@bongos/core 1.20.24 → 1.20.26

package/modules/provisioning/routes/provisioning.js

@@ -285,14 +285,13 @@ module.exports = function provisioningRoutes() {
   });
 
   // POST /provisioning/instances — request a new instance. rank: any authenticated
-  // builder (own resource) for the free `co-tenant` shape. Every other shape also needs
-  // provisioning.fleet.manage — `dedicated` because it bills, `standalone` because it runs
-  // the caller's own repo on the platform's box — and `control-plane` is refused outright,
-  // since the platform enrolls its own row (../paid-shape-gate.js, task 1003370 / audit B4).
+  // builder (own resource) for `byo-host`, and for their FIRST live `cloud-host` (task
+  // 1004412, ADR 0354). A further cloud-host needs provisioning.fleet.manage, and
+  // `control-plane` / `co-tenant` are refused outright (../paid-shape-gate.js).
   // A full shared box answers 409 box_full up front (../capacity-gate.js).
   // ENQUEUES a 'provision' intent the runner (task P3) stands up. Idempotent on slug for the SAME
   // owner (re-request returns the existing row); a slug owned by ANOTHER builder → 409.
-  // Body: { slug (required), target_ref?, hosting_shape? (co-tenant free; others gated),
+  // Body: { slug (required), target_ref?, hosting_shape? (byo-host free; one cloud-host free),
   //         domain?, tier?, onboard_mode? (greenfield|adopt) }.
   //
   // onboard_mode is LOAD-BEARING, not a label (task 1002562): the control-plane runner
@@ -300,7 +299,7 @@ module.exports = function provisioningRoutes() {
   // ALREADY has, so the runner must clone + layer onto its history instead of pushing a
   // fresh tree at `main` (which an existing repo rejects as unrelated history). Absent →
   // 'greenfield', the safe default.
-  router.post('/provisioning/instances', auth.requireBuilder, requireAuthorityForShape(auth.requirePermission), requireRoomOnBox(pool, log), async (req, res) => {
+  router.post('/provisioning/instances', auth.requireBuilder, requireAuthorityForShape(auth.requirePermission, pool, log), requireRoomOnBox(pool, log), async (req, res) => {
     if (validateOrRespond(req, res, {
       slug: { required: true, type: 'string', maxLength: 40 },
       target_ref: { type: 'string', maxLength: 200 },
@@ -427,6 +426,7 @@ module.exports = function provisioningRoutes() {
         // with the same standing: skipped, and resolved from the bundle on read.
         modules: body.modules,
       });
+      if (req.releaseFreePlace) await req.releaseFreePlace();   // the row exists: the one-free lock's work is done (../free-place-lock.js)
       // Slug already taken by ANOTHER builder — refuse (never reassign ownership).
       if (!created && String(instance.owner_builder_id) !== String(req.builder.id)) {
         return res.fail('slug_taken', { status: 409, message: 'That instance slug is already in use.' });

package/modules/public-landing/public/projects.html

@@ -4868,6 +4868,13 @@ summary{min-height:24px;padding:3px 0;}
       if (code === 'bad_domain') return 'The domain didn’t parse as a real hostname — use something like myproject.example.com.';
       if (code === 'repo_scope_required') return 'GitHub hasn’t granted repository access for this session. Sign in again — it asks for repository access — and try once more.';
       if (code === 'request_failed') return 'The platform couldn’t file the request. Nothing was created — try again in a moment.';
+      /* the shape gate (task 1004412): an account hosts ONE project without the fleet
+         permission, and this wizard only asks for a hosted project, so a refusal naming
+         that permission means "you already have one". held is null when authority could
+         not be checked at all: a blip, so it falls to the generic sentence instead. */
+      var details = code ? err.data.error.details : null;
+      if (code === 'permission_forbidden' && details && Array.isArray(details.held)) return 'Each account can host one project for free, and yours already has one. To start a new one, take the old one offline from its page under Your projects. Trusted builders can host more than one — ask the platform team if you need that.';
+      if (code === 'box_full') return 'Our shared server is full right now, so there’s no room for a new project. Nothing was created — try again later.';
       return '';
     }
     function createFailureMarkup(err) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.24",
+  "version": "1.20.26",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.24",
+      "version": "1.20.26",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.24",
+  "version": "1.20.26",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8200,5 +8200,21 @@
       "id": "1004428",
       "text": "The plan for the new project-startup experience is agreed and written down. New projects begin with a demo-or-create choice and seven planet questions, and each project picks its own colours and logo. While a project is being"
     }
+  ],
+  "1.20.25": [
+    {
+      "id": "1004415",
+      "text": "The project-startup design is now saved in the project as the official reference. It sets out screen by screen what the current builders hall keeps and what founding mode adds, so the new design never takes over the existing h"
+    },
+    {
+      "id": "1004412",
+      "text": "New users can create a project again. Since 19 September, anyone new who pressed \"Create my project\" was turned away with a vague error, because hosted projects had been limited to trusted builders. Now everyone who is signed"
+    }
+  ],
+  "1.20.26": [
+    {
+      "id": "1004429",
+      "text": "A new project's founding stages are now decided by its own government. When a stage's work is finished, closing the stage goes to the Board Room like any other decision. A solo founder under the default one-leader government c"
+    }
   ]
 }

package/src/bongos/route-rank-check.js

@@ -268,6 +268,9 @@ const GOVERNMENT_PINS = {
   // R18: the Constitution view — the live rule + the amendment history; reading
   // the rule you vote under is part of casting.
   'GET /government/constitution': 'perm:board.vote.cast',
+  // task 1004429: the founding band — who each genesis stage is waiting on. A
+  // read of the open ballot, so the same atom as the room.
+  'GET /government/board/genesis-stages': 'perm:board.vote.cast',
 };
 
 // Module-scoped privileged-rank pins: a privileged route that lives in a FEATURE

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.24'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.26'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/government_board_genesis_stage.mjs

@@ -0,0 +1,305 @@
+// tests/government_board_genesis_stage.mjs — a genesis stage is the Board
+// Room's third subject (task 1004429 / BV2.PS04, spec decision D7).
+//
+// When a founding stage's tasks are all finished (shipped or dropped), closing
+// the stage is put to the constitution IN FORCE as a board item. DB-free (db
+// monkeypatched, membership logic real). The invariants:
+//
+//   1. THE GATE IS "THE STAGE'S TASKS ARE FINISHED", and it lives here — an
+//      unknown stage, an empty task list, or any unfinished (or missing) task
+//      opens nothing, before any write.
+//   2. THE ITEM IS AN ORDINARY ITEM — it snapshots the live constitution, runs
+//      the live window, and is idempotent through government_003's one-open-
+//      per-subject index (subject_id = the stage number).
+//   3. MONARCHY: THE FOUNDER'S ONE CONFIRM CLOSES IT — under first_ratifier the
+//      founder who put the stage up casts yes and the sitting passes. No bypass
+//      makes that true: the author rule is full_idea-scoped (ADR 0191), exactly
+//      as for an amendment, so the founder is simply the first ratifier.
+//   4. EVERY OTHER SHAPE IS A REAL SITTING — consent waits for full turnout,
+//      majority counts the membership; no new pass rule exists.
+//   5. A PASS FIRES `board.genesis_stage.passed` for the genesis home, pays no
+//      credit and no ratify karma.
+//   6. "WHO IS THIS STAGE WAITING ON" is answered from the item's own snapshot
+//      and the live members, and the founder is SUMMONED for their own stage.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+const api = require(path.join(ROOT, 'src', 'module-api.js'));
+const board = require(path.join(GOV, 'board.js'));
+const db = require(path.join(GOV, 'db.js'));
+const config = require(path.join(GOV, 'config.js'));
+
+const { GENESIS_STAGES, openGenesisStageClose, genesisStageStatus, castVote, maybeCloseAfterVote, closeItem } = board;
+
+const FOUNDER = '42';
+const AVERY = '43';
+const JORDAN = '44';
+
+const MONARCHY = Object.freeze({
+  membership: 'rank:archon', pass_rule: 'first_ratifier', window_minutes: null, close_early_on_full_turnout: true,
+});
+const CONSENT = Object.freeze({ ...MONARCHY, membership: 'rank:metic+', pass_rule: 'consent', window_minutes: 1440 });
+const MAJORITY = Object.freeze({ ...CONSENT, pass_rule: 'majority' });
+
+async function withDb(stubs, fn) {
+  const originals = {};
+  for (const [k, v] of Object.entries(stubs)) { originals[k] = db[k]; db[k] = v; }
+  try { return await fn(); } finally { for (const [k, v] of Object.entries(originals)) db[k] = v; }
+}
+
+// Capture one seam event for the duration of fn.
+async function capturing(event, fn) {
+  const seen = [];
+  const off = api.on(event, (p) => { seen.push(p); });
+  try { await fn(); } finally { if (typeof off === 'function') off(); }
+  return seen;
+}
+
+const stageItem = (over = {}) => ({
+  id: '90', subject_type: 'genesis_stage', subject_id: '3', opened_by: FOUNDER,
+  closes_at: null, closed_at: null, outcome: null, expired: false, constitution: MONARCHY, ...over,
+});
+const vote = (voter, direction = 'yes', extra = {}) => ({ voter_id: voter, direction, ...extra });
+const member = (id, login) => ({ builder_id: id, github_login: login, display_name: login });
+
+// ── the stage list ──────────────────────────────────────────────────────────
+
+test('the five founding stages, in order, numbered 1..5 — the range the migration CHECK allows', () => {
+  assert.deepEqual(GENESIS_STAGES.map((s) => s.key), ['scope', 'strategize', 'charter', 'legalize', 'legislation']);
+  assert.deepEqual(GENESIS_STAGES.map((s) => s.number), [1, 2, 3, 4, 5]);
+  assert.ok(Object.isFrozen(GENESIS_STAGES) && GENESIS_STAGES.every(Object.isFrozen));
+  const sql = fs.readFileSync(path.join(GOV, 'migrations', 'government_020_genesis_stage_subject.sql'), 'utf8');
+  assert.match(sql, /subject_type IN \('full_idea', 'constitutional_amendment', 'genesis_stage'\)/,
+    'the CHECK widens to the third subject and keeps the first two');
+  assert.match(sql, new RegExp(`subject_id BETWEEN 1 AND ${GENESIS_STAGES.length}`),
+    'the stage-number range in the database is the length of the one list here');
+});
+
+// ── invariant 1: the finished-tasks gate ─────────────────────────────────────
+
+test('nothing opens for an unknown stage, an empty task list, or any unfinished or missing task', async () => {
+  await withDb({
+    openBoardItem: async () => { throw new Error('must not be reached'); },
+    getTaskStatuses: async (ids) => ids.filter((id) => id !== 103).map((id) => ({
+      id: String(id), status: id === 102 ? 'active' : 'shipped',
+    })),
+  }, async () => {
+    assert.equal((await openGenesisStageClose({ stageKey: 'coronation', taskIds: [101], openedBy: FOUNDER })).reason, 'unknown_stage');
+    assert.equal((await openGenesisStageClose({ stageKey: 'charter', taskIds: [], openedBy: FOUNDER })).reason, 'no_stage_tasks');
+    assert.equal((await openGenesisStageClose({ stageKey: 'charter', taskIds: ['x'], openedBy: FOUNDER })).reason, 'no_stage_tasks');
+    const out = await openGenesisStageClose({ stageKey: 'charter', taskIds: [101, 102, 103], openedBy: FOUNDER });
+    assert.equal(out.opened, false);
+    assert.equal(out.reason, 'stage_tasks_unfinished');
+    assert.deepEqual(out.unfinished, [
+      { task_id: '102', status: 'active' },
+      { task_id: '103', status: null },
+    ], 'each blocker is named, and a task nobody can find counts as unfinished');
+  });
+});
+
+// ── invariant 2: an ordinary item under the constitution in force ────────────
+
+test('finished tasks (shipped AND dropped) open ONE item that snapshots the live constitution', async () => {
+  let opened = null;
+  const live = config.loadGovernmentConfig().board;
+  const events = await capturing('board.item.opened', () => withDb({
+    getTaskStatuses: async () => [{ id: '101', status: 'shipped' }, { id: '102', status: 'abandoned' }],
+    openBoardItem: async (args) => { opened = args; return { ...stageItem(), constitution: args.constitution }; },
+  }, async () => {
+    const out = await openGenesisStageClose({ stageKey: 'charter', taskIds: [101, '102'], openedBy: FOUNDER });
+    assert.equal(out.opened, true);
+    assert.equal(out.stage.key, 'charter');
+  }));
+  assert.equal(opened.subjectType, 'genesis_stage');
+  assert.equal(opened.subjectId, 3, 'the subject is the stage NUMBER — one open sitting per stage, structurally');
+  assert.equal(opened.openedBy, FOUNDER);
+  assert.deepEqual(opened.constitution, live, 'the item snapshots the constitution in force, like every item');
+  assert.equal(opened.windowMinutes, live.window_minutes, 'the live clock rule, unchanged');
+  assert.equal(events.length, 1, 'the window-open nudge fires, as for any item');
+});
+
+test('a second open while the stage sits returns the standing item and opens nothing', async () => {
+  const events = await capturing('board.item.opened', () => withDb({
+    getTaskStatuses: async () => [{ id: '101', status: 'shipped' }],
+    openBoardItem: async () => null, // the partial unique index said no
+    getOpenBoardItem: async (type, id) => (type === 'genesis_stage' && id === 3 ? stageItem() : null),
+  }, async () => {
+    const out = await openGenesisStageClose({ stageKey: 'charter', taskIds: [101], openedBy: FOUNDER });
+    assert.equal(out.opened, false);
+    assert.equal(out.reason, 'already_open');
+    assert.equal(out.item.id, '90');
+  }));
+  assert.equal(events.length, 0, 'nobody is summoned twice');
+});
+
+// ── invariant 3: the monarchy default — the founder's one confirm ────────────
+
+test('under Monarchy / BDFL the founder\'s single yes closes the stage — no bypass, just the first ratifier', async () => {
+  const votes = [];
+  let karmaPaid = false;
+  const passed = await capturing('board.genesis_stage.passed', async () => {
+    await withDb({
+      getBoardItemForVote: async () => stageItem(),
+      builderHoldsRankActive: async (id) => id === FOUNDER,
+      getActiveBuildersWithRank: async () => [member(FOUNDER, 'founder')],
+      // Returns opened_by for any non-idea subject — the founder. The point of
+      // the test is that the deciding rules never hold it against them.
+      getBoardItemAuthor: async (item) => item.opened_by,
+      insertBoardVote: async (row) => { const v = { ...row, voter_id: row.voterId, direction: row.direction }; votes.push(v); return v; },
+      insertVoteKarma: async () => {},
+      getVotesForItem: async () => votes,
+      closeBoardItem: async ({ outcome, afterClose }) => {
+        assert.equal(afterClose, null, 'a stage close books no credit — nothing rides the transaction');
+        return { ...stageItem(), closed_at: 'T', outcome };
+      },
+      insertAuthorRatifyKarma: async () => { karmaPaid = true; return true; },
+    }, async () => {
+      const cast = await castVote({ itemId: '90', voterId: FOUNDER, direction: 'yes' });
+      assert.equal(cast.ok, true);
+      assert.equal(cast.self_cast, false, 'the author rule is full_idea-scoped — the founder is not a self-caster here');
+      const closed = await maybeCloseAfterVote('90');
+      assert.equal(closed.closed, true);
+      assert.equal(closed.outcome, 'passed');
+    });
+  });
+  assert.equal(karmaPaid, false, 'closing a stage ratifies no authored work — no ratify karma');
+  assert.deepEqual(passed, [{ item_id: '90', stage_key: 'charter', stage_number: 3, passed_at: 'T' }],
+    'the genesis home hears exactly which stage passed');
+});
+
+// ── invariant 4: every other shape is a real sitting ─────────────────────────
+
+test('under consent the founder\'s yes does not end it — the sitting waits for full turnout', async () => {
+  const members = [member(FOUNDER, 'founder'), member(AVERY, 'avery')];
+  const votes = [vote(FOUNDER)];
+  await withDb({
+    getBoardItemForVote: async () => stageItem({ constitution: CONSENT }),
+    getActiveBuildersWithRank: async () => members,
+    getVotesForItem: async () => votes,
+    getBoardItemAuthor: async (item) => item.opened_by,
+    closeBoardItem: async ({ outcome }) => ({ ...stageItem({ constitution: CONSENT }), closed_at: 'T', outcome }),
+    insertAuthorRatifyKarma: async () => true,
+  }, async () => {
+    assert.equal((await maybeCloseAfterVote('90')).reason, 'window_still_open');
+    votes.push(vote(AVERY));
+    const out = await maybeCloseAfterVote('90');
+    assert.equal(out.outcome, 'passed', 'every member has spoken, nobody objected');
+  });
+});
+
+test('under majority, silence is not assent: one yes of three returns the stage at expiry', async () => {
+  const members = [member(FOUNDER, 'f'), member(AVERY, 'a'), member(JORDAN, 'j')];
+  const passed = await capturing('board.genesis_stage.passed', () => withDb({
+    getVotesForItem: async () => [vote(FOUNDER)],
+    getActiveBuildersWithRank: async () => members,
+    getBoardItemAuthor: async (item) => item.opened_by,
+    closeBoardItem: async ({ outcome }) => ({ ...stageItem({ constitution: MAJORITY }), closed_at: 'T', outcome }),
+  }, async () => {
+    const out = await closeItem(stageItem({ constitution: MAJORITY }), { cause: 'expiry' });
+    assert.equal(out.outcome, 'returned');
+  }));
+  assert.equal(passed.length, 0, 'a returned stage announces no pass');
+});
+
+// ── invariant 6: who is this stage waiting on ────────────────────────────────
+
+test('the stage status names who each open sitting is waiting on, from the item\'s own snapshot', async () => {
+  const items = [
+    { ...stageItem({ id: '80', subject_id: '1' }), closed_at: 'T1', outcome: 'passed' },
+    stageItem({ id: '90', subject_id: '3', constitution: CONSENT, closes_at: 'T9', remaining_seconds: 600 }),
+  ];
+  let resolvedFor = null;
+  await withDb({
+    listLatestGenesisStageItems: async () => items,
+    getVotesForItems: async () => [{ item_id: '90', voter_id: AVERY, direction: 'yes', github_login: 'avery', display_name: 'Avery' }],
+    getActiveBuildersWithRank: async (keys) => { resolvedFor = keys; return [member(FOUNDER, 'founder'), member(AVERY, 'avery')]; },
+  }, async () => {
+    const status = await genesisStageStatus();
+    assert.deepEqual(status.stages.map((s) => [s.key, s.state]), [
+      ['scope', 'passed'], ['strategize', 'not_put'], ['charter', 'sitting'], ['legalize', 'not_put'], ['legislation', 'not_put'],
+    ]);
+    const charter = status.stages[2];
+    assert.equal(charter.item_id, '90');
+    assert.equal(charter.pass_rule, 'consent');
+    assert.equal(charter.remaining_seconds, 600, 'the database\'s own countdown, never client clock math');
+    assert.deepEqual(charter.waiting_on.map((m) => m.builder_id), [FOUNDER]);
+    assert.deepEqual(charter.voted.map((m) => [m.builder_id, m.direction]), [[AVERY, 'yes']]);
+    assert.equal(typeof charter.needs, 'string');
+    assert.ok(charter.needs.length > 0, 'the rule is said in words');
+    assert.equal(status.stages[0].waiting_on.length, 0, 'a closed stage waits on nobody');
+  });
+  assert.ok(resolvedFor.includes('archon') && resolvedFor.includes('metic'),
+    'membership is resolved under the SNAPSHOT (rank:metic+), not the live config');
+});
+
+test('under monarchy the band says one vote decides, and names every member who could give it', async () => {
+  await withDb({
+    listLatestGenesisStageItems: async () => [stageItem()],
+    getVotesForItems: async () => [],
+    getActiveBuildersWithRank: async () => [member(FOUNDER, 'founder')],
+  }, async () => {
+    const charter = (await genesisStageStatus()).stages[2];
+    assert.equal(charter.one_vote_decides, true);
+    assert.deepEqual(charter.waiting_on.map((m) => m.builder_id), [FOUNDER]);
+  });
+});
+
+test('every pass rule the constitution knows has its words for the band — no more, no fewer', () => {
+  assert.deepEqual(Object.keys(board.PASS_RULE_WORDS).sort(), [...config.PASS_RULES].sort());
+});
+
+test('the latest-sitting read has its own partial index, keyed to its ORDER BY', () => {
+  const sql = fs.readFileSync(path.join(GOV, 'migrations', 'government_020_genesis_stage_subject.sql'), 'utf8');
+  assert.match(sql, /ON government_board_items \(subject_id, opened_at DESC, id DESC\)\s+WHERE subject_type = 'genesis_stage'/);
+  const src = fs.readFileSync(path.join(GOV, 'db.js'), 'utf8');
+  const block = src.slice(src.indexOf('async function listLatestGenesisStageItems'), src.indexOf('// Author-ratification karma'));
+  assert.match(block, /WHERE subject_type = 'genesis_stage'\s+ORDER BY subject_id, opened_at DESC, id DESC/,
+    'the query filters and orders exactly as the index is built');
+});
+
+test('the founder is summoned for their own stage — the author hold-back is not applied to it', () => {
+  const src = fs.readFileSync(path.join(GOV, 'db.js'), 'utf8');
+  const block = src.slice(src.indexOf('async function openBoardItemsAwaitingVoter'), src.indexOf('async function getTaskStatuses'));
+  assert.match(block, /WHEN i\.subject_type = 'genesis_stage' THEN NULL/,
+    'the summons SQL yields no author for a stage, so pendingVotesFor never skips the founder');
+});
+
+// ── the surfaces that carry it ───────────────────────────────────────────────
+
+test('the Board Room view names the stage instead of mistaking it for an amendment', async () => {
+  await withDb({
+    listOpenBoardItems: async () => [stageItem()],
+    listClosedBoardItems: async () => [],
+    getVotesForItems: async () => [],
+    getIdeaSubjects: async () => [],
+    getAmendmentSubjects: async () => [],
+  }, async () => {
+    const view = await board.boardRoomView();
+    assert.deepEqual(view.open[0].subject, { stage_key: 'charter', stage_number: 3, label: 'Charter', author_id: FOUNDER });
+  });
+  const room = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'board-room.js'), 'utf8');
+  assert.match(room, /subject_type === 'genesis_stage'/, 'the hall card has its own line for a stage');
+  const discord = require(path.join(ROOT, 'modules', 'discord', 'board-broadcast.js'));
+  if (typeof discord.subjectLabel === 'function') {
+    assert.match(discord.subjectLabel('genesis_stage'), /genesis stage/i);
+  } else {
+    const src = fs.readFileSync(path.join(ROOT, 'modules', 'discord', 'board-broadcast.js'), 'utf8');
+    assert.match(src, /genesis_stage/, 'the announcer does not call a stage "A Full Idea"');
+  }
+});
+
+test('the port carries the open and the status; the status route is pinned on the vote atom', () => {
+  const routes = fs.readFileSync(path.join(GOV, 'routes', 'government.js'), 'utf8');
+  assert.match(routes, /openGenesisStageClose: board\.openGenesisStageClose/);
+  assert.match(routes, /genesisStageStatus: board\.genesisStageStatus/);
+  assert.match(routes, /router\.get\('\/government\/board\/genesis-stages', api\.requireBuilder, api\.requirePermission\('board\.vote\.cast'\)/);
+  const pins = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'), 'utf8');
+  assert.match(pins, /'GET \/government\/board\/genesis-stages': 'perm:board\.vote\.cast'/);
+});

package/tests/government_seed.mjs

@@ -43,6 +43,7 @@ const NON_GRANT_MIGRATIONS = new Set([
   'government_008_closed_items_index.sql',         // R16 closed-history index (task 1003029)
   'government_017_board_section_keys_v2.sql',      // BV2.R06 board section_key CHECK widening (task 1004085)
   'government_018_passed_items_index.sql',         // BV2.R17 passed-item lookup index (task 1004096)
+  'government_020_genesis_stage_subject.sql',      // BV2.PS04 genesis_stage board subject CHECK (task 1004429)
 ]);
 
 // Permission keys RENAMED after the grant migrations that first granted them.

package/tests/project_catalog_routes.mjs

@@ -52,6 +52,8 @@ let healed = [];
 provisioning.getInstanceById = async (_db, id) => (instance ? { ...instance, id } : null);
 provisioning.getInstanceBySlug = async (_db, slug) => (instance && instance.slug === slug ? { ...instance } : null);
 provisioning.getInstanceByDomain = async () => null;
+provisioning.listInstancesForOwner = async () => [];   // the shape gate's count (task 1004412): no other hosted project
+require('../modules/provisioning/free-place-lock.js').holdFreePlace = async () => async () => {};   // and its lock: always free here
 provisioning.createInstance = async (_db, req) => {
   instance = { ...BASE_ROW, slug: req.slug, domain: req.domain || null, description: req.description || null };
   return { instance: { ...instance }, created: true };

package/tests/projects_hub_pre_uat.mjs

@@ -508,7 +508,7 @@ test('an unmapped create failure gets a plain sentence with the raw text folded
   const friendly = fn('friendlyCreateError');
   assert.match(friendly, /return '';\n\s*\}/, 'unmapped codes return nothing — the caller folds them');
   assert.doesNotMatch(friendly, /Couldn’t file the request: ' \+/, 'the raw message is no longer the headline');
-  for (const code of ['slug_taken', 'bad_slug', 'domain_reserved', 'domain_taken', 'bad_domain', 'repo_scope_required', 'request_failed']) {
+  for (const code of ['slug_taken', 'bad_slug', 'domain_reserved', 'domain_taken', 'bad_domain', 'repo_scope_required', 'request_failed', 'permission_forbidden', 'box_full']) {
     assert.match(friendly, new RegExp(`code === '${code}'`), `${code} stays headline-only`);
   }
   assert.match(friendly, /belongs to the platform’s own domain/, 'domain_reserved covers both server branches');

package/tests/provisioning_capacity_gate.mjs

@@ -48,6 +48,8 @@ capacity.fleetCapacity = async () => {
 const provisioning = require('../modules/provisioning/provisioning.js');
 let existing = null, lastCreateArgs = null;
 provisioning.getInstanceBySlug = async () => existing;
+provisioning.listInstancesForOwner = async () => [];   // the shape gate's count (task 1004412): no other hosted project
+require('../modules/provisioning/free-place-lock.js').holdFreePlace = async () => async () => {};   // and its lock: always free here
 provisioning.createInstance = async (_db, args) => {
   lastCreateArgs = args;
   if (existing) return { instance: existing, created: false };

package/tests/provisioning_domain_attach.mjs

@@ -118,6 +118,8 @@ provisioning.enqueueIntent = async (_db, id, action, requestedBy) => {
 provisioning.getOpenIntent = async () => null;
 provisioning.createInstance = async () => createResult;
 provisioning.getInstanceBySlug = async () => null;   // the task-1002704 birth-time pre-check
+provisioning.listInstancesForOwner = async () => [];   // the shape gate's count (task 1004412): no other hosted project
+require('../modules/provisioning/free-place-lock.js').holdFreePlace = async () => async () => {};   // and its lock: always free here
 provisioning.recordEvent = async () => {};
 provisioning.createOAuthManifest = async (_db, row) => { manifestRows.push(row); return { id: 1, ...row }; };
 provisioning.getLatestOAuthManifestForInstance = async () => null;

package/tests/provisioning_paid_shape_gate.mjs

@@ -37,6 +37,13 @@
 // So the set below is now the set that needs NO authority, and a shape added later is gated
 // by omission instead of admitted by it.
 //
+// NARROWED FOR ONE PROJECT BY TASK 1004412 (ADR 0354). Gating cloud-host outright also
+// refused every new user at the create wizard's last button, because the wizard only ever
+// asks for cloud-host, and ADR 0345 made that shape the free front door. The owner's ruling:
+// a builder's FIRST live hosted project needs no permission, and a further one needs
+// provisioning.fleet.manage. The route-level proof with a real Xenos is
+// tests/provisioning_wizard_create_xenos.mjs; the cases below hold the gate's side.
+//
 // DB-free: the pool is never reached (createInstance is stubbed), auth is faked. No network
 // beyond a loopback listener.
 //
@@ -65,6 +72,13 @@ provisioning.createInstance = async (_db, args) => {
 provisioning.enqueueIntent = async () => ({ intent: { id: 1, state: 'pending' }, created: true });
 provisioning.recordEvent = async () => {};
 provisioning.getInstanceBySlug = async () => null;
+// The caller's own projects, which the one-free count reads (task 1004412). Flipped per case.
+let owned = [];
+provisioning.listInstancesForOwner = async () => owned;
+// …and the free-place lock beside it (free-place-lock.js), always free here: the race is
+// proved in tests/provisioning_wizard_create_xenos.mjs.
+require('../modules/provisioning/free-place-lock.js').holdFreePlace = async () => async () => {};
+const LIVE_HOSTED = { id: 9, owner_builder_id: 7, slug: 'older', hosting_shape: 'cloud-host', status: 'active' };
 
 const api = require('../src/module-api.js');
 api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
@@ -189,28 +203,42 @@ await ta('the refusal speaks WIRE vocabulary — no owner-facing label is transl
     'a refusal that names no alternative is a dead end — the stored values are the alternative');
 });
 
-// ── cloud-host runs the caller's OWN code on the platform's box (task 1003370) ────
+// ── cloud-host runs the caller's OWN code on the platform's box ───────────────────
+// Task 1003370 gated it outright; task 1004412 lets each builder host ONE project free.
 
-await ta('cloud-host: REFUSED for a builder without provisioning.fleet.manage', async () => {
-  // Task 1003682 left this shape open, reasoning that a $0 shape hands the caller
-  // nothing. That is true of the invoice and false of the trust: the systemd unit's
-  // WorkingDirectory is the caller's own checkout and the module loader discovers
-  // `modules/` from process.cwd(), so a cloud-host request is "please require() this
-  // repo on your control plane". The uid split (task 1003369) bounds the blast radius;
-  // it does not make the default acceptable.
+await ta('cloud-host: a builder\'s FIRST live hosted project needs no permission (task 1004412)', async () => {
+  // The wizard's front door (ADR 0345). The trust question task 1003370 raised is still
+  // true — the unit's WorkingDirectory is the caller's own checkout, so the platform
+  // require()s their repo, bounded by the per-instance uid (task 1003369) — and the owner
+  // accepted it for one project per builder (ADR 0354).
   held = [];
+  owned = [];
   lastCreateArgs = null;
   const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'cloud-host', no_address: true });
+  assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
+  assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'cloud-host');
+});
+
+await ta('cloud-host: a SECOND live hosted project is REFUSED without provisioning.fleet.manage', async () => {
+  // The limit is what stops one person taking every place on the shared box (ADR 0285).
+  // The refusal is the kernel permission gate's own, naming the atom.
+  held = [];
+  owned = [LIVE_HOSTED];
+  lastCreateArgs = null;
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'cloud-host', no_address: true });
+  owned = [];
   assert.equal(res.status, 403, `expected 403, got ${res.status} ${res.raw}`);
   assert.equal(res.body.error.code, 'permission_forbidden');
   assert.deepEqual(res.body.error.details.required, ['provisioning.fleet.manage']);
   assert.equal(lastCreateArgs, null, 'no row is created when the shape is refused');
 });
 
-await ta('cloud-host: ADMITTED for a builder holding provisioning.fleet.manage', async () => {
+await ta('cloud-host: ADMITTED past the limit for a builder holding provisioning.fleet.manage', async () => {
   held = ['provisioning.fleet.manage'];
+  owned = [LIVE_HOSTED, { ...LIVE_HOSTED, slug: 'oldest' }];
   lastCreateArgs = null;
   const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'cloud-host', no_address: true });
+  owned = [];
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
   assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'cloud-host');
 });
@@ -271,8 +299,11 @@ await ta('the gate refuses BEFORE the row exists — a denied create leaves noth
   // The denial must land ahead of createInstance, not after it: a refused-but-inserted row
   // would still be drained by the runner, which reads the column, not the HTTP status.
   held = [];
+  owned = [LIVE_HOSTED]; // a second hosted project, so the shape is refused
   lastCreateArgs = null;
-  await post('/provisioning/instances', { slug: 'spendy', hosting_shape: 'cloud-host', no_address: true });
+  const res = await post('/provisioning/instances', { slug: 'spendy', hosting_shape: 'cloud-host', no_address: true });
+  owned = [];
+  assert.equal(res.status, 403, `expected 403, got ${res.status} ${res.raw}`);
   assert.equal(lastCreateArgs, null);
 });
 
@@ -301,7 +332,8 @@ await ta('HOSTING_SHAPES is pinned, so a new shape forces a written decision abo
   // POST for a second control plane until task 1003370.
   //
   // So the question this list now forces is the one that generalises. The gate is an
-  // allow-list: `byo-host` needs nothing, `control-plane` and `co-tenant` are refused
+  // allow-list: `byo-host` needs nothing, `cloud-host` needs nothing for a builder's first
+  // live project (task 1004412), `control-plane` and `co-tenant` are refused
   // outright (for different reasons — never-yours vs retired), and
   // EVERY other shape — including one added after this file was last read — demands
   // provisioning.fleet.manage by omission. A fifth shape therefore arrives already

package/tests/provisioning_teardown_intent.mjs

@@ -187,6 +187,8 @@ provisioning.enqueueIntent = async (_db, id, action, requestedBy) => {
 provisioning.getOpenIntent = async () => null;
 provisioning.createInstance = async () => createResult;
 provisioning.getInstanceBySlug = async () => null;   // the task-1002704 birth-time pre-check
+provisioning.listInstancesForOwner = async () => [];   // the shape gate's count (task 1004412): no other hosted project
+require('../modules/provisioning/free-place-lock.js').holdFreePlace = async () => async () => {};   // and its lock: always free here
 provisioning.recordEvent = async () => {};
 
 const api = require('../src/module-api.js');