@bongos/core 1.19.508 → 1.19.510

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.508",
-  "core_contract": "1.19.508",
-  "source_commit": "f80c3ed5ba139cbecb704b5cd064990b3ff9aaaf",
+  "core_version": "1.19.510",
+  "core_contract": "1.19.510",
+  "source_commit": "bf4b829a050e1e59d80f4669559d33aff1ca021e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T18:24:24.662Z",
+  "built_at": "2026-09-03T18:34:17.437Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 427,
+    "docs_redacted": 428,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1947,
+    "functional_verbatim": 1951,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2398,
-  "tree_sha256": "8482fdb735f30dbc4866dbf952a55196a50e643fd932b0ef0bb5b701ada05eab",
+  "file_count": 2403,
+  "tree_sha256": "50673e10faee37607acac515c28140b876d8838c656e49115440b31f3d2ae42a",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -192,7 +192,7 @@
     {
       "path": ".claude/skills/new-project/SKILL.md",
       "mode": "0000644",
-      "sha256": "21ae14d681f0b8a7056b320c764ffbaa88c9cf777afc67589049e4778bf98d3b"
+      "sha256": "ce864614cf02126a8ccf46b4128f646fc9734d96ad2e3b5a3060249497449d35"
     },
     {
       "path": ".claude/skills/otb-character-review/SKILL.md",
@@ -362,12 +362,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "7904ca2bfec8710c90bd846edb4c0b50436eebc29fcb87897eea69fea09d1001"
+      "sha256": "146ce9d114ec7d5a90413713b8604843c42eac060dd943648412868e214a1a6e"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "4f6b441e36573c71d391a24b76247df79db02a46bf719965bee22051a90c916f"
+      "sha256": "0e3fb901fd7110352e0edb686cfd8824d71687b88bd7e42269d0fe855177ac9f"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -377,17 +377,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "193252b5fb3be984786b23507a400564dfd6ad1899b0778b436882b8b28de39e"
+      "sha256": "19f11ecf8c9eda49cd1f2ac2425f1d3d9772ad46495305d9ae4bdeadf4695ea2"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "afe60dae1ca8b55c5f9521b4f23eaad4eb194627a2ee105cae1513745ae71544"
+      "sha256": "4ced11579608e8fdb481a07b5555c41b3cbf3018cb3a8bd7697fb58368283bf0"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "1bf4942a3074fa90887b3efdcff39bde587abc6d8b70b4b83a2dea149beaa85a"
+      "sha256": "3d5868d134bce56923b8f0270fbb2e988dea5b6a5ea1a00b96ff8bcde06bb40e"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1407,7 +1407,7 @@
     {
       "path": "docs/adr/0182-project-visibility-two-axes.md",
       "mode": "0000644",
-      "sha256": "119637165d2d6b89f8c00afccd07d9f073629f1502f4b2f2cdc673001b2f8d2a"
+      "sha256": "9474378cf54f6d66269797edf6cd1d0d76014cecbfc657f53cd5892999599f20"
     },
     {
       "path": "docs/adr/0183-criteria-close-themselves.md",
@@ -1689,20 +1689,25 @@
       "mode": "0000644",
       "sha256": "87b350049a0ed1b7be0c58fc2ae6ecd18a077b21ca689563a8763f925a37eef6"
     },
+    {
+      "path": "docs/adr/0237-a-starter-bundle-is-a-preset-over-the-always-on-core-keyed-by-declared-type.md",
+      "mode": "0000644",
+      "sha256": "10534e533c2c70baf670048fb38e18ddedb36925312806afbae9941a9c958667"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "16d284a7a9b1b70f1ba2aa3550a380ed76ace41b985c5f6a309c9899acf6b5f8"
+      "sha256": "e6b0e3bc8becec5ed9c7384596e205cc5a78e6145da244c8d6d2c1d5a4514380"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "1388440a16b1563120683f32ad285c9234c636f54c49a293bc7c1e9aabe55b53"
+      "sha256": "f9a893262b5112e48a8bffa455c8e1a7ce8aed663e34141ef9c48117882a2ad7"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "0b5eab5940ae6cf0e8691c6ec59757e8bbfb719a660ec3e8492d9870c95a8c62"
+      "sha256": "ec2d400cae26a7b89f644e978840927fd0fb88fc0b7b94e9f0d00dd19955aaf2"
     },
     {
       "path": "docs/architecture.md",
@@ -1727,12 +1732,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "b6b680304b158480b87c61679bafa3431d6e492aa9323933abf68621ce243365"
+      "sha256": "c3c4bf94c9565778297efc223bd8a3d0adea4b96d6c484d516f21885532dcdaf"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "ed8c0d7c6ab7edd3ae61cd97c530323ed915f32cfa14a4f4ed1bca4d52437a01"
+      "sha256": "e757dec5eb8da4947297f2fdae06b460e888d6e7cad1a5d13d0dae5e03df4aa1"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2577,7 +2582,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "4af1ded195d83c7060e26bf72c6aa27144bfba92e2ce679e2e90d57b866a0c93"
+      "sha256": "8a8c8b3fa575b33ef7221af26b78a3cbe649f3cbf6b23e398da4d44e2a826096"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3947,7 +3952,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "193252b5fb3be984786b23507a400564dfd6ad1899b0778b436882b8b28de39e"
+      "sha256": "19f11ecf8c9eda49cd1f2ac2425f1d3d9772ad46495305d9ae4bdeadf4695ea2"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -5797,12 +5802,12 @@
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
-      "sha256": "d7c74b8b41b3c0f6d0d072632f4a8d04f11b06c39203c6f759dcaf4e324fd9b0"
+      "sha256": "ea0ef93145343658eb46421ebc435181fe7233c35be7bc73a7cac229f53f6c08"
     },
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "c43bda216cc9c6ec1788dd5d6ef4978594c1ab6db61ad6af33ed8ce451594899"
+      "sha256": "1b626dfb9b8aec98c95d94d8a831e5343018bb6164ef76a160ae6ff5e026a3ad"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -5814,6 +5819,11 @@
       "mode": "0000644",
       "sha256": "2e898799632a2b5c2ead9cb44fa0b8029fcb6d217f7d5f26c8a39b34c75bbea7"
     },
+    {
+      "path": "modules/platform-identity/publish-gate.js",
+      "mode": "0000644",
+      "sha256": "233b2479304b45339b2e31529b47cb1af1ccb48b77a7f6845dd8ef6af52031e0"
+    },
     {
       "path": "modules/platform-identity/recruiter-sliver.js",
       "mode": "0000644",
@@ -5837,7 +5847,7 @@
     {
       "path": "modules/platform-identity/routes/projects.js",
       "mode": "0000644",
-      "sha256": "10e0e86e055063fb33fe5dd0855c1db23c8e0aeb71e1bafb56b4061b8718285a"
+      "sha256": "8652dbbc243f9bb10d759dd140163471d41687b405742f02b5936be818a93472"
     },
     {
       "path": "modules/platform-identity/routes/public-profile.js",
@@ -5867,7 +5877,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "6b523f1fbecaaa29310d3439cc1e4164f7dba3d01057812ccb4ac71bca861b68"
+      "sha256": "6151b6e7d5c4336fece03d0c29dbc94493329ba3bd4d8782702a2d581e5a4cc7"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -5972,7 +5982,12 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "db8e97581ea3b23e31f23cce7246e6fc498ad34005575e234e6537c197d0702b"
+      "sha256": "338e135f492e584aa4539d4a64d7c881b964c9ffa8428ff3359ad96d80b82a5c"
+    },
+    {
+      "path": "modules/provisioning/starter-bundles.js",
+      "mode": "0000644",
+      "sha256": "760382a3e361692f9d8457f88122fda498eb6bccecd37b351837fa5c4fa5e6f4"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -6482,7 +6497,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "258d73c5e38fcb99b8f1ebe6aebbd5c50dd2eb28ac8165cb7504353208b6b3be"
+      "sha256": "f744bab1254cec8220d3399c829bd566f8a6f2d07b412e531720476798837d7b"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -7227,12 +7242,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e9270218a7b9b405011ac398777c9eb70fca7f0cdf3010649ea7450f25d399bb"
+      "sha256": "473153ee377e541a11f94f2b68604221d7cc56b75ce228745a71c094a6db32be"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6a1614277a1b71103a1882256a82e138cbdb4bfbc28be233e69cc751d7f24eed"
+      "sha256": "24b60ab686b6e4edfefbbaecd284c9916d5090f8754a6020cba487a66e9c1441"
     },
     {
       "path": "public-docs/index.html",
@@ -8902,7 +8917,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "eef34fbd7a43f793b876c07999581137f4e8e37cc0b3f03d7db41759b0271693"
+      "sha256": "27eb92e570f6572c875f3c0ab7cffee29fca5c49395167fe4ed7a1d8e466a32e"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11097,7 +11112,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "273da7ef31439224c4c1dade351848c821dd8294333439ea82b5aef039e3c696"
+      "sha256": "2cdad6b12240d3556614aa0e77874f41651e59884f1b07bd9af664334eb90c20"
     },
     {
       "path": "tests/projects_hub_pre_uat.mjs",
@@ -11174,6 +11189,11 @@
       "mode": "0000644",
       "sha256": "1623d2dff20d7b5843f9fd39dd91c35e4a8ebe10b60cf798e01a7fbc4b0202cf"
     },
+    {
+      "path": "tests/provisioning_starter_bundles.mjs",
+      "mode": "0000644",
+      "sha256": "0d3dadff4425e8d014cca29c66c31ff094e78ffbf2fd246f56ba11c5e1cefc93"
+    },
     {
       "path": "tests/provisioning_teardown_intent.mjs",
       "mode": "0000644",
@@ -11209,6 +11229,11 @@
       "mode": "0000644",
       "sha256": "485b2b965bcf44a515571de43851c42a32f278dcdd02510f0d3cd9f6ac53e61c"
     },
+    {
+      "path": "tests/publish_gate.mjs",
+      "mode": "0000644",
+      "sha256": "3e3b97d2c7e4e67a412eaa04bbf3d8fd4ad649ae46f9e194c8e07eedfc2349bb"
+    },
     {
       "path": "tests/publish_manifest.mjs",
       "mode": "0000644",

package/.claude/skills/new-project/SKILL.md

@@ -30,6 +30,8 @@ Both ride the provisioning request as `description` and `detail: { team_shape }`
 
 Never gate the standup on this step, and never invent an answer the owner didn't give — a recommendation built on a guess is worse than no recommendation.
 
+**Read the verdict back rather than asserting one (task 1002335).** Every instance read and the detail PATCH answer with `publish: { publishable, missing, missing_phrase }` — the server's own derivation of the gate. Report *that*, verbatim: "it's on the public map" or "it has no description, so it isn't on the map yet". Do not compute publishability yourself from the fields you happen to have sent; the owner's project page renders the same server verdict, and two surfaces disagreeing about whether a project is published is worse than either being briefly stale. If `publish` is absent, this platform has no public map — say nothing about one.
+
 ### 3. DNS token preflight — BEFORE you commit the address (task 1980)
 
 Before anything is provisioned, verify the control-plane's Cloudflare token can actually manage the domain's zone (a mismatched-zone token is exactly what broke the Emersonian standup mid-flow):

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 345 operations across 53 resource groups
+- 346 operations across 53 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -671,6 +671,8 @@ function createClient(opts = {}) {
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
+      // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles
+      getProvisioningStarterBundles: (args) => request("GET", "/provisioning/starter-bundles", { hasBody: false }, args),
       // GET /provisioning/tls-check — rank: public — GET /provisioning/tls-check
       getProvisioningTlsCheck: (args) => request("GET", "/provisioning/tls-check", { hasBody: false }, args),
     },

package/clients/bongos-client/index.cjs

@@ -670,6 +670,8 @@ function createClient(opts = {}) {
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
+      // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles
+      getProvisioningStarterBundles: (args) => request("GET", "/provisioning/starter-bundles", { hasBody: false }, args),
       // GET /provisioning/tls-check — rank: public — GET /provisioning/tls-check
       getProvisioningTlsCheck: (args) => request("GET", "/provisioning/tls-check", { hasBody: false }, args),
     },

package/clients/bongos-client/index.d.ts

@@ -98,6 +98,7 @@ export interface GetProvisioningInstancesIdSettingsResponse { ok: boolean; setti
 export interface GetProvisioningInstancesResponse { instances: unknown }
 export interface GetProvisioningOnboardPlanResponse { mode: unknown; steps: unknown }
 export interface GetProvisioningSlugAvailableResponse { slug: unknown; available: unknown; reason: unknown; address: unknown }
+export interface GetProvisioningStarterBundlesResponse { core: unknown; bundles: unknown }
 export interface GetPublicBlockersIdResponse { blocker: unknown }
 export interface GetPublicBountyTableResponse { table: unknown; currency: unknown }
 export interface GetPublicGradesResponse { window_days: unknown; rolling: unknown; trend: unknown; attempts: unknown; threshold: unknown; grader_version: unknown }
@@ -169,7 +170,7 @@ export interface PatchMeSoundPrefsResponse { prefs: unknown; effective: unknown;
 export interface PatchProjectsIdFeaturedRequest { featured: boolean }
 export interface PatchProjectsIdFeaturedResponse { project: unknown }
 export interface PatchProvisioningInstancesIdDetailRequest { description?: string; detail?: Record<string, unknown> }
-export interface PatchProvisioningInstancesIdDetailResponse { ok: boolean; description: unknown; detail: unknown; options: unknown }
+export interface PatchProvisioningInstancesIdDetailResponse { ok: boolean; description: unknown; detail: unknown; options: unknown; publish: unknown }
 export interface PatchProvisioningInstancesIdSettingsResponse { ok: boolean; saved: unknown; planet: unknown; push: unknown }
 export interface PatchTaskRecommendationsIdRequest { status: "declined" | "withdrawn" }
 export interface PatchTaskRecommendationsIdResponse { ok: boolean; recommendation: unknown }
@@ -981,6 +982,8 @@ export interface BongosClient {
     getProvisioningOnboardPlan(args?: RequestArgs): Promise<GetProvisioningOnboardPlanResponse>;
     /** GET /provisioning/slug-available — rank: any-builder */
     getProvisioningSlugAvailable(args?: RequestArgs): Promise<GetProvisioningSlugAvailableResponse>;
+    /** GET /provisioning/starter-bundles — rank: public */
+    getProvisioningStarterBundles(args?: RequestArgs): Promise<GetProvisioningStarterBundlesResponse>;
     /** GET /provisioning/tls-check — rank: public */
     getProvisioningTlsCheck(args?: RequestArgs): Promise<ApiResponse>;
   };

package/clients/bongos-client/index.mjs

@@ -667,6 +667,8 @@ export function createClient(opts = {}) {
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
+      // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles
+      getProvisioningStarterBundles: (args) => request("GET", "/provisioning/starter-bundles", { hasBody: false }, args),
       // GET /provisioning/tls-check — rank: public — GET /provisioning/tls-check
       getProvisioningTlsCheck: (args) => request("GET", "/provisioning/tls-check", { hasBody: false }, args),
     },

package/docs/adr/0182-project-visibility-two-axes.md

@@ -159,6 +159,7 @@ Until then: `stealth` unqualified in product code and copy means the project sta
 - R05 moves host: instance-side settings, not a hub page.
 - R08 defaults fail-closed on an unreported project.
 - Anything reading `featured = true AND status = 'active'` as "is this public" is now wrong and must be found. `modules/platform-identity/routes/projects.js` is the known site.
+- **R16 makes D3's bound real, and D4's gate reach a second module.** Shipping R16 (task 1002335) surfaced one thing this ADR left implicit. D3 says `featured` may never put an unpublishable project on the map, so `PATCH /projects/:id/featured` now refuses a dark-matter row (409 `not_publishable`, `missing` in the details); un-featuring stays unconditional, since an already-featured husk must remain removable. And D4's "name what is missing" is owed to the owner *before* their project is ever catalogued on the hub — which is the `provisioning` plane, a different module that ADR 0083 forbids from importing `platform-identity`. Rather than let a two-field rule exist twice, the gate is published as a kernel seam port, `project.publishGate` (`modules/platform-identity/publish-gate.js`). `provisioning` resolves it **optionally** and declares no `consumes`: `platform-identity` is hub-only, the public map is a hub concept, and a platform without one must answer "no verdict" rather than invent a local rule — which is the same drift-avoidance argument that produced `publishableSql` in the first place.
 
 ## Alternatives rejected
 

package/docs/adr/0237-a-starter-bundle-is-a-preset-over-the-always-on-core-keyed-by-declared-type.md

@@ -0,0 +1,137 @@
+# 0237 — A starter bundle is a preset over the always-on core, keyed by the declared project type
+
+- **Status:** Accepted
+- **Date:** 2026-09-03
+- **Tasks:** [#1002338](https://cloudbongos.com/builders#/task/1002338) (this decision — BV1.R19)
+- **Goal:** [#1000046](https://cloudbongos.com/builders#/goal/1000046) — Project creation: visibility and
+  customization, criterion `proj-module-select` ("during setup a default set of modules is pre-selected…")
+- **Related:** [ADR 0083](<redacted>.md) (the one-way import rule that
+  keeps this file pure), [ADR 0107](<redacted>.md) +
+  [ADR 0167](<redacted>.md) (the module catalog a bundle names into),
+  [ADR 0182](<redacted>.md) D4 (the publish bar a bundle may not join),
+  task [#1002772](https://cloudbongos.com/builders#/task/1002772) (the declared project type),
+  task [#1002334](https://cloudbongos.com/builders#/task/1002334) (R15, the detail interview)
+
+## 1. The problem
+
+Criterion `proj-module-select` opens with "during setup a default set of modules is
+pre-selected." Every Cloud Bongos instance already boots with the same always-on
+core — the sixteen `default: true` modules a project cannot sensibly run without —
+so "pre-selected" can only mean the **opt-in** modules layered on top. An owner
+creating their first project has met none of them, and asking them to read a
+twenty-one-row catalog before they have a repo is the version of customization
+that gets skipped.
+
+R19 is the data that answers it. R20 ([#1002339](https://cloudbongos.com/builders#/task/1002339))
+renders the picker, R21 searches the catalog, R17/R22 recommend from the interview
+answers, R23 adds modules later — four consumers, one table underneath.
+
+## 2. Keyed by the DECLARED type, not by anything inferred
+
+The task text (seeded 2026-07-17) names three bundles: *Game / SaaS-Tool /
+Community*. That vocabulary was superseded four weeks later. Task
+[#1002772](https://cloudbongos.com/builders#/task/1002772) settled the closed
+project-type set by owner decision on 2026-08-13 — **`game` · `research` ·
+`business` · `non-profit` · `not-sure`** — and it is the live one: a CHECK on
+`platform_identity_projects.type`, a matching CHECK on
+`provisioning_instances.type`, `PROJECT_TYPES` in both modules, and five buttons in
+the create wizard. "Community" survives, but as a **team shape**
+(`PROJECT_DETAIL_VOCAB.team_shape ∈ solo | small-team | community`), not a project
+type. Bundles key off the shipped vocabulary; the seeded triple is recorded here as
+history so the divergence is not read later as an omission.
+
+Two constraints come with that key and neither is negotiable:
+
+- **The arrow runs type → modules, never back.** Task 1002772 explicitly rejected
+  deriving a project's type from its enabled module set, because flags flip all
+  through setup and a half-configured project would show a confidently wrong type.
+- **The interview does not ask a second time.** R15 wrote that into its own
+  vocabulary comment: "the module bundle R19 recommends comes off the
+  separately-declared `type`, so the interview deliberately does not ask it a
+  second time." So R19 adds no key to `PROJECT_DETAIL_VOCAB` and no migration —
+  the `detail` jsonb column stays reserved for answers an owner actually gave.
+
+`not-sure` and *undeclared* resolve to the same modules (the core, nothing else)
+and are deliberately **not** the same answer: `type` is nullable because every row
+predates the field and must never be back-filled with a guess, so `bundleForProjectType(null)`
+returns `type: null` with its own copy. A picker can tell "the owner said not sure"
+from "nobody asked yet"; conflating them would be the same invention the nullable
+column exists to prevent.
+
+## 3. A declaration pinned by a test, not a read of the live catalog
+
+The natural implementation is to resolve bundles against
+`src/module-loader/catalog.js` — the one model the hall's Modules tab and
+`bongos module list` both build from, so they cannot drift (ADR 0167). A module may
+not import it: `src/module-api.js` is the only core file a module may require (ADR
+0083's one-way rule) and the doorway exposes no catalog.
+
+So `modules/provisioning/starter-bundles.js` **declares** its module keys and stays
+pure — no I/O, no core import, no sibling import — exactly like `onboard-plan.js`
+beside it. The link back to the catalog is a test, not a runtime read:
+`tests/provisioning_starter_bundles.mjs` reads every `modules/*/module.json` off
+disk and fails the build if a bundle names a module that does not exist, if
+`ALWAYS_ON_CORE` drifts from the manifests' `default: true` set, if a bundle names
+an always-on module (a preselect that toggles nothing but reads to the owner as a
+choice), or if it names one of the two hub-only modules. A test is the right
+enforcement point here because the failure is a *build-time* fact — the manifests
+are in the same commit as the declaration — and buying it at runtime would cost the
+purity that lets a script, a route and a test all read the same answer.
+
+## 4. What the bundles are, and why they are short
+
+| type | bundle (opt-in additions) |
+|---|---|
+| `game` | `dev-box`, `discord` |
+| `research` | `agents` |
+| `business` | `agents`, `dev-box` |
+| `non-profit` | `discord` |
+| `not-sure` | — |
+
+Today's opt-in catalog is genuinely three modules wide (`agents`, `dev-box`,
+`discord`; `platform-identity` and `provisioning` are the control plane's own and
+are refused by construction). That is why this is a **declaration and not a rule
+engine** — a bundle grows as the catalog does, and R17/R22 own the layer that
+reasons. A preselect an owner has to audit is worse than none.
+
+`dev-box` is preselected on two types despite costing money to *use*: enabling the
+module opens the door, it provisions nothing and bills nothing until a builder asks
+for a box, and the picker toggles it off in one click.
+
+## 5. The read surface
+
+`GET /provisioning/starter-bundles` returns `{ core, bundles }` — the always-on
+floor once, then every type resolved as
+`{ type, label, summary, core, bundle, modules }`. The whole table in one read,
+because the picker re-preselects as the owner flips the type question and must not
+refetch to do it, and because R17's recommendations and R20's preselect reading the
+same shape is what stops them naming different modules.
+
+`rank: public`, the same (absent) gate as `GET /provisioning/onboard-plan` — the
+signed-out wizard reads it while choosing a type, it writes nothing, and the module
+catalog it names into is already public at `GET /public/modules`.
+
+## 6. Consequences
+
+- **A bundle is never a publish precondition.** [ADR 0182](<redacted>.md)
+  D4 fixes the bar at identity alone — a name and a description, "not tagline, art,
+  modules, governance, or a completed interview." Taking or declining a bundle
+  cannot move a project's dark-matter state.
+- **Nothing is stored yet.** R19 defines and serves; where a chosen selection lands
+  is R20's decision, and there is still no module-selection column on any table.
+- **Adding a module to the catalog is now a two-file change** if it belongs in a
+  bundle — the manifest and this declaration — and the integrity test says so out
+  loud when a manifest flips its `default`.
+
+## 7. Rejected
+
+- **Resolving against the live catalog at runtime** — costs the purity and breaks
+  the one-way rule for a fact that is fixed at build time.
+- **A `bundle` key in `PROJECT_DETAIL_VOCAB`** — R15 already ruled the interview
+  must not re-ask what `type` declares.
+- **Inferring the bundle from the free-text description** — that is the deferred
+  AI/semantic layer ([#1003500](https://cloudbongos.com/builders#/task/1003500)), and
+  the goal's own text pins the near term as rule-based.
+- **Naming the seeded Game / SaaS-Tool / Community triple** — three of those five
+  live types would then have no bundle, and two of the three names match nothing an
+  owner can pick.

package/docs/adr/README.md

@@ -324,5 +324,6 @@ This keeps the decision history honest and traceable.
 | 0234 | [**Idea routing: capture-time promotion, the landing matrix, and the homeless-only inbox** ([task 1003064](https://cloudbongos.com/builders#/task/1003064) · goal 1000071, "Idea routing"). Idea 1000771 named the failure: Discord `#bugs` created tasks DIRECTLY against a hardcoded, already-shipped version — no `captured_by`, no lineage, so the ideator-credit lane had nothing to pay against — while every other open idea sat waiting for a human triage pass that dropped its promotion into a version catch-all, because nothing in capture ever named a goal. Records what R01/R02/R05/R07/R13 shipped. `captureIdea` (`modules/ideas/inbox.js`) stays the ONE capture chokepoint — routing is one optional `goalId` argument, never a second creation door — and when the matrix routes, `routeIdeaToGoal` writes the idea row, the task (via the `lifecycle.createTask` port) and an `ideas_task_lineage` row (`origin='route'`) in ONE transaction, so a route can never mint attribution-free work the way `#bugs` did. `modules/ideas/routing.js`'s `decideLanding` is PURE and fail-closed: a bug from a Metic+ filer hard-lands `ready`, a sub-Metic bug or any other kind with a goal soft-lands `backlog`, a Full Idea or `criterion-proposal`/`decision` never routes, no goal named stays the pre-routing inbox path. `authorizeRoutedLanding` is the BINDING gate underneath the matrix's decision — a goal reaching protected scope raises the task's rank floor to Metic and REFUSES a sub-Metic filer outright, while membership is deliberately NOT required (reporting isn't authoring). `core_222`'s `suggested_goal_id` is an advisory hint only — the real home is `tasks.goal_id`, set by construction — and `/idea-triage` (`scripts/gds/triage.js`) now sends `goal_id` on promotion, so the inbox is homeless-only. Divergence recorded: R11 (Discord `#bugs`) hard-lands a linked Metic+ builder's bug immediately through the SAME shared matrix rather than the spec's "always soft-land, pending queue" design, because a local copy of the rank split would only drift from the one definition; and R12 (Discord `#ideas` hints) is NOT YET SHIPPED, so `#ideas` carries no goal hint today despite the interview decision that it should, hint-only, never route.](<redacted>.md) | ideas / lifecycle |
 | 0235 | [**A fix category is `kind='bug'` under a goal, not a new column** ([task 1003215](https://cloudbongos.com/builders#/task/1003215) · goal 1000071, "Idea routing" — the structural half of idea 1000828; task 1003214 shipped the advisory's first quiet case, task 1003157 extended it). A fix for something that should already work needs a home under an existing goal WITHOUT a new goal being born and WITHOUT a stored column restating what `tasks.kind` already says. Not a global "Bugs" goal either: a goal spanning every module makes the [ADR 0086](<redacted>.md) scope wall either everything or nothing, and a goal that can never reach `achieved` (a bug container never finishes) pollutes the exact signal [ADR 0183](<redacted>.md)'s auto-satisfy depends on. Not [ADR 0192 "a category orients and authorises nothing"](<redacted>.md) either, despite the structural resemblance: that decision forbids any gate from branching on a goal's category, while THIS decision is two decision surfaces deliberately branching on `kind='bug'` — `adviseGoal()` (`modules/lifecycle/goal-advisory.js`) goes silent for a bug under all three of its reasons (`no_goal`, `catch_all`, `no_criterion_link` — "a fix is the goal's 'fix category', not a delivery against one of its stated outcomes," its own doc comment) and `countTasksWithoutCriterionLink()` (`modules/lifecycle/db-deps-criteria.js`, surfaced on the hall's goal detail view) excludes `kind='bug'` from its count for the same reason. No hall/status change was needed for GROUPING bugs under a goal: every task card already renders its `kind` as a visible tag and the goal detail view's Filters already offer a `Kind` lens with `bug` as a value — verified against the live code, not built new. Rejected: a `tasks.category`/`fix_category` column or enum, a global cross-module "Bugs" goal, a bug-specific grouping widget beside the general-purpose kind facility that already works.](<redacted>.md) | ideas / lifecycle |
 | 0236 | [**Many ideas → one task: the lineage key is the pair** ([task 1003515](https://cloudbongos.com/builders#/task/1003515) · goal 1000071, "Idea routing" — promoted from idea 1000815; the table was built by [task 1002997](https://cloudbongos.com/builders#/task/1002997)). `ideas_task_lineage.task_id` was the PRIMARY KEY on the reasoning that "a task descends from at most one idea", and `linkIdeaTask` wrote `ON CONFLICT (task_id) DO UPDATE SET idea_id = EXCLUDED.idea_id` — so promoting a SECOND idea into a task that already had a link **silently replaced the first idea's lineage**: no error, no warning, no log line. Two ordinary triage promotes at one task were enough, and it happened on prod on 2026-08-21 (ideas 1000811 + 1000812 → task 1003150). Because this table is the rail [ADR 0172](<redacted>.md) stream 1 pays against, an overwritten row is an **ideator not paid** for work their idea produced, with nothing recording it — and it makes merging duplicate reports into one task a LOSSY move, which is the triage the inbox exists to encourage. The R01 grader named this shape and was told it was unreachable; it was unreachable on the ROUTING path examined and fully reachable on the ordinary PROMOTE path. **Decision: many ideas → one task is a real relation, so the key is the pair** — `ideas_006` re-adds `ideas_task_lineage_pkey` as `PRIMARY KEY (task_id, idea_id)` and both INSERT sites `DO UPDATE SET origin`, never `idea_id`. Refusing the second link would turn a legitimate merge into an error; logging the replacement keeps a lossy ledger. **Where one row is still required the EARLIEST link wins** (`ORDER BY created_at, idea_id`, stated in SQL rather than left to the planner): `sourceIdeaForTask`, `credits.awardIdeaTaskShipCredit`, and the nod queue's one-row-per-task predicate — one constant shared by the list and its count, so the pill can never disagree with the rows. Consequences: a task subsumed from N ideas **counts once toward each idea's** shipped-task credit (and cannot double-count within one — the pair is unique); the per-ship payout still names one idea, the earliest, because paying every co-source ideator is a decision about total worth, not a bug fix; the migration **backfills** from `idea_inbox.promoted_to_task_id`, the weaker pointer that survived each overwrite, labelling restored rows `origin='promote'`; and `updateIdea` still swallows a lineage failure but now reports it as a `LINEAGE GAP` through `api.logger` — a silent swallow on top of a silent overwrite was two layers of one mistake.](<redacted>.md) | ideas / economy |
+| 0237 | [**A starter bundle is a preset over the always-on core, keyed by the declared project type** ([task 1002338](https://cloudbongos.com/builders#/task/1002338) · goal 1000046, criterion `proj-module-select`). "During setup a default set of modules is pre-selected" can only mean the OPT-IN modules, since every instance already boots with the same sixteen `default: true` core-domain ones — so a bundle is a short list of opt-in module keys layered on that floor, preselected and freely toggled off by R20's picker ([task 1002339](https://cloudbongos.com/builders#/task/1002339)). **The key is the DECLARED type, and the seeded vocabulary is stale:** the task text (2026-07-17) names *Game / SaaS-Tool / Community*, but task [1002772](https://cloudbongos.com/builders#/task/1002772)'s owner decision (2026-08-13) fixed the live closed set as `game · research · business · non-profit · not-sure` — two CHECK constraints, two `PROJECT_TYPES` constants and five wizard buttons — and "community" survives only as a `team_shape`. Two constraints ride the key: the arrow runs **type → modules, never back** (1002772 rejected inferring type from module flags, which flip all through setup), and the R15 interview must **not re-ask** what `type` declares, so R19 adds no `PROJECT_DETAIL_VOCAB` key and no migration. `not-sure` and *undeclared* resolve to the same modules but are deliberately different answers — `type` is nullable precisely so "nobody said" is never back-filled with a guess, and the resolver returns `type: null` with its own copy. **The declaration is pinned by a test, not a runtime catalog read:** a module may not import `src/module-loader/catalog.js` (the one-way rule, [ADR 0083](<redacted>.md)), so `modules/provisioning/starter-bundles.js` stays PURE like `onboard-plan.js` beside it and `tests/provisioning_starter_bundles.mjs` reads every `modules/*/module.json` off disk — failing the build if a bundle names a module that does not exist, if `ALWAYS_ON_CORE` drifts from the manifests' `default: true` set, if a bundle names an always-on module (a preselect that toggles nothing), or if it names one of the two hub-only modules. The bundles are `game → dev-box, discord`; `research → agents`; `business → agents, dev-box`; `non-profit → discord`; `not-sure → —`, and they are SHORT because today's opt-in catalog is three modules wide and a preselect an owner must audit is worse than none. Served whole at public `GET /provisioning/starter-bundles` (`{ core, bundles }`, same absent gate as `onboard-plan`) so the picker re-preselects without a refetch and R17's recommendations read the same shape. A bundle is **never a publish precondition** — [ADR 0182](<redacted>.md) D4 fixes that bar at name + description alone. Rejected: a runtime catalog read, a `bundle` key in the interview vocabulary, inferring the bundle from the description (the deferred AI layer, [task 1003500](https://cloudbongos.com/builders#/task/1003500)), and keeping the seeded Game/SaaS-Tool/Community triple.](<redacted>.md) | provisioning / project creation |
 
 > ⚠️ **Numbering collisions are now machine-enforced, not narrated.** Twenty numbers are shared by two ADRs each — assigned in parallel sessions before anything checked. The files keep their filenames (renumbering would break every existing citation, and a number once assigned is never reused), and this table disambiguates each pair as `NNNN-a` / `NNNN-b`. The authoritative list is `LEGACY_DUPLICATE_ADRS` in [`scripts/gds/adr-namespace.js`](../../scripts/gds/adr-namespace.js), frozen by exact filename: a **new** collision — or a third file joining a legacy number, or a rename of either half — hard-fails the `unit` CI gate, as does an index row that points at no file or an ADR with no row. The list may only shrink. This paragraph used to narrate the collisions one by one and had fallen eight behind reality; see [ADR 0195](<redacted>.md) for why the check exists and why the pairs are grandfathered rather than renumbered.

package/docs/api/openapi.json

@@ -10859,7 +10859,7 @@
           "projects"
         ],
         "summary": "PATCH /projects/:id/featured",
-        "description": "the feature / unfeature control (the ADR 0141 §5 curation gate).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `project.curate` (all required).",
+        "description": "the feature / unfeature control (the ADR 0141 §5 curation gate), BOUNDED BY THE PUBLISH GATE (ADR 0182 D3, task 1002335). Featuring ranks among projects already on the map; it is not a way ONTO it, so featuring a dark-matter row is refused — and the refusal names the identity field that is missing rather than merely saying no (D4). Un-featuring is never refused.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `project.curate` (all required).",
         "x-rank": "metic+archon",
         "x-source": "modules/platform-identity/routes/projects.js",
         "x-permissions": [
@@ -11728,6 +11728,34 @@
         ]
       }
     },
+    "/provisioning/starter-bundles": {
+      "get": {
+        "operationId": "get_provisioning_starter_bundles",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "GET /provisioning/starter-bundles",
+        "description": "GET /provisioning/starter-bundles — the curated module preset for each declared project type (BV1.R19, task 1002338; goal 1000046 criterion `proj-module-select`). Returns the always-on core once, then one resolved bundle per type: `{ type, label, summary, core, bundle, modules }`. The whole table in one read, because the creation picker (R20, task 1002339) re-preselects as the owner flips the type question and must not refetch to do it; R17's rule engine reads the same shape so a recommendation and a preselect can never name different modules. A DECLARATION, not a query — modules/provisioning/starter-bundles.js is pure, so this route touches no database and no per-request state. rank: public — the signed-out hub wizard (/projects?view=new) reads it while choosing a type, exactly like onboard-plan above; no write, no secret, and the module catalog it names is already public at GET /public/modules.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/provisioning/routes/provisioning.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetProvisioningStarterBundlesResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
     "/provisioning/tls-check": {
       "get": {
         "operationId": "get_provisioning_tls_check",
@@ -16984,6 +17012,17 @@
           "address"
         ]
       },
+      "GetProvisioningStarterBundlesResponse": {
+        "type": "object",
+        "properties": {
+          "core": {},
+          "bundles": {}
+        },
+        "required": [
+          "core",
+          "bundles"
+        ]
+      },
       "GetPublicBlockersIdResponse": {
         "type": "object",
         "properties": {
@@ -17905,13 +17944,15 @@
           },
           "description": {},
           "detail": {},
-          "options": {}
+          "options": {},
+          "publish": {}
         },
         "required": [
           "ok",
           "description",
           "detail",
-          "options"
+          "options",
+          "publish"
         ]
       },
       "PatchProvisioningInstancesIdSettingsResponse": {
@@ -21756,9 +21797,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 345,
-  "x-schema-count": 377,
+  "x-endpoint-count": 346,
+  "x-schema-count": 378,
   "x-undocumented-bodies": 9,
-  "x-response-schemas": 257,
+  "x-response-schemas": 258,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }