@bongos/core 1.19.999 → 1.19.1000

package/tests/provisioning_capacity.mjs

@@ -78,17 +78,23 @@ t('ceilingFor: an explicit override wins; an unmeasured box falls to the ADR sma
   assert.equal(DEFAULT_CEILING, 15);
 });
 
-t('placementBox: standalone → control plane always; co-tenant → the remote box only under remote-exec; dedicated → no shared box', () => {
-  assert.deepEqual(placementBox('standalone', {}), { box: 'control-plane', shapes: ['standalone', 'co-tenant'], fixedMb: 750 });
-  assert.deepEqual(placementBox('standalone', { remoteHost: 'cohost' }), { box: 'control-plane', shapes: ['standalone'], fixedMb: 750 });
-  assert.deepEqual(placementBox('co-tenant', {}), { box: 'control-plane', shapes: ['standalone', 'co-tenant'], fixedMb: 750 });
+t('placementBox: cloud-host → control plane always; co-tenant → the remote box only under remote-exec; byo-host → no box of ours', () => {
+  assert.deepEqual(placementBox('cloud-host', {}), { box: 'control-plane', shapes: ['cloud-host', 'co-tenant'], fixedMb: 750 });
+  assert.deepEqual(placementBox('cloud-host', { remoteHost: 'cohost' }), { box: 'control-plane', shapes: ['cloud-host'], fixedMb: 750 });
+  assert.deepEqual(placementBox('co-tenant', {}), { box: 'control-plane', shapes: ['cloud-host', 'co-tenant'], fixedMb: 750 });
   assert.deepEqual(placementBox('co-tenant', { remoteHost: 'cohost' }), { box: 'overflow', shapes: ['co-tenant'], fixedMb: 630 });
-  assert.equal(placementBox('dedicated', {}), null);
-  // ADR 0323: a byo-host runs on the owner's own machine, so it has no box of ours and
-  // no shared ceiling — null for a STRONGER reason than dedicated's (dedicated is our
-  // droplet, just not a shared one). remoteHost must not change that answer.
+  // ADR 0323: a byo-host runs on the owner's own machine, so it has no box of ours and no
+  // shared ceiling. This used to be one of TWO null answers — 'dedicated' was the other,
+  // null for a weaker reason (our droplet, just not a shared one) — until ADR 0327
+  // decision 4 removed that shape. remoteHost must not change the answer.
   assert.equal(placementBox('byo-host', {}), null);
   assert.equal(placementBox('byo-host', { remoteHost: 'cohost' }), null);
+  // Everything else still falls through to the control-plane box — including the
+  // 'control-plane' row itself, which is unchanged by this rename. So 'byo-host' is now the
+  // ONLY null answer, where there used to be two; the skip reason it produces is named for
+  // the question ('no-shared-box') rather than for the shape, so removing the other one did
+  // not leave a label naming a shape that no longer exists.
+  assert.deepEqual(placementBox('control-plane', {}), { box: 'control-plane', shapes: ['cloud-host', 'co-tenant'], fixedMb: 750 });
 });
 
 t('placementVerdict: the ceiling refuses at N of N, the floor refuses under 256 MB free, an unmeasured floor cannot refuse', () => {
@@ -119,14 +125,14 @@ t('capacitySummary: resize_due at 80% (12 of 15), remaining never negative, verd
 
 await ta('countPlaced counts ONLY provisioning + active rows of the box\'s shapes, and can exclude the row being re-run', async () => {
   const db = fakeDb(10);
-  assert.equal(await countPlaced(db, ['standalone']), 10);
-  assert.deepEqual(db.queries[0].params, [['standalone'], PLACED_STATES]);
+  assert.equal(await countPlaced(db, ['cloud-host']), 10);
+  assert.deepEqual(db.queries[0].params, [['cloud-host'], PLACED_STATES]);
   assert.deepEqual(PLACED_STATES, ['provisioning', 'active'], 'error rows hold no running unit (live fleet, 2026-09-16) and must not take a slot');
   assert.doesNotMatch(db.queries[0].sql, /id <>/, 'no exclusion unless asked');
-  await countPlaced(db, ['standalone', 'co-tenant'], { excludeId: 42 });
+  await countPlaced(db, ['cloud-host', 'co-tenant'], { excludeId: 42 });
   assert.match(db.queries[1].sql, /id <> \$3/);
-  assert.deepEqual(db.queries[1].params, [['standalone', 'co-tenant'], PLACED_STATES, 42]);
-  assert.equal(await countPlaced({ query: async () => ({ rows: [] }) }, ['standalone']), 0, 'a recording fake with no rows reads 0, not NaN');
+  assert.deepEqual(db.queries[1].params, [['cloud-host', 'co-tenant'], PLACED_STATES, 42]);
+  assert.equal(await countPlaced({ query: async () => ({ rows: [] }) }, ['cloud-host']), 0, 'a recording fake with no rows reads 0, not NaN');
 });
 
 await ta('fleetCapacity (the API + CLI summary) measures THIS host and counts the control plane\'s shapes', async () => {
@@ -135,7 +141,7 @@ await ta('fleetCapacity (the API + CLI summary) measures THIS host and counts th
   const c = await fleetCapacity(db, { meminfo: MEMINFO_2GB, remoteHost: null });
   assert.equal(c.box, 'control-plane'); assert.equal(c.placed, 10); assert.equal(c.ceiling, 15); assert.equal(c.source, 'measured');
   assert.equal(c.mem_available_mb, 1108); assert.equal(c.resize_due, false); assert.equal(c.verdict.ok, true);
-  assert.deepEqual(db.queries[0].params[0], ['standalone', 'co-tenant']);
+  assert.deepEqual(db.queries[0].params[0], ['cloud-host', 'co-tenant']);
   const remote = await fleetCapacity(fakeDb(3), { meminfo: MEMINFO_4GB, remoteHost: 'cohost' });
   assert.equal(remote.ceiling, 39, 'the control plane\'s own 4 GB ceiling, not the overflow box\'s');
   // The env override reaches the summary, and is read per call.
@@ -147,7 +153,7 @@ await ta('fleetCapacity (the API + CLI summary) measures THIS host and counts th
 
 console.log('\nthe runner preflight (scripts/gds/provision-capacity.js):');
 
-const standalone = { id: 7, slug: 'lantern', hosting_shape: 'standalone', status: 'requested', owner_builder_id: 3, port: null, db_name: 'lantern', domain: null };
+const cloudHost = { id: 7, slug: 'lantern', hosting_shape: 'cloud-host', status: 'requested', owner_builder_id: 3, port: null, db_name: 'lantern', domain: null };
 
 // Recording deps: which executor was asked, what was logged, which events landed.
 function preflightDeps({ apply = true, placed = 10, controlMeminfo = MEMINFO_2GB, boxMeminfo = MEMINFO_4GB } = {}) {
@@ -164,11 +170,11 @@ function preflightDeps({ apply = true, placed = 10, controlMeminfo = MEMINFO_2GB
   };
 }
 
-await ta('a standalone with room: ok, measured on the CONTROL executor, the count excludes its own row', async () => {
+await ta('a cloud-host with room: ok, measured on the CONTROL executor, the count excludes its own row', async () => {
   const h = preflightDeps({ placed: 10 });
-  const r = await capacityPreflight(standalone, h.deps);
+  const r = await capacityPreflight(cloudHost, h.deps);
   assert.equal(r.ok, true);
-  assert.deepEqual(h.asked, [['control', MEMINFO_CMD]], 'a standalone runs control-plane-local, so its box is measured there');
+  assert.deepEqual(h.asked, [['control', MEMINFO_CMD]], 'a cloud-host runs control-plane-local, so its box is measured there');
   assert.equal(r.ceiling, 15); assert.equal(r.source, 'measured'); assert.equal(r.placed, 10);
   assert.deepEqual(h.deps.db.queries[0].params[2], 7, 'the row being provisioned never counts itself');
   assert.equal(h.events.length, 0, 'nothing to record when it fits');
@@ -177,7 +183,7 @@ await ta('a standalone with room: ok, measured on the CONTROL executor, the coun
 
 await ta('a full box REFUSES with the owner-readable reason, records placement-refused, and returns (never throws)', async () => {
   const h = preflightDeps({ placed: 15 });
-  const r = await capacityPreflight(standalone, h.deps);
+  const r = await capacityPreflight(cloudHost, h.deps);
   assert.equal(r.ok, false);
   assert.match(r.error, /15 of 15 project slots are taken/);
   assert.equal(h.events.length, 1);
@@ -189,7 +195,7 @@ await ta('a full box REFUSES with the owner-readable reason, records placement-r
 
 await ta('the live memory floor refuses even with slots to spare (a stray unit the ledger cannot see)', async () => {
   const h = preflightDeps({ placed: 10, controlMeminfo: MEMINFO_TIGHT });
-  const r = await capacityPreflight(standalone, h.deps);
+  const r = await capacityPreflight(cloudHost, h.deps);
   assert.equal(r.ok, false);
   assert.equal(r.verdict.wall, 'memory');
   assert.match(r.error, /117 MB of memory free/);
@@ -198,7 +204,7 @@ await ta('the live memory floor refuses even with slots to spare (a stray unit t
 
 await ta('at 80% it still places, but the log names the resize trigger', async () => {
   const h = preflightDeps({ placed: 12 });
-  const r = await capacityPreflight(standalone, h.deps);
+  const r = await capacityPreflight(cloudHost, h.deps);
   assert.equal(r.ok, true); assert.equal(r.resize_due, true);
   assert.ok(h.logs.some((l) => /at or past 80%: schedule the resize \(task 1003923\)/.test(l)), h.logs.join(' | '));
 });
@@ -209,35 +215,35 @@ await ta('a co-tenant under remote-exec is measured on the BOX executor against
   CONFIG.remoteHost = 'cohost';
   try {
     const h = preflightDeps({ placed: 40 });
-    const r = await capacityPreflight({ ...standalone, hosting_shape: 'co-tenant' }, h.deps);
+    const r = await capacityPreflight({ ...cloudHost, hosting_shape: 'co-tenant' }, h.deps);
     assert.deepEqual(h.asked, [['box', MEMINFO_CMD]]);
     assert.equal(r.box, 'overflow'); assert.equal(r.ceiling, 41); assert.equal(r.ok, true);
     assert.deepEqual(h.deps.db.queries[0].params[0], ['co-tenant'], 'only the shapes that share that box count');
   } finally { CONFIG.remoteHost = prior; }
 });
 
-await ta('a dedicated droplet is its own box: no measurement, no count, no refusal', async () => {
+await ta('a shape with no box of ours: no measurement, no count, no refusal', async () => {
   const h = preflightDeps({ placed: 99 });
-  const r = await capacityPreflight({ ...standalone, hosting_shape: 'dedicated' }, h.deps);
-  assert.deepEqual(r, { ok: true, skipped: 'dedicated' });
+  const r = await capacityPreflight({ ...cloudHost, hosting_shape: 'byo-host' }, h.deps);
+  assert.deepEqual(r, { ok: true, skipped: 'no-shared-box' });
   assert.equal(h.asked.length, 0); assert.equal(h.deps.db.queries.length, 0);
 });
 
 await ta('dry-run measures nothing and refuses nothing, even on a full box; an unmeasured --apply falls to the default and warns', async () => {
   const dry = preflightDeps({ apply: false, placed: 15 });
-  const r = await capacityPreflight(standalone, dry.deps);
+  const r = await capacityPreflight(cloudHost, dry.deps);
   assert.equal(r.ok, true); assert.equal(r.dryRun, true);
   assert.equal(dry.events.length, 0);
   assert.ok(dry.logs.some((l) => /would refuse if full/.test(l)));
   // --apply with an executor that answers no stdout (a fake, or a box without procfs)
   const blind = preflightDeps({ placed: 3, controlMeminfo: '' });
-  const b = await capacityPreflight(standalone, blind.deps);
+  const b = await capacityPreflight(cloudHost, blind.deps);
   assert.equal(b.ok, true); assert.equal(b.source, 'default'); assert.equal(b.ceiling, DEFAULT_CEILING);
   assert.ok(blind.logs.some((l) => /could not measure the box.*PROVISION_BOX_CEILING/.test(l)), blind.logs.join(' | '));
   // …and an executor that throws is the same as one that answers nothing.
   const throwing = preflightDeps({ placed: 3 });
   throwing.deps.controlExec = () => { throw new Error('ssh down'); };
-  assert.equal((await capacityPreflight(standalone, throwing.deps)).source, 'default');
+  assert.equal((await capacityPreflight(cloudHost, throwing.deps)).source, 'default');
 });
 
 await ta('statusCapacityLine prints "box at N of M" for the CLI', async () => {
@@ -272,7 +278,7 @@ function recorder({ apply, placed, meminfo = MEMINFO_2GB }) {
 
 await ta('provisionInstance(--apply) on a full box returns ok:false BEFORE any status write or standup command', async () => {
   const h = recorder({ apply: true, placed: 15 });
-  const r = await P.provisionInstance(standalone, h.deps);
+  const r = await P.provisionInstance(cloudHost, h.deps);
   assert.equal(r.ok, false);
   assert.match(r.error, /15 of 15 project slots/);
   assert.deepEqual(h.statuses, [], 'never flipped to provisioning — a project that was not placed is not "provisioning"');
@@ -283,7 +289,7 @@ await ta('provisionInstance(--apply) on a full box returns ok:false BEFORE any s
 
 await ta('provisionInstance(--apply) with room proceeds into the runbook exactly as before', async () => {
   const h = recorder({ apply: true, placed: 10 });
-  const r = await P.provisionInstance({ ...standalone, hosting_shape: 'co-tenant', port: 3003 }, h.deps);
+  const r = await P.provisionInstance({ ...cloudHost, hosting_shape: 'co-tenant', port: 3003 }, h.deps);
   assert.equal(r.ok, true);
   assert.equal(h.statuses[0], 'provisioning');
   assert.equal(h.cmds[0], MEMINFO_CMD, 'measured first');
@@ -292,7 +298,7 @@ await ta('provisionInstance(--apply) with room proceeds into the runbook exactly
 
 await ta('provisionInstance(dry-run) on a full box still prints the whole plan — dry-run places nothing, so it refuses nothing', async () => {
   const h = recorder({ apply: false, placed: 15 });
-  const r = await P.provisionInstance({ ...standalone, hosting_shape: 'co-tenant', port: 3003 }, h.deps);
+  const r = await P.provisionInstance({ ...cloudHost, hosting_shape: 'co-tenant', port: 3003 }, h.deps);
   assert.equal(r.ok, true);
   assert.ok(h.cmds.some((c) => /createdb lantern/.test(c)));
 });
@@ -306,7 +312,7 @@ await ta('cmdRunIntents: a refused placement retires onto the card as error_note
     db: fakeDb(15),
     provisioning: {
       claimNextIntent: async () => (claims++ === 0 ? { id: 9, instance_id: 7, action: 'provision', attempts: P.MAX_INTENT_ATTEMPTS } : null),
-      getInstanceById: async () => ({ ...standalone }),
+      getInstanceById: async () => ({ ...cloudHost }),
       resolveIntent: async (_db, id, state, err) => { resolved.push({ id, state, err }); },
       setInstanceStatus: async (_db, id, status, patch) => { statusWrites.push({ id, status, patch }); },
       recordEvent: async (_db, e) => { events.push(e); },
@@ -335,7 +341,7 @@ await ta('cmdRunIntents: below the attempt cap a refusal goes back to pending wi
     apply: true, log: () => {}, db,
     provisioning: {
       claimNextIntent: async () => (claims++ === 0 ? { id: 9, instance_id: 7, action: 'provision', attempts: 1 } : null),
-      getInstanceById: async () => ({ ...standalone }),
+      getInstanceById: async () => ({ ...cloudHost }),
       resolveIntent: async () => { throw new Error('must not resolve on a retryable refusal'); },
       setInstanceStatus: async () => { throw new Error('must not touch the instance on a retryable refusal'); },
       recordEvent: async () => {},
@@ -357,7 +363,7 @@ console.log('\nthe fleet API carries the same summary:');
 // Stub the route's data access at the same seams tests/provisioning_paid_shape_gate.mjs
 // uses; the capacity module object is shared with the route through the require cache.
 const provisioning = require('../modules/provisioning/provisioning.js');
-provisioning.listAllInstances = async () => [{ id: 1, owner_builder_id: 7, slug: 'lantern', status: 'active', hosting_shape: 'standalone', settings: {}, detail: {}, github_login: 'o', display_name: 'O', rank: 'archon' }];
+provisioning.listAllInstances = async () => [{ id: 1, owner_builder_id: 7, slug: 'lantern', status: 'active', hosting_shape: 'cloud-host', settings: {}, detail: {}, github_login: 'o', display_name: 'O', rank: 'archon' }];
 const api = require('../src/module-api.js');
 api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
 api.requirePermission = () => (_req, _res, next) => next();

package/tests/provisioning_capacity_gate.mjs

@@ -8,7 +8,7 @@
 // naming N of M, before any row or intent exists.
 //
 // What these tests pin: the refusal lands before createInstance; a box the web tier cannot
-// count (dedicated, a remote co-host) is never refused here; a re-request of a row that
+// count (a remote co-host, or byo-host) is never refused here; a re-request of a row that
 // already holds its slot stays idempotent, while a revive (which takes a slot) is counted;
 // the live-memory floor stays the runner's; and a capacity read that fails ADMITS, because
 // the runner remains the wall.
@@ -100,7 +100,7 @@ function reset({ count = 0, row = null, mem = MEMINFO_2GB, fails = false } = {})
   delete process.env.PROVISION_REMOTE_HOST;
 }
 
-const WIZARD = { slug: 'lantern', hosting_shape: 'standalone', no_address: true };
+const WIZARD = { slug: 'lantern', hosting_shape: 'cloud-host', no_address: true };
 
 // ── the wall ──────────────────────────────────────────────────────────────────────
 
@@ -141,13 +141,6 @@ await ta('an absent shape takes the byo-host default, so a full box does NOT ref
 
 // ── boxes the web tier cannot count are the runner's ──────────────────────────────
 
-await ta('dedicated is its own box: never refused here, and the count is never read', async () => {
-  reset({ count: 15 });
-  const res = await post({ slug: 'lantern', hosting_shape: 'dedicated', no_address: true });
-  assert.equal(res.status, 201, res.raw);
-  assert.equal(capacityReads, 0);
-});
-
 await ta('byo-host runs on the OWNER\'s machine: never refused here, and the count is never read', async () => {
   // ADR 0323's new shape, and the strongest form of "not our box": there is no machine
   // of ours to place it on at all, so a full control plane must not refuse it and the
@@ -176,14 +169,14 @@ await ta('the live-memory floor is left to the runner: slots free + memory tight
 // ── re-requests ───────────────────────────────────────────────────────────────────
 
 await ta('a re-request of the owner\'s ACTIVE project on a full box stays idempotent (no box_full)', async () => {
-  reset({ count: 15, row: { id: 42, owner_builder_id: 7, slug: 'lantern', hosting_shape: 'standalone', status: 'active' } });
+  reset({ count: 15, row: { id: 42, owner_builder_id: 7, slug: 'lantern', hosting_shape: 'cloud-host', status: 'active' } });
   const res = await post(WIZARD);
   assert.notEqual(res.status, 409, res.raw);
   assert.ok(res.status < 300, res.raw);
 });
 
 await ta('a revive of a torn-down project takes a slot, so a full box refuses it', async () => {
-  reset({ count: 15, row: { id: 42, owner_builder_id: 7, slug: 'lantern', hosting_shape: 'standalone', status: 'torn_down' } });
+  reset({ count: 15, row: { id: 42, owner_builder_id: 7, slug: 'lantern', hosting_shape: 'cloud-host', status: 'torn_down' } });
   const res = await post(WIZARD);
   assert.equal(res.status, 409, res.raw);
   assert.equal(res.body.error.code, 'box_full');
@@ -199,7 +192,7 @@ await ta('a capacity read that fails ADMITS — the runner remains the wall', as
 });
 
 await ta('a malformed slug or shape gets the handler\'s 400, not box_full', async () => {
-  for (const body of [{ slug: 'Bad Slug!', hosting_shape: 'standalone' }, { slug: 'lantern', hosting_shape: 'giant' }]) {
+  for (const body of [{ slug: 'Bad Slug!', hosting_shape: 'cloud-host' }, { slug: 'lantern', hosting_shape: 'giant' }]) {
     reset({ count: 15 });
     const res = await post(body);
     assert.equal(res.status, 400, `${JSON.stringify(body)} → ${res.raw}`);

package/tests/provisioning_default_domain.mjs

@@ -133,7 +133,7 @@ function post(path, body = {}) {
 }
 
 const freshRow = (over = {}) => ({
-  id: 41, owner_builder_id: 7, slug: 'spike', status: 'requested', hosting_shape: 'standalone',
+  id: 41, owner_builder_id: 7, slug: 'spike', status: 'requested', hosting_shape: 'cloud-host',
   domain: 'spike.cloudbongos.com', onboard_mode: 'greenfield', type: null, created_at: '', updated_at: '', ...over,
 });
 

package/tests/provisioning_domain_attach.mjs

@@ -192,7 +192,7 @@ function reset({ inst, holder } = {}) {
 console.log('\nPOST /provisioning/instances/:id/domain — give an existing instance its address:');
 
 await ta('ACTIVE domainless instance: domain is validated, recorded, and a domain-attach intent queues', async () => {
-  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'standalone', domain: null } });
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'cloud-host', domain: null } });
   const res = await post('/provisioning/instances/18/domain', { domain: 'Spike.CloudBongos.com.' });
   assert.equal(res.status, 200, res.raw);
   assert.equal(res.body.ok, true);
@@ -419,7 +419,7 @@ console.log('\nPOST /provisioning/instances — slug re-requests are truthful ab
 await ta('re-request with a domain on an existing instance SAYS the domain was ignored (and where to send it)', async () => {
   reset();
   createResult = { instance: { id: 18, owner_builder_id: 7, slug: 'spike', status: 'active', domain: null }, created: false };
-  const res = await post('/provisioning/instances', { slug: 'spike', hosting_shape: 'standalone', domain: 'spike.cloudbongos.com' });
+  const res = await post('/provisioning/instances', { slug: 'spike', hosting_shape: 'cloud-host', domain: 'spike.cloudbongos.com' });
   assert.equal(res.status, 200, res.raw);
   assert.ok(res.body.domain_ignored, 'the drop is surfaced, not silent');
   assert.equal(res.body.domain_ignored.requested, 'spike.cloudbongos.com');
@@ -429,7 +429,7 @@ await ta('re-request with a domain on an existing instance SAYS the domain was i
 await ta('re-request with the SAME domain the instance already has → no ignored flag (nothing was dropped)', async () => {
   reset();
   createResult = { instance: { id: 18, owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com' }, created: false };
-  const res = await post('/provisioning/instances', { slug: 'spike', hosting_shape: 'standalone', domain: 'spike.cloudbongos.com' });
+  const res = await post('/provisioning/instances', { slug: 'spike', hosting_shape: 'cloud-host', domain: 'spike.cloudbongos.com' });
   assert.equal(res.status, 200, res.raw);
   assert.equal(res.body.domain_ignored, undefined);
 });
@@ -437,7 +437,7 @@ await ta('re-request with the SAME domain the instance already has → no ignore
 await ta('a fresh create with a domain is untouched (the domain is stored at creation — nothing ignored)', async () => {
   reset();
   createResult = { instance: { id: 43, owner_builder_id: 7, slug: 'new', status: 'requested', domain: 'new.cloudbongos.com' }, created: true };
-  const res = await post('/provisioning/instances', { slug: 'new', hosting_shape: 'standalone', domain: 'new.cloudbongos.com' });
+  const res = await post('/provisioning/instances', { slug: 'new', hosting_shape: 'cloud-host', domain: 'new.cloudbongos.com' });
   assert.equal(res.status, 201, res.raw);
   assert.equal(res.body.domain_ignored, undefined);
 });

package/tests/provisioning_domain_unique.mjs

@@ -249,7 +249,7 @@ console.log('\nPOST /provisioning/instances/:id/domain — the index refusing a
 
 await ta('the index catching the race answers domain_taken 409, and nothing is queued', async () => {
   reset();
-  instance = { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'standalone', domain: null };
+  instance = { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'cloud-host', domain: null };
   updateThrows = DOMAIN_VIOLATION();
   const res = await post('/provisioning/instances/18/domain', { domain: 'mercury.example.com' });
   assert.equal(res.status, 409, res.raw);
@@ -260,7 +260,7 @@ await ta('the index catching the race answers domain_taken 409, and nothing is q
 
 await ta('any OTHER failure on attach is still the honest 500', async () => {
   reset();
-  instance = { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'standalone', domain: null };
+  instance = { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'cloud-host', domain: null };
   updateThrows = Object.assign(new Error('connection terminated'), { code: '57P01' });
   const res = await post('/provisioning/instances/18/domain', { domain: 'mercury.example.com' });
   assert.equal(res.status, 500, res.raw);

package/tests/provisioning_error_note_scope.mjs

@@ -30,7 +30,7 @@ const provisioning = require('../modules/provisioning/provisioning.js');
 const { test, summary } = makeRunner();
 
 const activeStandalone = {
-  id: 18, slug: 'spike', hosting_shape: 'standalone', status: 'active', owner_builder_id: 7,
+  id: 18, slug: 'spike', hosting_shape: 'cloud-host', status: 'active', owner_builder_id: 7,
   port: 3010, db_name: 'spike', domain: null, target_ref: 'jaxri/spike-harbor',
 };
 

package/tests/provisioning_module_selection.mjs

@@ -74,7 +74,7 @@ await ta('createInstance: a chosen set is stored as a jsonb array, in catalog or
 
   // Act
   await provisioning.createInstance(db, {
-    ownerBuilderId: 7, slug: 'demo', hostingShape: 'standalone', type: 'game',
+    ownerBuilderId: 7, slug: 'demo', hostingShape: 'cloud-host', type: 'game',
     modules: ['discord', 'agents'],
   });
 
@@ -90,7 +90,7 @@ await ta('createInstance: NO answer stores NULL — the skip has to stay readabl
   for (const modules of [undefined, null, 'discord', 42]) {
     const db = recordingDb();
     await provisioning.createInstance(db, {
-      ownerBuilderId: 7, slug: 'demo', hostingShape: 'standalone', type: 'game', modules,
+      ownerBuilderId: 7, slug: 'demo', hostingShape: 'cloud-host', type: 'game', modules,
     });
     const params = insertParams(db);
     assert.equal(params[13], null, `modules=${JSON.stringify(modules)} stores NULL, not an empty list`);
@@ -100,7 +100,7 @@ await ta('createInstance: NO answer stores NULL — the skip has to stay readabl
 await ta('createInstance: an explicit empty answer is stored, and is NOT the same as absent', async () => {
   const db = recordingDb();
   await provisioning.createInstance(db, {
-    ownerBuilderId: 7, slug: 'demo', hostingShape: 'standalone', type: 'game', modules: [],
+    ownerBuilderId: 7, slug: 'demo', hostingShape: 'cloud-host', type: 'game', modules: [],
   });
   assert.equal(insertParams(db)[13], '[]', 'the owner said none of them, and the row says so');
 });
@@ -110,7 +110,7 @@ await ta('createInstance: the always-on core is never written into the selection
   // the column disagree with ALWAYS_ON_CORE the day a manifest flips its default.
   const db = recordingDb();
   await provisioning.createInstance(db, {
-    ownerBuilderId: 7, slug: 'demo', hostingShape: 'standalone', modules: ['memory', 'discord', 'provisioning'],
+    ownerBuilderId: 7, slug: 'demo', hostingShape: 'cloud-host', modules: ['memory', 'discord', 'provisioning'],
   });
   assert.equal(insertParams(db)[13], JSON.stringify(['discord']));
 });
@@ -164,7 +164,7 @@ provisioning.createInstance = async (_db, args) => {
   lastCreateArgs = args;
   return existingRow
     ? { instance: existingRow, created: false }
-    : { instance: { id: 41, owner_builder_id: 7, slug: args.slug, status: 'requested', hosting_shape: 'standalone', type: args.type || null, detail: {} }, created: true };
+    : { instance: { id: 41, owner_builder_id: 7, slug: args.slug, status: 'requested', hosting_shape: 'cloud-host', type: args.type || null, detail: {} }, created: true };
 };
 provisioning.enqueueIntent = async (_db, id, action) => ({ intent: { id: 9, action, state: 'pending' }, created: true });
 provisioning.getOpenIntent = async () => null;

package/tests/provisioning_onboard_mode.mjs

@@ -53,7 +53,7 @@ await ta('createInstance: onboardMode "adopt" is persisted', async () => {
   const db = recordingDb();
   await provisioning.createInstance(db, {
     ownerBuilderId: 7, slug: 'demo', targetRef: 'example-owner/demo',
-    hostingShape: 'standalone', onboardMode: 'adopt',
+    hostingShape: 'cloud-host', onboardMode: 'adopt',
   });
   const insert = db.calls.find((c) => /INSERT INTO provisioning_instances/i.test(c.text));
   assert.ok(insert, 'issued an INSERT');
@@ -68,7 +68,7 @@ await ta('createInstance: absent / unknown onboardMode → greenfield, the SAFE
   for (const mode of [undefined, null, '', 'ADOPT', 'brownfield', 'nonsense']) {
     const db = recordingDb();
     await provisioning.createInstance(db, {
-      ownerBuilderId: 7, slug: 'demo', hostingShape: 'standalone', onboardMode: mode,
+      ownerBuilderId: 7, slug: 'demo', hostingShape: 'cloud-host', onboardMode: mode,
     });
     const insert = db.calls.find((c) => /INSERT INTO provisioning_instances/i.test(c.text));
     assert.ok(insert.params.includes('greenfield'), `onboardMode=${JSON.stringify(mode)} → greenfield`);

package/tests/provisioning_paid_shape_gate.mjs

@@ -3,13 +3,18 @@
 // The paid-shape gate on POST /provisioning/instances (task 1003682).
 //
 // Before this, the create route's only gate was requireBuilder, and `hosting_shape` was
-// caller-supplied and validated only against the allowed set. `dedicated` is the ONE shape
-// whose runner leg creates a real DigitalOcean droplet (scripts/gds/provision.js — billed
-// monthly, defaulting to s-2vcpu-4gb), so any authenticated builder — a Xenos included —
-// could queue recurring infrastructure spend the owner never approved. The route that
-// SPENDS was less gated than force-teardown, which stops spending and sits behind
+// caller-supplied and validated only against the allowed set. `dedicated` was then the ONE
+// shape whose runner leg created a real DigitalOcean droplet (scripts/gds/provision.js —
+// billed monthly, defaulting to s-2vcpu-4gb), so any authenticated builder — a Xenos
+// included — could queue recurring infrastructure spend the owner never approved. The route
+// that SPENDS was less gated than force-teardown, which stops spending and sits behind
 // provisioning.fleet.manage.
 //
+// THAT SHAPE IS GONE (ADR 0327 decision 4, task 1004182, migration provisioning_027): on the
+// owner's own platform account a bigger plan is a setting they choose, not a shape we model.
+// Its rows folded into 'cloud-host'. The gate's reasoning did not move with it — see the
+// 'dedicated is no longer requestable' case below, which is what holds the removal.
+//
 // The fix gates the SHAPE, not the route: ordinary project creation must not require a rank,
 // so the front door — `byo-host` since ADR 0323, `co-tenant` before it — stays open to any
 // authenticated builder. Everything else
@@ -21,10 +26,10 @@
 // subject. The original gate named the one shape it refused and admitted the rest, and two
 // shapes stayed open underneath that reasoning:
 //
-//   standalone    — judged harmless because it costs $0. True of the invoice; false of the
-//                   trust. The unit's WorkingDirectory is the caller's own checkout and the
-//                   loader discovers modules from process.cwd(), so the platform require()s
-//                   a repo the caller named.
+//   cloud-host    — then stored as 'standalone'. Judged harmless because it costs $0. True
+//                   of the invoice; false of the trust. The unit's WorkingDirectory is the
+//                   caller's own checkout and the loader discovers modules from
+//                   process.cwd(), so the platform require()s a repo the caller named.
 //   control-plane — did not exist when the gate was written, and was permitted by omission
 //                   the moment task 1003159 added it. A probe returned 201 and a second
 //                   control-plane row, while this file's own comment asserted it could not.
@@ -173,41 +178,41 @@ await ta('the refusal speaks WIRE vocabulary — no owner-facing label is transl
     const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: shape, no_address: true });
     assert.equal(res.status, 403, `expected 403 for ${shape}, got ${res.status} ${res.raw}`);
     const message = res.body.error.message || '';
-    for (const label of ['bring your own host', 'cloud host', 'dedicated cloud host']) {
+    for (const label of ['bring your own host', 'your own host', 'shared server']) {
       assert.ok(!message.toLowerCase().includes(label),
         `the ${shape} refusal translates a stored value into the owner-facing label "${label}" — that map lives only in projects.html's SHAPE_LABEL (ADR 0323): ${message}`);
     }
   }
   // And the caller is still told what they CAN ask for, in the vocabulary they sent.
   const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'co-tenant', no_address: true });
-  assert.deepEqual([...res.body.error.details.requestable].sort(), ['byo-host', 'dedicated', 'standalone'],
+  assert.deepEqual([...res.body.error.details.requestable].sort(), ['byo-host', 'cloud-host'],
     'a refusal that names no alternative is a dead end — the stored values are the alternative');
 });
 
-// ── standalone runs the caller's OWN code on the platform's box (task 1003370) ────
+// ── cloud-host runs the caller's OWN code on the platform's box (task 1003370) ────
 
-await ta('standalone: REFUSED for a builder without provisioning.fleet.manage', async () => {
+await ta('cloud-host: REFUSED for a builder without provisioning.fleet.manage', async () => {
   // Task 1003682 left this shape open, reasoning that a $0 shape hands the caller
   // nothing. That is true of the invoice and false of the trust: the systemd unit's
   // WorkingDirectory is the caller's own checkout and the module loader discovers
-  // `modules/` from process.cwd(), so a standalone request is "please require() this
+  // `modules/` from process.cwd(), so a cloud-host request is "please require() this
   // repo on your control plane". The uid split (task 1003369) bounds the blast radius;
   // it does not make the default acceptable.
   held = [];
   lastCreateArgs = null;
-  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'standalone', no_address: true });
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'cloud-host', no_address: true });
   assert.equal(res.status, 403, `expected 403, got ${res.status} ${res.raw}`);
   assert.equal(res.body.error.code, 'permission_forbidden');
   assert.deepEqual(res.body.error.details.required, ['provisioning.fleet.manage']);
   assert.equal(lastCreateArgs, null, 'no row is created when the shape is refused');
 });
 
-await ta('standalone: ADMITTED for a builder holding provisioning.fleet.manage', async () => {
+await ta('cloud-host: ADMITTED for a builder holding provisioning.fleet.manage', async () => {
   held = ['provisioning.fleet.manage'];
   lastCreateArgs = null;
-  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'standalone', no_address: true });
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'cloud-host', no_address: true });
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
-  assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'standalone');
+  assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'cloud-host');
 });
 
 // ── control-plane is not requestable AT ALL (task 1003370) ────────────────────────
@@ -239,45 +244,46 @@ await ta('control-plane: still refused for a builder holding EVERY permission',
   assert.equal(lastCreateArgs, null, 'no row is created');
 });
 
-// ── dedicated is the metered one ──────────────────────────────────────────────────
-
-await ta('dedicated: REFUSED for a builder without provisioning.fleet.manage', async () => {
-  held = [];
-  lastCreateArgs = null;
-  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'dedicated', no_address: true });
-  assert.equal(res.status, 403, `expected 403, got ${res.status} ${res.raw}`);
-  assert.equal(res.body.error.code, 'permission_forbidden');
-  // requirePermission reports the gate's literal list under `details` (the same envelope
-  // requireRank uses), so the denial names the atom a caller has to be granted.
-  assert.deepEqual(res.body.error.details.required, ['provisioning.fleet.manage']);
-  assert.equal(lastCreateArgs, null, 'no row is created when the shape is refused');
-});
+// ── the removed shape stays removed ───────────────────────────────────────────────
 
-await ta('dedicated: ADMITTED for a builder holding provisioning.fleet.manage', async () => {
-  held = ['provisioning.fleet.manage'];
-  lastCreateArgs = null;
-  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'dedicated', no_address: true });
-  assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
-  assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'dedicated');
+await ta('dedicated is no longer requestable AT ALL — not by permission, not by anyone', async () => {
+  // This is the assertion that holds ADR 0327 decision 4. 'dedicated' used to be the metered
+  // shape: refused without provisioning.fleet.manage, ADMITTED with it. Task 1004182 removed
+  // the value from HOSTING_SHAPES and migration provisioning_027 folded its rows into
+  // 'cloud-host', so it is now an unknown shape — the gate DEFERS it and the validator
+  // refuses it, whatever the caller holds.
+  //
+  // Asserted for BOTH permission states deliberately. Testing only the unprivileged case
+  // would still pass if the shape had merely gone back to being gated, which is exactly the
+  // state this removal is distinguishable from.
+  for (const permissions of [[], ['provisioning.fleet.manage']]) {
+    held = permissions;
+    lastCreateArgs = null;
+    const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'dedicated', no_address: true });
+    assert.ok(res.status === 400 || res.status === 403,
+      `holding ${JSON.stringify(permissions)}: expected a refusal, got ${res.status} ${res.raw}`);
+    assert.equal(lastCreateArgs, null,
+      `holding ${JSON.stringify(permissions)}: a removed shape must never reach createInstance`);
+  }
 });
 
-await ta('the gate refuses BEFORE the row exists — a denied dedicated create leaves nothing behind', async () => {
+await ta('the gate refuses BEFORE the row exists — a denied create leaves nothing behind', async () => {
   // The denial must land ahead of createInstance, not after it: a refused-but-inserted row
   // would still be drained by the runner, which reads the column, not the HTTP status.
   held = [];
   lastCreateArgs = null;
-  await post('/provisioning/instances', { slug: 'spendy', hosting_shape: 'dedicated', tier: 's-4vcpu-8gb' });
+  await post('/provisioning/instances', { slug: 'spendy', hosting_shape: 'cloud-host', no_address: true });
   assert.equal(lastCreateArgs, null);
 });
 
 // ── the gate cannot be walked around ──────────────────────────────────────────────
 
-await ta('a case-variant shape does not slip past the gate INTO a dedicated row', async () => {
+await ta('a case-variant shape does not slip past the gate INTO a privileged row', async () => {
   // The gate matches the exact wire value, and so does the shape validator — so a variant
-  // is refused as a bad shape rather than admitted as a cheap one and stored as dedicated.
-  // The property that matters is not WHICH error comes back, it is that no dedicated row
+  // is refused as a bad shape rather than admitted as a cheap one and stored as a gated
+  // shape. The property that matters is not WHICH error comes back, it is that no gated row
   // is ever created without the permission.
-  for (const shape of ['DEDICATED', 'Dedicated', ' dedicated', 'dedicated ']) {
+  for (const shape of ['CLOUD-HOST', 'Cloud-Host', ' cloud-host', 'cloud-host ']) {
     held = [];
     lastCreateArgs = null;
     const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: shape, no_address: true });
@@ -307,8 +313,15 @@ await ta('HOSTING_SHAPES is pinned, so a new shape forces a written decision abo
   // no caller may request: the value stays storable so one torn-down row remains
   // readable, and the door is shut in UNREQUESTABLE_SHAPES instead. Dropping it from
   // HOSTING_SHAPES would make that historical row violate its own CHECK constraint.
+  //
+  // It fired a THIRD time at task 1004182, which is the first time it fired for a shape
+  // going AWAY rather than arriving. 'dedicated' left the set entirely (ADR 0327 decision 4)
+  // and 'standalone' was renamed to 'cloud-host' so the stored value matches the
+  // owner-facing word; migration provisioning_027 moved both. A shape LEAVING needs the same
+  // written decision as one arriving, and more care: the rows carrying the old value have to
+  // land somewhere legal before the CHECK constraint narrows under them.
   assert.deepEqual([...provisioning.HOSTING_SHAPES].sort(),
-    ['byo-host', 'co-tenant', 'control-plane', 'dedicated', 'standalone']);
+    ['byo-host', 'cloud-host', 'co-tenant', 'control-plane']);
 });
 
 await ta('an unknown shape is answered by the validator, not by the gate', () => {

package/tests/provisioning_repo_private_route.mjs

@@ -83,7 +83,7 @@ function post(path, body) {
   });
 }
 
-const LIVE = { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'standalone', target_ref: 'example-owner/spike' };
+const LIVE = { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'cloud-host', target_ref: 'example-owner/spike' };
 const OWNER = { id: 7, github_login: 'owner', rank: 'thetes' };
 function reset(patch = {}) {
   instance = { ...LIVE, ...patch };