@bongos/core 1.19.999 → 1.19.1000

package/scripts/gds/provision-core-upgrade.js

@@ -39,7 +39,7 @@ const { isValidSlug } = require('../../modules/provisioning/provisioning.js');
 // for one would be a request that is accepted and never lands. The route refuses the
 // same shape; this is the second gate, and it is the one that holds if a row's shape
 // changes between the request and the drain.
-const UPGRADE_SHAPES = Object.freeze(new Set(['co-tenant', 'standalone', 'control-plane']));
+const UPGRADE_SHAPES = Object.freeze(new Set(['co-tenant', 'cloud-host', 'control-plane']));
 
 // The strict three-number form a core version takes. Re-stated here rather than imported
 // from the web tier's core-upgrade.js: a module may not be required from scripts/ (ADR
@@ -152,7 +152,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
   const { db, provisioning, exec, log, apply, privileged } = deps;
   // A standalone's box IS the control plane's box, the same routing restartInstance and
   // settingsApplyInstance use; a co-tenant shares this checkout.
-  const boxExec = inst.hosting_shape === 'standalone' ? (deps.controlExec || exec) : exec;
+  const boxExec = inst.hosting_shape === 'cloud-host' ? (deps.controlExec || exec) : exec;
   const to = intent && intent.target_version;
   log(`core-upgrade ${inst.slug} → ${to || '(no target)'} (shape=${inst.hosting_shape}, status=${inst.status})`);
 
@@ -190,7 +190,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
   // ---- 2. is the target real, and permitted -----------------------------------------
   const channelMod = deps.updateChannel || require('./update-channel.js');
   const selfRoot = deps.selfInstanceRoot || selfInstanceRoot;
-  const instanceDir = inst.hosting_shape === 'standalone' ? standaloneRoot(inst) : selfRoot();
+  const instanceDir = inst.hosting_shape === 'cloud-host' ? standaloneRoot(inst) : selfRoot();
   const readInstalled = deps.readInstalledCoreVersion || require('./upgrade.js').readInstalledCoreVersion;
   const installed = readInstalled(instanceDir);
   // THE PLATFORM DEFAULT, NOT A PER-INSTANCE CHANNEL — and saying so beats implying
@@ -325,7 +325,7 @@ function resolveRunAs(inst, deps, { probe: allowProbe = true } = {}) {
   // probe on `exec` would then ask the co-hosting box whether an account exists while
   // the command it is deciding for runs on the control plane — a wrong answer that
   // looks like a right one.
-  const boxExec = inst.hosting_shape === 'standalone' ? (deps.controlExec || deps.exec) : deps.exec;
+  const boxExec = inst.hosting_shape === 'cloud-host' ? (deps.controlExec || deps.exec) : deps.exec;
   const r = boxExec(`id -u ${wanted}`, { allowFail: true });
   const failed = !r || r.softFailed === true || r.ok === false;
   if (!failed) return { runAs: wanted, fellBack: false };
@@ -371,7 +371,7 @@ function upgradeInvocation(inst, to, { privileged = false, dryRun = false, reque
   // just to node_modules/@bongos/core — and the door aimed at the package instead of
   // the project. So ask, rather than assume; in the legacy shape the answer is
   // REPO_ROOT and the command below is byte-identical to what it always was.
-  const instanceDir = inst.hosting_shape === 'standalone' ? standaloneRoot(inst) : selfRoot();
+  const instanceDir = inst.hosting_shape === 'cloud-host' ? standaloneRoot(inst) : selfRoot();
   // WHICH ACCOUNT, AND WHY IT IS RESOLVED RATHER THAN DERIVED (task 1004128).
   //
   // Task 1004119 wrote this as `control-plane ? APP_USER : instanceUser(inst)` and was
@@ -409,7 +409,7 @@ function upgradeInvocation(inst, to, { privileged = false, dryRun = false, reque
 // is the interesting answer, not an exception: pre-flight refusing is what this is for.
 function preflightUpgrade(inst, to, deps) {
   const { exec, privileged } = deps;
-  const boxExec = inst.hosting_shape === 'standalone' ? (deps.controlExec || exec) : exec;
+  const boxExec = inst.hosting_shape === 'cloud-host' ? (deps.controlExec || exec) : exec;
   // A distinct local name: `deps.selfInstanceRoot || selfInstanceRoot` with a const of
   // the same name would TDZ-shadow the import and crash every uninjected call.
   const selfRoot = deps.selfInstanceRoot || selfInstanceRoot;
@@ -718,10 +718,10 @@ async function preflightCoreUpgrade(inst, deps, intent) {
 async function snapshotCoreVersions(inst, deps) {
   const { db, exec, log } = deps;
   if (!UPGRADE_SHAPES.has(inst.hosting_shape) || inst.status !== 'active') return { ok: true, skipped: true };
-  const boxExec = inst.hosting_shape === 'standalone' ? (deps.controlExec || exec) : exec;
+  const boxExec = inst.hosting_shape === 'cloud-host' ? (deps.controlExec || exec) : exec;
   const channelMod = deps.updateChannel || require('./update-channel.js');
   const selfRoot = deps.selfInstanceRoot || selfInstanceRoot;
-  const instanceDir = inst.hosting_shape === 'standalone' ? standaloneRoot(inst) : selfRoot();
+  const instanceDir = inst.hosting_shape === 'cloud-host' ? standaloneRoot(inst) : selfRoot();
   try {
     const probe = boxExec(versionCmd(inst), { allowFail: true });
     const body = probe && !probe.softFailed ? (probe.stdout || '') : null;

package/scripts/gds/provision-disconnect.js

@@ -49,7 +49,7 @@ function eraseCommands(inst, { privileged = false } = {}) {
     `${sudo}find ${CONFIG.backupDir} -maxdepth 1 -type f -name '${dumpGlob(inst)}' -delete`,
     `${sudo}rm -rf ${path.posix.dirname(webEnvPath(inst))} ${instanceStateDir(inst)}`,
   ];
-  if (inst.hosting_shape === 'standalone') cmds.push(`${sudo}rm -rf ${standaloneRoot(inst)}`);
+  if (inst.hosting_shape === 'cloud-host') cmds.push(`${sudo}rm -rf ${standaloneRoot(inst)}`);
   cmds.push(`if id -u ${user} >/dev/null 2>&1; then ${sudo}userdel ${user}; fi`);
   return cmds;
 }
@@ -63,7 +63,7 @@ async function disconnectInstance(inst, deps) {
   await teardownInstance(inst, deps);
 
   if (inst.hosting_shape !== 'dedicated') {
-    const boxExec = inst.hosting_shape === 'standalone' ? (deps.controlExec || exec) : exec;
+    const boxExec = inst.hosting_shape === 'cloud-host' ? (deps.controlExec || exec) : exec;
     for (const cmd of eraseCommands(inst, { privileged })) {
       try { boxExec(cmd); }
       catch (e) { return { ok: false, error: `erase step failed (${cmd.split(' ').slice(0, 3).join(' ')}): ${(e && e.message) || e}` }; }

package/scripts/gds/provision-process.js

@@ -75,13 +75,13 @@ function supervisorConfPath(inst) {
 // cannot drift: a standalone runs out of its own pinned core, anything else out of this
 // checkout.
 function programCommand(inst) {
-  return inst.hosting_shape === 'standalone'
+  return inst.hosting_shape === 'cloud-host'
     ? `/usr/bin/node ${CORE_PKG_DIR}/src/platform-server.js`
     : '/usr/bin/node src/platform-server.js';
 }
 
 function supervisorProgram(inst, { etcBase = CONFIG.etcBase } = {}) {
-  const workDir = inst.hosting_shape === 'standalone' ? standaloneRoot(inst) : REPO_ROOT;
+  const workDir = inst.hosting_shape === 'cloud-host' ? standaloneRoot(inst) : REPO_ROOT;
   return `[program:${inst.slug}]
 ; Cloud Bongos instance — ${inst.slug} (provisioned by provision.js, ADR 0306)
 command=${programCommand(inst)}

package/scripts/gds/provision-repo-private.js

@@ -40,7 +40,7 @@ async function repoPrivateInstance(inst, deps) {
 
   // Only a standalone project has its own checkout to wire; any other shape reads from a
   // checkout this project does not own, so a key minted here would change nothing.
-  if (inst.hosting_shape !== 'standalone') {
+  if (inst.hosting_shape !== 'cloud-host') {
     return { ok: false, error: 'This project shares its code checkout with others, so its repository cannot be made private from here.' };
   }
   if (inst.status !== 'active') {

package/scripts/gds/provision-repo.js

@@ -79,8 +79,18 @@ function seedFirstVersionCmd(inst, { privileged = false } = {}) {
   return asPostgres(`psql -v ON_ERROR_STOP=1 -d ${dbName(inst)} -c '${sql}'`, privileged);
 }
 
-// ── STANDALONE shape (hosting_shape='standalone', ADR 0108, task 1978) ────────
-// A standalone instance runs from its OWN repo checkout (host content: config/,
+// ── The CLOUD-HOST shape (hosting_shape='cloud-host', ADR 0108, task 1978) ────
+//
+// TWO SENSES OF "STANDALONE", AND THIS FILE USES BOTH. The ADR 0108 sense is a repo
+// TOPOLOGY: an instance running from its own checkout with the core as an npm dependency,
+// as opposed to co-tenant's shared control-plane checkout. That is what `standaloneRoot`,
+// `standaloneBase` and `PROVISION_STANDALONE_BASE` name, and those keep their spelling —
+// `PROVISION_STANDALONE_BASE` in particular is a live environment variable on the control
+// plane and is documented in the /new-project skill. The other sense was the HOSTING SHAPE
+// once stored as 'standalone'; task 1004182 renamed that value to 'cloud-host'. Only the
+// stored value moved. Do not "finish the rename" by touching the topology names.
+//
+// A cloud-host instance runs from its OWN repo checkout (host content: config/,
 // migrations/instance/, the core PIN in package.json) with @bongos/core installed
 // as an npm DEPENDENCY — NOT the shared control-plane checkout the co-tenant shape uses.
 // It is the ADR 0108 DESTINATION model; these generators make provision.js drive the
@@ -883,7 +893,7 @@ function deployKeyPath(inst) { return path.posix.join(standaloneRoot(inst), '.gi
 async function ensurePrivateRepoAccess(inst, deps) {
   const { log, apply } = deps;
   const exec = deps.controlExec || deps.exec;
-  if (inst.hosting_shape !== 'standalone') return { skipped: 'shape' };
+  if (inst.hosting_shape !== 'cloud-host') return { skipped: 'shape' };
   const repo = parseTargetRef(inst.target_ref);
   if (!repo) return { skipped: 'no_repo' };
   // Dry-run stays OFFLINE like every other plan path here (the checkDnsTokenScope

package/scripts/gds/provision-teardown.js

@@ -24,7 +24,7 @@ async function teardownInstance(inst, deps) {
   // local (task 2074), so disable/remove its unit HERE — not on the remote co-hosting
   // box, where it was never installed (that would allowFail-noop and leave the real
   // control-plane unit running). Co-tenant + dedicated are unchanged.
-  const boxExec = inst.hosting_shape === 'standalone' ? controlExec : exec;
+  const boxExec = inst.hosting_shape === 'cloud-host' ? controlExec : exec;
   const sudoP = privileged ? 'sudo ' : '';   // systemctl / rm-under-/etc escalation (task 2066)
   log(`teardown ${inst.slug} (status=${inst.status})`);
   if (apply) await provisioning.setInstanceStatus(db, inst.id, 'tearing_down');
@@ -47,7 +47,7 @@ async function teardownInstance(inst, deps) {
   // files must NOT ride along — and a revoke skip must be LOUD: a torn-down project
   // silently keeping durable read access to the owner's private repo is the exact
   // shape a teardown exists to end. A missing token / API hiccup never blocks it.
-  if (inst.hosting_shape === 'standalone' && inst.target_ref) {
+  if (inst.hosting_shape === 'cloud-host' && inst.target_ref) {
     const repo = parseTargetRef(inst.target_ref);
     if (repo) {
       try {

package/scripts/gds/provision-units.js

@@ -16,7 +16,7 @@ const { CORE_PKG_DIR, appUser, dbName, instanceDbRole, instanceStateDir, instanc
 function serviceUnit(inst, { etcBase = CONFIG.etcBase } = {}) {
   const envFile = path.posix.join(etcBase, inst.slug, 'web.env');
   const user = instanceUser(inst), stateDir = instanceStateDir(inst);
-  const standalone = inst.hosting_shape === 'standalone';
+  const standalone = inst.hosting_shape === 'cloud-host';
   const workDir = standalone ? standaloneRoot(inst) : REPO_ROOT;
   const execStart = standalone
     ? `/usr/bin/node ${CORE_PKG_DIR}/src/platform-server.js`
@@ -91,7 +91,7 @@ function backupTimerPath(inst) { return `/etc/systemd/system/${backupUnitName(in
 // scripts/gds/ — mirrors serviceUnit's execStart resolution so they can't diverge.
 function backupScriptPath(inst) {
   const rel = 'scripts/gds/db-backup-nightly.sh';
-  return inst.hosting_shape === 'standalone'
+  return inst.hosting_shape === 'cloud-host'
     ? path.posix.join(standaloneRoot(inst), CORE_PKG_DIR, rel)
     : path.posix.join(REPO_ROOT, rel);
 }

package/scripts/gds/provision.js

@@ -238,7 +238,7 @@ async function provisionInstance(inst, deps) {
   // So a standalone uses the control-plane executors; co-tenant + dedicated are
   // unchanged (boxExec === exec, boxWriteFile === writeFile). When no remoteHost is
   // set, controlExec === exec anyway, so this is a no-op for the all-local default.
-  const standalone = inst.hosting_shape === 'standalone';
+  const standalone = inst.hosting_shape === 'cloud-host';
   const boxExec = standalone ? controlExec : exec;
   const boxWriteFile = standalone ? (deps.controlWriteFile || writeFile) : writeFile;
   const sudoP = privileged ? 'sudo ' : '';   // systemctl escalation prefix (task 2066)
@@ -372,7 +372,7 @@ async function provisionInstance(inst, deps) {
     // materialize config/ + .claude/ + file:-pinned core + lockfile → commit + push
     // (ADR 0108 / 0125, task 2055). Replaces the old "repo must already be cloned"
     // throw: the greenfield flow now has no manual clone step. Idempotent + dry-run-safe.
-    if (inst.hosting_shape === 'standalone') {
+    if (inst.hosting_shape === 'cloud-host') {
       await scaffoldStandaloneRepo(inst, deps);
       // A PRIVATE target_ref gets its own read-only deploy key BEFORE step 2's
       // `git pull --ff-only origin main` — the pull that failed unauthenticated
@@ -740,7 +740,7 @@ async function domainAttachInstance(inst, deps) {
   const controlExec = deps.controlExec || exec;
   // Same box routing as provisionInstance: a standalone runs control-plane-local
   // (task 2074), so its env/caddy/service live HERE, not on the co-hosting box.
-  const standalone = inst.hosting_shape === 'standalone';
+  const standalone = inst.hosting_shape === 'cloud-host';
   const boxExec = standalone ? controlExec : exec;
   const boxWriteFile = standalone ? (deps.controlWriteFile || writeFile) : writeFile;
   const sudoP = privileged ? 'sudo ' : '';
@@ -876,7 +876,7 @@ async function domainAttachInstance(inst, deps) {
 async function settingsApplyInstance(inst, deps) {
   const { db, provisioning, exec, writeFile, log, apply, privileged } = deps;
   // Same box routing as domainAttachInstance: a standalone runs control-plane-local.
-  const standalone = inst.hosting_shape === 'standalone';
+  const standalone = inst.hosting_shape === 'cloud-host';
   const boxExec = standalone ? (deps.controlExec || exec) : exec;
   const boxWriteFile = standalone ? (deps.controlWriteFile || writeFile) : writeFile;
   const sudoP = privileged ? 'sudo ' : '';
@@ -992,7 +992,7 @@ async function settingsApplyInstance(inst, deps) {
 async function restartInstance(inst, deps) {
   const { db, provisioning, exec, log, apply, privileged } = deps;
   // Same box routing as settingsApplyInstance: a standalone runs control-plane-local.
-  const boxExec = inst.hosting_shape === 'standalone' ? (deps.controlExec || exec) : exec;
+  const boxExec = inst.hosting_shape === 'cloud-host' ? (deps.controlExec || exec) : exec;
   const sudoP = privileged ? 'sudo ' : '';
   log(`restart ${inst.slug} (shape=${inst.hosting_shape}, status=${inst.status})`);
 
@@ -1124,7 +1124,7 @@ async function placeManifestCreds(inst, mrow, deps) {
     return { ok: false, error: 'GitHub App Manifest cred placement is not supported for a dedicated droplet yet — run oauth-secret.js on the droplet instead' };
   }
   if (!mrow.github_code) return { ok: false, error: 'manifest row carries no github_code to convert' };
-  const standalone = inst.hosting_shape === 'standalone';
+  const standalone = inst.hosting_shape === 'cloud-host';
   const boxExec = standalone ? (deps.controlExec || deps.exec) : deps.exec;
   const boxWriteFile = standalone ? (deps.controlWriteFile || deps.writeFile) : deps.writeFile;
   const sudoP = deps.privileged ? 'sudo ' : '';

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.999'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1000'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/collab_page.mjs

@@ -565,12 +565,138 @@ test('the asker can settle in place, with both outcomes', () => {
   assert.match(js, /patchHelpRequestsId/, 'through the real API, not a local edit');
 });
 
-test('there is deliberately NO reply thread — that would reimplement the Agora', () => {
-  // The goal forbids reimplementing the Agora to get around C06's dependency.
-  const js = read('modules', 'hall-ui', 'public', 'collab.js');
-  for (const f of ['reply', 'comment', 'thread', 'message']) {
-    assert.ok(!new RegExp(`data-${f}|post${f}`, 'i').test(js), `no ${f} surface`);
+// REPLACED, not deleted (task 1004216). This test used to read "there is
+// deliberately NO reply thread — that would reimplement the Agora", deferring
+// replies to task 1002946 under goal 1000064. That task is ABANDONED and that
+// goal is ARCHIVED, so the deferral had no addressee left: the surface that was
+// to own replies will never be built, and an ask stayed unanswerable to keep a
+// promise to a thing that does not exist. ADR 0330 records the reversal.
+//
+// What the old test was PROTECTING is still real, so it is what these assert:
+// a thread here must not grow into the chat surface ADR 0187 §4a declined.
+test('an ask can be answered — and the answer surface stops well short of a chat', () => {
+  const src = read('modules', 'hall-ui', 'public', 'collab.js');
+  // Comments stripped before the bans are checked: this file ARGUES at length
+  // about the four things it is not building, and a scan that read the argument
+  // as the thing would fail on the very prose explaining the restraint.
+  const js = src.replace(/^\s*\/\/.*$/gm, '');
+  assert.match(js, /data-reply-form/, 'there is somewhere to write an answer');
+  assert.match(js, /POST', `\/help-requests\/\$\{id\}\/replies`/, 'and it posts to the replies route');
+
+  // The four things a chat has that this must not grow.
+  assert.ok(!/data-edit|patchReply|editReply/i.test(js), 'no edit — a reply is what was said at the time');
+  assert.ok(!/deleteReply|data-reply-delete/i.test(js), 'no delete');
+  assert.ok(!/data-react|reaction|emoji/i.test(js), 'no reactions');
+  assert.ok(!/parent_reply|data-reply-to|@mention|mentions/i.test(js), 'no nesting and no mentions');
+});
+
+// RUN, not grepped — this file's own convention for everything in collab-lib.js,
+// and the grader was right that the first pass broke it. canClose in particular
+// decides whether a close control is drawn at all, so each branch of it needs a
+// test that calls it rather than a regex that agrees with a wrong answer.
+test('canClose: the asker and the addressee, and nobody else', () => {
+  const L = lib();
+  const craftAsk = { requested_by: '90', needs_craft: 'artist', needs_builder_id: null };
+  const namedAsk = { requested_by: '90', needs_craft: null, needs_builder_id: '7' };
+
+  assert.equal(L.canClose(namedAsk, 90, []), true, 'the asker always may');
+  assert.equal(L.canClose(namedAsk, 7, []), true, 'so may the person it names');
+  assert.equal(L.canClose(craftAsk, 7, ['artist']), true, 'or a craft they belong to');
+
+  assert.equal(L.canClose(craftAsk, 7, ['builder']), false, 'a craft they do not belong to is not theirs to close');
+  assert.equal(L.canClose(namedAsk, 8, ['artist']), false, 'a stranger to a by-name ask');
+  assert.equal(L.canClose(craftAsk, 7, []), false, 'no declared craft reaches no craft ask');
+});
+
+test('canClose fails CLOSED on every missing fact', () => {
+  // The page reads meId from /me. A failed read leaves it null, and the correct
+  // answer then is "draw nothing" — never "draw it and let the server refuse".
+  const L = lib();
+  const ask = { requested_by: '90', needs_builder_id: '7' };
+  for (const bad of [null, undefined]) {
+    assert.equal(L.canClose(ask, bad, ['artist']), false, `meId ${bad} draws no control`);
+  }
+  assert.equal(L.canClose(null, 7, ['artist']), false, 'no request, no control');
+  assert.equal(L.canClose({ requested_by: '90', needs_craft: null }, 7, null), false,
+    'a non-array craft list is not iterated into a yes');
+});
+
+test('canClose compares ids ACROSS types — the API sends strings, /me sends what it sends', () => {
+  // The live bug this forecloses: needs_builder_id arrives as "7" and meId as 7,
+  // and === between them is false, so the person a request names would silently
+  // lose their own close control.
+  const L = lib();
+  assert.equal(L.canClose({ requested_by: '90', needs_builder_id: '7' }, 7, []), true);
+  assert.equal(L.canClose({ requested_by: 90, needs_builder_id: 7 }, '7', []), true);
+});
+
+test('threadOf: oldest first, ties broken on id, and never explodes on a missing thread', () => {
+  const L = lib();
+  const out = L.threadOf({ replies: [
+    { id: 3, created_at: '2026-09-22T10:00:00Z' },
+    { id: 1, created_at: '2026-09-20T10:00:00Z' },
+    { id: 2, created_at: '2026-09-22T10:00:00Z' },
+  ] });
+  assert.deepEqual(out.map((r) => r.id), [1, 2, 3], 'two replies in the same second keep the order written');
+  assert.deepEqual(L.threadOf({}), [], 'a row with no replies field');
+  assert.deepEqual(L.threadOf(null), []);
+  assert.deepEqual(L.threadOf({ replies: 'nonsense' }), [], 'and a field that is not a list');
+});
+
+test('saidLabel is the PAST tense — an answer is not a debt', () => {
+  // ageLabel says "waiting 3 days", which under an answer reads as the answer
+  // still being owed: the exact opposite of what a reply means.
+  const L = lib();
+  const NOW2 = Date.parse('2026-09-23T12:00:00Z');
+  const ago = (d) => new Date(NOW2 - d * 86400000).toISOString();
+  assert.equal(L.saidLabel(ago(0), NOW2), 'today');
+  assert.equal(L.saidLabel(ago(1), NOW2), 'yesterday');
+  assert.equal(L.saidLabel(ago(3), NOW2), '3 days ago');
+  assert.equal(L.saidLabel(ago(21), NOW2), '3 weeks ago');
+  assert.equal(L.saidLabel('nonsense', NOW2), 'just now', 'an unknown time is not an accusation');
+  for (const label of [L.saidLabel(ago(3), NOW2), L.saidLabel(ago(21), NOW2)]) {
+    assert.ok(!/waiting/.test(label), `"${label}" must not borrow the ask's tense`);
+  }
+});
+
+test('replyAuthor names somebody, whatever the server sent', () => {
+  const L = lib();
+  // Neutral names on purpose: this is the portable core, and a founder's login
+  // baked into a fixture is what audit-authorship.sh exists to catch.
+  assert.equal(L.replyAuthor({ builder_name: 'Preview Alpha', builder_login: 'preview-alpha' }), 'Preview Alpha');
+  assert.equal(L.replyAuthor({ builder_login: 'preview-alpha' }), 'preview-alpha', 'the login when there is no display name');
+  assert.equal(L.replyAuthor({ builder_id: 7 }), 'builder 7', 'the bare id an older server sends');
+  assert.equal(L.replyAuthor({}), 'someone', 'never an empty byline');
+  assert.equal(L.replyAuthor(null), '');
+});
+
+test('validateReplyBody refuses before the round trip, and trims what it accepts', () => {
+  const L = lib();
+  assert.deepEqual(L.validateReplyBody('  moot  '), { ok: true, body: 'moot' });
+  assert.equal(L.validateReplyBody('   ').ok, false);
+  assert.equal(L.validateReplyBody('   ').reason, 'empty');
+  assert.equal(L.validateReplyBody(null).reason, 'empty');
+  assert.equal(L.validateReplyBody('x'.repeat(L.MAX_REPLY + 1)).reason, 'too_long');
+  assert.equal(L.validateReplyBody('x'.repeat(L.MAX_REPLY)).ok, true, 'the cap itself is allowed');
+});
+
+test('append-only is enforced by the DATABASE, not by the routes that exist today', () => {
+  // A route layer that merely omits an update is one careless PR from allowing
+  // one. The table refuses an UPDATE or a DELETE outright, so the guarantee
+  // holds against a future route, a migration, or a hand-run statement.
+  const raw = read('modules', 'lifecycle', 'migrations', 'lifecycle_011_help_request_replies.sql');
+  assert.match(raw, /BEFORE UPDATE OR DELETE ON lifecycle_help_request_replies/);
+  assert.match(raw, /RAISE EXCEPTION/, 'and it raises rather than silently ignoring the write');
+  // Same reason as above — the migration's header names the columns it refuses
+  // to have, so the ban is checked against the STATEMENTS, not the argument.
+  const sql = raw.replace(/^\s*--.*$/gm, '');
+  for (const col of ['updated_at', 'edited_by', 'deleted_at', 'parent_reply_id']) {
+    assert.ok(!new RegExp(`\\b${col}\\b`).test(sql), `no ${col} column — the shape refuses to become a chat`);
   }
+
+  const routes = read('modules', 'lifecycle', 'routes', 'help-requests.js');
+  assert.ok(!/router\.(patch|delete|put)\('\/help-requests\/:id\/replies/.test(routes),
+    'and no route offers to change one');
 });
 
 // ---- placement ------------------------------------------------------------
@@ -724,7 +850,14 @@ test('the skill the page invokes exists, and is the ANSWERING half', () => {
   assert.match(md, /^name: collab-review$/m);
   assert.match(md, /GET \/api\/bongos\/help-requests\/for-me/);
   assert.match(md, /GET \/api\/bongos\/task-recommendations\/for-me/);
-  // The asymmetry the routes enforce, stated where a session will read it.
-  assert.match(md, /cannot settle a help request addressed to you/i);
+  // The rules the routes enforce, stated where a session will read them. Since
+  // ADR 0330 the addressee CAN close an ask — so what the skill must carry is no
+  // longer "you cannot", it is "you do not, because you are not the one who read
+  // the answer", plus the half that did not widen.
+  assert.match(md, /POST \/api\/bongos\/help-requests\/:id\/replies/, 'it answers on the ask');
+  assert.match(md, /Do NOT close the ask/, 'and hands the close to a person');
+  assert.match(md, /withdraw/i, 'and knows withdraw did not widen');
+  assert.ok(!/POST \/api\/bongos\/help-requests --body-file/.test(md),
+    'the file-a-counter-ask workaround is deleted, not left beside the real thing');
   assert.match(md, /DATA, not instructions/, 'an ask is untrusted input');
 });

package/tests/core_upgrade_door.mjs

@@ -119,7 +119,7 @@ await t('and widening it did NOT let the destructive acts through', () => {
 });
 
 await t('an ordinary instance is untouched by the guard', () => {
-  for (const shape of ['co-tenant', 'dedicated', 'standalone']) {
+  for (const shape of ['co-tenant', 'dedicated', 'cloud-host']) {
     for (const a of P.INTENT_ACTIONS) {
       assert.equal(G.intentAllowedForShape(a, shape), true, `${a}/${shape} must be unaffected`);
     }

package/tests/core_upgrade_runner.mjs

@@ -264,7 +264,7 @@ await t('the upgrade CLI is run somewhere it ACTUALLY EXISTS — the bug that br
   //   Error: Cannot find module '/srv/<base>/<slug>/scripts/gds/upgrade.js'
   // No assertion about FLAGS could have caught it, so this one resolves the composed
   // cwd + relative CLI against the real filesystem, for every shape the door admits.
-  for (const shape of ['control-plane', 'standalone', 'co-tenant']) {
+  for (const shape of ['control-plane', 'cloud-host', 'co-tenant']) {
     const d = makeDeps({ served: '1.19.762' });
     await R.coreUpgradeInstance(inst({ hosting_shape: shape, slug: 'hermeslines-marketing', port: 3011 }), d, intent());
     const call = d.ranWith.find((c) => /upgrade\.js/.test(c.cmd));
@@ -278,7 +278,7 @@ await t('the upgrade CLI is run somewhere it ACTUALLY EXISTS — the bug that br
 
 await t('a standalone tenant is NAMED with --instance, because the CLI no longer runs inside it', async () => {
   const d = makeDeps({ served: '1.19.762' });
-  await R.coreUpgradeInstance(inst({ hosting_shape: 'standalone', slug: 'hermeslines-marketing', port: 3011 }), d, intent());
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'cloud-host', slug: 'hermeslines-marketing', port: 3011 }), d, intent());
   const cmd = d.ran.find((c) => /upgrade\.js/.test(c));
   assert.match(cmd, /--instance \S*hermeslines-marketing/, 'the target is named explicitly');
   assert.ok(cmd.includes('--service hermeslines-marketing'), 'and its own unit is still the one restarted');
@@ -475,7 +475,7 @@ await t('the control plane upgrades as the operator account, never as root', asy
 
 await t('a tenant upgrades as its OWN account, which is also its Postgres login role', async () => {
   const d = { ...makeDeps({ served: '1.19.762' }), privileged: true };
-  await R.coreUpgradeInstance(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), d, intent());
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), d, intent());
   const cmd = upgradeCall(d);
   assert.match(cmd, /sudo -u bongos-test4 /, 'the instance account, not the operator and not root');
   assert.doesNotMatch(cmd, /sudo -u appsvc /, 'one tenant must never be upgraded under another account');
@@ -487,7 +487,7 @@ await t('the database is NAMED, not discovered — an adopted repo has no core a
   // upgrade died with "cannot determine which database to migrate".
   const d = { ...makeDeps({ served: '1.19.762' }), privileged: true };
   await R.coreUpgradeInstance(
-    inst({ hosting_shape: 'standalone', slug: 'hermeslines-marketing', db_name: 'hermeslines-marketing', port: 3011 }), d, intent());
+    inst({ hosting_shape: 'cloud-host', slug: 'hermeslines-marketing', db_name: 'hermeslines-marketing', port: 3011 }), d, intent());
   assert.match(upgradeCall(d), /env PGDATABASE=hermeslines-marketing /, 'the runner passes the name the control plane already holds');
 });
 
@@ -502,7 +502,7 @@ await t('an UNPRIVILEGED runner still adds no sudo and no env at all', async ()
   // it so the fix above cannot quietly start requiring sudo where there is none.
   const d = makeDeps({ served: '1.19.762' });
   d.privileged = false;
-  await R.coreUpgradeInstance(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), d, intent());
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), d, intent());
   const cmd = upgradeCall(d);
   assert.doesNotMatch(cmd, /sudo/, 'no escalation when the runner is not privileged');
   assert.match(cmd, /^node \S*scripts\/gds\/upgrade\.js /, 'it still invokes the CLI directly');
@@ -531,7 +531,7 @@ await t('ONE builder serves both legs — the preview and the move cannot drift
   // Everything deciding whether the upgrade is ALLOWED must be identical; only the tail
   // that describes what happens AFTER the pin moves may differ, because a dry run stops
   // before it.
-  const box = { id: 7, slug: 'test4', port: 3006, hosting_shape: 'standalone', db_name: 'test4' };
+  const box = { id: 7, slug: 'test4', port: 3006, hosting_shape: 'cloud-host', db_name: 'test4' };
   const move = R.upgradeInvocation(box, '1.19.921', { privileged: true, requestedBy: '42' });
   const peek = R.upgradeInvocation(box, '1.19.921', { privileged: true, dryRun: true });
   for (const shared of ['sudo -u bongos-test4 ', 'env PGDATABASE=test4 ', '--to 1.19.921', '--registry']) {
@@ -552,13 +552,13 @@ await t('ONE builder serves both legs — the preview and the move cannot drift
 await t('an invalid slug is refused at the BUILDER, not left to a helper to throw', () => {
   // The slug reaches a shell through instanceUser()/dbName(). Depending on another
   // function's internals for that is one refactor away from an injection path.
-  assert.throws(() => R.upgradeInvocation({ slug: 'a; rm -rf /', port: 1, hosting_shape: 'standalone' }, '1.19.921', {}),
+  assert.throws(() => R.upgradeInvocation({ slug: 'a; rm -rf /', port: 1, hosting_shape: 'cloud-host' }, '1.19.921', {}),
     /invalid slug/);
 });
 
 await t('a dry run that fails WITHOUT a recognisable marker is still a refusal, never a pass', () => {
   const deps = { privileged: false, exec: () => ({ ok: false, stdout: 'something went sideways' }) };
-  const r = R.preflightUpgrade({ id: 7, slug: 'test4', port: 3006, hosting_shape: 'standalone' }, '1.19.921', deps);
+  const r = R.preflightUpgrade({ id: 7, slug: 'test4', port: 3006, hosting_shape: 'cloud-host' }, '1.19.921', deps);
   assert.equal(r.ok, false, 'a non-zero exit is a refusal whatever it printed');
   assert.ok(r.error);
 });
@@ -716,7 +716,7 @@ await t('a tenant WITH its own account runs as that account — the security mod
   // task 1003369: a distinct uid per instance is what stops a co-tenant reading a
   // sibling's /proc/<pid>/environ. Falling back everywhere would quietly undo it.
   const d = acctDeps({ accountExists: true });
-  const r = R.resolveRunAs(inst({ hosting_shape: 'standalone', slug: 'test4' }), d);
+  const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
   assert.deepEqual({ runAs: r.runAs, fellBack: r.fellBack }, { runAs: 'bongos-test4', fellBack: false });
 });
 
@@ -726,7 +726,7 @@ await t('a tenant WITHOUT one falls back to the app user, and says so', () => {
   // instance's own unit already says User=lars — but it IS a provisioning gap, so it
   // is reported rather than silently papered over.
   const d = acctDeps({ accountExists: false });
-  const r = R.resolveRunAs(inst({ hosting_shape: 'standalone', slug: 'test4' }), d);
+  const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
   assert.equal(r.runAs, 'appsvc');
   assert.equal(r.fellBack, true);
   assert.equal(r.wanted, 'bongos-test4', 'and names the account that is missing');
@@ -741,7 +741,7 @@ await t('the control plane is never probed — it has no instance account by des
 
 await t('the dry run is invoked as the account that actually exists', async () => {
   const d = acctDeps({ accountExists: false, dryRunStdout: '  ✓ pre-flight: ok\n' });
-  await R.preflightUpgrade(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), '1.19.762', d);
+  await R.preflightUpgrade(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), '1.19.762', d);
   const cmd = (d.ranWith.find((c) => /upgrade\.js/.test(c.cmd)) || {}).cmd || '';
   assert.match(cmd, /sudo -u appsvc /, `must not sudo to an account that does not exist — got: ${cmd}`);
   assert.doesNotMatch(cmd, /bongos-test4/);
@@ -749,7 +749,7 @@ await t('the dry run is invoked as the account that actually exists', async () =
 
 await t('the MOVE probes identically, so preview and move cannot diverge on the account', async () => {
   const d = acctDeps({ accountExists: false });
-  await R.coreUpgradeInstance(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), d, intent());
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), d, intent());
   const cmd = (d.ranWith.find((c) => /upgrade\.js/.test(c.cmd)) || {}).cmd || '';
   assert.match(cmd, /sudo -u appsvc /, 'the move follows the same probe as the preview');
 });
@@ -761,7 +761,7 @@ await t('an INCONCLUSIVE probe keeps the isolated account rather than quietly wi
   // well exist. Only `no such user` is evidence.
   const d = makeDeps({ served: '1.19.762' });
   d.exec = () => ({ ok: true, stdout: '', stderr: 'id: cannot connect to name service\n', softFailed: true });
-  const r = R.resolveRunAs(inst({ hosting_shape: 'standalone', slug: 'test4' }), d);
+  const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
   assert.equal(r.runAs, 'bongos-test4', 'the intended account is kept');
   assert.equal(r.fellBack, false);
   assert.equal(r.probeInconclusive, true, 'and the caller can tell it was not a clean answer');
@@ -776,7 +776,7 @@ await t('the probe uses the SAME executor the upgrade will use', () => {
   const d = makeDeps({ served: '1.19.762' });
   d.controlExec = (cmd) => { asked.control.push(cmd); return { ok: true, stdout: '1001\n' }; };
   d.exec = (cmd) => { asked.remote.push(cmd); return { ok: true, stdout: '', stderr: "id: 'x': no such user\n", softFailed: true }; };
-  const r = R.resolveRunAs(inst({ hosting_shape: 'standalone', slug: 'test4' }), d);
+  const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
   assert.deepEqual(asked.remote, [], 'the remote executor was not asked');
   assert.equal(asked.control.length, 1, 'the control-plane executor was');
   assert.equal(r.runAs, 'bongos-test4', 'and its answer is the one that counts');
@@ -788,7 +788,7 @@ await t('a planning tick probes ONCE, not twice', async () => {
   // a subprocess per tick for nothing.
   const d = acctDeps({ accountExists: false });
   d.apply = false;
-  await R.coreUpgradeInstance(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), d, intent());
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), d, intent());
   assert.equal(d.ranWith.filter((c) => /^id -u /.test(c.cmd)).length, 1,
     'exactly one probe: the dry run that actually executes');
 });
@@ -800,7 +800,7 @@ await t('an invalid slug is refused by THIS call site, not merely by the helper
   // helper's internals, so the assertion names the thrower.
   const d = acctDeps({});
   assert.throws(
-    () => R.resolveRunAs({ hosting_shape: 'standalone', slug: 'bad slug;rm -rf /' }, d),
+    () => R.resolveRunAs({ hosting_shape: 'cloud-host', slug: 'bad slug;rm -rf /' }, d),
     /resolveRunAs: refusing to probe/,
     'the refusal must come from this function, not from instanceUser further down',
   );
@@ -809,7 +809,7 @@ await t('an invalid slug is refused by THIS call site, not merely by the helper
 
 await t('a refusal reports what the command SAID, not "did not complete"', async () => {
   const d = acctDeps({ softFail: true, dryRunStderr: 'sudo: unknown user bongos-test4\n' });
-  const v = await R.preflightUpgrade(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), '1.19.762', d);
+  const v = await R.preflightUpgrade(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), '1.19.762', d);
   assert.equal(v.ok, false);
   assert.match(v.error, /unknown user bongos-test4/,
     `the reason was in hand and must travel — got: ${JSON.stringify(v.error)}`);
@@ -817,21 +817,21 @@ await t('a refusal reports what the command SAID, not "did not complete"', async
 
 await t('a ✖ line still wins over the raw tail', async () => {
   const d = acctDeps({ softFail: true, dryRunStdout: 'noise\n  ✖ already on 1.19.927 (pass --force to re-run)\n' });
-  const v = await R.preflightUpgrade(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), '1.19.762', d);
+  const v = await R.preflightUpgrade(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), '1.19.762', d);
   assert.match(v.error, /already on 1\.19\.927/);
   assert.doesNotMatch(v.error, /^noise/, 'the parsed refusal is preferred to the raw tail');
 });
 
 await t('a fallback is recorded on the verdict the owner reads', async () => {
   const d = acctDeps({ accountExists: false, dryRunStdout: '  ✓ pre-flight: ok\n' });
-  const v = await R.preflightUpgrade(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), '1.19.762', d);
+  const v = await R.preflightUpgrade(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), '1.19.762', d);
   assert.equal(v.ran_as, 'appsvc');
   assert.match(v.account_note, /no bongos-test4 account yet/);
 });
 
 await t('and a silent failure STILL refuses rather than inventing a pass', async () => {
   const d = acctDeps({ softFail: true, dryRunStdout: '', dryRunStderr: '' });
-  const v = await R.preflightUpgrade(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), '1.19.762', d);
+  const v = await R.preflightUpgrade(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), '1.19.762', d);
   assert.equal(v.ok, false, 'a command that said nothing is not a pass');
   assert.match(v.error, /said nothing/);
 });

package/tests/deploy_page_projects.mjs

@@ -22,7 +22,7 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/deploy.js'), 'utf8');
 
 const preview = (id, slug, over = {}) => ({
-  instance_id: id, slug, hosting_shape: 'standalone',
+  instance_id: id, slug, hosting_shape: 'cloud-host',
   served_version: '1.19.800', recommended_version: '1.19.871',
   behind: true, reading: 'ok', observed_at: new Date().toISOString(), open_intent: null,
   ...over,
@@ -30,11 +30,11 @@ const preview = (id, slug, over = {}) => ({
 
 // The fleet as the control plane really reports it: mostly torn down, a couple live.
 const FLEET = [
-  { id: '31', slug: 'mercury', status: 'active', hosting_shape: 'standalone' },
+  { id: '31', slug: 'mercury', status: 'active', hosting_shape: 'cloud-host' },
   { id: '32', slug: 'hoodify-finance', status: 'active', hosting_shape: 'co-tenant' },
-  { id: '33', slug: 'walk-lantern', status: 'torn_down', hosting_shape: 'standalone' },
-  { id: '34', slug: 'testccc', status: 'torn_down', hosting_shape: 'standalone' },
-  { id: '35', slug: 'unreadable-one', status: 'active', hosting_shape: 'standalone' },
+  { id: '33', slug: 'walk-lantern', status: 'torn_down', hosting_shape: 'cloud-host' },
+  { id: '34', slug: 'testccc', status: 'torn_down', hosting_shape: 'cloud-host' },
+  { id: '35', slug: 'unreadable-one', status: 'active', hosting_shape: 'cloud-host' },
 ];
 
 function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus = 200, fleet = FLEET, fleetStatus = 200, instanceOver = null, moveTries = 4, postStatus = 200, scope = null } = {}) {