@bongos/core 1.19.533 → 1.19.535

package/docs/file-map.md

@@ -245,6 +245,7 @@
 │   │   ├── secret-box.js / sensitive-surfaces.js ← at-rest secret encryption + the sensitive-file classifier
 │   │   ├── cascade-dispatch.js  ← (dormant System 3, ADR 0079) the model-tier escalation ladder for autonomous dispatch
 │   │   ├── goal-scope-check.js / hierarchy-config.js / module-scope-map.js ← goal-scope protected-path checks, the configurable work-hierarchy tiers, and the module→file-glob map
+│   │   ├── project-door.js      ← the project's COMPOSED join/apply door — visibility × join_grant × joinability → open | apply | invite_only | locked (BV1.R12 / task 1002331, ADR 0182 D6 + ADR 0245). PURE + kernel; published as api.projectJoinDoor() so the public POST /access-requests, the hall landing form, the CLI and the hub's join relay cannot answer one stranger differently
 │   │   ├── path-match.js / repo-info.js / metrics.js / uptime-poller.js / app-pair.js ← touches[] overlap matcher, git-remote parser, Prometheus metrics endpoint, uptime poller, Claude-Desktop pairing store
 │   └── world/
 │       ├── terrain.js           ← (Phase D + ADR 0012, CJS): TERRAIN + OBJECT enums + BLOCKING_TERRAINS + BLOCKING_OBJECTS (server twin of public/game/world/terrain.js)

package/docs/module-api-changelog.md

@@ -1503,5 +1503,21 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.531 with no explicit bump. run 33880032943. (task 1002620)
   1.19.533 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.532 with no explicit bump. run 33881330388. (task 1002620)
+  (next carrier) — projectJoinDoor re-exported (task 1002331, goal 1000046; ADR
+        0182 D6, ADR 0247). joinabilityMode above answers ONE knob; a project's
+        join/apply door is the composition of three — where it stands on the
+        platform's map (visibility), what a public join grants (joinGrant), and how
+        someone becomes a member (joinability) — and ADR 0182 D6's rule is that the
+        stricter always wins and none may widen another. That is only true if ONE
+        function says so, so the composed answer moves onto the doorway beside
+        joinabilityMode, and the onboarding module's public POST /access-requests
+        calls it instead of reading a single knob. Additive — a MINOR by the 1.19.0
+        precedent, but a hand-bumped version cannot pass the publish lane's LIVE
+        test (tests/bump_version.mjs), so it rides the next CI patch, exactly as
+        joinabilityMode did at 1.19.374.
+  1.19.534 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.533 with no explicit bump. run 33885355024. (task 1002620)
+  1.19.535 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.534 with no explicit bump. run 33886686350. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/hall-kit.js

@@ -737,13 +737,25 @@
       + '</svg>';
   }
 
-  // Horizontal labelled bars. rows: [{ label, value, valueLabel }].
+  // Horizontal labelled bars. rows: [{ label, value, start, valueLabel }].
   // opts: { max, tone: 'accent'|'neutral', labelWidth, valueWidth, barHeight,
   //         pill, ariaLabel, list }
   //
   // `max` is the caller's when several series must share one scale; otherwise
   // the largest value here. It floors at 1 so an all-zero set draws empty
   // tracks instead of dividing by zero.
+  //
+  // A row's optional `start` OFFSETS its bar instead of beginning it at the
+  // track's left edge, which turns the same primitive into a SPAN series — a
+  // timeline. It arrived with the roadmap's versions (task 1003447): each one
+  // holds a `started_at` and a `shipped_at`, and the series those two dates
+  // support is "when did each version run", every bar on one shared axis. That
+  // is a bar with a left offset and nothing else, so it is an OPTION here
+  // rather than a second class family — the same seam every other difference
+  // between call sites rides. `start` is in the SAME units as `value` and
+  // measured from the axis origin, so the kit still never learns what a date
+  // is: a caller passes `max` as the axis span and `start` as the offset into
+  // it, exactly as it already passes x0/x1/yMax to the plot.
   function barSeriesHtml(rows, opts = {}) {
     const list = (rows || []).filter((r) => r && r.label !== undefined && r.label !== null);
     if (!list.length) return '';
@@ -775,14 +787,34 @@
       + (opts.ariaLabel ? ` aria-label="${esc(opts.ariaLabel)}"` : '')
       + '>'
       + list.map((r, i) => {
-        const w = Math.round((vals[i] / max) * 100);
+        // A POSITIVE value always draws at least a sliver. Rounding alone sends
+        // anything under half a percent of the max to `width:0%`, which reads as
+        // "none" — the one thing it is not. Zero stays zero: an empty track is
+        // the honest picture of nothing, and the column series makes the
+        // opposite choice for the opposite reason (a zero bucket there is a week
+        // that happened). Load-bearing for a span: a version that started and
+        // shipped inside one day is a real span half a pixel wide.
+        const raw = Math.round((vals[i] / max) * 100);
+        const w = vals[i] > 0 ? Math.max(1, raw) : raw;
+        // The offset takes the SAME floor, and for the same reason: a span that
+        // begins just after the axis origin but rounds to 0% draws flush against
+        // the track edge, which is the picture of "started first" — and on a
+        // timeline that is a claim about ordering, not a rounding artefact.
+        const start = Number(r.start);
+        const rawOff = Number.isFinite(start) && start > 0 ? Math.round((start / max) * 100) : 0;
+        const off = Number.isFinite(start) && start > 0 ? Math.max(1, rawOff) : 0;
+        // Offset by MARGIN, not `left`: the fill is an ordinary block inside the
+        // track, so absolute positioning would need a positioned ancestor the
+        // track does not declare. Omitted entirely at zero, so every existing
+        // caller's markup is byte-identical to what it was.
+        const geom = off > 0 ? `margin-left:${off}%;width:${w}%` : `width:${w}%`;
         const val = r.valueLabel === undefined || r.valueLabel === null
           ? String(vals[i])
           : String(r.valueLabel);
         return `<div class="kit-bars__row"${rowRole}>`
           + `<span class="kit-bars__label">${esc(r.label)}</span>`
           + `<span class="kit-bars__track" aria-hidden="true">`
-          + `<span class="kit-bars__fill" style="width:${w}%"></span></span>`
+          + `<span class="kit-bars__fill" style="${geom}"></span></span>`
           + `<span class="kit-bars__val">${esc(val)}</span>`
           + '</div>';
       }).join('')
@@ -818,10 +850,60 @@
     return { width, height, pad, base: height - pad.b };
   }
 
+  // The VERTICAL window a series should be drawn in — the companion to
+  // timeStepGeometry's yMin/yMax, and geometry rather than date semantics, which
+  // is why it lives here rather than at the call site (task 1003447).
+  //
+  // `zeroBased` (the default) is right whenever zero is a state the series can
+  // actually reach: a count of dead exports sitting at zero for a week is the
+  // reading, and lifting the floor off it would invent a change. Pass false for
+  // a LEVEL — repo-health's total_loc — where zero is unreachable and a zero
+  // floor squashes a month of real movement into a flat band across the top.
+  // A fitted floor magnifies every wiggle, so a caller that passes false owes
+  // the reader the range in words somewhere on the page.
+  //
+  // `air` is the fraction of the range left as breathing room (12% by default)
+  // so the line neither rides the top edge nor welds itself to the axis. A FLAT
+  // series has no range to take a fraction of, so the air falls back to the
+  // value's own magnitude — and, for a series flat at zero, to 1, which leaves
+  // it drawn honestly along the axis.
+  //
+  // A MISSING entry is dropped, not read as zero: a null from a snapshot that
+  // predates a column would otherwise drag `lo` to zero and draw a cliff nothing
+  // recorded. Note this is the one place in the kit that must NOT go through
+  // `chartNums` — that maps a null to 0 on purpose, because a gap-filled DAILY
+  // feed really does mean "nothing happened that day". Here a null means "not
+  // measured", and the two are opposite readings of the same byte. `Number(null)`
+  // and `Number('')` are both a finite 0, so the emptiness has to be tested for
+  // before the coercion, never after it.
+  function plotWindow(values, opts = {}) {
+    const nums = (values || [])
+      .filter((v) => v !== null && v !== undefined && v !== '')
+      .map(Number)
+      .filter((n) => Number.isFinite(n));
+    if (!nums.length) return { lo: 0, hi: 0, yMin: 0, yMax: 1, n: 0 };
+    const lo = Math.min(...nums);
+    const hi = Math.max(...nums);
+    const frac = Number.isFinite(Number(opts.air)) ? Number(opts.air) : 0.12;
+    const air = ((hi - lo) || Math.abs(hi) || 1) * frac;
+    const zeroBased = opts.zeroBased !== false;
+    return { lo, hi, yMin: zeroBased ? 0 : lo - air, yMax: hi + air, n: nums.length };
+  }
+
   // A STEP line over a time axis: the value holds until the next recorded
   // point, then rises — which is what a cumulative "how much by now" series
   // means, and why this is not a straight polyline between samples.
   // points: [{ x, value }] in data space, sorted. Returns { d, area, xs }.
+  //
+  // `yMin` (default 0) is the value the AXIS sits at, and it exists because the
+  // second kind of series this plot draws is not cumulative. A cumulative line
+  // starts at nothing and every reading is "how much by now", so zero is the
+  // only honest floor. A LEVEL — repo-health's total_loc, task 1003447 — is a
+  // large number that moves a little: on a zero floor its whole month of change
+  // is a flat band across the top, and the chart says nothing the headline
+  // figure did not. A caller that fits the floor to the data MUST say so on the
+  // page (watch.js puts the range in the figure's foot), because a non-zero
+  // baseline silently multiplies how big every wiggle looks.
   function timeStepGeometry(points, opts = {}) {
     const { width, height, pad, base } = plotBox(opts);
     const list = points || [];
@@ -829,11 +911,14 @@
     const x0 = Number(opts.x0 ?? list[0].x);
     const x1 = Number(opts.x1 ?? list[list.length - 1].x);
     const last = list[list.length - 1];
-    // A span of 0 (one point, no window) would divide by zero; yMax 0 likewise.
+    // A span of 0 (one point, no window) would divide by zero; a flat series
+    // whose yMin and yMax are equal likewise.
     const spanX = (x1 - x0) || 1;
-    const yMax = Number(opts.yMax ?? last.value) || 1;
+    const yMin = Number.isFinite(Number(opts.yMin)) ? Number(opts.yMin) : 0;
+    const yMax = Number(opts.yMax ?? last.value);
+    const spanY = ((Number.isFinite(yMax) ? yMax : 0) - yMin) || 1;
     const px = (t) => pad.l + ((t - x0) / spanX) * (width - pad.l - pad.r);
-    const py = (v) => height - pad.b - (v / yMax) * (height - pad.t - pad.b);
+    const py = (v) => height - pad.b - ((v - yMin) / spanY) * (height - pad.t - pad.b);
     let d = `M${px(list[0].x).toFixed(1)},${py(list[0].value).toFixed(1)}`;
     list.forEach((p, i) => {
       if (i === 0) return;
@@ -961,7 +1046,8 @@
     plotSvgHtml, plotValueLabelHtml, timeStepSeriesHtml, timeStepGeometry, columnSeriesHtml,
     // plotBox is exported so a caller mapping pointer x back into viewBox
     // space reads the plot's width instead of re-declaring the number.
-    plotBox,
+    // plotWindow fits the vertical axis to a level series (task 1003447).
+    plotBox, plotWindow,
     // states
     emptyStateHtml, skeletonRows, collapsibleCard,
     // ship-time task visual (task 1003109)

package/modules/hall-ui/public/roadmap-timeline.js

@@ -0,0 +1,105 @@
+// roadmap-timeline.js — the program in time (task 1003447, criterion
+// `legibility-series-are-drawn`).
+//
+// /public/versions has always carried `started_at` and `shipped_at` per version,
+// and /roadmap drew NEITHER: both dates reached the browser and came out as
+// "Sep 2026" on a shipped pill. The series two dates support is a SPAN — when
+// each version ran — and every span on ONE shared axis is the reading the page
+// exists for: whether the build is speeding up, and how much of the in-flight
+// version's run is already behind it.
+//
+// Its own file rather than another sixty lines of roadmap.js, for the reason
+// profile-charts.js is its own file: the builders are PURE, so a test imports
+// this and runs the real arithmetic over the real fixture instead of agreeing
+// with a copy of it. Exposed as window.OTBRoadmapTimeline; node-require-safe
+// (the hall-kit.js / dom-utils.js pattern — assignment is the only eval-time
+// side effect, and only when a window exists).
+//
+// The DRAWING is the kit's: OTBKit.barSeriesHtml with a per-row `start`, the
+// span option added for exactly this. Date arithmetic stays here — the kit takes
+// `max` as the axis span and `start` as an offset into it, and never learns what
+// a month is. That is the same seam every other chart in the hall rides.
+(() => {
+  'use strict';
+
+  const MON = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+
+  // "May ’26" — short enough that a whole span label fits the value column at
+  // phone width, which "May 2026 – September 2026" does not.
+  function ymShort(t) {
+    const d = new Date(t);
+    return Number.isNaN(d.getTime()) ? '' : `${MON[d.getMonth()]} ’${String(d.getFullYear()).slice(-2)}`;
+  }
+
+  // One row per version that actually started, oldest first.
+  //
+  // A version with no parsable `start` is NOT on the timeline, because it has
+  // not happened. Defaulting it to the axis origin would draw it as having begun
+  // at the start of the project, which is the opposite of true; the caller says
+  // how many were left out instead.
+  //
+  // `open` is a version still running (or parked mid-run): its span reaches
+  // today and its label says "now", rather than naming an end date nothing
+  // recorded. `to` is floored at `from` so a clock skew or a bad shipped_at
+  // cannot produce a negative span the kit would draw backwards.
+  function timelineRows(all, now) {
+    return (all || [])
+      .map((v) => {
+        const from = Date.parse(v && v.start);
+        if (!Number.isFinite(from)) return null;
+        const shipped = Date.parse(v.ship);
+        const open = !Number.isFinite(shipped);
+        return { v, from, to: Math.max(open ? now : shipped, from), open };
+      })
+      .filter(Boolean)
+      .sort((a, b) => a.from - b.from);
+  }
+
+  // The chart card: the spans, and the foot that says what the axis covers and
+  // what is missing from it. Returns { count, html }, or NULL when there is
+  // nothing worth drawing — so the caller renders no section at all rather than
+  // an empty panel. One return shape either way, never a string sometimes and an
+  // object other times.
+  //
+  // `kit` is a parameter (defaulting to window.OTBKit) so this module is pure
+  // enough to import in node and run against the real kit in a test.
+  function timelineCardHtml(all, now, kit) {
+    const k = kit || (typeof window !== 'undefined' ? window.OTBKit : null);
+    if (!k) return null;
+    const rows = timelineRows(all, now);
+    // One version is not a timeline: a single bar filling the whole axis says
+    // nothing that version's own card does not already say.
+    if (rows.length < 2) return null;
+
+    const t0 = rows[0].from;
+    const t1 = Math.max(now, ...rows.map((r) => r.to));
+    const span = (t1 - t0) || 1;
+    const bars = k.barSeriesHtml(
+      rows.map((r) => ({
+        label: r.v.id,
+        value: r.to - r.from,
+        start: r.from - t0,
+        valueLabel: `${ymShort(r.from)} → ${r.open ? 'now' : ymShort(r.to)}`,
+      })),
+      {
+        max: span,
+        list: true,
+        ariaLabel: 'When each version ran',
+        labelWidth: '92px',
+        valueWidth: '108px',
+        barHeight: '10px',
+        pill: true,
+      },
+    );
+    const missing = (all || []).length - rows.length;
+    const foot = `${ymShort(t0)} to today, one bar per version.`
+      + (missing > 0
+        ? ` ${missing} version${missing === 1 ? '' : 's'} with no start date ${missing === 1 ? 'is' : 'are'} not shown.`
+        : '');
+    return { count: rows.length, html: k.chartCardHtml('When each version ran', bars, foot) };
+  }
+
+  const api = { timelineRows, timelineCardHtml, ymShort };
+  if (typeof window !== 'undefined') window.OTBRoadmapTimeline = api;
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+})();

package/modules/hall-ui/public/roadmap.html

@@ -45,6 +45,12 @@
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
-<script src="/builders/roadmap.js?v=2026-07-24-deck1"></script>
+<!-- The chart kit and the timeline's series builders (task 1003447). Both MUST
+     precede roadmap.js: the page reads window.OTBKit / window.OTBRoadmapTimeline
+     at render time, so loading either after would be a blank section in
+     production and a green unit suite. tests/hall_kit_charts.mjs pins the order. -->
+<script src="/builders/hall-kit.js"></script>
+<script src="/builders/roadmap-timeline.js"></script>
+<script src="/builders/roadmap.js?v=2026-09-03-timeline"></script>
 </body>
 </html>

package/modules/hall-ui/public/roadmap.js

@@ -241,6 +241,18 @@
     </article>`;
   }
 
+  // The program in time (task 1003447). The SERIES is roadmap-timeline.js's —
+  // pure builders in their own file so a test runs the real arithmetic over the
+  // real fixture — and the SECTION chrome is this page's, which is the same seam
+  // the chart kit keeps everywhere: the module draws, the page frames. Missing
+  // module or fewer than two started versions renders nothing at all, so the
+  // deck reads exactly as it did before rather than growing an empty panel.
+  function timelineHtml(all, now) {
+    const mod = window.OTBRoadmapTimeline;
+    const card = mod ? mod.timelineCardHtml(all, now) : null;
+    return card ? sectionHtml('flight', 'In time', card.count, '', card.html) : '';
+  }
+
   function sectionHtml(dotCls, title, count, note, inner) {
     return `<section class="rm-sec">
       <div class="rm-sec__h"><span class="rm-sec__dot rm-sec__dot--${dotCls}"></span><span class="rm-sec__t">${title}</span><span class="rm-sec__n">${count}</span><span class="rm-sec__rule"></span></div>
@@ -380,6 +392,10 @@
       html += `<div class="rm-hero"><div class="rm-lab" style="max-width:none">No version is in flight right now.</div></div>`;
     }
 
+    // Directly under the hero: both are program-level readings, and this is the
+    // one that answers "how fast" rather than "how much".
+    html += timelineHtml(all, Date.now());
+
     if (staged.length) {
       html += sectionHtml('staged', 'Staged', staged.length, 'Seeded with goals, not yet started.', `<div class="rm-grid">${staged.map(stagedCard).join('')}</div>`);
     }

package/modules/hall-ui/public/style.css

@@ -2039,8 +2039,10 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
      reduced-motion kill switch (§the kill switch, at the end of this sheet)
      already zeroes this with !important — do NOT add a second @media block
      here, which is what `tests/hall_tokens.mjs` forbids and why the rule
-     cannot rot in two places. */
-  transition: width 200ms ease;
+     cannot rot in two places. `margin-left` rides along because a SPAN bar
+     (barSeriesHtml's per-row `start`) moves as well as grows, and a bar that
+     slides while its neighbour eases reads as two different animations. */
+  transition: width 200ms ease, margin-left 200ms ease;
 }
 .kit-bars__row:hover .kit-bars__fill { opacity: .8; }
 .kit-bars__val { text-align: right; color: var(--ink-faint); }

package/modules/hall-ui/public/watch.html

@@ -111,6 +111,10 @@
             <h2 id="ledger-h" class="scroll__h">Repo health</h2>
             <p class="scroll__lede">The shape and health of the codebase.</p>
             <div id="ledger-stats" class="ov-figs"><span class="kit-skel"></span></div>
+            <!-- The trend the request has always carried and the page dropped
+                 on the floor (task 1003447) — the same shape as the sessions
+                 fix above it. -->
+            <div id="ledger-trend"></div>
             <div id="ledger-loc"></div>
             <div id="ledger-files"></div>
           </section>

package/modules/hall-ui/public/watch.js

@@ -942,6 +942,120 @@
       .replace(/\b\w/g, (c) => c.toUpperCase());
   }
 
+  // The four series the snapshot table keeps, in the order a reader wants them:
+  // how big the codebase is, then the three kinds of rot it accumulates.
+  //
+  // `zeroBased` is the axis decision, made per metric because the metrics are
+  // not alike. A count of dead exports belongs on a zero floor: zero is a real,
+  // reachable state and the distance from it IS the reading. `total_loc` never
+  // goes near zero — on a zero floor a month of real movement is a flat band
+  // across the top of the box, which is a picture of nothing. That one fits its
+  // floor to the data, and `trendFigure` puts the range in the foot so the
+  // magnified wiggle is never silent about what it is.
+  const TREND_METRICS = [
+    {
+      key: 'total_loc', title: 'Total lines', fmt: fmtCompact, zeroBased: false,
+      foot: 'Every tracked line of the codebase, snapshot by snapshot.',
+    },
+    {
+      key: 'dead_exports', title: 'Dead exports', fmt: fmtInt, zeroBased: true,
+      foot: 'Exported symbols nothing imports — the knip scan, run daily.',
+    },
+    {
+      key: 'stale_branches', title: 'Stale branches', fmt: fmtInt, zeroBased: true,
+      foot: 'Branches with no movement inside the staleness window.',
+    },
+    {
+      key: 'confirmed_unshipped', title: 'Confirmed, unshipped', fmt: fmtInt, zeroBased: true,
+      foot: 'Work verified but not yet landed — the strand backlog.',
+    },
+  ];
+
+  // One repo-health metric as a figure: the step plot, the value it ends on, and
+  // the table twin that keeps it out of picture-only territory.
+  //
+  // A STEP line, not a polyline, and that is the honest shape here: a snapshot's
+  // value is what the repo measured that morning and it holds until the next run
+  // measures again. The scan does not run every single day, so a straight line
+  // between two samples a week apart would draw movement nobody recorded.
+  //
+  // No readout is wired, so the plot passes `interactive: false` and takes
+  // neither a focus stop nor a crosshair — the /drachmae contract. The reading
+  // is the aria-label, the labelled endpoint and the twin.
+  function trendFigure({ key, title, fmt, foot: footText, zeroBased }, trend) {
+    const kit = window.OTBKit;
+    // Only rows that actually carry this metric. An older snapshot predates a
+    // column and sends null; counting that as 0 would draw a cliff to the floor
+    // that never happened.
+    //
+    // NOT `Number(v)` — that is the trap, and the trap is silent: Number(null),
+    // Number(undefined ?? '') and Number('') are 0, 0 and 0, every one of them
+    // finite, so a plain isFinite filter keeps a missing reading as a real zero.
+    // The page's own `num()` coerces the same way for the same reason. Mapping
+    // an absent value to NaN is what makes the filter below mean "carried".
+    const carried = (v) => (v === null || v === undefined || v === '' ? NaN : Number(v));
+    const points = trend
+      .map((r) => ({ x: Date.parse(r.snapshot_date), value: carried(r[key]) }))
+      .filter((p) => Number.isFinite(p.x) && Number.isFinite(p.value));
+    // One sample is a reading, not a trend, and it draws a single dot on an
+    // axis with nothing to compare it to.
+    if (points.length < 2) return '';
+
+    const last = points[points.length - 1];
+    // The axis window is the kit's arithmetic, not this page's.
+    const { lo, hi, yMin, yMax } = kit.plotWindow(points.map((p) => p.value), { zeroBased });
+
+    const series = kit.timeStepSeriesHtml(points, {
+      x0: points[0].x, x1: last.x, yMin, yMax,
+    });
+    const { endX, endY } = series.geometry;
+    const day = (t) => new Date(t).toISOString().slice(0, 10);
+    // At most ~21 rows however wide the window is (?days goes to 90), and the
+    // last row is always present so the twin ends where the plot's label does.
+    const step = Math.max(1, Math.ceil(points.length / 20));
+    const twinRows = points.filter((p, i) => i % step === 0 || i === points.length - 1);
+    const range = `${fmt(lo)} – ${fmt(hi)} across ${fmtInt(points.length)} snapshots.`;
+    // A fitted floor multiplies how big every move looks, so the figure says so
+    // in words rather than letting the picture imply a collapse to nothing.
+    const axisNote = zeroBased ? '' : ` The axis starts at ${fmt(Math.round(yMin))}, not zero.`;
+
+    return `<figure class="pchart" id="ledger-trend-${escapeHtml(key)}">
+      <figcaption class="pchart__title">${escapeHtml(title)}</figcaption>
+      ${kit.plotSvgHtml({
+    series: series.body,
+    interactive: false,
+    ariaLabel: `${title}: ${fmt(last.value)} on ${day(last.x)}, ranging ${fmt(lo)} to ${fmt(hi)} over the window.`,
+    label: kit.plotValueLabelHtml(endX, endY - 8, fmt(last.value), 'end'),
+    leftTick: day(points[0].x),
+    rightTick: day(last.x),
+  })}
+      <details class="pchart__twin">
+        <summary>Read it as a table</summary>
+        <table class="ledger pchart__table"><thead><tr><th>Snapshot</th><th>${escapeHtml(title)}</th></tr></thead><tbody>
+        ${twinRows.map((p) => `<tr><td>${escapeHtml(day(p.x))}</td><td>${escapeHtml(fmt(p.value))}</td></tr>`).join('')}
+        </tbody></table>
+      </details>
+      <p class="pchart__foot">${escapeHtml(`${footText} ${range}${axisNote}`)}</p>
+    </figure>`;
+  }
+
+  // The trend the route has always sent and renderLedger discarded (task
+  // 1003447). It is requested WITH ?days=30 — the page was paying for the window
+  // and reading one snapshot off it.
+  function renderTrend(data) {
+    const el = $('#ledger-trend');
+    if (!el) return;
+    const trend = Array.isArray(data.trend) ? data.trend : [];
+    const figures = TREND_METRICS.map((m) => trendFigure(m, trend)).filter(Boolean).join('');
+    // Nothing plottable yet (a fresh instance, or one metrics run) renders
+    // nothing at all — the figures above already say what today's numbers are,
+    // and an empty panel under them would be worse than no panel.
+    el.innerHTML = figures
+      ? `<section class="ov-group"><div class="ov-group__head"><span class="ov-group__name">Over the last ${escapeHtml(String(data.window_days || 30))} days</span></div>`
+        + `<div class="pcharts">${figures}</div></section>`
+      : '';
+  }
+
   function renderLedger(data, stats) {
     const locEl = $('#ledger-loc');
     const filesEl = $('#ledger-files');
@@ -962,6 +1076,8 @@
     }
     stats.innerHTML = figs(cards);
 
+    renderTrend(data);
+
     // loc_by_dir as a two-column ledger under its own head.
     const locByDir = latest.loc_by_dir && typeof latest.loc_by_dir === 'object' ? latest.loc_by_dir : {};
     const dirEntries = Object.entries(locByDir).sort((a, b) => num(b[1]) - num(a[1]));

package/modules/onboarding/module.json

@@ -2,7 +2,7 @@
   "key": "onboarding",
   "title": "Onboarding (admission · setup · newcomer floor)",
   "description": "The newcomer ADMISSION + ORIENTATION domain — the public access-request → Archon-approval gate, the server-ticked onboarding state machine (the 'Path into the City' checklist that graduates a Xenos to Thetes), the friction analyzer (feedback-without-asking on consented onboarding transcripts), and the evergreen newcomer-chore restock (a fresh first-builder task is always waiting). A core-domain module carved out of the GDS core in BV1.R81 (ADR 0093 §1); default-on because every instance onboards its own builders. The access-requests admission routes mount here; the core lifecycle (db.js claim/ship), auth callbacks, and the me/builders profile readers resolve the `onboarding` kernel PORT for the state-machine + restock surface they need — never importing the module.",
-  "coreVersion": "^1.19.374",
+  "coreVersion": "^1.19.532",
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "contributes": { "routes": ["onboarding"] },

package/modules/onboarding/routes/access-requests.js

@@ -26,10 +26,19 @@
 //                                          username before any request exists:
 //                                          the way in on an invite-only project.
 //
-// Which door a project runs — open / apply / invite_only — is the owner's
-// joinability setting, read through the doorway's joinabilityMode() (task
-// 1003044, ADR 0194): the same reader the sign-in gate uses, so this route and
-// the gate never disagree about whether a stranger may ask.
+// Which door a project runs — open / apply / invite_only / locked — is the
+// COMPOSITION of three owner-set knobs, read through the doorway's
+// projectJoinDoor() (BV1.R12, task 1002331; ADR 0182 D6, ADR 0247): its place on
+// the platform's map (`visibility`), what a public join grants (`joinGrant`), and
+// how someone becomes a member (`joinability`, ADR 0194 — the same reader the
+// sign-in gate uses). The stricter always wins and none of them can widen another,
+// so this route and the gate never disagree about whether a stranger may ask.
+//
+// THE REFUSAL NEVER NAMES WHICH KNOB CLOSED THE DOOR. A stealth project, a public
+// one whose join grants only a look, and an explicitly invite-only one all answer
+// with the same sentence — otherwise the refusal is a read-out of a state ADR 0182
+// D2a exists to keep anonymous. Nothing is stored on a refusal either, so a closed
+// project accumulates no queue to leak (D6).
 //
 // The global IP rate-limiter (mounted in routes.js before every router) guards
 // the public POST against spam. A partial unique index on lower(github_login)
@@ -51,10 +60,16 @@ const approvalBroadcast = require('../approval-broadcast');
 const log = api.logger('onboarding');
 
 // The public refusal each door gives a would-be applicant — plain sentences,
-// shown as written by the hall, the CLI, and the hub's join relay.
+// shown as written by the hall, the CLI, and the hub's join relay. `apply` is
+// absent because it is the one door that does not refuse: it reaches the queue.
 const DOOR_REFUSAL = {
   invite_only: { code: 'invite_only', status: 403, message: 'This project is invite-only — it doesn’t take applications. If you’ve been invited, or already have an account, sign in with GitHub to enter.' },
   open: { code: 'open_enrollment', status: 409, message: 'This project is open — no request needed. Sign in with GitHub and you’re in.' },
+  // Dark matter (ADR 0182 D1/D4): the project has not published enough about
+  // itself to be on the platform's map, so there is no door to knock on yet. It
+  // says the project's own state, not the applicant's — nothing they can do fixes
+  // it, and a refusal that implied otherwise would send them back to retry.
+  locked: { code: 'not_published', status: 403, message: 'This project isn’t published yet, so it isn’t taking anyone on. Its owner has to finish setting it up first.' },
 };
 
 // GitHub usernames: 1–39 chars, alphanumeric or single hyphens, no leading/
@@ -74,7 +89,7 @@ module.exports = function buildAccessRequestsRouter() {
   router.post('/access-requests', async (req, res) => {
     // The door answers first — before validation and before any lookup — so a
     // refusal costs no query and reveals nothing about who already exists.
-    const refusal = DOOR_REFUSAL[api.joinabilityMode()];
+    const refusal = DOOR_REFUSAL[api.projectJoinDoor()];
     if (refusal) {
       return res.fail(refusal.code, { status: refusal.status, message: refusal.message });
     }

package/modules/platform-identity/module.json

@@ -14,6 +14,6 @@
     "migrations": true,
     "pollers": ["code-sweep"]
   },
-  "provides": ["platform-identity.hub", "project.publishGate"],
+  "provides": ["platform-identity.hub", "project.publishGate", "project.catalog"],
   "consumes": []
 }