@bongos/core 1.19.511 → 1.19.513

package/modules/hall-ui/public/profile.css

@@ -134,17 +134,11 @@
 }
 .pchart__title { margin: 0; font-size: 13.5px; font-weight: 500; color: var(--ink); }
 .pchart__read { margin: 2px 0 var(--sp-hair); font-family: var(--label-face); font-size: var(--label-size); letter-spacing: var(--label-space); text-transform: var(--label-case); color: var(--ink-soft); min-height: 1.4em; }
-.pchart__svg { display: block; width: 100%; height: auto; overflow: visible; border-radius: var(--radius-sm); }
-.pchart__svg:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
-.pchart__line { fill: none; stroke: var(--accent); stroke-width: 2; stroke-linejoin: round; stroke-linecap: round; }
-.pchart__area { fill: color-mix(in srgb, var(--accent) 10%, transparent); stroke: none; }
-.pchart__axis, .pchart__hair { stroke: var(--rule-soft); stroke-width: 1; }
-.pchart__hair { stroke: var(--ink-faint); }
-.pchart__dot { fill: var(--accent); stroke: var(--bg-card); stroke-width: 2; }
-.pchart__col { fill: var(--accent); }
-.pchart__col--empty { fill: var(--rule-soft); }
-.pchart__end { font-family: var(--font-body); font-size: 11.5px; font-weight: 500; fill: var(--ink); }
-.pchart__tick { font-family: var(--label-face); font-size: 10px; letter-spacing: var(--label-space); text-transform: var(--label-case); fill: var(--ink-faint); }
+/* The plot itself — the svg, the line, the columns, the axis, the crosshair,
+   the ticks — is OTBKit's `.kit-plot*` in style.css (task 1003445). It was
+   written twice in this file's own script, and the goal's next charts want it
+   again. The dataviz spec moved verbatim; what stays below is this page's
+   FIGURE: the caption, the live readout, the table twin and the foot. */
 .pchart__twin { margin-top: var(--sp-hair); }
 .pchart__twin > summary { display: inline-flex; align-items: center; min-height: 24px; padding: 0 4px; margin: 0 -4px; font-family: var(--label-face); font-size: var(--label-size); letter-spacing: var(--label-space); text-transform: var(--label-case); color: var(--ink-soft); cursor: pointer; border-radius: var(--radius-sm); }
 .pchart__twin > summary:hover { color: var(--ink); background: var(--glass-strong); }
@@ -153,13 +147,10 @@
 .pchart__foot { margin: var(--sp-hair) 0 0; font-size: 12px; color: var(--ink-faint); }
 .pchart__note { margin: 0; font-size: 14px; color: var(--ink-soft); }
 /* the craft mix: label, bar, count — a row is its own table row */
-.pmix { display: flex; flex-direction: column; gap: 6px; margin: var(--sp-hair) 0; }
-.pmix__row { display: grid; grid-template-columns: minmax(72px, 110px) minmax(0, 1fr) auto; align-items: center; gap: 10px; font-size: 12.5px; min-height: 24px; }
-.pmix__label { color: var(--ink-soft); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
-.pmix__track { display: block; height: 8px; background: var(--rule-soft); border-radius: 0 4px 4px 0; overflow: hidden; }
-.pmix__fill { display: block; height: 100%; background: var(--accent); border-radius: 0 4px 4px 0; }
-.pmix__row:hover .pmix__fill { opacity: .8; }
-.pmix__n { color: var(--ink-faint); font-variant-numeric: tabular-nums; }
+/* The craft mix is OTBKit.barSeriesHtml (task 1003445) — the .pmix family was
+   the hall's third copy of one horizontal bar. Only the vertical air around it
+   is this page's; the row, the track and the 24px floor are the kit's. */
+.pchart .kit-bars { margin: var(--sp-hair) 0; }
 @media (max-width: 720px) {
   .pcharts { grid-template-columns: minmax(0, 1fr); }
 }

package/modules/hall-ui/public/style.css

@@ -1944,24 +1944,110 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
   grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
   gap: 12px;
 }
-.curve__chart {
-  background: var(--surface-2);
-  border-radius: var(--radius-sm);
-  padding: 10px 14px 12px;
+/* ---------- hall-kit charts (task 1003445) ----------
+   The hall's ONE chart vocabulary. Before this the same horizontal bar was
+   written three times — the Curve's kinds, Watch's Review-quality trend, and
+   the profile's craft mix — each with its own class family, geometry and tone,
+   and the line chart a fourth family beside them.
+
+   Three deliberate changes came with the merge, all of them the kit's defaults
+   winning over a copy that had drifted: every row now holds the hall's 24px
+   FLOOR (only the profile's copy remembered it, so the Curve's kind rows grow
+   a few px), the hover dim applies to all three rather than the profile alone,
+   and the value cell right-aligns (a no-op where its column is `auto`).
+   Everything else is declaration-for-declaration what the three families
+   said. */
+
+.kit-chart { background: var(--surface-2); border-radius: var(--radius-sm); padding: 10px 14px 12px; }
+.kit-chart__title { font-size: 12px; font-weight: 600; color: var(--ink-soft); margin: 0 0 6px; }
+.kit-chart__empty { font-size: 12px; color: var(--ink-faint); }
+.kit-chart__foot { font-size: 11.5px; color: var(--ink-faint); margin-top: 4px; }
+
+.kit-spark { width: 100%; height: 44px; display: block; }
+/* The stroke/fill here are the FALLBACK: sparklineHtml writes the caller's
+   colour inline, because the Curve spends a different accent per chart. */
+.kit-spark__line { fill: none; stroke: var(--accent); stroke-width: 2; }
+.kit-spark__area { fill: color-mix(in srgb, var(--accent) 14%, transparent); stroke: none; }
+
+/* Every difference between the three call sites is one of these six custom
+   properties, which is what makes the fifth chart free: pass barSeriesHtml's
+   labelWidth / valueWidth / barHeight / radius / track options, never a new
+   class. */
+.kit-bars {
+  --kit-bars-label-w: 110px;
+  --kit-bars-val-w: auto;
+  --kit-bars-h: 8px;
+  --kit-bars-radius: 4px;
+  --kit-bars-track: var(--surface-2);
+  --kit-bars-fill: var(--accent);
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+}
+.kit-bars__row {
+  display: grid;
+  grid-template-columns: var(--kit-bars-label-w) minmax(0, 1fr) var(--kit-bars-val-w);
+  align-items: center;
+  gap: 10px;
+  /* The hall's 24px floor, held here so no call site has to remember it —
+     the profile's mix was the only one of the three that did. */
+  min-height: 24px;
+  font-size: 12.5px;
+  font-variant-numeric: tabular-nums;
 }
-.curve__chart-title { font-size: 12px; font-weight: 600; color: var(--ink-soft); margin: 0 0 6px; }
-.curve__chart-empty { font-size: 12px; color: var(--ink-faint); }
-.curve__chart-foot { font-size: 11.5px; color: var(--ink-faint); margin-top: 4px; }
-.spark { width: 100%; height: 44px; display: block; }
-.spark__line { fill: none; stroke: var(--accent); stroke-width: 2; }
-.spark__area { fill: color-mix(in srgb, var(--accent) 14%, transparent); stroke: none; }
+.kit-bars__label { color: var(--ink-soft); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.kit-bars__track {
+  display: block;
+  height: var(--kit-bars-h);
+  background: var(--kit-bars-track);
+  border-radius: var(--kit-bars-radius);
+  overflow: hidden;
+}
+.kit-bars__fill {
+  display: block;
+  height: 100%;
+  background: var(--kit-bars-fill);
+  border-radius: var(--kit-bars-radius);
+  /* A re-render (an SSE nudge, a lookback change) grows the bar to its new
+     width rather than jumping. First paint does not animate: a freshly
+     inserted element has no previous width to transition from. The hall's ONE
+     reduced-motion kill switch (§the kill switch, at the end of this sheet)
+     already zeroes this with !important — do NOT add a second @media block
+     here, which is what `tests/hall_tokens.mjs` forbids and why the rule
+     cannot rot in two places. */
+  transition: width 200ms ease;
+}
+.kit-bars__row:hover .kit-bars__fill { opacity: .8; }
+.kit-bars__val { text-align: right; color: var(--ink-faint); }
+/* The neutral tone: a series read as data rather than as the page's own
+   accent — Watch's trend, where the accent belongs to the pressable. */
+.kit-bars--neutral {
+  --kit-bars-track: var(--rule-soft);
+  --kit-bars-fill: var(--ink-soft);
+}
+.kit-bars--neutral .kit-bars__val { color: var(--ink); }
+
+/* The PLOT: a step line or a column series on a time axis. Moved verbatim from
+   profile.css's .pchart__* (task 1003445), where the same frame was drawn twice
+   by profile-charts.js. The dataviz spec here is measured, not chosen — a 2px
+   accent line, a 10% wash, a hairline solid axis, an r=4 end dot with a 2px
+   card-coloured ring, and the ONE labelled value in ink rather than the series
+   colour. tests/hall_kit_charts.mjs pins all five; do not hand-tune one.
+   `tabindex` is on the svg because the chart is walkable by arrow key, so the
+   focus ring is a real control's, not decoration. */
+.kit-plot { display: block; width: 100%; height: auto; overflow: visible; border-radius: var(--radius-sm); }
+.kit-plot:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+.kit-plot__line { fill: none; stroke: var(--accent); stroke-width: 2; stroke-linejoin: round; stroke-linecap: round; }
+.kit-plot__area { fill: color-mix(in srgb, var(--accent) 10%, transparent); stroke: none; }
+.kit-plot__axis, .kit-plot__hair { stroke: var(--rule-soft); stroke-width: 1; }
+.kit-plot__hair { stroke: var(--ink-faint); }
+.kit-plot__dot { fill: var(--accent); stroke: var(--bg-card); stroke-width: 2; }
+.kit-plot__col { fill: var(--accent); }
+.kit-plot__col--empty { fill: var(--rule-soft); }
+.kit-plot__end { font-family: var(--font-body); font-size: 11.5px; font-weight: 500; fill: var(--ink); }
+.kit-plot__tick { font-family: var(--label-face); font-size: 10px; letter-spacing: var(--label-space); text-transform: var(--label-case); fill: var(--ink-faint); }
 
 .curve__kinds { display: flex; flex-direction: column; gap: 6px; margin-top: 16px; }
-.curve__kind { display: grid; grid-template-columns: 110px minmax(0, 1fr) auto; align-items: center; gap: 10px; font-size: 12.5px; }
-.curve__kind-label { color: var(--ink-soft); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
-.curve__kind-bar { height: 8px; background: var(--surface-2); border-radius: 4px; overflow: hidden; }
-.curve__kind-fill { height: 100%; background: var(--accent); border-radius: 4px; }
-.curve__kind-n { color: var(--ink-faint); font-variant-numeric: tabular-nums; }
 
 /* ---------- onboarding checklist ---------- */
 

package/modules/hall-ui/public/watch.css

@@ -55,20 +55,12 @@
 /* The 14-day grade trend: a day, a bar, then the count and score. The bar is a
    measurement, not a control, so it is ink on a hairline track and never the
    accent. */
-.watch-trend { display: flex; flex-direction: column; margin-top: 4px; }
-.watch-trend__row {
-  display: grid;
-  grid-template-columns: 64px minmax(0, 1fr) 96px;
-  gap: 12px;
-  align-items: center;
-  min-height: 28px;
-  font-size: 13px;
-  color: var(--ink-soft);
-  font-variant-numeric: tabular-nums;
-}
-.watch-trend__bar-track { height: 6px; overflow: hidden; border-radius: var(--radius-pill); background: var(--rule-soft); }
-.watch-trend__bar-fill { display: block; height: 100%; background: var(--ink-soft); }
-.watch-trend__val { text-align: right; color: var(--ink); }
+/* The Review-quality trend is OTBKit.barSeriesHtml in its neutral tone (task
+   1003445) — the .watch-trend family was the hall's second copy of one
+   horizontal bar. What stays here is this page's own density: a taller row and
+   more air between the three columns than the kit's default. */
+#mason-marks-trend .kit-bars { margin-top: 4px; gap: 0; }
+#mason-marks-trend .kit-bars__row { min-height: 28px; gap: 12px; font-size: 13px; }
 
 /* A link inside a ledger cell (a session's tasks) is a control at a 13.5px line
    box: the padding buys the 24px floor and the negative margin hands it back. */

package/modules/hall-ui/public/watch.html

@@ -59,7 +59,7 @@
           <!-- 1. ACCESS REQUESTS -->
           <section class="scroll" id="gate-scroll" aria-labelledby="gate-h" hidden>
             <h2 id="gate-h" class="scroll__h">Access requests</h2>
-            <p class="scroll__lede">People asking to join. Approve or dismiss each request.</p>
+            <p class="scroll__lede">People asking to join. Approve or dismiss each request, re-read the ones you already decided, and take back an approval before that person has signed in.</p>
             <div id="gate-body"><span class="kit-skel"></span></div>
           </section>
 

package/modules/hall-ui/public/watch.js

@@ -26,6 +26,14 @@
 // family's .ov-figs, every sub-section is an .ov-group head, the access requests
 // are oversight rows, and the five most recent sessions the page always fetched
 // and threw away are now rendered under the tally.
+//
+// TASK 1002332 made the access-requests section a REVIEW queue rather than a
+// decision button: every row says whether the platform vouched for the name on
+// it (ADR 0201 — the public unauthenticated write means anyone may apply as
+// anyone, so vouched/unvouched is load-bearing, not decoration), the three
+// lifecycle states sit behind one switch, and an approval can be RESCINDED
+// before its holder ever signs in — a transition the route has always taken and
+// nothing on this page offered (ADR 0208).
 
 (() => {
   'use strict';
@@ -43,7 +51,7 @@
   const { escapeHtml, $, num, fmtInt, fmtCompact } = window.OTB;
   // Shared component kit (hall-kit.js, task 2166): tabs, ledger, pager, empty
   // states — adopted here by task 2173, and by every list since task 1003469.
-  const { makeTabs, makeLedger, makePager, emptyStateHtml } = window.OTBKit;
+  const { makeTabs, makeLedger, makePager, makeFilterBar, emptyStateHtml } = window.OTBKit;
   const fmtDate = (iso) => window.OTB.fmtDate(iso, { time: true });
   const rankLabel = (rank) => window.OTB.rankLabel(rank, { empty: '' });
   const toast = (msg) => window.OTB.toast(msg);
@@ -291,50 +299,131 @@
     });
   }
 
-  // One request, one oversight row: who, their note as the sub line, when they
-  // asked as the fact, and the two decisions on the right.
+  // The three lists the queue is, behind one switch. Reviewing is not only
+  // deciding: an owner has to re-read what they already decided, and RESCIND an
+  // approval given by mistake before the applicant ever signed in — the route
+  // has always taken that transition (ADR 0201 D4.2) and nothing offered it,
+  // because this page only ever fetched `?status=pending` (ADR 0208).
+  const GATE_VIEWS = [
+    { value: 'pending', label: 'Waiting', empty: 'No pending access requests.' },
+    { value: 'invited', label: 'Admitted', empty: 'Nobody has been admitted yet.' },
+    { value: 'dismissed', label: 'Declined', empty: 'No declined requests.' },
+  ];
+  let gateView = 'pending';
+
+  function gateEmptyMsg() {
+    return (GATE_VIEWS.find((v) => v.value === gateView) || GATE_VIEWS[0]).empty;
+  }
+
+  // The switch itself, rebuilt on every render because `section` replaces the
+  // whole body — the same lifecycle wireInviteForm already lives with.
+  function wireGateView(target) {
+    const mount = target.querySelector('#gate-view');
+    if (!mount) return;
+    makeFilterBar({
+      mount,
+      primary: [{
+        id: 'gate-status',
+        label: 'Show',
+        value: gateView,
+        options: GATE_VIEWS.map((v) => ({ value: v.value, label: v.label })),
+      }],
+      onChange: (vals) => {
+        const next = vals['gate-status'];
+        if (next === gateView) return;
+        gateView = next;
+        loadGate();
+      },
+    });
+  }
+
+  // Whether the platform vouched for this applicant, said on the row — and the
+  // single thing that makes the queue safe to read (ADR 0201, Consequences).
+  // POST /access-requests is the one PUBLIC unauthenticated write, so anyone may
+  // file a request under anyone's name; a row that merely LOOKED vouched is the
+  // whole impersonation surface the vouch exists to close. It is never authority
+  // (ADR 0016) — an unvouched applicant is admitted by the identical statement —
+  // it only says whether anyone confirmed who is asking.
+  function vouchPill(vouched) {
+    return vouched
+      ? '<span class="fact-pill fact-pill--ok" title="The platform confirmed this request came from the account it names.">Identity vouched</span>'
+      : '<span class="fact-pill fact-pill--warn" title="Nobody vouched for this name — anyone can file a request naming anyone. Confirm who is asking before you admit them.">Name unvouched</span>';
+  }
+
+  // What this row still offers. A waiting request has two decisions; an admitted
+  // one can still be rescinded (until they sign in, after which the server
+  // refuses and says so); a declined one is terminal here — re-admitting is the
+  // invite form above, which is what the server's own refusal names.
+  function gateRowActions(r) {
+    const id = escapeHtml(r.id);
+    if (r.status === 'invited') {
+      return ghost(`data-gate-action="dismissed" data-gate-from="invited" data-id="${id}"`, 'Rescind', true);
+    }
+    if (r.status === 'dismissed') return '';
+    return ghost(`data-gate-action="invited" data-id="${id}"`, 'Invite')
+      + ghost(`data-gate-action="dismissed" data-id="${id}"`, 'Dismiss', true);
+  }
+
+  // One request, one oversight row: who, whether anyone vouched for them, their
+  // note as the sub line, when they asked (and who decided, once someone has) as
+  // the facts, and whatever decisions are still open on the right.
+  function gateRowHtml(r) {
+    const who = r.display_name
+      ? `${escapeHtml(r.display_name)}<span class="ov-mono">@${escapeHtml(r.github_login)}</span>`
+      : `<span class="ov-mono">@${escapeHtml(r.github_login)}</span>`;
+    const note = r.note ? `<p class="ov-row__sub">“${escapeHtml(r.note)}”</p>` : '';
+    // A rescind overwrites the approver with the rescinder (ADR 0208), so this
+    // names who put the row in the state it is in now — which is what it says.
+    const by = r.resolved_by_login ? ` by <span class="ov-mono">@${escapeHtml(r.resolved_by_login)}</span>` : '';
+    const decided = r.resolved_at
+      ? `<span class="ov-row__when">${r.status === 'invited' ? 'Admitted' : 'Declined'} ${escapeHtml(fmtDate(r.resolved_at))}${by}</span>`
+      : '';
+    const actions = gateRowActions(r);
+    return (
+      `<li class="ov-row" data-req-id="${escapeHtml(r.id)}">` +
+      '<div class="ov-row__main">' +
+      `<span class="ov-row__title">${who}</span>` +
+      note +
+      '<div class="ov-row__facts">' +
+      vouchPill(!!r.vouched) +
+      `<span class="ov-row__when">Asked ${escapeHtml(fmtDate(r.created_at))}</span>` +
+      decided +
+      '</div>' +
+      '</div>' +
+      (actions ? `<div class="ov-row__right"><div class="ov-row__actions">${actions}</div></div>` : '') +
+      '</li>'
+    );
+  }
+
   function renderGate(data, target) {
     const requests = Array.isArray(data.requests) ? data.requests : [];
-    setAttention('att-access', requests.length); // tile count = table content
-    if (!requests.length) {
-      target.innerHTML = inviteFormHtml() + emptyStateHtml('No pending access requests.');
-      wireInviteForm(target);
-      return;
+    // The attention tile counts WAITING work, never whatever list is on screen:
+    // reading the decided history must not repaint the board with a number that
+    // means something else. Its own sub line says "pending".
+    if (gateView === 'pending') setAttention('att-access', requests.length);
+    const head = inviteFormHtml() + '<div id="gate-view"></div>';
+    target.innerHTML = requests.length
+      ? head + '<ul class="ov-rows">' + requests.map(gateRowHtml).join('') + '</ul>'
+      : head + emptyStateHtml(gateEmptyMsg());
+
+    if (requests.length) {
+      wireActions(target, '[data-gate-action]', async (btn) => {
+        const id = btn.getAttribute('data-id');
+        const status = btn.getAttribute('data-gate-action');
+        const rescinding = btn.getAttribute('data-gate-from') === 'invited';
+        await patchJson(`/access-requests/${encodeURIComponent(id)}`, { status });
+        toast(status === 'invited' ? 'Builder invited.'
+          : rescinding ? 'Approval rescinded — that sign-in no longer gets in.'
+            : 'Request dismissed.');
+        await loadGate();
+      }, 'Could not resolve');
     }
-    target.innerHTML = inviteFormHtml() + '<ul class="ov-rows">' + requests
-      .map((r) => {
-        const who = r.display_name
-          ? `${escapeHtml(r.display_name)}<span class="ov-mono">@${escapeHtml(r.github_login)}</span>`
-          : `<span class="ov-mono">@${escapeHtml(r.github_login)}</span>`;
-        const note = r.note ? `<p class="ov-row__sub">“${escapeHtml(r.note)}”</p>` : '';
-        return (
-          `<li class="ov-row" data-req-id="${escapeHtml(r.id)}">` +
-          '<div class="ov-row__main">' +
-          `<span class="ov-row__title">${who}</span>` +
-          note +
-          `<div class="ov-row__facts"><span class="ov-row__when">Asked ${escapeHtml(fmtDate(r.created_at))}</span></div>` +
-          '</div>' +
-          '<div class="ov-row__right"><div class="ov-row__actions">' +
-          ghost(`data-gate-action="invited" data-id="${escapeHtml(r.id)}"`, 'Invite') +
-          ghost(`data-gate-action="dismissed" data-id="${escapeHtml(r.id)}"`, 'Dismiss', true) +
-          '</div></div>' +
-          '</li>'
-        );
-      })
-      .join('') + '</ul>';
-
-    wireActions(target, '[data-gate-action]', async (btn) => {
-      const id = btn.getAttribute('data-id');
-      const status = btn.getAttribute('data-gate-action');
-      await patchJson(`/access-requests/${encodeURIComponent(id)}`, { status });
-      toast(status === 'invited' ? 'Builder invited.' : 'Request dismissed.');
-      await loadGate();
-    }, 'Could not resolve');
     wireInviteForm(target);
+    wireGateView(target);
   }
 
   function loadGate() {
-    return section($('#gate-body'), () => fetchJson('/access-requests?status=pending'), renderGate, {
+    return section($('#gate-body'), () => fetchJson(`/access-requests?status=${encodeURIComponent(gateView)}`), renderGate, {
       sealedMsg: 'Archons only. Access requests are not visible at your rank.',
       errMsg: 'Could not load access requests.',
       name: 'gate',
@@ -782,23 +871,19 @@
       trendEl.innerHTML = emptyStateHtml('No trend to show yet.');
       return;
     }
-    const maxN = Math.max(1, ...trend.map((t) => num(t.n)));
+    // task 1003445: this was the hall's third copy of the same horizontal bar.
+    // It draws through OTBKit.barSeriesHtml now, in the NEUTRAL tone — on an
+    // oversight page the accent belongs to the pressable, not to the data —
+    // with its own geometry passed as options rather than a second class family.
     trendEl.innerHTML =
-      '<div class="watch-trend">' +
-      trend
-        .map((t) => {
-          const w = Math.round((num(t.n) / maxN) * 100);
-          const avg = (t.avg_score ?? '—') === '—' ? '—' : escapeHtml(String(t.avg_score));
-          return (
-            '<div class="watch-trend__row">' +
-            `<span>${escapeHtml(fmtDay(t.day))}</span>` +
-            `<span class="watch-trend__bar-track"><span class="watch-trend__bar-fill" style="width:${w}%"></span></span>` +
-            `<span class="watch-trend__val">${fmtInt(t.n)} · ${avg}</span>` +
-            '</div>'
-          );
-        })
-        .join('') +
-      '</div>' +
+      window.OTBKit.barSeriesHtml(
+        trend.map((t) => ({
+          label: fmtDay(t.day),
+          value: num(t.n),
+          valueLabel: `${fmtInt(t.n)} · ${(t.avg_score ?? '—') === '—' ? '—' : String(t.avg_score)}`,
+        })),
+        { tone: 'neutral', labelWidth: '64px', valueWidth: '96px', barHeight: '6px', pill: true },
+      ) +
       foot('Per day: ships graded · avg score.');
   }
 

package/modules/provisioning/provisioning.js

@@ -118,11 +118,37 @@ const RESTART_SHAPES = new Set(['co-tenant', 'standalone']);
 // (migration provisioning_009) is a dumb store with room for future keys.
 // DEFAULT_SETTINGS is TODAY's behavior (public surfaces, apply-to-join),
 // applied at read time so pre-existing rows need no data backfill.
+//
+// `visibility` is ADR 0182's STORED JOIN DOOR (BV1.R05, task 1002324) and it is a
+// third axis, not a synonym of its neighbours — the three answer three different
+// questions and an owner may set them independently:
+//
+//   platform_visibility  who may READ this project's own pages (its sign-in door)
+//   joinability          HOW someone becomes a member (self-join / apply / invite)
+//   visibility           how the project stands on the PLATFORM's map: named and
+//                        open (public), named and closed (private), or present but
+//                        anonymous (stealth)
+//
+// The name is ADR 0182 D1's deliberate choice — `goals.visibility` established the
+// word and one word across both planes beat an accurate name used in one place —
+// and D1 also records that it is a mild lie: this key does NOT decide whether the
+// project is on the map. PUBLISHABILITY does (a name + a description, ADR 0182 D4),
+// it is derived and never stored, and no value here can put a husk on the map.
+//
+// It is a POLICY, not a platform-drawn key: ADR 0182 D6 makes the door the CEILING
+// that `joinability` may only narrow, and D1/D5 put that authority on the instance —
+// so it rides web.env like its two neighbours and a restart applies it. The instance
+// reads it back as `project.visibility` (src/branding.js), which is what lets a later
+// task enforce the door there and report the value to the hub catalog (R08).
 const SETTINGS_VOCAB = Object.freeze({
   platform_visibility: ['public', 'gated'],
   joinability: ['open', 'apply', 'invite_only'],
+  visibility: ['public', 'private', 'stealth'],
 });
-const DEFAULT_SETTINGS = Object.freeze({ platform_visibility: 'public', joinability: 'apply' });
+// Default = today's behavior on every axis, including the join door: ADR 0182's
+// migration gives the hub column the same `public` default, "existing rows keep
+// today's behaviour".
+const DEFAULT_SETTINGS = Object.freeze({ platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
 
 // The project's PLANET (task 1003347, direction record §16): how the platform
 // DRAWS it on the sky, in the owner's list and on the card — its template