@bongos/core 1.19.511 → 1.19.513

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.511",
-  "core_contract": "1.19.511",
-  "source_commit": "3a3d1626dee489511d9d444d6cd3c78620a5fffd",
+  "core_version": "1.19.513",
+  "core_contract": "1.19.513",
+  "source_commit": "9e6d801ba8dcecaefcb3b75033642211d8275198",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T18:50:51.590Z",
+  "built_at": "2026-09-03T19:22:17.457Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 428,
+    "docs_redacted": 430,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1951,
+    "functional_verbatim": 1956,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2403,
-  "tree_sha256": "61291b79de3b99190857d7ed49c124e41ac765c57c9ad792cf8cfa1e62f002cb",
+  "file_count": 2410,
+  "tree_sha256": "a794da9ad6fee320c375a0fe3bea353d508f6d1fe6cba0dd1761da71a9ef5f32",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -362,12 +362,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "146ce9d114ec7d5a90413713b8604843c42eac060dd943648412868e214a1a6e"
+      "sha256": "546f5670b4637aa1d4c492a8616d5189a971c79e8e2e163d12fe11276292faa6"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "0e3fb901fd7110352e0edb686cfd8824d71687b88bd7e42269d0fe855177ac9f"
+      "sha256": "ae151ff268d04dced73fae1136c682215a02e59bae5edb68a3d6001c0143dd57"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -377,17 +377,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "19f11ecf8c9eda49cd1f2ac2425f1d3d9772ad46495305d9ae4bdeadf4695ea2"
+      "sha256": "72d841c53787c5ad83b214c2ac816fd4cb9c97b47329eb0417b80e660a9f6b02"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "4ced11579608e8fdb481a07b5555c41b3cbf3018cb3a8bd7697fb58368283bf0"
+      "sha256": "07554254c8559f81ec5cf45807ddccd8488732b228a618167455c932e7f05750"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "3d5868d134bce56923b8f0270fbb2e988dea5b6a5ea1a00b96ff8bcde06bb40e"
+      "sha256": "c4b04368e61803e2fe36f26ba3757aa75ada7e465384baf3e53cd012c9ce8423"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -397,7 +397,7 @@
     {
       "path": "config/branding.neutral.json",
       "mode": "0000644",
-      "sha256": "1b4d9952aebc5306b1ec212e05a72431ed1b4b0d36748a2fe547941a1e3f4a56"
+      "sha256": "c33b285d6a88d38eb15e062e0da845d29ec2aa7e6bfc5a4d321a3a49e0b7b2f9"
     },
     {
       "path": "config/design-tokens.neutral.json",
@@ -1694,20 +1694,30 @@
       "mode": "0000644",
       "sha256": "10534e533c2c70baf670048fb38e18ddedb36925312806afbae9941a9c958667"
     },
+    {
+      "path": "docs/adr/0238-the-join-door-is-a-provisioning-settings-policy-key.md",
+      "mode": "0000644",
+      "sha256": "fb05e36eb48861f2b32a38da04eba839f8141bd52ff9d913070bc589c115f9d5"
+    },
+    {
+      "path": "docs/adr/0239-a-recommendation-is-a-table-that-carries-its-own-reason.md",
+      "mode": "0000644",
+      "sha256": "42b20cd6d2e8a8d76c980df73087fd404487e4c479034dbe34d8297677bd9387"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "e6b0e3bc8becec5ed9c7384596e205cc5a78e6145da244c8d6d2c1d5a4514380"
+      "sha256": "cef542ef427dd81632465f17c6343c6b27f3ab69436eba2130c4fa4b5c9bc4ae"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "f9a893262b5112e48a8bffa455c8e1a7ce8aed663e34141ef9c48117882a2ad7"
+      "sha256": "af226ff669081accc330b8797ec6ac766bef9066a9fc97e834c66ad61fcec22c"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "ec2d400cae26a7b89f644e978840927fd0fb88fc0b7b94e9f0d00dd19955aaf2"
+      "sha256": "34cd50bf2154126c9a402235972642f4430281434852977c4e7277febc959a18"
     },
     {
       "path": "docs/architecture.md",
@@ -1732,12 +1742,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "c3c4bf94c9565778297efc223bd8a3d0adea4b96d6c484d516f21885532dcdaf"
+      "sha256": "0cc8ccfda8d8e3e7b518fae7a7584bb368d7d2eac6703518404d30f0b6ead30d"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "e757dec5eb8da4947297f2fdae06b460e888d6e7cad1a5d13d0dae5e03df4aa1"
+      "sha256": "1003ea51740a5f71af49e05c66ba088c337185680dd92a391c959e8ea76a3f40"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2582,7 +2592,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "2e35f3f9c7c2c961b5c8274d20202664564cb33d59b046ef4d2e190c15c05afe"
+      "sha256": "326d065772f944339af791ceb779b2724c0feef4d4937d1aa9e13c9bc5b8a38e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3952,7 +3962,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "19f11ecf8c9eda49cd1f2ac2425f1d3d9772ad46495305d9ae4bdeadf4695ea2"
+      "sha256": "72d841c53787c5ad83b214c2ac816fd4cb9c97b47329eb0417b80e660a9f6b02"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -4702,12 +4712,12 @@
     {
       "path": "modules/hall-ui/public/hall-kit.js",
       "mode": "0000644",
-      "sha256": "e392af98c2d310bfe80ccc560895dc2729abbe416087fcc7609d22dd4593484c"
+      "sha256": "9fdd4fa659a6ff1f36159a89a5bab9d12009b1624f7d72f8d1296d1dffff0d3f"
     },
     {
       "path": "modules/hall-ui/public/hall-render.js",
       "mode": "0000644",
-      "sha256": "d3ec5ebd2a4b60f0e87d82304920905021c6ee992e6a371516317da02f78ac3e"
+      "sha256": "e06761bf930a2b7bf8b0c4a3eba0532edb1a6f0d49d366b6889ebba9101e5d4f"
     },
     {
       "path": "modules/hall-ui/public/hall-widgets.js",
@@ -4902,7 +4912,7 @@
     {
       "path": "modules/hall-ui/public/profile-charts.js",
       "mode": "0000644",
-      "sha256": "865df71a66dd944006b01dfb1317778a1d733d9320b4486efd8ee1ed3ea76f19"
+      "sha256": "6eb791bb5d73e869f1af1dbabe6fbd04eccf970b54696a89a4cd1d28e6e705df"
     },
     {
       "path": "modules/hall-ui/public/profile-connections.js",
@@ -4917,7 +4927,7 @@
     {
       "path": "modules/hall-ui/public/profile.css",
       "mode": "0000644",
-      "sha256": "81712abfa291664378581139a3611acaff0ebdcd2cb77d641e8543d653080c30"
+      "sha256": "18d65cb2bab78487a4cbf2447154a69674291972d15256d338123c2a437abc87"
     },
     {
       "path": "modules/hall-ui/public/profile.html",
@@ -5052,7 +5062,7 @@
     {
       "path": "modules/hall-ui/public/style.css",
       "mode": "0000644",
-      "sha256": "287e9d4c4a2f57e812051dc6613d4c5ef493924c1a3de1b15fa91072128fa46e"
+      "sha256": "801d467a63d65c24877cac2741308590b9cd66530231f77bdf7230d1c4ebe513"
     },
     {
       "path": "modules/hall-ui/public/task-detail.js",
@@ -5092,17 +5102,17 @@
     {
       "path": "modules/hall-ui/public/watch.css",
       "mode": "0000644",
-      "sha256": "0c877cf6decf1b7291c877ec2e6c0603c5170cfecabf0d6be15a793b6858dad8"
+      "sha256": "ea2f7870bdd9383cfded8b2b09724486faa0793438dfa17bc52af189c8a81c6f"
     },
     {
       "path": "modules/hall-ui/public/watch.html",
       "mode": "0000644",
-      "sha256": "b20c001318da04ee5ca731702356479b0c7e4bffdd5784be9b1984db31d30777"
+      "sha256": "60ffce27ce4250223dc6bbaa22e1b7b9dfb4f689bd78b6ca1c75445088c5ddb9"
     },
     {
       "path": "modules/hall-ui/public/watch.js",
       "mode": "0000644",
-      "sha256": "0576fa65e1ac51a3928e1ac584532b9e4db1102513d35acc5e31c1afef66c32c"
+      "sha256": "f5d264fde6898c3cf82387d042d26fb434bbd8e60657c376b452f89b0a85435c"
     },
     {
       "path": "modules/hall-ui/public/watch.states.json",
@@ -5972,17 +5982,22 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "f68f397e4b3b1879c69f8b3369cfb499a270ca7f29963412da917f1185838981"
+      "sha256": "67eb2963688cba73fe846b354070e1e43333971425f603b1e84b45552b5381f0"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
       "mode": "0000644",
       "sha256": "27046325beffad5d1edfcc91c331048038900ef7d32f1d38796755c7990ba202"
     },
+    {
+      "path": "modules/provisioning/recommendations.js",
+      "mode": "0000644",
+      "sha256": "8c4b2d8d17b80229c371b82ac9a5a2cf2fa979683ac586e8b833ca0a309a92fc"
+    },
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "338e135f492e584aa4539d4a64d7c881b964c9ffa8428ff3359ad96d80b82a5c"
+      "sha256": "9285f3f2d426305c060eef4b3b98ae64fc386e4ce487f99d9ad59d9921dc493e"
     },
     {
       "path": "modules/provisioning/starter-bundles.js",
@@ -5997,7 +6012,7 @@
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
       "mode": "0000644",
-      "sha256": "559ae0d8025693a997a16012758236dbe895f28621de1a1a591d2a43fb21ff00"
+      "sha256": "03e4ba2a5625ac321a95392c91b8e90cc6f7e235dc9a0c4bbcb742cbd459b083"
     },
     {
       "path": "modules/provisioning/ui/.gitkeep",
@@ -6497,7 +6512,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "f744bab1254cec8220d3399c829bd566f8a6f2d07b412e531720476798837d7b"
+      "sha256": "8af95785b813eb27e6356fa717a4f20cb73f1220dd9ce15de2d62a18631afdd3"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -6932,7 +6947,7 @@
     {
       "path": "modules/ui-design/kit/serve.js",
       "mode": "0000644",
-      "sha256": "745fdc2ff5f72951b919ba49ab871b8cdbe0f09db73e79dfa248cd01e9232cdd"
+      "sha256": "efb50e76596a5ad009dab58d8e12b590382cc6bf1f819d0ab447cb14a4b4d6a3"
     },
     {
       "path": "modules/ui-design/kit/tells.js",
@@ -7242,12 +7257,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0c5b45784b5275f6c58d456a275a390b6ef111efbcc1fb7653750120a8a84981"
+      "sha256": "afcb15b2197925baf012e363e7af8de096c9e2f6bbdd6cf50015b4039a2e0441"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "2605b735d7f5d07c4eb993212d4901e7043138693d4d2bb56492f9fb18c0baf0"
+      "sha256": "a9827319a035ff87ca5805284b7296d80d1148390a3bb99ae03f46307a6952e8"
     },
     {
       "path": "public-docs/index.html",
@@ -8897,7 +8912,7 @@
     {
       "path": "src/branding.js",
       "mode": "0000644",
-      "sha256": "51d70cad3ef6955a0648f4467dd3e0ffa54d747d93b7a30301dce3c8afdbe1cb"
+      "sha256": "e603fa0fabe63b7150f649db1ecaa50ef0908a803396e808cf212f4378cbb053"
     },
     {
       "path": "src/build-info.js",
@@ -8917,7 +8932,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ac752bde3af7292c3b4a1857045652f7d3badf0d1bbdf02cf3fd47f2ac8c40fc"
+      "sha256": "86d6ba39dbe1e2b39067a2fd2328284fd950a9f9060450f87e55b3be84f5fef9"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9617,7 +9632,7 @@
     {
       "path": "tests/currency_label.mjs",
       "mode": "0000644",
-      "sha256": "e6e6f835296328e1055b048c6610c2c69853d311252365f904c6a3de4a2c4d59"
+      "sha256": "09a937b9a9550b77659c0e60b3bc44c45378fdb3545c510d7579d4711518a733"
     },
     {
       "path": "tests/cutover_codemod.mjs",
@@ -10297,7 +10312,7 @@
     {
       "path": "tests/hall_audit.mjs",
       "mode": "0000644",
-      "sha256": "7df5602bb92b44186613870501ecb4e959c9288f8d103cfc8075a3a24d51d840"
+      "sha256": "0b30e949b0479adb4b436aa32e741c9f2ab3925a1ac4327daf6e8a95700a8c14"
     },
     {
       "path": "tests/hall_board_world.mjs",
@@ -10319,6 +10334,11 @@
       "mode": "0000644",
       "sha256": "1d9c1d345a6fe25eacf810703a3e7f9f3b33f8e982aef49364e19eb4469de668"
     },
+    {
+      "path": "tests/hall_kit_charts.mjs",
+      "mode": "0000644",
+      "sha256": "475c712af2b45fed7863b486c3d2ed3b96e955dccb9acc5909999db3990843d5"
+    },
     {
       "path": "tests/hall_nav.mjs",
       "mode": "0000644",
@@ -10347,7 +10367,7 @@
     {
       "path": "tests/hall_profile_world.mjs",
       "mode": "0000644",
-      "sha256": "9e5047b39d55875e167c992157c6c04a9a766ec331c1a3bf343fe7ea194a8309"
+      "sha256": "b35d647c4cb7b90be70dee8e7245396cc901479992fafbf19ceef734d8195399"
     },
     {
       "path": "tests/hall_reading_world.mjs",
@@ -10397,7 +10417,7 @@
     {
       "path": "tests/helpers.mjs",
       "mode": "0000644",
-      "sha256": "89d0ebdf842108bcf807bd08663e9f83566d9b0ae80e72ba038f8d4f0b30b0f8"
+      "sha256": "b3f0a87c51c9e655c712db00a0a8763e2fc08e4de3c6904c6080385e7c7dad14"
     },
     {
       "path": "tests/hierarchy-config.mjs",
@@ -10627,7 +10647,7 @@
     {
       "path": "tests/joinability_invite_only.mjs",
       "mode": "0000644",
-      "sha256": "082693b5e07c1c25cec17cde7f93a8716aafa94ead9b1cee76b1643f30edff79"
+      "sha256": "5311e076e8a72b993a235e57ebc54c9ecd529ccd31b65609432677a12e15e85d"
     },
     {
       "path": "tests/joinability_open.mjs",
@@ -11099,6 +11119,11 @@
       "mode": "0000644",
       "sha256": "6a7a223a678b56333befaed017429e5b9d8a81e4405efae72a23355902517d9d"
     },
+    {
+      "path": "tests/project_door_ui.mjs",
+      "mode": "0000644",
+      "sha256": "29f59ab64b231a7ec5d17a3e784d451f75d80c19efd4cb6a523d263e8f88b581"
+    },
     {
       "path": "tests/project_stats.mjs",
       "mode": "0000644",
@@ -11112,12 +11137,12 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "712e02763f7e9f3e6f4acc17a5a757a4aee11e9234909dcf50923b85679e09e6"
+      "sha256": "eeb54786e5cb1211f0036d7c72119082fe47c023502c017b0092c6b22f60f0c1"
     },
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "033c9054a24f5ef93694fc4c9db54d4790e9e342d2e36fda78075d6a9d3252e9"
+      "sha256": "fef872ed80c7efdbf37e0672067f555c76aa17368a515afb99b1fa7e7ca3c4b4"
     },
     {
       "path": "tests/promote_goal_id.mjs",
@@ -11142,7 +11167,7 @@
     {
       "path": "tests/provision_settings_apply.mjs",
       "mode": "0000644",
-      "sha256": "9666ed868774ebe49a76b15b9de6db17ac93af23a740c3384e25b73b4536cc58"
+      "sha256": "9a04386b3047177bb55b6d392db88764f06f92e5c0b20c16ed9e0f8ce520b07d"
     },
     {
       "path": "tests/provisioning_default_domain.mjs",
@@ -11164,6 +11189,11 @@
       "mode": "0000644",
       "sha256": "97d04ee39cc06b720d4a5b42f3e3cc614f64d9462b27471a1af7598b5e2929be"
     },
+    {
+      "path": "tests/provisioning_recommendations.mjs",
+      "mode": "0000644",
+      "sha256": "0557876002c1f0efde5a8e7c87702fa57df3a9efb26ea93b077969bcc10e3637"
+    },
     {
       "path": "tests/provisioning_restart.mjs",
       "mode": "0000644",
@@ -11172,17 +11202,17 @@
     {
       "path": "tests/provisioning_settings.mjs",
       "mode": "0000644",
-      "sha256": "ffc902b4296017dd9069a17d2a098053f2d3de08dfade2b93ec5f72866b55eb7"
+      "sha256": "6f78a45d0c68a0da780d40c602f23bca3d48a80524218d4d7d311b2f8574dbee"
     },
     {
       "path": "tests/provisioning_settings_apply.mjs",
       "mode": "0000644",
-      "sha256": "f36148bcb14a666c95ddc4f0ac4d59af2e5409db01fcf338930a813a7f383f76"
+      "sha256": "c453bab3768953257be481cb8df700530f964e167fdca073cf4ae69892930a79"
     },
     {
       "path": "tests/provisioning_settings_env.mjs",
       "mode": "0000644",
-      "sha256": "4c8f1c7bdec5a063bcd3e76f4d43245c9491e3b8529593cdfaf33a3fbc85e319"
+      "sha256": "4f51ea07fe3d80d52d6998547b028bec0a97267210faeffd75d9a47f7b5643e8"
     },
     {
       "path": "tests/provisioning_slug_available.mjs",
@@ -11837,7 +11867,7 @@
     {
       "path": "tests/task_detail_ui.mjs",
       "mode": "0000644",
-      "sha256": "5e7150f8651a3c147b17f51800f5f8afa1e9534b3ec545584e5c37792475b2aa"
+      "sha256": "d7b12d56b50a0412d50f3558065c681d92c0c631edfef5553164e646979e6fa5"
     },
     {
       "path": "tests/task_goal_link.mjs",
@@ -11994,6 +12024,11 @@
       "mode": "0000644",
       "sha256": "745a868a2e13f34afd29f96840102205792bac810f2fd911c7da00f6a5695242"
     },
+    {
+      "path": "tests/watch_applications_queue.mjs",
+      "mode": "0000644",
+      "sha256": "b1f7df5aa40b89f8737c76d94def15c539514f7f439cca79a034bf37b922158d"
+    },
     {
       "path": "tests/web_admission_status.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 346 operations across 53 resource groups
+- 347 operations across 53 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -669,6 +669,8 @@ function createClient(opts = {}) {
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
+      // GET /provisioning/recommendations — rank: public — GET /provisioning/recommendations
+      getProvisioningRecommendations: (args) => request("GET", "/provisioning/recommendations", { hasBody: false }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
       // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles

package/clients/bongos-client/index.cjs

@@ -668,6 +668,8 @@ function createClient(opts = {}) {
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
+      // GET /provisioning/recommendations — rank: public — GET /provisioning/recommendations
+      getProvisioningRecommendations: (args) => request("GET", "/provisioning/recommendations", { hasBody: false }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
       // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles

package/clients/bongos-client/index.d.ts

@@ -97,6 +97,7 @@ export interface GetProvisioningInstancesIdResponse { instance: unknown; open_in
 export interface GetProvisioningInstancesIdSettingsResponse { ok: boolean; settings: unknown; planet: unknown; options: unknown }
 export interface GetProvisioningInstancesResponse { instances: unknown }
 export interface GetProvisioningOnboardPlanResponse { mode: unknown; steps: unknown }
+export interface GetProvisioningRecommendationsResponse { recommendations: unknown }
 export interface GetProvisioningSlugAvailableResponse { slug: unknown; available: unknown; reason: unknown; address: unknown }
 export interface GetProvisioningStarterBundlesResponse { core: unknown; bundles: unknown }
 export interface GetPublicBlockersIdResponse { blocker: unknown }
@@ -980,6 +981,8 @@ export interface BongosClient {
     postProvisioningInstancesIdTeardown(args?: RequestArgs): Promise<PostProvisioningInstancesIdTeardownResponse>;
     /** GET /provisioning/onboard-plan — rank: public */
     getProvisioningOnboardPlan(args?: RequestArgs): Promise<GetProvisioningOnboardPlanResponse>;
+    /** GET /provisioning/recommendations — rank: public */
+    getProvisioningRecommendations(args?: RequestArgs): Promise<GetProvisioningRecommendationsResponse>;
     /** GET /provisioning/slug-available — rank: any-builder */
     getProvisioningSlugAvailable(args?: RequestArgs): Promise<GetProvisioningSlugAvailableResponse>;
     /** GET /provisioning/starter-bundles — rank: public */

package/clients/bongos-client/index.mjs

@@ -665,6 +665,8 @@ export function createClient(opts = {}) {
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
+      // GET /provisioning/recommendations — rank: public — GET /provisioning/recommendations
+      getProvisioningRecommendations: (args) => request("GET", "/provisioning/recommendations", { hasBody: false }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
       // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles

package/config/branding.neutral.json

@@ -27,9 +27,10 @@
     "idp": false
   },
   "project": {
-    "_note": "Per-project policy the PLATFORM decides and this instance OBEYS (task 1003139, goal 1000058). Stored on the platform's provisioning_instances.settings; written here as <PREFIX>_PLATFORM_VISIBILITY / <PREFIX>_JOINABILITY by the provisioning runner, which re-writes web.env and restarts the service when the owner changes one. The defaults are TODAY's behavior, so an instance that never receives a push — a self-hosted one, or one provisioned before this channel — keeps behaving exactly as it does now. platformVisibility: public | gated. joinability: open | apply | invite_only.",
+    "_note": "Per-project policy the PLATFORM decides and this instance OBEYS (task 1003139, goal 1000058). Stored on the platform's provisioning_instances.settings; written here as <PREFIX>_PLATFORM_VISIBILITY / <PREFIX>_JOINABILITY / <PREFIX>_VISIBILITY by the provisioning runner, which re-writes web.env and restarts the service when the owner changes one. The defaults are TODAY's behavior, so an instance that never receives a push — a self-hosted one, or one provisioned before this channel — keeps behaving exactly as it does now. platformVisibility (who may READ this instance's own pages): public | gated. joinability (HOW someone becomes a member): open | apply | invite_only. visibility (the join door, ADR 0182 D1 — how this project stands on the platform's map): public | private | stealth; it does NOT decide whether the project is on the map, publishability does.",
     "platformVisibility": "public",
-    "joinability": "apply"
+    "joinability": "apply",
+    "visibility": "public"
   },
   "repo": {
     "owner": "",

package/docs/adr/0238-the-join-door-is-a-provisioning-settings-policy-key.md

@@ -0,0 +1,57 @@
+# ADR 0238 — The join door is a provisioning SETTINGS key, and the hub column stays the cache
+
+- **Status:** Accepted
+- **Date:** 2026-09-03
+- **Task:** [task 1002324](https://cloudbongos.com/builders#/task/1002324) (BONGOS-V1, goal 1000046 — *Project creation — visibility and customization*, criterion `proj-visibility-states`)
+- **Deciders:** jaxri (Archon), Claude
+- **Related:** [ADR 0182](<redacted>.md) (the two axes — this ADR only says *where* R05's half lives) · [ADR 0141](<redacted>.md) §3 (authority stays local) · [ADR 0190](<redacted>.md) (a pushed setting takes effect by a restart) · [ADR 0192](<redacted>.md) (`platform_visibility`, the neighbouring axis)
+
+---
+
+## Context
+
+ADR 0182 D5 says R05 "**moves host** — an instance surface, not a hub one … The setting lives in the project's own hall settings, gated by the project's own ranks." It does not say through which channel, and on the tree as R05 was claimed those two sentences pointed at nothing that existed:
+
+- **The hub catalog column that R04 shipped** — `platform_identity_projects.visibility` — is written by **no route at all**. Every write on `routes/projects.js` is `requirePermission('project.curate')`, an Archon/Metic *curation* gate with no ownership check, and `upsertProject` deliberately omits `visibility` from its column list (ADR 0182 D5: a client re-registration must not reset an owner's door). `owner_github_id` on that table is commented "advisory attribution (not an authority)". So the hub has, by design, no way to authorise an owner's visibility change.
+- **"The project's own hall settings"** is a page that does not exist. `modules/hall-ui/public/settings.html` is per-**builder** (account / access / dev box / preferences); the hall's `my-projects.html` was deleted in task 1003308 ("the hub owns it"). Building a new project-settings page on the instance, plus the hub sync (R08, unshipped), to carry one radio group would ship a control that changes nothing anyone can see.
+
+Meanwhile the surface where an owner **already manages a project** — `/projects?view=manage` on the hub — carries two adjacent settings that are the same shape as this one, on a channel built for exactly this: `provisioning_instances.settings`, a jsonb "dumb store" whose migration header names the keys the manage-page wave adds "one task at a time — *platform visibility, joinability, repo visibility, …*".
+
+## Decision
+
+**The owner's join door is a key in `provisioning.SETTINGS_VOCAB`** — `visibility ∈ (public, private, stealth)`, default `public` — set through the existing `PATCH /api/gds/provisioning/instances/:id/settings`, and rendered as one more section on the manage view.
+
+That one line buys the whole of R05 from machinery already in place and already proven:
+
+| What R05 needs | What the channel already does |
+|---|---|
+| only the owner may set it | `instanceAccessDenied` — own-scoped, Archon override, **404** (never 403) so there is no existence leak |
+| the enum is enforced by the server | the route's schema **is** the vocabulary (`vocabSchema(SETTINGS_VOCAB)`), so a value off the list is a 400 and a key added to the vocabulary can never drift out of the validator |
+| an audit trail | a `provisioning_events` row with the actor, `api:archon:<id>` on an override |
+| the value reaches the instance | `settingsEnvVars` derives `<PREFIX>_VISIBILITY` from the vocabulary automatically; the runner patches `web.env` in place and restarts |
+| the instance can read it | `src/branding.js` maps that env onto `project.visibility` and publishes it in the public manifest, beside its two neighbours |
+
+### It is a POLICY key, not a platform-drawn one
+
+The same store holds `PLANET_VOCAB` — keys the platform *draws* with, which have no default, ride no env and restart nothing. The door could have gone there (today only the map reads it, and the restart currently applies an env nothing consumes yet). It does not, for two reasons that outlive today:
+
+1. **ADR 0182 D6 makes the door the ceiling `joinability` may only narrow**, and D1/D5 put admission authority on the instance. The instance is the thing that must refuse a self-join on `private` and refuse an application *at the door* on `stealth` (R11/R12). A door the instance cannot read cannot be a ceiling.
+2. **A key with a default belongs in the defaulted vocabulary.** `effectiveSettings` gives `SETTINGS_VOCAB` keys today's behaviour for rows that predate them, which is exactly what ADR 0182's migration default (`'public'`, "existing rows keep today's behaviour") asks for. `PLANET_VOCAB` keys are nullable — null means *the platform picks* — and there is no such thing as "the platform picks your join door".
+
+### The hub column is unchanged, and stays the cache
+
+Nothing here writes `platform_identity_projects.visibility`. ADR 0182 D5 already calls that row a cache fed by the instance's report, and **R08 is that report** — this ADR only fixes where the truth it will carry is written. Until R08 ships, the map still reads the old `featured + active` predicate (R06's job), so an owner's pick is stored, validated, audited and delivered to their instance, and does not yet move the orb. That gap is R06/R08's, named here so the next builder does not go looking for a bug.
+
+## Consequences
+
+- Adding one key to `SETTINGS_VOCAB` propagates through every derived surface at once — the GET's `options`, the PATCH's validator, the env transport, the push receipt. The lockstep tests that had hardcoded the two-key world (`provisioning_settings*.mjs`, `provision_settings_apply.mjs`, the module's own unit file, the kit stub) all had to be told about the third key; that they broke is the guard working.
+- The manage section deliberately has **no "what your project runs" read-back line**, unlike its two siblings. An already-deployed project reports no door until it takes a release carrying `project.visibility`, and a line that could only ever say *"this project's server doesn't report this setting yet"* is worse than no line. It arrives with the enforcement.
+- `config/branding.neutral.json` gains `project.visibility: "public"`, so a self-hosted instance that never receives a push behaves exactly as it does now.
+- The three settings on that page now answer three different questions and are easy to confuse. The mitigation is copy, not naming: each section's fold says what it is *not* ("separate from 'Who can see it' above — that one is the door on the project's own pages"), and the vocabulary comment in `provisioning.js` lays the three side by side.
+
+## Alternatives rejected
+
+- **A new owner-scoped write route on the hub catalog** (`PATCH /projects/:id/visibility`). Rejected: it would make the hub authorise a visibility change, which ADR 0182 D5 forbids in as many words, and it would have to invent per-project ownership authority on a table whose owner column is documented as advisory.
+- **A new project-settings page on the instance's hall.** Rejected as the literal reading of D5: it is the right *long-run* home once a project has instance-side settings worth a page, but on its own today it is a control with no consumer — the map is fed by the hub, and the sync that would connect them (R08) is unshipped. The manage view is where an owner already goes, and the same value reaches the instance anyway through the push.
+- **A `visibility` column on `provisioning_instances`, beside `description`.** Rejected: `description` earned a column because it is half the publish gate and is read by SQL; the door is a closed-vocabulary knob, which is exactly what the jsonb store plus a code-side vocabulary exists for (migration `provisioning_009`'s own reasoning: "a new key must not cost a migration each time").
+- **Putting it in `PLANET_VOCAB` to avoid the restart.** Rejected above — it would buy a quieter save today and cost the ceiling rule tomorrow.