@bongos/core 1.19.1035 → 1.19.1036

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1035",
-  "core_contract": "1.19.1035",
-  "source_commit": "984bf7acda7d778bdbac5cb358d4817b17b18d88",
+  "core_version": "1.19.1036",
+  "core_contract": "1.19.1036",
+  "source_commit": "19197b1c05f3e07896458dc0e71d7e41529d10d1",
   "source_ref": "HEAD",
-  "built_at": "2026-09-26T07:18:36.442Z",
+  "built_at": "2026-09-26T07:30:38.514Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 541,
+    "docs_redacted": 542,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2489,
+    "functional_verbatim": 2491,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3057,
-  "tree_sha256": "625127767ece3a0c054244383e2f3971ffcd5a2fb986f2ea192d4d837c89b237",
+  "file_count": 3060,
+  "tree_sha256": "871996fc2ebf4d378610236e8e594e2a024b36fec0ed2a8f8a2971ef43a2b1c3",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -372,7 +372,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "1b3e0d29bec82e3637396c31bb42af2c8a72e6a897a7b83f02dd2e546e4817ce"
+      "sha256": "9f07e5e4cc88e90ec9f7ced7c258890724f9457bb3412eccad177c14805c29dd"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -2189,10 +2189,15 @@
       "mode": "0000644",
       "sha256": "5acb8ac6e656a909ef6392f845f7a479d44d7b7619197e9f66b4879e16a6971c"
     },
+    {
+      "path": "docs/adr/0339-a-projects-owner-upgrades-it-and-a-hosted-project-hands-off-to-the-hub-door.md",
+      "mode": "0000644",
+      "sha256": "e337e1ab80b949992f8805873f81864466522c40f247e8b8b28ccdd1575d6471"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "cfc9f596d7c1304223fbd6f0175b7ccf76ac4ab1b4b46cd0d4e5a92e0269c637"
+      "sha256": "9d611061b85a56b85f33ea9e0638239b1765cb251761b5f56f63ea82387ac01f"
     },
     {
       "path": "docs/api-reference.md",
@@ -2202,7 +2207,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "d81fad692604b0240f2237d2d33eb0ff503fdfa992f2376d9aa565b8c8c59de9"
+      "sha256": "9ba85d53f945f62060b03de6a7638d025edd5c3a83942404876fb618c96f36da"
     },
     {
       "path": "docs/architecture.md",
@@ -2227,12 +2232,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "ec0998154b23a557722d7538cc99d2be3dd2ea71caaeca679476665196d76387"
+      "sha256": "9256c15d5c0e1227d33babd5b036e3d15af58d52a4a7204eb016a9f435e4de0b"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "0364763b59a5b1f12cbb95a37fc3510bf6deded9f0e403050cc2b8f940dd380a"
+      "sha256": "5bbc6bda98aead6a950661199dd0547b06e6b6d8555a4576339a9795dad9ac61"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2762,7 +2767,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "831d4d60af672d57ba41368d631ed8d63dbdccb6da2ac3c5c67f7c08055f6630"
+      "sha256": "6ef6f0678f191a2d3210235fd6d56466f7de506bb9054d1213ebdf99385d2dd9"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4777,7 +4782,7 @@
     {
       "path": "modules/hall-ui/public/atlas.html",
       "mode": "0000644",
-      "sha256": "3edd194899fa87bf44563f6d5976edb74905e107b368e4cdaba70858c81779fb"
+      "sha256": "fbdd3f0ec0bd7cfc7d2db007b78e38ea0f37317e8eaea9d025516700b01cb0d5"
     },
     {
       "path": "modules/hall-ui/public/atlas.js",
@@ -4797,7 +4802,7 @@
     {
       "path": "modules/hall-ui/public/blockers.html",
       "mode": "0000644",
-      "sha256": "f065a6ed301971734cd2b873f3229dbf4fdf82cbc24f19de8463aea9f685cbad"
+      "sha256": "71c74c720f4d814dddc6814f6f84c9403ee79acb6e836ccf25818379ac1030c8"
     },
     {
       "path": "modules/hall-ui/public/blockers.js",
@@ -4817,7 +4822,7 @@
     {
       "path": "modules/hall-ui/public/board-room.html",
       "mode": "0000644",
-      "sha256": "2501f5df77b652c86a4daa4bcd96b0873c57632f884bf3dede2f367b156ead71"
+      "sha256": "33ac4f80a8bf4abd2f9d7e4669dd878b0b781992cd7d2c6478db6444f3f7668f"
     },
     {
       "path": "modules/hall-ui/public/board-room.js",
@@ -4857,7 +4862,7 @@
     {
       "path": "modules/hall-ui/public/collab.html",
       "mode": "0000644",
-      "sha256": "d84a90723fc50a96f73c66144234acea8354d4031c0412c739ea1d8d1daa3c70"
+      "sha256": "203f2ec19408e99d652a620716150f917ca1370f534494611b278bcd3db37713"
     },
     {
       "path": "modules/hall-ui/public/collab.js",
@@ -4877,7 +4882,7 @@
     {
       "path": "modules/hall-ui/public/copy-desk.html",
       "mode": "0000644",
-      "sha256": "caaa3010a46e9620bd3ae2f9c4abd7f8f3d78b5a7385daa3776aa2984bb87292"
+      "sha256": "14256df75f8ee4c4e52ae4783c6949e26d53e1ec2bfcd840bc8efa66ccd76d43"
     },
     {
       "path": "modules/hall-ui/public/copy-desk.js",
@@ -4917,7 +4922,7 @@
     {
       "path": "modules/hall-ui/public/deploy.html",
       "mode": "0000644",
-      "sha256": "29d4629ecaa99f527b381a9607eb0ce2b4dd12c9b82a549dbc5e97cdedb63f85"
+      "sha256": "77173078fe8aa93fa9bf9ad98ca7bc1c5698999c2f837b0ae9d0c38be12fd2b2"
     },
     {
       "path": "modules/hall-ui/public/deploy.js",
@@ -4942,7 +4947,7 @@
     {
       "path": "modules/hall-ui/public/diagrams.html",
       "mode": "0000644",
-      "sha256": "7d5bc99479d368ebf2919a76fe641f4fe2363ce0f8362ef92e2452ffe5fd8c42"
+      "sha256": "670a093f6f725c468a6bf0b3fadd1563416f79a845af9d828065482df6ec1d31"
     },
     {
       "path": "modules/hall-ui/public/diagrams.states.json",
@@ -4957,7 +4962,7 @@
     {
       "path": "modules/hall-ui/public/drachmae.html",
       "mode": "0000644",
-      "sha256": "8b1f36c4d99706bbad7c196169eee34e9348fde86371d5788f07ac4214b862a6"
+      "sha256": "c1f0483ef4c6fd5733e633511f7cd0fe80d1e0ee6e9f28a5c9be15d68df3accb"
     },
     {
       "path": "modules/hall-ui/public/drachmae.js",
@@ -4982,7 +4987,7 @@
     {
       "path": "modules/hall-ui/public/fleet.html",
       "mode": "0000644",
-      "sha256": "82a3edae9faf65138a843237e57b5d8231f733fd612d1321b91eb1d64874d718"
+      "sha256": "e2747aa6933e15c98c96adb647c1157cc4f2dc0f41028f40e5489b7229b4f0fb"
     },
     {
       "path": "modules/hall-ui/public/fleet.js",
@@ -5002,7 +5007,7 @@
     {
       "path": "modules/hall-ui/public/gate.html",
       "mode": "0000644",
-      "sha256": "becfb72526c5ba2ab097f279393be8829b77016193c4bfb8efeb5738040b7a94"
+      "sha256": "1116f5a968997226cdd77b5482ace78301983b7ad5a6c8bf7168fa538f3a1ac6"
     },
     {
       "path": "modules/hall-ui/public/gate.js",
@@ -5062,7 +5067,7 @@
     {
       "path": "modules/hall-ui/public/goals.html",
       "mode": "0000644",
-      "sha256": "fa68cd950f0ded536245502fdf13c6ce934ca6d0e0b989274ce0cea2d383e548"
+      "sha256": "7d36c5382d4a7fe28bbe11e5c8091ec57901d5a6ff109d7939fe440dde75abf7"
     },
     {
       "path": "modules/hall-ui/public/goals.js",
@@ -5082,7 +5087,7 @@
     {
       "path": "modules/hall-ui/public/government.html",
       "mode": "0000644",
-      "sha256": "92a68d4ae3b0a3c2760ee9e73be094f87dd8eb6643c03b5f2d6b75098daa5a27"
+      "sha256": "169be49c008f72a38d3344799bcdf57da8aa982cd493e7ba730ae076a69363ed"
     },
     {
       "path": "modules/hall-ui/public/government.js",
@@ -5127,7 +5132,7 @@
     {
       "path": "modules/hall-ui/public/idea.html",
       "mode": "0000644",
-      "sha256": "3ef0e66974b350aacf248103cc35d9a5e2d217c0008a8929921d623d60638317"
+      "sha256": "b17f24b4e708d634a2881f4bcef7516b1643561681d190920c28064145b09d37"
     },
     {
       "path": "modules/hall-ui/public/idea.js",
@@ -5147,7 +5152,7 @@
     {
       "path": "modules/hall-ui/public/ideas.html",
       "mode": "0000644",
-      "sha256": "17eb43cb9aa65b94aa022a47d0a46f62d401967232bd3ed563e95b71cfc2a109"
+      "sha256": "40fc0a25222393e8b113da5e334c106f518be2830f5a5d85e06ae15bfd67f447"
     },
     {
       "path": "modules/hall-ui/public/ideas.js",
@@ -5162,7 +5167,7 @@
     {
       "path": "modules/hall-ui/public/index.html",
       "mode": "0000644",
-      "sha256": "7f626a633e8be246b73f9e385e2bab10de223c30f99491d0f68935d587be1d87"
+      "sha256": "f5529b026a2a3403b8ec2cd09ab20099d1a2600f38c84ec1b5402cc278f46a8c"
     },
     {
       "path": "modules/hall-ui/public/index.states.json",
@@ -5187,7 +5192,7 @@
     {
       "path": "modules/hall-ui/public/modules.html",
       "mode": "0000644",
-      "sha256": "9ee5aa49c43d3d9438d3bd287e1050d6c3c9677b0f1223f3a81085150450ebb9"
+      "sha256": "a2601defe8617175c8539a14a56c003559966aae11c298885205269579c61a22"
     },
     {
       "path": "modules/hall-ui/public/modules.js",
@@ -5222,7 +5227,7 @@
     {
       "path": "modules/hall-ui/public/people.html",
       "mode": "0000644",
-      "sha256": "531b5b44da9f8310cdac68f7028651b9faba93537f46a7d62d2d91b534cb60ee"
+      "sha256": "6d6522caa3e8a11f29f67c289ca75cceef6345d123fbf3b733c4a7faeb880237"
     },
     {
       "path": "modules/hall-ui/public/people.js",
@@ -5242,7 +5247,7 @@
     {
       "path": "modules/hall-ui/public/primer.html",
       "mode": "0000644",
-      "sha256": "f42672a64748654dc14a96541a1b4b2f9472a68047d9be9a10da146e92d25418"
+      "sha256": "5cb9c552a0c2d99e4c1172c4681ce41c774ece16410cf9a944a7314108afc7ac"
     },
     {
       "path": "modules/hall-ui/public/primer.js",
@@ -5282,7 +5287,7 @@
     {
       "path": "modules/hall-ui/public/profile.html",
       "mode": "0000644",
-      "sha256": "cbabc56bef3e160fba12de6b8f832ac50805c9bb7756c3c8010a5636ed9c47b1"
+      "sha256": "6a0dc1f2ba2a2db0d2c7cca9833cdc341d3e0b82f86788b086df110e6f0af238"
     },
     {
       "path": "modules/hall-ui/public/profile.js",
@@ -5302,7 +5307,7 @@
     {
       "path": "modules/hall-ui/public/project-settings.html",
       "mode": "0000644",
-      "sha256": "b4955c3648c66aa8b9230a64c3f0c7dad0b3b59f1e8a9be2f5c115fe78d3c35b"
+      "sha256": "1567ea69d15d77e832d22098123a5a9f9b84f5e4f4b6e6ac31f4ebd76a7f8d15"
     },
     {
       "path": "modules/hall-ui/public/project-settings.js",
@@ -5312,7 +5317,7 @@
     {
       "path": "modules/hall-ui/public/ranks.html",
       "mode": "0000644",
-      "sha256": "2c12baff9d9eb66ee73ba6dba22cad83502ed54a7d58210ba950b88e01e3a9c9"
+      "sha256": "eeb0ecad70b42413a3ea546c443902cef7909202f58ea8ba72e62639557e4844"
     },
     {
       "path": "modules/hall-ui/public/ranks.js",
@@ -5342,7 +5347,7 @@
     {
       "path": "modules/hall-ui/public/roadmap.html",
       "mode": "0000644",
-      "sha256": "8b942a03271472b484e65ba6f1cc6412aa7a9e69ca1dff517e35e7e0eea6dbda"
+      "sha256": "3aea689b90c6e265cf95e655c634fe8ca5676b392ca4bf8d6632d15f2653a298"
     },
     {
       "path": "modules/hall-ui/public/roadmap.js",
@@ -5362,7 +5367,7 @@
     {
       "path": "modules/hall-ui/public/roster.html",
       "mode": "0000644",
-      "sha256": "36ed566e96502e389cc96a6cc0a7e8a1e22a281f01a8554ad6b4e9748685ace5"
+      "sha256": "8bad58e00c57e3f8d011b33f0a0f7a5f1c4a150bab10ac115c87d2a17db93c98"
     },
     {
       "path": "modules/hall-ui/public/roster.js",
@@ -5382,7 +5387,7 @@
     {
       "path": "modules/hall-ui/public/sessions.html",
       "mode": "0000644",
-      "sha256": "9c944d47052160f18535414b50fe345e4529ef7c81b46b2095a36e54c396fd1a"
+      "sha256": "4bc80429d2866370d3545c9db21709b09b80f9a2e963e6ae948cd0e20463fa5d"
     },
     {
       "path": "modules/hall-ui/public/sessions.js",
@@ -5422,7 +5427,7 @@
     {
       "path": "modules/hall-ui/public/settings.html",
       "mode": "0000644",
-      "sha256": "f552e9959410bbdd6899236e830f75f5602fde523aaf6f7844d1280fd409b4b2"
+      "sha256": "357ecd574a10f3a93296deac4e77b398acfa58d21fb15c02fe5d3621cbb87a80"
     },
     {
       "path": "modules/hall-ui/public/settings.js",
@@ -5437,7 +5442,7 @@
     {
       "path": "modules/hall-ui/public/shell.js",
       "mode": "0000644",
-      "sha256": "9cc99bb9b7cce94878d5a9e146c9cdb5d408bb28dbe2078db78b4c31bc6bccd7"
+      "sha256": "983282a83fd5aa71079eac2044887f805d230c473ab6e60705236516525a1bea"
     },
     {
       "path": "modules/hall-ui/public/ship.wav",
@@ -5487,7 +5492,7 @@
     {
       "path": "modules/hall-ui/public/studio.html",
       "mode": "0000644",
-      "sha256": "6043b1269c576df6f923241612706f9bb5daf4d4aeba83661f1d901fba98344c"
+      "sha256": "ca9771d0c4b170e44c1b0577b522d84b530996025734e4fd7267d5d365f741f0"
     },
     {
       "path": "modules/hall-ui/public/studio.js",
@@ -5522,7 +5527,7 @@
     {
       "path": "modules/hall-ui/public/task.html",
       "mode": "0000644",
-      "sha256": "afbaba812beaddb6da59aec3f470ef2a3e396525c50052f9f10adaad3002ea4a"
+      "sha256": "949b9a014360e00171bd57e998bd89b08532a09feb8beb9dacf9dbc478c257ae"
     },
     {
       "path": "modules/hall-ui/public/task.js",
@@ -5567,7 +5572,7 @@
     {
       "path": "modules/hall-ui/public/watch.html",
       "mode": "0000644",
-      "sha256": "630e436130c784af1228f5e4584295266f8edfd63f1d6ff52310bded2794a11b"
+      "sha256": "aafc62b380549030fd8e7baa9e1550ec35b057559eeced5e6a56ed11e9d889d2"
     },
     {
       "path": "modules/hall-ui/public/watch.js",
@@ -5592,7 +5597,7 @@
     {
       "path": "modules/hall-ui/public/work.html",
       "mode": "0000644",
-      "sha256": "07561e30791294b2d2cfc6cb4bc128c27ebfbe47e4eb171890440c3ea5d738e8"
+      "sha256": "8375f591427f25d23617490f8a5f94cd9e05ec6514be29ca2ae0d582e676b079"
     },
     {
       "path": "modules/hall-ui/public/work.js",
@@ -6874,10 +6879,15 @@
       "mode": "0000644",
       "sha256": "0bbe91cadfb2bec4c419aab26e728c239ff1772af2c3568203d8fba2fb99a2d6"
     },
+    {
+      "path": "modules/provisioning/core-upgrade-authz.js",
+      "mode": "0000644",
+      "sha256": "3e3c92ba55eb9a3196b51a0f3aae7cf558ce58d25e7c6327c982f6d65619337c"
+    },
     {
       "path": "modules/provisioning/core-upgrade.js",
       "mode": "0000644",
-      "sha256": "1c9bf1138bfdac392c2f8718bb024560e5c6383965c9b337d4aee98df459dc0c"
+      "sha256": "ff2f256a550c5d83a83deb47448590fc9a8f4cfd30c52fd4e90a441223b2aaa7"
     },
     {
       "path": "modules/provisioning/cost-ledger.js",
@@ -7077,7 +7087,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "fba7da2883254cc0f7f2eafee6c437aeac00f97fb1f8a35acade67e48c6a6eff"
+      "sha256": "58cbd888fa2ddedb174e566b861efb1749d06928f8152514e9b09d99701592af"
     },
     {
       "path": "modules/provisioning/public-refusal.js",
@@ -7112,7 +7122,7 @@
     {
       "path": "modules/provisioning/routes/core-upgrade.js",
       "mode": "0000644",
-      "sha256": "8ceb0707b3bfe16e308cdf3034b034bcea8b5e266bcfa1d0e47bd53a61392990"
+      "sha256": "5e74192eb8c4543da8af94a362d7516b54adb8fcbe114953923905d382e5f616"
     },
     {
       "path": "modules/provisioning/routes/disconnect.js",
@@ -8432,12 +8442,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "badec3b8c68b18938b3759d753d7d28e594367c32103cb46a3842e5f0968648f"
+      "sha256": "8bc4159c82c66d02c808e07894e32b1f60f12e46384d9d535c4b603605e5420f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "605847b031c0ec07aef44c3b574bf3eafbb320c75280d9af2c8cc1d80c725385"
+      "sha256": "64ebac363a5645b7b24781ef504f245cc3ebbda68eab36cff10bdc9a2d9c2716"
     },
     {
       "path": "public-docs/index.html",
@@ -8457,7 +8467,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "368eba38c61e4ecb3613174255b865e9c9fc595ffc04930e35a90a0a5696c38e"
+      "sha256": "f6742c6fe0101e4c11797f7f8ad2933b4012ff0a8f6f04b77a4ee0e91b7a234c"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9412,7 +9422,7 @@
     {
       "path": "scripts/gds/provision-core-upgrade.js",
       "mode": "0000644",
-      "sha256": "8dc70d4c4b551818ee49c942a54fc2bb40758d2130c845de4f04502038b14a49"
+      "sha256": "2a79d1302cb0351ef13bfeeeee0582368fdf6d3c0b1ab64777b97acf99f88824"
     },
     {
       "path": "scripts/gds/provision-disconnect.js",
@@ -10232,7 +10242,7 @@
     {
       "path": "src/bongos/auth.js",
       "mode": "0000644",
-      "sha256": "f35226f4ab906fa8dbcd688e1c429ce9f161e616f6b5c4a96dee3cebdf33e4b1"
+      "sha256": "28501abfa037b22a8068e1f4bfcf2ffcc78b3cbf06e81c45c41d54fabbb5e85f"
     },
     {
       "path": "src/bongos/cascade-dispatch.js",
@@ -10417,7 +10427,7 @@
     {
       "path": "src/bongos/routes/core-update.js",
       "mode": "0000644",
-      "sha256": "5cfcc4d5a48eb6e0c2370adf6c990d86a4af605d664c56b64687920150b16463"
+      "sha256": "7d5675eac467a35b68e2348415e40576947b89dd6d794450d34886bfa6950160"
     },
     {
       "path": "src/bongos/routes/github.js",
@@ -10517,7 +10527,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "896f882c5f8e0e2050bab3d8b44aecfb3967be01cc9328003477016ae7f7fa4a"
+      "sha256": "aa1249f6836cac45e41de0aa8047758dd0c271301a0c2ca986ed440d165f2318"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11474,6 +11484,11 @@
       "mode": "0000644",
       "sha256": "9e19834caee7747ae1e07499ec3119903be404b6d244dfe0598d6c7ad3793aa3"
     },
+    {
+      "path": "tests/core_upgrade_owner_door.mjs",
+      "mode": "0000644",
+      "sha256": "37a7441d340f2db848dde73d62a50ed8ba91d7e62d2cbe64a88e9cc3150a7461"
+    },
     {
       "path": "tests/core_upgrade_runner.mjs",
       "mode": "0000644",
@@ -13422,7 +13437,7 @@
     {
       "path": "tests/nav_permission_atoms.mjs",
       "mode": "0000644",
-      "sha256": "bb38798d489d8f9839ad68f641a66333172b45674a526928fdddc046ae0e19f4"
+      "sha256": "ac4dbf8fb9bf50c928385e9f77c7f9312a17f14096aec764af07f1d5c5424f1d"
     },
     {
       "path": "tests/needs_rebase.mjs",
@@ -14002,7 +14017,7 @@
     {
       "path": "tests/provisioning_teardown_intent.mjs",
       "mode": "0000644",
-      "sha256": "fef5b0a02aad78099590b5c9df8f370f9bbb48719d6c64da30e960c68ea34653"
+      "sha256": "51cbc39169b50eae3e88a2d435bfe1d2f25474c12125898040715b0c35aedbf9"
     },
     {
       "path": "tests/provisioning_teardown_states.mjs",
@@ -14312,7 +14327,7 @@
     {
       "path": "tests/scouting_page_gate.mjs",
       "mode": "0000644",
-      "sha256": "fcb87aec22e9051eaa303f6587f1687701dd59d29971b11823fa443cef2edb77"
+      "sha256": "dda423aa7e7d58c77ce394d27365d7700e40fcd7759dc8ba1943ab02f87a73f8"
     },
     {
       "path": "tests/scouting_rollup_fanout.mjs",

package/clients/bongos-client/index.d.ts

@@ -61,7 +61,7 @@ export interface GetConnectionsDegreeHandleResponse { handle: unknown; degree: u
 export interface GetConnectionsRequestsResponse { incoming: unknown; outgoing: unknown; incoming_count: unknown; outgoing_count: unknown }
 export interface GetConnectionsResponse { connections: unknown; count: unknown }
 export interface GetConnectionsSuggestionsResponse { suggestions: unknown; count: unknown }
-export interface GetCoreUpdateResponse { ok: boolean; update: unknown }
+export interface GetCoreUpdateResponse { ok: boolean; update: unknown; deploy_url: unknown }
 export interface GetCoreUpgradesResponse { ok: boolean; running: unknown; limit: unknown; upgrades: unknown }
 export interface GetDiscordChannelsPlanResponse { ok: boolean; guild_id: unknown; op_count: unknown; ops: unknown; warnings: unknown }
 export interface GetDiscordChannelsSnapshotResponse { ok: boolean; guild_id: unknown; config: unknown; warnings: unknown }

package/docs/adr/0339-a-projects-owner-upgrades-it-and-a-hosted-project-hands-off-to-the-hub-door.md

@@ -0,0 +1,84 @@
+# ADR 0339 — A project's owner upgrades it, and a hosted project hands off to the hub's door
+
+- **Status:** Accepted
+- **Date:** 2026-09-26
+- **Task:** [task 1004174](https://cloudbongos.com/builders#/task/1004174) (goal 1000090 — BONGOS-V2)
+- **Deciders:** the owner, Lars. On 2026-09-22 he said "every project has the option to upgrade its version of bongos including bongos itself", and that the control belongs in that project's own hall. On 2026-09-26 he ruled that **only a project's owner upgrades it**, adding that for him "owners and archons are the same", because he owns the platform.
+- **Amends:** [ADR 0293](0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md) D5 ("Archon-gated server-side"). The deploy door gains a second audience, as stated below. D1 (the web tier only asks, the control plane acts), D3, D4 and D6 are unchanged.
+- **Related:** [ADR 0328](0328-a-hosted-projects-authority-is-its-membership-row-not-its-owner-column.md) (the owner-OR-operator gate shape this reuses), [ADR 0210](0210-scouting-graduates-on-an-instance-asserted-owner-claim.md) (the `alsoAdmits` page-gate door this reuses), [ADR 0246](0246-catalog-membership-is-a-projection-not-a-federation-side-effect.md) (a hosted project's hub client id is its slug), [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) / 0111 §2 (the web tier gains no capability)
+
+## Context
+
+The deploy door is `POST` and `GET /provisioning/instances/:id/core-upgrade` on the control plane, fronted by the hub's `/deploy` page. It was gated on `core.pin.move` alone. That atom has an archon floor and `system:true`: the catalog forbids granting it to metic, and no custom rank can hold it.
+
+That produced two dead ends.
+
+1. **The owner of a hosted project below Archon could see they were behind and could never act on it.** On a hosted project the banner (task 1004045) prints "Core X is available" with no action, because that project does not run the provisioning module. The door lives on the hub, and on the hub the owner (erikwils is Xenos; willHermesLines is Metic) is refused by the atom.
+2. **A hosted project's own hall had a "Deploy" link that opened a page with nothing behind it.** The page's calls are provisioning routes, and a tenant has none.
+
+Task 1004174's own text settled where the act must happen. It stays on the control plane, because ADR 0293 D1 and ADR 0043 both turn on the web tier never gaining a shell. The hosted project hands off rather than acting.
+
+## Decision
+
+### D1 — The owner of a hosted project may move that project's core, from the hub
+
+The two per-project routes (the preview `GET` and the move `POST`) are gated by an OR, implemented in `modules/provisioning/core-upgrade-authz.js`:
+
+1. **Ownership is asked first.** The caller is admitted if the row's `owner_builder_id` is the caller and the row is a tenant shape (`co-tenant` or `cloud-host`).
+2. **Every other caller meets the unmodified `requirePermission('core.pin.move')`** and its unchanged refusal. That includes callers who are not the owner, a missing row, an unparseable id, and a database error during the ownership read.
+
+This is the shape ADR 0328 Decision 2 and ADR 0210's `requireScoutingReader` already use. The atom is still spelled in each route's middleware list, where `route-rank-check.js` and `gen-api-docs.js` read it. The consequences:
+
+- A non-owner below Archon gets exactly the 403 they always got, and learns nothing about whether the id exists.
+- The Archon path is untouched.
+- The widening can only admit.
+
+### D2 — The platform's own row stays on the atom
+
+`OWNER_SHAPES` excludes `control-plane`. Moving the platform changes the code that drives every hosted project, so only a holder of `core.pin.move` may do it. `GET /provisioning/control-plane` keeps the atom alone.
+
+For Lars this is no restriction: he is both the platform's owner and an Archon, which is his ruling that the two are the same.
+
+### D3 — A hosted project hands its owner to the hub, and gains nothing
+
+`GET /api/bongos/core-update` (core) now also answers `deploy_url`: `<hub origin>/deploy?project=<slug>`.
+
+- It is built from the two values provisioning already writes into a federated project's `web.env`: the hub origin and the hub client id, which is the slug (ADR 0246).
+- It is null on an instance with no hub, such as a self-hosted instance or the hub itself.
+- The client secret is never read for it.
+
+The hall uses that address in two places, and only where it has no door of its own (the provisioning module is off):
+
+- **The banner's "Upgrade" links there.**
+- **The rail's "Deploy" item** is dropped where the provisioning module is off, and re-pointed at that address once it is known.
+
+The hub's `/deploy?project=<slug>` page (task 1004171) was built as exactly this seam.
+
+The hub's `/deploy` page shell is gated by `requireCorePinPage`. It now declares `alsoAdmits: 'isProjectOwner'`, the door `/people` uses: it admits the shell for an owner of any live project. Which project the owner may read or move is still the routes' decision, made per request against that project's row.
+
+### D4 — The actor says which door was used, and still names the builder
+
+An owner's move is recorded as `api:owner:<id>`, and an Archon's as `api:archon:<id>`. The runner's `requestedByOf` accepts both and passes the id through as `--requested-by`, so the `core_upgrades` ledger attributes the move either way (ADR 0293 D5).
+
+## Rejected
+
+- **A tenant-side API that authenticates back to the control plane and performs the upgrade.** It is rejected in writing, as the task asked. It would be a new cross-instance authentication surface on the most privileged action in the system, and it would give a tenant's web process a path to the act ADR 0293 D1 keeps on the control plane. The hand-off costs one navigation and adds no new capability anywhere.
+- **Granting `core.pin.move` to owners.** The atom is `system:true` precisely so it cannot be handed down, and "may move core pins" is not "may move this one project's pin". Ownership is a separate axis, as ADR 0151 §3 keeps it.
+- **Letting an owner move the platform row.** The platform row is not the owner's project in the sense the ruling means. Its only owner is the Archon who holds the atom anyway.
+- **Asking the platform-identity membership ledger instead of `owner_builder_id`.** ADR 0328 Phase 2 (task 1004161) will widen project authority to members through that port. The ruling here is "owner", which the row already records, so this ADR takes the column and leaves the widening to that task.
+
+## Consequences
+
+- **erikwils (hoodify-finance) and willHermesLines (mercury) can upgrade their own projects.** They open `https://cloudbongos.com/deploy?project=<slug>` on the hub. The hub half works as soon as the platform runs a core carrying this ADR. The in-hall link reaches a hosted project only once that project runs such a core, because the banner ships inside the core. Until then the owner reaches the door by its address.
+- **An owner's upgrade restarts their own site.** The runner's health gate and auto-rollback apply unchanged.
+- **ADR 0328 Phase 1 must absorb this gate, not route around it.** When task 1004159 lands `requireProjectOwner` for the `/provisioning/instances/:id...` routes, the two core-upgrade routes should move onto it with the atom as their override. That keeps the same owner-OR-atom answer, and the platform row stays atom-only. Until then `requireOwnProjectOrPin` is the only owner gate on them. Task 1004160's `project_scope_missing` check lists `/provisioning/instances/:id` as a prefix, so it would flag these two routes. That is correct: it is the reminder to fold them in, not a sign that they are unguarded.
+- **The page shell admits any live project owner.** An owner without the atom who opens `/deploy` without `?project=` sees the sealed state, because `/provisioning/control-plane` refuses them. The page is a shell, and every datum behind it is gated per request.
+- **Proof:** `tests/core_upgrade_owner_door.mjs` covers each case:
+  - the owner below Archon, admitted;
+  - the Archon on another's project, admitted by the atom;
+  - the non-owner below Archon, refused byte-for-byte as before, whether the id exists or not;
+  - the platform row, owner or not, refused without the atom;
+  - a failing ownership read, which falls to the atom;
+  - the actor labels, and the runner's attribution parse;
+  - the page shell admitting an owner and still refusing a stranger;
+  - the `deploy_url`, and the hall's banner and rail on a hosted project and on the platform.

package/docs/adr/README.md

@@ -430,3 +430,4 @@ This keeps the decision history honest and traceable.
 | 0336 | [**A guild is a hub-side group whose members each consent twice, and its collective record is only ever the sum of what those members already show** ([task 1002299](https://cloudbongos.com/builders#/task/1002299), goal 1000110 — the R23 design spike for goal 1000045's C7/C8/C9). No platform guild existed (every "guild" in the tree is Discord's). Decisions: (1) three hub tables in `platform-identity`, in their own `guilds.js` (the 1,500-line ratchet), distinct from instance-local `goal_members`: guilds (slug, name, `visibility ∈ public|unlisted` with **no default**), members (`membership_kind ∈ owner|member`, never `role` per ADR 0174; a partial unique index holds exactly one owner; a per-member `shown_publicly`), and requests; (2) two consents to join, no self-join, through ADR 0202's connections lifecycle verbatim (silent decline, 90-day swallowed re-ask, 30-day read-time expiry); `accountActiveSql` floors the feature; an **unlisted guild 404s to everyone on the public read, members included**, and takes invites only, because a slug is guessable; (3) the public roster is `shown_publicly AND accountVisibleSql`, and widening a guild to public changes no member's flag but the flipping owner's, so consent given to a small audience is never reused for a large one; (4) **the privacy resolution — NOT ratified; superseded by [ADR 0337](0337-the-hub-account-is-the-person-a-hall-account-is-their-seat-in-one-project.md) D4.4:** it proposed that a member is counted iff shown AND `rollupVisibleSql`, read-time, `no-store`, never stored, and N and M are both lengths of lists the reader can see. The guild record is therefore always a sum of numbers already on members' own public profiles, so nothing can be subtracted out. All-or-nothing is rejected (one member blanks everyone and hiding becomes costly), as is per-member consent to count hidden numbers (it breaks "hide_stats beats everything"). The trade-off: guilds of privacy-minded builders look smaller and rank lower. A union count of all members' projects is refused because it reveals shared private projects; (5) the namespace is `/g/<slug>`, `g` is reserved in the SEO spec's project-slug list, the slug is fixed in V1, and `tests/guild_namespace_reserved.mjs` pins the two documents together; (6) a guild engages a project only through the individual door: a guild application is each member's own vouched application, labelled through ADR 0260's live applicant-profile read (no new instance field); inviting a guild fans out ordinary individual invites to its public roster at that moment, **never a guild-level pre-approval** (that would let a guild owner decide admission to someone else's project); (7) the map ranks public guilds by size and counted works shipped, read-time, with a slug tiebreak, and R29 narrows to the visual. Scope changes for R24–R37 are tabled in the ADR, including R28's dependency on the abandoned R11 and R29/R31's archived orb goals.](0336-a-guilds-record-is-the-sum-of-what-its-members-already-show.md) | platform identity / privacy / social graph |
 | 0337 | [**The hub account is the person, a hall account is their seat in one project, so anything that spans projects lives on the hub** ([task 1004255](https://cloudbongos.com/builders#/task/1004255), goal 1000110 — the owner's hub/hall re-scope, 2026-09-24/25). Extends [ADR 0141](<redacted>.md) from identity to placement: (1) a surface about the person across projects, or about more than one project, goes on the HUB (`public-landing`, `platform-identity`): people directory, community, guilds, connections, recruiting, platform-account settings; one about this project goes in the HALL (`hall-ui`); "Builders you may know" is on both; `status-ui` is the status dashboard, not the hall; (2) no authority moves, and hub actions still land as the project's own rows; (3) hall `/people` retires, ADR 0334's recruiting directory moves unchanged to the hub community page, `/roster` is the in-project directory; (4) owner calls: the hidden-builder recruiter panel is recruiter-only while public search is unchanged (amends community-tab spec D8); platform-account settings get a new hub page; **guild totals count hidden and private members by default, with a notice on the join card and a per-guild off switch (`counted_in_totals`), rounded to a 1–2–5 band, only once a guild has at least 3 of them, refreshed weekly; size stays the public roster length** (supersedes ADR 0336 D5; relaxes the privacy spec's "`hide_stats` beats everything" for guild totals only, for a member who was told), with the fake-account padding limit stated and accepted.](0337-the-hub-account-is-the-person-a-hall-account-is-their-seat-in-one-project.md) | platform identity / placement / privacy |
 | 0338 | [**Modules travel through a Bongos-hosted store, and an acquired module keeps working forever** ([task 1003782](https://cloudbongos.com/builders#/task/1003782), goal 1000091 — working area 5, owner Will). A module had no transport of its own: it reached an instance only inside the core (ADR 0107 §6) or in the instance's repo. Weighed npm packages, a Bongos-hosted store and git refs against the four things area 5's criteria require — entitlement before install, a per-version score, a tester channel, and a delist that stops distribution. npm and git refs fail entitlement and delist by construction. **D1:** Cloud Bongos hosts the store; a module version is a tarball + hash manifest in the same format `package-core.js` already emits (same `isPublishable()` gate), registry rows on the control-plane DB, artifacts in the already-paid DO Spaces bucket, served by the control plane only after an entitlement + channel check; free modules take the same path at price zero; install/update verify hashes on arrival; modules' own npm deps still travel via npm (ADR 0138). No new fixed cost. **D2 (owner):** delisting, author withdrawal or deletion removes a module from the catalog and stops new acquisitions and updates, but **an acquired module keeps working forever** — the store never disables or removes an installed copy and a delist never revokes an entitlement; the holder is told no more updates will come. Security issues are not a special case; a remote kill switch would need a superseding ADR. Rejected: npm, git refs, remote disable on delist.](0338-modules-travel-through-a-bongos-hosted-store.md) | modules / distribution / economy |
+| 0339 | [**A project's owner upgrades it, and a hosted project hands off to the hub's door** ([task 1004174](https://cloudbongos.com/builders#/task/1004174), goal 1000090 — the owner's ruling of 2026-09-26 that only a project's owner upgrades it). Amends ADR 0293 D5. **D1:** the deploy door's preview and move routes admit the OWNER of a tenant row (`co-tenant`/`cloud-host`) for that row, asked first; every other caller meets the unmodified `core.pin.move` gate, so a non-owner's refusal is unchanged whether or not the id exists and the widening can only admit. **D2:** the platform's own row stays atom-only. **D3:** `GET /core-update` names `<hub>/deploy?project=<slug>` on a federated project, and the hosted hall's banner and rail hand off there (the dead local Deploy item is gone); the hub's `/deploy` shell admits a project owner through `alsoAdmits: 'isProjectOwner'`. **D4:** the intent's actor records the door (`api:owner:<id>` / `api:archon:<id>`), both attributed on the `core_upgrades` ledger. Rejected: a tenant-side API that performs the upgrade, granting the system atom to owners, owners moving the platform row. ADR 0328 Phase 1 (task 1004159) should fold this gate into `requireProjectOwner`.](0339-a-projects-owner-upgrades-it-and-a-hosted-project-hands-off-to-the-hub-door.md) | provisioning / deploy door / permissions |