@bongos/core 1.19.999 → 1.19.1001

package/modules/provisioning/capacity.js

@@ -75,11 +75,11 @@ function parseMeminfo(text) {
 // consume a slot that a cloud-host would otherwise get — which is what returning null
 // here buys, since PLACED_STATES counting keys off the shapes a box declares.
 function placementBox(hostingShape, { remoteHost = null } = {}) {
-  if (hostingShape === 'dedicated' || hostingShape === 'byo-host') return null;
+  if (hostingShape === 'byo-host') return null;
   if (hostingShape === 'co-tenant' && remoteHost) {
     return { box: 'overflow', shapes: ['co-tenant'], fixedMb: FIXED_MB.overflow };
   }
-  return { box: 'control-plane', shapes: remoteHost ? ['standalone'] : ['standalone', 'co-tenant'], fixedMb: FIXED_MB['control-plane'] };
+  return { box: 'control-plane', shapes: remoteHost ? ['cloud-host'] : ['cloud-host', 'co-tenant'], fixedMb: FIXED_MB['control-plane'] };
 }
 
 // ceilingFor — the slot count for a box: an explicit override wins, else the ADR
@@ -148,7 +148,7 @@ function readLocalMeminfo() {
 // for tests; `remoteHost` mirrors the runner's PROVISION_REMOTE_HOST so the two
 // count the same shapes (set it in web.env too if co-tenants ever run remotely).
 async function fleetCapacity(db, { meminfo = readLocalMeminfo(), remoteHost = process.env.PROVISION_REMOTE_HOST || null } = {}) {
-  const target = placementBox('standalone', { remoteHost });
+  const target = placementBox('cloud-host', { remoteHost });
   const { override, floorMb } = envOverrides();
   const mem = parseMeminfo(meminfo);
   const { ceiling, source } = ceilingFor({ override, memTotalMb: mem.memTotalMb, fixedMb: target.fixedMb });

package/modules/provisioning/control-plane-guard.js

@@ -11,7 +11,7 @@
 //
 // It also puts a 'teardown' button one query away from the platform itself. That
 // is the risk this file exists to close, and it is the reason the shape is a
-// distinct VALUE rather than a reuse of 'standalone': a distinct value is something
+// distinct VALUE rather than a reuse of 'cloud-host': a distinct value is something
 // every destructive leg can refuse BY NAME.
 //
 // AN ALLOW-LIST, NOT A DENY-LIST. Listing today's destructive actions and refusing

package/modules/provisioning/core-upgrade.js

@@ -38,13 +38,13 @@ const CORE_UPGRADE_FROM = Object.freeze(new Set(['active']));
 // The shapes whose box the runner can actually reach to perform an upgrade.
 // Mirrors RESTART_SHAPES and adds the control plane (which the runner IS on).
 //
-// A 'dedicated' droplet is stood up by cloud-init and the runner has no post-hoc
-// exec path to it — the same fact the restart route refuses on. Queueing an
-// upgrade for one would be the F16 lie: a request that is accepted and never
-// lands. This is a SEPARATE question from the control-plane guard, which asks
-// what may be aimed at the platform itself; a first cut conflated the two and
-// silently accepted upgrades for dedicated droplets.
-const UPGRADE_SHAPES = Object.freeze(new Set(['co-tenant', 'standalone', 'control-plane']));
+// 'byo-host' is the shape this set excludes: the owner runs it, so there is nothing
+// for the runner to upgrade and queueing one would be the F16 lie — a request that is
+// accepted and never lands. This is a SEPARATE question from the control-plane guard,
+// which asks what may be aimed at the platform itself; a first cut conflated the two.
+// ('dedicated' was excluded here for the same reachability reason until ADR 0327
+// decision 4 removed the shape and provisioning_027 folded its value into 'cloud-host'.)
+const UPGRADE_SHAPES = Object.freeze(new Set(['co-tenant', 'cloud-host', 'control-plane']));
 
 // The shape of a core version as the pin records it. Deliberately strict and
 // three-part: the column's own CHECK carries the same pattern, so a value that

package/modules/provisioning/cost-ledger.js

@@ -0,0 +1,74 @@
+'use strict';
+// The fleet cost ledger (GET /provisioning/fleet/cost-ledger) — VISIBILITY only (ADR 0111 §6).
+//
+// It asks two questions, one column each (task 1004148, ADR 0327). Before, one column
+// asked both and reported a confident $0 for every project:
+//   platform_monthly_usd — what a row costs US. A cloud-host runs on its owner's own
+//     account, so $0 is correct; the one thing we pay for is the control plane's box.
+//   owner_monthly_usd    — an ESTIMATE of the owner's own hosting bill, never ours.
+// null in either column means UNPRICED — the row names no plan we can price — and is
+// never folded into a total as 0.
+
+const { HOSTING_SHAPES, TIER_MONTHLY_USD } = require('./provisioning');
+
+// What a cloud-host's owner pays Render per month, keyed by the plan stored in `tier`:
+// web service + Postgres, ~$13 at the default plans (ADR 0327). No row names a plan yet;
+// the Render standup (task 1004183) writes one, and the pilot (task 1004142) confirms
+// these names and prices.
+const RENDER_PLAN_MONTHLY_USD = Object.freeze({
+  'starter+basic-256mb': 13,
+});
+
+function priceOf(table, key) {
+  return typeof key === 'string' && Object.hasOwn(table, key) ? table[key] : null;
+}
+
+function platformMonthlyUsd({ hostingShape, tier } = {}) {
+  // The box the projects share today is priced once, here, by its droplet size.
+  if (hostingShape === 'control-plane') return priceOf(TIER_MONTHLY_USD, tier);
+  return HOSTING_SHAPES.includes(hostingShape) ? 0 : null;
+}
+
+function ownerMonthlyUsd({ hostingShape, tier } = {}) {
+  if (hostingShape === 'cloud-host') return priceOf(RENDER_PLAN_MONTHLY_USD, tier);
+  // co-tenant shares our box and the control plane is ours: no owner is billed for either.
+  if (hostingShape === 'co-tenant' || hostingShape === 'control-plane') return 0;
+  return null; // byo-host runs on the owner's own machine, whose bill we cannot see
+}
+
+function columnTotal(instances, key) {
+  const priced = instances.map((i) => i[key]).filter((v) => v !== null);
+  const sum = priced.reduce((a, v) => a + v, 0);
+  return { monthly_usd: Number(sum.toFixed(4)), unpriced: instances.length - priced.length };
+}
+
+// Per-instance costs + a total per column, over the instances not torn down.
+async function costLedger(db, { limit = 500 } = {}) {
+  const { rows } = await db.query(
+    `SELECT pi.id, pi.slug, pi.hosting_shape, pi.tier, pi.status, b.github_login
+       FROM provisioning_instances pi
+       JOIN builders b ON b.id = pi.owner_builder_id
+      WHERE pi.status <> 'torn_down'
+      ORDER BY pi.updated_at DESC
+      LIMIT $1`,
+    [Math.min(Math.max(Number(limit) || 500, 1), 2000)]
+  );
+  const instances = rows.map((r) => {
+    const shape = { hostingShape: r.hosting_shape, tier: r.tier };
+    return {
+      id: r.id, slug: r.slug, owner: r.github_login,
+      hosting_shape: r.hosting_shape, tier: r.tier, status: r.status,
+      platform_monthly_usd: platformMonthlyUsd(shape),
+      owner_monthly_usd: ownerMonthlyUsd(shape),
+    };
+  });
+  return {
+    instances,
+    totals: {
+      platform: columnTotal(instances, 'platform_monthly_usd'),
+      owner: columnTotal(instances, 'owner_monthly_usd'),
+    },
+  };
+}
+
+module.exports = { RENDER_PLAN_MONTHLY_USD, platformMonthlyUsd, ownerMonthlyUsd, costLedger };

package/modules/provisioning/migrations/provisioning_027_cloud_host_shape_rename.sql

@@ -0,0 +1,58 @@
+-- provisioning_027 — the stored hosting shapes take their owner-facing names
+-- (ADR 0323 §1, ADR 0327 decision 4, task 1004182).
+--
+-- provisioning_021 deliberately left the two managed shapes at their old stored
+-- spellings, on the grounds that task 1004142 would rename them "with those files
+-- already open". That task has since split; the rename is task 1004182 and this is it.
+--
+--   'standalone'  ->  'cloud-host'     the shape ADR 0323 renamed owner-facing
+--   'dedicated'   ->  'cloud-host'     the shape ADR 0327 decision 4 REMOVED
+--   'co-tenant'        unchanged       retired, but still storable -- see below
+--   'byo-host'         unchanged       the free front door, and the column DEFAULT
+--   'control-plane'    unchanged       the platform's own row, unrequestable
+--
+-- WHY 'dedicated' FOLDS INTO 'cloud-host' RATHER THAN BEING DROPPED. ADR 0327 decision 4
+-- removes the shape because "on the owner's own platform account a larger plan is a
+-- setting they choose, not a hosting shape we model", and its consequences say the value
+-- "must be migrated, not merely orphaned". A dedicated instance was a cloud-host on a
+-- bigger box, so cloud-host is where it belongs. Measured on the live fleet 2026-09-23
+-- there are ZERO 'dedicated' rows, so this is expected to update nothing -- but it is
+-- written to do the right thing rather than to assume the measurement still holds at
+-- the moment it runs, which is the whole reason it is an UPDATE and not an assertion.
+--
+-- 'co-tenant' STAYS IN THE SET, for the reason provisioning_021 gave and this migration
+-- does not revisit: retirement closes the door, not the record. One torn-down row still
+-- carries it, and dropping it from the constraint would make a historical row violate
+-- its own table. The door stays closed in code (paid-shape-gate.js lists it
+-- UNREQUESTABLE), never in the constraint.
+--
+-- THIS IS A NARROWING, WHICH THE PRECEDING FOUR CONSTRAINT REWRITES WERE NOT. fitness.js
+-- (isConstraintWidening) permits a `DROP CONSTRAINT IF EXISTS` paired with a re-`ADD
+-- CONSTRAINT` of the same name, and its comment justifies that as additive -- "no
+-- existing row changes and no data is lost". That justification does NOT describe this
+-- migration: rows change, and two values leave the set. It is safe for a different
+-- reason, which is the ORDER below.
+--
+-- THE ORDER IS DROP -> UPDATE -> ADD, AND ALL THREE POSITIONS MATTER. The obvious
+-- arrangement -- move the rows onto a legal value first, then narrow the constraint over
+-- them -- does not work, and fails immediately rather than subtly: the OLD constraint is
+-- still in force during that UPDATE and it does not admit 'cloud-host', so the very first
+-- row rewritten violates it. (Verified: that arrangement was written first and refused on
+-- a probe database with `new row ... violates check constraint`.) Dropping first leaves a
+-- window with NO constraint, which is exactly what the UPDATE needs; adding last closes it
+-- over rows that are already legal. Postgres runs a migration file in one implicit
+-- transaction, so the unconstrained window is never visible to another session.
+
+-- 1. Take the old constraint off. Nothing may constrain the column while it is rewritten.
+ALTER TABLE provisioning_instances DROP CONSTRAINT IF EXISTS provisioning_instances_hosting_shape_check;
+
+-- 2. Move the rows. Both old spellings land on the one surviving managed shape.
+UPDATE provisioning_instances SET hosting_shape = 'cloud-host'
+ WHERE hosting_shape IN ('standalone', 'dedicated');
+
+-- 3. Put the narrowed constraint back, now that nothing violates it.
+ALTER TABLE provisioning_instances ADD CONSTRAINT provisioning_instances_hosting_shape_check
+  CHECK (hosting_shape IN ('byo-host', 'co-tenant', 'cloud-host', 'control-plane'));
+
+-- The DEFAULT is already 'byo-host' (provisioning_021) and stays valid, so it is not
+-- touched here. Naming it is cheaper than the next reader re-deriving that it is safe.

package/modules/provisioning/onboard-plan.js

@@ -44,7 +44,7 @@
 // for one thing is how a filter starts silently matching nothing. The shape is absent
 // from CONTROL_PLANE_SHAPES, which is what drops the runner-performed legs from its plan
 // BY CONSTRUCTION rather than by a list someone has to remember to update.
-const CONTROL_PLANE_SHAPES = ['standalone', 'co-tenant', 'dedicated'];
+const CONTROL_PLANE_SHAPES = ['cloud-host', 'co-tenant'];
 const ALL_SHAPES = [...CONTROL_PLANE_SHAPES, 'byo-host'];
 
 function onboardPlan(mode = 'greenfield', opts = {}) {

package/modules/provisioning/paid-shape-gate.js

@@ -22,17 +22,29 @@
 //   co-tenant     — RETIRED (ADR 0323). Was the free front door; ran on the platform's
 //                   own box, which is why the name could not be carried over to
 //                   bring-your-own-host. Now UNREQUESTABLE — see below.
-//   dedicated     — allocates a real droplet (`scripts/gds/provision.js`), billed
-//                   monthly, defaulting to s-2vcpu-4gb when no tier is named.
-//   standalone    — runs the caller's OWN repo on the platform's box. The unit's
-//                   WorkingDirectory is that checkout (`scripts/gds/provision-units.js`)
-//                   and the module loader discovers modules from `resolveInstanceRoot()`,
-//                   which is process.cwd() (`src/module-loader/loader.js`). So the
-//                   caller names a repo and the platform require()s its `modules/` —
-//                   arbitrary code execution on the control plane's own machine. Task
-//                   1003369 gave each instance its own uid, which bounds the blast
-//                   radius to that account; it does not make "any Xenos may run code
-//                   here" an acceptable default.
+//   cloud-host    — runs the caller's OWN repo on a host the platform stands up. TODAY
+//                   that host is still the platform's own box, and that is what this
+//                   entry gates: the unit's WorkingDirectory is that checkout
+//                   (`scripts/gds/provision-units.js`) and the module loader discovers
+//                   modules from `resolveInstanceRoot()`, which is process.cwd()
+//                   (`src/module-loader/loader.js`). So the caller names a repo and the
+//                   platform require()s its `modules/` — arbitrary code execution on the
+//                   control plane's own machine. Task 1003369 gave each instance its own
+//                   uid, which bounds the blast radius to that account; it does not make
+//                   "any Xenos may run code here" an acceptable default.
+//
+//                   Once ADR 0327 lands, a cloud-host stands up on the OWNER's platform
+//                   account instead and that specific argument dissolves — but the gate
+//                   does NOT automatically follow, because the platform is still doing
+//                   the standing-up and still spending its own runner on it. Re-decide
+//                   this entry when the move happens (task 1004184); do not assume the
+//                   shape becomes open just because the box stops being ours.
+//
+//                   Stored as 'standalone' until task 1004182 renamed it to match the
+//                   owner-facing name (migration provisioning_027). The old 'dedicated'
+//                   value folded into this one: ADR 0327 decision 4 deleted that shape,
+//                   because on someone else's account a bigger plan is a setting, not a
+//                   hosting shape we model.
 //   control-plane — the platform's OWN row (ADR 0293 D2, task 1003159), enrolled by
 //                   `scripts/gds/enroll-control-plane.js` so the owner's deploy door has
 //                   something to point at. Never a thing a builder asks for. See below.
@@ -45,10 +57,11 @@
 // The set named below is the set that needs NO authority. Every other shape, including
 // one added after this file was last read, requires the permission by omission. The
 // previous shape of this gate listed the one shape that was gated and admitted the rest,
-// and that is exactly how `standalone` and `control-plane` stayed open: `standalone`
-// because it was reasoned about as "$0, therefore harmless" (true of the invoice, false
-// of the trust), and `control-plane` because it did not exist yet when the gate was
-// written. Permitted-by-omission is the failure mode this inversion removes.
+// and that is exactly how `cloud-host` and `control-plane` stayed open: `cloud-host`
+// (then stored as `standalone`) because it was reasoned about as "$0, therefore harmless"
+// — true of the invoice, false of the trust — and `control-plane` because it did not
+// exist yet when the gate was written. Permitted-by-omission is the failure mode this
+// inversion removes.
 //
 // The atom is `provisioning.fleet.manage` (floor: metic), deliberately the same one that
 // already guards the fleet cost-ledger and force-teardown. Spending on the fleet and

package/modules/provisioning/provisioning.js

@@ -24,8 +24,9 @@ const { normalizeModuleSelection, effectiveModules } = require('./starter-bundle
 // Constants (mirror the CHECK constraints in provisioning_001_tables.sql)
 // ---------------------------------------------------------------------------
 const INSTANCE_STATES = ['requested', 'provisioning', 'active', 'tearing_down', 'torn_down', 'error'];
-// Shapes, owner-facing names + why the spellings differ: ADR 0323 + this module's CLAUDE.md.
-const HOSTING_SHAPES = ['byo-host', 'co-tenant', 'dedicated', 'standalone', 'control-plane'];
+// Shapes + why 'co-tenant' is storable but unrequestable: this module's CLAUDE.md.
+// Stored values match the owner-facing names since task 1004182 (provisioning_027).
+const HOSTING_SHAPES = ['byo-host', 'co-tenant', 'cloud-host', 'control-plane'];
 // How the instance's repo was onboarded (migration provisioning_004, ADR 0121):
 //   greenfield — a fresh EMPTY repo; the runner scaffolds it and pushes the first commit
 //   adopt      — a repo the owner ALREADY has; the runner must LAYER onto it, preserving
@@ -102,11 +103,9 @@ const MAX_RELEASED_DOMAINS = 8;
 // provision intent cannot stand in for it: PROVISION_ENQUEUE_FROM deliberately
 // excludes 'active' (task 1002691).
 const SETTINGS_APPLY_FROM = new Set(['active']);
-// The hosting shapes the runner has a write path to. A 'dedicated' instance is
-// its own droplet, stood up by cloud-init — the runner has no post-hoc exec path
-// to it (the placeManifestCreds refusal) — so the route refuses the push HONESTLY
-// rather than queue one that never lands.
-const SETTINGS_APPLY_SHAPES = new Set(['co-tenant', 'standalone']);
+// The hosting shapes the runner has a write path to. 'byo-host' is absent (the owner runs
+// it, we reach into nothing) and so is 'control-plane' (the platform's own row).
+const SETTINGS_APPLY_SHAPES = new Set(['co-tenant', 'cloud-host']);
 // The ONE state a restart is meaningful from (task 1003238). Liveness is an
 // OVERLAY, not a seventh state — an instance the heartbeat cannot reach is still
 // 'active', and 'active' is exactly where a restart applies. Every earlier state
@@ -116,10 +115,9 @@ const SETTINGS_APPLY_SHAPES = new Set(['co-tenant', 'standalone']);
 // SETTINGS_APPLY_FROM: each action declaring its own gate is this module's
 // convention, and the two answer different questions.
 const RESTART_FROM = new Set(['active']);
-// Same reachability rule as the settings push, for the same reason: a 'dedicated'
-// droplet is stood up by cloud-init and the runner has no post-hoc exec path to
-// it, so the route refuses HONESTLY rather than queue a restart that never lands.
-const RESTART_SHAPES = new Set(['co-tenant', 'standalone']);
+// Same reachability rule as the settings push, and the same set for the same reason:
+// the runner can only restart what it runs.
+const RESTART_SHAPES = new Set(['co-tenant', 'cloud-host']);
 
 // Per-project settings (task 1003040, goal 1000058): the known keys + their
 // vocabularies, enforced at the API layer — the jsonb `settings` column
@@ -303,9 +301,16 @@ function isValidSlug(slug) {
   return true;
 }
 
-// Monthly USD estimate for a shape+tier. Co-tenant + standalone are free (they share
-// the box / run on the owner's own infra); only a dedicated droplet costs its tier's
-// rate (0 if the tier is unknown/unset). PURE.
+// Monthly USD estimate of what a shape costs THE PLATFORM. PURE.
+//
+// SINCE task 1004182 THIS RETURNS 0 FOR EVERY STORED ROW, and that is correct, not broken:
+// 'dedicated' was the only shape that priced above zero and provisioning_027 folded it into
+// 'cloud-host', so no row can carry it. ADR 0327 says a ledger of OUR spend "should read
+// ~$0 per cloud-host and be *correct*"; what an owner is worth telling is THEIR platform
+// cost, a different column — ownerMonthlyUsd in cost-ledger.js, which the fleet ledger
+// reads instead of this stored value. The 'dedicated' arm and the tier table stay because
+// this is pure and its tests call it with that value; the droplet code path is task
+// 1004185's to delete.
 function costEstimateUsd({ hostingShape, tier } = {}) {
   if (hostingShape !== 'dedicated') return 0;
   // An ABSENT tier is not an unknown one. The runner substitutes its own default
@@ -1430,30 +1435,6 @@ async function planetChoicesForHosts(db, hosts) {
   return out;
 }
 
-// Fleet cost ledger (Archon): per-instance monthly estimate + a total, over the
-// instances that still cost something (not torn_down). VISIBILITY only (ADR 0111 §6).
-async function costLedger(db, { limit = 500 } = {}) {
-  const { rows } = await db.query(
-    `SELECT pi.id, pi.slug, pi.hosting_shape, pi.tier, pi.status,
-            pi.cost_estimate_usd, b.github_login
-       FROM provisioning_instances pi
-       JOIN builders b ON b.id = pi.owner_builder_id
-      WHERE pi.status <> 'torn_down'
-      ORDER BY pi.cost_estimate_usd DESC, pi.updated_at DESC
-      LIMIT $1`,
-    [Math.min(Math.max(Number(limit) || 500, 1), 2000)]
-  );
-  const totalMonthlyUsd = rows.reduce((a, r) => a + Number(r.cost_estimate_usd || 0), 0);
-  return {
-    instances: rows.map((r) => ({
-      id: r.id, slug: r.slug, owner: r.github_login,
-      hosting_shape: r.hosting_shape, tier: r.tier, status: r.status,
-      cost_estimate_usd: Number(r.cost_estimate_usd || 0),
-    })),
-    total_monthly_usd: Number(totalMonthlyUsd.toFixed(4)),
-  };
-}
-
 module.exports = {
   // constants
   INSTANCE_STATES, HOSTING_SHAPES, ONBOARD_MODES, PROJECT_TYPES, INTENT_ACTIONS, TEARDOWN_FROM,
@@ -1484,7 +1465,7 @@ module.exports = {
   recordSettingsPushOwed,
   createInstance, setInstanceStatus, updateInstanceDomain, clearReleasedDomains, updateInstanceSettings, updateInstanceDetail,
   enqueueIntent, enqueueTeardown, enqueueSettingsApply, enqueueRestart, getOpenIntent, claimNextIntent, resolveIntent,
-  recordEvent, instanceStateForSlug, planetChoicesForHosts, projectOwnedBy, costLedger,
+  recordEvent, instanceStateForSlug, planetChoicesForHosts, projectOwnedBy,
   // data access — GitHub App Manifest attempts (task 2080)
   createOAuthManifest, getOAuthManifestByState, attachManifestCode,
   getLatestOAuthManifestForInstance, claimNextOAuthManifest, resolveOAuthManifest,

package/modules/provisioning/routes/provisioning.js

@@ -29,7 +29,7 @@
 //     GET    /provisioning/instances/:id/invite-suggestions — who is worth inviting (R28, ADR 0251)
 //   Archon-scoped (requireRank('archon') — the fleet, the /boxes precedent):
 //     GET    /provisioning/fleet                    — the full instance roster + the box's slot `capacity` (ADR 0285)
-//     GET    /provisioning/fleet/cost-ledger        — per-instance + total cost estimate
+//     GET    /provisioning/fleet/cost-ledger        — per-instance cost to us + to its owner, with totals
 //     POST   /provisioning/instances/:id/force-teardown — tear down ANY instance
 //   public:
 //     GET    /provisioning/health                   — liveness + core version
@@ -49,6 +49,7 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const auth = api, { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
+const { costLedger } = require('../cost-ledger');
 const { onboardPlan, stepsForShape } = require('../onboard-plan');
 const { ALWAYS_ON_CORE, OPTIONAL_MODULES, starterBundleAnswerTable, optionalModules, effectiveModules } = require('../starter-bundles');
 const { recommendationsForDetails } = require('../recommendations');
@@ -214,14 +215,14 @@ module.exports = function provisioningRoutes() {
     }
   });
 
-  // GET /provisioning/fleet/cost-ledger — per-instance monthly estimate + total.
+  // GET /provisioning/fleet/cost-ledger — per-instance monthly cost to us + estimated cost to its owner, with totals.
   // rank: archon — cost oversight across the fleet (the /boxes/cost-ledger precedent).
   // Declared among the archon routes (archon-first) for correct auditor classification.
   router.get('/provisioning/fleet/cost-ledger', auth.requireBuilder, auth.requirePermission('provisioning.fleet.manage'), async (req, res) => {
     try {
       // R14 (#2001 / ADR 0119): shared helper; per-endpoint cap preserved (default 500, max 2000).
       const { limit } = api.parsePagination(req, { defaultLimit: 500, maxLimit: 2000 });
-      const out = await provisioning.costLedger(pool, { limit });
+      const out = await costLedger(pool, { limit });
       res.json(out);
     } catch (err) {
       log.error('[provisioning] GET /provisioning/fleet/cost-ledger', err);

package/modules/provisioning/routes/repo-private.js

@@ -26,7 +26,7 @@ function unavailableReason(inst) {
   if (inst.hosting_shape === 'byo-host') {
     return 'This project runs on your own host, so the platform never reads its code — you can make the repository private on GitHub directly.';
   }
-  if (inst.hosting_shape !== 'standalone') {
+  if (inst.hosting_shape !== 'cloud-host') {
     return 'Only a project on a Cloud host can have its repository made private from here.';
   }
   if (inst.status !== 'active') {

package/modules/provisioning/tests/liveness.mjs

@@ -307,15 +307,23 @@ await ta('a redirecting healthz is DOWN — the probe never follows a redirect (
 
 console.log('\nshape-aware onboard plan (direction §7 — no promises a shape cannot keep):');
 
-t('runner-performed legs are absent from the self-host plan; control-plane shapes keep everything', () => {
-  const { onboardPlan, stepsForShape } = require('../onboard-plan.js');
+t('runner-performed legs are absent from the byo-host plan; control-plane shapes keep everything', () => {
+  // The shape here was 'self-host' until task 1004182 noticed it had stopped meaning
+  // anything. ADR 0323 (task 1004141) replaced that plan-only spelling with 'byo-host' in
+  // ALL_SHAPES, so 'self-host' became an UNKNOWN shape — and an unknown shape is
+  // deliberately unfiltered (the last assertion in this case), which handed the full plan
+  // back and made every "absent on self-host" assertion below fail. It has been red since,
+  // masked because the DB-backed cases in this file fail first on any machine without a
+  // local Postgres. Pinning the live spelling is what makes the filter actually tested.
+  const { onboardPlan, stepsForShape, ALL_SHAPES } = require('../onboard-plan.js');
+  assert.ok(ALL_SHAPES.includes('byo-host'), 'the filtered shape must be one the plan knows, or this case tests nothing');
   const all = onboardPlan('greenfield');
-  const standalone = stepsForShape(all, 'standalone');
-  assert.equal(standalone.length, all.length, 'a control-plane shape gets the full sequence');
-  const selfHost = stepsForShape(all, 'self-host');
+  const cloudHost = stepsForShape(all, 'cloud-host');
+  assert.equal(cloudHost.length, all.length, 'a control-plane shape gets the full sequence');
+  const selfHost = stepsForShape(all, 'byo-host');
   const selfKeys = selfHost.map((s) => s.key);
   for (const runnerLeg of ['provision', 'oauth-place', 'dns-preflight']) {
-    assert.ok(!selfKeys.includes(runnerLeg), `${runnerLeg} assumes the platform runner — absent on self-host`);
+    assert.ok(!selfKeys.includes(runnerLeg), `${runnerLeg} assumes the platform runner — absent on byo-host`);
   }
   for (const human of ['github-repo', 'oauth-app', 'first-sign-in', 'enter-hall']) {
     assert.ok(selfKeys.includes(human), `${human} is the owner's own leg — present on every shape`);
@@ -374,7 +382,7 @@ console.log('\nAPI exposure — the overlay rides the instance reads:');
 
 await ta('GET /provisioning/instances carries last_verified_at + last_verified_up', async () => {
   instance = {
-    id: 18, owner_builder_id: 7, slug: 'mercury', status: 'active', hosting_shape: 'standalone',
+    id: 18, owner_builder_id: 7, slug: 'mercury', status: 'active', hosting_shape: 'cloud-host',
     domain: 'mercury.cloudbongos.com', port: 3101,
     last_verified_at: '2026-08-12T10:00:00.000Z', last_verified_up: true,
   };
@@ -403,7 +411,7 @@ t("PROVISION_ENQUEUE_FROM allows 'error' (the state a snagged card is in)", () =
 await ta("POST /provisioning/instances on an 'error' instance re-enqueues a provision intent", async () => {
   enqueueCalls.length = 0;
   createResult = {
-    instance: { id: 20, owner_builder_id: 7, slug: 'snagged', status: 'error', hosting_shape: 'standalone', domain: null },
+    instance: { id: 20, owner_builder_id: 7, slug: 'snagged', status: 'error', hosting_shape: 'cloud-host', domain: null },
     created: false,
   };
   const res = await req('POST', '/provisioning/instances', { slug: 'snagged' });

package/modules/provisioning/tests/provisioning.mjs

@@ -172,7 +172,7 @@ t('an UNRECOGNISED tier is still $0 — unpriced rather than wrong', () => {
 });
 
 t('every non-dedicated shape is $0 — it co-tenants on infrastructure already paid for', () => {
-  for (const shape of ['standalone', 'co-tenant', 'shared', undefined]) {
+  for (const shape of ['cloud-host', 'co-tenant', 'shared', undefined]) {
     assert.equal(P.costEstimateUsd({ hostingShape: shape, tier: 's-4vcpu-8gb' }), 0,
       `shape ${JSON.stringify(shape)} is never metered, whatever tier rides along`);
   }

package/modules/public-landing/public/projects.html

@@ -3959,8 +3959,8 @@ summary{min-height:24px;padding:3px 0;}
         ['Address', resolvedDomain()
           ? '<code>' + esc(resolvedDomain()) + '</code>'
           : '<em style="font-weight:600;color:var(--warn)">none — sign-in stays locked until it has one</em>'],
-        /* The wizard creates hosting_shape 'standalone', whose owner-facing name is
-           "cloud host" (ADR 0323) — we stand it up and run it for them. */
+        /* The wizard creates hosting_shape 'cloud-host' — we stand it up and run it for
+           them. Since task 1004182 the stored value IS the owner-facing name (ADR 0323). */
         ['Shape', 'Cloud host — we stand it up and run it for you, on the platform’s current release']
       ];
       $('reviewList').innerHTML = rows.map(function (r) {
@@ -4050,7 +4050,7 @@ summary{min-height:24px;padding:3px 0;}
                the server then applies the SAME starter bundle the panel showed,
                so a skip and an accept land the same modules */
             modules: modulesForCreate(),
-            hosting_shape: 'standalone',
+            hosting_shape: 'cloud-host',
             /* ONLY a bring-your-own domain travels (task 1002898 N2). The server owns
                the assigned <slug>.<apex> default (task 1002704) and applies it to an
                omitted domain, so re-sending our own derived copy could only disagree
@@ -4144,9 +4144,9 @@ summary{min-height:24px;padding:3px 0;}
       var domain = resolvedDomain() || '';
       var key = state.mode + '|' + domain;
       if (!planPromises[key]) {
-        /* shape=standalone: this wizard only creates control-plane standalone
+        /* shape=cloud-host: this wizard only creates control-plane cloud-host
            instances, and the plan is shape-filtered server-side (direction §7) */
-        planPromises[key] = fetch(API + '/provisioning/onboard-plan?mode=' + encodeURIComponent(state.mode) + '&shape=standalone' + (domain ? '&domain=' + encodeURIComponent(domain) : ''))
+        planPromises[key] = fetch(API + '/provisioning/onboard-plan?mode=' + encodeURIComponent(state.mode) + '&shape=cloud-host' + (domain ? '&domain=' + encodeURIComponent(domain) : ''))
           .then(function (res) { if (!res.ok) throw new Error('plan'); return res.json(); })
           .then(function (d) { return (d && d.steps) || []; })
           .catch(function () {
@@ -4601,8 +4601,7 @@ summary{min-height:24px;padding:3px 0;}
       } else if (s === 'tearing_down') {
         /* a deliberate end is calm, never styled as a failure (direction §5) —
            and it speaks the teardown vocabulary, not the standup's (F22) */
-        setProgress(progressMarkup(1, 1, 'Taking the server offline. The repository stays yours; ' +
-          (inst.hosting_shape === 'dedicated' ? 'its database goes with the machine.' : 'the database is kept.'), '', 'teardown'));
+        setProgress(progressMarkup(1, 1, 'Taking the server offline. The repository stays yours; the database is kept.', '', 'teardown'));
       } else if (s === 'torn_down') {
         setProgress(progressMarkup(-1, 3, 'This instance was torn down. Bring it back any time from ' +
           projectPageLink('its own page') + ', or start another below.', '', 'teardown'));
@@ -5063,8 +5062,7 @@ summary{min-height:24px;padding:3px 0;}
      brand-new project never grows a Restart button it has no use for. A door on
      every healthy card would only invite needless downtime. */
   function canRestart(inst) {
-    return inst.status === 'active' && inst.last_verified_up === false &&
-      inst.hosting_shape !== 'dedicated' && !inst.open_intent;
+    return inst.status === 'active' && inst.last_verified_up === false && !inst.open_intent;
   }
   /* keep watching while the platform is doing something to this instance */
   function shouldWatch(inst) {
@@ -5172,8 +5170,7 @@ summary{min-height:24px;padding:3px 0;}
                : 'Raising the server, database, and address — nothing needed from you.');
     }
     if (s === 'tearing_down') {
-      return stripMarkup('teardown', 1, 1, 'Taking the server offline. The repository stays yours; ' +
-        (inst.hosting_shape === 'dedicated' ? 'its database goes with the machine.' : 'the database is kept.'));
+      return stripMarkup('teardown', 1, 1, 'Taking the server offline. The repository stays yours; the database is kept.');
     }
     if (inst.open_intent) {
       var a = inst.open_intent.action;
@@ -5242,16 +5239,22 @@ summary{min-height:24px;padding:3px 0;}
   /* ── rendering ───────────────────────────────────────────────────────── */
 
   /* The owner-facing name of each hosting shape (ADR 0323). This map IS the translation
-     between the stored value and the word the owner reads: 'standalone' and 'dedicated'
-     keep their old spellings in the database on purpose (task 1004142 renames the data),
-     so this is the ONLY place that difference should ever be visible. Read as a noun
-     phrase — it lands in a meta list and in the "server" ledger row.
-     'co-tenant' is retired and unrequestable, but one torn-down row still carries it,
-     so it keeps a label rather than falling through to the raw value. */
+     between the stored value and the word the owner reads. Read as a noun phrase — it
+     lands in a meta list and in the "server" ledger row.
+
+     Since task 1004182 (migration provisioning_027) the stored values ARE the
+     owner-facing words, so most of this map is now an identity. It is kept, rather than
+     collapsed into a bare `inst.hosting_shape`, for the two entries that still translate
+     — 'byo-host' and 'co-tenant' — and because the callers already fall through to the
+     raw value for an unknown shape, which is the behaviour a future shape should get.
+
+     'co-tenant' is retired and unrequestable, but one torn-down row still carries it, so
+     it keeps a label rather than falling through. 'dedicated' is gone entirely (ADR 0327
+     decision 4) and its rows folded into 'cloud-host', so it needs no label: a row that
+     could show one no longer exists. */
   var SHAPE_LABEL = {
     'byo-host': 'your own host',
-    standalone: 'cloud host',
-    dedicated: 'dedicated cloud host',
+    'cloud-host': 'cloud host',
     'co-tenant': 'shared server (retired)',
     'control-plane': 'the control plane'
   };
@@ -5269,9 +5272,7 @@ summary{min-height:24px;padding:3px 0;}
        and provisioning keep the built-world text on purpose — a run that failed
        partway may already have a database, a port and a DNS record. */
     if (inst && inst.status === 'requested') return 'Nothing has been stood up yet — this cancels the standup. Anything already on GitHub is untouched, and the name and web address stay reserved for this project.';
-    return inst && inst.hosting_shape === 'dedicated'
-      ? 'This project has a machine to itself, so the machine goes away and its database goes with it. Your repository is untouched. Its web address stays reserved for this project, and nothing answers there until you bring it back. Taking it offline erases nothing.'
-      : 'The server goes away. Your repository is untouched. The database is kept, so bringing it back later restores its memory. Its web address stays reserved for this project, and nothing answers there until you bring it back. Taking it offline erases nothing.';
+    return 'The server goes away. Your repository is untouched. The database is kept, so bringing it back later restores its memory. Its web address stays reserved for this project, and nothing answers there until you bring it back. Taking it offline erases nothing.';
   }
 
   /* onManage: the same facts, but the pointers name the controls THIS surface
@@ -5371,9 +5372,7 @@ summary{min-height:24px;padding:3px 0;}
       /* with a revive queued, the strip tells the story — this paragraph would
          contradict it (F22, the same guard the error paragraph has) */
       body += '<div class="projMsg">Torn down' + (inst.torn_down_at ? ' ' + esc(shortDate(inst.torn_down_at)) : '') +
-        (inst.hosting_shape === 'dedicated'
-          ? '. The repository is still yours. Bringing it back stands up a fresh machine with an empty database. Or <a href="?view=new">start another</a>.</div>'
-          : '. The repository is still yours, and its database is kept — bringing it back takes one click. Or <a href="?view=new">start another</a>.</div>');
+        '. The repository is still yours, and its database is kept — bringing it back takes one click. Or <a href="?view=new">start another</a>.</div>';
     }
     var lm = lastMsg[inst.id];
     /* a live region: an action's result is announced where the pointer is,
@@ -5663,7 +5662,7 @@ summary{min-height:24px;padding:3px 0;}
     var box = $('mMsg');
     box.className = 'projMsg'; box.textContent = verb === 'revive' ? 'Asking the platform to bring it back…' : 'Asking the platform to try again…';
     $('mActs').querySelectorAll('button').forEach(function (b) { b.disabled = true; });
-    var body = { slug: inst.slug, hosting_shape: inst.hosting_shape || 'standalone' };
+    var body = { slug: inst.slug, hosting_shape: inst.hosting_shape || 'cloud-host' };
     if (inst.onboard_mode) body.onboard_mode = inst.onboard_mode;
     if (inst.target_ref) body.target_ref = inst.target_ref;
     if (inst.domain) body.domain = inst.domain;
@@ -5983,7 +5982,7 @@ summary{min-height:24px;padding:3px 0;}
   function repoPrivDoor(inst, repo) {
     if (!inst) return '';
     var why = inst.hosting_shape === 'byo-host' ? 'This project runs on your own host, so the platform never reads its code — you can make the repository private on GitHub directly.'
-      : inst.hosting_shape !== 'standalone' ? 'Only a project on a Cloud host can have its repository made private from here.'
+      : inst.hosting_shape !== 'cloud-host' ? 'Only a project on a Cloud host can have its repository made private from here.'
       : inst.status !== 'active' ? 'You can make it private once the project is running.'
       : !repo.admin ? 'Your GitHub account can’t change this repository’s settings.'
       : '';

package/modules/ui-design/kit/fixtures/provisioning-instances.json

@@ -25,7 +25,7 @@
       "status": "provisioning", "planet_template": "blob-frost-tint", "planet_accent": "sun-lit",
       "domain": null,
       "target_ref": "builder/harbor",
-      "hosting_shape": "standalone",
+      "hosting_shape": "cloud-host",
       "onboard_mode": "scaffold",
       "created_at": "$now-6m",
       "provisioned_at": null,