@bongos/core 1.19.533 → 1.19.534

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.533",
-  "core_contract": "1.19.533",
-  "source_commit": "03699f66aaf653282fcbb775d32389f301c822f8",
+  "core_version": "1.19.534",
+  "core_contract": "1.19.534",
+  "source_commit": "1eed1abe54c1a615fc751be7b5c5361ed183e701",
   "source_ref": "HEAD",
-  "built_at": "2026-09-04T14:01:59.226Z",
+  "built_at": "2026-09-04T14:43:41.890Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 436,
+    "docs_redacted": 439,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1979,
+    "functional_verbatim": 1988,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2439,
-  "tree_sha256": "2ab0086b311db79080f1d46f9e35341d02d01ed318907fcf85a11f4dd19beb38",
+  "file_count": 2451,
+  "tree_sha256": "1d0ba8602e73d9b01a0bf440739e615efce023edf6cd5db2a27e12021eac8fda",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -387,7 +387,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "ae23995907a851acd2b2dbae901280926e3041ce64e16407d47ed5ba998d7c74"
+      "sha256": "22ae4bdb9bf36dfc3ce19fe38e64e8dded029087dac16d3ea20ccdbe1d860788"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -402,7 +402,7 @@
     {
       "path": "config/branding.neutral.json",
       "mode": "0000644",
-      "sha256": "c33b285d6a88d38eb15e062e0da845d29ec2aa7e6bfc5a4d321a3a49e0b7b2f9"
+      "sha256": "af8b7eea98085e2ec1365e3e4bdaaffe35df17e753c8891265b3839dc2a8d42b"
     },
     {
       "path": "config/design-tokens.neutral.json",
@@ -1734,20 +1734,35 @@
       "mode": "0000644",
       "sha256": "a115ba411ec945223b0de36514fcbfb253205b79c2125c232081f35af3ec9a45"
     },
+    {
+      "path": "docs/adr/0245-the-way-back-into-an-optional-step-is-that-step-s-own-answer-route.md",
+      "mode": "0000644",
+      "sha256": "eb4e39132264f6a4515276b470d6d431ccc3b38f3f14927080d7bc67e3aba57e"
+    },
+    {
+      "path": "docs/adr/0246-catalog-membership-is-a-projection-not-a-federation-side-effect.md",
+      "mode": "0000644",
+      "sha256": "4440a267f36bb1b22815a0fd192dd96f4dbd236ec5c73e108f9462a31f2a7ad9"
+    },
+    {
+      "path": "docs/adr/0247-the-join-door-is-one-composed-answer-and-dark-matter-has-no-live-verdict-yet.md",
+      "mode": "0000644",
+      "sha256": "f46ee74d7b83ad4422e1832fdba68a8b9ea0deccb425ab3083d4c8fbfd06eb02"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "b34cab20b46a17a183ce54b2aed2bb09f03c55c47c7f6300b43fc32c86a79421"
+      "sha256": "d1bb4772b43b56cf1efa16fa99f255535bd736910c4c0ead94249f19862c7152"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "b137673ee16cd6f7d32b0b24d12b6c8e844a2e6e415a8118a4d458c382e5724f"
+      "sha256": "44555316c4fd8655bd48185820784f8a351ddc1a874e6d905c38865c330e6be1"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "46e8c08e1e7b5bfa6fe2e709308a466f3764ed320702c93dbe74d5523bb1d74b"
+      "sha256": "59f85c4841c3e884ea88d03a8385b37d104e0b0bcf561c87412bc30912490831"
     },
     {
       "path": "docs/architecture.md",
@@ -1772,12 +1787,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "b42faf85d36a5411a0a1227ca1dd52c7d1f0f741332f03f2fb66d5fa90bc3ea0"
+      "sha256": "63719647c69dd90bafa957a9e24b772324b49a09c8e615cc4bc6eac65996e540"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "f1a02c1bad4249ae04fc7c0758c5e6efd2df2e647be3d89c531a3daeb5281826"
+      "sha256": "c951cedd4efe1050dadb15f8bda65e0bd1e6f59aa775e2a407c9b676c27a7d5d"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2612,7 +2627,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "c7f035d61e8a45f2354256ae5fbbc16794ce6108ab3b5b712b054ade924df4ea"
+      "sha256": "6085fdda80f0c961067a044b890358fa148415638854029e63f764e262594aeb"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2622,7 +2637,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "4b74bef8f5b808fa3c7990b8fd727c26be2c929d64805e071489f1ca40a7f339"
+      "sha256": "93a1f84761363805e0950743fa35a6b755957ef1a8621baa51705ba70f83ddd4"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5712,7 +5727,7 @@
     {
       "path": "modules/onboarding/module.json",
       "mode": "0000644",
-      "sha256": "36800847c9cc9d239bb4d0ec910b35b547f8c67e5db5cb1cd5aa63d801e4bf02"
+      "sha256": "6d27c15d955095fb278db240d7e68da87abbdab14b4dd10f98dfd0753746a3c1"
     },
     {
       "path": "modules/onboarding/newcomer-restock.js",
@@ -5737,7 +5752,7 @@
     {
       "path": "modules/onboarding/routes/access-requests.js",
       "mode": "0000644",
-      "sha256": "41729b14813c7f9d7ed93d8e9cc272f8ec6a97c610318ac5cb0fa2ff870a74c0"
+      "sha256": "ebebd2ce84727de2dff8411a6279aefb3792de51577a5ba04dc7d565cbce5494"
     },
     {
       "path": "modules/onboarding/routes/onboarding.js",
@@ -5877,7 +5892,7 @@
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
-      "sha256": "ea0ef93145343658eb46421ebc435181fe7233c35be7bc73a7cac229f53f6c08"
+      "sha256": "b798cbc2c6f4106c4eb94c9f7219ad1643bfb5ec9449e0384bf87b3f7ecccc30"
     },
     {
       "path": "modules/platform-identity/platform-identity.js",
@@ -5889,6 +5904,11 @@
       "mode": "0000644",
       "sha256": "b6eea95dbe66a3126fc2c73d93237cf38dd648a803e910eb88fbd5c780ccef62"
     },
+    {
+      "path": "modules/platform-identity/project-catalog.js",
+      "mode": "0000644",
+      "sha256": "2f83a6c37f3cabb5ef04d20f0d6e92a39218528bad214a5e61e07eb3bba1468e"
+    },
     {
       "path": "modules/platform-identity/project-stats.js",
       "mode": "0000644",
@@ -5917,7 +5937,7 @@
     {
       "path": "modules/platform-identity/routes/my-projects.js",
       "mode": "0000644",
-      "sha256": "9f3a833a455c14ea535910ec09d86a2c5bfb5419678274cb5d6ea8d790dd7883"
+      "sha256": "70148631797a5b75a033861f696bf43535f81e8d1f44284a1d935b741a0f6304"
     },
     {
       "path": "modules/platform-identity/routes/profile.js",
@@ -5927,7 +5947,7 @@
     {
       "path": "modules/platform-identity/routes/projects.js",
       "mode": "0000644",
-      "sha256": "ec297f39a3d7f23b05b24ea6837bb9bfd07a12f99734788e9332769c59acc7b7"
+      "sha256": "f90fbe23065310a09769bc46fdb0703e460f402d5a4e0cc490eba70cf67965ea"
     },
     {
       "path": "modules/platform-identity/routes/public-profile.js",
@@ -5942,7 +5962,7 @@
     {
       "path": "modules/platform-identity/routes/sso.js",
       "mode": "0000644",
-      "sha256": "dc3eaa8789a28a389ddeaac88f5cd514db8bf10705f430839f0bf164fc963674"
+      "sha256": "6f89a384bfe46027ac330324b933255c2d55764b53df0c06571ecfbce6b98c23"
     },
     {
       "path": "modules/platform-identity/scouting-authz.js",
@@ -5969,6 +5989,11 @@
       "mode": "0000644",
       "sha256": "7cb9dac9cb87b679e1ae50e4112b3a7928a38ebb9902c8947a74d17bec4d9009"
     },
+    {
+      "path": "modules/provisioning/catalog-bridge.js",
+      "mode": "0000644",
+      "sha256": "35a3c70ebe49b37a18044d6756d97b9caea87917a9fdbe0198fa05be25f5457a"
+    },
     {
       "path": "modules/provisioning/migrations/provisioning_001_tables.sql",
       "mode": "0000644",
@@ -6057,7 +6082,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "8745258599d655b34204e5878b413308ae48a012b0306bde3297e98e452b3686"
+      "sha256": "d3d376a0aafc52dda55d9d2f2dcdc3d5baf9370a766cd4328cd00b314e897c99"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -6077,7 +6102,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "e08199bc9146bd3122ca038637a0e390b9f5e636a102fa290dba414cf6cafdc1"
+      "sha256": "3528d699cb9c0f396eeda2e9fc26eb9b89c02e0b0ca34beeb20fd84c832f5241"
     },
     {
       "path": "modules/provisioning/starter-bundles.js",
@@ -6092,7 +6117,7 @@
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
       "mode": "0000644",
-      "sha256": "03e4ba2a5625ac321a95392c91b8e90cc6f7e235dc9a0c4bbcb742cbd459b083"
+      "sha256": "4dceb82f4dbeb39128c66d666df0642aacb38988f7c6d01c55f6515bcd8ad798"
     },
     {
       "path": "modules/provisioning/ui/.gitkeep",
@@ -6332,7 +6357,7 @@
     {
       "path": "modules/public-landing/public/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "f10975893b3522accc6592246af0b07645c8d910c7637ecc5a006064a0988057"
+      "sha256": "8da9101c633ea363802a4ac2831fe55d182308573a923bec50b4ce00e4f8254b"
     },
     {
       "path": "modules/public-landing/public/assets/verro-medallion.png",
@@ -6592,7 +6617,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "16d728f41b1fc8b72fb1ac74d6b97b8bb0709f8a490e660062d21a964b52a4f1"
+      "sha256": "456100c301325c4d303061a00804fa67f7dfc7d4494b15aea190641541db6531"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -7027,7 +7052,7 @@
     {
       "path": "modules/ui-design/kit/serve.js",
       "mode": "0000644",
-      "sha256": "4c52462cf61559e9a424107398eca58aa56b3783338827dda6110200fcdfd00a"
+      "sha256": "e0d76468a01c6e76c0f106714b31bc42f6b3cb12cf2b73a5739253fab1b45b90"
     },
     {
       "path": "modules/ui-design/kit/tells.js",
@@ -7337,12 +7362,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "427e2b1d9b7e871c4e28163f4acd078751e2e43c88561fcefd85083721126292"
+      "sha256": "468fe9079df95bf33112f63df0b3e72ce952db87b121b4127156e6c615eb2bbb"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "7e9fdd8898ce17821b9724972161530d4fb126cd7ec164a02dc290be89a41ae6"
+      "sha256": "ac5e20798f6621e686013476b57d4034f1ce36d5562e684e7f3c6bee0747c759"
     },
     {
       "path": "public-docs/index.html",
@@ -7777,7 +7802,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "c6a11cbffff99b725d60dff415622ff3ade8e9c56ede14edc01828ebb80d8415"
+      "sha256": "172f890f2a4297d287008f0ba11bc04fc801ea21a52728855967b178e2875373"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -8097,7 +8122,7 @@
     {
       "path": "scripts/gds/provision-net.js",
       "mode": "0000644",
-      "sha256": "01b6ef89cbef4d898934c1802dec416c6085f0dde5ae49012bd2fa7a14bb9589"
+      "sha256": "86c308f807a27f448a1f90f4257e74238c177b885468b95b89d379c7249366fa"
     },
     {
       "path": "scripts/gds/provision-repo.js",
@@ -8869,6 +8894,11 @@
       "mode": "0000644",
       "sha256": "c9edcf9cb1f027ca122388beabae488d2b771b9e7aee2cd12fbdb48ea6f0ded8"
     },
+    {
+      "path": "src/bongos/project-door.js",
+      "mode": "0000644",
+      "sha256": "045c0edceb0f71c3b488471ffb3a1c20c58014d0592c9ac44572245a7eb08960"
+    },
     {
       "path": "src/bongos/project-settings.js",
       "mode": "0000644",
@@ -9002,7 +9032,7 @@
     {
       "path": "src/branding.js",
       "mode": "0000644",
-      "sha256": "e603fa0fabe63b7150f649db1ecaa50ef0908a803396e808cf212f4378cbb053"
+      "sha256": "8885ee12599cdfdaf9bdb073185c83a5532bdc46d07edaeab42e36ccdc12f8e1"
     },
     {
       "path": "src/build-info.js",
@@ -9022,7 +9052,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "12cf837247460eee2eafd0b97bcbaf4472a0dcea13cd87b116952f4b8f2b75fb"
+      "sha256": "e97c60a63ed6befae3e842e86f97cf592bb58f45cdbe488d13cb0f5e576c75b0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9077,7 +9107,7 @@
     {
       "path": "tests/access_requests_invite.mjs",
       "mode": "0000644",
-      "sha256": "4d8435e7f8b949715ee40843beddc1868105edd9c67b269cfa8f510a192e9212"
+      "sha256": "7229451a9a9cb74049b7fea808458423d8a2754c213e6974593811cd1b4322b1"
     },
     {
       "path": "tests/account_existence_rate_limit.mjs",
@@ -9177,7 +9207,7 @@
     {
       "path": "tests/application_lifecycle.mjs",
       "mode": "0000644",
-      "sha256": "ac8128aa0834f420ee744e057cd2baa01569611052d199dba9e5d28986ff1166"
+      "sha256": "249c97a172d0b77dae22dc561dc7c02dd48b636956df296647d62d7c6e213727"
     },
     {
       "path": "tests/architect.mjs",
@@ -9504,6 +9534,11 @@
       "mode": "0000644",
       "sha256": "de9d8f8c1daab1e48122febd16699ac519890b6e1296edb7966d835434851786"
     },
+    {
+      "path": "tests/catalog_only_client.mjs",
+      "mode": "0000644",
+      "sha256": "2eb721978e016514ef53cf5083dbbc5d38a2db57cd75786fdd6b6a12e5488dff"
+    },
     {
       "path": "tests/category_advisory_guard.mjs",
       "mode": "0000644",
@@ -9727,7 +9762,7 @@
     {
       "path": "tests/currency_label.mjs",
       "mode": "0000644",
-      "sha256": "09a937b9a9550b77659c0e60b3bc44c45378fdb3545c510d7579d4711518a733"
+      "sha256": "b88f7ab55948f0bfbf0e6982cc96465ff2c34d76b143f40b86f933c323b8ff1d"
     },
     {
       "path": "tests/cutover_codemod.mjs",
@@ -10962,7 +10997,7 @@
     {
       "path": "tests/module_api.mjs",
       "mode": "0000644",
-      "sha256": "839cbdc51d53f6719671ff1f2caa431d52a8b76636cd7973350000510510779b"
+      "sha256": "c7eadd36ae57c2f8976bf30bbd4c5d6ac3db0c1a8f67319860b3e4f85b5b5bc1"
     },
     {
       "path": "tests/module_catalog.mjs",
@@ -11234,11 +11269,36 @@
       "mode": "0000644",
       "sha256": "6a7a223a678b56333befaed017429e5b9d8a81e4405efae72a23355902517d9d"
     },
+    {
+      "path": "tests/project_catalog_bridge.mjs",
+      "mode": "0000644",
+      "sha256": "f4c023348054679885b8aefb8dcb700d23f3a67316e898f02e7cb0ecda75e9ff"
+    },
+    {
+      "path": "tests/project_catalog_routes.mjs",
+      "mode": "0000644",
+      "sha256": "5918d1ce7c106e5d7baa9cb989d52f3e82ac2aaf45a89f9a9bb154066106dccc"
+    },
     {
       "path": "tests/project_door_ui.mjs",
       "mode": "0000644",
       "sha256": "29f59ab64b231a7ec5d17a3e784d451f75d80c19efd4cb6a523d263e8f88b581"
     },
+    {
+      "path": "tests/project_join_door.mjs",
+      "mode": "0000644",
+      "sha256": "c0313968f5c6b07061443cfdbb0d928ba3067fb118cdd6fcf5892788189d22f7"
+    },
+    {
+      "path": "tests/project_join_door_route.mjs",
+      "mode": "0000644",
+      "sha256": "9da8c3416b4d06f82fdf8254aec216d8e7a7368b697f151f5d58f1c286f86639"
+    },
+    {
+      "path": "tests/project_modules_ui.mjs",
+      "mode": "0000644",
+      "sha256": "e728a4c1d13ea3a54910d0a706522a780db138783202a09f300900b8c661ae2e"
+    },
     {
       "path": "tests/project_stats.mjs",
       "mode": "0000644",
@@ -11252,7 +11312,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "edcc3d0cc2b9d5e5c44a33b43f98353001ff22222bf2f34c2c3dd28f04f66989"
+      "sha256": "2ef099cea46b1ffa0841d1845dedf00de047de4f9c6844baaabdcd317a5eebac"
     },
     {
       "path": "tests/projects_hub_module_picker.mjs",
@@ -11262,7 +11322,7 @@
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "fef872ed80c7efdbf37e0672067f555c76aa17368a515afb99b1fa7e7ca3c4b4"
+      "sha256": "294ecd72fa9e1c67cba9c2411c57447e459426682586c099adcd93b606530def"
     },
     {
       "path": "tests/promote_goal_id.mjs",
@@ -11287,7 +11347,7 @@
     {
       "path": "tests/provision_settings_apply.mjs",
       "mode": "0000644",
-      "sha256": "9a04386b3047177bb55b6d392db88764f06f92e5c0b20c16ed9e0f8ce520b07d"
+      "sha256": "9a09eb9bd47ff36a991b7208d0bada1fb91e3f8f03fe36a3ac4b5549b56b48ca"
     },
     {
       "path": "tests/provisioning_callback_page.mjs",
@@ -11312,7 +11372,7 @@
     {
       "path": "tests/provisioning_module_selection.mjs",
       "mode": "0000644",
-      "sha256": "4a27e1641d949f261a8ba1b72816a8b077fc8a55862c4eef4091b453b7cfd45c"
+      "sha256": "a8cb68c1f21a7c6547ef382b4641b80c1c9e46a2aad415f75dbfde36224079fd"
     },
     {
       "path": "tests/provisioning_onboard_mode.mjs",
@@ -11332,17 +11392,17 @@
     {
       "path": "tests/provisioning_settings.mjs",
       "mode": "0000644",
-      "sha256": "6f78a45d0c68a0da780d40c602f23bca3d48a80524218d4d7d311b2f8574dbee"
+      "sha256": "a7ec1145f695ed066c322bbd88f5f1dd3f3b47620ca4314e57860876a7394fe7"
     },
     {
       "path": "tests/provisioning_settings_apply.mjs",
       "mode": "0000644",
-      "sha256": "c453bab3768953257be481cb8df700530f964e167fdca073cf4ae69892930a79"
+      "sha256": "7fc80fc5576aba1dd10c0416899ade5fa2c9380ea8c1a995aaa99745aa56c29c"
     },
     {
       "path": "tests/provisioning_settings_env.mjs",
       "mode": "0000644",
-      "sha256": "4f51ea07fe3d80d52d6998547b028bec0a97267210faeffd75d9a47f7b5643e8"
+      "sha256": "a941c67c8b5640bdbacc0b5078fadacc79d1332befeb40bc3ebe82cd36764552"
     },
     {
       "path": "tests/provisioning_slug_available.mjs",

package/clients/bongos-client/index.d.ts

@@ -171,7 +171,7 @@ export interface PatchMeSkillPrefsResponse { prefs: unknown; effective: unknown;
 export interface PatchMeSoundPrefsResponse { prefs: unknown; effective: unknown; effective_map: unknown; volume: unknown; defaults: unknown; known_sounds: unknown }
 export interface PatchProjectsIdFeaturedRequest { featured: boolean }
 export interface PatchProjectsIdFeaturedResponse { project: unknown }
-export interface PatchProvisioningInstancesIdDetailRequest { description?: string; detail?: Record<string, unknown> }
+export interface PatchProvisioningInstancesIdDetailRequest { description?: string; detail?: Record<string, unknown>; modules?: string[] }
 export interface PatchProvisioningInstancesIdDetailResponse { ok: boolean; description: unknown; detail: unknown; options: unknown; publish: unknown; modules: unknown }
 export interface PatchProvisioningInstancesIdSettingsResponse { ok: boolean; saved: unknown; planet: unknown; push: unknown }
 export interface PatchTaskRecommendationsIdRequest { status: "declined" | "withdrawn" }

package/config/branding.neutral.json

@@ -27,10 +27,11 @@
     "idp": false
   },
   "project": {
-    "_note": "Per-project policy the PLATFORM decides and this instance OBEYS (task 1003139, goal 1000058). Stored on the platform's provisioning_instances.settings; written here as <PREFIX>_PLATFORM_VISIBILITY / <PREFIX>_JOINABILITY / <PREFIX>_VISIBILITY by the provisioning runner, which re-writes web.env and restarts the service when the owner changes one. The defaults are TODAY's behavior, so an instance that never receives a push — a self-hosted one, or one provisioned before this channel — keeps behaving exactly as it does now. platformVisibility (who may READ this instance's own pages): public | gated. joinability (HOW someone becomes a member): open | apply | invite_only. visibility (the join door, ADR 0182 D1 — how this project stands on the platform's map): public | private | stealth; it does NOT decide whether the project is on the map, publishability does.",
+    "_note": "Per-project policy the PLATFORM decides and this instance OBEYS (task 1003139, goal 1000058). Stored on the platform's provisioning_instances.settings; written here as <PREFIX>_PLATFORM_VISIBILITY / <PREFIX>_JOINABILITY / <PREFIX>_VISIBILITY by the provisioning runner, which re-writes web.env and restarts the service when the owner changes one. The defaults are TODAY's behavior, so an instance that never receives a push — a self-hosted one, or one provisioned before this channel — keeps behaving exactly as it does now. platformVisibility (who may READ this instance's own pages): public | gated. joinability (HOW someone becomes a member): open | apply | invite_only. visibility (the join door, ADR 0182 D1 — how this project stands on the platform's map): public | private | stealth; it does NOT decide whether the project is on the map, publishability does. joinGrant (what a PUBLIC join GRANTS): view | apply | full — the ceiling joinability may only narrow (ADR 0182 D6 / ADR 0245); `full` narrows nothing, which is why it is the default.",
     "platformVisibility": "public",
     "joinability": "apply",
-    "visibility": "public"
+    "visibility": "public",
+    "joinGrant": "full"
   },
   "repo": {
     "owner": "",

package/docs/adr/0245-the-way-back-into-an-optional-step-is-that-step-s-own-answer-route.md

@@ -0,0 +1,144 @@
+# 0245 — The way back into an optional step is that step's own answer route
+
+- **Status:** Accepted
+- **Date:** 2026-09-04
+- **Tasks:** [#1002342](https://cloudbongos.com/builders#/task/1002342) (this decision — BV1.R23)
+- **Goal:** [#1000046](https://cloudbongos.com/builders#/goal/1000046) — Project creation, criterion
+  `proj-module-select` ("during setup a default set of modules is pre-selected…")
+- **Related:** [ADR 0240](<redacted>.md)
+  (R20 — the nullable `modules` column, the three-valued contract, and §6's "R23 … needs to know whether
+  an owner has ever been asked"), [ADR 0237](<redacted>.md)
+  (R19 — the bundles and the `OPTIONAL_MODULES` catalog this surface renders),
+  [ADR 0243](<redacted>.md) (R22 — the
+  team-shape adjustment inside the fallback, and why `PATCH …/detail` already answered with `modules`),
+  [ADR 0238](<redacted>.md) (R05 — the manage view, and its
+  finding that "the project's own hall settings" is a page that does not exist),
+  [ADR 0111](<redacted>.md) (the enqueue-only web tier)
+
+## 1. The problem
+
+R20 shipped a module picker as step 4 of the create wizard and made it skippable.
+The route file said out loud what that left behind:
+
+> …there is no mutation route yet (R23, task 1002342 is "add modules later"), so
+> the receipt says the answer was kept rather than naming a way back that does
+> not exist.
+
+So a project's module set was **write-once at creation**. An owner who skipped the
+picker, or picked wrong, had no way to change it — which is the same dead end
+`PATCH /provisioning/instances/:id/detail` was built to close for the About step
+one panel earlier. An optional step is a supported default only while there is a
+way back; without one, "optional" quietly means "permanent".
+
+Two questions had to be answered, and the second follows from the first.
+
+## 2. Not a new route — the same route the step beside it uses
+
+The obvious move is a new `PATCH /provisioning/instances/:id/modules`. It is the
+wrong one, and the reason is that the wizard's two optional steps are the same
+kind of thing:
+
+| | About (step 3) | Modules (step 4) |
+|---|---|---|
+| asked | optionally, at creation | optionally, at creation |
+| stored | `description` + `detail` on the platform row | `modules` on the platform row |
+| reaches the running instance | no | no |
+| way back | `PATCH …/detail` | **this** |
+
+`PATCH …/detail` is already *"answer (or re-answer) the wizard's optional creation
+steps after creation"* — the name is narrower than the job. It already carries the
+ownership gate (`instanceAccessDenied`: own-scoped, Archon override, 404 with no
+existence leak), already records an event with an `api:self` / `api:archon:<id>`
+actor, and — since [ADR 0243](<redacted>.md)
+— **already answers with `effectiveModules(updated)`**, because a `team_shape`
+answer moves a bundle-sourced project's modules. The route was already reporting
+this value; all that was missing was the ability to set it.
+
+A second route would have duplicated the gate, the actor rule, the 404 shape and
+the receipt, for one column on a row the first route already writes. Duplicated
+authorization is the kind that drifts.
+
+**Not the settings channel**, for [ADR 0240](<redacted>.md)
+§3's reason, restated: a setting is *a policy the running instance obeys* — it
+rides `web.env`, queues a `settings-apply` intent and restarts the service. A
+module selection is a declaration held on the platform row until a catalog row
+materializes. Nothing is pushed and nothing restarts, and the surface says so
+rather than borrowing its neighbours' "your project will restart" receipt.
+
+## 3. The skip state is not writable
+
+`modules` is three-valued (ADR 0240 §2): `NULL` = never asked, `[]` = declined
+everything, `[…]` = chosen. A later edit must be able to reach the second and
+third, and **must not be able to reach the first**.
+
+So only an **array** is a change. An omitted key, or an explicit `null`, leaves the
+column alone; a body carrying nothing but a null `modules` is still the existing
+`bad_detail` "nothing to change". That is a deliberate asymmetry rather than an
+oversight: `NULL` is a claim about the owner's *history* — that they were never
+asked — and a write that could re-assert it would let an answered project become
+indistinguishable from an unasked one, permanently, which is the exact collapse
+ADR 0240 refused `NOT NULL DEFAULT '[]'` to prevent.
+
+`modules` also **replaces** where `detail` merges. The `detail = detail || $n::jsonb`
+precedent exists because a form may send one interview answer without resending
+the rest; a module selection has no keys to merge, and a merging write would make
+*removal* impossible — the half of "add modules later" an owner needs most.
+
+The always-on core stays unremovable by construction, not by a guard bolted on
+here: `badModuleSelection` refuses a core key by name (`"memory" is always on for
+every project — it is not one of the modules to choose`), `normalizeModuleSelection`
+filters to the opt-in catalog on the way to storage, and `effectiveModules` prepends
+the whole core on the way out. Three independent places, none of which this route
+had to add.
+
+## 4. The surface is the manage page, because the hall page is still gone
+
+ADR 0182 D5 pointed R05 at "the project's own hall settings"; ADR 0238 found that
+page does not exist — `settings.html` is per-*builder*, and the hall's my-projects
+page was deleted by task 1003308. Nothing has changed since, so the extras band
+lands where its three sibling settings already live: `/projects?view=manage&id=N`.
+
+Two reads, one of them new. The **current set** rides in on the instance itself —
+`publicInstance` resolves `effectiveModules(row)`, so a skipped picker reads as its
+own starter bundle and this page never re-derives that rule, which is the one way
+two surfaces come to name different modules for one project. The **catalog** is the
+same public `GET /provisioning/starter-bundles` the wizard's panel reads.
+
+**A toggle is the save.** Every sibling section on that page has a Save button
+because each is one choice with one value; the extras band is a list of independent
+facts, where a Save button only adds a way to lose one. The write sends the whole
+list in catalog order (what the column stores), and the band repaints from the
+platform's answer rather than from what was sent — so it can never show a set the
+server did not accept, and a refusal puts it back to what the row still holds.
+
+## 5. Consequences
+
+- **`modules_ignored` now names the way back.** A create re-request that carries a
+  changed `modules` still refuses to apply it, but its receipt points at this route
+  — the `detail_ignored` shape, for the `detail_ignored` reason.
+- **The wizard's own `?view=manage` links carry their id now.** The done panel's
+  in-page router matched `view=(\w+)` and dropped the query, so every
+  `projectPageLink` on that panel landed on a manage page with no project. Fixed in
+  passing because criterion B's pointer would have been the fifth link to do it.
+- **Still not an input to the runner** (ADR 0240 §6). Changing the set changes a
+  declaration on the platform row; turning it into the child instance's own
+  `config/modules.json` remains separate work. The surface's copy says so — "nothing
+  restarts" is true today and would be a lie the moment that work lands, so it is
+  worth re-reading then.
+- **A module selection is still not a publish precondition** (ADR 0182 D4).
+
+## 6. Rejected
+
+- **A new `PATCH …/modules` route** — a second copy of one ownership gate, one actor
+  rule and one 404 shape, for a column the existing route's own UPDATE already
+  reaches.
+- **The settings channel** — would queue a `settings-apply` and restart a running
+  instance to deliver a value the instance does not read (ADR 0240 §3).
+- **Letting `modules: null` clear the column** — reachable, coherent-looking, and it
+  destroys the only fact that says whether an owner was ever asked.
+- **Merging the list like `detail`** — makes removing a module impossible.
+- **A Save button under the band** — one more state to hold, and its failure mode is
+  an owner who toggles, leaves, and loses the change.
+- **Rendering the always-on core as disabled rows** — ADR 0240's rejection, and it
+  holds here for the same reason: a disabled control reads as a choice the owner
+  failed to make.