@bongos/core 1.19.999 → 1.19.1001

package/tests/core_upgrade_runner.mjs

@@ -264,7 +264,7 @@ await t('the upgrade CLI is run somewhere it ACTUALLY EXISTS — the bug that br
   //   Error: Cannot find module '/srv/<base>/<slug>/scripts/gds/upgrade.js'
   // No assertion about FLAGS could have caught it, so this one resolves the composed
   // cwd + relative CLI against the real filesystem, for every shape the door admits.
-  for (const shape of ['control-plane', 'standalone', 'co-tenant']) {
+  for (const shape of ['control-plane', 'cloud-host', 'co-tenant']) {
     const d = makeDeps({ served: '1.19.762' });
     await R.coreUpgradeInstance(inst({ hosting_shape: shape, slug: 'hermeslines-marketing', port: 3011 }), d, intent());
     const call = d.ranWith.find((c) => /upgrade\.js/.test(c.cmd));
@@ -278,7 +278,7 @@ await t('the upgrade CLI is run somewhere it ACTUALLY EXISTS — the bug that br
 
 await t('a standalone tenant is NAMED with --instance, because the CLI no longer runs inside it', async () => {
   const d = makeDeps({ served: '1.19.762' });
-  await R.coreUpgradeInstance(inst({ hosting_shape: 'standalone', slug: 'hermeslines-marketing', port: 3011 }), d, intent());
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'cloud-host', slug: 'hermeslines-marketing', port: 3011 }), d, intent());
   const cmd = d.ran.find((c) => /upgrade\.js/.test(c));
   assert.match(cmd, /--instance \S*hermeslines-marketing/, 'the target is named explicitly');
   assert.ok(cmd.includes('--service hermeslines-marketing'), 'and its own unit is still the one restarted');
@@ -475,7 +475,7 @@ await t('the control plane upgrades as the operator account, never as root', asy
 
 await t('a tenant upgrades as its OWN account, which is also its Postgres login role', async () => {
   const d = { ...makeDeps({ served: '1.19.762' }), privileged: true };
-  await R.coreUpgradeInstance(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), d, intent());
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), d, intent());
   const cmd = upgradeCall(d);
   assert.match(cmd, /sudo -u bongos-test4 /, 'the instance account, not the operator and not root');
   assert.doesNotMatch(cmd, /sudo -u appsvc /, 'one tenant must never be upgraded under another account');
@@ -487,7 +487,7 @@ await t('the database is NAMED, not discovered — an adopted repo has no core a
   // upgrade died with "cannot determine which database to migrate".
   const d = { ...makeDeps({ served: '1.19.762' }), privileged: true };
   await R.coreUpgradeInstance(
-    inst({ hosting_shape: 'standalone', slug: 'hermeslines-marketing', db_name: 'hermeslines-marketing', port: 3011 }), d, intent());
+    inst({ hosting_shape: 'cloud-host', slug: 'hermeslines-marketing', db_name: 'hermeslines-marketing', port: 3011 }), d, intent());
   assert.match(upgradeCall(d), /env PGDATABASE=hermeslines-marketing /, 'the runner passes the name the control plane already holds');
 });
 
@@ -502,7 +502,7 @@ await t('an UNPRIVILEGED runner still adds no sudo and no env at all', async ()
   // it so the fix above cannot quietly start requiring sudo where there is none.
   const d = makeDeps({ served: '1.19.762' });
   d.privileged = false;
-  await R.coreUpgradeInstance(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), d, intent());
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), d, intent());
   const cmd = upgradeCall(d);
   assert.doesNotMatch(cmd, /sudo/, 'no escalation when the runner is not privileged');
   assert.match(cmd, /^node \S*scripts\/gds\/upgrade\.js /, 'it still invokes the CLI directly');
@@ -531,7 +531,7 @@ await t('ONE builder serves both legs — the preview and the move cannot drift
   // Everything deciding whether the upgrade is ALLOWED must be identical; only the tail
   // that describes what happens AFTER the pin moves may differ, because a dry run stops
   // before it.
-  const box = { id: 7, slug: 'test4', port: 3006, hosting_shape: 'standalone', db_name: 'test4' };
+  const box = { id: 7, slug: 'test4', port: 3006, hosting_shape: 'cloud-host', db_name: 'test4' };
   const move = R.upgradeInvocation(box, '1.19.921', { privileged: true, requestedBy: '42' });
   const peek = R.upgradeInvocation(box, '1.19.921', { privileged: true, dryRun: true });
   for (const shared of ['sudo -u bongos-test4 ', 'env PGDATABASE=test4 ', '--to 1.19.921', '--registry']) {
@@ -552,13 +552,13 @@ await t('ONE builder serves both legs — the preview and the move cannot drift
 await t('an invalid slug is refused at the BUILDER, not left to a helper to throw', () => {
   // The slug reaches a shell through instanceUser()/dbName(). Depending on another
   // function's internals for that is one refactor away from an injection path.
-  assert.throws(() => R.upgradeInvocation({ slug: 'a; rm -rf /', port: 1, hosting_shape: 'standalone' }, '1.19.921', {}),
+  assert.throws(() => R.upgradeInvocation({ slug: 'a; rm -rf /', port: 1, hosting_shape: 'cloud-host' }, '1.19.921', {}),
     /invalid slug/);
 });
 
 await t('a dry run that fails WITHOUT a recognisable marker is still a refusal, never a pass', () => {
   const deps = { privileged: false, exec: () => ({ ok: false, stdout: 'something went sideways' }) };
-  const r = R.preflightUpgrade({ id: 7, slug: 'test4', port: 3006, hosting_shape: 'standalone' }, '1.19.921', deps);
+  const r = R.preflightUpgrade({ id: 7, slug: 'test4', port: 3006, hosting_shape: 'cloud-host' }, '1.19.921', deps);
   assert.equal(r.ok, false, 'a non-zero exit is a refusal whatever it printed');
   assert.ok(r.error);
 });
@@ -716,7 +716,7 @@ await t('a tenant WITH its own account runs as that account — the security mod
   // task 1003369: a distinct uid per instance is what stops a co-tenant reading a
   // sibling's /proc/<pid>/environ. Falling back everywhere would quietly undo it.
   const d = acctDeps({ accountExists: true });
-  const r = R.resolveRunAs(inst({ hosting_shape: 'standalone', slug: 'test4' }), d);
+  const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
   assert.deepEqual({ runAs: r.runAs, fellBack: r.fellBack }, { runAs: 'bongos-test4', fellBack: false });
 });
 
@@ -726,7 +726,7 @@ await t('a tenant WITHOUT one falls back to the app user, and says so', () => {
   // instance's own unit already says User=lars — but it IS a provisioning gap, so it
   // is reported rather than silently papered over.
   const d = acctDeps({ accountExists: false });
-  const r = R.resolveRunAs(inst({ hosting_shape: 'standalone', slug: 'test4' }), d);
+  const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
   assert.equal(r.runAs, 'appsvc');
   assert.equal(r.fellBack, true);
   assert.equal(r.wanted, 'bongos-test4', 'and names the account that is missing');
@@ -741,7 +741,7 @@ await t('the control plane is never probed — it has no instance account by des
 
 await t('the dry run is invoked as the account that actually exists', async () => {
   const d = acctDeps({ accountExists: false, dryRunStdout: '  ✓ pre-flight: ok\n' });
-  await R.preflightUpgrade(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), '1.19.762', d);
+  await R.preflightUpgrade(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), '1.19.762', d);
   const cmd = (d.ranWith.find((c) => /upgrade\.js/.test(c.cmd)) || {}).cmd || '';
   assert.match(cmd, /sudo -u appsvc /, `must not sudo to an account that does not exist — got: ${cmd}`);
   assert.doesNotMatch(cmd, /bongos-test4/);
@@ -749,7 +749,7 @@ await t('the dry run is invoked as the account that actually exists', async () =
 
 await t('the MOVE probes identically, so preview and move cannot diverge on the account', async () => {
   const d = acctDeps({ accountExists: false });
-  await R.coreUpgradeInstance(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), d, intent());
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), d, intent());
   const cmd = (d.ranWith.find((c) => /upgrade\.js/.test(c.cmd)) || {}).cmd || '';
   assert.match(cmd, /sudo -u appsvc /, 'the move follows the same probe as the preview');
 });
@@ -761,7 +761,7 @@ await t('an INCONCLUSIVE probe keeps the isolated account rather than quietly wi
   // well exist. Only `no such user` is evidence.
   const d = makeDeps({ served: '1.19.762' });
   d.exec = () => ({ ok: true, stdout: '', stderr: 'id: cannot connect to name service\n', softFailed: true });
-  const r = R.resolveRunAs(inst({ hosting_shape: 'standalone', slug: 'test4' }), d);
+  const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
   assert.equal(r.runAs, 'bongos-test4', 'the intended account is kept');
   assert.equal(r.fellBack, false);
   assert.equal(r.probeInconclusive, true, 'and the caller can tell it was not a clean answer');
@@ -776,7 +776,7 @@ await t('the probe uses the SAME executor the upgrade will use', () => {
   const d = makeDeps({ served: '1.19.762' });
   d.controlExec = (cmd) => { asked.control.push(cmd); return { ok: true, stdout: '1001\n' }; };
   d.exec = (cmd) => { asked.remote.push(cmd); return { ok: true, stdout: '', stderr: "id: 'x': no such user\n", softFailed: true }; };
-  const r = R.resolveRunAs(inst({ hosting_shape: 'standalone', slug: 'test4' }), d);
+  const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
   assert.deepEqual(asked.remote, [], 'the remote executor was not asked');
   assert.equal(asked.control.length, 1, 'the control-plane executor was');
   assert.equal(r.runAs, 'bongos-test4', 'and its answer is the one that counts');
@@ -788,7 +788,7 @@ await t('a planning tick probes ONCE, not twice', async () => {
   // a subprocess per tick for nothing.
   const d = acctDeps({ accountExists: false });
   d.apply = false;
-  await R.coreUpgradeInstance(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), d, intent());
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), d, intent());
   assert.equal(d.ranWith.filter((c) => /^id -u /.test(c.cmd)).length, 1,
     'exactly one probe: the dry run that actually executes');
 });
@@ -800,7 +800,7 @@ await t('an invalid slug is refused by THIS call site, not merely by the helper
   // helper's internals, so the assertion names the thrower.
   const d = acctDeps({});
   assert.throws(
-    () => R.resolveRunAs({ hosting_shape: 'standalone', slug: 'bad slug;rm -rf /' }, d),
+    () => R.resolveRunAs({ hosting_shape: 'cloud-host', slug: 'bad slug;rm -rf /' }, d),
     /resolveRunAs: refusing to probe/,
     'the refusal must come from this function, not from instanceUser further down',
   );
@@ -809,7 +809,7 @@ await t('an invalid slug is refused by THIS call site, not merely by the helper
 
 await t('a refusal reports what the command SAID, not "did not complete"', async () => {
   const d = acctDeps({ softFail: true, dryRunStderr: 'sudo: unknown user bongos-test4\n' });
-  const v = await R.preflightUpgrade(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), '1.19.762', d);
+  const v = await R.preflightUpgrade(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), '1.19.762', d);
   assert.equal(v.ok, false);
   assert.match(v.error, /unknown user bongos-test4/,
     `the reason was in hand and must travel — got: ${JSON.stringify(v.error)}`);
@@ -817,21 +817,21 @@ await t('a refusal reports what the command SAID, not "did not complete"', async
 
 await t('a ✖ line still wins over the raw tail', async () => {
   const d = acctDeps({ softFail: true, dryRunStdout: 'noise\n  ✖ already on 1.19.927 (pass --force to re-run)\n' });
-  const v = await R.preflightUpgrade(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), '1.19.762', d);
+  const v = await R.preflightUpgrade(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), '1.19.762', d);
   assert.match(v.error, /already on 1\.19\.927/);
   assert.doesNotMatch(v.error, /^noise/, 'the parsed refusal is preferred to the raw tail');
 });
 
 await t('a fallback is recorded on the verdict the owner reads', async () => {
   const d = acctDeps({ accountExists: false, dryRunStdout: '  ✓ pre-flight: ok\n' });
-  const v = await R.preflightUpgrade(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), '1.19.762', d);
+  const v = await R.preflightUpgrade(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), '1.19.762', d);
   assert.equal(v.ran_as, 'appsvc');
   assert.match(v.account_note, /no bongos-test4 account yet/);
 });
 
 await t('and a silent failure STILL refuses rather than inventing a pass', async () => {
   const d = acctDeps({ softFail: true, dryRunStdout: '', dryRunStderr: '' });
-  const v = await R.preflightUpgrade(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), '1.19.762', d);
+  const v = await R.preflightUpgrade(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), '1.19.762', d);
   assert.equal(v.ok, false, 'a command that said nothing is not a pass');
   assert.match(v.error, /said nothing/);
 });

package/tests/deploy_page_projects.mjs

@@ -22,7 +22,7 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/deploy.js'), 'utf8');
 
 const preview = (id, slug, over = {}) => ({
-  instance_id: id, slug, hosting_shape: 'standalone',
+  instance_id: id, slug, hosting_shape: 'cloud-host',
   served_version: '1.19.800', recommended_version: '1.19.871',
   behind: true, reading: 'ok', observed_at: new Date().toISOString(), open_intent: null,
   ...over,
@@ -30,11 +30,11 @@ const preview = (id, slug, over = {}) => ({
 
 // The fleet as the control plane really reports it: mostly torn down, a couple live.
 const FLEET = [
-  { id: '31', slug: 'mercury', status: 'active', hosting_shape: 'standalone' },
+  { id: '31', slug: 'mercury', status: 'active', hosting_shape: 'cloud-host' },
   { id: '32', slug: 'hoodify-finance', status: 'active', hosting_shape: 'co-tenant' },
-  { id: '33', slug: 'walk-lantern', status: 'torn_down', hosting_shape: 'standalone' },
-  { id: '34', slug: 'testccc', status: 'torn_down', hosting_shape: 'standalone' },
-  { id: '35', slug: 'unreadable-one', status: 'active', hosting_shape: 'standalone' },
+  { id: '33', slug: 'walk-lantern', status: 'torn_down', hosting_shape: 'cloud-host' },
+  { id: '34', slug: 'testccc', status: 'torn_down', hosting_shape: 'cloud-host' },
+  { id: '35', slug: 'unreadable-one', status: 'active', hosting_shape: 'cloud-host' },
 ];
 
 function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus = 200, fleet = FLEET, fleetStatus = 200, instanceOver = null, moveTries = 4, postStatus = 200, scope = null } = {}) {

package/tests/hall_collab_world.mjs

@@ -108,8 +108,12 @@ test('the server names the people on a row through a join, and the writes stay b
     const body = src.slice(src.indexOf(`async function ${fn}`));
     assert.match(body.slice(0, 700), /SELECT \$\{LIST_COLS\} \$\{LIST_FROM\}/, `${fn} reads the joined columns`);
   }
-  const upd = src.slice(src.indexOf('async function setHelpRequestStatus'));
-  assert.match(upd.slice(0, 600), /RETURNING \$\{COLS\}/, 'the UPDATE cannot reach a joined alias, so it returns the bare columns');
+  // Sliced to the end of the function rather than a character count: task
+  // 1004216 widened who may settle, so the body grew past the old 600-char
+  // window and a fixed slice would report the property missing when it is there.
+  const from = src.indexOf('async function setHelpRequestStatus');
+  const upd = src.slice(from, src.indexOf('\n}', from));
+  assert.match(upd, /RETURNING \$\{COLS\}/, 'the UPDATE cannot reach a joined alias, so it returns the bare columns');
 });
 
 test('the first line is decided: the ask\'s first sentence is the title, the rest the sub, no word lost', () => {

package/tests/help_requests.mjs

@@ -141,11 +141,62 @@ test('the addressed read excludes your own requests', () => {
   assert.match(fn.slice(0, 700), /status = 'open'/, 'and settled requests are history');
 });
 
-test('only the ASKER can settle their own request', () => {
-  const src = read('modules', 'lifecycle', 'help-requests.js');
-  const fn = src.slice(src.indexOf('async function setHelpRequestStatus'));
-  assert.match(fn.slice(0, 600), /requested_by = \$2/, 'ownership is in the WHERE, not in rank');
-  assert.match(fn.slice(0, 600), /status = 'open'/, 'and a settled request cannot be re-settled');
+// WHO MAY SETTLE — widened by task 1004216 / ADR 0330, and RUN rather than
+// grepped, because the rule is now a shape (asker OR addressee, except for
+// withdraw) that a source scan would agree with while the SQL said otherwise.
+async function settleSql(args) {
+  const calls = [];
+  const pool = { query: async (sql, params) => { calls.push({ sql, params }); return { rows: [{ id: 1 }] }; } };
+  await help.setHelpRequestStatus(args, { pool });
+  return calls[0];
+}
+
+test('the asker still settles, and the rule lives in the WHERE rather than in rank', async () => {
+  const c = await settleSql({ id: 1, builderId: 7, status: 'answered', crafts: [] });
+  assert.match(c.sql, /requested_by = \$2/, 'ownership is in the WHERE, not in rank');
+  assert.match(c.sql, /status = 'open'/, 'and a settled request cannot be re-settled');
+});
+
+test('the ADDRESSEE can close an ask too — by name, or through a craft they belong to', async () => {
+  // The defect this fixes: a request addressed to someone who has just answered
+  // it on the page, and still cannot close it, is a surface arguing with itself.
+  const c = await settleSql({ id: 1, builderId: 7, status: 'answered', crafts: ['artist'] });
+  assert.match(c.sql, /needs_builder_id = \$2/, 'the person a request names');
+  assert.match(c.sql, /needs_craft = ANY\(\$5::text\[\]\)/, 'or a craft they belong to');
+  assert.deepEqual(c.params[4], ['artist'], 'and the crafts are bound, never interpolated');
+  assert.equal(c.params[3], false, 'the asker-only switch is off for answered');
+});
+
+test('WITHDRAW stays the asker\'s alone — an addressee cannot make an ask disappear', async () => {
+  // Withdrawing means "I no longer need this", which only the person who needed
+  // it can say. An addressee who wants rid of an ask answers it and closes it,
+  // in the open, with their name on both.
+  const c = await settleSql({ id: 1, builderId: 7, status: 'withdrawn', crafts: ['artist'] });
+  assert.equal(c.params[3], true, 'the asker-only switch is ON for withdrawn');
+  assert.match(c.sql, /\$4::boolean IS FALSE/, 'and it gates the addressee branch, not the asker one');
+});
+
+test('a craft the caller does not hold is filtered out before it binds', async () => {
+  // The same fail-closed rule the addressed read learned the hard way: a craft
+  // value that did not come from the caller's own profile must never widen a
+  // scope. Here it would let anyone close any craft-addressed ask.
+  const c = await settleSql({ id: 1, builderId: 7, status: 'answered', crafts: ['wizard', 'artist'] });
+  assert.deepEqual(c.params[4], ['artist'], 'an unknown craft is dropped, not passed through');
+});
+
+test('settling records WHO settled it', async () => {
+  const c = await settleSql({ id: 1, builderId: 7, status: 'answered', crafts: [] });
+  assert.match(c.sql, /settled_by = \$2/, 'now that two different people can close an ask, which one matters');
+});
+
+test('the route takes the caller\'s crafts from their PROFILE, never from the body', () => {
+  // C01's privacy hole was a caller-supplied craft widening a scope. The same
+  // value now decides who may CLOSE an ask, so it comes from the same place.
+  const routes = read('modules', 'lifecycle', 'routes', 'help-requests.js');
+  const idx = routes.indexOf("'PATCH /help-requests/:id'");
+  const body = routes.slice(idx, routes.indexOf('errorCode', idx));
+  assert.match(body, /craftsForBuilder\(req\.builder\.id\)/, 'read from the profile');
+  assert.ok(!/req\.body\.craft|req\.query\.craft/.test(body), 'and never from the caller');
 });
 
 // ---- it stands alone ------------------------------------------------------
@@ -217,7 +268,13 @@ test('the settle refusal no longer lets you enumerate ids', () => {
   // The comment claimed one refusal for three cases; the code looked the row up
   // and said which. Comment and code now agree.
   const routes = read('modules', 'lifecycle', 'routes', 'help-requests.js');
-  const patch = routes.slice(routes.indexOf("'PATCH /help-requests/:id'"));
+  // Scoped to the PATCH HANDLER, not to the rest of the file. Task 1004216 added
+  // the reply routes after it, and one of them looks a request up on purpose —
+  // a reply to an id that never existed should be a named 404 rather than an FK
+  // violation rendered as a 500. Slicing to the end of the file would read that
+  // lookup as this handler's and report a hole that is not here.
+  const from = routes.indexOf("'PATCH /help-requests/:id'");
+  const patch = routes.slice(from, routes.indexOf('help_request_update_failed', from));
   assert.ok(!/getHelpRequest/.test(patch), 'no existence lookup in the refusal path');
   const reasons = patch.match(/reason: '[^']+'/g) || [];
   assert.equal(reasons.length, 1, `exactly one refusal reason, got ${reasons}`);
@@ -309,3 +366,141 @@ test('a help request addressed to a non-existent builder is a named 400', () =>
   assert.match(routes, /builderExists/);
   assert.match(routes, /no_such_builder/, 'the refusal names the field, not an FK 500');
 });
+
+// ---- replies (task 1004216, ADR 0330) --------------------------------------
+//
+// An ask could be filed and settled and never ANSWERED — the person being asked
+// had no write at all, so the answer happened somewhere the project could not
+// see, and the row sat open until its author remembered it.
+test('a reply must say something, and cannot say more than an ask', () => {
+  const why = (input) => help.validateReply(input).errors.map((e) => e.reason);
+  assert.deepEqual(why({ body: 'the metrics stack was removed on the 15th' }), []);
+  assert.deepEqual(why({ body: '   ' }), ['required'], 'whitespace is not an answer');
+  assert.deepEqual(why({}), ['required']);
+  assert.deepEqual(why({ body: 'x'.repeat(help.MAX_REPLY + 1) }), ['too_long']);
+  assert.equal(help.MAX_REPLY, help.MAX_STUCK, 'an answer may be as long as the question');
+});
+
+test('a reply is stored trimmed, against the ask it answers', async () => {
+  const calls = [];
+  const pool = { query: async (sql, params) => { calls.push({ sql, params }); return { rows: [{ id: 5 }] }; } };
+  await help.createReply({ helpRequestId: 11, builderId: 3, body: '  moot, it was removed  ' }, { pool });
+  assert.match(calls[0].sql, /INSERT INTO lifecycle_help_request_replies/);
+  assert.deepEqual(calls[0].params, [11, 3, 'moot, it was removed']);
+});
+
+test('a thread reads OLDEST FIRST — it is a conversation, not a queue', async () => {
+  const calls = [];
+  const pool = { query: async (sql, params) => { calls.push({ sql, params }); return { rows: [] }; } };
+  await help.listReplies(11, { pool });
+  assert.match(calls[0].sql, /ORDER BY r\.created_at ASC, r\.id ASC/,
+    'and ties break on id, so two replies in the same second keep their order');
+  assert.match(calls[0].sql, /builder_login|builder_name/, 'it names who said it');
+});
+
+test('every thread on a page is ONE query, not one per row', async () => {
+  // A list read renders a thread under every ask. Per-row fetching is what makes
+  // a page slow for reasons no single request explains.
+  const calls = [];
+  const pool = {
+    query: async (sql, params) => {
+      calls.push({ sql, params });
+      return { rows: [{ id: 1, help_request_id: '11', body: 'a' }, { id: 2, help_request_id: '12', body: 'b' }] };
+    },
+  };
+  const map = await help.repliesForRequests(['11', '12', '11'], { pool });
+  assert.equal(calls.length, 1, 'one round trip for the whole page');
+  assert.deepEqual(calls[0].params, [[11, 12]], 'de-duplicated, and bound as an array');
+  assert.equal(map.get('11').length, 1);
+  assert.equal(map.get('12').length, 1);
+});
+
+test('reading the replies of an unknown ask answers [] — a 404 there would be an id oracle', async () => {
+  // The asymmetry with POST (which DOES 404) is deliberate. This surface already
+  // learned once that an existence lookup on a refusal path lets a caller
+  // enumerate ids; a 404 on a GET rebuilds that oracle on the cheapest possible
+  // request. The POST can afford it because it is a write.
+  const routes = read('modules', 'lifecycle', 'routes', 'help-requests.js');
+  const idx = routes.indexOf("'GET /help-requests/:id/replies'");
+  assert.ok(idx > 0, 'the route exists');
+  const body = routes.slice(idx, routes.indexOf('errorCode', idx));
+  assert.ok(!/getHelpRequest|not_found/.test(body), 'no existence lookup, no 404');
+
+  const pool = { query: async () => ({ rows: [] }) };
+  assert.deepEqual(await help.listReplies(999999, { pool }), [], 'and the read itself is happy to find nothing');
+});
+
+test('the bulk thread read is BOUNDED, and bounded PER ASK', async () => {
+  // listReplies caps at MAX_ROWS; this one backs three list routes on the page's
+  // own load path, so an unbounded result set would be the one place a busy
+  // project could make Collab arrive by the megabyte (grader).
+  //
+  // Per-ask, not one global LIMIT: a global cap lets one busy ask eat the budget
+  // and hands the rows below it empty threads, which reads as "nobody answered" —
+  // the exact lie this surface exists to stop telling.
+  const calls = [];
+  const pool = { query: async (sql, params) => { calls.push({ sql, params }); return { rows: [] }; } };
+  await help.repliesForRequests([11, 12], { pool });
+  assert.match(calls[0].sql, /ROW_NUMBER\(\) OVER \(PARTITION BY r\.help_request_id/, 'the window is per ask');
+  assert.match(calls[0].sql, new RegExp(`thread_pos <= ${help.MAX_THREAD_ON_LIST}`), 'and it is capped');
+  assert.ok(help.MAX_THREAD_ON_LIST > 0 && help.MAX_THREAD_ON_LIST <= help.MAX_ROWS);
+  // The order inside the window must match the single-thread read's, or the
+  // first N a list shows are a different N in a different order.
+  assert.match(calls[0].sql, /ORDER BY r\.created_at ASC, r\.id ASC\) AS thread_pos/);
+});
+
+test('asking for no threads asks the database nothing', async () => {
+  const pool = { query: async () => { throw new Error('must not query'); } };
+  const map = await help.repliesForRequests([], { pool });
+  assert.equal(map.size, 0);
+});
+
+test('a row without replies carries an EMPTY list, never a missing field', () => {
+  // A reader must never have to tell "no replies" apart from "this response does
+  // not carry replies" — the second is how a page decides to hide a thread that
+  // is really there.
+  const routes = read('modules', 'lifecycle', 'routes', 'help-requests.js');
+  assert.match(routes, /replies: threads\.get\(String\(r\.id\)\) \|\| \[\]/);
+  for (const route of ["'GET /help-requests/for-me'", "'GET /help-requests/mine'", "'GET /help-requests'"]) {
+    const idx = routes.indexOf(route);
+    assert.ok(idx > 0, `${route} exists`);
+    const body = routes.slice(idx, routes.indexOf('errorCode', idx));
+    assert.match(body, /withReplies\(/, `${route} carries its threads`);
+  }
+});
+
+test('there is no way to edit or delete a reply, at either layer', () => {
+  const routes = read('modules', 'lifecycle', 'routes', 'help-requests.js');
+  assert.ok(!/router\.(patch|put|delete)\('\/help-requests\/:id\/replies/.test(routes), 'no route');
+  const src = read('modules', 'lifecycle', 'help-requests.js');
+  assert.ok(!/function (update|delete|edit)Reply/i.test(src), 'no data function');
+  // And the table refuses regardless — the guarantee must not rest on the routes
+  // that happen to exist today.
+  const sql = read('modules', 'lifecycle', 'migrations', 'lifecycle_011_help_request_replies.sql');
+  assert.match(sql, /BEFORE UPDATE OR DELETE ON lifecycle_help_request_replies/);
+});
+
+test('the FK RESTRICTS — append-only and ON DELETE CASCADE cannot both be true', () => {
+  // A real bug, caught by applying this migration to a live Postgres rather than
+  // by reading it. The first draft cascaded, because "a reply has no meaning
+  // without the ask it answers" reads right — but a cascade IS a plain DELETE on
+  // the replies table, the append-only trigger refuses it, and deleting a help
+  // request that had ever been answered failed outright with a trigger error.
+  const sql = read('modules', 'lifecycle', 'migrations', 'lifecycle_011_help_request_replies.sql');
+  assert.match(sql, /REFERENCES lifecycle_help_requests\(id\) ON DELETE RESTRICT/);
+  assert.ok(!/ON DELETE CASCADE/.test(sql.replace(/^\s*--.*$/gm, '')),
+    'no cascade in the statements — it would be refused by the trigger below it');
+});
+
+test('a reply to an ask that never existed is a named 404, not an FK 500', () => {
+  const routes = read('modules', 'lifecycle', 'routes', 'help-requests.js');
+  const idx = routes.indexOf("'POST /help-requests/:id/replies'");
+  assert.ok(idx > 0, 'the route exists');
+  const body = routes.slice(idx, routes.indexOf('errorCode', idx));
+  assert.match(body, /getHelpRequest\(id\)/);
+  assert.match(body, /help_request_not_found/);
+  // The guard sits on the router line, ahead of the handler's own label — the
+  // same place the board read's test looks for it.
+  const line = routes.slice(routes.lastIndexOf('router.post', idx), idx);
+  assert.match(line, /api\.requireBuilder/, 'signed in, like every other route here');
+});

package/tests/hub_disconnect_ui.mjs

@@ -85,7 +85,10 @@ test('the render guards a half-typed name per project, names an open run, and of
 
 test('the ender no longer claims nothing on the page erases — it scopes that to itself and points at the card', () => {
   const truth = fn('teardownTruth');
-  assert.equal((truth.match(/until you bring it back\. Taking it offline erases nothing\.'/g) || []).length, 2, 'both shapes');
+  // Was 2 — one per hosting-shape branch. Task 1004182 left one branch (ADR 0327 decision 4
+  // removed 'dedicated'), so the count is 1. The property this case is really about is that
+  // the ender's reassurance is scoped to ITSELF, which the assertions below carry.
+  assert.equal((truth.match(/until you bring it back\. Taking it offline erases nothing\.'/g) || []).length, 1, 'the built-world truth ends on the reassurance');
   assert.doesNotMatch(HUB, /Nothing here erases a project/);
   const delFold = (HUB.match(/<details class="finePrint" id="mDelWhat">[\s\S]*?<\/details>/) || [''])[0];
   assert.doesNotMatch(delFold, /no permanent-delete button/i, 'the capability exists now');

package/tests/init.mjs

@@ -240,8 +240,8 @@ test('provisioningRequest: null unless opted in; builds the POST body when opted
   assert.equal(init.provisioningRequest(fullSpec()), null);              // no block → not requested
   const co = init.provisioningRequest(provSpec({}));                     // empty block = opted in, defaults
   assert.deepEqual(co, { slug: 'cloud-bongos', hosting_shape: 'byo-host' });
-  const full = init.provisioningRequest(provSpec({ shape: 'dedicated', domain: 'example.com', targetRef: 'do:main', tier: 's-1vcpu-2gb' }));
-  assert.deepEqual(full, { slug: 'cloud-bongos', hosting_shape: 'dedicated', domain: 'example.com', target_ref: 'do:main', tier: 's-1vcpu-2gb' });
+  const full = init.provisioningRequest(provSpec({ shape: 'cloud-host', domain: 'example.com', targetRef: 'do:main', tier: 's-1vcpu-2gb' }));
+  assert.deepEqual(full, { slug: 'cloud-bongos', hosting_shape: 'cloud-host', domain: 'example.com', target_ref: 'do:main', tier: 's-1vcpu-2gb' });
 });
 
 test('provisioningRequest: unknown shape falls back to byo-host, the free front door', () => {
@@ -256,7 +256,7 @@ test('kickoffTasks: provisioning requested → production-topology is AUTOMATED
     firstAdmin: 'x', version: { id: 'V1', name: 'V1', done_when: 'x' } };
   const manual = init.kickoffTasks(init.normalizeSpec(baseSpec));        // no provisioning
   assert.ok(manual.some((t) => /Production topology/i.test(t.title)), 'manual keeps the production-topology task');
-  const withProv = init.kickoffTasks(init.normalizeSpec({ ...baseSpec, provisioning: { shape: 'dedicated' } }));
+  const withProv = init.kickoffTasks(init.normalizeSpec({ ...baseSpec, provisioning: { shape: 'cloud-host' } }));
   assert.ok(!withProv.some((t) => /Production topology/i.test(t.title)), 'provisioning drops the production-topology task');
   assert.equal(withProv.length, manual.length - 1, 'exactly one fewer kickoff task');
   assert.ok(withProv.some((t) => /OAuth/i.test(t.title)), 'OAuth stays manual');
@@ -272,7 +272,7 @@ test('normalizeSpec: coerces the provisioning block; drops it when absent', () =
 });
 
 test('validateSpec: valid provisioning passes; flags an underivable slug', () => {
-  assert.deepEqual(init.validateSpec(provSpec({ shape: 'dedicated' })), []);
+  assert.deepEqual(init.validateSpec(provSpec({ shape: 'cloud-host' })), []);
   // productName 'x' slugifies to a 1-char slug (< the module's 2-char floor) and no
   // explicit provisioning.slug overrides it → flagged before the server 400s.
   const bad = init.normalizeSpec({ identity: { productName: 'x' }, repo: { owner: 'o', name: 'n' }, firstAdmin: 'x',
@@ -642,12 +642,12 @@ async function runSeedTests() {
 
   await at('seedViaApi: provisioning success → POSTs the request, no manual topo task, provisioned:true', async () => {
     const api = fakeApi([['/provisioning/instances', { ok: true, status: 201, data: { instance: { cost_estimate_usd: 12 } } }]]);
-    const out = await init.seedViaApi(provSpec({ shape: 'dedicated', domain: 'x.example.com', tier: 's-1vcpu-2gb' }), { log: () => {}, api });
+    const out = await init.seedViaApi(provSpec({ shape: 'cloud-host', domain: 'x.example.com', tier: 's-1vcpu-2gb' }), { log: () => {}, api });
     assert.equal(out.provisioned, true);
     const prov = api.calls.find((c) => c.path.includes('/provisioning/instances'));
     assert.ok(prov, 'POSTed the provisioning request');
     assert.equal(prov.body.slug, 'cloud-bongos');
-    assert.equal(prov.body.hosting_shape, 'dedicated');
+    assert.equal(prov.body.hosting_shape, 'cloud-host');
     assert.ok(!findTaskPost(api, /Production topology/), 'production-topology NOT filed as a manual task');
   });
 

package/tests/onboard.mjs

@@ -129,8 +129,9 @@ test('onboardPlan lists repo-auth as an AUTO, control-plane step between scaffol
   const step = plan.find((s) => s.key === 'repo-auth');
   assert.ok(step, 'the plan carries a repo-auth step');
   assert.equal(step.kind, 'auto', 'the runner mints + registers the key — no routine owner action');
-  assert.deepEqual(step.shapes, ['standalone', 'co-tenant', 'dedicated'],
-    'self-host has no platform runner, so its plan must not promise this leg');
+  assert.deepEqual(step.shapes, ['cloud-host', 'co-tenant'],
+    'byo-host has no platform runner, so its plan must not promise this leg');
+  assert.ok(!step.shapes.includes('byo-host'), 'named explicitly: the shape without a runner is the one that must be absent');
   assert.ok(keys.indexOf('scaffold') < keys.indexOf('repo-auth'), 'the checkout exists before it can be wired');
   assert.ok(keys.indexOf('repo-auth') < keys.indexOf('provision'), 'wired before the provision leg whose pull needs it');
   assert.match(step.label, /read-only deploy key/, 'the label says what the key can and cannot do');
@@ -253,13 +254,13 @@ test('buildInitSpec maps answers to a STANDALONE init spec (domain → origin +
   assert.equal(spec.repo.name, 'mercury');
   assert.equal(spec.firstAdmin, 'acme');
   assert.equal(spec.domains.publicOrigin, 'https://mercury.example.com');
-  assert.equal(spec.provisioning.shape, 'standalone');
+  assert.equal(spec.provisioning.shape, 'cloud-host');
   assert.equal(spec.provisioning.slug, 'mercury');
 });
 
 test('buildInitSpec without a domain still defaults a standalone provisioning shape by slug', () => {
   const spec = ob.buildInitSpec({ productName: 'X', repoOwner: 'o', repoName: 'x', slug: 'x' });
-  assert.equal(spec.provisioning.shape, 'standalone');
+  assert.equal(spec.provisioning.shape, 'cloud-host');
   assert.equal(spec.provisioning.domain, null);
   assert.equal(spec.domains, undefined);
 });

package/tests/project_catalog_backfill.mjs

@@ -42,7 +42,7 @@ const feed = require('../modules/platform-identity/projects-feed.js');
 // something puts it there. Instance 18's shape — the one whose owner could not invite anyone.
 const STANDALONE = Object.freeze({
   id: 18, slug: 'spike-harbor', domain: 'spike-harbor.cloudbongos.test',
-  hosting_shape: 'standalone', status: 'active', owner_builder_id: 42,
+  hosting_shape: 'cloud-host', status: 'active', owner_builder_id: 42,
   description: 'A harbour for spikes.', type: 'research',
   settings: { visibility: 'public' },
 });

package/tests/project_catalog_bridge.mjs

@@ -51,7 +51,7 @@ function mockPool(responses = []) {
 // R18 proof watched reach `publishable: true` and never reach the map.
 const STANDALONE = Object.freeze({
   id: 18, slug: 'spike-harbor', domain: 'spike-harbor.cloudbongos.test',
-  hosting_shape: 'standalone', status: 'active', owner_builder_id: 42,
+  hosting_shape: 'cloud-host', status: 'active', owner_builder_id: 42,
   description: 'A harbour for spikes.', type: 'research',
   settings: { visibility: 'public', joinability: 'apply' },
 });
@@ -78,7 +78,7 @@ test('a standalone instance projects a complete catalog entry', () => {
 test('the projection is BLIND to hosting shape — the old gate is what this task deletes', () => {
   // shouldFederate() refused anything that was not 'co-tenant', which made hosting topology
   // decide who is on the map. ADR 0182 D4 says the gate is IDENTITY. Three shapes, one row.
-  const shapes = ['standalone', 'co-tenant', 'dedicated'].map((hosting_shape) =>
+  const shapes = ['cloud-host', 'co-tenant', 'dedicated'].map((hosting_shape) =>
     bridge.catalogEntryForInstance({ ...STANDALONE, hosting_shape }, { ownerGithubId: 9001 }));
   assert.deepEqual(shapes[0], shapes[1]);
   assert.deepEqual(shapes[1], shapes[2]);

package/tests/project_catalog_routes.mjs

@@ -38,7 +38,7 @@ const api = require('../src/module-api.js');
 const OWNER = { id: 7, github_login: 'owner', rank: 'thetes' };
 const BASE_ROW = Object.freeze({
   id: 18, slug: 'spike-harbor', domain: 'spike-harbor.cloudbongos.test',
-  hosting_shape: 'standalone', status: 'active', owner_builder_id: 7,
+  hosting_shape: 'cloud-host', status: 'active', owner_builder_id: 7,
   description: null, type: 'research', settings: { visibility: 'public' },
   released_domains: [], cost_estimate_usd: 0,
 });
@@ -130,10 +130,10 @@ function call(method, path, body) {
 beforeEach(() => { instance = { ...BASE_ROW }; published = []; healed = []; });
 
 test('CREATE catalogues the project at birth, whatever its hosting shape', async () => {
-  // The wizard hard-codes hosting_shape 'standalone', which is exactly the shape
+  // The wizard hard-codes hosting_shape 'cloud-host', which is exactly the shape
   // shouldFederate() refused — so this is the call that ends "never catalogued at all".
   const res = await call('POST', '/provisioning/instances', {
-    slug: 'spike-harbor', hosting_shape: 'standalone', description: 'A harbour for spikes.',
+    slug: 'spike-harbor', hosting_shape: 'cloud-host', description: 'A harbour for spikes.',
   });
   assert.equal(res.status, 201);
   assert.equal(published.length, 1);
@@ -145,7 +145,7 @@ test('CREATE catalogues even when the owner SKIPS the description', async () =>
   // Skipping is the supported default: the row exists, the publish gate keeps it dark
   // matter, and PATCH …/detail is the way back onto the map. The row has to be there for
   // that way back to reach anything.
-  const res = await call('POST', '/provisioning/instances', { slug: 'spike-harbor', hosting_shape: 'standalone' });
+  const res = await call('POST', '/provisioning/instances', { slug: 'spike-harbor', hosting_shape: 'cloud-host' });
   assert.equal(res.status, 201);
   assert.equal(published.length, 1);
   assert.equal(published[0].row.description, null);

package/tests/projects_hub.mjs

@@ -2186,7 +2186,7 @@ test('the wizard\'s own structures wear the world: hairline fields, cells of one
   assert.match(HUB, /<h2 class="stepsHead" id="doneStepsHead">Your steps — the parts only you can play<\/h2>/, 'the steps heading is the label face by class, not an inline style (the id is where a skipped invite step hands focus on, task 1002346)');
   // what is enqueued is unchanged (ADR 0111): the filing body the control plane reads
   assert.match(SCRIPT, /body: JSON\.stringify\(\{\s*slug: state\.slug,/, 'the filing still carries the slug first');
-  assert.match(SCRIPT, /hosting_shape: 'standalone',/, 'the shape is unchanged');
+  assert.match(SCRIPT, /hosting_shape: 'cloud-host',/, 'the shape is unchanged');
   assert.match(SCRIPT, /target_ref: state\.owner \+ '\/' \+ state\.repo,/, 'the repo ref is unchanged');
   assert.match(SCRIPT, /onboard_mode: state\.mode === 'adopt' \? 'adopt' : 'greenfield'/, 'the onboard mode is unchanged');
   // the kit walks every step and files against the stub