@bongos/core 1.20.14 → 1.20.16

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.14",
-  "core_contract": "1.20.14",
-  "source_commit": "791ad29beab00019cab69c01896dbb132b40b5ad",
+  "core_version": "1.20.16",
+  "core_contract": "1.20.16",
+  "source_commit": "594ee4d4c853130397cd87e0095a3b50e03ad4b0",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T12:05:40.305Z",
+  "built_at": "2026-09-30T12:51:52.406Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 556,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3210,
-  "tree_sha256": "521479f97c392987b24cca51bd5ca57048b353ae978e89f748a15793d8e80990",
+  "tree_sha256": "9a6832279c80fa1b768101f4b2c4c13e626f023be26da7232d0596ef21accfa9",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "b3abd2f21a34a8547f169368ddcaa19364e2fcb5f5ddeb4f296bcfaf67acf3b5"
+      "sha256": "2664b90799e3d947cdce43f2eb6c05699da1aafad223fef1b6eafd463c4478e3"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2882,7 +2882,7 @@
     {
       "path": "docs/recipes/autobongos-windows-host.md",
       "mode": "0000644",
-      "sha256": "e8c45b5b1ab16fc5ae7bbfaef677672f338195dde885e734d53d752c5113deeb"
+      "sha256": "e70faa969725827307388ccb0620bde203500333ed299d860ca7a001cc8577a1"
     },
     {
       "path": "docs/recipes/bongos-cli-release.md",
@@ -8862,12 +8862,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "908c96be621ea531a175e213836861eddf3bd3b652f793aaefd6fd098d7e5543"
+      "sha256": "979f117fe308e4c9d4c2b8d9765fc7a8314c490d8cb134215efd61cded7cf30e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "88ae8247e31afb3b9e49258788fe2f01132af4779ba70f3377ca6b8af3756adf"
+      "sha256": "f5ff021f7aedefb0c74cd4e019815aaada727a00b4a1dc7609f369aa41186b85"
     },
     {
       "path": "public-docs/index.html",
@@ -8887,7 +8887,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "4d06b7011b86e611f4ae20cd9f925c3a27715663139ceb06d4b3f841a8c764f0"
+      "sha256": "95ae54225e9925f4d47f66179e6a081db5668a217c0000b94c06c992a2cae479"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9057,7 +9057,7 @@
     {
       "path": "scripts/gds/autobongos-service.ps1",
       "mode": "0000644",
-      "sha256": "2dcf13abd58dfaf6cce56285dc1f156efe06be9e2307acc0d9e2bc7912c9f424"
+      "sha256": "b1e038bb70ace1652b85a4d29f5a68761c6b432fd50fbfdafb5e1e38d93627de"
     },
     {
       "path": "scripts/gds/autobongos-verify.js",
@@ -9842,7 +9842,7 @@
     {
       "path": "scripts/gds/provision-config.js",
       "mode": "0000644",
-      "sha256": "eef551d38110a43e295f465a9a61b0ac136ac14e79f40821c2ea0501ee8fa58a"
+      "sha256": "5d8c07ebba17c797d7c8506e199f408a9490418e74089f5441a6141d76400be5"
     },
     {
       "path": "scripts/gds/provision-core-upgrade.js",
@@ -9852,12 +9852,12 @@
     {
       "path": "scripts/gds/provision-disconnect.js",
       "mode": "0000644",
-      "sha256": "eabada0abfcca12b744952a0bea9402ef95946ce5685b1ed08ae0f9b38da24b6"
+      "sha256": "43aabd985e5ec2b2eff12b5d624158c3240e7777887705228945fedf691d95c3"
     },
     {
       "path": "scripts/gds/provision-net.js",
       "mode": "0000644",
-      "sha256": "85c84ac0ceb00133acb0a86c5c48a3887908a7c2e51490ec9de549d7714f4103"
+      "sha256": "cc3bd9146e6f513239f564df67fe3dd0a4b50e7889a759c7528c9a4d34e64ce4"
     },
     {
       "path": "scripts/gds/provision-pin-key.js",
@@ -9887,22 +9887,22 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "7ab829842156f06853991a96d1eb0d0e800013b5e7a50d4d02c42c7733d3a37b"
+      "sha256": "d1fd247608db02805168cd306d27378cf2ac964bf8ac156019eb969cc7b410d4"
     },
     {
       "path": "scripts/gds/provision-teardown.js",
       "mode": "0000644",
-      "sha256": "b2bb567debb248f2488d26e4bb87fff1258d6226a490e054ba601febdad288a6"
+      "sha256": "eca5ebb6a796e336b3e5c542de171923488a3f4edd24e2e5da07d0a53f239c23"
     },
     {
       "path": "scripts/gds/provision-units.js",
       "mode": "0000644",
-      "sha256": "876697e79f9a3e3933bbd7623f97655962e2d10c298b6ba5f27d5b75cb885f9d"
+      "sha256": "2fd3cd47bce98f32ec151557908fdde48f91d7a3d7a144f7e3e7f77638eb5165"
     },
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "0f9b3bc9e540e9a1ff0c210ce58aef97963c8bdcdd4674b31267e5fd7af3fe43"
+      "sha256": "8f03f6c0e043ba7d80e6c4543cc0d6abc8b2ccb8d4a7e40e814a6a14d6859440"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -11002,7 +11002,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "111c9b37716e607675072df7499f9040e048c7b6f5e4c006890d4b898dc6c9d3"
+      "sha256": "0d0657d70e9b17cb8f11328fd85f36df2bb7d67c1f44cac8745364e6558bc453"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11457,7 +11457,7 @@
     {
       "path": "tests/autobongos_service_ps1.mjs",
       "mode": "0000644",
-      "sha256": "541a3030ed91fe74b98b837e4d45b59e6a337b9f45c99f848a9df53a20b781a1"
+      "sha256": "34ca7d75bc83d9c4a77706dd06ecc170011ef52b7ee77eea5c3b77ac514389d0"
     },
     {
       "path": "tests/autobongos_verify.mjs",
@@ -14512,12 +14512,12 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "550f0342dd556bb0f974875edfc570ac8a4734938832a75d00b019d19db0f8ed"
+      "sha256": "ad4c6e5d4dd342e8c2b183c6decd7a38c976b207b30e211042bed0a42f3f5f17"
     },
     {
       "path": "tests/provision_account_identity.mjs",
       "mode": "0000644",
-      "sha256": "9f62eea1b43a478334a83df52d0e81a3b3b67f4c4eea54680d2d8db3b25ee513"
+      "sha256": "63a9052194dbeca658aab24b839f549ba3193b34f564001ad889dd5671166fd9"
     },
     {
       "path": "tests/provision_byo_host.mjs",
@@ -14532,7 +14532,7 @@
     {
       "path": "tests/provision_disconnect.mjs",
       "mode": "0000644",
-      "sha256": "20de6ef694e176459b690aac55351f97a77bf91a3076870ba43972a6b8b6e54c"
+      "sha256": "8c117a05b0c4af8e4f6a465cad02d208210148aaa7e26adfe9098967911f1be5"
     },
     {
       "path": "tests/provision_render.mjs",
@@ -14547,17 +14547,17 @@
     {
       "path": "tests/provision_restart.mjs",
       "mode": "0000644",
-      "sha256": "b9cdf2ef4d1af83c084b77ce44d3c142a935fb25f3a275f052db0cf3ede9b205"
+      "sha256": "caa345e6708d896b42c597a9f83919b4795222e61955c728975d56a873a04fb8"
     },
     {
       "path": "tests/provision_settings_apply.mjs",
       "mode": "0000644",
-      "sha256": "08761779d0e8e733dd4db9de9c90cd147037ac30909883ec36e104389bac1edf"
+      "sha256": "b8721014fea6a0cb60335077fff10fe55ab0c745511ab680154cbc291e357f9c"
     },
     {
       "path": "tests/provision_teardown_address.mjs",
       "mode": "0000644",
-      "sha256": "45f771259689319eff14f2c90fb9ebb063b172c290731b195770b02e923a133b"
+      "sha256": "e835c2b0b75640dc96954815c1f13ecd6d8fddcb08ae64fb0b6d98818959eb0a"
     },
     {
       "path": "tests/provisioning_app_status.mjs",

package/docs/module-api-changelog.md

@@ -2685,5 +2685,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.12 with no explicit bump. run 36710762884. (task 1002620)
   1.20.14 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.13 with no explicit bump. run 36712510525. (task 1002620)
+  1.20.15 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.14 with no explicit bump. run 36713710510. (task 1002620)
+  1.20.16 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.15 with no explicit bump. run 36717488992. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/autobongos-windows-host.md

@@ -18,7 +18,7 @@ Task [1003905](https://cloudbongos.com/builders#/task/1003905).
 
 ## What you need on the box first
 
-Open PowerShell as your normal user (not Administrator) and check all three:
+Open PowerShell as your own user and check all three:
 
 ```powershell
 node --version ; git --version ; claude --version
@@ -28,7 +28,7 @@ All three must print a version. The installer refuses to proceed otherwise —
 a runner that starts without `claude` on its PATH fails every worker and looks
 like a mysterious outage in the log rather than a missing program.
 
-You also need, as **your own user** (not an administrator account):
+You also need, as **your own user** (not a separate administrator account):
 
 - a `git` credential that can fetch the repo,
 - a signed-in Claude Code session,
@@ -53,13 +53,29 @@ machine can write, the worker running on it can write too.
 
 ## 2. Install the scheduled task
 
-From the checkout:
+**This step, and only this step, needs an Administrator shell.** Right-click
+PowerShell, choose **Run as administrator**, and sign in to the prompt as the
+**same user** you checked the prerequisites with — then, from the checkout:
 
 ```powershell
 powershell -ExecutionPolicy Bypass -File scripts\gds\autobongos-service.ps1 install
 powershell -ExecutionPolicy Bypass -File scripts\gds\autobongos-service.ps1 start
 ```
 
+Why admin, when the runner deliberately is not: two different things happen
+here. **Registering** the task needs admin, because it uses the S4U logon type
+(run whether or not anyone is signed in), and Windows only lets an elevated
+shell register one — from a normal shell `install` stops and says so, rather
+than failing with a bare *Access is denied*. **Running** the task does not: it
+runs as you, unelevated (`-RunLevel Limited`), which is what lets it use your
+git credential and Claude session. Elevating the same account keeps your
+username, so the task is still registered to run as you.
+
+Do **not** install it as SYSTEM, or from a different administrator account:
+the task would run as that account, which has none of your credentials. If
+your own account is not an administrator on this PC, make it one for the
+install rather than elevating as someone else.
+
 That registers a task called `Autobongos` that starts **at boot** (not at sign-in
 — nobody should have to log in), restarts if it crashes, and never times out.
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.14",
+  "version": "1.20.16",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.14",
+      "version": "1.20.16",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.14",
+  "version": "1.20.16",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8140,5 +8140,17 @@
       "id": "1004397",
       "text": "The unattended runner now records which version of the code it is running from its very first check-in, instead of leaving that blank for its first minute, which is exactly when someone is trying to find out."
     }
+  ],
+  "1.20.15": [
+    {
+      "id": "1004177",
+      "text": "Installing the Windows runner now tells you up front that it needs an administrator window, and why, instead of failing with a bare \"access denied\"; the setup guide no longer says the opposite."
+    }
+  ],
+  "1.20.16": [
+    {
+      "id": "1004185",
+      "text": "Cleaned out leftover code for a hosting option we retired, with proof that every live project's setup is unchanged — no project sees any difference."
+    }
   ]
 }

package/scripts/gds/autobongos-service.ps1

@@ -25,7 +25,8 @@
 # UNPRIVILEGED ON PURPOSE. It runs as the logged-in user, not SYSTEM: the runner
 # needs that user's git credential, npm config and Claude session, and SYSTEM has
 # none of them. It is also the smaller blast radius for a process that spawns
-# workers with blanket bypassPermissions.
+# workers with blanket bypassPermissions. (INSTALLING it is the one step that
+# needs an elevated shell of that same user -- see Assert-Prereqs, task 1004177.)
 
 [CmdletBinding()]
 param(
@@ -49,10 +50,32 @@ $LogDir = Join-Path $env:LOCALAPPDATA 'cloudbongos'
 $LogFile = Join-Path $LogDir 'autobongos.log'
 $Wrapper = Join-Path $RepoRoot 'scripts\gds\autobongos-service.cmd'
 
+# Is this shell elevated (Run as administrator)? Its own function so the tests
+# can stand it in: the check is Windows-only, and CI runs on Linux.
+function Test-Elevated {
+  $id = [Security.Principal.WindowsIdentity]::GetCurrent()
+  return ([Security.Principal.WindowsPrincipal]$id).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+}
+
+# REGISTERING vs RUNNING (task 1004177). The task RUNS as this user, unelevated
+# (-RunLevel Limited): that is what reaches the user's git credential and Claude
+# session, and it is load-bearing. But REGISTERING a task with an S4U principal
+# needs an elevated shell -- unelevated, Register-ScheduledTask fails with a bare
+# "Access is denied" (0x80070005) that says nothing about why. Elevating the SAME
+# account keeps $env:USERNAME, so the principal below is still this user. So
+# install -- and only install -- checks, and says so in words, before trying.
+$ElevationNeeded = @(
+  'install needs an elevated shell: registering a task that runs whether or not you are signed in (the S4U logon type) requires Administrator.',
+  'Open PowerShell with "Run as administrator" AS THIS SAME USER and run install again. The task still RUNS as you, unelevated (-RunLevel Limited) -- only the registration needs admin.',
+  'Do NOT install it as SYSTEM or another admin account: the runner needs your git credential and Claude session, and SYSTEM has neither.'
+) -join ' '
+
 function Assert-Prereqs {
+  param([switch]$ForInstall)
   if (-not (Test-Path (Join-Path $RepoRoot 'scripts\gds\autobongos-run.js'))) {
     throw "No autobongos-run.js under $RepoRoot -- pass -RepoRoot <path to the checkout>."
   }
+  if ($ForInstall -and -not (Test-Elevated)) { throw $ElevationNeeded }
   foreach ($exe in @('node', 'git', 'claude')) {
     if (-not (Get-Command $exe -ErrorAction SilentlyContinue)) {
       # Named, not guessed at: a runner that starts without `claude` on PATH will
@@ -191,7 +214,7 @@ if ($MyInvocation.InvocationName -eq '.') { return }
 
 switch ($Action) {
   'install' {
-    Assert-Prereqs
+    Assert-Prereqs -ForInstall
     New-Item -ItemType Directory -Force -Path $LogDir | Out-Null
 
     # NOT $action: PowerShell variable names are CASE-INSENSITIVE, so $action IS the

package/scripts/gds/provision-config.js

@@ -77,12 +77,11 @@ const CONFIG = {
   // systemd (ADR 0306). Unused on a systemd box. No sudo is applied to writes here: the
   // planes that select supervisord run unprivileged and already own this dir.
   supervisorConfDir: process.env.PROVISION_SUPERVISOR_CONF_DIR || '/etc/supervisor/conf.d',
-  // Dedicated-droplet defaults (only used for hosting_shape='dedicated').
-  region: process.env.PROVISION_REGION || 'nyc3',
-  baseImage: process.env.PROVISION_BASE_IMAGE || 'ubuntu-24-04-x64',
-  tag: process.env.PROVISION_TAG || 'cloudbongos-instance',
+  // The DigitalOcean token. No runner leg spends it since the dedicated droplet path went
+  // (task 1004185); the read stays because it is what makes this file a registered
+  // credential reader (modules/government/protected-surfaces.json + the tripwire in
+  // tests/government_protected_surfaces.mjs). Dropping it is a governance change of its own.
   doToken: process.env.DO_API_TOKEN || null,
-  sshKeyIds: (process.env.BOX_SSH_KEY_IDS || '').split(',').map((s) => s.trim()).filter(Boolean),
   // The Cloudflare DNS hook (the instance's infra/box-dns-cloudflare.sh).
   // P4 (#1945) formalizes the UPSERT: point the instance's domain at the target
   // public IP (below), in the domain's OWN Cloudflare zone, proxied=false (see
@@ -90,8 +89,7 @@ const CONFIG = {
   // still reachable by IP; TLS then can't be issued until DNS lands).
   dnsHook: process.env.BOX_DNS_HOOK || null,
   // This box's PUBLIC IP — the A-record target for a CO-TENANT instance's domain.
-  // Set in the control-plane /etc/<inst>/box.env (never the web tier). A dedicated
-  // instance instead points its A record at the freshly-created droplet's IP. Under
+  // Set in the control-plane /etc/<inst>/box.env (never the web tier). Under
   // remote-exec (PROVISION_REMOTE_HOST) this is the CO-HOSTING box's IP — where the
   // co-tenant actually runs (ADR 0130).
   publicIp: process.env.PROVISION_PUBLIC_IP || process.env.BOX_PUBLIC_IP || null,
@@ -159,8 +157,8 @@ const CONFIG = {
   // allows 97 non-superuser backends, so nine busy projects exhaust it whatever the
   // RAM headroom. Idle projects hold zero backends, so this bounds bursts, not the
   // steady state: 3 × 15 slots + the control plane's own 10 stays under the 97. The
-  // control plane keeps pg's default (it is not provisioned by this runner), and a
-  // dedicated droplet has its own server, so neither is written.
+  // control plane keeps pg's default (it is not provisioned by this runner), so it is
+  // not written there.
   instancePoolMax: numEnv('PROVISION_INSTANCE_PGPOOL_MAX', 3),
 };
 
@@ -188,8 +186,6 @@ function loadDeps() {
   const { pool } = require(path.join(REPO_ROOT, 'src/bongos/pool'));
   // eslint-disable-next-line global-require
   const provisioning = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning'));
-  // eslint-disable-next-line global-require
-  const { DoApi } = require(path.join(REPO_ROOT, 'scripts/gds/do-api'));
   // Cross-site identity (ADR 0141 §4, task #1002109). Resolve the hub-side module by a
   // VARIABLE key, gated on isModuleEnabled — the module-loader's own dynamic-dispatch
   // pattern (the run-unit-tests.js precedent), NOT a static 'modules/platform-identity/'
@@ -206,14 +202,14 @@ function loadDeps() {
     try { platformIdentity = require(path.join(piBase, 'platform-identity')); hubKeys = require(path.join(piBase, 'hub-keys')); projectCatalog = require(path.join(piBase, 'project-catalog')); }
     catch { platformIdentity = null; hubKeys = null; projectCatalog = null; }
   }
-  _deps = { pool, provisioning, DoApi, platformIdentity, hubKeys, projectCatalog };
+  _deps = { pool, provisioning, platformIdentity, hubKeys, projectCatalog };
   return _deps;
 }
 
 // ---------------------------------------------------------------------------
 // PURE step-command generators (exported for tests). Each returns the exact shell
-// command a runbook step runs. Kept pure so local exec (co-tenant) and the
-// dedicated droplet's cloud-init both build from ONE source of truth.
+// command a runbook step runs. Kept pure so the runbook and its tests build from ONE
+// source of truth.
 // ---------------------------------------------------------------------------
 
 // A slug is validated DNS/db-safe upstream (provisioning.isValidSlug), so it is

package/scripts/gds/provision-disconnect.js

@@ -62,12 +62,10 @@ async function disconnectInstance(inst, deps) {
   // A teardown returns ok or throws; a throw ends the run here, before anything is erased.
   await teardownInstance(inst, deps);
 
-  if (inst.hosting_shape !== 'dedicated') {
-    const boxExec = inst.hosting_shape === 'cloud-host' ? (deps.controlExec || exec) : exec;
-    for (const cmd of eraseCommands(inst, { privileged })) {
-      try { boxExec(cmd); }
-      catch (e) { return { ok: false, error: `erase step failed (${cmd.split(' ').slice(0, 3).join(' ')}): ${(e && e.message) || e}` }; }
-    }
+  const boxExec = inst.hosting_shape === 'cloud-host' ? (deps.controlExec || exec) : exec;
+  for (const cmd of eraseCommands(inst, { privileged })) {
+    try { boxExec(cmd); }
+    catch (e) { return { ok: false, error: `erase step failed (${cmd.split(' ').slice(0, 3).join(' ')}): ${(e && e.message) || e}` }; }
   }
 
   const origin = catalogOriginForInstance(inst);

package/scripts/gds/provision-net.js

@@ -33,8 +33,7 @@ function federationHubOrigin() {
 // platform-identity module is present, a signing key is loadable, AND a hub origin
 // resolves), the instance is a CO-TENANT (the mothership-hosted shape whose web.env is
 // written locally — a `standalone` is owner-hosted and keeps its own GitHub app, the
-// self-hosted path; a `dedicated` droplet has no local web.env write yet, same gap the
-// ADR 0133 manifest flow leaves — see placeManifestCreds), and it has a public domain
+// self-hosted path), and it has a public domain
 // (the origin the hub binds the CLI mint audience to — the #1002108 account-takeover
 // fix). Returns { federate, reason } so the caller can log WHY it skipped. PURE-ish
 // (reads env + the injected module handles; no DB, no I/O).
@@ -110,7 +109,7 @@ function zoneForDomain(domain) {
 // The env a DNS UPSERT invocation of infra/box-dns-cloudflare.sh needs for a
 // PROVISIONED host: the hostname, the target public IP (the A-record content), the
 // zone the record lives in, and whether Cloudflare proxies it.
-//   • proxied=false (default) is LOAD-BEARING for a CO-TENANT/dedicated host: it uses
+//   • proxied=false (default) is LOAD-BEARING for a CO-TENANT host: it uses
 //     Caddy on-demand ACME (Let's Encrypt), whose challenge must reach Caddy directly —
 //     Cloudflare proxy ON would intercept :80/:443 at the edge and the challenge would
 //     silently fail (ADR 0003 / docs/recipes/ops-gotchas.md). Do NOT proxy those.
@@ -297,11 +296,9 @@ function ingressPlaneGap(exec, { caddyfile = CONFIG.caddyfile } = {}) {
 }
 // The preflight around ingressPlaneGap: the narration its sibling preflights already carry,
 // including the dry-run line without which the plan prints step 6's Caddy write as though it
-// will work. Returns the refusal, or null to proceed. `dedicated` skips it (Caddy comes from
-// cloud-init). Lives here rather than inline at the two call sites to keep provision.js under
-// its 1,500-line ratchet.
-function ingressPreflight({ exec, apply, log, shape, probe = ingressPlaneGap, before = 'writing any Caddy config' }) {
-  if (shape === 'dedicated') return null;
+// will work. Returns the refusal, or null to proceed. Lives here rather than inline at the two
+// call sites to keep provision.js under its 1,500-line ratchet.
+function ingressPreflight({ exec, apply, log, probe = ingressPlaneGap, before = 'writing any Caddy config' }) {
   if (!apply) { log(`  [preflight] would probe the plane for a reverse proxy before ${before}`); return null; }
   const missing = probe(exec);
   if (missing) return `Ingress preflight failed: ${missing}`;

package/scripts/gds/provision-repo.js

@@ -62,9 +62,8 @@ function migrateCmd(inst, { privileged = false } = {}) {
 // The id/name/done_when come from instanceInitSpec so the starter version has ONE
 // source of truth (the same spec the greenfield `bongos init` seed uses). SQL string
 // literals are DOLLAR-QUOTED ($v$…$v$) so the whole -c argument is single-quoted —
-// the one form that is safe UNCHANGED across all three executors: inline (/bin/sh),
-// over SSH (bash -s), AND embedded in a dedicated droplet's cloud-init (bash -lc "…"),
-// with no nested-quote or $-expansion hazard.
+// the one form that is safe UNCHANGED across both executors: inline (/bin/sh) and
+// over SSH (bash -s), with no nested-quote or $-expansion hazard.
 function seedFirstVersionCmd(inst, { privileged = false } = {}) {
   const v = instanceInitSpec(inst).version;
   const q = (s) => `$v$${s}$v$`;                 // dollar-quoted literal (no value contains a single quote or $)
@@ -299,10 +298,8 @@ function accountPlaneGap(exec, { privileged = false } = {}) {
 
 // The preflight around accountPlaneGap: the narration its sibling preflights carry,
 // including the dry-run line without which the plan prints step 1c's useradd as though it
-// will work. Returns the refusal, or null to proceed. `dedicated` skips it — that account
-// is created by cloud-init, which runs as root. Lives here beside the account it guards.
-function accountPreflight({ exec, apply, log, shape, privileged = false, probe = accountPlaneGap }) {
-  if (shape === 'dedicated') return null;
+// will work. Returns the refusal, or null to proceed. Lives here beside the account it guards.
+function accountPreflight({ exec, apply, log, privileged = false, probe = accountPlaneGap }) {
   if (!apply) { log('  [preflight] would probe whether the runner can create this instance\'s own unix account'); return null; }
   const missing = probe(exec, { privileged });
   if (missing) return `Account preflight failed: ${missing}`;
@@ -327,38 +324,20 @@ function accountPreflight({ exec, apply, log, shape, privileged = false, probe =
 //
 // QUOTING, which is load-bearing in a way that is easy to undo by accident. Every literal
 // is DOLLAR-QUOTED and every identifier goes through format(%I), so the rendered command
-// contains no single quote and NO DOUBLE QUOTE. It has to survive three executors
-// unchanged — inline /bin/sh, `bash -s` over SSH, and, the strict one, `- [ bash, -lc,
-// "..." ]` inside the dedicated droplet's cloud-init, which is a YAML DOUBLE-QUOTED
-// scalar. A plain "role" identifier reads fine in psql and silently truncates the YAML.
-// seedFirstVersionCmd dollar-quotes for the same reason; a test asserts the absence.
-// `peerOnly` is the DEDICATED shape's mode, and it exists because of where that
-// command TRAVELS (task 1003369). A dedicated droplet's steps ride DigitalOcean
-// cloud-init user-data, which DO RETAINS and serves back through its API, its console
-// and the droplet's own metadata endpoint — so a password embedded there is a second,
-// permanent copy of the credential in a place this task cannot lock down, which is
-// strictly worse than what it protects against. A dedicated droplet is SINGLE-TENANT:
-// there are no siblings on it, so the co-tenancy vector B3 describes does not exist,
-// and the role can peer-auth to its own unix account. The role, its DB ownership and
-// the PUBLIC revoke are still created — only the password is omitted, deliberately.
-function dbRoleCmd(inst, { password = null, peerOnly = false, privileged = false } = {}) {
+// contains no single quote and NO DOUBLE QUOTE, so it survives both executors unchanged —
+// inline /bin/sh and `bash -s` over SSH. seedFirstVersionCmd dollar-quotes for the same
+// reason; a test asserts the absence.
+function dbRoleCmd(inst, { password = null, privileged = false } = {}) {
   const role = instanceDbRole(inst), db = dbName(inst);
-  if (peerOnly) {
-    if (password) throw new Error('dbRoleCmd: peerOnly takes no password — it exists to keep one out of cloud-init user-data');
-  } else if (!/^[A-Za-z0-9_-]+$/.test(String(password || ''))) {
+  if (!/^[A-Za-z0-9_-]+$/.test(String(password || ''))) {
     throw new Error('dbRoleCmd: password must be a non-empty base64url string (generateDbPassword)');
   }
-  // Two shapes of the same upsert. peerOnly omits the PASSWORD clause entirely rather
-  // than passing an empty one — `WITH LOGIN` leaves any existing password untouched.
-  const login = peerOnly
-    ? { clause: 'WITH LOGIN', args: '' }
-    : { clause: 'WITH LOGIN PASSWORD %L', args: `, $p$${password}$p$` };
   const sql =
     `DO $do$ BEGIN ` +
     `IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = $r$${role}$r$) THEN ` +
-    `EXECUTE format($f$ALTER ROLE %I ${login.clause}$f$, $r$${role}$r$${login.args}); ` +
+    `EXECUTE format($f$ALTER ROLE %I WITH LOGIN PASSWORD %L$f$, $r$${role}$r$, $p$${password}$p$); ` +
     `ELSE ` +
-    `EXECUTE format($f$CREATE ROLE %I ${login.clause}$f$, $r$${role}$r$${login.args}); ` +
+    `EXECUTE format($f$CREATE ROLE %I WITH LOGIN PASSWORD %L$f$, $r$${role}$r$, $p$${password}$p$); ` +
     `END IF; ` +
     `EXECUTE format($f$ALTER DATABASE %I OWNER TO %I$f$, $d$${db}$d$, $r$${role}$r$); ` +
     `EXECUTE format($f$REVOKE CONNECT ON DATABASE %I FROM PUBLIC$f$, $d$${db}$d$); ` +
@@ -1158,7 +1137,7 @@ async function refreshStandaloneCorePin(inst, deps) {
 // bound to the instance's port + DB + brand, secrets from its own env file. SHAPE-AWARE:
 // a STANDALONE instance runs the CORE PACKAGE's platform-server from its OWN repo dir
 // (WorkingDirectory=standaloneRoot → resolveInstanceRoot() resolves to the instance via
-// cwd, deploy-instance.sh §4); co-tenant/dedicated run this control-plane checkout's src/.
+// cwd, deploy-instance.sh §4); co-tenant runs this control-plane checkout's src/.
 
 module.exports = {
   appGroupExpr,

package/scripts/gds/provision-teardown.js

@@ -24,24 +24,20 @@ async function teardownInstance(inst, deps) {
   // Tear down on the box the instance actually RAN on: a standalone ran control-plane-
   // local (task 2074), so disable/remove its unit HERE — not on the remote co-hosting
   // box, where it was never installed (that would allowFail-noop and leave the real
-  // control-plane unit running). Co-tenant + dedicated are unchanged.
+  // control-plane unit running). Co-tenant is unchanged.
   const boxExec = inst.hosting_shape === 'cloud-host' ? controlExec : exec;
   const sudoP = privileged ? 'sudo ' : '';   // systemctl / rm-under-/etc escalation (task 2066)
   log(`teardown ${inst.slug} (status=${inst.status})`);
   if (apply) await provisioning.setInstanceStatus(db, inst.id, 'tearing_down');
-  if (inst.hosting_shape !== 'dedicated') {
-    // Stop + remove the service AND the nightly backup units (task 2213; the dir + dumps stay — precious data, like the DB below). Whoever supervises the instance owns its removal (ADR 0306) — the systemd manager keeps the reset-failed step task 1003940 added, since a removed unit's FAILED state outlives its file and `systemctl --failed` listed torn-down ghosts for weeks.
-    (deps.processManager || resolveProcessManager()).removeService(inst, { exec: boxExec, sudoP });
-    // The site snippet standup step 6 wrote: while it stays, Caddy proxies the hostname to
-    // a port nothing listens on and every visitor gets a 502 (task 1002897). Not precious.
-    boxExec(`${sudoP}rm -f ${caddySnippetPath(inst)}`, { allowFail: true });
-    boxExec(`${sudoP}systemctl reload caddy`, { allowFail: true });
-    // Left for an operator (data is precious), naming ONLY what this row created —
-    // teardown now takes 'requested'/'error'. `port` + `domain` stay held: ADR 0181.
-    if (inst.db_name) log(`  (left for the operator: dropdb ${dbName(inst)}, prune ${CONFIG.backupDir}/${dbName(inst)}-*.sql.gz)`);
-  } else if (apply && inst.droplet_id && deps.doApi) {
-    await deps.doApi.deleteDroplet(inst.droplet_id);
-  }
+  // Stop + remove the service AND the nightly backup units (task 2213; the dir + dumps stay — precious data, like the DB below). Whoever supervises the instance owns its removal (ADR 0306) — the systemd manager keeps the reset-failed step task 1003940 added, since a removed unit's FAILED state outlives its file and `systemctl --failed` listed torn-down ghosts for weeks.
+  (deps.processManager || resolveProcessManager()).removeService(inst, { exec: boxExec, sudoP });
+  // The site snippet standup step 6 wrote: while it stays, Caddy proxies the hostname to
+  // a port nothing listens on and every visitor gets a 502 (task 1002897). Not precious.
+  boxExec(`${sudoP}rm -f ${caddySnippetPath(inst)}`, { allowFail: true });
+  boxExec(`${sudoP}systemctl reload caddy`, { allowFail: true });
+  // Left for an operator (data is precious), naming ONLY what this row created —
+  // teardown now takes 'requested'/'error'. `port` + `domain` stay held: ADR 0181.
+  if (inst.db_name) log(`  (left for the operator: dropdb ${dbName(inst)}, prune ${CONFIG.backupDir}/${dbName(inst)}-*.sql.gz)`);
   parkAddress(inst, { controlExec, log, apply });
   // The app's Render services are the OWNER's: forget them, never delete them (ADR 0327 §3, task 1004183).
   await require('./provision-render.js').forgetRenderApp(inst, { db, log, apply });

package/scripts/gds/provision-units.js

@@ -87,7 +87,7 @@ function backupUnitName(inst) { return `${inst.slug}-db-backup`; }
 function backupServicePath(inst) { return `/etc/systemd/system/${backupUnitName(inst)}.service`; }
 function backupTimerPath(inst) { return `/etc/systemd/system/${backupUnitName(inst)}.timer`; }
 // The consumer-layout-correct absolute path to db-backup-nightly.sh. Standalone runs
-// it from the instance's own pinned core; co-tenant/dedicated from this checkout's
+// it from the instance's own pinned core; co-tenant from this checkout's
 // scripts/gds/ — mirrors serviceUnit's execStart resolution so they can't diverge.
 function backupScriptPath(inst) {
   const rel = 'scripts/gds/db-backup-nightly.sh';
@@ -269,9 +269,8 @@ GITHUB_APP_PRIVATE_KEY=${String(appPem).replace(/\r?\n/g, '\\n')}
     : '';
   // The pool cap (task 1003928, ADR 0285 §3): a co-located instance shares the box's
   // Postgres with every sibling and the control plane, so its pool may not take pg's
-  // default 10 of the server's 97. src/bongos/pool.js reads it bare. A dedicated
-  // droplet has its own server and keeps the default — the line is not written.
-  const poolLine = inst.hosting_shape === 'dedicated' ? '' : `PGPOOL_MAX=${CONFIG.instancePoolMax}\n`;
+  // default 10 of the server's 97. src/bongos/pool.js reads it bare.
+  const poolLine = `PGPOOL_MAX=${CONFIG.instancePoolMax}\n`;
   return `# /etc/${inst.slug}/web.env — per-instance secrets (chmod 600, OUTSIDE the repo).
 ${credComment}
 ${prefix}_GITHUB_CLIENT_ID=${clientId || ''}