@bongos/core 1.19.532 → 1.19.534

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.532",
-  "core_contract": "1.19.532",
-  "source_commit": "0d85f8047f3d27e733f38cbc564ee04e52ade1ba",
+  "core_version": "1.19.534",
+  "core_contract": "1.19.534",
+  "source_commit": "1eed1abe54c1a615fc751be7b5c5361ed183e701",
   "source_ref": "HEAD",
-  "built_at": "2026-09-04T13:48:05.212Z",
+  "built_at": "2026-09-04T14:43:41.890Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 435,
+    "docs_redacted": 439,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1979,
+    "functional_verbatim": 1988,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2438,
-  "tree_sha256": "e9a3a6c31479fe08db5016d877a886d2a957224c77830e643951589e59a5fa7f",
+  "file_count": 2451,
+  "tree_sha256": "1d0ba8602e73d9b01a0bf440739e615efce023edf6cd5db2a27e12021eac8fda",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -387,7 +387,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "ae23995907a851acd2b2dbae901280926e3041ce64e16407d47ed5ba998d7c74"
+      "sha256": "22ae4bdb9bf36dfc3ce19fe38e64e8dded029087dac16d3ea20ccdbe1d860788"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -402,7 +402,7 @@
     {
       "path": "config/branding.neutral.json",
       "mode": "0000644",
-      "sha256": "c33b285d6a88d38eb15e062e0da845d29ec2aa7e6bfc5a4d321a3a49e0b7b2f9"
+      "sha256": "af8b7eea98085e2ec1365e3e4bdaaffe35df17e753c8891265b3839dc2a8d42b"
     },
     {
       "path": "config/design-tokens.neutral.json",
@@ -1729,20 +1729,40 @@
       "mode": "0000644",
       "sha256": "17a0018cfa4f42364a1567bee6bc98f8cf84311ce8344b218d4de9eab870b496"
     },
+    {
+      "path": "docs/adr/0244-a-catalog-search-is-a-view-over-the-rows-never-an-edit-to-the-selection.md",
+      "mode": "0000644",
+      "sha256": "a115ba411ec945223b0de36514fcbfb253205b79c2125c232081f35af3ec9a45"
+    },
+    {
+      "path": "docs/adr/0245-the-way-back-into-an-optional-step-is-that-step-s-own-answer-route.md",
+      "mode": "0000644",
+      "sha256": "eb4e39132264f6a4515276b470d6d431ccc3b38f3f14927080d7bc67e3aba57e"
+    },
+    {
+      "path": "docs/adr/0246-catalog-membership-is-a-projection-not-a-federation-side-effect.md",
+      "mode": "0000644",
+      "sha256": "4440a267f36bb1b22815a0fd192dd96f4dbd236ec5c73e108f9462a31f2a7ad9"
+    },
+    {
+      "path": "docs/adr/0247-the-join-door-is-one-composed-answer-and-dark-matter-has-no-live-verdict-yet.md",
+      "mode": "0000644",
+      "sha256": "f46ee74d7b83ad4422e1832fdba68a8b9ea0deccb425ab3083d4c8fbfd06eb02"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "fb28cbf7bb03cc69deb895b5e25956a440449c11f1fd977ee09655116e3fc3b0"
+      "sha256": "d1bb4772b43b56cf1efa16fa99f255535bd736910c4c0ead94249f19862c7152"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "b137673ee16cd6f7d32b0b24d12b6c8e844a2e6e415a8118a4d458c382e5724f"
+      "sha256": "44555316c4fd8655bd48185820784f8a351ddc1a874e6d905c38865c330e6be1"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "46e8c08e1e7b5bfa6fe2e709308a466f3764ed320702c93dbe74d5523bb1d74b"
+      "sha256": "59f85c4841c3e884ea88d03a8385b37d104e0b0bcf561c87412bc30912490831"
     },
     {
       "path": "docs/architecture.md",
@@ -1767,12 +1787,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "729633c41036ec0026d3ef1ac787f68cb6fb7ab77e3eb578f855b5ec2d63280f"
+      "sha256": "63719647c69dd90bafa957a9e24b772324b49a09c8e615cc4bc6eac65996e540"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "344a451940b630b1f6db2f97acb45eb387616311675b243dcc4381dc604ef77d"
+      "sha256": "c951cedd4efe1050dadb15f8bda65e0bd1e6f59aa775e2a407c9b676c27a7d5d"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2607,7 +2627,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "c7f035d61e8a45f2354256ae5fbbc16794ce6108ab3b5b712b054ade924df4ea"
+      "sha256": "6085fdda80f0c961067a044b890358fa148415638854029e63f764e262594aeb"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2617,7 +2637,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6ca40faade53a38c1de107d3bd73b9abb9ababfa89642ff49f42c2453fe8dcbb"
+      "sha256": "93a1f84761363805e0950743fa35a6b755957ef1a8621baa51705ba70f83ddd4"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5707,7 +5727,7 @@
     {
       "path": "modules/onboarding/module.json",
       "mode": "0000644",
-      "sha256": "36800847c9cc9d239bb4d0ec910b35b547f8c67e5db5cb1cd5aa63d801e4bf02"
+      "sha256": "6d27c15d955095fb278db240d7e68da87abbdab14b4dd10f98dfd0753746a3c1"
     },
     {
       "path": "modules/onboarding/newcomer-restock.js",
@@ -5732,7 +5752,7 @@
     {
       "path": "modules/onboarding/routes/access-requests.js",
       "mode": "0000644",
-      "sha256": "41729b14813c7f9d7ed93d8e9cc272f8ec6a97c610318ac5cb0fa2ff870a74c0"
+      "sha256": "ebebd2ce84727de2dff8411a6279aefb3792de51577a5ba04dc7d565cbce5494"
     },
     {
       "path": "modules/onboarding/routes/onboarding.js",
@@ -5872,7 +5892,7 @@
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
-      "sha256": "ea0ef93145343658eb46421ebc435181fe7233c35be7bc73a7cac229f53f6c08"
+      "sha256": "b798cbc2c6f4106c4eb94c9f7219ad1643bfb5ec9449e0384bf87b3f7ecccc30"
     },
     {
       "path": "modules/platform-identity/platform-identity.js",
@@ -5884,6 +5904,11 @@
       "mode": "0000644",
       "sha256": "b6eea95dbe66a3126fc2c73d93237cf38dd648a803e910eb88fbd5c780ccef62"
     },
+    {
+      "path": "modules/platform-identity/project-catalog.js",
+      "mode": "0000644",
+      "sha256": "2f83a6c37f3cabb5ef04d20f0d6e92a39218528bad214a5e61e07eb3bba1468e"
+    },
     {
       "path": "modules/platform-identity/project-stats.js",
       "mode": "0000644",
@@ -5912,7 +5937,7 @@
     {
       "path": "modules/platform-identity/routes/my-projects.js",
       "mode": "0000644",
-      "sha256": "9f3a833a455c14ea535910ec09d86a2c5bfb5419678274cb5d6ea8d790dd7883"
+      "sha256": "70148631797a5b75a033861f696bf43535f81e8d1f44284a1d935b741a0f6304"
     },
     {
       "path": "modules/platform-identity/routes/profile.js",
@@ -5922,7 +5947,7 @@
     {
       "path": "modules/platform-identity/routes/projects.js",
       "mode": "0000644",
-      "sha256": "ec297f39a3d7f23b05b24ea6837bb9bfd07a12f99734788e9332769c59acc7b7"
+      "sha256": "f90fbe23065310a09769bc46fdb0703e460f402d5a4e0cc490eba70cf67965ea"
     },
     {
       "path": "modules/platform-identity/routes/public-profile.js",
@@ -5937,7 +5962,7 @@
     {
       "path": "modules/platform-identity/routes/sso.js",
       "mode": "0000644",
-      "sha256": "dc3eaa8789a28a389ddeaac88f5cd514db8bf10705f430839f0bf164fc963674"
+      "sha256": "6f89a384bfe46027ac330324b933255c2d55764b53df0c06571ecfbce6b98c23"
     },
     {
       "path": "modules/platform-identity/scouting-authz.js",
@@ -5964,6 +5989,11 @@
       "mode": "0000644",
       "sha256": "7cb9dac9cb87b679e1ae50e4112b3a7928a38ebb9902c8947a74d17bec4d9009"
     },
+    {
+      "path": "modules/provisioning/catalog-bridge.js",
+      "mode": "0000644",
+      "sha256": "35a3c70ebe49b37a18044d6756d97b9caea87917a9fdbe0198fa05be25f5457a"
+    },
     {
       "path": "modules/provisioning/migrations/provisioning_001_tables.sql",
       "mode": "0000644",
@@ -6052,7 +6082,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "8745258599d655b34204e5878b413308ae48a012b0306bde3297e98e452b3686"
+      "sha256": "d3d376a0aafc52dda55d9d2f2dcdc3d5baf9370a766cd4328cd00b314e897c99"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -6072,7 +6102,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "e08199bc9146bd3122ca038637a0e390b9f5e636a102fa290dba414cf6cafdc1"
+      "sha256": "3528d699cb9c0f396eeda2e9fc26eb9b89c02e0b0ca34beeb20fd84c832f5241"
     },
     {
       "path": "modules/provisioning/starter-bundles.js",
@@ -6087,7 +6117,7 @@
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
       "mode": "0000644",
-      "sha256": "03e4ba2a5625ac321a95392c91b8e90cc6f7e235dc9a0c4bbcb742cbd459b083"
+      "sha256": "4dceb82f4dbeb39128c66d666df0642aacb38988f7c6d01c55f6515bcd8ad798"
     },
     {
       "path": "modules/provisioning/ui/.gitkeep",
@@ -6327,7 +6357,7 @@
     {
       "path": "modules/public-landing/public/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "f10975893b3522accc6592246af0b07645c8d910c7637ecc5a006064a0988057"
+      "sha256": "8da9101c633ea363802a4ac2831fe55d182308573a923bec50b4ce00e4f8254b"
     },
     {
       "path": "modules/public-landing/public/assets/verro-medallion.png",
@@ -6587,7 +6617,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "7147ff51b2eaa3487557fff35f4fc7c3e4f6164fd8054e41c76064bcfe932e08"
+      "sha256": "456100c301325c4d303061a00804fa67f7dfc7d4494b15aea190641541db6531"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -6597,7 +6627,7 @@
     {
       "path": "modules/public-landing/public/projects.states.json",
       "mode": "0000644",
-      "sha256": "16fbd27a36c9c32696539c74a815dc9b3f187f5b539b393e3bee7f7dabc4e2a6"
+      "sha256": "2cd5e5598d59e8dbf813658c950821bbb9a34b57823bdfb3be7f61d834bf7714"
     },
     {
       "path": "modules/public-landing/public/terms.html",
@@ -7022,7 +7052,7 @@
     {
       "path": "modules/ui-design/kit/serve.js",
       "mode": "0000644",
-      "sha256": "4c52462cf61559e9a424107398eca58aa56b3783338827dda6110200fcdfd00a"
+      "sha256": "e0d76468a01c6e76c0f106714b31bc42f6b3cb12cf2b73a5739253fab1b45b90"
     },
     {
       "path": "modules/ui-design/kit/tells.js",
@@ -7332,12 +7362,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9f7a9f1769483872e239544ecd2a8c5900dd84cde6a846c974593acc3dc2c7b8"
+      "sha256": "468fe9079df95bf33112f63df0b3e72ce952db87b121b4127156e6c615eb2bbb"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b5ecef3b6c7a8d52cfdae026ae1fe9b805e97e7c5c6f015b668aed8e7bcef684"
+      "sha256": "ac5e20798f6621e686013476b57d4034f1ce36d5562e684e7f3c6bee0747c759"
     },
     {
       "path": "public-docs/index.html",
@@ -7772,7 +7802,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "c6a11cbffff99b725d60dff415622ff3ade8e9c56ede14edc01828ebb80d8415"
+      "sha256": "172f890f2a4297d287008f0ba11bc04fc801ea21a52728855967b178e2875373"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -8092,7 +8122,7 @@
     {
       "path": "scripts/gds/provision-net.js",
       "mode": "0000644",
-      "sha256": "01b6ef89cbef4d898934c1802dec416c6085f0dde5ae49012bd2fa7a14bb9589"
+      "sha256": "86c308f807a27f448a1f90f4257e74238c177b885468b95b89d379c7249366fa"
     },
     {
       "path": "scripts/gds/provision-repo.js",
@@ -8864,6 +8894,11 @@
       "mode": "0000644",
       "sha256": "c9edcf9cb1f027ca122388beabae488d2b771b9e7aee2cd12fbdb48ea6f0ded8"
     },
+    {
+      "path": "src/bongos/project-door.js",
+      "mode": "0000644",
+      "sha256": "045c0edceb0f71c3b488471ffb3a1c20c58014d0592c9ac44572245a7eb08960"
+    },
     {
       "path": "src/bongos/project-settings.js",
       "mode": "0000644",
@@ -8997,7 +9032,7 @@
     {
       "path": "src/branding.js",
       "mode": "0000644",
-      "sha256": "e603fa0fabe63b7150f649db1ecaa50ef0908a803396e808cf212f4378cbb053"
+      "sha256": "8885ee12599cdfdaf9bdb073185c83a5532bdc46d07edaeab42e36ccdc12f8e1"
     },
     {
       "path": "src/build-info.js",
@@ -9017,7 +9052,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "dcab3a87e36bb416a45b58bacfc472980145fefeeff6049beb8a9f72aabb0884"
+      "sha256": "e97c60a63ed6befae3e842e86f97cf592bb58f45cdbe488d13cb0f5e576c75b0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9072,7 +9107,7 @@
     {
       "path": "tests/access_requests_invite.mjs",
       "mode": "0000644",
-      "sha256": "4d8435e7f8b949715ee40843beddc1868105edd9c67b269cfa8f510a192e9212"
+      "sha256": "7229451a9a9cb74049b7fea808458423d8a2754c213e6974593811cd1b4322b1"
     },
     {
       "path": "tests/account_existence_rate_limit.mjs",
@@ -9172,7 +9207,7 @@
     {
       "path": "tests/application_lifecycle.mjs",
       "mode": "0000644",
-      "sha256": "ac8128aa0834f420ee744e057cd2baa01569611052d199dba9e5d28986ff1166"
+      "sha256": "249c97a172d0b77dae22dc561dc7c02dd48b636956df296647d62d7c6e213727"
     },
     {
       "path": "tests/architect.mjs",
@@ -9499,6 +9534,11 @@
       "mode": "0000644",
       "sha256": "de9d8f8c1daab1e48122febd16699ac519890b6e1296edb7966d835434851786"
     },
+    {
+      "path": "tests/catalog_only_client.mjs",
+      "mode": "0000644",
+      "sha256": "2eb721978e016514ef53cf5083dbbc5d38a2db57cd75786fdd6b6a12e5488dff"
+    },
     {
       "path": "tests/category_advisory_guard.mjs",
       "mode": "0000644",
@@ -9722,7 +9762,7 @@
     {
       "path": "tests/currency_label.mjs",
       "mode": "0000644",
-      "sha256": "09a937b9a9550b77659c0e60b3bc44c45378fdb3545c510d7579d4711518a733"
+      "sha256": "b88f7ab55948f0bfbf0e6982cc96465ff2c34d76b143f40b86f933c323b8ff1d"
     },
     {
       "path": "tests/cutover_codemod.mjs",
@@ -10957,7 +10997,7 @@
     {
       "path": "tests/module_api.mjs",
       "mode": "0000644",
-      "sha256": "839cbdc51d53f6719671ff1f2caa431d52a8b76636cd7973350000510510779b"
+      "sha256": "c7eadd36ae57c2f8976bf30bbd4c5d6ac3db0c1a8f67319860b3e4f85b5b5bc1"
     },
     {
       "path": "tests/module_catalog.mjs",
@@ -11229,11 +11269,36 @@
       "mode": "0000644",
       "sha256": "6a7a223a678b56333befaed017429e5b9d8a81e4405efae72a23355902517d9d"
     },
+    {
+      "path": "tests/project_catalog_bridge.mjs",
+      "mode": "0000644",
+      "sha256": "f4c023348054679885b8aefb8dcb700d23f3a67316e898f02e7cb0ecda75e9ff"
+    },
+    {
+      "path": "tests/project_catalog_routes.mjs",
+      "mode": "0000644",
+      "sha256": "5918d1ce7c106e5d7baa9cb989d52f3e82ac2aaf45a89f9a9bb154066106dccc"
+    },
     {
       "path": "tests/project_door_ui.mjs",
       "mode": "0000644",
       "sha256": "29f59ab64b231a7ec5d17a3e784d451f75d80c19efd4cb6a523d263e8f88b581"
     },
+    {
+      "path": "tests/project_join_door.mjs",
+      "mode": "0000644",
+      "sha256": "c0313968f5c6b07061443cfdbb0d928ba3067fb118cdd6fcf5892788189d22f7"
+    },
+    {
+      "path": "tests/project_join_door_route.mjs",
+      "mode": "0000644",
+      "sha256": "9da8c3416b4d06f82fdf8254aec216d8e7a7368b697f151f5d58f1c286f86639"
+    },
+    {
+      "path": "tests/project_modules_ui.mjs",
+      "mode": "0000644",
+      "sha256": "e728a4c1d13ea3a54910d0a706522a780db138783202a09f300900b8c661ae2e"
+    },
     {
       "path": "tests/project_stats.mjs",
       "mode": "0000644",
@@ -11247,17 +11312,17 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "f8e557372a86d42dc0433414a1d5821a350dc545056fcc8104aa151b51e939f7"
+      "sha256": "2ef099cea46b1ffa0841d1845dedf00de047de4f9c6844baaabdcd317a5eebac"
     },
     {
       "path": "tests/projects_hub_module_picker.mjs",
       "mode": "0000644",
-      "sha256": "55b7912d1985ea1e02874b479c9d0453c25df48bfad6287ba9402df50326d6ed"
+      "sha256": "44981254fda6a07522d650210127fae6d65ed4d06e539f8a555c860c74de8c64"
     },
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "fef872ed80c7efdbf37e0672067f555c76aa17368a515afb99b1fa7e7ca3c4b4"
+      "sha256": "294ecd72fa9e1c67cba9c2411c57447e459426682586c099adcd93b606530def"
     },
     {
       "path": "tests/promote_goal_id.mjs",
@@ -11282,7 +11347,7 @@
     {
       "path": "tests/provision_settings_apply.mjs",
       "mode": "0000644",
-      "sha256": "9a04386b3047177bb55b6d392db88764f06f92e5c0b20c16ed9e0f8ce520b07d"
+      "sha256": "9a09eb9bd47ff36a991b7208d0bada1fb91e3f8f03fe36a3ac4b5549b56b48ca"
     },
     {
       "path": "tests/provisioning_callback_page.mjs",
@@ -11307,7 +11372,7 @@
     {
       "path": "tests/provisioning_module_selection.mjs",
       "mode": "0000644",
-      "sha256": "4a27e1641d949f261a8ba1b72816a8b077fc8a55862c4eef4091b453b7cfd45c"
+      "sha256": "a8cb68c1f21a7c6547ef382b4641b80c1c9e46a2aad415f75dbfde36224079fd"
     },
     {
       "path": "tests/provisioning_onboard_mode.mjs",
@@ -11327,17 +11392,17 @@
     {
       "path": "tests/provisioning_settings.mjs",
       "mode": "0000644",
-      "sha256": "6f78a45d0c68a0da780d40c602f23bca3d48a80524218d4d7d311b2f8574dbee"
+      "sha256": "a7ec1145f695ed066c322bbd88f5f1dd3f3b47620ca4314e57860876a7394fe7"
     },
     {
       "path": "tests/provisioning_settings_apply.mjs",
       "mode": "0000644",
-      "sha256": "c453bab3768953257be481cb8df700530f964e167fdca073cf4ae69892930a79"
+      "sha256": "7fc80fc5576aba1dd10c0416899ade5fa2c9380ea8c1a995aaa99745aa56c29c"
     },
     {
       "path": "tests/provisioning_settings_env.mjs",
       "mode": "0000644",
-      "sha256": "4f51ea07fe3d80d52d6998547b028bec0a97267210faeffd75d9a47f7b5643e8"
+      "sha256": "a941c67c8b5640bdbacc0b5078fadacc79d1332befeb40bc3ebe82cd36764552"
     },
     {
       "path": "tests/provisioning_slug_available.mjs",

package/clients/bongos-client/index.d.ts

@@ -171,7 +171,7 @@ export interface PatchMeSkillPrefsResponse { prefs: unknown; effective: unknown;
 export interface PatchMeSoundPrefsResponse { prefs: unknown; effective: unknown; effective_map: unknown; volume: unknown; defaults: unknown; known_sounds: unknown }
 export interface PatchProjectsIdFeaturedRequest { featured: boolean }
 export interface PatchProjectsIdFeaturedResponse { project: unknown }
-export interface PatchProvisioningInstancesIdDetailRequest { description?: string; detail?: Record<string, unknown> }
+export interface PatchProvisioningInstancesIdDetailRequest { description?: string; detail?: Record<string, unknown>; modules?: string[] }
 export interface PatchProvisioningInstancesIdDetailResponse { ok: boolean; description: unknown; detail: unknown; options: unknown; publish: unknown; modules: unknown }
 export interface PatchProvisioningInstancesIdSettingsResponse { ok: boolean; saved: unknown; planet: unknown; push: unknown }
 export interface PatchTaskRecommendationsIdRequest { status: "declined" | "withdrawn" }

package/config/branding.neutral.json

@@ -27,10 +27,11 @@
     "idp": false
   },
   "project": {
-    "_note": "Per-project policy the PLATFORM decides and this instance OBEYS (task 1003139, goal 1000058). Stored on the platform's provisioning_instances.settings; written here as <PREFIX>_PLATFORM_VISIBILITY / <PREFIX>_JOINABILITY / <PREFIX>_VISIBILITY by the provisioning runner, which re-writes web.env and restarts the service when the owner changes one. The defaults are TODAY's behavior, so an instance that never receives a push — a self-hosted one, or one provisioned before this channel — keeps behaving exactly as it does now. platformVisibility (who may READ this instance's own pages): public | gated. joinability (HOW someone becomes a member): open | apply | invite_only. visibility (the join door, ADR 0182 D1 — how this project stands on the platform's map): public | private | stealth; it does NOT decide whether the project is on the map, publishability does.",
+    "_note": "Per-project policy the PLATFORM decides and this instance OBEYS (task 1003139, goal 1000058). Stored on the platform's provisioning_instances.settings; written here as <PREFIX>_PLATFORM_VISIBILITY / <PREFIX>_JOINABILITY / <PREFIX>_VISIBILITY by the provisioning runner, which re-writes web.env and restarts the service when the owner changes one. The defaults are TODAY's behavior, so an instance that never receives a push — a self-hosted one, or one provisioned before this channel — keeps behaving exactly as it does now. platformVisibility (who may READ this instance's own pages): public | gated. joinability (HOW someone becomes a member): open | apply | invite_only. visibility (the join door, ADR 0182 D1 — how this project stands on the platform's map): public | private | stealth; it does NOT decide whether the project is on the map, publishability does. joinGrant (what a PUBLIC join GRANTS): view | apply | full — the ceiling joinability may only narrow (ADR 0182 D6 / ADR 0245); `full` narrows nothing, which is why it is the default.",
     "platformVisibility": "public",
     "joinability": "apply",
-    "visibility": "public"
+    "visibility": "public",
+    "joinGrant": "full"
   },
   "repo": {
     "owner": "",

package/docs/adr/0244-a-catalog-search-is-a-view-over-the-rows-never-an-edit-to-the-selection.md

@@ -0,0 +1,116 @@
+# 0244 — A catalog search is a view over the rows, never an edit to the selection
+
+- **Status:** Accepted
+- **Date:** 2026-09-04
+- **Tasks:** [#1002340](https://cloudbongos.com/builders#/task/1002340) (this decision — BV1.R21)
+- **Goal:** [#1000046](https://cloudbongos.com/builders#/goal/1000046) — Project creation, criterion
+  `proj-module-select` ("during setup a default set of modules is pre-selected…")
+- **Related:** [ADR 0237](<redacted>.md)
+  (R19 — the per-type presets, and the file that already said "R21 searches the catalog"),
+  [ADR 0240](<redacted>.md)
+  (R20 — the picker, and the three-valued `modules` column whose `null` this must not disturb),
+  [ADR 0243](<redacted>.md)
+  (R22 — the tailored preselect the search now filters)
+
+## 1. The problem
+
+The picker paints one row per optional module. The catalog is three rows today
+and is meant to grow — the module system's whole point is that an instance adds
+modules — so R21 asks for a keyword search over it.
+
+A search over a list of *links* is trivial. A search over a list of **toggles**
+is not, because the list is also an answer. Two things can go wrong the moment a
+row can be hidden:
+
+1. **The filter edits the answer.** The natural implementation of "show only the
+   matching rows" is to narrow the array the panel renders *and* the array it
+   reads back — at which point typing `discord` and pressing Next files a project
+   with one module instead of three. The bug is silent: every screen looks right.
+2. **The filter lies about the answer.** Even a filter that only narrows the
+   *render* leaves a switched-on module off screen. The owner sees one row, sees
+   it unticked, and reasonably concludes nothing else is on. ADR 0237's standard
+   for the preselect — "a preselect an owner cannot see the reason for is one
+   they have to audit" — applies here in its harsher form: a preselect they
+   cannot **see at all** is one they cannot audit.
+
+## 2. Decision
+
+**The search is a view. `state.modules` is the answer. The view may not write to
+it.**
+
+Concretely, in `modules/public-landing/public/projects.html`'s picker block:
+
+- `moduleQuery` is a plain variable that holds what is typed. It is **not** part
+  of the draft — `saveDraft()` is never called from the input handler — so a
+  resumed draft never comes back mid-search, and a search can never be the thing
+  that turns an untouched picker into an answered one (ADR 0240's `null`).
+- `visibleModules()` derives, per render, the rows the current query leaves.
+  `pickedModules()`, `modulesForCreate()` and `extrasRow()` are untouched and
+  keep reading the whole catalog, so what rides the create request and what the
+  review names are both independent of what is on screen.
+- **The panel states the part the filter is hiding.** One line under the field:
+  `Showing 1 of 3. 2 extras are switched on, including any this search is
+  hiding.` It is silent with an empty query, and it counts what is *on*, not what
+  is *visible* — which is the whole point of it existing.
+- An empty query is not a search: every row shows, and the line goes quiet. So
+  does a query of nothing but spaces.
+
+## 3. What "matching" means, and what it deliberately does not
+
+`moduleMatches(mod, terms)` is a pure function over one catalog row:
+
+> lower-case the row's **label + summary + key** into one haystack; every
+> whitespace-separated term must appear in it as a **substring**.
+
+- **AND across terms.** An owner adding a word is saying the list is still too
+  long; OR would grow it, which is the opposite of what they asked for.
+- **Substring, not word-boundary.** A half-typed word must still find its module,
+  because the field filters on every keystroke and a filter that shows nothing
+  until you finish typing reads as a broken one.
+- **The key is searchable even though it is never shown.** It costs nothing and
+  it is what a returning owner (or a support answer, or our own docs) actually
+  names a module by.
+- **No ranking, no fuzziness, no synonyms.** The catalog is small enough that
+  order is the catalog's order, and a rank that reorders toggles under a typing
+  hand is a worse experience than a filter that does not.
+- **Not semantic.** "Somewhere for people to chat" finds nothing, and that is the
+  scope line: search by meaning is deferred to idea 1000552 with the rest of the
+  AI layer for project creation. A lexical filter that admits it is lexical is
+  honest; one that half-guesses is not.
+
+The whole matcher is a named function on the page precisely so the vm harness in
+`tests/projects_hub_module_picker.mjs` can run it directly — the same reason
+`bundleForAnswers` is a function and not an inline expression.
+
+## 4. Consequences
+
+- The picker scales past the point where the band is scannable, with no server
+  work: the catalog already arrives whole in the one `GET
+  /provisioning/starter-bundles` read (ADR 0237), so typing costs no round trip
+  and adds no failure mode.
+- BV1.R24's proof path — *create → bundle preselected → search + add → enabled* —
+  works because a toggle made while filtered still re-derives the answer in
+  **catalog order**, exactly as an unfiltered toggle does.
+- When the catalog fails to load the field is hidden rather than disabled: a
+  search box over a list that is not there can only disappoint.
+- A future by-meaning search replaces `moduleMatches` and nothing else. The
+  view/answer split is what makes that swap safe.
+
+## 5. Alternatives considered
+
+- **Filtering the array the panel reads back** (the "obvious" implementation) —
+  rejected: it makes the search an editor of the answer, which is failure mode 1
+  above, and it is silent.
+- **Hiding matched-out rows with CSS instead of not rendering them** — same
+  outcome for the owner, but it puts `aria-pressed` toggles in the accessibility
+  tree that a sighted owner cannot see, and the empty-result case still needs its
+  own line. Rendering fewer rows is the simpler truth.
+- **Keeping switched-on rows pinned at the top regardless of the query** — it
+  makes the count line unnecessary, but it means a search sometimes shows rows
+  that do not match, which is a filter that lies in the other direction. The
+  count says the same thing without breaking the band's one rule.
+- **Persisting the query in the draft** — a search is a way of looking, not a
+  decision. Restoring one on a resumed draft would hide most of the catalog from
+  an owner who did not ask for that.
+- **Debouncing the input** — the filter is a pass over three-to-a-few-dozen rows
+  of already-loaded data. A delay would only make the field feel slower.