@bongos/core 1.21.125 → 1.21.127

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.125",
-  "core_contract": "1.21.125",
-  "source_commit": "6537f85e10dcb60107037c138237fe4e5d855500",
+  "core_version": "1.21.127",
+  "core_contract": "1.21.127",
+  "source_commit": "ea6cb74e9eba8805eb016b8ac0420841e429c290",
   "source_ref": "HEAD",
-  "built_at": "2026-10-15T15:06:45.205Z",
+  "built_at": "2026-10-15T15:58:58.689Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 605,
+    "docs_redacted": 606,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3128,
+    "functional_verbatim": 3138,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3762,
-  "tree_sha256": "7fb72ed794b2cdaa7f0fe66ffdccb7b56f5c18a9d4d66f18b4767254072e1827",
+  "file_count": 3773,
+  "tree_sha256": "2af5f5b320f78e843791c36c370aa8f198a28c9bd3b085c1875f39869558c2cd",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1887,7 +1887,7 @@
     {
       "path": "docs/adr/0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md",
       "mode": "0000644",
-      "sha256": "6043bb19c2b18074c132750b0480b03f627733536c3263ab79c049f40f314e57"
+      "sha256": "957ee2f99f8b8ac8a22723c7af73798540499a0ea859f010decb87b09cf0a02f"
     },
     {
       "path": "docs/adr/0286-a-gated-project-s-manifest-tells-a-stranger-how-to-sign-in-and-nothing-else.md",
@@ -2232,7 +2232,7 @@
     {
       "path": "docs/adr/0354-a-builder-hosts-one-project-free-and-more-takes-the-fleet-permission.md",
       "mode": "0000644",
-      "sha256": "962d868c0887244c53b53c58754f7232715a20df6feec694f30cbda707f9e17e"
+      "sha256": "47b6fbbe4da97fd83f1b7e9914f102bbd5924d88b02dca6d87a4e2cf44af8664"
     },
     {
       "path": "docs/adr/0355-a-soft-limit-is-a-rule-with-a-reason-and-nobody-enforces-it.md",
@@ -2382,7 +2382,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "b8d8cae75596996b38203b5b73b8fc4f5cfc4afa8fa6a170541131fdfed924ea"
+      "sha256": "cd89b6776167172503ef68a77b1cfa68a00bf886d8f586c456f67e3cfef84fba"
     },
     {
       "path": "docs/architecture.md",
@@ -2407,12 +2407,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "2f6c0fff979e7a52a1dff20184291da110751084197f9619497bc5a8668c2c0f"
+      "sha256": "24ace5710d2fd5823ec9f1c030570e53b48ccdff5b356b193e5d055fe9209d9f"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "2fa52a4d4411a29e5aadeb0a03898a32144834527c7e84804f4c9df5f584cab6"
+      "sha256": "d1bf2d46cc50c80729a6b705eef2313753ea48b56eed76bb365b8bda635ca68f"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2922,7 +2922,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "a1ec4ace0bc91b34031c59bb4fd08263af542f5ddd1284204bfd821cf843b527"
+      "sha256": "de498901b8143d15779aafd30051f97e04ae01f32c880902da3a8234a6e262e7"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3007,12 +3007,12 @@
     {
       "path": "docs/page-inventory.json",
       "mode": "0000644",
-      "sha256": "b9608b2d132b5fff25d2d7baac59e2d25b565414a63fba1372a436e328d302cd"
+      "sha256": "688c15d7b79c60a561be7fca61931627898d1544d52dd912a79ff3fa6c160876"
     },
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "d59a98a2c166e276275156dfb13887c9147f1596ca65fb777c97e988dd23bf25"
+      "sha256": "2ade456b9e5e4e51e4c4e541f3336360d694022bd43b6ea5da77ae63367bd809"
     },
     {
       "path": "docs/project-context.template.md",
@@ -5917,12 +5917,12 @@
     {
       "path": "modules/hall-ui/public/goal-forest-lib.js",
       "mode": "0000644",
-      "sha256": "f4eef6f9ec782aa76369b98cbbd95152ab0e11858a4bb9d2c2f9839a1d71a08c"
+      "sha256": "84ea32523a9bc1fdd34e00cd28f75b52189d18bd72491739dafd2b08b40be39e"
     },
     {
       "path": "modules/hall-ui/public/goal-forest-render.js",
       "mode": "0000644",
-      "sha256": "9edf4cf99fe2726e75b4ac21b6f41a5e51ecc1b933659ac0f9c7d98c3de217b1"
+      "sha256": "19df08dd72ce42827c825c6ee32233a6bb51f534e060c33d42552aff6e39a8ba"
     },
     {
       "path": "modules/hall-ui/public/goal-inbox.js",
@@ -5947,22 +5947,22 @@
     {
       "path": "modules/hall-ui/public/goals-page.js",
       "mode": "0000644",
-      "sha256": "9f5944388fa573d7c483a6a690d0de53527a407facc13a9a00b01b06c5772047"
+      "sha256": "3836cafa9edc429cdcd847f48f324f7f3aa412ca42b847ed1622126525e67c9a"
     },
     {
       "path": "modules/hall-ui/public/goals-render.js",
       "mode": "0000644",
-      "sha256": "82bbcc5d2b7c098dbf228b30cdccadca6fbb7d3b3a73189f6298b0697c56f110"
+      "sha256": "d7cbd599a69f43851bf6af8be33166cc4ddc949d22f28f36bf2282def0cfc6ba"
     },
     {
       "path": "modules/hall-ui/public/goals.css",
       "mode": "0000644",
-      "sha256": "d5257a3e4f755d17300490eeb8dce9bd91d9c1b8faa31f6a4d6f6d3a79e232a9"
+      "sha256": "6042df284acac7f5af12688651aad7e8d0cf38829a9395a1e28e0e0ded7b8bf3"
     },
     {
       "path": "modules/hall-ui/public/goals.html",
       "mode": "0000644",
-      "sha256": "2f9fe0010658b8aac1a3942bd1e8804c60f99438d789ff52b4fb1d18a2b1fd1d"
+      "sha256": "11b681a246ba5a6a662e6fb0b0eae795460bd1f8cdf251f8cd0e2e52c4869756"
     },
     {
       "path": "modules/hall-ui/public/goals.js",
@@ -5972,7 +5972,7 @@
     {
       "path": "modules/hall-ui/public/goals.states.json",
       "mode": "0000644",
-      "sha256": "36c7b1b130b6255a35494600ecb3e2136a16eab26407b6f14cdd572a794484ab"
+      "sha256": "8b458aa1afaaf9e122217d912bcf15390550cf75953414a94c6bd912c98574e5"
     },
     {
       "path": "modules/hall-ui/public/gov-feeds.js",
@@ -6757,7 +6757,7 @@
     {
       "path": "modules/hall-ui/records/goal-dependency-forest.md",
       "mode": "0000644",
-      "sha256": "dde9b115c2db984ddd86c7dbf3e9e8164f5ae9d3bf09638702bd5206f68f2d04"
+      "sha256": "32d57c27724e1c6e263762a7b150a1db4fbe849f7e3ac3e05ee3af4edb0493d5"
     },
     {
       "path": "modules/hall-ui/records/governor-street.md",
@@ -8137,7 +8137,7 @@
     {
       "path": "modules/platform-identity/invite-authz.js",
       "mode": "0000644",
-      "sha256": "2eb5577450d3bc1d67b7eab9a13256889aca945c6ac6a6a0ca919e195952b7a1"
+      "sha256": "dd54f1456e383de90c7440dbddeb3919718588bd4fb43621f1d192ae16061db5"
     },
     {
       "path": "modules/platform-identity/invite-notices.js",
@@ -8487,7 +8487,7 @@
     {
       "path": "modules/provisioning/catalog-bridge.js",
       "mode": "0000644",
-      "sha256": "6978ddde30cb0b378a2decbe18c2824817d8d57a941a8de6230483453e99acd7"
+      "sha256": "ddc1228706e8f8342bbbd7705acae6a99f1e65e700e72c701c8afe62cd67d732"
     },
     {
       "path": "modules/provisioning/control-plane-guard.js",
@@ -8792,7 +8792,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "c99cfa7d071ece3f6d821709a8610baa25bb0323f7219016ac53d7e8ebb5e197"
+      "sha256": "29ce4dc7dacfa6b9bdddf35ab80fd4b226c96ebcf9a4235297619defe0174119"
     },
     {
       "path": "modules/provisioning/public-refusal.js",
@@ -8824,6 +8824,11 @@
       "mode": "0000644",
       "sha256": "aa3e794ed904157f8549d6ab8ce28ae4a9fa3c2235758b59fc4bd3a66a3b7049"
     },
+    {
+      "path": "modules/provisioning/route-helpers.js",
+      "mode": "0000644",
+      "sha256": "8a4b7f5d8696a1f3e8c80f01e51663a98f14c6115fb76610b66d65e98e68545d"
+    },
     {
       "path": "modules/provisioning/routes/body-validators.js",
       "mode": "0000644",
@@ -8847,12 +8852,12 @@
     {
       "path": "modules/provisioning/routes/disconnect.js",
       "mode": "0000644",
-      "sha256": "e817af6b207a45a61fe8b80e00328537bfeb629d0164a6125af1f8e459bc700f"
+      "sha256": "eae0b840da488f3a9a9a1c0a4eb1de5a0f4fb72ec7120041af9101957e5661c0"
     },
     {
       "path": "modules/provisioning/routes/env-manifest.js",
       "mode": "0000644",
-      "sha256": "dbc156fa4cb2c74132a8034c481ec676f818f4f19139cb10d7d5d669e2e4bbd9"
+      "sha256": "53778501a1265d9e43d49281052e6dbc52730a8fb06fb644ff7c20745d086a6e"
     },
     {
       "path": "modules/provisioning/routes/github-setup.js",
@@ -8867,7 +8872,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "336ac83ef1fcdc91416bd6ca4d0cd040a2b926e0b695a9fbd528a5ab262a4974"
+      "sha256": "55e3e478e7a1978e1e12c5d5fc551fa9b58d51e6d0e920a4d71ef02618e7b78f"
     },
     {
       "path": "modules/provisioning/routes/render-standup.js",
@@ -10477,12 +10482,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "cb1fe1a974c6063f91ae16893f1daddb028647374dc13d9df725ea4be5074d9a"
+      "sha256": "efe64aff087c9fac228bb0502df35fdb706ea66215ba9a7b20a16575b4568a6d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e92ae06c5b33aa14e3ec516f009526f335ebec59b5e03b4e774a4a48c252d087"
+      "sha256": "65dbc0fd1642caa7dd0907f8ca5f8d6e3808087637f31aaff0b5b3b2e22da1da"
     },
     {
       "path": "public-docs/index.html",
@@ -10502,7 +10507,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "415b376c73ce06c6803897093c02aa9157378d55487a0f84dd8387dc749a75a0"
+      "sha256": "b3c808cc70f6d027e4dc58fad374f2dff423b73416eee5c5a96e8779ddd2d04f"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11017,7 +11022,7 @@
     {
       "path": "scripts/gds/exec-path-guard.js",
       "mode": "0000644",
-      "sha256": "cda9e125cfb2cb354c7d4e20065c36712a75955d3981203012c2334d0ce637ae"
+      "sha256": "5b5f2b8b40d62dab10a0ea9b43768944dcbe60a8af550b35229ce278deaceffc"
     },
     {
       "path": "scripts/gds/feedback-send.js",
@@ -11092,7 +11097,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "88a99a1a1455477dd9f7987c0f6c48f20464cc4ab98cc2f224c1a5536483fd2d"
+      "sha256": "e2f483de1afd806d77fc5b62d6f1b08d762ea4fec9eaddb91d2ef1f25f00112e"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -11392,17 +11397,37 @@
     {
       "path": "scripts/gds/module-assess-tests.js",
       "mode": "0000644",
-      "sha256": "83dc9529be926f8e10043ab78d644d1a72096d02000623035798bd420b2b3261"
+      "sha256": "802ee523248df153dace07e364b29516f6c6dcfcf8eaa301aa97bb723c135983"
     },
     {
       "path": "scripts/gds/module-assess-version.js",
       "mode": "0000644",
-      "sha256": "d240e15768b1cd5869c52ef2c93656cdcdd870554893dd58031b12c78f212e36"
+      "sha256": "b21c85714a8b93e43857c26237eec9dca9830abb53f44146957525f262fb8e7b"
+    },
+    {
+      "path": "scripts/gds/module-error-report.js",
+      "mode": "0000644",
+      "sha256": "dc8e6794d0c09479891136c8b0ab4da7ce73c1797522e03b9457db113b2534e2"
+    },
+    {
+      "path": "scripts/gds/module-test-runner.js",
+      "mode": "0000644",
+      "sha256": "00c844922f5b465485847e45782c71c3103fe9d6aa0e09d4908121769aecbe78"
+    },
+    {
+      "path": "scripts/gds/module-test-runner/README.md",
+      "mode": "0000644",
+      "sha256": "e6253ef4056f35355d5c19af247de840b0f925f7a2b8ead8f2598227be9e6d38"
+    },
+    {
+      "path": "scripts/gds/module-test-runner/module-tests.yml",
+      "mode": "0000644",
+      "sha256": "d721ad7959afb899877aafd31c6a22287d6e479e0fb4fb4f600d12ce5e12a2fd"
     },
     {
       "path": "scripts/gds/module.js",
       "mode": "0000644",
-      "sha256": "b02d07e9e7e1d2e2852676383e054f13d8e423755534fe23ed3e10cbfefb4086"
+      "sha256": "9391cc7d6881150cd5d196aa5e63245db032093063ce90e1e1ae5c26dafcb49c"
     },
     {
       "path": "scripts/gds/move-escalation.js",
@@ -11529,6 +11554,11 @@
       "mode": "0000644",
       "sha256": "2102af404ac985f0d7b037da973600234b2ef8f90b6c689ca164b9ac1f46262f"
     },
+    {
+      "path": "scripts/gds/provision-caps.js",
+      "mode": "0000644",
+      "sha256": "0dee61336a309cf3eda2cb715bb53680773c17d65186864384e3cb0bc9dadaba"
+    },
     {
       "path": "scripts/gds/provision-config.js",
       "mode": "0000644",
@@ -11567,7 +11597,7 @@
     {
       "path": "scripts/gds/provision-process.js",
       "mode": "0000644",
-      "sha256": "6a784f63078e5cb2c0f85475672b02b18ded67a36a8041b1ba3643b227a465d0"
+      "sha256": "4689867d4925672e3e12c56620ef2e4e6ad2474dfaaa309571da9533af49b997"
     },
     {
       "path": "scripts/gds/provision-render.js",
@@ -11597,12 +11627,12 @@
     {
       "path": "scripts/gds/provision-units.js",
       "mode": "0000644",
-      "sha256": "eb6cf09ce1eb97330b20fe97c61068e2b7cc8bb4556a54df39e3a3978fe6ffa2"
+      "sha256": "02173656cffc347b23b68fa5036826d16bfedbb0e490161b8e5853b5cbb9b8a9"
     },
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "ea11cc49dbc298c8b3ed4ad88e25a3acfbba65fcd65727c9b47c43ee41e24437"
+      "sha256": "bf16a2ef196d64088c7755e3d6ccbdd8f7917eb907efdbb8ec132e7df9694a52"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -12827,17 +12857,22 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "81694f072dbbb4e64a286a4f5157d07a8e1105ae8a94d800f09eba00f30848e6"
+      "sha256": "8ff71d0200dd2b11afa13be91155669caee7ba000a537df94e37426a6485e7f1"
     },
     {
       "path": "src/module-loader/catalog.js",
       "mode": "0000644",
       "sha256": "633042ab3228780fd18f96ce6a2dd0d84452a124948720678d4484c29df0acd8"
     },
+    {
+      "path": "src/module-loader/error-tally.js",
+      "mode": "0000644",
+      "sha256": "00f37bb206c47a75c5ee1420831781a38eb88b9446a9ce1cc3e8ee5a47e09334"
+    },
     {
       "path": "src/module-loader/loader.js",
       "mode": "0000644",
-      "sha256": "04458c645d876011324e5ae11011774699c06e39ff2fa1ba1cf58a2d2775f887"
+      "sha256": "4520d7cb0a91dd3f6cb52c52ced8caf2039126fa7c942e3f0714e91600cebb80"
     },
     {
       "path": "src/module-loader/manifest-schema.js",
@@ -12872,7 +12907,7 @@
     {
       "path": "src/platform-server.js",
       "mode": "0000644",
-      "sha256": "773372a16a32d3936aa53d0ca5ec0e19833e45cadcc16688102b5e81c117e5bf"
+      "sha256": "435a89e5f5becab510ee5ad3f4246f34ee6a6abac859d49823edc74fd1bcdf4f"
     },
     {
       "path": "src/role-responsibilities.js",
@@ -14667,12 +14702,12 @@
     {
       "path": "tests/goal_forest_lib.mjs",
       "mode": "0000644",
-      "sha256": "3b309358c195469bee0ab1ce95242914fbc0b1b3def0bb7de3d51dc09dd29c6a"
+      "sha256": "a647398539783aed52b9cf7e5026ae6ab1e9f7337c5e7920d57c9cc106fd9581"
     },
     {
       "path": "tests/goal_forest_page.mjs",
       "mode": "0000644",
-      "sha256": "fdad13a1d265a3506229712816e244ebe026f449beabe3f98a5d652b36d01365"
+      "sha256": "143033e1a1d6178a6d7da40be7b649f61c48997327a34d53d0f32d5e0df08e3a"
     },
     {
       "path": "tests/goal_graph.mjs",
@@ -16342,12 +16377,12 @@
     {
       "path": "tests/module_assess_price_parity.mjs",
       "mode": "0000644",
-      "sha256": "78f36a8bbbd948c4485dfd80df55e1ee053af1b510b4d98607c0d2545bcfa66c"
+      "sha256": "b0cbedfe78c04c5e7ec55d1d50e607c8730784d1e820a2ec64ace05689968c2a"
     },
     {
       "path": "tests/module_assess_score.mjs",
       "mode": "0000644",
-      "sha256": "5255bc0c4e721190d588d5d6c812a8814788598929d38d3bbd87480371ee0b05"
+      "sha256": "5e80628e696af499d95e7d59cc8c655902b9d3bdbe63473f68e573c0acaa2dd3"
     },
     {
       "path": "tests/module_assess_security.mjs",
@@ -16389,6 +16424,11 @@
       "mode": "0000644",
       "sha256": "50e4d45bf544efe755dda538a93eafc40dcd9caa071e987d8833d97ecf1b7e0f"
     },
+    {
+      "path": "tests/module_error_counts.mjs",
+      "mode": "0000644",
+      "sha256": "7c5e8009a416c72d5659677c0a23d90408001f33ff6b56b121ed06a2beceb739"
+    },
     {
       "path": "tests/module_exports_unique_keys.mjs",
       "mode": "0000644",
@@ -16474,6 +16514,11 @@
       "mode": "0000644",
       "sha256": "0db12d802203780f489e9a6d7abf970dfcde9099ac7011fcaaa6c575336804cd"
     },
+    {
+      "path": "tests/module_test_runner.mjs",
+      "mode": "0000644",
+      "sha256": "e6fbb32fd8f43c748d89aca5a9025872582d1628e47de12c4ce4bca834c8be88"
+    },
     {
       "path": "tests/module_toggle_restart.mjs",
       "mode": "0000644",
@@ -16957,7 +17002,7 @@
     {
       "path": "tests/project_catalog_routes.mjs",
       "mode": "0000644",
-      "sha256": "e19d61fb2734092104276d1f74f1cbdf691bfe4f920414c543a1c07e839725e6"
+      "sha256": "52bb32c6e47676407b96e447969cd09cecf12d040d5aa0aef71d5f017b4b0a12"
     },
     {
       "path": "tests/project_door_ui.mjs",
@@ -17107,7 +17152,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "2c31c74c71147c5fe96beb8e6a53f8793ea3f42870512a6005f43df7c6fb5382"
+      "sha256": "dc30483813143d76ed6597f4b68d61db3dd2ae9bf34d15b9ce8ddd57caf0f79f"
     },
     {
       "path": "tests/provision_account_identity.mjs",
@@ -17144,6 +17189,11 @@
       "mode": "0000644",
       "sha256": "f99d0a4a54fa9d846efc772148156e06023d3ad4e2afbddce8dd1d9a62821b96"
     },
+    {
+      "path": "tests/provision_resource_caps.mjs",
+      "mode": "0000644",
+      "sha256": "491c29cbeee40a677a01ee71f1f54a787017456b4baa8416219480f337e3c3e3"
+    },
     {
       "path": "tests/provision_restart.mjs",
       "mode": "0000644",
@@ -17237,7 +17287,7 @@
     {
       "path": "tests/provisioning_module_selection.mjs",
       "mode": "0000644",
-      "sha256": "3be5d5409c5ffc223ac0ad9aad885fe63d4c8ffe0b11c3aa409d42bee5286932"
+      "sha256": "6aa80d1dd73c9437429b37d8b8af375383a992d4fc8e68909c8346987f2ebc06"
     },
     {
       "path": "tests/provisioning_onboard_mode.mjs",
@@ -17254,6 +17304,11 @@
       "mode": "0000644",
       "sha256": "2a7769c430da7f81509659eb592c16abe7f95b2b3a3a447dac85fd10f0c780ee"
     },
+    {
+      "path": "tests/provisioning_project_owner_gate.mjs",
+      "mode": "0000644",
+      "sha256": "c632c7fd2b797f40cfda0e62be35f10769c836bc13164ecbc10cb28ab63f8320"
+    },
     {
       "path": "tests/provisioning_public_refusal.mjs",
       "mode": "0000644",

package/docs/adr/0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md

@@ -80,3 +80,9 @@ The measured cost is the same **unit** for `co-tenant` and `standalone`. What se
 - **+** Billing has a unit cost for a shared slot.
 - **−** The page-cache reserve is an allowance, not a measurement. If a ceiling is ever approached, re-measure `MemAvailable` then instead of trusting the 250 MB.
 - **−** These are **idle-fleet** numbers. A project with real traffic or large data will sit above 80 MB, so the ceiling is an upper bound for quiet projects. Re-measure the same way (`Pss` + `SwapPss` per unit, `memory.peak`, `pg_stat_activity`) as projects gain users.
+
+## Amendment — 2026-10-15 (task 1004414): each hosted project is capped
+
+**The owner's numbers**, sized from the measurement above: `MemoryHigh=160M`, `MemoryMax=256M`, `CPUQuota=50%`, `TasksMax=256` on every hosted project's unit. A project idles at 45–70 MB and its boot peak is 118–134 MB with page cache, so `MemoryHigh` sits above the boot peak and makes the kernel reclaim before `MemoryMax` kills. A killed project comes back through `Restart=always`. Half a core is about a thousand times the measured idle use, and 256 tasks is far above what one Node process starts. The caps bound one runaway project; they do not change the ceiling, which still counts ~80 MB per project.
+
+New units render the caps (`serviceUnit`). An existing unit takes them with `systemctl set-property`, live and without a restart, through `node scripts/gds/provision.js apply-caps --apply` on the control plane. The unit file is not rewritten, because a project made before the per-instance accounts (task 1003369) would be moved onto an account that does not exist. The numbers live in `scripts/gds/provision-caps.js`, and `tests/provision_resource_caps.mjs` pins them, so changing one is a decision. A project with real traffic or an adopted repo with heavy dependencies may need more; re-measure as above before raising them.

package/docs/adr/0354-a-builder-hosts-one-project-free-and-more-takes-the-fleet-permission.md

@@ -36,7 +36,7 @@ The count and the insert are two separate steps, so two requests sent together w
 ## Consequences
 
 - New users can create a project from the wizard again. Each project costs us about $0.80 a month (ADR 0285).
-- A stranger's code now runs on the shared box, on the same server as the hub. It runs in its own locked account (task 1003369), and the hub's sign-in cookie no longer reaches project halls (task 1004357). **Nothing caps a hosted project's memory or CPU**, so one misbehaving project can slow every hall and the hub. That was already true of every hosted project; this decision widens who can have one.
+- A stranger's code now runs on the shared box, on the same server as the hub. It runs in its own locked account (task 1003369), and the hub's sign-in cookie no longer reaches project halls (task 1004357). **Nothing caps a hosted project's memory or CPU**, so one misbehaving project can slow every hall and the hub. That was already true of every hosted project; this decision widens who can have one. (Closed by task 1004414: each hosted project is now capped. See the ADR 0285 amendment.)
 - Each first-free request holds one database connection from its count to its insert. Creates are rare, so the pool can carry it.
 
 ## Alternatives considered

package/docs/api/openapi.json

@@ -17838,7 +17838,7 @@
           "provisioning"
         ],
         "summary": "POST /provisioning/instances/:id/domain",
-        "description": "POST /provisioning/instances/:id/domain — give the caller's OWN instance its address (task 1002692, gap 5: no path existed to add a domain after creation). Validates + records the domain; for an already-ACTIVE instance it also enqueues a 'domain-attach' intent the control-plane runner drains (web tier holds no cloud tokens — ADR 0111 §2). A requested/error instance only records it: the (re)provision run wires the domain itself. A bring-your-own address may be RE-POINTED (task 1003237, ADR 0200): the same guards the first attach applies decide it, and the address it moved off is queued for release. Body: { domain (required) }.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "POST /provisioning/instances/:id/domain — give the caller's OWN instance its address (task 1002692, gap 5: no path existed to add a domain after creation). Validates + records the domain; for an already-ACTIVE instance it also enqueues a 'domain-attach' intent the control-plane runner drains (web tier holds no cloud tokens — ADR 0111 §2). A requested/error instance only records it: the (re)provision run wires the domain itself. A bring-your-own address may be RE-POINTED (task 1003237, ADR 0200): the same guards the first attach applies decide it, and the address it moved off is queued for release. Body: { domain (required) }. An archon may set any project's address; the override is audited via the actor.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "parameters": [
@@ -18193,7 +18193,7 @@
           "provisioning"
         ],
         "summary": "POST /provisioning/instances/:id/github-app",
-        "description": "POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 0133). rank: any authenticated builder (own resource). Returns the pre-filled manifest + the GitHub form-POST target (personal + org variants) + a one-time `state`; the browser POSTs the manifest to GitHub, the owner approves, and GitHub redirects back to the public callback below. The web tier only RECORDS the attempt (state token) — the control-plane runner does the token exchange + cred placement (trust boundary intact, ADR 0111 §2). Body: { account? ('personal'|'org'), org? (a GitHub organisation login) }. A personal or an organisation account (task 1004651): account 'org' makes the app on the organisation the founder chose on the page (`org`), else on the repo's owner. The org name is checked against GitHub's login rules here, never trusted from the page; whether the founder may make an app there is GitHub's to enforce on its own page (this module holds no GitHub token to ask with, ADR 0111 §2). Anything other than account 'org' is the founder's personal account, exactly as before.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 0133). rank: any authenticated builder (own resource; archon may mint for any — audited via the actor). Returns the pre-filled manifest + the GitHub form-POST target (personal + org variants) + a one-time `state`; the browser POSTs the manifest to GitHub, the owner approves, and GitHub redirects back to the public callback below. The web tier only RECORDS the attempt (state token) — the control-plane runner does the token exchange + cred placement (trust boundary intact, ADR 0111 §2). Body: { account? ('personal'|'org'), org? (a GitHub organisation login) }. A personal or an organisation account (task 1004651): account 'org' makes the app on the organisation the founder chose on the page (`org`), else on the repo's owner. The org name is checked against GitHub's login rules here, never trusted from the page; whether the founder may make an app there is GitHub's to enforce on its own page (this module holds no GitHub token to ask with, ADR 0111 §2). Anything other than account 'org' is the founder's personal account, exactly as before.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "parameters": [
@@ -18301,7 +18301,7 @@
           "provisioning"
         ],
         "summary": "GET /provisioning/instances/:id/invite-suggestions",
-        "description": "── Who is worth inviting (BV1.R28, task 1002347, goal 1000046 C6) ──────── GET /provisioning/instances/:id/invite-suggestions — turn the engine's `invites.seeking` into NAMES. ADR 0239 §6 left `invites.suggested` empty on purpose: ranking builders is a directory read the pure engine may not run. This is the resolution, and ADR 0251 is why it looks like this. rank: any authenticated builder, own resource — `instanceAccessDenied`, the same gate and the same 404 as the manage read above. That is deliberate and not a new authorization idea: REACHING this route IS the ownership answer (ADR 0249 §4), so the surface never re-derives \"is this theirs\" and can never become a weaker second copy of a server rule (ADR 0016). It also 404s rather than 403s, so it leaks no more instance existence than the read beside it. `seeking: null` COSTS NOTHING AND ASKS NOBODY. A solo owner is suggested nobody on purpose (ADR 0239 §6), which is a different statement from an empty list nobody filled — so that answer returns its own reason and never touches the directory at all.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "── Who is worth inviting (BV1.R28, task 1002347, goal 1000046 C6) ──────── GET /provisioning/instances/:id/invite-suggestions — turn the engine's `invites.seeking` into NAMES. ADR 0239 §6 left `invites.suggested` empty on purpose: ranking builders is a directory read the pure engine may not run. This is the resolution, and ADR 0251 is why it looks like this. rank: any authenticated builder, own resource — `requireProjectOwner`, the same gate and the same 404 as the manage read above. That is deliberate and not a new authorization idea: REACHING this route IS the ownership answer (ADR 0249 §4), so the surface never re-derives \"is this theirs\" and can never become a weaker second copy of a server rule (ADR 0016). It also 404s rather than 403s, so it leaks no more instance existence than the read beside it. `seeking: null` COSTS NOTHING AND ASKS NOBODY. A solo owner is suggested nobody on purpose (ADR 0239 §6), which is a different statement from an empty list nobody filled — so that answer returns its own reason and never touches the directory at all.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "parameters": [
@@ -18913,7 +18913,7 @@
           "provisioning"
         ],
         "summary": "POST /provisioning/instances/:id/teardown",
-        "description": "POST /provisioning/instances/:id/teardown — request teardown of the caller's OWN instance. rank: any authenticated builder (own resource). Enqueues a 'teardown' intent; the runner executes it (web tier holds no tokens). 404 when the id isn't the caller's; 409 when the instance isn't in a teardownable state.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "POST /provisioning/instances/:id/teardown — request teardown of the caller's OWN instance. rank: any authenticated builder (own resource; archon may tear down any — the override is audited via the actor). Enqueues a 'teardown' intent; the runner executes it (web tier holds no tokens). 404 when the id isn't the caller's; 409 when the instance isn't in a teardownable state.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "parameters": [