@bongos/core 1.20.24 → 1.20.25

package/modules/provisioning/paid-shape-gate.js

@@ -1,5 +1,6 @@
-// modules/provisioning/paid-shape-gate.js — who may ask for which hosting SHAPE
-// (task 1003682, widened by task 1003370 / audit B4).
+// modules/provisioning/paid-shape-gate.js — who may ask for which hosting SHAPE, and how
+// many hosted projects a builder may hold without the fleet permission
+// (task 1003682, widened by task 1003370 / audit B4, one free hosted project by task 1004412).
 //
 // THE FILENAME IS NARROWER THAN THE FILE, DELIBERATELY. This started as the gate over
 // METERED shapes alone. Task 1003370 widened it to every shape that is not the free
@@ -9,9 +10,9 @@
 // clarity for free.
 //
 // The create route is open to any authenticated builder, and it must stay that way:
-// standing up a project is the platform's front door, not a privilege. But only ONE of
-// the shapes it accepts is actually that front door. The others each hand the caller
-// something the platform pays for or trusts:
+// standing up a project is the platform's front door, not a privilege. But only two of
+// the shapes it accepts are that front door, and only one of them without limit. The
+// others each hand the caller something the platform pays for or trusts:
 //
 //   byo-host      — the front door since ADR 0323. The OWNER supplies the host, so the
 //                   platform pays nothing and runs none of the caller's code. No
@@ -22,23 +23,23 @@
 //   co-tenant     — RETIRED (ADR 0323). Was the free front door; ran on the platform's
 //                   own box, which is why the name could not be carried over to
 //                   bring-your-own-host. Now UNREQUESTABLE — see below.
-//   cloud-host    — runs the caller's OWN repo on a host the platform stands up. TODAY
-//                   that host is still the platform's own box, and that is what this
-//                   entry gates: the unit's WorkingDirectory is that checkout
+//   cloud-host    — the project's hall, hosted by us (ADR 0345), and the only shape the
+//                   create wizard sends. It runs the caller's OWN repo on the platform's
+//                   own box: the unit's WorkingDirectory is that checkout
 //                   (`scripts/gds/provision-units.js`) and the module loader discovers
 //                   modules from `resolveInstanceRoot()`, which is process.cwd()
 //                   (`src/module-loader/loader.js`). So the caller names a repo and the
-//                   platform require()s its `modules/` — arbitrary code execution on the
-//                   control plane's own machine. Task 1003369 gave each instance its own
-//                   uid, which bounds the blast radius to that account; it does not make
-//                   "any Xenos may run code here" an acceptable default.
+//                   platform require()s its `modules/` — code execution on the control
+//                   plane's own machine. Task 1003369 gave each instance its own uid,
+//                   which bounds the blast radius to that account.
 //
-//                   Once ADR 0327 lands, a cloud-host stands up on the OWNER's platform
-//                   account instead and that specific argument dissolves — but the gate
-//                   does NOT automatically follow, because the platform is still doing
-//                   the standing-up and still spending its own runner on it. Re-decide
-//                   this entry when the move happens (task 1004184); do not assume the
-//                   shape becomes open just because the box stops being ours.
+//                   Task 1003370 gated it outright, and that also refused every new user
+//                   at the wizard's last button (task 1004412): ADR 0345 decision 1 says
+//                   creating a project needs no account, key or bill. The owner's ruling
+//                   (2026-09-30, ADR 0354): a builder's FIRST live hosted project needs no
+//                   authority, and a further one needs the fleet permission. The limit is
+//                   what stops one person taking every place on the box (ADR 0285). See
+//                   ONE_FREE_SHAPES below.
 //
 //                   Stored as 'standalone' until task 1004182 renamed it to match the
 //                   owner-facing name (migration provisioning_027). The old 'dedicated'
@@ -54,7 +55,8 @@
 // reason this is a middleware over one field rather than a floor on the endpoint.
 //
 // AN ALLOW-LIST, NOT A DENY-LIST — the control-plane-guard.js rule, for the same reason.
-// The set named below is the set that needs NO authority. Every other shape, including
+// The sets named below are the ones that need no authority (OPEN_SHAPES), or none for a
+// builder's first project (ONE_FREE_SHAPES). Every other shape, including
 // one added after this file was last read, requires the permission by omission. The
 // previous shape of this gate listed the one shape that was gated and admitted the rest,
 // and that is exactly how `cloud-host` and `control-plane` stayed open: `cloud-host`
@@ -79,14 +81,30 @@
 'use strict';
 
 const provisioning = require('./provisioning.js');
+const { failFrom } = require('./public-refusal');
 
-// The shapes any authenticated builder may request with no permission at all. This is
-// the whole allow-list, and it is deliberately one entry long: byo-host is the front
-// door, and the front door is the only thing that should be free. `tests/
-// provisioning_paid_shape_gate.mjs` pins HOSTING_SHAPES against this set so a new shape
+// The shapes any authenticated builder may request with no permission at all, as many
+// times as they like. Deliberately one entry long: byo-host runs on the owner's own
+// host, so it costs the platform nothing and runs none of the caller's code. `tests/
+// provisioning_paid_shape_gate.mjs` pins HOSTING_SHAPES against these sets so a new shape
 // cannot be added without someone deciding, in writing, which side of the line it is on.
 const OPEN_SHAPES = Object.freeze(new Set(['byo-host']));
 
+// The shapes a builder may hold ONE live project of with no permission (task 1004412,
+// ADR 0354). A second one needs provisioning.fleet.manage, like any shape outside every
+// set here. cloud-host is the only member: it is the wizard's front door under ADR 0345,
+// and it spends a place on the shared box, of which there are about fifteen (ADR 0285).
+// "Live" is any status but torn_down: a failed or queued project still holds its place,
+// and its owner can retry it (the same slug) or take it offline to free the place.
+const ONE_FREE_SHAPES = Object.freeze(new Set(['cloud-host']));
+
+// One first-free request per builder at a time. The count and the insert are two steps
+// with awaits between them, so two requests sent at once would both count zero and both
+// take the free place. The builder's advisory lock is held from before the count until
+// the response closes, so a second request sent meanwhile — from any web process — is
+// refused (the wizard never sends two). ./free-place-lock.js says how it is held.
+const freePlace = require('./free-place-lock');
+
 // Shapes that are not requestable through this route AT ALL — no permission admits them,
 // because there is no rank at which "ask the API for a second control plane" is a
 // coherent request. The control-plane row is the platform describing ITSELF; a builder
@@ -105,6 +123,8 @@ const UNREQUESTABLE_SHAPES = Object.freeze(new Set(['control-plane', 'co-tenant'
 
 // shapeAuthority — what does this wire value demand? PURE. Returns one of:
 //   'open'          → admit with no permission
+//   'one-free'      → admit the caller's first live project of the shape; after that,
+//                     require provisioning.fleet.manage
 //   'unrequestable' → refuse outright, whatever the caller holds
 //   'permission'    → require provisioning.fleet.manage
 //   'defer'         → not a shape this gate recognises; let the route's own validator
@@ -128,18 +148,58 @@ function shapeAuthority(rawShape) {
   if (!provisioning.HOSTING_SHAPES.includes(shape)) return 'defer';
   if (UNREQUESTABLE_SHAPES.has(shape)) return 'unrequestable';
   if (OPEN_SHAPES.has(shape)) return 'open';
+  if (ONE_FREE_SHAPES.has(shape)) return 'one-free';
   return 'permission';
 }
 
+// otherLiveProjects — the caller's own projects of this shape that still hold their place,
+// leaving out the slug being asked for: a retry or revive of your own project is that
+// project again, not a second one. The slug is normalised exactly as the route does.
+// Reads provisioning through its module object at request time so a test can re-point it.
+async function otherLiveProjects(db, builderId, shape, rawSlug) {
+  const slug = String(rawSlug || '').trim().toLowerCase();
+  const rows = await provisioning.listInstancesForOwner(db, builderId);
+  return rows.filter((r) => r.hosting_shape === shape && r.status !== 'torn_down' && r.slug !== slug);
+}
+
 // requireAuthorityForShape — the create route's shape gate. Mount it AFTER requireBuilder
 // and BEFORE the handler, so a refusal leaves no row behind for the runner to drain later.
 // `requirePermission` is injected (rather than required here) so the gate is exercisable
-// without standing up the auth stack.
-function requireAuthorityForShape(requirePermission) {
+// without standing up the auth stack; `db` and `log` serve the one-free count.
+function requireAuthorityForShape(requirePermission, db, log) {
   const gate = requirePermission('provisioning.fleet.manage');
-  return function shapeGate(req, res, next) {
+  return async function shapeGate(req, res, next) {
     const verdict = shapeAuthority(req.body && req.body.hosting_shape);
     if (verdict === 'open' || verdict === 'defer') return next();
+    if (verdict === 'one-free') {
+      let others;
+      try {
+        // Read through the module object at request time so a test can re-point it.
+        const release = await freePlace.holdFreePlace(db, req.builder.id);
+        if (!release) {
+          return res.fail('create_in_progress', {
+            status: 409,
+            message: 'Another project request from this account is still being answered. Try again once it finishes.',
+          });
+        }
+        // Held until the row exists: the handler calls req.releaseFreePlace right after its
+        // insert, so the lock's connection is not kept through the rest of the request.
+        // Every earlier exit (a refusal, a validation 400, a thrown error, a client that
+        // hangs up) releases on 'close' instead — 'close', not 'finish', because 'finish'
+        // never fires for a response the client abandoned. Release is idempotent.
+        req.releaseFreePlace = release;
+        res.once('close', () => { release().catch(() => {}); });
+        others = await otherLiveProjects(db, req.builder.id, req.body.hosting_shape, req.body.slug);
+      } catch (err) {
+        // Fail CLOSED (ADR 0016): a lock or count that could not be read is not a free place.
+        log.error('[provisioning] shape gate could not lock or count the caller\'s projects; refusing', err);
+        return failFrom(res, err, 'request_failed');
+      }
+      if (others.length === 0) return next();
+      // A further live project: the same permission as any gated shape, and the kernel
+      // gate's own refusal (permission_forbidden, naming the atom) is the answer.
+      return gate(req, res, next);
+    }
     if (verdict === 'unrequestable') {
       // Two shapes land here for different reasons, so the message names which.
       //
@@ -167,8 +227,8 @@ function requireAuthorityForShape(requirePermission) {
   };
 }
 
-// Only the gate is exported. OPEN_SHAPES, UNREQUESTABLE_SHAPES and shapeAuthority are
-// deliberately private: nothing outside this file needs to ask "what does this shape
-// demand" separately from being gated on it, and an export nobody consumes is one more
-// thing to keep true.
+// Only the gate is exported. OPEN_SHAPES, ONE_FREE_SHAPES, UNREQUESTABLE_SHAPES and
+// shapeAuthority are deliberately private: nothing outside this file needs to ask "what
+// does this shape demand" separately from being gated on it, and an export nobody
+// consumes is one more thing to keep true.
 module.exports = { requireAuthorityForShape };

package/modules/provisioning/routes/provisioning.js

@@ -285,14 +285,13 @@ module.exports = function provisioningRoutes() {
   });
 
   // POST /provisioning/instances — request a new instance. rank: any authenticated
-  // builder (own resource) for the free `co-tenant` shape. Every other shape also needs
-  // provisioning.fleet.manage — `dedicated` because it bills, `standalone` because it runs
-  // the caller's own repo on the platform's box — and `control-plane` is refused outright,
-  // since the platform enrolls its own row (../paid-shape-gate.js, task 1003370 / audit B4).
+  // builder (own resource) for `byo-host`, and for their FIRST live `cloud-host` (task
+  // 1004412, ADR 0354). A further cloud-host needs provisioning.fleet.manage, and
+  // `control-plane` / `co-tenant` are refused outright (../paid-shape-gate.js).
   // A full shared box answers 409 box_full up front (../capacity-gate.js).
   // ENQUEUES a 'provision' intent the runner (task P3) stands up. Idempotent on slug for the SAME
   // owner (re-request returns the existing row); a slug owned by ANOTHER builder → 409.
-  // Body: { slug (required), target_ref?, hosting_shape? (co-tenant free; others gated),
+  // Body: { slug (required), target_ref?, hosting_shape? (byo-host free; one cloud-host free),
   //         domain?, tier?, onboard_mode? (greenfield|adopt) }.
   //
   // onboard_mode is LOAD-BEARING, not a label (task 1002562): the control-plane runner
@@ -300,7 +299,7 @@ module.exports = function provisioningRoutes() {
   // ALREADY has, so the runner must clone + layer onto its history instead of pushing a
   // fresh tree at `main` (which an existing repo rejects as unrelated history). Absent →
   // 'greenfield', the safe default.
-  router.post('/provisioning/instances', auth.requireBuilder, requireAuthorityForShape(auth.requirePermission), requireRoomOnBox(pool, log), async (req, res) => {
+  router.post('/provisioning/instances', auth.requireBuilder, requireAuthorityForShape(auth.requirePermission, pool, log), requireRoomOnBox(pool, log), async (req, res) => {
     if (validateOrRespond(req, res, {
       slug: { required: true, type: 'string', maxLength: 40 },
       target_ref: { type: 'string', maxLength: 200 },
@@ -427,6 +426,7 @@ module.exports = function provisioningRoutes() {
         // with the same standing: skipped, and resolved from the bundle on read.
         modules: body.modules,
       });
+      if (req.releaseFreePlace) await req.releaseFreePlace();   // the row exists: the one-free lock's work is done (../free-place-lock.js)
       // Slug already taken by ANOTHER builder — refuse (never reassign ownership).
       if (!created && String(instance.owner_builder_id) !== String(req.builder.id)) {
         return res.fail('slug_taken', { status: 409, message: 'That instance slug is already in use.' });

package/modules/public-landing/public/projects.html

@@ -4868,6 +4868,13 @@ summary{min-height:24px;padding:3px 0;}
       if (code === 'bad_domain') return 'The domain didn’t parse as a real hostname — use something like myproject.example.com.';
       if (code === 'repo_scope_required') return 'GitHub hasn’t granted repository access for this session. Sign in again — it asks for repository access — and try once more.';
       if (code === 'request_failed') return 'The platform couldn’t file the request. Nothing was created — try again in a moment.';
+      /* the shape gate (task 1004412): an account hosts ONE project without the fleet
+         permission, and this wizard only asks for a hosted project, so a refusal naming
+         that permission means "you already have one". held is null when authority could
+         not be checked at all: a blip, so it falls to the generic sentence instead. */
+      var details = code ? err.data.error.details : null;
+      if (code === 'permission_forbidden' && details && Array.isArray(details.held)) return 'Each account can host one project for free, and yours already has one. To start a new one, take the old one offline from its page under Your projects. Trusted builders can host more than one — ask the platform team if you need that.';
+      if (code === 'box_full') return 'Our shared server is full right now, so there’s no room for a new project. Nothing was created — try again later.';
       return '';
     }
     function createFailureMarkup(err) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.24",
+  "version": "1.20.25",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.24",
+      "version": "1.20.25",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.24",
+  "version": "1.20.25",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8200,5 +8200,15 @@
       "id": "1004428",
       "text": "The plan for the new project-startup experience is agreed and written down. New projects begin with a demo-or-create choice and seven planet questions, and each project picks its own colours and logo. While a project is being"
     }
+  ],
+  "1.20.25": [
+    {
+      "id": "1004415",
+      "text": "The project-startup design is now saved in the project as the official reference. It sets out screen by screen what the current builders hall keeps and what founding mode adds, so the new design never takes over the existing h"
+    },
+    {
+      "id": "1004412",
+      "text": "New users can create a project again. Since 19 September, anyone new who pressed \"Create my project\" was turned away with a vague error, because hosted projects had been limited to trusted builders. Now everyone who is signed"
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.24'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.25'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/project_catalog_routes.mjs

@@ -52,6 +52,8 @@ let healed = [];
 provisioning.getInstanceById = async (_db, id) => (instance ? { ...instance, id } : null);
 provisioning.getInstanceBySlug = async (_db, slug) => (instance && instance.slug === slug ? { ...instance } : null);
 provisioning.getInstanceByDomain = async () => null;
+provisioning.listInstancesForOwner = async () => [];   // the shape gate's count (task 1004412): no other hosted project
+require('../modules/provisioning/free-place-lock.js').holdFreePlace = async () => async () => {};   // and its lock: always free here
 provisioning.createInstance = async (_db, req) => {
   instance = { ...BASE_ROW, slug: req.slug, domain: req.domain || null, description: req.description || null };
   return { instance: { ...instance }, created: true };

package/tests/projects_hub_pre_uat.mjs

@@ -508,7 +508,7 @@ test('an unmapped create failure gets a plain sentence with the raw text folded
   const friendly = fn('friendlyCreateError');
   assert.match(friendly, /return '';\n\s*\}/, 'unmapped codes return nothing — the caller folds them');
   assert.doesNotMatch(friendly, /Couldn’t file the request: ' \+/, 'the raw message is no longer the headline');
-  for (const code of ['slug_taken', 'bad_slug', 'domain_reserved', 'domain_taken', 'bad_domain', 'repo_scope_required', 'request_failed']) {
+  for (const code of ['slug_taken', 'bad_slug', 'domain_reserved', 'domain_taken', 'bad_domain', 'repo_scope_required', 'request_failed', 'permission_forbidden', 'box_full']) {
     assert.match(friendly, new RegExp(`code === '${code}'`), `${code} stays headline-only`);
   }
   assert.match(friendly, /belongs to the platform’s own domain/, 'domain_reserved covers both server branches');

package/tests/provisioning_capacity_gate.mjs

@@ -48,6 +48,8 @@ capacity.fleetCapacity = async () => {
 const provisioning = require('../modules/provisioning/provisioning.js');
 let existing = null, lastCreateArgs = null;
 provisioning.getInstanceBySlug = async () => existing;
+provisioning.listInstancesForOwner = async () => [];   // the shape gate's count (task 1004412): no other hosted project
+require('../modules/provisioning/free-place-lock.js').holdFreePlace = async () => async () => {};   // and its lock: always free here
 provisioning.createInstance = async (_db, args) => {
   lastCreateArgs = args;
   if (existing) return { instance: existing, created: false };

package/tests/provisioning_domain_attach.mjs

@@ -118,6 +118,8 @@ provisioning.enqueueIntent = async (_db, id, action, requestedBy) => {
 provisioning.getOpenIntent = async () => null;
 provisioning.createInstance = async () => createResult;
 provisioning.getInstanceBySlug = async () => null;   // the task-1002704 birth-time pre-check
+provisioning.listInstancesForOwner = async () => [];   // the shape gate's count (task 1004412): no other hosted project
+require('../modules/provisioning/free-place-lock.js').holdFreePlace = async () => async () => {};   // and its lock: always free here
 provisioning.recordEvent = async () => {};
 provisioning.createOAuthManifest = async (_db, row) => { manifestRows.push(row); return { id: 1, ...row }; };
 provisioning.getLatestOAuthManifestForInstance = async () => null;

package/tests/provisioning_paid_shape_gate.mjs

@@ -37,6 +37,13 @@
 // So the set below is now the set that needs NO authority, and a shape added later is gated
 // by omission instead of admitted by it.
 //
+// NARROWED FOR ONE PROJECT BY TASK 1004412 (ADR 0354). Gating cloud-host outright also
+// refused every new user at the create wizard's last button, because the wizard only ever
+// asks for cloud-host, and ADR 0345 made that shape the free front door. The owner's ruling:
+// a builder's FIRST live hosted project needs no permission, and a further one needs
+// provisioning.fleet.manage. The route-level proof with a real Xenos is
+// tests/provisioning_wizard_create_xenos.mjs; the cases below hold the gate's side.
+//
 // DB-free: the pool is never reached (createInstance is stubbed), auth is faked. No network
 // beyond a loopback listener.
 //
@@ -65,6 +72,13 @@ provisioning.createInstance = async (_db, args) => {
 provisioning.enqueueIntent = async () => ({ intent: { id: 1, state: 'pending' }, created: true });
 provisioning.recordEvent = async () => {};
 provisioning.getInstanceBySlug = async () => null;
+// The caller's own projects, which the one-free count reads (task 1004412). Flipped per case.
+let owned = [];
+provisioning.listInstancesForOwner = async () => owned;
+// …and the free-place lock beside it (free-place-lock.js), always free here: the race is
+// proved in tests/provisioning_wizard_create_xenos.mjs.
+require('../modules/provisioning/free-place-lock.js').holdFreePlace = async () => async () => {};
+const LIVE_HOSTED = { id: 9, owner_builder_id: 7, slug: 'older', hosting_shape: 'cloud-host', status: 'active' };
 
 const api = require('../src/module-api.js');
 api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
@@ -189,28 +203,42 @@ await ta('the refusal speaks WIRE vocabulary — no owner-facing label is transl
     'a refusal that names no alternative is a dead end — the stored values are the alternative');
 });
 
-// ── cloud-host runs the caller's OWN code on the platform's box (task 1003370) ────
+// ── cloud-host runs the caller's OWN code on the platform's box ───────────────────
+// Task 1003370 gated it outright; task 1004412 lets each builder host ONE project free.
 
-await ta('cloud-host: REFUSED for a builder without provisioning.fleet.manage', async () => {
-  // Task 1003682 left this shape open, reasoning that a $0 shape hands the caller
-  // nothing. That is true of the invoice and false of the trust: the systemd unit's
-  // WorkingDirectory is the caller's own checkout and the module loader discovers
-  // `modules/` from process.cwd(), so a cloud-host request is "please require() this
-  // repo on your control plane". The uid split (task 1003369) bounds the blast radius;
-  // it does not make the default acceptable.
+await ta('cloud-host: a builder\'s FIRST live hosted project needs no permission (task 1004412)', async () => {
+  // The wizard's front door (ADR 0345). The trust question task 1003370 raised is still
+  // true — the unit's WorkingDirectory is the caller's own checkout, so the platform
+  // require()s their repo, bounded by the per-instance uid (task 1003369) — and the owner
+  // accepted it for one project per builder (ADR 0354).
   held = [];
+  owned = [];
   lastCreateArgs = null;
   const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'cloud-host', no_address: true });
+  assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
+  assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'cloud-host');
+});
+
+await ta('cloud-host: a SECOND live hosted project is REFUSED without provisioning.fleet.manage', async () => {
+  // The limit is what stops one person taking every place on the shared box (ADR 0285).
+  // The refusal is the kernel permission gate's own, naming the atom.
+  held = [];
+  owned = [LIVE_HOSTED];
+  lastCreateArgs = null;
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'cloud-host', no_address: true });
+  owned = [];
   assert.equal(res.status, 403, `expected 403, got ${res.status} ${res.raw}`);
   assert.equal(res.body.error.code, 'permission_forbidden');
   assert.deepEqual(res.body.error.details.required, ['provisioning.fleet.manage']);
   assert.equal(lastCreateArgs, null, 'no row is created when the shape is refused');
 });
 
-await ta('cloud-host: ADMITTED for a builder holding provisioning.fleet.manage', async () => {
+await ta('cloud-host: ADMITTED past the limit for a builder holding provisioning.fleet.manage', async () => {
   held = ['provisioning.fleet.manage'];
+  owned = [LIVE_HOSTED, { ...LIVE_HOSTED, slug: 'oldest' }];
   lastCreateArgs = null;
   const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'cloud-host', no_address: true });
+  owned = [];
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
   assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'cloud-host');
 });
@@ -271,8 +299,11 @@ await ta('the gate refuses BEFORE the row exists — a denied create leaves noth
   // The denial must land ahead of createInstance, not after it: a refused-but-inserted row
   // would still be drained by the runner, which reads the column, not the HTTP status.
   held = [];
+  owned = [LIVE_HOSTED]; // a second hosted project, so the shape is refused
   lastCreateArgs = null;
-  await post('/provisioning/instances', { slug: 'spendy', hosting_shape: 'cloud-host', no_address: true });
+  const res = await post('/provisioning/instances', { slug: 'spendy', hosting_shape: 'cloud-host', no_address: true });
+  owned = [];
+  assert.equal(res.status, 403, `expected 403, got ${res.status} ${res.raw}`);
   assert.equal(lastCreateArgs, null);
 });
 
@@ -301,7 +332,8 @@ await ta('HOSTING_SHAPES is pinned, so a new shape forces a written decision abo
   // POST for a second control plane until task 1003370.
   //
   // So the question this list now forces is the one that generalises. The gate is an
-  // allow-list: `byo-host` needs nothing, `control-plane` and `co-tenant` are refused
+  // allow-list: `byo-host` needs nothing, `cloud-host` needs nothing for a builder's first
+  // live project (task 1004412), `control-plane` and `co-tenant` are refused
   // outright (for different reasons — never-yours vs retired), and
   // EVERY other shape — including one added after this file was last read — demands
   // provisioning.fleet.manage by omission. A fifth shape therefore arrives already

package/tests/provisioning_teardown_intent.mjs

@@ -187,6 +187,8 @@ provisioning.enqueueIntent = async (_db, id, action, requestedBy) => {
 provisioning.getOpenIntent = async () => null;
 provisioning.createInstance = async () => createResult;
 provisioning.getInstanceBySlug = async () => null;   // the task-1002704 birth-time pre-check
+provisioning.listInstancesForOwner = async () => [];   // the shape gate's count (task 1004412): no other hosted project
+require('../modules/provisioning/free-place-lock.js').holdFreePlace = async () => async () => {};   // and its lock: always free here
 provisioning.recordEvent = async () => {};
 
 const api = require('../src/module-api.js');