@bongos/core 1.19.991 → 1.19.992

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.991",
-  "core_contract": "1.19.991",
-  "source_commit": "e80119e1a3eaf21835fda089e6279bdff4043c04",
+  "core_version": "1.19.992",
+  "core_contract": "1.19.992",
+  "source_commit": "b050bdcbee08970a2f54ba939e4ef7f7b2583381",
   "source_ref": "HEAD",
-  "built_at": "2026-09-23T20:27:54.477Z",
+  "built_at": "2026-09-23T20:51:51.595Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 518,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2398,
+    "functional_verbatim": 2401,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2942,
-  "tree_sha256": "2e7708f19e4b524ede30ec609d2809a2d7e6bc77953d5d3106cbd01170134253",
+  "file_count": 2945,
+  "tree_sha256": "4097079e3007248addbcbb19a43c23b3584f074f63cfb4a36951d04dd28d1886",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2712,7 +2712,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "4f19e3d159ebd6ef4268a44b5805c0ad09cedcfb482d4e36e486f892e1e8df6e"
+      "sha256": "47569dfa1c5d507174585d586c5ab619caa3bbf99bbeb24cdb26381ea25cb5e7"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6629,6 +6629,11 @@
       "mode": "0000644",
       "sha256": "a99596f5d3780a426ce9a5fcb287123dc860a04dfa08ce32a9ab81b2e06938ef"
     },
+    {
+      "path": "modules/provisioning/error-note.js",
+      "mode": "0000644",
+      "sha256": "f00a21da3c27933cd34cb66a7d99ef1104eac1180d0655e8fa59e96f9a366ace"
+    },
     {
       "path": "modules/provisioning/migrations/provisioning_001_tables.sql",
       "mode": "0000644",
@@ -6754,6 +6759,11 @@
       "mode": "0000644",
       "sha256": "949130ba321fc382c30fd7bfb76572e8415492b8641f644719cef3658a415cb9"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_026_error_note_action.sql",
+      "mode": "0000644",
+      "sha256": "6697b56875a74f7a69c4dfcdcf1e3553d8c0eed1f54e12d4763d72b805ada46f"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -6792,7 +6802,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "a6c7b6cdaca50106bd59b86e0272a2e24fe269a43e4a7f6e3a63504e73fa74d5"
+      "sha256": "17958cac0da80a65e5b835df4517e145c741dd43ff468ad79b92d75eb1dc62c9"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -6837,7 +6847,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "a10d9ac50f6be584c33a6bb559ad9d0431c2ac7f4655c23fcdf47baedf540cd2"
+      "sha256": "7738dad310a0de636739fecd9d98036c1d9e4381f7e972337fa8c01d59ccfe9c"
     },
     {
       "path": "modules/provisioning/routes/repo-private.js",
@@ -8167,12 +8177,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8693404033a617a03140037d079df84b7e71b967394f7f4069b0681667761be8"
+      "sha256": "3b59f773dda29971e3d49ea6d78364db3e51600641e9211c9860dfb0aa1b1d9e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "4b6ac3b9b46c3053276678a73c6aaef328f9a832523b8efc82386645aabc6345"
+      "sha256": "56028c71f30866f4beea2f6902771f011ce4fefe51b5448b5b48075bf2fdf8f1"
     },
     {
       "path": "public-docs/index.html",
@@ -9127,7 +9137,7 @@
     {
       "path": "scripts/gds/provision-core-upgrade.js",
       "mode": "0000644",
-      "sha256": "3e9467d52cf9b704fc3cfa9f103e86c22b4128bdc021dee104e192f5f13a5ccf"
+      "sha256": "9d6ef473dcf4b9d8bbaa8c5a796d8d21f761b3732a0279981ff9e60aadf25919"
     },
     {
       "path": "scripts/gds/provision-disconnect.js",
@@ -9152,7 +9162,7 @@
     {
       "path": "scripts/gds/provision-repo-private.js",
       "mode": "0000644",
-      "sha256": "1209c7ae79f6ba568d8ae5b0da28a4a52d27447d24b0faf7d8496196e0110138"
+      "sha256": "f342f5f37c96c3167a867697af0edaa70d07ec5e27eee29a0cde3fdf7e360c4d"
     },
     {
       "path": "scripts/gds/provision-repo.js",
@@ -9172,7 +9182,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "7747b46f241bddb4257a56461703f82603dd58e18d22bd2c547fd7137749d0e6"
+      "sha256": "6662c9bf5e47532a4a996eead3d48599b8f0d469818ab4b7c545421ab78955d8"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -10212,7 +10222,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "fa9ef668d1c3a3762533b0b74415725117d45c789d3f8b3b2c6cda3ab8344b47"
+      "sha256": "860067ab748034a9318878640268ecb791138d914e0ee3e8ea7d6ee2ee6137f8"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13357,7 +13367,7 @@
     {
       "path": "tests/provision_repo_private.mjs",
       "mode": "0000644",
-      "sha256": "cd97e188c5b842b60d99b250d164a2b2da39e25fb56081064c9ec44107518356"
+      "sha256": "2bce22a05f7e0e51a412145657ec5c662e9f2545b8097be197a502e2d8ba4713"
     },
     {
       "path": "tests/provision_restart.mjs",
@@ -13407,7 +13417,7 @@
     {
       "path": "tests/provisioning_domain_attach.mjs",
       "mode": "0000644",
-      "sha256": "8a5bc0b4b1ab854cb1c5dc2d8c4a1330f38c445455651e2de15b258938acc6ef"
+      "sha256": "de931d33b0c0557a0901f3f5bb5403e5f6e9b49aa8c0a2955de81d4ea7fd2d2a"
     },
     {
       "path": "tests/provisioning_domain_lookup_index.mjs",
@@ -13424,6 +13434,11 @@
       "mode": "0000644",
       "sha256": "1c6ea2d8ec4a8b3836a1976511ac3727fd158ac88db373efe89950bbadf4296f"
     },
+    {
+      "path": "tests/provisioning_error_note_scope.mjs",
+      "mode": "0000644",
+      "sha256": "741d5bfeb01be36d9293fa0f9225a60574c4ef58e3f3649f22919fd82c928df1"
+    },
     {
       "path": "tests/provisioning_github_app_routes.mjs",
       "mode": "0000644",
@@ -13472,7 +13487,7 @@
     {
       "path": "tests/provisioning_settings_apply.mjs",
       "mode": "0000644",
-      "sha256": "ab01149d73158276a73464bc0feca3474ee2f054db03af378c9b43874a2056fb"
+      "sha256": "f4ac3da586f80cc85664c9fb3b04794153f707b334ccedbeef780d901510e20f"
     },
     {
       "path": "tests/provisioning_settings_env.mjs",

package/docs/module-api-changelog.md

@@ -2456,5 +2456,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.989 with no explicit bump. run 35912578496. (task 1002620)
   1.19.991 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.990 with no explicit bump. run 35916061384. (task 1002620)
+  1.19.992 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.991 with no explicit bump. run 35918717050. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/error-note.js

@@ -0,0 +1,33 @@
+'use strict';
+// error-note.js — the "we stopped trying" note (F19, task 1002720) belongs to the action
+// that wrote it (task 1004197).
+//
+// The intent runner's retire leg writes error_note AND error_note_action (provisioning_026).
+// A successful run releases only its own action's note: a restart that worked says nothing
+// about a domain that never attached, so another action's note stays on the card. The
+// owner's re-kick doors ask the same question — re-sent settings re-queue a push only over
+// a settings-apply note. A note with no recorded action predates the column and counts as
+// anyone's, which is how every note behaved before.
+//
+// Its own file because provisioning.js sits at the size ratchet.
+
+// Is there a note on this row that `action` wrote (or that nobody is recorded as writing)? PURE.
+function ownsErrorNote(inst, action) {
+  if (!inst || !inst.error_note) return false;
+  return inst.error_note_action == null || inst.error_note_action === action;
+}
+
+// Release the note after a successful run of `action`. One statement, so a note another
+// action writes in between is never erased. Same narrowness rule as recordDnsNote: no
+// status, no updated_at.
+async function clearErrorNote(db, id, action) {
+  const { rows } = await db.query(
+    `UPDATE provisioning_instances SET error_note = NULL, error_note_action = NULL
+      WHERE id = $1 AND error_note IS NOT NULL AND (error_note_action IS NULL OR error_note_action = $2)
+      RETURNING id`,
+    [id, action ?? null]
+  );
+  return rows[0] || null;
+}
+
+module.exports = { clearErrorNote, ownsErrorNote };

package/modules/provisioning/migrations/provisioning_026_error_note_action.sql

@@ -0,0 +1,20 @@
+-- provisioning_026_error_note_action.sql — record WHICH action wrote an instance's
+-- "we stopped trying" note (task 1004197; the F19 latch, task 1002720).
+--
+-- WHY. A retired intent writes error_note onto the project card, and a later successful run
+-- releases it. Without the author, "released" meant ANY success: a restart that worked erased
+-- a domain-attach note although the domain still was not attached, and a make-private that
+-- worked cleared nothing at all. With it, a success clears only the note its own action wrote,
+-- and the owner's re-kick doors (same settings / same address re-sent) fire only over a note
+-- their own action left.
+--
+-- NULL means "written before this column existed" (or never written); readers treat such a
+-- note as nobody's in particular, which is exactly how every note behaved before.
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+ALTER TABLE provisioning_instances ADD COLUMN IF NOT EXISTS error_note_action text;
+
+COMMIT;

package/modules/provisioning/provisioning.js

@@ -1012,17 +1012,9 @@ async function recordDnsNote(db, id, note) {
   return rows[0] || null;
 }
 
-// Clear the error_note latch (task 1002720 / F19). The retire leg of the intent
-// runner sets it when work stops; a later SUCCESSFUL run must release it, or the
-// card shows "we stopped trying" forever on a healed instance. Same narrowness
-// rule: no status, no updated_at.
-async function clearErrorNote(db, id) {
-  const { rows } = await db.query(
-    `UPDATE provisioning_instances SET error_note = NULL WHERE id = $1 RETURNING id`,
-    [id]
-  );
-  return rows[0] || null;
-}
+// The error_note latch (task 1002720 / F19) belongs to the action that wrote it (task
+// 1004197, provisioning_026). Its own file: this one is at the size ratchet.
+const { clearErrorNote, ownsErrorNote } = require('./error-note.js');
 
 // The caller's own instances, newest first.
 async function listInstancesForOwner(db, ownerBuilderId) {
@@ -1119,7 +1111,7 @@ async function setInstanceStatus(db, id, status, patch = {}) {
   const params = [id, status];
   const COLS = {
     domain: 'domain', db_name: 'db_name', port: 'port', tier: 'tier',
-    target_ref: 'target_ref', error_note: 'error_note',
+    target_ref: 'target_ref', error_note: 'error_note', error_note_action: 'error_note_action',
     cost_estimate_usd: 'cost_estimate_usd',
     provisioned_at: 'provisioned_at', torn_down_at: 'torn_down_at',
   };
@@ -1487,7 +1479,7 @@ module.exports = {
   isProvisionedHostname,
   getInstanceById, getInstanceBySlug, getInstanceByDomain, listInstancesForOwner, listAllInstances,
   // data access — verification overlay (task 1002696)
-  listActiveInstancesForLiveness, recordLivenessProbe, recordDnsNote, clearErrorNote,
+  listActiveInstancesForLiveness, recordLivenessProbe, recordDnsNote, clearErrorNote, ownsErrorNote,
   // data access — the owed-push marker (task 1003524)
   recordSettingsPushOwed,
   createInstance, setInstanceStatus, updateInstanceDomain, clearReleasedDomains, updateInstanceSettings, updateInstanceDetail,

package/modules/provisioning/routes/provisioning.js

@@ -901,7 +901,7 @@ module.exports = function provisioningRoutes() {
       // "send it again", and folding the second in is what makes that sentence
       // true: the re-send is unchanged, so it would otherwise hit "No change".
       const pushOwed = provisioning.settingsPushOwed(inst);
-      const policyResent = (!!inst.error_note || pushOwed) && policyTouched;
+      const policyResent = (provisioning.ownsErrorNote(inst, 'settings-apply') || pushOwed) && policyTouched;
       // Raising `artist_gate` to 'strict' also stamps WHEN (ADR 0241 §5 makes the
       // tightening non-retroactive, and the instance cannot honour that without the
       // date). It rides the same single UPDATE as the setting it belongs to, and is
@@ -1131,7 +1131,7 @@ module.exports = function provisioningRoutes() {
         // probe says the address doesn't answer — and nothing is in flight. A
         // healthy instance (no note, verified up or unprobed) keeps the
         // idempotent no-op below.
-        const needsRewire = inst.error_note || inst.last_verified_up === false;
+        const needsRewire = provisioning.ownsErrorNote(inst, 'domain-attach') || inst.last_verified_up === false;
         if (inst.status === 'active' && needsRewire && !(await provisioning.getOpenIntent(pool, id))) {
           const { created } = await provisioning.enqueueIntent(pool, id, 'domain-attach', 'api:self');
           if (created) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.991",
+  "version": "1.19.992",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.991",
+      "version": "1.19.992",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.991",
+  "version": "1.19.992",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision-core-upgrade.js

@@ -274,7 +274,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
     detail: served ? `core pin moved to ${served}` : `core pin moved to ${to}; the box did not answer /version, so this is unconfirmed`,
     actor: intent.requested_by || 'runner',
   }).catch(() => {});
-  if (provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id).catch(() => {});
+  if (provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id, 'core-upgrade').catch(() => {});
   log(served ? `  ✓ ${inst.slug} serves core ${served}` : `  ⚠ ${inst.slug} upgraded to ${to}, but did not answer /version — unconfirmed`);
   return { ok: true, served, confirmed: served === to };
 }

package/scripts/gds/provision-repo-private.js

@@ -89,6 +89,8 @@ async function repoPrivateInstance(inst, deps) {
     detail: `${repo.owner}/${repo.name} made private — the project now reads it with its own read-only deploy key${wired.minted ? ' (newly registered)' : ''}`,
     actor: 'runner',
   }).catch(() => {});
+  // A make-private that failed earlier left "still public" on the card; this run made it private.
+  if (provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id, 'repo-private').catch(() => {});
   log(`  ✓ ${repo.owner}/${repo.name} is private; ${inst.slug} reads it with its own deploy key`);
   return { ok: true, minted: !!wired.minted };
 }

package/scripts/gds/provision.js

@@ -844,7 +844,7 @@ async function domainAttachInstance(inst, deps) {
       : null).catch(() => {});
     // Release the F19 latch: this run SUCCEEDED, so a "we stopped trying" note
     // from an earlier retired attach must not outlive its own recovery.
-    if (provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id).catch(() => {});
+    if (provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id, 'domain-attach').catch(() => {});
     await provisioning.recordEvent(db, {
       instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: 'domain-attached',
       detail: dnsSkipped
@@ -957,7 +957,7 @@ async function settingsApplyInstance(inst, deps) {
   if (probeIsVerdict && provisioning.recordLivenessProbe) await provisioning.recordLivenessProbe(db, inst.id, healthy).catch(() => {});
   // Release the F19 latch: this run SUCCEEDED, so a "we stopped trying" note
   // from an earlier retired push must not outlive its own recovery.
-  if (provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id).catch(() => {});
+  if (provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id, 'settings-apply').catch(() => {});
   await provisioning.recordEvent(db, {
     instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: 'settings-applied',
     detail: `settings pushed (${shown}) — web.env patched in place; ${outcome}`,
@@ -1038,8 +1038,8 @@ async function restartInstance(inst, deps) {
   // that HAS a domain. Silence after the whole budget is a verdict on any shape.
   const probeIsVerdict = healthy === false || (healthy === true && !inst.domain);
   if (probeIsVerdict && provisioning.recordLivenessProbe) await provisioning.recordLivenessProbe(db, inst.id, healthy).catch(() => {});
-  // A restart that worked retires any "we stopped trying" note left by earlier
-  // work (the F19 latch) — the note outliving its own recovery is the bug.
+  // A restart that worked retires the "we stopped trying" note a failed restart
+  // left (the F19 latch); another action's note stays (task 1004197).
   // DELIBERATELY gated on `healthy`, NOT on probeIsVerdict: the two answer
   // different questions. probeIsVerdict asks "may this run claim the instance is
   // UP?" — a loopback pass may not, for an instance whose address the sweep owns.
@@ -1047,7 +1047,7 @@ async function restartInstance(inst, deps) {
   // answered is that work finishing, whatever the public address does next.
   // Holding the note until the sweep agrees would leave a stale "nothing more
   // will happen" on the card of a project that just visibly recovered.
-  if (healthy && provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id).catch(() => {});
+  if (healthy && provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id, 'restart').catch(() => {});
   // Name WHAT was observed, not a verdict this probe cannot reach. healthzCmd is
   // loopback (127.0.0.1:<port>) while the liveness sweep probes the PUBLIC
   // https://<domain>/healthz — so an instance can answer here while DNS, Caddy or
@@ -1303,7 +1303,7 @@ async function cmdRunIntents(deps) {
           // CURRENT status makes the status write a no-op, so a healthy active
           // instance is never marked broken over a domain hiccup, but the card
           // can say why the work stopped.
-          await provisioning.setInstanceStatus(db, intent.instance_id, inst.status, { error_note: result.error || 'op failed' }).catch(() => {});
+          await provisioning.setInstanceStatus(db, intent.instance_id, inst.status, { error_note: result.error || 'op failed', error_note_action: intent.action }).catch(() => {});
         } else {
           await db.query(`UPDATE provisioning_intents SET state='pending', last_error=$2, updated_at=now() WHERE id=$1`, [intent.id, result.error || 'op failed']);
         }
@@ -1312,7 +1312,7 @@ async function cmdRunIntents(deps) {
     } catch (e) {
       await provisioning.resolveIntent(db, intent.id, 'error', e.message).catch(() => {});
       // Surface the failure on the instance too, so a stuck instance is visible.
-      await provisioning.setInstanceStatus(db, intent.instance_id, 'error', { error_note: e.message }).catch(() => {});
+      await provisioning.setInstanceStatus(db, intent.instance_id, 'error', { error_note: e.message, error_note_action: intent.action }).catch(() => {});
       errors++; log(`  ✖ intent #${intent.id}: ${e.message}`);
     }
   }

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.991'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.992'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provision_repo_private.mjs

@@ -92,6 +92,22 @@ await ta('the deploy key is registered and the checkout re-pointed BEFORE the re
   assert.equal(r.timeline[flip][2], 'example-owner/demo', 'the flip targets the project repository');
 });
 
+await ta('a make-private that worked releases the note an earlier retired make-private left (task 1004197); a failed one does not', async () => {
+  // Arrange
+  const ok = recorder();
+  const bad = recorder({ flipFails: new Error('GitHub said no') });
+  const cleared = [];
+  for (const r of [ok, bad]) r.deps.provisioning.clearErrorNote = async (_db, id, action) => { cleared.push({ id, action, r }); };
+  // Act
+  const good = await repoPrivateInstance(liveStandalone, ok.deps);
+  const failed = await repoPrivateInstance(liveStandalone, bad.deps);
+  // Assert
+  assert.equal(good.ok, true);
+  assert.equal(failed.ok, false);
+  assert.deepEqual(cleared.map(({ id, action }) => ({ id, action })), [{ id: 18, action: 'repo-private' }], 'cleared once, by the run that worked, scoped to its own action');
+  assert.equal(cleared[0].r, ok);
+});
+
 await ta('the wiring is a PRE-flip wiring — it runs although GitHub still reports the repository public', async () => {
   const r = recorder();
   await repoPrivateInstance(liveStandalone, r.deps);

package/tests/provisioning_domain_attach.mjs

@@ -245,6 +245,17 @@ await ta('same domain again RE-ENQUEUES when the wiring stopped — the owner re
   assert.match(res.body.message, /Wiring that address again/);
 });
 
+await ta('another action\'s note is NOT a re-wire: the same address re-sent over a retired RESTART\'s note stays the no-op (task 1004197)', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com', error_note: 'could not restart spike', error_note_action: 'restart' } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'spike.cloudbongos.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.queued, false, 'a restart note says nothing about the wiring');
+  assert.equal(enqueueCalls.length, 0);
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com', error_note: 'DNS preflight failed', error_note_action: 'domain-attach' } });
+  const own = await post('/provisioning/instances/18/domain', { domain: 'spike.cloudbongos.com' });
+  assert.equal(own.body.queued, true, 'its OWN retired attach still re-kicks');
+});
+
 await ta('a verified-DOWN address re-enqueues too; an open intent keeps the no-op', async () => {
   reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com', last_verified_up: false } });
   const res = await post('/provisioning/instances/18/domain', { domain: 'spike.cloudbongos.com' });

package/tests/provisioning_error_note_scope.mjs

@@ -0,0 +1,147 @@
+// tests/provisioning_error_note_scope.mjs — the "we stopped trying" note belongs to the
+// action that wrote it (task 1004197; the F19 latch, task 1002720).
+//
+// What is pinned:
+//   1. both retire paths record the retiring intent's action beside the note, through the
+//      setInstanceStatus whitelist, and provisioning_026 adds that column idempotently;
+//   2. clearErrorNote releases only its own action's note (or one with no recorded
+//      action), in one narrow statement; ownsErrorNote answers the same question for the
+//      owner's re-kick doors;
+//   3. every success leg names its own action — no unscoped clear is left.
+// The re-kick doors themselves are pinned in tests/provisioning_settings_apply.mjs and
+// tests/provisioning_domain_attach.mjs.
+//
+// DB-free: CI has no Postgres, so the SQL is exercised through a recording fake.
+//
+// Run:  node tests/provisioning_error_note_scope.mjs
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const P = require('../scripts/gds/provision.js');
+const { clearErrorNote, ownsErrorNote } = require('../modules/provisioning/error-note.js');
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+const { test, summary } = makeRunner();
+
+const activeStandalone = {
+  id: 18, slug: 'spike', hosting_shape: 'standalone', status: 'active', owner_builder_id: 7,
+  port: 3010, db_name: 'spike', domain: null, target_ref: 'jaxri/spike-harbor',
+};
+
+function recordingDb(rows = [{ id: 18 }]) {
+  const calls = [];
+  return { calls, query: async (sql, params) => { calls.push({ sql, params }); return { rows }; } };
+}
+
+// ---- 1. the author is recorded ------------------------------------------------------
+
+function retireDeps(getInstanceById) {
+  let claims = 0;
+  const patches = [];
+  const deps = {
+    apply: true, log: () => {},
+    db: { query: async () => ({ rows: [] }) },
+    provisioning: {
+      claimNextIntent: async () => (claims++ === 0
+        ? { id: 9, instance_id: 18, action: 'domain-attach', attempts: P.MAX_INTENT_ATTEMPTS } : null),
+      getInstanceById,
+      resolveIntent: async () => {},
+      setInstanceStatus: async (_db, _id, _s, patch) => { patches.push(patch); },
+      recordEvent: async () => {},
+      claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
+    },
+    exec: () => ({ ok: true }), writeFile: () => ({ ok: true }), doApi: null,
+    checkDnsTokenScope: async () => ({ reachable: true, zone: 'z' }),
+    checkCaddyWiring: () => null,
+  };
+  return { deps, patches };
+}
+
+await test('a retire that returned ok:false records its action beside the note', async () => {
+  // Arrange: an active instance with no domain makes the attach leg fail on its last attempt.
+  const r = retireDeps(async () => ({ ...activeStandalone }));
+  // Act
+  await P.cmdRunIntents(r.deps);
+  // Assert
+  assert.equal(r.patches.length, 1);
+  assert.ok(r.patches[0].error_note, 'the reason reaches the card');
+  assert.equal(r.patches[0].error_note_action, 'domain-attach');
+});
+
+await test('a retire by a throw records its action beside the note', async () => {
+  const r = retireDeps(async () => { throw new Error('box unreachable'); });
+  await P.cmdRunIntents(r.deps);
+  assert.deepEqual(r.patches[0], { error_note: 'box unreachable', error_note_action: 'domain-attach' });
+});
+
+await test('setInstanceStatus writes error_note_action (it is on the whitelist)', async () => {
+  const db = recordingDb();
+  await provisioning.setInstanceStatus(db, 18, 'active', { error_note: 'x', error_note_action: 'restart' });
+  assert.match(db.calls[0].sql, /error_note_action = \$\d/);
+  assert.ok(db.calls[0].params.includes('restart'));
+});
+
+await test('provisioning_026 adds the column idempotently, and nothing else', () => {
+  const sql = readFileSync(path.join(ROOT, 'modules/provisioning/migrations/provisioning_026_error_note_action.sql'), 'utf8')
+    .replace(/--.*$/gm, '');
+  assert.match(sql, /ALTER TABLE provisioning_instances ADD COLUMN IF NOT EXISTS error_note_action text;/);
+  assert.doesNotMatch(sql, /DROP|UPDATE|DELETE/i, 'additive only (ADR 0083)');
+});
+
+// ---- 2. who may release the note ------------------------------------------------------
+
+await test('ownsErrorNote: own action, or no recorded action, owns the note; another action does not', () => {
+  assert.equal(ownsErrorNote({ error_note: 'x', error_note_action: 'restart' }, 'restart'), true);
+  assert.equal(ownsErrorNote({ error_note: 'x', error_note_action: null }, 'restart'), true, 'a note from before the column is anyone\'s, as before');
+  assert.equal(ownsErrorNote({ error_note: 'x' }, 'restart'), true);
+  assert.equal(ownsErrorNote({ error_note: 'x', error_note_action: 'domain-attach' }, 'restart'), false);
+  assert.equal(ownsErrorNote({ error_note: null, error_note_action: 'restart' }, 'restart'), false, 'no note, nothing to own');
+  assert.equal(ownsErrorNote(null, 'restart'), false);
+});
+
+await test('clearErrorNote releases only its own action\'s note, in one narrow statement', async () => {
+  const db = recordingDb();
+  const out = await clearErrorNote(db, 18, 'repo-private');
+  assert.deepEqual(out, { id: 18 });
+  assert.equal(db.calls.length, 1, 'one statement — no read-then-write window');
+  const { sql, params } = db.calls[0];
+  assert.match(sql, /SET error_note = NULL, error_note_action = NULL/);
+  assert.match(sql, /error_note IS NOT NULL AND \(error_note_action IS NULL OR error_note_action = \$2\)/,
+    'another action\'s note does not match, so it stays');
+  assert.deepEqual(params, [18, 'repo-private']);
+  assert.doesNotMatch(sql, /status\s*=|updated_at/, 'releasing the latch never touches the lifecycle');
+});
+
+await test('an unscoped clear passes null, which releases only a note with no recorded action', async () => {
+  const db = recordingDb([]);
+  assert.equal(await clearErrorNote(db, 18), null);
+  assert.deepEqual(db.calls[0].params, [18, null]);
+});
+
+await test('provisioning.js re-exports both from error-note.js', () => {
+  assert.equal(provisioning.clearErrorNote, clearErrorNote);
+  assert.equal(provisioning.ownsErrorNote, ownsErrorNote);
+});
+
+// ---- 3. every success leg names its own action -------------------------------------
+
+await test('each success leg clears with its OWN action, and no unscoped clear is left', () => {
+  const want = {
+    'scripts/gds/provision.js': ['domain-attach', 'settings-apply', 'restart'],
+    'scripts/gds/provision-core-upgrade.js': ['core-upgrade'],
+    'scripts/gds/provision-repo-private.js': ['repo-private'],
+  };
+  for (const [file, actions] of Object.entries(want)) {
+    const src = readFileSync(path.join(ROOT, file), 'utf8');
+    const calls = [...src.matchAll(/clearErrorNote\(db, inst\.id(?:, '([a-z-]+)')?\)/g)].map((m) => m[1] || '(none)');
+    assert.deepEqual(calls.sort(), [...actions].sort(), `${file}: ${calls.join(', ')}`);
+  }
+});
+
+summary();

package/tests/provisioning_settings_apply.mjs

@@ -323,6 +323,20 @@ await ta('the owner re-kick: same values re-sent while a retired push left its e
   receiptShape(r.body.push, { queued: true, restart: true, reachable: true });
 });
 
+await ta('another action\'s note is NOT a re-kick: same values re-sent over a retired RESTART\'s note → "No change", nothing queued (task 1004197)', async () => {
+  // A settings push that works cannot release a restart's note, so treating that note as
+  // "the push is owed" would re-queue a push (and a restart) on every unchanged save.
+  reset({ inst: { ...ACTIVE, settings: { platform_visibility: 'gated' }, error_note: 'could not restart spike', error_note_action: 'restart' } });
+  const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated' });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(enqueueCalls.length, 0, 'no push re-queued');
+  assert.equal(updateCalls.length, 0);
+  reset({ inst: { ...ACTIVE, settings: { platform_visibility: 'gated' }, error_note: 'could not apply the settings on spike', error_note_action: 'settings-apply' } });
+  const own = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated' });
+  assert.deepEqual(enqueueCalls.map((c) => c.id), [18], 'its OWN retired push still re-kicks');
+  receiptShape(own.body.push, { queued: true, restart: true, reachable: true });
+});
+
 console.log('\nthe state gate — store, queue nothing, say when it takes effect:');
 
 await ta('requested / provisioning: stored, NO intent (standup writes the same values), message says so', async () => {