@bongos/core 1.21.126 → 1.21.127

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.126",
-  "core_contract": "1.21.126",
-  "source_commit": "94a48727259da5ad6269d8e1982648c5a263116b",
+  "core_version": "1.21.127",
+  "core_contract": "1.21.127",
+  "source_commit": "ea6cb74e9eba8805eb016b8ac0420841e429c290",
   "source_ref": "HEAD",
-  "built_at": "2026-10-15T15:32:06.327Z",
+  "built_at": "2026-10-15T15:58:58.689Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 606,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3133,
+    "functional_verbatim": 3138,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3768,
-  "tree_sha256": "aaa23a52f299e82601309b1dc11007fe842e9686674c9c5cc96991f5412286e3",
+  "file_count": 3773,
+  "tree_sha256": "2af5f5b320f78e843791c36c370aa8f198a28c9bd3b085c1875f39869558c2cd",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1887,7 +1887,7 @@
     {
       "path": "docs/adr/0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md",
       "mode": "0000644",
-      "sha256": "6043bb19c2b18074c132750b0480b03f627733536c3263ab79c049f40f314e57"
+      "sha256": "957ee2f99f8b8ac8a22723c7af73798540499a0ea859f010decb87b09cf0a02f"
     },
     {
       "path": "docs/adr/0286-a-gated-project-s-manifest-tells-a-stranger-how-to-sign-in-and-nothing-else.md",
@@ -2232,7 +2232,7 @@
     {
       "path": "docs/adr/0354-a-builder-hosts-one-project-free-and-more-takes-the-fleet-permission.md",
       "mode": "0000644",
-      "sha256": "962d868c0887244c53b53c58754f7232715a20df6feec694f30cbda707f9e17e"
+      "sha256": "47b6fbbe4da97fd83f1b7e9914f102bbd5924d88b02dca6d87a4e2cf44af8664"
     },
     {
       "path": "docs/adr/0355-a-soft-limit-is-a-rule-with-a-reason-and-nobody-enforces-it.md",
@@ -2922,7 +2922,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "8b70cfa6cac3da1e08d0f969f6d2a3f0c43ca0533b28d7e8a58ca12044165c26"
+      "sha256": "de498901b8143d15779aafd30051f97e04ae01f32c880902da3a8234a6e262e7"
     },
     {
       "path": "docs/modules-contract.md",
@@ -10482,12 +10482,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "341426e0e35db5113dd017485f4479dc0674db124643388aeec9d883e113f7e3"
+      "sha256": "efe64aff087c9fac228bb0502df35fdb706ea66215ba9a7b20a16575b4568a6d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f5522e5c98564bbf8ffd3a4817e094732239f369a1850e1b743030a4b03d00b2"
+      "sha256": "65dbc0fd1642caa7dd0907f8ca5f8d6e3808087637f31aaff0b5b3b2e22da1da"
     },
     {
       "path": "public-docs/index.html",
@@ -10507,7 +10507,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "4fbea8b3dd2714eb5ec49751e18f66a0b995e94d64163edfbbf5fa837b196d81"
+      "sha256": "b3c808cc70f6d027e4dc58fad374f2dff423b73416eee5c5a96e8779ddd2d04f"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11022,7 +11022,7 @@
     {
       "path": "scripts/gds/exec-path-guard.js",
       "mode": "0000644",
-      "sha256": "cda9e125cfb2cb354c7d4e20065c36712a75955d3981203012c2334d0ce637ae"
+      "sha256": "5b5f2b8b40d62dab10a0ea9b43768944dcbe60a8af550b35229ce278deaceffc"
     },
     {
       "path": "scripts/gds/feedback-send.js",
@@ -11097,7 +11097,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "88a99a1a1455477dd9f7987c0f6c48f20464cc4ab98cc2f224c1a5536483fd2d"
+      "sha256": "e2f483de1afd806d77fc5b62d6f1b08d762ea4fec9eaddb91d2ef1f25f00112e"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -11404,6 +11404,11 @@
       "mode": "0000644",
       "sha256": "b21c85714a8b93e43857c26237eec9dca9830abb53f44146957525f262fb8e7b"
     },
+    {
+      "path": "scripts/gds/module-error-report.js",
+      "mode": "0000644",
+      "sha256": "dc8e6794d0c09479891136c8b0ab4da7ce73c1797522e03b9457db113b2534e2"
+    },
     {
       "path": "scripts/gds/module-test-runner.js",
       "mode": "0000644",
@@ -11422,7 +11427,7 @@
     {
       "path": "scripts/gds/module.js",
       "mode": "0000644",
-      "sha256": "b02d07e9e7e1d2e2852676383e054f13d8e423755534fe23ed3e10cbfefb4086"
+      "sha256": "9391cc7d6881150cd5d196aa5e63245db032093063ce90e1e1ae5c26dafcb49c"
     },
     {
       "path": "scripts/gds/move-escalation.js",
@@ -11549,6 +11554,11 @@
       "mode": "0000644",
       "sha256": "2102af404ac985f0d7b037da973600234b2ef8f90b6c689ca164b9ac1f46262f"
     },
+    {
+      "path": "scripts/gds/provision-caps.js",
+      "mode": "0000644",
+      "sha256": "0dee61336a309cf3eda2cb715bb53680773c17d65186864384e3cb0bc9dadaba"
+    },
     {
       "path": "scripts/gds/provision-config.js",
       "mode": "0000644",
@@ -11587,7 +11597,7 @@
     {
       "path": "scripts/gds/provision-process.js",
       "mode": "0000644",
-      "sha256": "6a784f63078e5cb2c0f85475672b02b18ded67a36a8041b1ba3643b227a465d0"
+      "sha256": "4689867d4925672e3e12c56620ef2e4e6ad2474dfaaa309571da9533af49b997"
     },
     {
       "path": "scripts/gds/provision-render.js",
@@ -11617,12 +11627,12 @@
     {
       "path": "scripts/gds/provision-units.js",
       "mode": "0000644",
-      "sha256": "eb6cf09ce1eb97330b20fe97c61068e2b7cc8bb4556a54df39e3a3978fe6ffa2"
+      "sha256": "02173656cffc347b23b68fa5036826d16bfedbb0e490161b8e5853b5cbb9b8a9"
     },
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "ea11cc49dbc298c8b3ed4ad88e25a3acfbba65fcd65727c9b47c43ee41e24437"
+      "sha256": "bf16a2ef196d64088c7755e3d6ccbdd8f7917eb907efdbb8ec132e7df9694a52"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -12847,17 +12857,22 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "05cbabab7a15ea12d403cdce32d0e9accfb56fe1dc44c691dc5e8920933edaf0"
+      "sha256": "8ff71d0200dd2b11afa13be91155669caee7ba000a537df94e37426a6485e7f1"
     },
     {
       "path": "src/module-loader/catalog.js",
       "mode": "0000644",
       "sha256": "633042ab3228780fd18f96ce6a2dd0d84452a124948720678d4484c29df0acd8"
     },
+    {
+      "path": "src/module-loader/error-tally.js",
+      "mode": "0000644",
+      "sha256": "00f37bb206c47a75c5ee1420831781a38eb88b9446a9ce1cc3e8ee5a47e09334"
+    },
     {
       "path": "src/module-loader/loader.js",
       "mode": "0000644",
-      "sha256": "04458c645d876011324e5ae11011774699c06e39ff2fa1ba1cf58a2d2775f887"
+      "sha256": "4520d7cb0a91dd3f6cb52c52ced8caf2039126fa7c942e3f0714e91600cebb80"
     },
     {
       "path": "src/module-loader/manifest-schema.js",
@@ -12892,7 +12907,7 @@
     {
       "path": "src/platform-server.js",
       "mode": "0000644",
-      "sha256": "773372a16a32d3936aa53d0ca5ec0e19833e45cadcc16688102b5e81c117e5bf"
+      "sha256": "435a89e5f5becab510ee5ad3f4246f34ee6a6abac859d49823edc74fd1bcdf4f"
     },
     {
       "path": "src/role-responsibilities.js",
@@ -16409,6 +16424,11 @@
       "mode": "0000644",
       "sha256": "50e4d45bf544efe755dda538a93eafc40dcd9caa071e987d8833d97ecf1b7e0f"
     },
+    {
+      "path": "tests/module_error_counts.mjs",
+      "mode": "0000644",
+      "sha256": "7c5e8009a416c72d5659677c0a23d90408001f33ff6b56b121ed06a2beceb739"
+    },
     {
       "path": "tests/module_exports_unique_keys.mjs",
       "mode": "0000644",
@@ -17132,7 +17152,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "2c31c74c71147c5fe96beb8e6a53f8793ea3f42870512a6005f43df7c6fb5382"
+      "sha256": "dc30483813143d76ed6597f4b68d61db3dd2ae9bf34d15b9ce8ddd57caf0f79f"
     },
     {
       "path": "tests/provision_account_identity.mjs",
@@ -17169,6 +17189,11 @@
       "mode": "0000644",
       "sha256": "f99d0a4a54fa9d846efc772148156e06023d3ad4e2afbddce8dd1d9a62821b96"
     },
+    {
+      "path": "tests/provision_resource_caps.mjs",
+      "mode": "0000644",
+      "sha256": "491c29cbeee40a677a01ee71f1f54a787017456b4baa8416219480f337e3c3e3"
+    },
     {
       "path": "tests/provision_restart.mjs",
       "mode": "0000644",

package/docs/adr/0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md

@@ -80,3 +80,9 @@ The measured cost is the same **unit** for `co-tenant` and `standalone`. What se
 - **+** Billing has a unit cost for a shared slot.
 - **−** The page-cache reserve is an allowance, not a measurement. If a ceiling is ever approached, re-measure `MemAvailable` then instead of trusting the 250 MB.
 - **−** These are **idle-fleet** numbers. A project with real traffic or large data will sit above 80 MB, so the ceiling is an upper bound for quiet projects. Re-measure the same way (`Pss` + `SwapPss` per unit, `memory.peak`, `pg_stat_activity`) as projects gain users.
+
+## Amendment — 2026-10-15 (task 1004414): each hosted project is capped
+
+**The owner's numbers**, sized from the measurement above: `MemoryHigh=160M`, `MemoryMax=256M`, `CPUQuota=50%`, `TasksMax=256` on every hosted project's unit. A project idles at 45–70 MB and its boot peak is 118–134 MB with page cache, so `MemoryHigh` sits above the boot peak and makes the kernel reclaim before `MemoryMax` kills. A killed project comes back through `Restart=always`. Half a core is about a thousand times the measured idle use, and 256 tasks is far above what one Node process starts. The caps bound one runaway project; they do not change the ceiling, which still counts ~80 MB per project.
+
+New units render the caps (`serviceUnit`). An existing unit takes them with `systemctl set-property`, live and without a restart, through `node scripts/gds/provision.js apply-caps --apply` on the control plane. The unit file is not rewritten, because a project made before the per-instance accounts (task 1003369) would be moved onto an account that does not exist. The numbers live in `scripts/gds/provision-caps.js`, and `tests/provision_resource_caps.mjs` pins them, so changing one is a decision. A project with real traffic or an adopted repo with heavy dependencies may need more; re-measure as above before raising them.

package/docs/adr/0354-a-builder-hosts-one-project-free-and-more-takes-the-fleet-permission.md

@@ -36,7 +36,7 @@ The count and the insert are two separate steps, so two requests sent together w
 ## Consequences
 
 - New users can create a project from the wizard again. Each project costs us about $0.80 a month (ADR 0285).
-- A stranger's code now runs on the shared box, on the same server as the hub. It runs in its own locked account (task 1003369), and the hub's sign-in cookie no longer reaches project halls (task 1004357). **Nothing caps a hosted project's memory or CPU**, so one misbehaving project can slow every hall and the hub. That was already true of every hosted project; this decision widens who can have one.
+- A stranger's code now runs on the shared box, on the same server as the hub. It runs in its own locked account (task 1003369), and the hub's sign-in cookie no longer reaches project halls (task 1004357). **Nothing caps a hosted project's memory or CPU**, so one misbehaving project can slow every hall and the hub. That was already true of every hosted project; this decision widens who can have one. (Closed by task 1004414: each hosted project is now capped. See the ADR 0285 amendment.)
 - Each first-free request holds one database connection from its count to its insert. Creates are rare, so the pool can carry it.
 
 ## Alternatives considered

package/docs/module-api-changelog.md

@@ -3089,5 +3089,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.124 with no explicit bump. run 38759002066. (task 1002620)
   1.21.126 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.125 with no explicit bump. run 38761052564. (task 1002620)
+  1.21.127 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.126 with no explicit bump. run 38764985266. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.126",
+  "version": "1.21.127",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.126",
+      "version": "1.21.127",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.126",
+  "version": "1.21.127",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9750,5 +9750,15 @@
       "id": "1004738",
       "text": "A goal's page is much shorter now: task dependencies sit in a small card at the top where Conflicts used to be, and the full dependency picture and conflict list are one click away."
     }
+  ],
+  "1.21.127": [
+    {
+      "id": "1004637",
+      "text": "Projects now count each store module's errors per day and send the count to the store, so a module's reliability score comes from real use. It sends with a builder's sign-in on that machine and respects the reporting switch in"
+    },
+    {
+      "id": "1004414",
+      "text": "Each hosted project now has a memory and CPU limit, so one runaway project can no longer slow down every other project or the hub."
+    }
   ]
 }

package/scripts/gds/exec-path-guard.js

@@ -103,7 +103,7 @@ const EXEMPTIONS = [
        + 'absorbed into this check.',
   },
   {
-    at: 'src/module-loader/loader.js:347',
+    at: 'src/module-loader/loader.js:350',
     why: 'The poller twin of the route require at :196 — same DEFAULT_ROOTS bound, same plugin-by-'
        + 'design rationale, same ADR 0107 / task 1003400 follow-on. Listed on its own line so a '
        + 'change to either call re-opens only that one.',

package/scripts/gds/fitness.js

@@ -524,6 +524,7 @@ const KERNEL_FILES = [
   'src/module-loader/loader.js',          // the disk loader (discover → validate → mount)
   'src/module-loader/manifest-schema.js', // the manifest validator
   'src/module-loader/semver.js',          // coreVersion compatibility
+  'src/module-loader/error-tally.js',     // per-module runtime-error counts the loader feeds (task 1004637)
   'src/bongos/module-scope-map.js',          // the module→path registry (it NAMES every module — exempt below)
   // trust primitives (ADR 0091 §1) — the authz boundary + data substrate
   'src/bongos/auth.js',                      // authz gates (requireBuilder/requireRank, ADR 0016)

package/scripts/gds/module-error-report.js

@@ -0,0 +1,148 @@
+#!/usr/bin/env node
+'use strict';
+//
+// scripts/gds/module-error-report.js — send this instance's daily runtime-error
+// count for each store module to the store, with the builder sign-in on this box
+// (task 1004637, follow-up to task 1003793; ADR 0343 D1).
+//
+// WHY. The store scores a module's Reliability from daily error counts, and nothing
+// sent one. The server keeps the tally (src/module-loader/error-tally.js writes
+// module-error-counts.json in the instance config dir); this script sends every
+// finished day it has not sent yet — including a 0, because a clean day is what
+// Reliability measures — and remembers which days went in module-error-sent.json.
+//
+// WHO SENDS (owner, 2026-10-15): a builder's sign-in on this box, because the store's
+// report routes take a builder and no project-to-store credential exists (that option
+// is parked as task 1004740). No sign-in here means nothing is sent, quietly.
+//
+// PRIVACY (owner, 2026-10-01): counts only, on by default, with an opt-out. If the
+// signed-in builder switched reporting off in Settings, nothing is sent and the days
+// are marked done; the store also drops a report from an opted-out holder, so the
+// rule holds whichever client sends.
+//
+// The server runs this every few hours (error-tally.js startDailySend); it is safe to
+// run by hand too:
+//   node scripts/gds/module-error-report.js [--dry-run] [--quiet]
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { readTally, utcDay, FILE_NAME } = require('../../src/module-loader/error-tally');
+
+const SENT_FILE = 'module-error-sent.json';
+// The store takes days up to 30 back (module-usage-reports.js ERROR_DAY_WINDOW).
+const WINDOW_DAYS = 30;
+const ENTRY_RE = /^([a-z0-9][a-z0-9-]*)@(\d+\.\d+\.\d+)$/;
+
+function daysAgo(today, n) { return utcDay(Date.parse(`${today}T00:00:00Z`) - n * 86_400_000); }
+
+// The finished days still to send, oldest first. Pure.
+function pendingDays(days, sent, today) {
+  const oldest = daysAgo(today, WINDOW_DAYS);
+  return Object.keys(days || {}).filter((d) => d < today && d >= oldest && !(sent && sent[d])).sort();
+}
+
+// Send what is pending. `call(method, path, { json })` is the store client (module.js
+// storeRequest). Never throws for a store answer: a day is marked done only when
+// every count in it got a final answer — recorded, or refused for good (4xx: the store
+// does not have that version, or this builder does not hold the module). A 5xx or an
+// unreachable store leaves the day for the next run. Returns a summary.
+async function sendPending({ days, sent = {}, today, call, dryRun = false }) {
+  const out = { pending: pendingDays(days, sent, today), sentDays: [], posted: 0, skipped: 0, optedOut: false, retryLater: false };
+  if (!out.pending.length) return out;
+
+  const pref = await call('GET', '/store/usage-reporting');
+  if (!pref.ok) { out.retryLater = true; return out; }
+  if (pref.data && pref.data.enabled === false) {
+    out.optedOut = true;
+    if (!dryRun) out.sentDays = out.pending.slice();
+    return out;
+  }
+
+  const entries = new Set();
+  for (const d of out.pending) for (const e of Object.keys(days[d] || {})) if (ENTRY_RE.test(e)) entries.add(e);
+  const keys = [...new Set([...entries].map((e) => e.match(ENTRY_RE)[1]))];
+  let known = new Set();
+  if (keys.length) {
+    const res = await call('GET', `/store/modules/latest?keys=${keys.map(encodeURIComponent).join(',')}`);
+    if (!res.ok) { out.retryLater = true; return out; }
+    known = new Set(Object.keys((res.data && res.data.latest) || {}));
+  }
+
+  for (const day of out.pending) {
+    let done = true;
+    for (const [e, count] of Object.entries(days[day] || {})) {
+      const m = e.match(ENTRY_RE);
+      if (!m || !known.has(m[1]) || !Number.isInteger(count) || count < 0) { out.skipped += 1; continue; }
+      if (dryRun) { out.posted += 1; continue; }
+      let res;
+      try {
+        res = await call('POST', `/store/modules/${encodeURIComponent(m[1])}/versions/${encodeURIComponent(m[2])}/error-count`, { json: { day, count } });
+      } catch { res = { ok: false, status: 0 }; }
+      if (res.ok) out.posted += 1;
+      else if (res.status >= 400 && res.status < 500) out.skipped += 1;
+      else done = false;
+    }
+    if (done && !dryRun) out.sentDays.push(day);
+    else if (!done) out.retryLater = true;
+  }
+  return out;
+}
+
+function readSent(file) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+    return parsed && parsed.sent && typeof parsed.sent === 'object' ? parsed.sent : {};
+  } catch { return {}; }
+}
+
+// Record the days sent, dropping any older than the store's window.
+function writeSent(file, sent, newDays, today) {
+  const oldest = daysAgo(today, WINDOW_DAYS + 1);
+  const next = {};
+  for (const d of [...Object.keys(sent), ...newDays]) if (d >= oldest) next[d] = true;
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify({ sent: next }, null, 2));
+  fs.renameSync(tmp, file);
+}
+
+async function main(argv = process.argv.slice(2), {
+  log = console.log, request, tallyFile, sentFile, today = utcDay(),
+} = {}) {
+  const quiet = argv.includes('--quiet');
+  const dryRun = argv.includes('--dry-run');
+  const say = (m) => { if (!quiet) log(m); };
+  const { configPath } = require('../../src/instance-config');
+  const tFile = tallyFile || configPath(FILE_NAME);
+  const sFile = sentFile || configPath(SENT_FILE);
+
+  const days = readTally(tFile);
+  const sent = readSent(sFile);
+  if (!pendingDays(days, sent, today).length) { say('module error counts: nothing to send.'); return 0; }
+
+  let call = request;
+  if (!call) {
+    try { call = require('./module').storeRequest(); }
+    catch { say('module error counts: no Bongos sign-in on this machine, so nothing was sent.'); return 0; }
+  }
+
+  let out;
+  try { out = await sendPending({ days, sent, today, call, dryRun }); }
+  catch (e) { say(`module error counts: the store could not be reached (${e.message}); will try again later.`); return 1; }
+  if (out.sentDays.length) writeSent(sFile, sent, out.sentDays, today);
+
+  if (out.optedOut) say('module error counts: reporting is switched off in your Settings, so nothing was sent.');
+  else say(`module error counts: ${dryRun ? 'would send' : 'sent'} ${out.posted} count(s) for ${out.pending.length} day(s); ${out.skipped} skipped (not a store module you hold)${out.retryLater ? '; some will be retried later' : ''}.`);
+  return out.retryLater ? 1 : 0;
+}
+
+module.exports = { pendingDays, sendPending, main };
+
+if (require.main === module) {
+  // Set the exit code and drain, never a hard exit after a request (task 1002734).
+  Promise.resolve(main()).then(
+    (code) => { process.exitCode = code; },
+    (e) => { console.error(e && e.message ? e.message : e); process.exitCode = 1; },
+  );
+}

package/scripts/gds/module.js

@@ -1350,6 +1350,7 @@ async function main(argv) {
 
 module.exports = {
   main, cmdNew, cmdList, cmdUpgrade, cmdCheck, cmdSubmit, cmdPublish, cmdInstall, cmdUpdate, printHelp,
+  storeRequest,
   gatherCatalog, formatCatalog, ownProjectName,
   scaffoldModule, gatherUpgrade, evaluateUpgrade, gatherUpdates, evaluateUpdates, buildManifest,
   formatMaintenanceHint, isPastRemoveAfter,

package/scripts/gds/provision-caps.js

@@ -0,0 +1,63 @@
+// scripts/gds/provision-caps.js — the resource caps every hosted project's service carries
+// (task 1004414). A cloud-host project runs its owner's code on the box that also serves the
+// hub, and ADR 0354 lets any signed-in builder host one, so a runaway project must not be
+// able to starve the others or the hub.
+//
+// The numbers are the owner's (2026-10-15), sized from ADR 0285's measurement: a project
+// idles at ~45-70 MB and peaks at 118-134 MB at boot (page cache included), and uses a
+// fraction of a percent of one core. MemoryHigh throttles and reclaims before MemoryMax
+// kills; a killed project comes back through the unit's Restart=always. Too tight a cap
+// takes a healthy project down, so change these only as a decision.
+//
+// A NEW unit renders them (serviceUnit). An EXISTING unit takes them with `systemctl
+// set-property`, which applies live and persists a drop-in under /etc/systemd/system.control/,
+// so nothing restarts and no unit file is rewritten — rewriting would move a project made
+// before the per-instance accounts (task 1003369) onto an account that does not exist.
+// systemd only: the supervisord image has no cgroups to cap.
+
+'use strict';
+
+const RESOURCE_CAPS = Object.freeze({
+  MemoryHigh: '160M',
+  MemoryMax: '256M',
+  CPUQuota: '50%',
+  TasksMax: '256',
+});
+
+function capDirectives() {
+  return Object.entries(RESOURCE_CAPS).map(([key, value]) => `${key}=${value}`);
+}
+
+// The slug is interpolated into a root shell command, so it is held to the create route's
+// charset here too rather than trusted from the row.
+const SAFE_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+
+function setCapsCmd(inst, { sudoP = '' } = {}) {
+  if (!SAFE_SLUG.test(String(inst.slug))) throw new Error(`refusing to cap an unsafe slug: ${JSON.stringify(inst.slug)}`);
+  return `${sudoP}systemctl set-property ${inst.slug}.service ${capDirectives().join(' ')}`;
+}
+
+// `provision.js apply-caps [--apply]` — cap every running hosted project now. A cloud-host
+// always runs on the control plane (capacity.placementBox), so this uses controlExec. One
+// project that refuses never stops the rest; the result names it.
+async function cmdApplyCaps(deps) {
+  const { db, log, privileged } = deps;
+  const exec = deps.controlExec || deps.exec;
+  const sudoP = privileged ? 'sudo ' : '';
+  const { rows } = await db.query(
+    `SELECT slug FROM provisioning_instances
+      WHERE hosting_shape = 'cloud-host' AND status = 'active'
+      ORDER BY slug`);
+  const capped = [], failed = [];
+  for (const { slug } of rows) {
+    // makeExec answers an allowFail'd failure ok:true + softFailed:true (softFailResult)
+    let r;
+    try { r = exec(setCapsCmd({ slug }, { sudoP }), { allowFail: true }); } catch { r = null; }
+    (!r || r.ok === false || r.softFailed ? failed : capped).push(slug);
+  }
+  log(`${deps.apply ? 'capped' : 'would cap (dry-run — add --apply)'} ${capped.length} of ${rows.length} active hosted project(s) at ${capDirectives().join(' ')}`);
+  if (failed.length) log(`  ✖ could not cap: ${failed.join(', ')} — re-run once each unit is loaded`);
+  return { ok: failed.length === 0, capped, failed };
+}
+
+module.exports = { RESOURCE_CAPS, capDirectives, setCapsCmd, cmdApplyCaps };

package/scripts/gds/provision-process.js

@@ -59,6 +59,9 @@ const systemd = {
     exec(`${sudoP}rm -f ${serviceUnitPath(inst)}`, { allowFail: true });
     exec(`${sudoP}systemctl disable --now ${backupUnitName(inst)}.timer`, { allowFail: true });
     exec(`${sudoP}rm -f ${backupServicePath(inst)} ${backupTimerPath(inst)}`, { allowFail: true });
+    // the caps drop-in `provision.js apply-caps` wrote (task 1004414, provision-caps.js)
+    exec(`${sudoP}rm -f /etc/systemd/system.control/${inst.slug}.service.d/50-*.conf`, { allowFail: true });
+    exec(`${sudoP}rmdir /etc/systemd/system.control/${inst.slug}.service.d`, { allowFail: true });
     exec(`${sudoP}systemctl daemon-reload`, { allowFail: true });
     exec(`${sudoP}systemctl reset-failed ${inst.slug}.service ${backupUnitName(inst)}.service`, { allowFail: true });
   },

package/scripts/gds/provision-units.js

@@ -12,6 +12,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { CONFIG, REPO_ROOT } = require('./provision-config.js');
 const { CORE_PKG_DIR, appUser, dbName, instanceDbRole, instanceStateDir, instanceUser, parseTargetRef, standaloneRoot } = require('./provision-repo.js');
+const { capDirectives } = require('./provision-caps.js');
 
 function serviceUnit(inst, { etcBase = CONFIG.etcBase } = {}) {
   const envFile = path.posix.join(etcBase, inst.slug, 'web.env');
@@ -61,6 +62,8 @@ ProtectSystem=strict
 ProtectHome=read-only
 PrivateTmp=true
 ReadWritePaths=${stateDir} -${workDir}/config
+# Resource caps (task 1004414; the numbers and their reasons are in provision-caps.js).
+${capDirectives().join('\n')}
 
 [Install]
 WantedBy=multi-user.target

package/scripts/gds/provision.js

@@ -1348,6 +1348,7 @@ Commands:
   teardown <slug>        tear down one instance by slug
   reconcile              re-enqueue instances stuck mid-flight with no open intent
   status                 list provisioned instances + estimated run-rate
+  apply-caps             cap every active hosted project's memory/CPU/tasks live (task 1004414)
   dns-check <domain>     PREFLIGHT: verify the control-plane Cloudflare token can reach
                          the domain's zone BEFORE the address step (network-only, no DB)
 
@@ -1397,7 +1398,7 @@ async function main() {
     process.exit(1);
   }
 
-  const known = ['run-intents', 'provision', 'teardown', 'reconcile', 'status'];
+  const known = ['run-intents', 'provision', 'teardown', 'reconcile', 'status', 'apply-caps'];
   if (!known.includes(cmd)) { console.error(`unknown command: ${cmd}\n`); usage(); process.exit(2); }
   const slug = args[1] && !args[1].startsWith('--') ? args[1] : null;
   if ((cmd === 'provision' || cmd === 'teardown') && !slug) { console.error(`${cmd} needs a <slug>`); process.exit(2); }
@@ -1432,6 +1433,7 @@ async function main() {
     else if (cmd === 'teardown') { const inst = await provisioning.getInstanceBySlug(pool, slug); if (!inst) { console.error(`no instance with slug '${slug}'`); await pool.end().catch(() => {}); process.exit(1); } result = await teardownInstance(inst, deps); }
     else if (cmd === 'reconcile') result = await cmdReconcile(deps);
     else if (cmd === 'status') result = await cmdStatus(deps);
+    else if (cmd === 'apply-caps') result = await require('./provision-caps.js').cmdApplyCaps(deps);
   } catch (e) {
     console.error('fatal:', e && e.message ? e.message : e);
     await pool.end().catch(() => {});

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.126'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.127'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');