const shape = body.hosting_shape || 'co-tenant';
+    // The absent-shape default MUST match createInstance's coercion and the paid-shape
+    // gate's, or this gate prices a request against a shape the row will not take. It
+    // was 'co-tenant' until ADR 0323; that shape lands on the control plane, so after the
+    // default moved to 'byo-host' — which runs on the OWNER's machine and takes no slot
+    // here — a shapeless create on a full box would have been refused box_full for
+    // capacity it never consumes. Three places default this; they agree deliberately.
+    const shape = body.hosting_shape || 'byo-host';
     const slug = String(body.slug || '').trim().toLowerCase();
     if (!provisioning.HOSTING_SHAPES.includes(shape) || !provisioning.isValidSlug(slug)) return next();
     const target = capacity.placementBox(shape, { remoteHost: process.env.PROVISION_REMOTE_HOST || null });

package/modules/provisioning/capacity.js

@@ -68,8 +68,14 @@ function parseMeminfo(text) {
 // local (task 2074); a co-tenant runs on the remote co-hosting box only when the
 // runner is in remote-exec mode (ADR 0130), else here. A dedicated droplet is its
 // own box and has no shared ceiling → null (no preflight).
+//
+// A 'byo-host' (ADR 0323) also answers null, for a stronger reason than dedicated's:
+// the owner supplies the machine, so the platform has no box to place it on and no
+// memory of its own to spend. It can never be refused for capacity, and it must never
+// consume a slot that a cloud-host would otherwise get — which is what returning null
+// here buys, since PLACED_STATES counting keys off the shapes a box declares.
 function placementBox(hostingShape, { remoteHost = null } = {}) {
-  if (hostingShape === 'dedicated') return null;
+  if (hostingShape === 'dedicated' || hostingShape === 'byo-host') return null;
   if (hostingShape === 'co-tenant' && remoteHost) {
     return { box: 'overflow', shapes: ['co-tenant'], fixedMb: FIXED_MB.overflow };
   }

package/modules/provisioning/migrations/provisioning_021_byo_host_shape.sql

@@ -0,0 +1,37 @@
+-- provisioning_021 — admit the 'byo-host' hosting shape (ADR 0323, task 1004141).
+--
+-- "Bring your own host": the OWNER runs the instance on their own machine, VPS or
+-- platform account. The platform stands up nothing and reaches into nothing, so the
+-- row is a record of an instance we do not operate — liveness is the ADR 0252 pull
+-- against an owner-supplied origin.
+--
+-- A CHECK-ENUM WIDENING, and nothing else. `DROP CONSTRAINT IF EXISTS` paired with a
+-- re-`ADD CONSTRAINT` of the SAME name in the SAME migration only ever PERMITS more
+-- values: no existing row changes and no data is lost, which is why fitness.js
+-- (isConstraintWidening) treats this exact shape as additive rather than destructive.
+-- The precedent is provisioning_002, which admitted 'standalone' the same way.
+--
+-- 'co-tenant' STAYS IN THE SET even though ADR 0323 retires it. Retirement closes the
+-- DOOR, not the record: one torn-down row still carries that value, and dropping it
+-- from the constraint would make a historical row violate its own table. The door is
+-- closed in code instead — paid-shape-gate.js lists it UNREQUESTABLE, so no new row can
+-- ever take it, while the old one stays readable. A shape that is storable but never
+-- grantable again is exactly what that set is for.
+--
+-- The two managed shapes keep their OLD stored spellings ('standalone', 'dedicated')
+-- on purpose. ADR 0323 renames them owner-facing to "cloud host" and "dedicated cloud
+-- host", but about half the code reading those values is landlord machinery that task
+-- 1004142 deletes when it moves them to a managed platform, and renaming a call site a
+-- task before deleting it is work done twice. That task carries the data rename with
+-- those files already open.
+
+ALTER TABLE provisioning_instances DROP CONSTRAINT IF EXISTS provisioning_instances_hosting_shape_check;
+ALTER TABLE provisioning_instances ADD CONSTRAINT provisioning_instances_hosting_shape_check
+  CHECK (hosting_shape IN ('byo-host', 'co-tenant', 'dedicated', 'standalone', 'control-plane'));
+
+-- The COLUMN default was 'co-tenant' (provisioning_001), which is now a retired shape.
+-- Every insert today goes through createInstance, which always passes an explicit shape,
+-- so nothing currently relies on this default — which is exactly why it is worth moving
+-- now rather than leaving a loaded gun for the first insert that ever omits the column.
+-- Changing a DEFAULT rewrites no existing row.
+ALTER TABLE provisioning_instances ALTER COLUMN hosting_shape SET DEFAULT 'byo-host';

package/modules/provisioning/onboard-plan.js

@@ -34,11 +34,18 @@
 // `shapes` (task 1002696; direction §7 — a surface renders only steps somebody real
 // will perform on THIS instance's shape). The control-plane shapes (standalone /
 // co-tenant / dedicated) have the platform's runner performing every 'auto' leg;
-// 'self-host' has no runner, so the runner-performed legs are absent from its plan —
-// a self-host form must never promise them (QA walk finding, task 1002717). Steps
-// with no `shapes` apply everywhere. Filter with stepsForShape().
+// 'byo-host' has no runner, so the runner-performed legs are absent from its plan —
+// a bring-your-own-host form must never promise them (QA walk finding, task 1002717).
+// Steps with no `shapes` apply everywhere. Filter with stepsForShape().
+//
+// 'byo-host' REPLACED the plan-only spelling 'self-host' here (ADR 0323, task 1004141).
+// That value was this file's own invention and had no callers anywhere else, so it was
+// a second vocabulary for a concept the hosting shapes now name directly — and two words
+// for one thing is how a filter starts silently matching nothing. The shape is absent
+// from CONTROL_PLANE_SHAPES, which is what drops the runner-performed legs from its plan
+// BY CONSTRUCTION rather than by a list someone has to remember to update.
 const CONTROL_PLANE_SHAPES = ['standalone', 'co-tenant', 'dedicated'];
-const ALL_SHAPES = [...CONTROL_PLANE_SHAPES, 'self-host'];
+const ALL_SHAPES = [...CONTROL_PLANE_SHAPES, 'byo-host'];
 
 function onboardPlan(mode = 'greenfield', opts = {}) {
   const adopt = mode === 'adopt';

package/modules/provisioning/paid-shape-gate.js

@@ -13,8 +13,15 @@
 // the shapes it accepts is actually that front door. The others each hand the caller
 // something the platform pays for or trusts:
 //
-//   co-tenant     — the front door. Co-tenants on infrastructure the platform already
-//                   runs; `costEstimateUsd` is 0. No authority required, ever.
+//   byo-host      — the front door since ADR 0323. The OWNER supplies the host, so the
+//                   platform pays nothing and runs none of the caller's code. No
+//                   authority required, ever. This is the shape that replaced 'co-tenant'
+//                   as the free option, and it is a STRONGER front door than co-tenant
+//                   was: co-tenant was free of charge but still ran on our box, whereas
+//                   this one never touches it.
+//   co-tenant     — RETIRED (ADR 0323). Was the free front door; ran on the platform's
+//                   own box, which is why the name could not be carried over to
+//                   bring-your-own-host. Now UNREQUESTABLE — see below.
 //   dedicated     — allocates a real droplet (`scripts/gds/provision.js`), billed
 //                   monthly, defaulting to s-2vcpu-4gb when no tier is named.
 //   standalone    — runs the caller's OWN repo on the platform's box. The unit's
@@ -61,11 +68,11 @@
 const provisioning = require('./provisioning.js');
 
 // The shapes any authenticated builder may request with no permission at all. This is
-// the whole allow-list, and it is deliberately one entry long: co-tenant is the front
+// the whole allow-list, and it is deliberately one entry long: byo-host is the front
 // door, and the front door is the only thing that should be free. `tests/
 // provisioning_paid_shape_gate.mjs` pins HOSTING_SHAPES against this set so a new shape
 // cannot be added without someone deciding, in writing, which side of the line it is on.
-const OPEN_SHAPES = Object.freeze(new Set(['co-tenant']));
+const OPEN_SHAPES = Object.freeze(new Set(['byo-host']));
 
 // Shapes that are not requestable through this route AT ALL — no permission admits them,
 // because there is no rank at which "ask the API for a second control plane" is a
@@ -75,7 +82,13 @@ const OPEN_SHAPES = Object.freeze(new Set(['co-tenant']));
 // `WHERE hosting_shape = 'control-plane' LIMIT 1`, so a second row makes "which machine
 // is the control plane" a question with a caller-influenced answer. Refused by name, at
 // the door, for the same reason control-plane-guard.js refuses by name.
-const UNREQUESTABLE_SHAPES = Object.freeze(new Set(['control-plane']));
+// 'co-tenant' joins it for a different reason (ADR 0323): it is RETIRED, not secret.
+// It remains a valid stored value because a torn-down row still carries it, so it cannot
+// simply leave HOSTING_SHAPES without making that row's history unreadable — and a shape
+// that is storable but must never be granted again is exactly what 'unrequestable' means.
+// Refusing it here rather than deleting the value is what makes the retirement complete
+// without rewriting the past.
+const UNREQUESTABLE_SHAPES = Object.freeze(new Set(['control-plane', 'co-tenant']));
 
 // shapeAuthority — what does this wire value demand? PURE. Returns one of:
 //   'open'          → admit with no permission
@@ -88,7 +101,7 @@ const UNREQUESTABLE_SHAPES = Object.freeze(new Set(['control-plane']));
 //
 // 'defer' is safe despite looking like a hole: the validator runs immediately after this
 // middleware and refuses anything outside HOSTING_SHAPES, and `createInstance` coerces an
-// unrecognised shape to 'co-tenant' rather than storing it. There is no path by which a
+// unrecognised shape to 'byo-host' rather than storing it. There is no path by which a
 // deferred value becomes a privileged row.
 //
 // Matches the exact wire value — a case or whitespace variant of a privileged shape is
@@ -96,7 +109,7 @@ const UNREQUESTABLE_SHAPES = Object.freeze(new Set(['control-plane']));
 // admitted as a cheap one.
 function shapeAuthority(rawShape) {
   const shape = rawShape === undefined || rawShape === null || rawShape === ''
-    ? 'co-tenant' // an absent shape is the documented default, and it is the open one
+    ? 'byo-host' // an absent shape is the documented default, and it is the open one
     : rawShape;
   if (typeof shape !== 'string') return 'defer';
   if (!provisioning.HOSTING_SHAPES.includes(shape)) return 'defer';
@@ -115,9 +128,25 @@ function requireAuthorityForShape(requirePermission) {
     const verdict = shapeAuthority(req.body && req.body.hosting_shape);
     if (verdict === 'open' || verdict === 'defer') return next();
     if (verdict === 'unrequestable') {
+      // Two shapes land here for different reasons, so the message names which.
+      //
+      // It names STORED VALUES and never an owner-facing label, deliberately. The
+      // stored value → owner-facing name translation lives in exactly one place —
+      // SHAPE_LABEL in modules/public-landing/public/projects.html (ADR 0323, and this
+      // module's CLAUDE.md says so) — and an API error string is the worst possible
+      // second copy of it: the next person to rename the product renames the label map
+      // and a wizard heading, and this sentence keeps selling a name that no longer
+      // exists. The right register for a 403 is the wire vocabulary the caller sent,
+      // which is also what `details.requestable` already hands them; a UI that wants to
+      // say it in product words has SHAPE_LABEL for exactly that. The guard against it
+      // creeping back is an assertion, not this comment — see
+      // ../../tests/provisioning_paid_shape_gate.mjs.
+      const retired = req.body.hosting_shape === 'co-tenant';
       return res.fail('shape_not_requestable', {
         status: 403,
-        message: 'The control plane enrolls its own row; it cannot be requested through this route.',
+        message: retired
+          ? "That hosting shape has been retired and can no longer be requested. Ask for one of the shapes in `requestable` instead: `byo-host` runs on a host you supply, and the rest are stood up for you."
+          : 'The control plane enrolls its own row; it cannot be requested through this route.',
         details: { hosting_shape: req.body.hosting_shape, requestable: [...provisioning.HOSTING_SHAPES].filter((s) => !UNREQUESTABLE_SHAPES.has(s)) },
       });
     }

package/modules/provisioning/provisioning.js

@@ -24,11 +24,8 @@ const { normalizeModuleSelection, effectiveModules } = require('./starter-bundle
 // Constants (mirror the CHECK constraints in provisioning_001_tables.sql)
 // ---------------------------------------------------------------------------
 const INSTANCE_STATES = ['requested', 'provisioning', 'active', 'tearing_down', 'torn_down', 'error'];
-// co-tenant  — a process + DB on THIS control-plane checkout (shared box, $0)
-// dedicated  — its own DigitalOcean droplet (priced by tier)
-// standalone — its OWN repo checkout + pinned @cloudbongos/core npm dep, co-located on
-//              the box (ADR 0108 destination model; owner-hosted, $0). See provision.js.
-const HOSTING_SHAPES = ['co-tenant', 'dedicated', 'standalone', 'control-plane'];
+// Shapes, owner-facing names + why the spellings differ: ADR 0323 + this module's CLAUDE.md.
+const HOSTING_SHAPES = ['byo-host', 'co-tenant', 'dedicated', 'standalone', 'control-plane'];
 // How the instance's repo was onboarded (migration provisioning_004, ADR 0121):
 //   greenfield — a fresh EMPTY repo; the runner scaffolds it and pushes the first commit
 //   adopt      — a repo the owner ALREADY has; the runner must LAYER onto it, preserving
@@ -1061,7 +1058,10 @@ async function listAllInstances(db, { status } = {}) {
 // decide (same owner → idempotent re-request; different owner → 409). Never
 // silently reassigns ownership.
 async function createInstance(db, { ownerBuilderId, slug, targetRef, hostingShape, domain, dbName, port, tier, onboardMode, type, description, detail, modules }) {
-  const shape = HOSTING_SHAPES.includes(hostingShape) ? hostingShape : 'co-tenant';
+  // Unknown/absent coerces to the shape that costs nothing and trusts nothing. Was
+  // 'co-tenant' (then the free front door); that shape is now retired + unrequestable,
+  // so coercing to it would mint a row no caller is allowed to ask for.
+  const shape = HOSTING_SHAPES.includes(hostingShape) ? hostingShape : 'byo-host';
   // Unknown/absent → 'greenfield', matching the column default. Falling back to the
   // SAFE mode matters: greenfield refuses to push over existing history (no --force
   // anywhere), whereas defaulting an unknown value to 'adopt' would put the layering

package/modules/provisioning/routes/provisioning.js

@@ -12,10 +12,12 @@
 //
 //   own-scoped (requireBuilder — the caller's OWN instances):
 //     POST   /provisioning/instances               — request a new instance
-//                                                     (only `co-tenant` is free; every other
-//                                                      shape ALSO needs provisioning.fleet.manage,
-//                                                      and `control-plane` is not requestable at
-//                                                      all; ../paid-shape-gate.js.
+//                                                     (only `byo-host` is free — ADR 0323 made it
+//                                                      the front door; every other shape ALSO
+//                                                      needs provisioning.fleet.manage, and
+//                                                      `control-plane` and the RETIRED `co-tenant`
+//                                                      are not requestable at all;
+//                                                      ../paid-shape-gate.js.
 //                                                      An `adopt` ALSO passes the credential
 //                                                      preflight — ../credential-preflight.js,
 //                                                      task 1002909; greenfield is exempt; a full box → 409, ../capacity-gate.js)
@@ -331,7 +333,15 @@ module.exports = function provisioningRoutes() {
     if (!provisioning.isValidSlug(slug)) {
       return res.fail('bad_slug', 400, { reason: 'lowercase, 2–40 chars of [a-z0-9-], no leading/trailing/double dash' });
     }
-    const shape = body.hosting_shape || 'co-tenant';
+    // FOURTH and last place that resolves an absent shape, and they must all agree:
+    // this route, paid-shape-gate.js's authority lookup, capacity-gate.js's placement
+    // lookup, and createInstance's coercion. Until ADR 0323 they agreed on 'co-tenant'.
+    // When that shape was retired this line was the hole: the gate admits an absent
+    // shape as 'byo-host' (open), and then a stale default here would hand createInstance
+    // a literal 'co-tenant' — which IS in HOSTING_SHAPES, so the coercion never fires and
+    // the validator never complains, and a shapeless create quietly stores the one shape
+    // no caller is allowed to request. Nothing would have errored.
+    const shape = body.hosting_shape || 'byo-host';
     if (!provisioning.HOSTING_SHAPES.includes(shape)) {
       return res.fail('bad_hosting_shape', 400, { valid: provisioning.HOSTING_SHAPES });
     }

package/modules/public-landing/public/projects.html

@@ -3934,7 +3934,9 @@ summary{min-height:24px;padding:3px 0;}
         ['Address', resolvedDomain()
           ? '<code>' + esc(resolvedDomain()) + '</code>'
           : '<em style="font-weight:600;color:var(--warn)">none — sign-in stays locked until it has one</em>'],
-        ['Shape', 'Its own server, running the platform’s current release']
+        /* The wizard creates hosting_shape 'standalone', whose owner-facing name is
+           "cloud host" (ADR 0323) — we stand it up and run it for them. */
+        ['Shape', 'Cloud host — we stand it up and run it for you, on the platform’s current release']
       ];
       $('reviewList').innerHTML = rows.map(function (r) {
         return '<li><span class="k">' + r[0] + '</span><span class="v">' + r[1] + '</span></li>';
@@ -5205,7 +5207,20 @@ summary{min-height:24px;padding:3px 0;}
 
   /* ── rendering ───────────────────────────────────────────────────────── */
 
-  var SHAPE_LABEL = { standalone: 'its own server', 'co-tenant': 'shared server', dedicated: 'its own server' };
+  /* The owner-facing name of each hosting shape (ADR 0323). This map IS the translation
+     between the stored value and the word the owner reads: 'standalone' and 'dedicated'
+     keep their old spellings in the database on purpose (task 1004142 renames the data),
+     so this is the ONLY place that difference should ever be visible. Read as a noun
+     phrase — it lands in a meta list and in the "server" ledger row.
+     'co-tenant' is retired and unrequestable, but one torn-down row still carries it,
+     so it keeps a label rather than falling through to the raw value. */
+  var SHAPE_LABEL = {
+    'byo-host': 'your own host',
+    standalone: 'cloud host',
+    dedicated: 'dedicated cloud host',
+    'co-tenant': 'shared server (retired)',
+    'control-plane': 'the control plane'
+  };
   /* what a teardown ACTUALLY does, per hosting shape (F17 — the DECIDED policy:
      retention is deliberate on shared boxes; a dedicated machine takes its
      database with it). Copy follows the runner, never the other way around. */

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.950",
+  "version": "1.19.952",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.950",
+      "version": "1.19.952",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.950",
+  "version": "1.19.952",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/adopt-preflight.js

@@ -12,7 +12,7 @@
 //   • CI collisions — the repo's workflows vs core's expected unit/secret-scan/
 //     gate-review checks.
 //   • IGNORED incoming files — a pre-existing .gitignore rule that would swallow what
-//     adopt is about to commit (task 1003400). This is the check that was missing when
+//     adopt is about to commit (task 1003881). This is the check that was missing when
 //     Cloud Bongos was adopted onto a repo whose .gitignore already carried `.claude/`:
 //     the skills, hooks and settings.json were materialized onto disk and then dropped
 //     by `git add`, so the adopt commit landed 8 files with no methodology surface at

package/scripts/gds/device-flow-help.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 // scripts/gds/device-flow-help.js — the one explanation of a Device-Flow refusal, shared
-// by `bongos setup` and `bongos login` (task 1003400).
+// by `bongos setup` and `bongos login` (task 1003881).
 //
 // WHY IT EXISTS AT ALL. GitHub creates an App from a manifest with Device Flow OFF and
 // exposes no API to switch it on — only a checkbox in the App's settings. So on every