@bongos/core 1.19.1009 → 1.19.1010

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1009",
-  "core_contract": "1.19.1009",
-  "source_commit": "f333a382d30859ea9dd83b8e0413b1bcf4e38b66",
+  "core_version": "1.19.1010",
+  "core_contract": "1.19.1010",
+  "source_commit": "2e959a08be544446bcbe4a050128862f651337f6",
   "source_ref": "HEAD",
-  "built_at": "2026-09-24T20:42:02.062Z",
+  "built_at": "2026-09-24T21:57:10.279Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 522,
+    "docs_redacted": 523,
     "agent_docs_stubbed": 26,
     "functional_verbatim": 2420,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2968,
-  "tree_sha256": "aa0d298bf24c87953cdd7448f2b0a543b2fbcbbdde10b5f805773313dd535202",
+  "file_count": 2969,
+  "tree_sha256": "1ed928f07118e31d83cb36f2f7c9e00fb8eb421f4e0c174d518a6c659944bae6",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1632,7 +1632,7 @@
     {
       "path": "docs/adr/0227-a-task-network-map-is-refused-the-goal-graph-is-the-map.md",
       "mode": "0000644",
-      "sha256": "4a0b38c1c05e358528461360dc4b36eb55484df7c545d73b38e98f83ecddaf21"
+      "sha256": "b3b3e724fb4051c9d034df59c7fa675b2be0d71f78305dcbd9d7d43a97aff222"
     },
     {
       "path": "docs/adr/0228-the-reading-room-owes-a-reference-content-rules-not-a-second-archetype.md",
@@ -2149,10 +2149,15 @@
       "mode": "0000644",
       "sha256": "39f310d52b3de17e8064eb6ada480e8dc00778d655ac40bfe748890b2d0ff713"
     },
+    {
+      "path": "docs/adr/0331-the-sky-is-the-ideators-home.md",
+      "mode": "0000644",
+      "sha256": "414a00aeb897b685a01716ec529da5c33feb875eaf50b8f1b652055b5b2fbf8c"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "2f1179abf6618280f106980c69e30a7f015374101a67ea5154c6390160e9ce30"
+      "sha256": "8e45e2918e9dd36572d35758efcd677e7f9d5020c7f2f59d11f303b47b814fdf"
     },
     {
       "path": "docs/api-reference.md",
@@ -2222,7 +2227,7 @@
     {
       "path": "docs/design/ideator-surface-direction.md",
       "mode": "0000644",
-      "sha256": "0ca62887b7345136ed669d2a6c279cd59c0cea2dce9cc91a3af1680ce0a31449"
+      "sha256": "00e4a4dc36481241bac90c3b46387a3f6d1ed906be75824b3b1dae31dc979403"
     },
     {
       "path": "docs/design/landing-page-direction-v2.md",
@@ -2722,7 +2727,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6edfd1a8650655c13f38f17ce919839b0ff0d2412f64dd8c0bb2c415d594450c"
+      "sha256": "982c59cdf01c7f07d25fe1593a21659b31366a6b4b0b09b0350a69a23eba2407"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8217,12 +8222,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "19c087c0a7b0792f92c2de05f05d8aec5c231d14c79d31cdecc3d4c0c90fa51b"
+      "sha256": "493838f2051f8f9c9d9878add2840c5f4e18914607147bbcb4bdea1fcb5559fe"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "fb7688b54f3876cd4282c13c0d192ee507646c83f6348a4ec761534b7dc8d5a4"
+      "sha256": "addc61bbe9d71187f833dcebcb6cfb7136557ba6782d00270395200501ef9f49"
     },
     {
       "path": "public-docs/index.html",
@@ -10267,7 +10272,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7e3b7c7ffca3404a92e817e76b48a4963a9da6c72c1723318d45761c65ae97ad"
+      "sha256": "be4a80ffea151ee7dcc548a28cf928376da1bcce570aa521478ea22657475905"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/adr/0227-a-task-network-map-is-refused-the-goal-graph-is-the-map.md

@@ -282,3 +282,31 @@ a straight face.
 before its numbers are quoted — a field-name mismatch does not fail, it answers zero.* §9
 already conceded this harness over-built for its question; the other half of that lesson is
 that the part it under-built was the twenty lines that touch reality.
+
+## 11. Amendment (2026-09-24) — the project sky takes the goal map's page
+
+Recorded by [ADR 0331](0331-the-sky-is-the-ideators-home.md); tasks
+[#1004229](https://cloudbongos.com/builders#/task/1004229)–[#1004233](https://cloudbongos.com/builders#/task/1004233).
+The owner adopted an interactive prototype of the **project sky** as is, and it replaces the goal
+map page. This section says what that changes here, and what it does not.
+
+**§1's refusal stands.** There is still no whole-corpus task map, at any density. The project sky
+is §1's own shape — the goal graph as the entry point, the per-goal drill-down as the detail —
+drawn as one page instead of two:
+
+- **Tasks are drawn only inside one goal, past a zoom threshold.** That is the per-goal forest
+  §10.5 measured as readable (worst case 127 tasks at 85.2px pitch, median 9), not the refused
+  1,012-node view. Below the threshold, tasks are **dust density on the rings of the goals beneath
+  it, with no identities** — a texture that says how full a goal is, never a disc anybody is asked
+  to name. A "show all tasks" toggle remains refused.
+- **The goal map's table survives as the sky's ledger drawer.** §6's table equivalent is kept,
+  not dropped; every drawn thing is a row in it, one key away.
+- **The nav slot the goal map was denied is granted to the sky**, under Goals (owner,
+  2026-09-24). The goal map page (task 1004105) took no slot on purpose, and a test asserts the
+  same; part 4 ([#1004232](https://cloudbongos.com/builders#/task/1004232)) changes the page and
+  that test together, with this section as the licence.
+
+**Design of record:** [`docs/design/mocks/sky/`](../design/mocks/sky/) — the pixel contract for
+the build. [ADR 0264](0264-the-ten-working-areas.md)'s deletion of the goal *Living project sky*
+([#1000044](https://cloudbongos.com/builders#/goal/1000044)) is superseded by this work, under
+Working area 3.

package/docs/adr/0331-the-sky-is-the-ideators-home.md

@@ -0,0 +1,103 @@
+# 0331 — The sky is the ideator's home, and the project sky takes the goal map's page
+
+- **Status:** Accepted
+- **Date:** 2026-09-24
+- **Tasks:** [#1004229](https://cloudbongos.com/builders#/task/1004229) (this ADR and the design of record), [#1004230](https://cloudbongos.com/builders#/task/1004230)–[#1004233](https://cloudbongos.com/builders#/task/1004233) (the build)
+- **Goal:** [#1000095](https://cloudbongos.com/builders#/goal/1000095) — criterion `ideator-sky-tells-the-truth`, whose text this ADR rewrites.
+- **Design of record:** [`docs/design/mocks/sky/`](../design/mocks/sky/) — the adopted prototype, and the pixel contract for the build.
+- **Amends:** [ADR 0227](0227-a-task-network-map-is-refused-the-goal-graph-is-the-map.md) (§11 there), decision 11 of [`docs/specs/<redacted>.md`](../specs/<redacted>.md).
+
+## 1. What happened
+
+The owner reviewed an interactive prototype of the **ideator sky** and the **project sky** over
+five rounds on 2026-09-24 and adopted it **as is** — copy, layout, colours, tour text, toggles,
+interactions. That adoption contradicts two things already written down, so this ADR rewrites
+them rather than leaving the build to be graded against a contract nobody meant any more.
+
+## 2. The decision
+
+**The sky is the ideator's home surface, not a decoration that arrives last.** It replaces
+*Your thinking* for the ideator and it replaces the goal map page for the project.
+
+**The rule that survives is the accessibility half, and it is unchanged in force:** the sky is
+never the **only** path to anything it shows. The list drawer — the room — is one key away
+(`L`), and every drawn thing is a row in it. What is dropped is "never load-bearing" and
+"arrives last": those were a sequencing hedge from before there was a design to look at, and
+holding the build to them now would mean shipping the owner's adopted surface as an optional
+extra that nothing routes to.
+
+**The five states and the two channels are untouched.** Criterion
+`ideator-sky-tells-the-truth` names a *model* — star, protostar, satellite, remnant, cold body;
+size is what a thought caused and never falls, brightness is how much of that work is still
+alive — and it names it deliberately so the picture may change without the criterion becoming
+unsatisfiable. This amendment changes the picture's standing, not the model.
+
+## 3. Why amend ADR 0227 rather than reverse it
+
+ADR 0227 refused a **whole-corpus task map** on measured evidence: ~1,357 tasks at 30.2px pitch
+is confetti, and drawing it denser draws forty goals badly while claiming to show a thousand
+tasks. **That refusal stands, and the project sky does not violate it** — it is 0227 §1's own
+prescription, not its refusal:
+
+- The entry point is the **goal graph**, as §1 requires.
+- **Tasks are drawn only inside one goal, past a zoom threshold** — the per-goal drill-down §1
+  and §10.5 measured as readable (worst case 127 tasks at 85.2px pitch; median 9). Below that
+  threshold tasks are **dust density on a goal's rings, with no identities** — a texture that
+  says "this goal is full", never a thousand discs nobody can name.
+- The goal map's **table survives as the sky's ledger drawer**, which is 0227 §6's table
+  equivalent, kept rather than dropped.
+
+The one thing 0227 is genuinely amended on is **placement**: the goal map deliberately took no
+nav slot, and a test asserts that. The owner grants the slot to the project sky, under Goals
+(owner, 2026-09-24). Part 4 changes the page and that test together, with this ADR as the
+licence.
+
+Also noted: [ADR 0264](0264-the-ten-working-areas.md) deleted the goal **Living project sky**
+([#1000044](https://cloudbongos.com/builders#/goal/1000044)) in the ten-working-areas cut. That
+deletion is **superseded** — the work is alive again, under Working area 3, as tasks
+[#1004229](https://cloudbongos.com/builders#/task/1004229)–[#1004233](https://cloudbongos.com/builders#/task/1004233).
+
+## 4. The two heuristics that must not ship
+
+The adopted prototype reads the live ledger for almost everything it draws, but **two things in
+it are guesses**, and the built pages must not present a guess as a ledger fact:
+
+1. **An idea's origin** — whether a person or a session filed it — is guessed from the idea's
+   text (the `claude layer` toggle).
+2. **"Born of a thought"** — a goal or criterion that came out of an idea — is found by scanning
+   text for idea ids.
+
+Parts 3 and 4 **hide** both layers. Part 5 replaces them with ledger facts: a `filed_via` column
+and a real born-of-a-thought read. A heuristic drawn in the sky would be indistinguishable from
+the facts beside it, which is the exact failure the criterion exists to prevent.
+
+## 5. Consequences
+
+- The build (parts 2–5) is graded against `docs/design/mocks/sky/sky.template.html` as a **pixel
+  contract**. Any deviation a gate or the file ratchet forces is listed in that part's ship
+  notes, so a forced change is a recorded one rather than a quiet drift.
+- The template ships with **no snapshot**: the snapshot script dumps real task, idea and goal
+  titles, and this repo is public. `docs/design/mocks/sky/.gitignore` refuses both the snapshot
+  and the built page.
+- Criterion 1000384 is already `satisfied` and stays so; its text is rewritten, not its state.
+  **This was done on 2026-09-24 under task 1004229, not left for later.** A satisfied
+  criterion's prose is frozen (`409 criterion_satisfied`), so the route's own prescription was
+  followed: `POST /done-when/1000384/unsatisfy` → `PATCH /done-when/1000384` with the new
+  `criterion_md` → `POST /done-when/1000384/satisfy`. The read-back is `satisfied: true`, slug
+  `ideator-sky-tells-the-truth`, and the last bullet now reads *"The sky is the ideator's home,
+  and it is never the ONLY path to anything it shows. The list drawer — the room — is one key
+  away, and every drawn thing is a row in it."* with a dated amendment paragraph after the
+  drafting note. The five states / two channels text is byte-for-byte what it was. The full
+  before/after is in the session log
+  [`docs/session-logs/<redacted>.md`](../session-logs/<redacted>.md).
+
+## 6. Alternatives rejected
+
+- **Ship the sky as an extra and keep "never load-bearing".** Rejected: it makes the owner's
+  adopted home surface unroutable and leaves *Your thinking* and the goal map as the real pages,
+  which is the opposite of what was adopted.
+- **Reverse ADR 0227.** Rejected: its refusal is measured and still correct. The project sky
+  needs 0227's drill-down shape, not its repeal.
+- **Ship the two heuristics behind a disclaimer.** Rejected: the criterion's whole claim is that
+  each state maps to a ledger fact rather than a UI guess. A labelled guess is still a guess in a
+  picture whose promise is that it cannot be faked.

package/docs/adr/README.md

@@ -422,3 +422,4 @@ This keeps the decision history honest and traceable.
 | 0328 | [**A hosted project's authority is its membership row, not its owner column** ([task 1003882](https://cloudbongos.com/builders#/task/1003882), goal 1000094 — BONGOS-V2). The owner's decision (2026-09-13): every API action must name its project, and a non-member may only apply. Two "project" concepts exist and answer different questions: `provisioning_instances` (the hub's fleet registry, single `owner_builder_id`, [ADR 0325](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md)) and `<redacted>` (`client_id, github_id, membership_kind ∈ {owner,member,visitor,pending}`, already correct, already backing `GET /my-projects`). The composition this needs already exists once, in the opposite direction: `provisioning.projectOwnedBy` is a published port (task 1003580) that `platform-identity/invite-authz.js` already consumes via `resolveOptional` to ask "does this builder own this project" without importing provisioning (ADR 0083). **The gap is that the module which owns the fact does not use it on itself, and has grown three separate local copies of it instead of one** — `instanceAccessDenied` (6 routes), `resolveOwnInstance` (4 routes) and `disconnect.js`'s own inline copy (1 route) all implement "owner OR archon", while 3 routes (`teardown`, `domain`, `github-app`) implement only "owner" with no archon override at all — an existing inconsistency between sibling routes in the same module, not just duplication, and none of the three implementations is visible to `route-rank-check.js`. Decision: (1) project scope stays the existing path segment, resolved through `slug` (the `client_id = slug` join key [ADR 0246](0246-catalog-membership-is-a-projection-not-a-federation-side-effect.md) already establishes); (2) Phase 1 extracts one local `requireProjectOwner` helper replacing all three implementations — a behavior-preserving swap for 11 routes and a stated, intentional archon-override widening for the 3 that lacked it — no new port needed since provisioning already holds the column; Phase 2 adds a new port `platform-identity.projectMembershipKind` and widens the same helper to admit `owner` OR `member`, falling back to the Phase 1 column check when platform-identity isn't installed (ADR 0083's degrade-gracefully contract) — a NEW parallel axis, not a fifth branch on `requirePermission`, mirroring why the ownership axis ([ADR 0151](0151-governance-permissions-as-atom-ranks-as-roles.md) §3, R100) is kept separate; (3) a caller with NO membership row still gets 404 `instance_not_found` (existence-hidden, unchanged), but a `pending`/`visitor` row gets 403 `project_membership_required` naming `POST /my-projects/join` (ADR 0141/0201/0247's existing apply flow) — the "apply to join it" the owner's decision names, routed into the flow that already ships rather than a second one; (4) `route-rank-check.js` gains a `project_scope_missing` finding (blocker on write, concerns on read) for any `/provisioning/instances/:id...` route missing the gate, the same structural read it already gives `requirePermission`; (5) migration order is the 14 evidenced routes only — the task's own "96 write routes" figure is the whole app's census, and the other ~82 act on a single-tenant instance's own Bongos board, which [ADR 0100](0100-two-repo-instance-model.md) §3 already isolates one-database-per-repo and has no project dimension to name. Filed: [task 1004159](https://cloudbongos.com/builders#/task/1004159) (the helper) · [task 1004160](https://cloudbongos.com/builders#/task/1004160) (route-rank-check.js, depends on 1004159) · [task 1004161](https://cloudbongos.com/builders#/task/1004161) (the membership port, depends on 1004159) · [task 1004162](https://cloudbongos.com/builders#/task/1004162) (the 403/404 split, depends on 1004161). Rejected: a second `provisioning_instance_members` table (the membership table already exists and joins on the same key — a second one repeats the mistake ADR 0325 already refused); folding project authority into `requirePermission` as a fifth axis (same reasoning R100 already applied to `.own` keys); migrating all 96 write routes (re-litigates ADR 0100's single-tenant model, not this decision); dropping 404 existence-hiding entirely (a total stranger should learn nothing, exactly as `invite-authz.js` already guarantees).](0328-a-hosted-projects-authority-is-its-membership-row-not-its-owner-column.md) | security / authorization / provisioning |
 | 0329 | [**The rendered fit check is a kit floor and an advisory ship-check row, not a grader worker** ([task 1004203](https://cloudbongos.com/builders#/task/1004203), goal 1000095 — UI quality). Nothing in the pipeline rendered a page, so titles clipped by character count ran past their cards (task 1003480, task 1004204) and a second `.mSec` child would have landed on the first (task 1003078), each found only in a browser. Two new kit floors, `text-fit` (text measured word by word past its box; SVG text past its card rect) and `sibling-overlap` (in-flow, block-level, text-bearing siblings), run in every `render.js` render; `scripts/gds/render-check.js` renders the pages a branch changed at 1280 + 390 and `/ship-check` shows them as an ADVISORY row that never flips its exit (ADR 0162). Not a grader worker: that would put a browser, fixtures and a harness on the grader host for signal the builder already saw; the artist gate (ADR 0241) stays the human look before deploy.](0329-the-rendered-fit-check-is-a-kit-floor-and-an-advisory-ship-check-row.md) | ui-design / kit + ship-check |
 | 0330 | [**An ask is answered where it was asked** ([task 1004216](https://cloudbongos.com/builders#/task/1004216), goal 1000095 — BONGOS-V2), amending [ADR 0187](0187-collab-four-decisions.md) §4a. `lifecycle_004` let a builder ASK for help and let the **asker** mark their own row answered; the person being **asked** had no write at all, so the answer happened somewhere Bongos cannot see and the row sat open until its author remembered it — six asks addressed to the owner had been open between four and thirteen days on 2026-09-23, every one of them answerable. That was not an oversight: §4a deferred conversation to the Agora and a test named *"there is deliberately NO reply thread"* enforced it. **The deferral lost its addressee** — task 1002946 is ABANDONED and goal 1000064 ARCHIVED (verified against the live DB), so the rule had stopped meaning "wait for the Agora" and started meaning "an ask stays unanswerable forever to keep a promise to something that does not exist". **Decisions:** (1) an ask carries a thread of replies, APPEND-ONLY in the SCHEMA rather than by convention — no `updated_at`, `edited_by`, `deleted_at` or `parent_reply_id`, no reactions, no mentions, and a trigger that refuses UPDATE and DELETE outright, because a thing you can edit, nest, react to and address at people is a chat and that is what §4a declined; any builder may reply, since the board read is already project-wide and the good case is somebody you did not ask knowing the answer; (2) the **ADDRESSEE** may close an ask (`answered`), widening an asker-only UPDATE that was coherent only while nothing could be said on the row — but `withdrawn` does NOT widen, since "I no longer need this" is the asker's sentence alone and widening it would be a way to make an ask vanish unanswered; `settled_by` records which of the two closed it, and ADR 0187 §3's consent posture is untouched — closing ends a question, it does not accept work; (3) `/collab-review` posts the reply and **leaves the ask open** (owner decision), since an answer the reader has not read is exactly what an unattended run must halt on. **Consequences:** a reply cannot be taken back, by design; the FK **RESTRICTS rather than cascades** — the first draft cascaded, which reads right and was wrong, because a cascade is a plain DELETE the trigger refuses, so deleting an answered ask failed outright (caught by applying the migration to a real Postgres, not by reading it); the old test was REPLACED, not deleted, so the record that the restraint was deliberate survives; and replies inherit the pull-not-push posture, so nothing still tells an asker they were answered. Rejected: a single `answer` column (cheapest and unambiguously not a chat, but a follow-up would have nowhere to go except a second ask, splitting one conversation across two rows); waiting for the Agora (abandoned — waiting means forever); letting anyone close any ask (an open question is somebody's, and a stranger ending it should not be one click away).](0330-an-ask-is-answered-where-it-was-asked.md) | collab / lifecycle / schema |
+| 0331 | [**The sky is the ideator's home, and the project sky takes the goal map's page** ([task 1004229](https://cloudbongos.com/builders#/task/1004229), goal 1000095 — BONGOS-V2), amending [ADR 0227](0227-a-task-network-map-is-refused-the-goal-graph-is-the-map.md) and decision 11 of `docs/specs/<redacted>.md`. The owner reviewed an interactive prototype of the ideator sky and the project sky over five rounds on 2026-09-24 and adopted it AS IS — copy, layout, colours, tour text, toggles, interactions — which contradicts two things already written down, so they are rewritten rather than leaving the build graded against a contract nobody means any more. **Decisions:** (1) the sky is the ideator's HOME surface — it replaces *Your thinking*, and the project sky replaces the goal map page — so "never load-bearing" and "arrives last" are DROPPED as a sequencing hedge from before there was a design to look at; the rule that survives at full force is the accessibility half, that the sky is never the ONLY path to anything it shows (the list drawer — the room — is one key away, and every drawn thing is a row in it); (2) ADR 0227 is AMENDED, not reversed — its measured refusal of a whole-corpus task map stands, and the project sky is §1's own prescription rather than its refusal: the goal graph is the entry point, tasks are drawn only INSIDE one goal past a zoom threshold (the per-goal drill-down §10.5 measured readable at 85.2px pitch worst case), below that they are dust density on the rings with NO identities, and the goal map's table survives as the sky's ledger drawer (§6's table equivalent kept); the nav slot the goal map was deliberately denied is GRANTED to the project sky, under Goals (owner, 2026-09-24), so part 4 changes the page and the test asserting no slot together; (3) the five states and the two channels are UNTOUCHED — criterion `ideator-sky-tells-the-truth` names a model, not a picture, and this amendment changes the picture's standing only; (4) the two HEURISTICS in the prototype — an idea's origin guessed from its text, and "born of a thought" found by scanning text for idea ids — must not ship as ledger facts: parts 3 and 4 hide both layers, part 5 replaces them with a `filed_via` column and a real born-of read. **Consequences:** `docs/design/mocks/sky/sky.template.html` is the PIXEL CONTRACT for parts 2–5, and every deviation a gate or the file ratchet forces is listed in that part's ship notes; no snapshot JSON or built page is ever committed (it carries real task and idea titles and this repo is public); ADR 0264's deleted goal "Living project sky" is superseded by this work under Working area 3. Rejected: shipping the sky as an extra and keeping "never load-bearing" (makes the adopted home surface unroutable); reversing ADR 0227 (its refusal is measured and still correct — the sky needs its drill-down shape, not its repeal); shipping the heuristics behind a disclaimer (a labelled guess is still a guess in a picture whose promise is that it cannot be faked).](0331-the-sky-is-the-ideators-home.md) | design / ideator / sky |

package/docs/design/ideator-surface-direction.md

@@ -3,6 +3,8 @@
 > **Status:** agreed 2026-09-19 with the area owner. Planning session meta task 1004076; the decisions live on idea 1001072; the scope is `docs/specs/<redacted>.md`.
 >
 > This file is the **visual** half. The spec is the build; the criteria on goal 1000095 are the done-when. Where this file and the spec disagree about behaviour, the spec wins; where a criterion and either of them disagree, the criterion wins.
+>
+> **Superseded for the sky (2026-09-24).** The Sky artboard in [`mocks/ideator-surface/`](mocks/ideator-surface/) is superseded by the adopted prototype at [`mocks/sky/`](mocks/sky/), which is the design of record and the pixel contract for the build ([ADR 0331](../adr/0331-the-sky-is-the-ideators-home.md)). The direction's rules were kept, not dropped: the **five objects** are the prototype's five states with the same ledger facts behind them; **size and brightness stay two channels** ("size is credits", never falling; brightness is the live share); **gravity** is the goal that lights as you type in the composer, and letting a thought float is still a real answer. What changed is the sky's standing — it is the ideator's home now, so "arrives last" and "never load-bearing" below are amended; the surviving rule is that the sky is never the *only* path, since the room is one key away and every drawn thing is a row in it.
 
 ## The problem this answers
 
@@ -63,11 +65,11 @@ The mockup sources are committed at [`mocks/ideator-surface/`](mocks/ideator-sur
 1. **File** — the fast path. One line, an optional aim, and a receipt that does not evaporate. Filing never gets slower than it is today.
 2. **The room** — the plain, everyday overview: what you filed, what it became, its size and whether it is still burning. This is the page a person opens daily, and it does the real work.
 3. **The descent** — one thought at the top and everything it caused falling away below, through rewrites, splits and merges, including the branches that went out.
-4. **The sky** — the ambient view. It is drawn from numbers the other three already produce, it arrives last, and **it is never the only path to anything it shows**.
+4. **The sky** — the ideator's home. It is drawn from numbers the other three already produce, and **it is never the only path to anything it shows**. *(Amended 2026-09-24 — it no longer "arrives last"; see the note at the top and ADR 0331.)*
 
 ## What this direction refuses
 
-- **A galaxy is not trivial, and it must never be load-bearing.** Every fact the sky shows is reachable without it.
+- **A galaxy is not trivial, and it is never the only path.** Every fact the sky shows is also a row in the room. *(Amended 2026-09-24 from "must never be load-bearing" — ADR 0331.)*
 - **Filing does not get slower to serve the picture.** A spark's whole value is that it costs nothing to have; the sky redraws in the background.
 - **The sky will be dominated by large dead rings in a project that churns.** That is honest, and it is the accepted trade — failure is fine, and a bright sky should be earned.
 - **Brightness never claws back credits.** The ledger is not rewritten when the project changes its mind; only the picture changes.

package/docs/module-api-changelog.md

@@ -2492,5 +2492,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1007 with no explicit bump. run 36052924171. (task 1002620)
   1.19.1009 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1008 with no explicit bump. run 36056558236. (task 1002620)
+  1.19.1010 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1009 with no explicit bump. run 36064558803. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1009",
+  "version": "1.19.1010",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1009",
+      "version": "1.19.1010",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1009",
+  "version": "1.19.1010",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1009'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1010'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');