@bongos/core 1.19.999 → 1.19.1000

package/tests/hall_collab_world.mjs

@@ -108,8 +108,12 @@ test('the server names the people on a row through a join, and the writes stay b
     const body = src.slice(src.indexOf(`async function ${fn}`));
     assert.match(body.slice(0, 700), /SELECT \$\{LIST_COLS\} \$\{LIST_FROM\}/, `${fn} reads the joined columns`);
   }
-  const upd = src.slice(src.indexOf('async function setHelpRequestStatus'));
-  assert.match(upd.slice(0, 600), /RETURNING \$\{COLS\}/, 'the UPDATE cannot reach a joined alias, so it returns the bare columns');
+  // Sliced to the end of the function rather than a character count: task
+  // 1004216 widened who may settle, so the body grew past the old 600-char
+  // window and a fixed slice would report the property missing when it is there.
+  const from = src.indexOf('async function setHelpRequestStatus');
+  const upd = src.slice(from, src.indexOf('\n}', from));
+  assert.match(upd, /RETURNING \$\{COLS\}/, 'the UPDATE cannot reach a joined alias, so it returns the bare columns');
 });
 
 test('the first line is decided: the ask\'s first sentence is the title, the rest the sub, no word lost', () => {

package/tests/help_requests.mjs

@@ -141,11 +141,62 @@ test('the addressed read excludes your own requests', () => {
   assert.match(fn.slice(0, 700), /status = 'open'/, 'and settled requests are history');
 });
 
-test('only the ASKER can settle their own request', () => {
-  const src = read('modules', 'lifecycle', 'help-requests.js');
-  const fn = src.slice(src.indexOf('async function setHelpRequestStatus'));
-  assert.match(fn.slice(0, 600), /requested_by = \$2/, 'ownership is in the WHERE, not in rank');
-  assert.match(fn.slice(0, 600), /status = 'open'/, 'and a settled request cannot be re-settled');
+// WHO MAY SETTLE — widened by task 1004216 / ADR 0330, and RUN rather than
+// grepped, because the rule is now a shape (asker OR addressee, except for
+// withdraw) that a source scan would agree with while the SQL said otherwise.
+async function settleSql(args) {
+  const calls = [];
+  const pool = { query: async (sql, params) => { calls.push({ sql, params }); return { rows: [{ id: 1 }] }; } };
+  await help.setHelpRequestStatus(args, { pool });
+  return calls[0];
+}
+
+test('the asker still settles, and the rule lives in the WHERE rather than in rank', async () => {
+  const c = await settleSql({ id: 1, builderId: 7, status: 'answered', crafts: [] });
+  assert.match(c.sql, /requested_by = \$2/, 'ownership is in the WHERE, not in rank');
+  assert.match(c.sql, /status = 'open'/, 'and a settled request cannot be re-settled');
+});
+
+test('the ADDRESSEE can close an ask too — by name, or through a craft they belong to', async () => {
+  // The defect this fixes: a request addressed to someone who has just answered
+  // it on the page, and still cannot close it, is a surface arguing with itself.
+  const c = await settleSql({ id: 1, builderId: 7, status: 'answered', crafts: ['artist'] });
+  assert.match(c.sql, /needs_builder_id = \$2/, 'the person a request names');
+  assert.match(c.sql, /needs_craft = ANY\(\$5::text\[\]\)/, 'or a craft they belong to');
+  assert.deepEqual(c.params[4], ['artist'], 'and the crafts are bound, never interpolated');
+  assert.equal(c.params[3], false, 'the asker-only switch is off for answered');
+});
+
+test('WITHDRAW stays the asker\'s alone — an addressee cannot make an ask disappear', async () => {
+  // Withdrawing means "I no longer need this", which only the person who needed
+  // it can say. An addressee who wants rid of an ask answers it and closes it,
+  // in the open, with their name on both.
+  const c = await settleSql({ id: 1, builderId: 7, status: 'withdrawn', crafts: ['artist'] });
+  assert.equal(c.params[3], true, 'the asker-only switch is ON for withdrawn');
+  assert.match(c.sql, /\$4::boolean IS FALSE/, 'and it gates the addressee branch, not the asker one');
+});
+
+test('a craft the caller does not hold is filtered out before it binds', async () => {
+  // The same fail-closed rule the addressed read learned the hard way: a craft
+  // value that did not come from the caller's own profile must never widen a
+  // scope. Here it would let anyone close any craft-addressed ask.
+  const c = await settleSql({ id: 1, builderId: 7, status: 'answered', crafts: ['wizard', 'artist'] });
+  assert.deepEqual(c.params[4], ['artist'], 'an unknown craft is dropped, not passed through');
+});
+
+test('settling records WHO settled it', async () => {
+  const c = await settleSql({ id: 1, builderId: 7, status: 'answered', crafts: [] });
+  assert.match(c.sql, /settled_by = \$2/, 'now that two different people can close an ask, which one matters');
+});
+
+test('the route takes the caller\'s crafts from their PROFILE, never from the body', () => {
+  // C01's privacy hole was a caller-supplied craft widening a scope. The same
+  // value now decides who may CLOSE an ask, so it comes from the same place.
+  const routes = read('modules', 'lifecycle', 'routes', 'help-requests.js');
+  const idx = routes.indexOf("'PATCH /help-requests/:id'");
+  const body = routes.slice(idx, routes.indexOf('errorCode', idx));
+  assert.match(body, /craftsForBuilder\(req\.builder\.id\)/, 'read from the profile');
+  assert.ok(!/req\.body\.craft|req\.query\.craft/.test(body), 'and never from the caller');
 });
 
 // ---- it stands alone ------------------------------------------------------
@@ -217,7 +268,13 @@ test('the settle refusal no longer lets you enumerate ids', () => {
   // The comment claimed one refusal for three cases; the code looked the row up
   // and said which. Comment and code now agree.
   const routes = read('modules', 'lifecycle', 'routes', 'help-requests.js');
-  const patch = routes.slice(routes.indexOf("'PATCH /help-requests/:id'"));
+  // Scoped to the PATCH HANDLER, not to the rest of the file. Task 1004216 added
+  // the reply routes after it, and one of them looks a request up on purpose —
+  // a reply to an id that never existed should be a named 404 rather than an FK
+  // violation rendered as a 500. Slicing to the end of the file would read that
+  // lookup as this handler's and report a hole that is not here.
+  const from = routes.indexOf("'PATCH /help-requests/:id'");
+  const patch = routes.slice(from, routes.indexOf('help_request_update_failed', from));
   assert.ok(!/getHelpRequest/.test(patch), 'no existence lookup in the refusal path');
   const reasons = patch.match(/reason: '[^']+'/g) || [];
   assert.equal(reasons.length, 1, `exactly one refusal reason, got ${reasons}`);
@@ -309,3 +366,141 @@ test('a help request addressed to a non-existent builder is a named 400', () =>
   assert.match(routes, /builderExists/);
   assert.match(routes, /no_such_builder/, 'the refusal names the field, not an FK 500');
 });
+
+// ---- replies (task 1004216, ADR 0330) --------------------------------------
+//
+// An ask could be filed and settled and never ANSWERED — the person being asked
+// had no write at all, so the answer happened somewhere the project could not
+// see, and the row sat open until its author remembered it.
+test('a reply must say something, and cannot say more than an ask', () => {
+  const why = (input) => help.validateReply(input).errors.map((e) => e.reason);
+  assert.deepEqual(why({ body: 'the metrics stack was removed on the 15th' }), []);
+  assert.deepEqual(why({ body: '   ' }), ['required'], 'whitespace is not an answer');
+  assert.deepEqual(why({}), ['required']);
+  assert.deepEqual(why({ body: 'x'.repeat(help.MAX_REPLY + 1) }), ['too_long']);
+  assert.equal(help.MAX_REPLY, help.MAX_STUCK, 'an answer may be as long as the question');
+});
+
+test('a reply is stored trimmed, against the ask it answers', async () => {
+  const calls = [];
+  const pool = { query: async (sql, params) => { calls.push({ sql, params }); return { rows: [{ id: 5 }] }; } };
+  await help.createReply({ helpRequestId: 11, builderId: 3, body: '  moot, it was removed  ' }, { pool });
+  assert.match(calls[0].sql, /INSERT INTO lifecycle_help_request_replies/);
+  assert.deepEqual(calls[0].params, [11, 3, 'moot, it was removed']);
+});
+
+test('a thread reads OLDEST FIRST — it is a conversation, not a queue', async () => {
+  const calls = [];
+  const pool = { query: async (sql, params) => { calls.push({ sql, params }); return { rows: [] }; } };
+  await help.listReplies(11, { pool });
+  assert.match(calls[0].sql, /ORDER BY r\.created_at ASC, r\.id ASC/,
+    'and ties break on id, so two replies in the same second keep their order');
+  assert.match(calls[0].sql, /builder_login|builder_name/, 'it names who said it');
+});
+
+test('every thread on a page is ONE query, not one per row', async () => {
+  // A list read renders a thread under every ask. Per-row fetching is what makes
+  // a page slow for reasons no single request explains.
+  const calls = [];
+  const pool = {
+    query: async (sql, params) => {
+      calls.push({ sql, params });
+      return { rows: [{ id: 1, help_request_id: '11', body: 'a' }, { id: 2, help_request_id: '12', body: 'b' }] };
+    },
+  };
+  const map = await help.repliesForRequests(['11', '12', '11'], { pool });
+  assert.equal(calls.length, 1, 'one round trip for the whole page');
+  assert.deepEqual(calls[0].params, [[11, 12]], 'de-duplicated, and bound as an array');
+  assert.equal(map.get('11').length, 1);
+  assert.equal(map.get('12').length, 1);
+});
+
+test('reading the replies of an unknown ask answers [] — a 404 there would be an id oracle', async () => {
+  // The asymmetry with POST (which DOES 404) is deliberate. This surface already
+  // learned once that an existence lookup on a refusal path lets a caller
+  // enumerate ids; a 404 on a GET rebuilds that oracle on the cheapest possible
+  // request. The POST can afford it because it is a write.
+  const routes = read('modules', 'lifecycle', 'routes', 'help-requests.js');
+  const idx = routes.indexOf("'GET /help-requests/:id/replies'");
+  assert.ok(idx > 0, 'the route exists');
+  const body = routes.slice(idx, routes.indexOf('errorCode', idx));
+  assert.ok(!/getHelpRequest|not_found/.test(body), 'no existence lookup, no 404');
+
+  const pool = { query: async () => ({ rows: [] }) };
+  assert.deepEqual(await help.listReplies(999999, { pool }), [], 'and the read itself is happy to find nothing');
+});
+
+test('the bulk thread read is BOUNDED, and bounded PER ASK', async () => {
+  // listReplies caps at MAX_ROWS; this one backs three list routes on the page's
+  // own load path, so an unbounded result set would be the one place a busy
+  // project could make Collab arrive by the megabyte (grader).
+  //
+  // Per-ask, not one global LIMIT: a global cap lets one busy ask eat the budget
+  // and hands the rows below it empty threads, which reads as "nobody answered" —
+  // the exact lie this surface exists to stop telling.
+  const calls = [];
+  const pool = { query: async (sql, params) => { calls.push({ sql, params }); return { rows: [] }; } };
+  await help.repliesForRequests([11, 12], { pool });
+  assert.match(calls[0].sql, /ROW_NUMBER\(\) OVER \(PARTITION BY r\.help_request_id/, 'the window is per ask');
+  assert.match(calls[0].sql, new RegExp(`thread_pos <= ${help.MAX_THREAD_ON_LIST}`), 'and it is capped');
+  assert.ok(help.MAX_THREAD_ON_LIST > 0 && help.MAX_THREAD_ON_LIST <= help.MAX_ROWS);
+  // The order inside the window must match the single-thread read's, or the
+  // first N a list shows are a different N in a different order.
+  assert.match(calls[0].sql, /ORDER BY r\.created_at ASC, r\.id ASC\) AS thread_pos/);
+});
+
+test('asking for no threads asks the database nothing', async () => {
+  const pool = { query: async () => { throw new Error('must not query'); } };
+  const map = await help.repliesForRequests([], { pool });
+  assert.equal(map.size, 0);
+});
+
+test('a row without replies carries an EMPTY list, never a missing field', () => {
+  // A reader must never have to tell "no replies" apart from "this response does
+  // not carry replies" — the second is how a page decides to hide a thread that
+  // is really there.
+  const routes = read('modules', 'lifecycle', 'routes', 'help-requests.js');
+  assert.match(routes, /replies: threads\.get\(String\(r\.id\)\) \|\| \[\]/);
+  for (const route of ["'GET /help-requests/for-me'", "'GET /help-requests/mine'", "'GET /help-requests'"]) {
+    const idx = routes.indexOf(route);
+    assert.ok(idx > 0, `${route} exists`);
+    const body = routes.slice(idx, routes.indexOf('errorCode', idx));
+    assert.match(body, /withReplies\(/, `${route} carries its threads`);
+  }
+});
+
+test('there is no way to edit or delete a reply, at either layer', () => {
+  const routes = read('modules', 'lifecycle', 'routes', 'help-requests.js');
+  assert.ok(!/router\.(patch|put|delete)\('\/help-requests\/:id\/replies/.test(routes), 'no route');
+  const src = read('modules', 'lifecycle', 'help-requests.js');
+  assert.ok(!/function (update|delete|edit)Reply/i.test(src), 'no data function');
+  // And the table refuses regardless — the guarantee must not rest on the routes
+  // that happen to exist today.
+  const sql = read('modules', 'lifecycle', 'migrations', 'lifecycle_011_help_request_replies.sql');
+  assert.match(sql, /BEFORE UPDATE OR DELETE ON lifecycle_help_request_replies/);
+});
+
+test('the FK RESTRICTS — append-only and ON DELETE CASCADE cannot both be true', () => {
+  // A real bug, caught by applying this migration to a live Postgres rather than
+  // by reading it. The first draft cascaded, because "a reply has no meaning
+  // without the ask it answers" reads right — but a cascade IS a plain DELETE on
+  // the replies table, the append-only trigger refuses it, and deleting a help
+  // request that had ever been answered failed outright with a trigger error.
+  const sql = read('modules', 'lifecycle', 'migrations', 'lifecycle_011_help_request_replies.sql');
+  assert.match(sql, /REFERENCES lifecycle_help_requests\(id\) ON DELETE RESTRICT/);
+  assert.ok(!/ON DELETE CASCADE/.test(sql.replace(/^\s*--.*$/gm, '')),
+    'no cascade in the statements — it would be refused by the trigger below it');
+});
+
+test('a reply to an ask that never existed is a named 404, not an FK 500', () => {
+  const routes = read('modules', 'lifecycle', 'routes', 'help-requests.js');
+  const idx = routes.indexOf("'POST /help-requests/:id/replies'");
+  assert.ok(idx > 0, 'the route exists');
+  const body = routes.slice(idx, routes.indexOf('errorCode', idx));
+  assert.match(body, /getHelpRequest\(id\)/);
+  assert.match(body, /help_request_not_found/);
+  // The guard sits on the router line, ahead of the handler's own label — the
+  // same place the board read's test looks for it.
+  const line = routes.slice(routes.lastIndexOf('router.post', idx), idx);
+  assert.match(line, /api\.requireBuilder/, 'signed in, like every other route here');
+});

package/tests/hub_disconnect_ui.mjs

@@ -85,7 +85,10 @@ test('the render guards a half-typed name per project, names an open run, and of
 
 test('the ender no longer claims nothing on the page erases — it scopes that to itself and points at the card', () => {
   const truth = fn('teardownTruth');
-  assert.equal((truth.match(/until you bring it back\. Taking it offline erases nothing\.'/g) || []).length, 2, 'both shapes');
+  // Was 2 — one per hosting-shape branch. Task 1004182 left one branch (ADR 0327 decision 4
+  // removed 'dedicated'), so the count is 1. The property this case is really about is that
+  // the ender's reassurance is scoped to ITSELF, which the assertions below carry.
+  assert.equal((truth.match(/until you bring it back\. Taking it offline erases nothing\.'/g) || []).length, 1, 'the built-world truth ends on the reassurance');
   assert.doesNotMatch(HUB, /Nothing here erases a project/);
   const delFold = (HUB.match(/<details class="finePrint" id="mDelWhat">[\s\S]*?<\/details>/) || [''])[0];
   assert.doesNotMatch(delFold, /no permanent-delete button/i, 'the capability exists now');

package/tests/init.mjs

@@ -240,8 +240,8 @@ test('provisioningRequest: null unless opted in; builds the POST body when opted
   assert.equal(init.provisioningRequest(fullSpec()), null);              // no block → not requested
   const co = init.provisioningRequest(provSpec({}));                     // empty block = opted in, defaults
   assert.deepEqual(co, { slug: 'cloud-bongos', hosting_shape: 'byo-host' });
-  const full = init.provisioningRequest(provSpec({ shape: 'dedicated', domain: 'example.com', targetRef: 'do:main', tier: 's-1vcpu-2gb' }));
-  assert.deepEqual(full, { slug: 'cloud-bongos', hosting_shape: 'dedicated', domain: 'example.com', target_ref: 'do:main', tier: 's-1vcpu-2gb' });
+  const full = init.provisioningRequest(provSpec({ shape: 'cloud-host', domain: 'example.com', targetRef: 'do:main', tier: 's-1vcpu-2gb' }));
+  assert.deepEqual(full, { slug: 'cloud-bongos', hosting_shape: 'cloud-host', domain: 'example.com', target_ref: 'do:main', tier: 's-1vcpu-2gb' });
 });
 
 test('provisioningRequest: unknown shape falls back to byo-host, the free front door', () => {
@@ -256,7 +256,7 @@ test('kickoffTasks: provisioning requested → production-topology is AUTOMATED
     firstAdmin: 'x', version: { id: 'V1', name: 'V1', done_when: 'x' } };
   const manual = init.kickoffTasks(init.normalizeSpec(baseSpec));        // no provisioning
   assert.ok(manual.some((t) => /Production topology/i.test(t.title)), 'manual keeps the production-topology task');
-  const withProv = init.kickoffTasks(init.normalizeSpec({ ...baseSpec, provisioning: { shape: 'dedicated' } }));
+  const withProv = init.kickoffTasks(init.normalizeSpec({ ...baseSpec, provisioning: { shape: 'cloud-host' } }));
   assert.ok(!withProv.some((t) => /Production topology/i.test(t.title)), 'provisioning drops the production-topology task');
   assert.equal(withProv.length, manual.length - 1, 'exactly one fewer kickoff task');
   assert.ok(withProv.some((t) => /OAuth/i.test(t.title)), 'OAuth stays manual');
@@ -272,7 +272,7 @@ test('normalizeSpec: coerces the provisioning block; drops it when absent', () =
 });
 
 test('validateSpec: valid provisioning passes; flags an underivable slug', () => {
-  assert.deepEqual(init.validateSpec(provSpec({ shape: 'dedicated' })), []);
+  assert.deepEqual(init.validateSpec(provSpec({ shape: 'cloud-host' })), []);
   // productName 'x' slugifies to a 1-char slug (< the module's 2-char floor) and no
   // explicit provisioning.slug overrides it → flagged before the server 400s.
   const bad = init.normalizeSpec({ identity: { productName: 'x' }, repo: { owner: 'o', name: 'n' }, firstAdmin: 'x',
@@ -642,12 +642,12 @@ async function runSeedTests() {
 
   await at('seedViaApi: provisioning success → POSTs the request, no manual topo task, provisioned:true', async () => {
     const api = fakeApi([['/provisioning/instances', { ok: true, status: 201, data: { instance: { cost_estimate_usd: 12 } } }]]);
-    const out = await init.seedViaApi(provSpec({ shape: 'dedicated', domain: 'x.example.com', tier: 's-1vcpu-2gb' }), { log: () => {}, api });
+    const out = await init.seedViaApi(provSpec({ shape: 'cloud-host', domain: 'x.example.com', tier: 's-1vcpu-2gb' }), { log: () => {}, api });
     assert.equal(out.provisioned, true);
     const prov = api.calls.find((c) => c.path.includes('/provisioning/instances'));
     assert.ok(prov, 'POSTed the provisioning request');
     assert.equal(prov.body.slug, 'cloud-bongos');
-    assert.equal(prov.body.hosting_shape, 'dedicated');
+    assert.equal(prov.body.hosting_shape, 'cloud-host');
     assert.ok(!findTaskPost(api, /Production topology/), 'production-topology NOT filed as a manual task');
   });
 

package/tests/onboard.mjs

@@ -129,8 +129,9 @@ test('onboardPlan lists repo-auth as an AUTO, control-plane step between scaffol
   const step = plan.find((s) => s.key === 'repo-auth');
   assert.ok(step, 'the plan carries a repo-auth step');
   assert.equal(step.kind, 'auto', 'the runner mints + registers the key — no routine owner action');
-  assert.deepEqual(step.shapes, ['standalone', 'co-tenant', 'dedicated'],
-    'self-host has no platform runner, so its plan must not promise this leg');
+  assert.deepEqual(step.shapes, ['cloud-host', 'co-tenant'],
+    'byo-host has no platform runner, so its plan must not promise this leg');
+  assert.ok(!step.shapes.includes('byo-host'), 'named explicitly: the shape without a runner is the one that must be absent');
   assert.ok(keys.indexOf('scaffold') < keys.indexOf('repo-auth'), 'the checkout exists before it can be wired');
   assert.ok(keys.indexOf('repo-auth') < keys.indexOf('provision'), 'wired before the provision leg whose pull needs it');
   assert.match(step.label, /read-only deploy key/, 'the label says what the key can and cannot do');
@@ -253,13 +254,13 @@ test('buildInitSpec maps answers to a STANDALONE init spec (domain → origin +
   assert.equal(spec.repo.name, 'mercury');
   assert.equal(spec.firstAdmin, 'acme');
   assert.equal(spec.domains.publicOrigin, 'https://mercury.example.com');
-  assert.equal(spec.provisioning.shape, 'standalone');
+  assert.equal(spec.provisioning.shape, 'cloud-host');
   assert.equal(spec.provisioning.slug, 'mercury');
 });
 
 test('buildInitSpec without a domain still defaults a standalone provisioning shape by slug', () => {
   const spec = ob.buildInitSpec({ productName: 'X', repoOwner: 'o', repoName: 'x', slug: 'x' });
-  assert.equal(spec.provisioning.shape, 'standalone');
+  assert.equal(spec.provisioning.shape, 'cloud-host');
   assert.equal(spec.provisioning.domain, null);
   assert.equal(spec.domains, undefined);
 });

package/tests/project_catalog_backfill.mjs

@@ -42,7 +42,7 @@ const feed = require('../modules/platform-identity/projects-feed.js');
 // something puts it there. Instance 18's shape — the one whose owner could not invite anyone.
 const STANDALONE = Object.freeze({
   id: 18, slug: 'spike-harbor', domain: 'spike-harbor.cloudbongos.test',
-  hosting_shape: 'standalone', status: 'active', owner_builder_id: 42,
+  hosting_shape: 'cloud-host', status: 'active', owner_builder_id: 42,
   description: 'A harbour for spikes.', type: 'research',
   settings: { visibility: 'public' },
 });

package/tests/project_catalog_bridge.mjs

@@ -51,7 +51,7 @@ function mockPool(responses = []) {
 // R18 proof watched reach `publishable: true` and never reach the map.
 const STANDALONE = Object.freeze({
   id: 18, slug: 'spike-harbor', domain: 'spike-harbor.cloudbongos.test',
-  hosting_shape: 'standalone', status: 'active', owner_builder_id: 42,
+  hosting_shape: 'cloud-host', status: 'active', owner_builder_id: 42,
   description: 'A harbour for spikes.', type: 'research',
   settings: { visibility: 'public', joinability: 'apply' },
 });
@@ -78,7 +78,7 @@ test('a standalone instance projects a complete catalog entry', () => {
 test('the projection is BLIND to hosting shape — the old gate is what this task deletes', () => {
   // shouldFederate() refused anything that was not 'co-tenant', which made hosting topology
   // decide who is on the map. ADR 0182 D4 says the gate is IDENTITY. Three shapes, one row.
-  const shapes = ['standalone', 'co-tenant', 'dedicated'].map((hosting_shape) =>
+  const shapes = ['cloud-host', 'co-tenant', 'dedicated'].map((hosting_shape) =>
     bridge.catalogEntryForInstance({ ...STANDALONE, hosting_shape }, { ownerGithubId: 9001 }));
   assert.deepEqual(shapes[0], shapes[1]);
   assert.deepEqual(shapes[1], shapes[2]);

package/tests/project_catalog_routes.mjs

@@ -38,7 +38,7 @@ const api = require('../src/module-api.js');
 const OWNER = { id: 7, github_login: 'owner', rank: 'thetes' };
 const BASE_ROW = Object.freeze({
   id: 18, slug: 'spike-harbor', domain: 'spike-harbor.cloudbongos.test',
-  hosting_shape: 'standalone', status: 'active', owner_builder_id: 7,
+  hosting_shape: 'cloud-host', status: 'active', owner_builder_id: 7,
   description: null, type: 'research', settings: { visibility: 'public' },
   released_domains: [], cost_estimate_usd: 0,
 });
@@ -130,10 +130,10 @@ function call(method, path, body) {
 beforeEach(() => { instance = { ...BASE_ROW }; published = []; healed = []; });
 
 test('CREATE catalogues the project at birth, whatever its hosting shape', async () => {
-  // The wizard hard-codes hosting_shape 'standalone', which is exactly the shape
+  // The wizard hard-codes hosting_shape 'cloud-host', which is exactly the shape
   // shouldFederate() refused — so this is the call that ends "never catalogued at all".
   const res = await call('POST', '/provisioning/instances', {
-    slug: 'spike-harbor', hosting_shape: 'standalone', description: 'A harbour for spikes.',
+    slug: 'spike-harbor', hosting_shape: 'cloud-host', description: 'A harbour for spikes.',
   });
   assert.equal(res.status, 201);
   assert.equal(published.length, 1);
@@ -145,7 +145,7 @@ test('CREATE catalogues even when the owner SKIPS the description', async () =>
   // Skipping is the supported default: the row exists, the publish gate keeps it dark
   // matter, and PATCH …/detail is the way back onto the map. The row has to be there for
   // that way back to reach anything.
-  const res = await call('POST', '/provisioning/instances', { slug: 'spike-harbor', hosting_shape: 'standalone' });
+  const res = await call('POST', '/provisioning/instances', { slug: 'spike-harbor', hosting_shape: 'cloud-host' });
   assert.equal(res.status, 201);
   assert.equal(published.length, 1);
   assert.equal(published[0].row.description, null);

package/tests/projects_hub.mjs

@@ -2186,7 +2186,7 @@ test('the wizard\'s own structures wear the world: hairline fields, cells of one
   assert.match(HUB, /<h2 class="stepsHead" id="doneStepsHead">Your steps — the parts only you can play<\/h2>/, 'the steps heading is the label face by class, not an inline style (the id is where a skipped invite step hands focus on, task 1002346)');
   // what is enqueued is unchanged (ADR 0111): the filing body the control plane reads
   assert.match(SCRIPT, /body: JSON\.stringify\(\{\s*slug: state\.slug,/, 'the filing still carries the slug first');
-  assert.match(SCRIPT, /hosting_shape: 'standalone',/, 'the shape is unchanged');
+  assert.match(SCRIPT, /hosting_shape: 'cloud-host',/, 'the shape is unchanged');
   assert.match(SCRIPT, /target_ref: state\.owner \+ '\/' \+ state\.repo,/, 'the repo ref is unchanged');
   assert.match(SCRIPT, /onboard_mode: state\.mode === 'adopt' \? 'adopt' : 'greenfield'/, 'the onboard mode is unchanged');
   // the kit walks every step and files against the stub

package/tests/projects_hub_pre_uat.mjs

@@ -78,7 +78,11 @@ test('the restart door appears ONLY where it has a reason to exist, and mirrors
   assert.match(body, /inst\.last_verified_up === false/, 'the probe verdict is the trigger — a healthy card grows no Restart button');
   assert.doesNotMatch(body, /last_verified_up === null|!inst\.last_verified_up/,
     'null (never probed) is deliberately NOT the same claim as false — publicInstance keeps the two apart');
-  assert.match(body, /inst\.hosting_shape !== 'dedicated'/, 'RESTART_SHAPES — the runner has no exec path to a droplet');
+  // The shape term is gone: it excluded 'dedicated', which ADR 0327 decision 4 removed and
+  // task 1004182 folded into 'cloud-host'. A `!== 'dedicated'` test against a value no row
+  // can hold is always true, so keeping it would have been a condition that reads like a
+  // guard and guards nothing.
+  assert.doesNotMatch(body, /hosting_shape/, 'no shape term survives — the one it excluded no longer exists');
   assert.match(body, /!inst\.open_intent/, 'the strip tells the story while work is in flight');
 });
 
@@ -237,7 +241,7 @@ test('no wall-clock promises, no operator vocabulary on the stranger’s path',
   assert.doesNotMatch(HUB, /about five minutes/, 'the empty state');
   assert.doesNotMatch(HUB, /a runner does the real work/, 'the mine fine print');
   assert.doesNotMatch(SCRIPT, /pinned platform core/, 'the review Shape row');
-  /* The wizard creates hosting_shape 'standalone', whose owner-facing name became
+  /* The wizard creates hosting_shape 'cloud-host', whose owner-facing name became
      "cloud host" at ADR 0323 — "its own server" was ambiguous between that shape and
      a dedicated one, and said nothing about WHO runs it. The assertion still guards the
      same property this test is about: owner vocabulary, and no wall-clock promise. */
@@ -443,7 +447,14 @@ test('decision 6 — the manage section is "Take it offline", and the teardown t
   assert.doesNotMatch(HUB, /Delete the project/, 'the word "Delete" no longer promises an erase anywhere on the page');
   const truth = fn('teardownTruth');
   // scoped to THIS control since task 1003249: the page now also carries the true delete
-  assert.equal((truth.match(/until you bring it back\. Taking it offline erases nothing\.'/g) || []).length, 2, 'both hosting shapes end on the same sentence');
+  // Was 2 — one per hosting-shape branch, asserting they ENDED THE SAME WAY. Task 1004182
+  // left one branch (ADR 0327 decision 4 removed 'dedicated'), so the count is 1 and the
+  // "same sentence" property is now structural rather than checked. What the owner's
+  // decision 6 actually demands is that the reassurance is there and is the LAST thing said,
+  // so assert that instead of a branch count that only records how many shapes exist.
+  assert.equal((truth.match(/until you bring it back\. Taking it offline erases nothing\.'/g) || []).length, 1, 'the built-world truth ends on the reassurance');
+  assert.ok(!truth.slice(truth.indexOf('Taking it offline erases nothing.')).includes('return '),
+    'and it is the LAST thing teardownTruth returns — no arm answers after the reassurance');
 });
 
 test('decision 5 — the Type step says where the type can be changed (task 1003504)', () => {
@@ -568,8 +579,14 @@ test('teardown copy is state-aware: a queued project is told nothing was built',
   const truth = fn('teardownTruth');
   assert.match(truth, /if \(inst && inst\.status === 'requested'\) return 'Nothing has been stood up yet — this cancels the standup\. Anything already on GitHub is untouched, and the name and web address stay reserved for this project\.';/);
   const arm = truth.indexOf("inst.status === 'requested'");
-  const shape = truth.indexOf("hosting_shape === 'dedicated'");
-  assert.ok(arm > 0 && arm < shape, 'the pre-standup arm comes before the shape arms');
+  assert.ok(arm > 0, 'the pre-standup arm is present');
+  // This used to assert the pre-standup arm came BEFORE the shape arms. There are no shape
+  // arms left — 'dedicated' was the only shape teardownTruth branched on, and task 1004182
+  // removed it — so the ordering has nothing to order. What still matters is that the
+  // pre-standup case is answered FIRST and then returns, rather than falling through to the
+  // built-world text for a project that was never stood up.
+  assert.ok(arm < truth.indexOf('The server goes away'), 'the pre-standup arm still precedes the built-world text');
+  assert.doesNotMatch(truth, /hosting_shape/, 'teardown truth no longer varies by shape');
   assert.doesNotMatch(truth, /status === 'error'|status === 'provisioning'/, 'error and provisioning keep today’s text — a failed run may already have built things');
 });
 

package/tests/projects_hub_repo_private.mjs

@@ -67,7 +67,7 @@ function world({ reply = RECEIPT } = {}) {
   return { ctx, els, calls, done };
 }
 
-const LIVE = { id: 18, status: 'active', hosting_shape: 'standalone', target_ref: 'o/demo', open_intent: null };
+const LIVE = { id: 18, status: 'active', hosting_shape: 'cloud-host', target_ref: 'o/demo', open_intent: null };
 const PUBLIC = { private: false, admin: true };
 
 console.log('the door:');