@bongos/core 1.19.509 → 1.19.511

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.509",
-  "core_contract": "1.19.509",
-  "source_commit": "9605bf28928f63695da44f2f5033d52569701f0c",
+  "core_version": "1.19.511",
+  "core_contract": "1.19.511",
+  "source_commit": "3a3d1626dee489511d9d444d6cd3c78620a5fffd",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T18:27:19.784Z",
+  "built_at": "2026-09-03T18:50:51.590Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 427,
+    "docs_redacted": 428,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1949,
+    "functional_verbatim": 1951,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2400,
-  "tree_sha256": "8caa606e95cdf39a34d1b4f654b3b415dc9e699d7c1a058a9281097e297ae916",
+  "file_count": 2403,
+  "tree_sha256": "61291b79de3b99190857d7ed49c124e41ac765c57c9ad792cf8cfa1e62f002cb",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -362,12 +362,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "7904ca2bfec8710c90bd846edb4c0b50436eebc29fcb87897eea69fea09d1001"
+      "sha256": "146ce9d114ec7d5a90413713b8604843c42eac060dd943648412868e214a1a6e"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "4f6b441e36573c71d391a24b76247df79db02a46bf719965bee22051a90c916f"
+      "sha256": "0e3fb901fd7110352e0edb686cfd8824d71687b88bd7e42269d0fe855177ac9f"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -377,17 +377,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "193252b5fb3be984786b23507a400564dfd6ad1899b0778b436882b8b28de39e"
+      "sha256": "19f11ecf8c9eda49cd1f2ac2425f1d3d9772ad46495305d9ae4bdeadf4695ea2"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "2507501215b31032378a856f4a26791921b3e618baedaaa1d6934df458d3023b"
+      "sha256": "4ced11579608e8fdb481a07b5555c41b3cbf3018cb3a8bd7697fb58368283bf0"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "1bf4942a3074fa90887b3efdcff39bde587abc6d8b70b4b83a2dea149beaa85a"
+      "sha256": "3d5868d134bce56923b8f0270fbb2e988dea5b6a5ea1a00b96ff8bcde06bb40e"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1672,7 +1672,7 @@
     {
       "path": "docs/adr/0233-a-copy-proposal-is-a-task-carrying-a-patch.md",
       "mode": "0000644",
-      "sha256": "69db7f69b30eb87a8b8e921ea664344faf7b953c7a85ce9d788282a0e181dbd1"
+      "sha256": "ab2970017b4776ee7d0be1ee22933d86123f57b8935a1f1bb0844e5f367fae07"
     },
     {
       "path": "docs/adr/0234-idea-routing-capture-time-promotion-landing-matrix-homeless-inbox.md",
@@ -1689,20 +1689,25 @@
       "mode": "0000644",
       "sha256": "87b350049a0ed1b7be0c58fc2ae6ecd18a077b21ca689563a8763f925a37eef6"
     },
+    {
+      "path": "docs/adr/0237-a-starter-bundle-is-a-preset-over-the-always-on-core-keyed-by-declared-type.md",
+      "mode": "0000644",
+      "sha256": "10534e533c2c70baf670048fb38e18ddedb36925312806afbae9941a9c958667"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "16d284a7a9b1b70f1ba2aa3550a380ed76ace41b985c5f6a309c9899acf6b5f8"
+      "sha256": "e6b0e3bc8becec5ed9c7384596e205cc5a78e6145da244c8d6d2c1d5a4514380"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "91a31987ff13dd0757ec86db23b6cf86ea4cb95833d702ac7070b75ed4354b49"
+      "sha256": "f9a893262b5112e48a8bffa455c8e1a7ce8aed663e34141ef9c48117882a2ad7"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "42d2388b2d327331b2e78f29dfdbf6db517c9625238a93606a050de74d03ecec"
+      "sha256": "ec2d400cae26a7b89f644e978840927fd0fb88fc0b7b94e9f0d00dd19955aaf2"
     },
     {
       "path": "docs/architecture.md",
@@ -2577,7 +2582,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "52cb03d41b0eb38da33a436b0ca2912d2b087b33ab3675aca404a77767fdeb34"
+      "sha256": "2e35f3f9c7c2c961b5c8274d20202664564cb33d59b046ef4d2e190c15c05afe"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3692,7 +3697,7 @@
     {
       "path": "modules/copy-desk/proposals.js",
       "mode": "0000644",
-      "sha256": "b05aefb7fb7f965b92389986b6e53991823abb8c1e8a03e88637ef3d065100c0"
+      "sha256": "de674674cf2f80fb36569cad67be4f1ba3a94e938b690b8f1d0c96446df346bf"
     },
     {
       "path": "modules/copy-desk/registry.js",
@@ -3702,7 +3707,7 @@
     {
       "path": "modules/copy-desk/routes/copy-desk.js",
       "mode": "0000644",
-      "sha256": "1d371bc5e850f12a1e261eb1d4409cb4462943ad0020ae629a3858d2f7063235"
+      "sha256": "7231f021bb49bd78cb247a6d8e8a0f6e9256ade52f2f9bb1438b54b6ddf400f8"
     },
     {
       "path": "modules/copy-desk/tests/copy_flags.mjs",
@@ -3717,7 +3722,7 @@
     {
       "path": "modules/copy-desk/tests/copy_proposals.mjs",
       "mode": "0000644",
-      "sha256": "86b7f54494e94407745e46290263ed4463fdb10e5d320276bcb199667ca52097"
+      "sha256": "e435042dea0436e0f4fa7f2a95b16b8647ff0723290741e26776e76c9d1c6973"
     },
     {
       "path": "modules/copy-desk/tests/copy_queue.mjs",
@@ -3947,7 +3952,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "193252b5fb3be984786b23507a400564dfd6ad1899b0778b436882b8b28de39e"
+      "sha256": "19f11ecf8c9eda49cd1f2ac2425f1d3d9772ad46495305d9ae4bdeadf4695ea2"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -5232,7 +5237,7 @@
     {
       "path": "modules/lifecycle/conflict-resolve.js",
       "mode": "0000644",
-      "sha256": "b9e3c44a7f68ec728bb6a59122dd43f87d64931b776bab3cbbba9aad2be78f28"
+      "sha256": "1a281a4233b3805550a05ed6bd38b163ab18db658d48675f055b90d2ba722a16"
     },
     {
       "path": "modules/lifecycle/criterion-suggest.js",
@@ -5977,7 +5982,12 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "aafd317ed353c3aa6b28fc6432d13758f3305fb7593aaaa8271555b658245a01"
+      "sha256": "338e135f492e584aa4539d4a64d7c881b964c9ffa8428ff3359ad96d80b82a5c"
+    },
+    {
+      "path": "modules/provisioning/starter-bundles.js",
+      "mode": "0000644",
+      "sha256": "760382a3e361692f9d8457f88122fda498eb6bccecd37b351837fa5c4fa5e6f4"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -6227,7 +6237,7 @@
     {
       "path": "modules/public-landing/public/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "40013b1065a87cbe6c5916bf20c4971ce8bac5811d22993a70b322cf9baf2d36"
+      "sha256": "bb2fa6d0a1c87aeb3e08038faf1d3ae0f06a1a41f9fe6d83f357146bc7e73045"
     },
     {
       "path": "modules/public-landing/public/assets/verro-medallion.png",
@@ -7232,12 +7242,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "da37c28e1647b70c11a589446419029d7dd7f05218cf88b0f357599aa1903836"
+      "sha256": "0c5b45784b5275f6c58d456a275a390b6ef111efbcc1fb7653750120a8a84981"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d468e341086d86826eccaa2a062e84c3199ae2e7169bb1e97dfa46a7e00e4589"
+      "sha256": "2605b735d7f5d07c4eb993212d4901e7043138693d4d2bb56492f9fb18c0baf0"
     },
     {
       "path": "public-docs/index.html",
@@ -7522,7 +7532,7 @@
     {
       "path": "scripts/gds/copy-apply.js",
       "mode": "0000644",
-      "sha256": "4b99eabcfcb8c6c472a2161427fc22a43b3208b5fbfc1ffe097e8f1926a44216"
+      "sha256": "05326c8016794742acc10a95ae0f1c7b630581231a7f0f86aef449a8c17c2c40"
     },
     {
       "path": "scripts/gds/copy-inventory.js",
@@ -7752,7 +7762,7 @@
     {
       "path": "scripts/gds/git-merge-regen.js",
       "mode": "0000644",
-      "sha256": "f9a391ac6f32b2d5ca939b48186b6d9cb7aa171554652a5b5afbc4a408aae203"
+      "sha256": "f6f9c93faeb589d07105027655e42bd842d8d766119812b16bd534d58aa50816"
     },
     {
       "path": "scripts/gds/go-live.js",
@@ -8907,7 +8917,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "fc08dfd1d74b0e89c903f8365f1e969286dbe2af19b75cf0a75f47e54d97fd0a"
+      "sha256": "ac752bde3af7292c3b4a1857045652f7d3badf0d1bbdf02cf3fd47f2ac8c40fc"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9502,7 +9512,7 @@
     {
       "path": "tests/conflict_resolve.mjs",
       "mode": "0000644",
-      "sha256": "69f4e40c66e49e4d2c58f1f41ec1c515b2cb44891e40b6192ed898484d10671d"
+      "sha256": "7ad7be450b9350e7888f075944888ddf2a0e2d57a23568f410a9ff17bd340dec"
     },
     {
       "path": "tests/connections_api.mjs",
@@ -9897,7 +9907,7 @@
     {
       "path": "tests/git_merge_regen.mjs",
       "mode": "0000644",
-      "sha256": "2d3574914c1f9c843396f498a8e68c2fd8ec2a5bc574c98f64dc2505aa1ccba8"
+      "sha256": "f4e7ab5eec2d13404080c408c0a70819c4b398b38fa61474b9c4cc57069d119b"
     },
     {
       "path": "tests/github_push_ancestry.mjs",
@@ -11102,7 +11112,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "2cdad6b12240d3556614aa0e77874f41651e59884f1b07bd9af664334eb90c20"
+      "sha256": "712e02763f7e9f3e6f4acc17a5a757a4aee11e9234909dcf50923b85679e09e6"
     },
     {
       "path": "tests/projects_hub_pre_uat.mjs",
@@ -11179,6 +11189,11 @@
       "mode": "0000644",
       "sha256": "1623d2dff20d7b5843f9fd39dd91c35e4a8ebe10b60cf798e01a7fbc4b0202cf"
     },
+    {
+      "path": "tests/provisioning_starter_bundles.mjs",
+      "mode": "0000644",
+      "sha256": "0d3dadff4425e8d014cca29c66c31ff094e78ffbf2fd246f56ba11c5e1cefc93"
+    },
     {
       "path": "tests/provisioning_teardown_intent.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 345 operations across 53 resource groups
+- 346 operations across 53 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -671,6 +671,8 @@ function createClient(opts = {}) {
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
+      // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles
+      getProvisioningStarterBundles: (args) => request("GET", "/provisioning/starter-bundles", { hasBody: false }, args),
       // GET /provisioning/tls-check — rank: public — GET /provisioning/tls-check
       getProvisioningTlsCheck: (args) => request("GET", "/provisioning/tls-check", { hasBody: false }, args),
     },

package/clients/bongos-client/index.cjs

@@ -670,6 +670,8 @@ function createClient(opts = {}) {
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
+      // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles
+      getProvisioningStarterBundles: (args) => request("GET", "/provisioning/starter-bundles", { hasBody: false }, args),
       // GET /provisioning/tls-check — rank: public — GET /provisioning/tls-check
       getProvisioningTlsCheck: (args) => request("GET", "/provisioning/tls-check", { hasBody: false }, args),
     },

package/clients/bongos-client/index.d.ts

@@ -98,6 +98,7 @@ export interface GetProvisioningInstancesIdSettingsResponse { ok: boolean; setti
 export interface GetProvisioningInstancesResponse { instances: unknown }
 export interface GetProvisioningOnboardPlanResponse { mode: unknown; steps: unknown }
 export interface GetProvisioningSlugAvailableResponse { slug: unknown; available: unknown; reason: unknown; address: unknown }
+export interface GetProvisioningStarterBundlesResponse { core: unknown; bundles: unknown }
 export interface GetPublicBlockersIdResponse { blocker: unknown }
 export interface GetPublicBountyTableResponse { table: unknown; currency: unknown }
 export interface GetPublicGradesResponse { window_days: unknown; rolling: unknown; trend: unknown; attempts: unknown; threshold: unknown; grader_version: unknown }
@@ -981,6 +982,8 @@ export interface BongosClient {
     getProvisioningOnboardPlan(args?: RequestArgs): Promise<GetProvisioningOnboardPlanResponse>;
     /** GET /provisioning/slug-available — rank: any-builder */
     getProvisioningSlugAvailable(args?: RequestArgs): Promise<GetProvisioningSlugAvailableResponse>;
+    /** GET /provisioning/starter-bundles — rank: public */
+    getProvisioningStarterBundles(args?: RequestArgs): Promise<GetProvisioningStarterBundlesResponse>;
     /** GET /provisioning/tls-check — rank: public */
     getProvisioningTlsCheck(args?: RequestArgs): Promise<ApiResponse>;
   };

package/clients/bongos-client/index.mjs

@@ -667,6 +667,8 @@ export function createClient(opts = {}) {
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
+      // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles
+      getProvisioningStarterBundles: (args) => request("GET", "/provisioning/starter-bundles", { hasBody: false }, args),
       // GET /provisioning/tls-check — rank: public — GET /provisioning/tls-check
       getProvisioningTlsCheck: (args) => request("GET", "/provisioning/tls-check", { hasBody: false }, args),
     },

package/docs/adr/0233-a-copy-proposal-is-a-task-carrying-a-patch.md

@@ -114,7 +114,12 @@ afterwards buys a port widening and a failure mode for a string.
 So the bare call, `node scripts/gds/copy-apply.js`, acts on **the task the caller is holding**.
 Holding no claim is a named refusal that says to claim it first. The command may only run under a
 claim — that is the whole feature — and a claim already names a task, so the constraint and the
-ergonomics are the same fact. `--task <id>` remains for someone holding several.
+ergonomics are the same fact. `--task <id>` remains for someone holding several — and it is *checked*
+against the same claim list the bare call reads, refusing `claim_not_held` for a task the caller does
+not hold. It shipped unchecked (task 1003493 fixed it): a rule stated in this ADR, in the module's
+`CLAUDE.md` and in the script's own header, enforced on one of its two paths, is the kind of claim
+that rots. The one path with no claim to prove is `--patch-file`, a local JSON patch used by the
+tests, which lands nothing a proposal task authorised.
 
 ### 7. Proposing is open to every rank, and lands in `backlog`
 
@@ -130,7 +135,16 @@ before anyone can claim it. Landing it `ready` would let anyone with an opinion
 ## Consequences
 
 - **The write surface of `copy-desk` is now three verbs, not two**, and `tests/copy_no_cms.mjs` says so
-  in a diff a reviewer can see — which is exactly what R02 built that list for.
+  in a diff a reviewer can see — which is exactly what R02 built that list for. To be exact about what
+  that test proves (task 1003493): it pins that no route **in this module** can write a rendered
+  string, which is narrower than "no route can write a rendered string to production directly". That
+  is the right scope for the feature — the module is the write surface this ADR adds — but the wider
+  claim is not something a module-scoped test can carry, and reading it as if it were is how a
+  no-CMS guarantee quietly becomes an assumption.
+- **A proposal lands only in the version being BUILT.** `proposals.resolveTargetVersion` returns the
+  `building` version or `null`, and the route refuses `no_open_version` — there is deliberately no
+  "first version in the list" fallback (task 1003493), because that row can be a shipped version, and
+  a proposal landing on sealed history is worse than a proposal that was not accepted.
 - **`scripts/gds/copy-apply.js` is the only thing in this feature that writes a surface file**, it is a
   command rather than a route, and the test asserts no file in the module's request path imports it.
   Naming it is fine and required: the task tells its claimer the exact line to run.

package/docs/adr/0237-a-starter-bundle-is-a-preset-over-the-always-on-core-keyed-by-declared-type.md

@@ -0,0 +1,137 @@
+# 0237 — A starter bundle is a preset over the always-on core, keyed by the declared project type
+
+- **Status:** Accepted
+- **Date:** 2026-09-03
+- **Tasks:** [#1002338](https://cloudbongos.com/builders#/task/1002338) (this decision — BV1.R19)
+- **Goal:** [#1000046](https://cloudbongos.com/builders#/goal/1000046) — Project creation: visibility and
+  customization, criterion `proj-module-select` ("during setup a default set of modules is pre-selected…")
+- **Related:** [ADR 0083](<redacted>.md) (the one-way import rule that
+  keeps this file pure), [ADR 0107](<redacted>.md) +
+  [ADR 0167](<redacted>.md) (the module catalog a bundle names into),
+  [ADR 0182](<redacted>.md) D4 (the publish bar a bundle may not join),
+  task [#1002772](https://cloudbongos.com/builders#/task/1002772) (the declared project type),
+  task [#1002334](https://cloudbongos.com/builders#/task/1002334) (R15, the detail interview)
+
+## 1. The problem
+
+Criterion `proj-module-select` opens with "during setup a default set of modules is
+pre-selected." Every Cloud Bongos instance already boots with the same always-on
+core — the sixteen `default: true` modules a project cannot sensibly run without —
+so "pre-selected" can only mean the **opt-in** modules layered on top. An owner
+creating their first project has met none of them, and asking them to read a
+twenty-one-row catalog before they have a repo is the version of customization
+that gets skipped.
+
+R19 is the data that answers it. R20 ([#1002339](https://cloudbongos.com/builders#/task/1002339))
+renders the picker, R21 searches the catalog, R17/R22 recommend from the interview
+answers, R23 adds modules later — four consumers, one table underneath.
+
+## 2. Keyed by the DECLARED type, not by anything inferred
+
+The task text (seeded 2026-07-17) names three bundles: *Game / SaaS-Tool /
+Community*. That vocabulary was superseded four weeks later. Task
+[#1002772](https://cloudbongos.com/builders#/task/1002772) settled the closed
+project-type set by owner decision on 2026-08-13 — **`game` · `research` ·
+`business` · `non-profit` · `not-sure`** — and it is the live one: a CHECK on
+`platform_identity_projects.type`, a matching CHECK on
+`provisioning_instances.type`, `PROJECT_TYPES` in both modules, and five buttons in
+the create wizard. "Community" survives, but as a **team shape**
+(`PROJECT_DETAIL_VOCAB.team_shape ∈ solo | small-team | community`), not a project
+type. Bundles key off the shipped vocabulary; the seeded triple is recorded here as
+history so the divergence is not read later as an omission.
+
+Two constraints come with that key and neither is negotiable:
+
+- **The arrow runs type → modules, never back.** Task 1002772 explicitly rejected
+  deriving a project's type from its enabled module set, because flags flip all
+  through setup and a half-configured project would show a confidently wrong type.
+- **The interview does not ask a second time.** R15 wrote that into its own
+  vocabulary comment: "the module bundle R19 recommends comes off the
+  separately-declared `type`, so the interview deliberately does not ask it a
+  second time." So R19 adds no key to `PROJECT_DETAIL_VOCAB` and no migration —
+  the `detail` jsonb column stays reserved for answers an owner actually gave.
+
+`not-sure` and *undeclared* resolve to the same modules (the core, nothing else)
+and are deliberately **not** the same answer: `type` is nullable because every row
+predates the field and must never be back-filled with a guess, so `bundleForProjectType(null)`
+returns `type: null` with its own copy. A picker can tell "the owner said not sure"
+from "nobody asked yet"; conflating them would be the same invention the nullable
+column exists to prevent.
+
+## 3. A declaration pinned by a test, not a read of the live catalog
+
+The natural implementation is to resolve bundles against
+`src/module-loader/catalog.js` — the one model the hall's Modules tab and
+`bongos module list` both build from, so they cannot drift (ADR 0167). A module may
+not import it: `src/module-api.js` is the only core file a module may require (ADR
+0083's one-way rule) and the doorway exposes no catalog.
+
+So `modules/provisioning/starter-bundles.js` **declares** its module keys and stays
+pure — no I/O, no core import, no sibling import — exactly like `onboard-plan.js`
+beside it. The link back to the catalog is a test, not a runtime read:
+`tests/provisioning_starter_bundles.mjs` reads every `modules/*/module.json` off
+disk and fails the build if a bundle names a module that does not exist, if
+`ALWAYS_ON_CORE` drifts from the manifests' `default: true` set, if a bundle names
+an always-on module (a preselect that toggles nothing but reads to the owner as a
+choice), or if it names one of the two hub-only modules. A test is the right
+enforcement point here because the failure is a *build-time* fact — the manifests
+are in the same commit as the declaration — and buying it at runtime would cost the
+purity that lets a script, a route and a test all read the same answer.
+
+## 4. What the bundles are, and why they are short
+
+| type | bundle (opt-in additions) |
+|---|---|
+| `game` | `dev-box`, `discord` |
+| `research` | `agents` |
+| `business` | `agents`, `dev-box` |
+| `non-profit` | `discord` |
+| `not-sure` | — |
+
+Today's opt-in catalog is genuinely three modules wide (`agents`, `dev-box`,
+`discord`; `platform-identity` and `provisioning` are the control plane's own and
+are refused by construction). That is why this is a **declaration and not a rule
+engine** — a bundle grows as the catalog does, and R17/R22 own the layer that
+reasons. A preselect an owner has to audit is worse than none.
+
+`dev-box` is preselected on two types despite costing money to *use*: enabling the
+module opens the door, it provisions nothing and bills nothing until a builder asks
+for a box, and the picker toggles it off in one click.
+
+## 5. The read surface
+
+`GET /provisioning/starter-bundles` returns `{ core, bundles }` — the always-on
+floor once, then every type resolved as
+`{ type, label, summary, core, bundle, modules }`. The whole table in one read,
+because the picker re-preselects as the owner flips the type question and must not
+refetch to do it, and because R17's recommendations and R20's preselect reading the
+same shape is what stops them naming different modules.
+
+`rank: public`, the same (absent) gate as `GET /provisioning/onboard-plan` — the
+signed-out wizard reads it while choosing a type, it writes nothing, and the module
+catalog it names into is already public at `GET /public/modules`.
+
+## 6. Consequences
+
+- **A bundle is never a publish precondition.** [ADR 0182](<redacted>.md)
+  D4 fixes the bar at identity alone — a name and a description, "not tagline, art,
+  modules, governance, or a completed interview." Taking or declining a bundle
+  cannot move a project's dark-matter state.
+- **Nothing is stored yet.** R19 defines and serves; where a chosen selection lands
+  is R20's decision, and there is still no module-selection column on any table.
+- **Adding a module to the catalog is now a two-file change** if it belongs in a
+  bundle — the manifest and this declaration — and the integrity test says so out
+  loud when a manifest flips its `default`.
+
+## 7. Rejected
+
+- **Resolving against the live catalog at runtime** — costs the purity and breaks
+  the one-way rule for a fact that is fixed at build time.
+- **A `bundle` key in `PROJECT_DETAIL_VOCAB`** — R15 already ruled the interview
+  must not re-ask what `type` declares.
+- **Inferring the bundle from the free-text description** — that is the deferred
+  AI/semantic layer ([#1003500](https://cloudbongos.com/builders#/task/1003500)), and
+  the goal's own text pins the near term as rule-based.
+- **Naming the seeded Game / SaaS-Tool / Community triple** — three of those five
+  live types would then have no bundle, and two of the three names match nothing an
+  owner can pick.

package/docs/adr/README.md

@@ -324,5 +324,6 @@ This keeps the decision history honest and traceable.
 | 0234 | [**Idea routing: capture-time promotion, the landing matrix, and the homeless-only inbox** ([task 1003064](https://cloudbongos.com/builders#/task/1003064) · goal 1000071, "Idea routing"). Idea 1000771 named the failure: Discord `#bugs` created tasks DIRECTLY against a hardcoded, already-shipped version — no `captured_by`, no lineage, so the ideator-credit lane had nothing to pay against — while every other open idea sat waiting for a human triage pass that dropped its promotion into a version catch-all, because nothing in capture ever named a goal. Records what R01/R02/R05/R07/R13 shipped. `captureIdea` (`modules/ideas/inbox.js`) stays the ONE capture chokepoint — routing is one optional `goalId` argument, never a second creation door — and when the matrix routes, `routeIdeaToGoal` writes the idea row, the task (via the `lifecycle.createTask` port) and an `ideas_task_lineage` row (`origin='route'`) in ONE transaction, so a route can never mint attribution-free work the way `#bugs` did. `modules/ideas/routing.js`'s `decideLanding` is PURE and fail-closed: a bug from a Metic+ filer hard-lands `ready`, a sub-Metic bug or any other kind with a goal soft-lands `backlog`, a Full Idea or `criterion-proposal`/`decision` never routes, no goal named stays the pre-routing inbox path. `authorizeRoutedLanding` is the BINDING gate underneath the matrix's decision — a goal reaching protected scope raises the task's rank floor to Metic and REFUSES a sub-Metic filer outright, while membership is deliberately NOT required (reporting isn't authoring). `core_222`'s `suggested_goal_id` is an advisory hint only — the real home is `tasks.goal_id`, set by construction — and `/idea-triage` (`scripts/gds/triage.js`) now sends `goal_id` on promotion, so the inbox is homeless-only. Divergence recorded: R11 (Discord `#bugs`) hard-lands a linked Metic+ builder's bug immediately through the SAME shared matrix rather than the spec's "always soft-land, pending queue" design, because a local copy of the rank split would only drift from the one definition; and R12 (Discord `#ideas` hints) is NOT YET SHIPPED, so `#ideas` carries no goal hint today despite the interview decision that it should, hint-only, never route.](<redacted>.md) | ideas / lifecycle |
 | 0235 | [**A fix category is `kind='bug'` under a goal, not a new column** ([task 1003215](https://cloudbongos.com/builders#/task/1003215) · goal 1000071, "Idea routing" — the structural half of idea 1000828; task 1003214 shipped the advisory's first quiet case, task 1003157 extended it). A fix for something that should already work needs a home under an existing goal WITHOUT a new goal being born and WITHOUT a stored column restating what `tasks.kind` already says. Not a global "Bugs" goal either: a goal spanning every module makes the [ADR 0086](<redacted>.md) scope wall either everything or nothing, and a goal that can never reach `achieved` (a bug container never finishes) pollutes the exact signal [ADR 0183](<redacted>.md)'s auto-satisfy depends on. Not [ADR 0192 "a category orients and authorises nothing"](<redacted>.md) either, despite the structural resemblance: that decision forbids any gate from branching on a goal's category, while THIS decision is two decision surfaces deliberately branching on `kind='bug'` — `adviseGoal()` (`modules/lifecycle/goal-advisory.js`) goes silent for a bug under all three of its reasons (`no_goal`, `catch_all`, `no_criterion_link` — "a fix is the goal's 'fix category', not a delivery against one of its stated outcomes," its own doc comment) and `countTasksWithoutCriterionLink()` (`modules/lifecycle/db-deps-criteria.js`, surfaced on the hall's goal detail view) excludes `kind='bug'` from its count for the same reason. No hall/status change was needed for GROUPING bugs under a goal: every task card already renders its `kind` as a visible tag and the goal detail view's Filters already offer a `Kind` lens with `bug` as a value — verified against the live code, not built new. Rejected: a `tasks.category`/`fix_category` column or enum, a global cross-module "Bugs" goal, a bug-specific grouping widget beside the general-purpose kind facility that already works.](<redacted>.md) | ideas / lifecycle |
 | 0236 | [**Many ideas → one task: the lineage key is the pair** ([task 1003515](https://cloudbongos.com/builders#/task/1003515) · goal 1000071, "Idea routing" — promoted from idea 1000815; the table was built by [task 1002997](https://cloudbongos.com/builders#/task/1002997)). `ideas_task_lineage.task_id` was the PRIMARY KEY on the reasoning that "a task descends from at most one idea", and `linkIdeaTask` wrote `ON CONFLICT (task_id) DO UPDATE SET idea_id = EXCLUDED.idea_id` — so promoting a SECOND idea into a task that already had a link **silently replaced the first idea's lineage**: no error, no warning, no log line. Two ordinary triage promotes at one task were enough, and it happened on prod on 2026-08-21 (ideas 1000811 + 1000812 → task 1003150). Because this table is the rail [ADR 0172](<redacted>.md) stream 1 pays against, an overwritten row is an **ideator not paid** for work their idea produced, with nothing recording it — and it makes merging duplicate reports into one task a LOSSY move, which is the triage the inbox exists to encourage. The R01 grader named this shape and was told it was unreachable; it was unreachable on the ROUTING path examined and fully reachable on the ordinary PROMOTE path. **Decision: many ideas → one task is a real relation, so the key is the pair** — `ideas_006` re-adds `ideas_task_lineage_pkey` as `PRIMARY KEY (task_id, idea_id)` and both INSERT sites `DO UPDATE SET origin`, never `idea_id`. Refusing the second link would turn a legitimate merge into an error; logging the replacement keeps a lossy ledger. **Where one row is still required the EARLIEST link wins** (`ORDER BY created_at, idea_id`, stated in SQL rather than left to the planner): `sourceIdeaForTask`, `credits.awardIdeaTaskShipCredit`, and the nod queue's one-row-per-task predicate — one constant shared by the list and its count, so the pill can never disagree with the rows. Consequences: a task subsumed from N ideas **counts once toward each idea's** shipped-task credit (and cannot double-count within one — the pair is unique); the per-ship payout still names one idea, the earliest, because paying every co-source ideator is a decision about total worth, not a bug fix; the migration **backfills** from `idea_inbox.promoted_to_task_id`, the weaker pointer that survived each overwrite, labelling restored rows `origin='promote'`; and `updateIdea` still swallows a lineage failure but now reports it as a `LINEAGE GAP` through `api.logger` — a silent swallow on top of a silent overwrite was two layers of one mistake.](<redacted>.md) | ideas / economy |
+| 0237 | [**A starter bundle is a preset over the always-on core, keyed by the declared project type** ([task 1002338](https://cloudbongos.com/builders#/task/1002338) · goal 1000046, criterion `proj-module-select`). "During setup a default set of modules is pre-selected" can only mean the OPT-IN modules, since every instance already boots with the same sixteen `default: true` core-domain ones — so a bundle is a short list of opt-in module keys layered on that floor, preselected and freely toggled off by R20's picker ([task 1002339](https://cloudbongos.com/builders#/task/1002339)). **The key is the DECLARED type, and the seeded vocabulary is stale:** the task text (2026-07-17) names *Game / SaaS-Tool / Community*, but task [1002772](https://cloudbongos.com/builders#/task/1002772)'s owner decision (2026-08-13) fixed the live closed set as `game · research · business · non-profit · not-sure` — two CHECK constraints, two `PROJECT_TYPES` constants and five wizard buttons — and "community" survives only as a `team_shape`. Two constraints ride the key: the arrow runs **type → modules, never back** (1002772 rejected inferring type from module flags, which flip all through setup), and the R15 interview must **not re-ask** what `type` declares, so R19 adds no `PROJECT_DETAIL_VOCAB` key and no migration. `not-sure` and *undeclared* resolve to the same modules but are deliberately different answers — `type` is nullable precisely so "nobody said" is never back-filled with a guess, and the resolver returns `type: null` with its own copy. **The declaration is pinned by a test, not a runtime catalog read:** a module may not import `src/module-loader/catalog.js` (the one-way rule, [ADR 0083](<redacted>.md)), so `modules/provisioning/starter-bundles.js` stays PURE like `onboard-plan.js` beside it and `tests/provisioning_starter_bundles.mjs` reads every `modules/*/module.json` off disk — failing the build if a bundle names a module that does not exist, if `ALWAYS_ON_CORE` drifts from the manifests' `default: true` set, if a bundle names an always-on module (a preselect that toggles nothing), or if it names one of the two hub-only modules. The bundles are `game → dev-box, discord`; `research → agents`; `business → agents, dev-box`; `non-profit → discord`; `not-sure → —`, and they are SHORT because today's opt-in catalog is three modules wide and a preselect an owner must audit is worse than none. Served whole at public `GET /provisioning/starter-bundles` (`{ core, bundles }`, same absent gate as `onboard-plan`) so the picker re-preselects without a refetch and R17's recommendations read the same shape. A bundle is **never a publish precondition** — [ADR 0182](<redacted>.md) D4 fixes that bar at name + description alone. Rejected: a runtime catalog read, a `bundle` key in the interview vocabulary, inferring the bundle from the description (the deferred AI layer, [task 1003500](https://cloudbongos.com/builders#/task/1003500)), and keeping the seeded Game/SaaS-Tool/Community triple.](<redacted>.md) | provisioning / project creation |
 
 > ⚠️ **Numbering collisions are now machine-enforced, not narrated.** Twenty numbers are shared by two ADRs each — assigned in parallel sessions before anything checked. The files keep their filenames (renumbering would break every existing citation, and a number once assigned is never reused), and this table disambiguates each pair as `NNNN-a` / `NNNN-b`. The authoritative list is `LEGACY_DUPLICATE_ADRS` in [`scripts/gds/adr-namespace.js`](../../scripts/gds/adr-namespace.js), frozen by exact filename: a **new** collision — or a third file joining a legacy number, or a rename of either half — hard-fails the `unit` CI gate, as does an index row that points at no file or an ADR with no row. The list may only shrink. This paragraph used to narrate the collisions one by one and had fallen eight behind reality; see [ADR 0195](<redacted>.md) for why the check exists and why the pairs are grandfathered rather than renumbered.

package/docs/api/openapi.json

@@ -11728,6 +11728,34 @@
         ]
       }
     },
+    "/provisioning/starter-bundles": {
+      "get": {
+        "operationId": "get_provisioning_starter_bundles",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "GET /provisioning/starter-bundles",
+        "description": "GET /provisioning/starter-bundles — the curated module preset for each declared project type (BV1.R19, task 1002338; goal 1000046 criterion `proj-module-select`). Returns the always-on core once, then one resolved bundle per type: `{ type, label, summary, core, bundle, modules }`. The whole table in one read, because the creation picker (R20, task 1002339) re-preselects as the owner flips the type question and must not refetch to do it; R17's rule engine reads the same shape so a recommendation and a preselect can never name different modules. A DECLARATION, not a query — modules/provisioning/starter-bundles.js is pure, so this route touches no database and no per-request state. rank: public — the signed-out hub wizard (/projects?view=new) reads it while choosing a type, exactly like onboard-plan above; no write, no secret, and the module catalog it names is already public at GET /public/modules.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/provisioning/routes/provisioning.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetProvisioningStarterBundlesResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
     "/provisioning/tls-check": {
       "get": {
         "operationId": "get_provisioning_tls_check",
@@ -16984,6 +17012,17 @@
           "address"
         ]
       },
+      "GetProvisioningStarterBundlesResponse": {
+        "type": "object",
+        "properties": {
+          "core": {},
+          "bundles": {}
+        },
+        "required": [
+          "core",
+          "bundles"
+        ]
+      },
       "GetPublicBlockersIdResponse": {
         "type": "object",
         "properties": {
@@ -21758,9 +21797,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 345,
-  "x-schema-count": 377,
+  "x-endpoint-count": 346,
+  "x-schema-count": 378,
   "x-undocumented-bodies": 9,
-  "x-response-schemas": 257,
+  "x-response-schemas": 258,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 345 endpoints across 56 route files.
+> **Generated from the live route files** — the route file is authoritative. 346 endpoints across 56 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -442,7 +442,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/projects/featured` | `public` | — | a curated public showcase; no auth by design. |
 | POST | `/api/bongos/projects/invite` | `metic+archon` | `client_id`, `github_login` | invite a builder into a project (ADR 0141 §5, task #1002115). |
 
-## `provisioning` (19)
+## `provisioning` (20)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -464,6 +464,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/provisioning/instances/:id/teardown` | `any-builder` | — | POST /provisioning/instances/:id/teardown — request teardown of the caller's OWN instance. |
 | GET | `/api/bongos/provisioning/onboard-plan` | `public` | — | GET /provisioning/onboard-plan?mode=greenfield\|adopt&domain=<host> — the CANONICAL onboarding step sequence (task 2085; goal 35 / criteri… |
 | GET | `/api/bongos/provisioning/slug-available` | `any-builder` | — | GET /provisioning/slug-available?slug=<handle> — is this handle free to create under? rank: any authenticated builder (same gate as the c… |
+| GET | `/api/bongos/provisioning/starter-bundles` | `public` | — | GET /provisioning/starter-bundles — the curated module preset for each declared project type (BV1.R19, task 1002338; goal 1000046 criteri… |
 | GET | `/api/bongos/provisioning/tls-check` | `public` | — | GET /provisioning/tls-check?domain=<host> — the Caddy on-demand-TLS ALLOW-LIST (ADR 0111 §4, task P4 task 1945). |
 
 ## `public` (18)

package/docs/module-api-changelog.md

@@ -1455,5 +1455,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.507 with no explicit bump. run 33790206682. (task 1002620)
   1.19.509 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.508 with no explicit bump. run 33790542026. (task 1002620)
+  1.19.510 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.509 with no explicit bump. run 33791237400. (task 1002620)
+  1.19.511 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.510 with no explicit bump. run 33792868990. (task 1002620)
 ---------------------------------------------------------------------------
 ```