@bongos/core 1.19.512 → 1.19.514

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.512",
-  "core_contract": "1.19.512",
-  "source_commit": "b80dfcced279a5dc071290fdc22ea3aeec3dfd70",
+  "core_version": "1.19.514",
+  "core_contract": "1.19.514",
+  "source_commit": "b092f2a3e4ee99d6f856ae4d1440ed723f1dcba8",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T18:54:15.905Z",
+  "built_at": "2026-09-03T19:32:24.004Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 429,
+    "docs_redacted": 430,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1952,
+    "functional_verbatim": 1958,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2405,
-  "tree_sha256": "382fde42e266c00ccb3f8289a487a709a55e3e606c5fc80a395a49c667f42e96",
+  "file_count": 2412,
+  "tree_sha256": "4ea8c8583161c137a8be9e3d96b1db2589a64bd504a47f7e75ebeb15232753d2",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -362,12 +362,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "146ce9d114ec7d5a90413713b8604843c42eac060dd943648412868e214a1a6e"
+      "sha256": "546f5670b4637aa1d4c492a8616d5189a971c79e8e2e163d12fe11276292faa6"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "0e3fb901fd7110352e0edb686cfd8824d71687b88bd7e42269d0fe855177ac9f"
+      "sha256": "ae151ff268d04dced73fae1136c682215a02e59bae5edb68a3d6001c0143dd57"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -377,17 +377,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "19f11ecf8c9eda49cd1f2ac2425f1d3d9772ad46495305d9ae4bdeadf4695ea2"
+      "sha256": "72d841c53787c5ad83b214c2ac816fd4cb9c97b47329eb0417b80e660a9f6b02"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "4ced11579608e8fdb481a07b5555c41b3cbf3018cb3a8bd7697fb58368283bf0"
+      "sha256": "07554254c8559f81ec5cf45807ddccd8488732b228a618167455c932e7f05750"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "3d5868d134bce56923b8f0270fbb2e988dea5b6a5ea1a00b96ff8bcde06bb40e"
+      "sha256": "c4b04368e61803e2fe36f26ba3757aa75ada7e465384baf3e53cd012c9ce8423"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1407,7 +1407,7 @@
     {
       "path": "docs/adr/0182-project-visibility-two-axes.md",
       "mode": "0000644",
-      "sha256": "9474378cf54f6d66269797edf6cd1d0d76014cecbfc657f53cd5892999599f20"
+      "sha256": "273133f1ce79a6e67b3beaa6d993c7aa3dda23daba0beeb2e9aedf9250152e6f"
     },
     {
       "path": "docs/adr/0183-criteria-close-themselves.md",
@@ -1699,20 +1699,25 @@
       "mode": "0000644",
       "sha256": "fb05e36eb48861f2b32a38da04eba839f8141bd52ff9d913070bc589c115f9d5"
     },
+    {
+      "path": "docs/adr/0239-a-recommendation-is-a-table-that-carries-its-own-reason.md",
+      "mode": "0000644",
+      "sha256": "42b20cd6d2e8a8d76c980df73087fd404487e4c479034dbe34d8297677bd9387"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "1ec64297bc6f1858e1315b049d143de5390fb5b5843e0414f536d4fa2a42d7d5"
+      "sha256": "cef542ef427dd81632465f17c6343c6b27f3ab69436eba2130c4fa4b5c9bc4ae"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "f9a893262b5112e48a8bffa455c8e1a7ce8aed663e34141ef9c48117882a2ad7"
+      "sha256": "36baedec0a98a17dd013bf264cdb5502624de9529ed62e69aa88590574b1b236"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "ec2d400cae26a7b89f644e978840927fd0fb88fc0b7b94e9f0d00dd19955aaf2"
+      "sha256": "718e7ab37e024cce51fb82da0b3a535aff961d04fb0dc5e25b8ec31a61e64851"
     },
     {
       "path": "docs/architecture.md",
@@ -1737,12 +1742,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "519630f4bda79510d5bc3f131d28ad1915517b05ec4f8dadf3081d0845bb9440"
+      "sha256": "0cc8ccfda8d8e3e7b518fae7a7584bb368d7d2eac6703518404d30f0b6ead30d"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "b920c2349d109b9c75c22396095d011c90edc2614f844ac27a4b3f116c805278"
+      "sha256": "1003ea51740a5f71af49e05c66ba088c337185680dd92a391c959e8ea76a3f40"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2587,7 +2592,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "26d8b7f65d94927b0f382674b0421d8b5694856fd619b5c8fc57f1147f17b20d"
+      "sha256": "decebcba9ee02ff15412e119309d9a37203ee82159922157b37c7cd7ddc21926"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3957,7 +3962,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "19f11ecf8c9eda49cd1f2ac2425f1d3d9772ad46495305d9ae4bdeadf4695ea2"
+      "sha256": "72d841c53787c5ad83b214c2ac816fd4cb9c97b47329eb0417b80e660a9f6b02"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -4707,12 +4712,12 @@
     {
       "path": "modules/hall-ui/public/hall-kit.js",
       "mode": "0000644",
-      "sha256": "e392af98c2d310bfe80ccc560895dc2729abbe416087fcc7609d22dd4593484c"
+      "sha256": "9fdd4fa659a6ff1f36159a89a5bab9d12009b1624f7d72f8d1296d1dffff0d3f"
     },
     {
       "path": "modules/hall-ui/public/hall-render.js",
       "mode": "0000644",
-      "sha256": "d3ec5ebd2a4b60f0e87d82304920905021c6ee992e6a371516317da02f78ac3e"
+      "sha256": "e06761bf930a2b7bf8b0c4a3eba0532edb1a6f0d49d366b6889ebba9101e5d4f"
     },
     {
       "path": "modules/hall-ui/public/hall-widgets.js",
@@ -4907,7 +4912,7 @@
     {
       "path": "modules/hall-ui/public/profile-charts.js",
       "mode": "0000644",
-      "sha256": "865df71a66dd944006b01dfb1317778a1d733d9320b4486efd8ee1ed3ea76f19"
+      "sha256": "6eb791bb5d73e869f1af1dbabe6fbd04eccf970b54696a89a4cd1d28e6e705df"
     },
     {
       "path": "modules/hall-ui/public/profile-connections.js",
@@ -4922,7 +4927,7 @@
     {
       "path": "modules/hall-ui/public/profile.css",
       "mode": "0000644",
-      "sha256": "81712abfa291664378581139a3611acaff0ebdcd2cb77d641e8543d653080c30"
+      "sha256": "18d65cb2bab78487a4cbf2447154a69674291972d15256d338123c2a437abc87"
     },
     {
       "path": "modules/hall-ui/public/profile.html",
@@ -5057,7 +5062,7 @@
     {
       "path": "modules/hall-ui/public/style.css",
       "mode": "0000644",
-      "sha256": "287e9d4c4a2f57e812051dc6613d4c5ef493924c1a3de1b15fa91072128fa46e"
+      "sha256": "801d467a63d65c24877cac2741308590b9cd66530231f77bdf7230d1c4ebe513"
     },
     {
       "path": "modules/hall-ui/public/task-detail.js",
@@ -5097,17 +5102,17 @@
     {
       "path": "modules/hall-ui/public/watch.css",
       "mode": "0000644",
-      "sha256": "0c877cf6decf1b7291c877ec2e6c0603c5170cfecabf0d6be15a793b6858dad8"
+      "sha256": "ea2f7870bdd9383cfded8b2b09724486faa0793438dfa17bc52af189c8a81c6f"
     },
     {
       "path": "modules/hall-ui/public/watch.html",
       "mode": "0000644",
-      "sha256": "b20c001318da04ee5ca731702356479b0c7e4bffdd5784be9b1984db31d30777"
+      "sha256": "60ffce27ce4250223dc6bbaa22e1b7b9dfb4f689bd78b6ca1c75445088c5ddb9"
     },
     {
       "path": "modules/hall-ui/public/watch.js",
       "mode": "0000644",
-      "sha256": "0576fa65e1ac51a3928e1ac584532b9e4db1102513d35acc5e31c1afef66c32c"
+      "sha256": "f5d264fde6898c3cf82387d042d26fb434bbd8e60657c376b452f89b0a85435c"
     },
     {
       "path": "modules/hall-ui/public/watch.states.json",
@@ -5812,7 +5817,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "1b626dfb9b8aec98c95d94d8a831e5343018bb6164ef76a160ae6ff5e026a3ad"
+      "sha256": "c58dad2f4aee4030bfc2e93904760f70185c799b388a20d715ebe70812b942ed"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -5824,6 +5829,11 @@
       "mode": "0000644",
       "sha256": "2e898799632a2b5c2ead9cb44fa0b8029fcb6d217f7d5f26c8a39b34c75bbea7"
     },
+    {
+      "path": "modules/platform-identity/projects-feed.js",
+      "mode": "0000644",
+      "sha256": "7ba4e7f2a375a1197524106605ff5dd6e4e597b2926bf6498f784ede5099a447"
+    },
     {
       "path": "modules/platform-identity/publish-gate.js",
       "mode": "0000644",
@@ -5852,7 +5862,7 @@
     {
       "path": "modules/platform-identity/routes/projects.js",
       "mode": "0000644",
-      "sha256": "8652dbbc243f9bb10d759dd140163471d41687b405742f02b5936be818a93472"
+      "sha256": "ec297f39a3d7f23b05b24ea6837bb9bfd07a12f99734788e9332769c59acc7b7"
     },
     {
       "path": "modules/platform-identity/routes/public-profile.js",
@@ -5882,7 +5892,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "6151b6e7d5c4336fece03d0c29dbc94493329ba3bd4d8782702a2d581e5a4cc7"
+      "sha256": "a0ed65254f629cc29f4f1093c54d5e78a148d5bc7f072fb98819562a96f7dd37"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -5984,10 +5994,15 @@
       "mode": "0000644",
       "sha256": "27046325beffad5d1edfcc91c331048038900ef7d32f1d38796755c7990ba202"
     },
+    {
+      "path": "modules/provisioning/recommendations.js",
+      "mode": "0000644",
+      "sha256": "8c4b2d8d17b80229c371b82ac9a5a2cf2fa979683ac586e8b833ca0a309a92fc"
+    },
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "338e135f492e584aa4539d4a64d7c881b964c9ffa8428ff3359ad96d80b82a5c"
+      "sha256": "9285f3f2d426305c060eef4b3b98ae64fc386e4ce487f99d9ad59d9921dc493e"
     },
     {
       "path": "modules/provisioning/starter-bundles.js",
@@ -7247,12 +7262,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "63c01590a251d6ec16dde2e0be5d843e12ff40955733268f6d322718f1e807be"
+      "sha256": "9c126ed4b632afd9452b01fa9e08eb97295699e99efc9c7d4040a761cac7f58d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "4bbced9436a337f2b2ea9fe5445bf6f9f94354ffeda4d1b1766cd12f4e9f74d9"
+      "sha256": "7cc213de070341042dae24c32b6fc458ae6912399a715d50b18dd92c52548fd8"
     },
     {
       "path": "public-docs/index.html",
@@ -8922,7 +8937,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "379afd7239016bc0e504bc3b73596c35cb71a074a6b743f32c76c5a24493a44e"
+      "sha256": "ace7f9365df0b8019d1fbc1758832db878c9b00ff59583a5ddcd839bbb69b1eb"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10302,7 +10317,7 @@
     {
       "path": "tests/hall_audit.mjs",
       "mode": "0000644",
-      "sha256": "7df5602bb92b44186613870501ecb4e959c9288f8d103cfc8075a3a24d51d840"
+      "sha256": "0b30e949b0479adb4b436aa32e741c9f2ab3925a1ac4327daf6e8a95700a8c14"
     },
     {
       "path": "tests/hall_board_world.mjs",
@@ -10324,6 +10339,11 @@
       "mode": "0000644",
       "sha256": "1d9c1d345a6fe25eacf810703a3e7f9f3b33f8e982aef49364e19eb4469de668"
     },
+    {
+      "path": "tests/hall_kit_charts.mjs",
+      "mode": "0000644",
+      "sha256": "475c712af2b45fed7863b486c3d2ed3b96e955dccb9acc5909999db3990843d5"
+    },
     {
       "path": "tests/hall_nav.mjs",
       "mode": "0000644",
@@ -10352,7 +10372,7 @@
     {
       "path": "tests/hall_profile_world.mjs",
       "mode": "0000644",
-      "sha256": "9e5047b39d55875e167c992157c6c04a9a766ec331c1a3bf343fe7ea194a8309"
+      "sha256": "b35d647c4cb7b90be70dee8e7245396cc901479992fafbf19ceef734d8195399"
     },
     {
       "path": "tests/hall_reading_world.mjs",
@@ -10402,7 +10422,7 @@
     {
       "path": "tests/helpers.mjs",
       "mode": "0000644",
-      "sha256": "89d0ebdf842108bcf807bd08663e9f83566d9b0ae80e72ba038f8d4f0b30b0f8"
+      "sha256": "b3f0a87c51c9e655c712db00a0a8763e2fc08e4de3c6904c6080385e7c7dad14"
     },
     {
       "path": "tests/hierarchy-config.mjs",
@@ -10632,7 +10652,7 @@
     {
       "path": "tests/joinability_invite_only.mjs",
       "mode": "0000644",
-      "sha256": "082693b5e07c1c25cec17cde7f93a8716aafa94ead9b1cee76b1643f30edff79"
+      "sha256": "5311e076e8a72b993a235e57ebc54c9ecd529ccd31b65609432677a12e15e85d"
     },
     {
       "path": "tests/joinability_open.mjs",
@@ -11122,7 +11142,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "eeb54786e5cb1211f0036d7c72119082fe47c023502c017b0092c6b22f60f0c1"
+      "sha256": "22461d4febf616202af96aa37fc940a686841bbf68155094526455ae85ab9886"
     },
     {
       "path": "tests/projects_hub_pre_uat.mjs",
@@ -11174,6 +11194,11 @@
       "mode": "0000644",
       "sha256": "97d04ee39cc06b720d4a5b42f3e3cc614f64d9462b27471a1af7598b5e2929be"
     },
+    {
+      "path": "tests/provisioning_recommendations.mjs",
+      "mode": "0000644",
+      "sha256": "0557876002c1f0efde5a8e7c87702fa57df3a9efb26ea93b077969bcc10e3637"
+    },
     {
       "path": "tests/provisioning_restart.mjs",
       "mode": "0000644",
@@ -11847,7 +11872,7 @@
     {
       "path": "tests/task_detail_ui.mjs",
       "mode": "0000644",
-      "sha256": "5e7150f8651a3c147b17f51800f5f8afa1e9534b3ec545584e5c37792475b2aa"
+      "sha256": "d7b12d56b50a0412d50f3558065c681d92c0c631edfef5553164e646979e6fa5"
     },
     {
       "path": "tests/task_goal_link.mjs",
@@ -11999,11 +12024,21 @@
       "mode": "0000644",
       "sha256": "2a381bab380342e4fc556211d4821c85fdde1f676a6c5c6aa2421a89a573cd27"
     },
+    {
+      "path": "tests/visible_projects_feed.mjs",
+      "mode": "0000644",
+      "sha256": "4bf47b6aee92c54099c583726d05421a433ac5b5e82792a848d11c80d7ee7bd1"
+    },
     {
       "path": "tests/wandering_prefs.mjs",
       "mode": "0000644",
       "sha256": "745a868a2e13f34afd29f96840102205792bac810f2fd911c7da00f6a5695242"
     },
+    {
+      "path": "tests/watch_applications_queue.mjs",
+      "mode": "0000644",
+      "sha256": "b1f7df5aa40b89f8737c76d94def15c539514f7f439cca79a034bf37b922158d"
+    },
     {
       "path": "tests/web_admission_status.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 346 operations across 53 resource groups
+- 347 operations across 53 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -669,6 +669,8 @@ function createClient(opts = {}) {
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
+      // GET /provisioning/recommendations — rank: public — GET /provisioning/recommendations
+      getProvisioningRecommendations: (args) => request("GET", "/provisioning/recommendations", { hasBody: false }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
       // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles

package/clients/bongos-client/index.cjs

@@ -668,6 +668,8 @@ function createClient(opts = {}) {
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
+      // GET /provisioning/recommendations — rank: public — GET /provisioning/recommendations
+      getProvisioningRecommendations: (args) => request("GET", "/provisioning/recommendations", { hasBody: false }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
       // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles

package/clients/bongos-client/index.d.ts

@@ -97,6 +97,7 @@ export interface GetProvisioningInstancesIdResponse { instance: unknown; open_in
 export interface GetProvisioningInstancesIdSettingsResponse { ok: boolean; settings: unknown; planet: unknown; options: unknown }
 export interface GetProvisioningInstancesResponse { instances: unknown }
 export interface GetProvisioningOnboardPlanResponse { mode: unknown; steps: unknown }
+export interface GetProvisioningRecommendationsResponse { recommendations: unknown }
 export interface GetProvisioningSlugAvailableResponse { slug: unknown; available: unknown; reason: unknown; address: unknown }
 export interface GetProvisioningStarterBundlesResponse { core: unknown; bundles: unknown }
 export interface GetPublicBlockersIdResponse { blocker: unknown }
@@ -980,6 +981,8 @@ export interface BongosClient {
     postProvisioningInstancesIdTeardown(args?: RequestArgs): Promise<PostProvisioningInstancesIdTeardownResponse>;
     /** GET /provisioning/onboard-plan — rank: public */
     getProvisioningOnboardPlan(args?: RequestArgs): Promise<GetProvisioningOnboardPlanResponse>;
+    /** GET /provisioning/recommendations — rank: public */
+    getProvisioningRecommendations(args?: RequestArgs): Promise<GetProvisioningRecommendationsResponse>;
     /** GET /provisioning/slug-available — rank: any-builder */
     getProvisioningSlugAvailable(args?: RequestArgs): Promise<GetProvisioningSlugAvailableResponse>;
     /** GET /provisioning/starter-bundles — rank: public */

package/clients/bongos-client/index.mjs

@@ -665,6 +665,8 @@ export function createClient(opts = {}) {
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
+      // GET /provisioning/recommendations — rank: public — GET /provisioning/recommendations
+      getProvisioningRecommendations: (args) => request("GET", "/provisioning/recommendations", { hasBody: false }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
       // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles

package/docs/adr/0182-project-visibility-two-axes.md

@@ -161,6 +161,8 @@ Until then: `stealth` unqualified in product code and copy means the project sta
 - Anything reading `featured = true AND status = 'active'` as "is this public" is now wrong and must be found. `modules/platform-identity/routes/projects.js` is the known site.
 - **R16 makes D3's bound real, and D4's gate reach a second module.** Shipping R16 (task 1002335) surfaced one thing this ADR left implicit. D3 says `featured` may never put an unpublishable project on the map, so `PATCH /projects/:id/featured` now refuses a dark-matter row (409 `not_publishable`, `missing` in the details); un-featuring stays unconditional, since an already-featured husk must remain removable. And D4's "name what is missing" is owed to the owner *before* their project is ever catalogued on the hub — which is the `provisioning` plane, a different module that ADR 0083 forbids from importing `platform-identity`. Rather than let a two-field rule exist twice, the gate is published as a kernel seam port, `project.publishGate` (`modules/platform-identity/publish-gate.js`). `provisioning` resolves it **optionally** and declares no `consumes`: `platform-identity` is hub-only, the public map is a hub concept, and a platform without one must answer "no verdict" rather than invent a local rule — which is the same drift-avoidance argument that produced `publishableSql` in the first place.
 
+- **R06 landed the predicate swap and the redaction, and settled three things this ADR left to the implementer** (task 1002325, `modules/platform-identity/projects-feed.js`). (a) **A black hole carries no stable per-project key.** D2a lists `name`/`tagline`/`art_url`/`origin`, and an id looks harmless beside them — but any identifier that survives a state change lets an observer who kept yesterday's public feed diff it against today's and *name* the project that went stealth. So stealth rows are byte-identical to one another and the feed grew no public id at all; the orbs page keys by position. (b) **The redaction is an ALLOW-list, not a deny-list** — every key nulled except `state` and `orb` — so a column added to the feed later is anonymous without anyone remembering to come back to it, and it NULLS rather than deletes, keeping the feed's "never drop a key" contract. (c) **An unrecognised `visibility` draws as a black hole, not a planet**: this mapping is a privacy boundary, so a fourth enum value added without mapping it must fail closed. Two smaller notes: the route PATH keeps the word `featured` (it is rank:public and CORS-open, already fetched by a static site and other origins — renaming it would break them for nothing, and `ORDER BY featured DESC` is where the flag's D3 ranking job now lives); and `getRollupForBuilder`'s `is_public` was deliberately left on the OLD `featured AND active` predicate rather than widened with the feed, because a stealth project is on the map *anonymously* and naming it in a builder's profile would be the exact leak D2a forbids — how much of a cross-project record may be NAMED is ADR 0171 D2's question, and under-naming is the safe direction meanwhile.
+
 ## Alternatives rejected
 
 - **A stored four-valued enum including `unlisted`.** Rejected: it makes "unlisted" a choice competing with `private`, and it lets a project be simultaneously "publishable" and "unlisted" — two sources of truth for one question, which is the bug the derived gate prevents by construction.

package/docs/adr/0239-a-recommendation-is-a-table-that-carries-its-own-reason.md

@@ -0,0 +1,177 @@
+# 0239 — A recommendation is a table that carries its own reason; governance is a preview and invites are a seam
+
+- **Status:** Accepted
+- **Date:** 2026-09-03
+- **Tasks:** [#1002336](https://cloudbongos.com/builders#/task/1002336) (this decision — BV1.R17)
+- **Goal:** [#1000046](https://cloudbongos.com/builders#/goal/1000046) — Project creation: visibility and
+  customization; criteria `proj-module-select` ("additional modules are recommended (rule-based) from the
+  project's details"), `proj-governance-reco` ("a recommended governance setup … derived from its details"),
+  `proj-invite-builders` ("the owner can optionally invite guilds or top builders")
+- **Related:** [ADR 0237](<redacted>.md)
+  (R19, the per-type preset this adjusts), [ADR 0182](<redacted>.md) D4 (skipping the
+  interview is a supported answer), [ADR 0083](<redacted>.md) (the
+  one-way import rule that makes the invite lookup a seam),
+  task [#1002334](https://cloudbongos.com/builders#/task/1002334) (R15, the interview whose answer this reads),
+  task [#1002772](https://cloudbongos.com/builders#/task/1002772) (the declared project type),
+  task [#1003500](https://cloudbongos.com/builders#/task/1003500) / idea 1000552 (the deferred AI layer)
+
+## 1. The problem
+
+Three of goal 1000046's criteria ask the same question in three places: after an
+owner answers the optional project-detail interview, what do we *recommend* — which
+modules, which governance setup, which builders to invite. The goal's own text pins
+the near term: "near-term recommendations are rule-based and module search is
+lexical; the AI/embeddings layer … is a deferred follow-up captured in the idea
+inbox."
+
+R19 ([ADR 0237](<redacted>.md))
+already answered the type half — a starter bundle per declared project type — and
+said explicitly that it is "a declaration and not a rule engine … R17/R22 own the
+layer that reasons." This is that layer.
+
+## 2. Two inputs, and the description is not one of them
+
+The engine reads exactly two things, and they arrive separately because they are
+stored separately: `type` is a column (the closed set task 1002772 fixed —
+`game · research · business · non-profit · not-sure`) and `team_shape` is the one
+closed-answer key the R15 interview collects (`PROJECT_DETAIL_VOCAB.team_shape ∈
+solo | small-team | community`). The interview deliberately does not re-ask the type
+(ADR 0237 §2), so `recommendationsForDetails({ type, team_shape })` is the file that
+puts the two back together, and a caller holding a row passes
+`{ type: row.type, ...projectDetail(row) }`.
+
+The interview's *third* answer — the free-text `description` — is deliberately
+**not** read. Inferring a bundle from prose is the deferred semantic layer
+([#1003500](https://cloudbongos.com/builders#/task/1003500), idea 1000552), and ADR
+0237 §7 already rejected it once for the same reason.
+
+## 3. A table, and every row carries the sentence that explains it
+
+The engine is three frozen tables and a resolver over them — not a scorer, not a
+weighting, not a model:
+
+| table | keyed on | effect |
+|---|---|---|
+| `TEAM_SHAPE_RULES` | `team_shape` | add/remove ONE opt-in module from the type's bundle |
+| `GOVERNANCE_RULES` | `team_shape` | a named preset out of `GOVERNANCE_PRESETS` |
+| `INVITE_RULES` | `team_shape` | a `seeking` descriptor, or `null` for "suggest nobody" |
+
+Every row carries a `reason` — one sentence in the owner's own words, shipped
+alongside the effect rather than reconstructed by whichever surface renders it. That
+is the constraint that makes the whole thing auditable: a recommendation an owner
+cannot be told the reason for is one they cannot disagree with, and a reason written
+separately from the rule drifts from it the first time either changes.
+
+The three bundle rules today: `community` **adds** `discord` (somewhere for it to
+gather); `small-team` **adds** `dev-box` (one shared environment); `solo` **removes**
+`dev-box` (your own machine is the setup). They are few for the reason ADR 0237 §4
+gave — today's opt-in catalog is three modules wide, and a preselect an owner must
+audit is worse than none. The rules' job is to correct a preset the owner's answer
+contradicts, not to re-derive it.
+
+## 4. `adjustments` is a delta — a rule that changes nothing claims nothing
+
+`bundle.adjustments` lists only the rules that ACTUALLY moved the module list. The
+game bundle already carries `discord`, so a `community` answer records no adjustment
+even though its condition matched; the non-profit bundle has no `dev-box`, so a
+`solo` answer removes nothing and says nothing.
+
+The alternative — record the reason whenever the condition matches — was rejected
+because it conflates two different sentences: "discord is on because your project is
+a game" (the bundle, R19's opinion) and "we switched discord on because you said
+community" (the rule). A picker rendering the second over a module the owner would
+have had anyway is telling them something they can check and find false.
+
+## 5. Governance is a named preview, never an applied setting
+
+Criterion `proj-governance-reco` says it out loud: the recommendation "depends on the
+governance module (goal 1000030), which is planned but not yet built." So a preset
+here is a **name plus one sentence of what living under it feels like** — `owner-only`
+/ `trusted-team` / `open-contribution` — and never a set of roles or permissions,
+because there is nowhere to put them.
+
+Every recommendation carries `governance.applied: false`. A constant field looks
+redundant until you count the surfaces that otherwise hardcode the same fact: R25's
+preview step ([#1002344](https://cloudbongos.com/builders#/task/1002344)), R18's proof
+([#1002337](https://cloudbongos.com/builders#/task/1002337)), the wizard and the
+project page. One flag flips when goal 1000030 lands; a test pins it false until then.
+
+## 6. Invites are a seam, because the leaderboard is a sibling module
+
+`invites.suggested` is **always empty**, and that is a decision rather than an
+unfinished edge. Ranking builders means querying the leaderboard, which lives in
+`economy` — a sibling module `provisioning` may not import (the one-way rule, ADR
+0083). Making the route do it instead would cost the engine's purity, put a database
+read behind a public endpoint, and duplicate work
+[#1002347](https://cloudbongos.com/builders#/task/1002347) (R28) already owns and
+whose dependency is R27, not R17.
+
+So the engine emits what to look for — `invites.seeking = { kind: 'top-builders',
+limit }`, or `null` for "suggest nobody" — and R28 turns it into names. `null` is a
+real answer here: a solo builder is suggested nobody on purpose, which is a different
+statement from an empty list nobody has filled yet.
+
+## 7. Skipping is an answer, and every default is the narrowest one
+
+The interview is optional (ADR 0182 D4), so every table has a stated default for
+"nobody said" and each is deliberately the narrowest option: the type's own bundle
+unadjusted, `owner-only` governance, and no invites. Widening later costs one
+setting; a project that quietly granted strangers a role it was never asked to grant
+is not recovered by setting it back.
+
+An **off-vocabulary** `team_shape` — absent, misspelled, or a value that has since
+left the vocabulary — reads as *no answer*, exactly as `normalizeProjectDetail` drops
+it on the way in. The route follows the same rule: a missing or unusable query value
+returns 200 with the defaults, never a 400, because refusing the request would make
+the supported path an error.
+
+`tailored: boolean` is the machine-readable half of criterion
+`proj-detail-interview`'s split ("completing it produces tailored recommendations;
+skipping produces sensible defaults") — false exactly when no detail answer shaped
+anything. R18 is the live proof of that line.
+
+## 8. The read surface
+
+`GET /provisioning/recommendations?type=&team_shape=` returns
+`{ recommendations: { type, teamShape, tailored, bundle, governance, invites } }`.
+`bundle` is ADR 0237 §5's shape with `adjustments` added, so R20's picker
+([#1002339](https://cloudbongos.com/builders#/task/1002339)) and this engine resolve
+through the same `bundleForProjectType` and can never name different modules — a test
+asserts that against the live `starter-bundles` route.
+
+`rank: public`, the same absent gate as `starter-bundles` and `onboard-plan`: the
+signed-out wizard asks while the owner is still answering, *before* any row exists to
+be own-scoped against, and the answer is a declaration that names nothing private.
+The route touches no database, and the test proves it by stubbing `pool` to throw.
+
+## 9. Consequences
+
+- **The UI is not wired here.** R20 renders the picker, R22
+  ([#1002341](https://cloudbongos.com/builders#/task/1002341)) surfaces these
+  recommendations inside it, and R18 proves the details→recs / skip→defaults split.
+  The creation wizard currently hardcodes a `TEAM_META` copy table in
+  `modules/public-landing/public/projects.html` that says roughly what
+  `governance.preview` now says — R22 should collapse that duplicate into this route
+  rather than leave one sentence written twice.
+- **Adding a fourth team-shape answer is a two-file change.** The interview vocabulary
+  and this file, and `tests/provisioning_recommendations.mjs` fails the build if a
+  vocabulary value has no governance rule and no invite rule.
+- **A recommendation is still never a publish precondition** (ADR 0182 D4 — the bar is
+  name + description alone), and taking or declining one cannot move a project's
+  dark-matter state.
+
+## 10. Rejected
+
+- **Reading the free-text description** — that is the deferred AI/semantic layer
+  ([#1003500](https://cloudbongos.com/builders#/task/1003500)), and the goal pins the
+  near term as rule-based.
+- **Filling `invites.suggested` from `GET /public/leaderboard`** — the route exists and
+  is public, but reaching it means importing a sibling module, and R28 owns that work
+  behind a different dependency.
+- **A scoring function over weighted signals** — with two inputs and three opt-in
+  modules there is nothing to weigh, and a score cannot be shown to an owner as a
+  sentence they can disagree with.
+- **Recording a reason for every matched condition** — see §4; it makes a claim the
+  owner can check and find false.
+- **Refusing an unknown `team_shape` with a 400** — skipping is the supported path, so
+  the shape of a skipped answer must not be an error.