@bongos/core 1.19.535 → 1.19.537

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.535",
-  "core_contract": "1.19.535",
-  "source_commit": "2fcce53c646bd37dcc7083e7b56a41eeceecfd4b",
+  "core_version": "1.19.537",
+  "core_contract": "1.19.537",
+  "source_commit": "171115727a6362835dd549dbed353a8bc817e4ee",
   "source_ref": "HEAD",
-  "built_at": "2026-09-04T14:57:42.502Z",
+  "built_at": "2026-09-04T15:20:04.870Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 439,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1989,
+    "functional_verbatim": 1995,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2452,
-  "tree_sha256": "248c6b75ebb6633a66a73f0028be64a0d958394e1219b143974d7154f581acca",
+  "file_count": 2458,
+  "tree_sha256": "2db763cfb805a63a9dd4a04cacedb717acd4aab6b9a8f3ce795a57f1bc49a0d4",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -367,12 +367,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "7a346b2474cdde1c10c16c55defddb37ea43f462cee07b6b0bb8262114fa4296"
+      "sha256": "b1abf8c13f89ba8fe2ebca540d1a8b22fac0ad293595e51f464e189dfaf1a1ad"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "1ca4f95d1d9dbd9edacdee3731182fcd7bee8f5fe247d681028657c3a4481cb5"
+      "sha256": "1178634ee16c7b1a83defe0c6ece5754a92901370ce18f114a84d3922f7065ca"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -382,17 +382,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "8243bbb4887f66a4e6f25ed22b664d3ee123ebaa015271d01ae61dbc7d05112c"
+      "sha256": "be9e267735c41c695157c01fb82efb9219c2f6769febfa46495395d6dcc887ec"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "22ae4bdb9bf36dfc3ce19fe38e64e8dded029087dac16d3ea20ccdbe1d860788"
+      "sha256": "73e1e22f18262eb0cb73edfe58aef773f802bae33b68b9ca2e4430403d03d7c9"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "c64f0c9b8f785680f2f2ee47307dde71c69d8b0f05bcffc1777d55a059b63fd5"
+      "sha256": "f9c26f336f8b7808ed1c07e844191abd0de7bc39657dda5d0363f5d472b6c2c4"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1757,12 +1757,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "44555316c4fd8655bd48185820784f8a351ddc1a874e6d905c38865c330e6be1"
+      "sha256": "88fb38cb095713380c1c70187816c33c930cf962d9e4641ec4bb740da56ba90b"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "59f85c4841c3e884ea88d03a8385b37d104e0b0bcf561c87412bc30912490831"
+      "sha256": "8ae264d8c9983ff2841a8309c141b6fb57b395bb4b52894a4b49f58280d8fb1b"
     },
     {
       "path": "docs/architecture.md",
@@ -1787,12 +1787,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "bbcbebc995c74de0b3c2ab588574c2e21636c67574bbafb0a76a65f22d856a53"
+      "sha256": "9a1c38c7134017a58f8bcee28ca7b1098a4c654f95908939328fd735e5c26984"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "1062042dadf82a43c3711019410515e756428d9f28351959febd727726190457"
+      "sha256": "ded4329d04fdde729da3e8fdf4af7b59d39223da6343096d815472b8d573f1ef"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2637,7 +2637,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "9f00bbe1ced069bb3dd2f9de9e2414763d0a4e777d0f101464ec78154de71a99"
+      "sha256": "1b719e47366fff0090cc4f3a18743953191d612e150e59a6c68e5d27c7b71624"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4012,7 +4012,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "8243bbb4887f66a4e6f25ed22b664d3ee123ebaa015271d01ae61dbc7d05112c"
+      "sha256": "be9e267735c41c695157c01fb82efb9219c2f6769febfa46495395d6dcc887ec"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -4252,7 +4252,7 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "36914d187c0dfe9d87d8d82b19111aa1d338de15b64724275dd8ecc005eead13"
+      "sha256": "913b7ab33c6785903376b0bf7804d7d8d2db620112b983ae4c0368f33a6b8c0f"
     },
     {
       "path": "modules/government/config.js",
@@ -4349,6 +4349,11 @@
       "mode": "0000644",
       "sha256": "986be40845d7a5d786d088dc9c0b8d6f9990062299418edb648c246c5a49fb07"
     },
+    {
+      "path": "modules/government/migrations/government_010_project_settings_manage.sql",
+      "mode": "0000644",
+      "sha256": "2b729acbc94c933ff2558d59e3cb811e7725450f0d646f9d9bc89209c1340d0f"
+    },
     {
       "path": "modules/government/module.json",
       "mode": "0000644",
@@ -4999,6 +5004,21 @@
       "mode": "0000644",
       "sha256": "3df74097937e52577f25255a4612b7be93effc491bc32f2f6bc81ddb91b28929"
     },
+    {
+      "path": "modules/hall-ui/public/project-settings.css",
+      "mode": "0000644",
+      "sha256": "5015849e7273ecea7a044a133eab54913930b949e20e206a9503a08074fab3fa"
+    },
+    {
+      "path": "modules/hall-ui/public/project-settings.html",
+      "mode": "0000644",
+      "sha256": "d96bd79671787688cbfb58633236b6287a06356767bc53a8b9f96294e2850335"
+    },
+    {
+      "path": "modules/hall-ui/public/project-settings.js",
+      "mode": "0000644",
+      "sha256": "5f042e8ca4059ea3d60440b8887416a29835ebb79ddae08742fc145a6dd4d3b4"
+    },
     {
       "path": "modules/hall-ui/public/ranks.html",
       "mode": "0000644",
@@ -5112,7 +5132,7 @@
     {
       "path": "modules/hall-ui/public/shell.js",
       "mode": "0000644",
-      "sha256": "be16fb5016124692a2399312a97a524b1fc64cc8dfabcf8629c17033ca96e33e"
+      "sha256": "07cd3fd4ea92c91d4a421dfc9cbded01a7951e06b0b7c42edb8354348401e26e"
     },
     {
       "path": "modules/hall-ui/public/ship.wav",
@@ -5417,7 +5437,7 @@
     {
       "path": "modules/lifecycle/goal-category.js",
       "mode": "0000644",
-      "sha256": "5b64317b3c687a08c80d0ebe78619b6b4bb8a9cdf4cf37673a0f29785fd5a7ca"
+      "sha256": "db3c71498cf0c6d8fae8ebab3084104e0d9f4e587472815eec75e48b24727720"
     },
     {
       "path": "modules/lifecycle/goal-conflicts.js",
@@ -5507,7 +5527,7 @@
     {
       "path": "modules/lifecycle/module.json",
       "mode": "0000644",
-      "sha256": "41da723fe35c3ca3db6226a1ff2208c5256c71eebe3a3768437aeff1fb070312"
+      "sha256": "8f2c194dda59deb035eda86014da71bc0dfb27602488297fbe99a1acf002999a"
     },
     {
       "path": "modules/lifecycle/pollers/publish-reconciler.js",
@@ -5562,7 +5582,7 @@
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "a92a6024969ed0d76902770995a6787933bc87618b9601f057907ba7b07ad8a6"
+      "sha256": "1729e085b7d83b2e4579ada11ab2b51f75a9f92686cc1d48a19f34a839fe5b73"
     },
     {
       "path": "modules/lifecycle/routes/help-requests.js",
@@ -5584,6 +5604,11 @@
       "mode": "0000644",
       "sha256": "0adbbe794703d0d9fe71b22caee9563b664a510241fc3cfed1c103517ecfaeff"
     },
+    {
+      "path": "modules/lifecycle/routes/project-settings.js",
+      "mode": "0000644",
+      "sha256": "5a8271bed02a4e34e10444bf42fc3b43248219797726fe426ceb7bbe5cde01ad"
+    },
     {
       "path": "modules/lifecycle/routes/recommendations.js",
       "mode": "0000644",
@@ -6087,7 +6112,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "d3d376a0aafc52dda55d9d2f2dcdc3d5baf9370a766cd4328cd00b314e897c99"
+      "sha256": "b073e5c362797e221f5e0f9ad322ee8e1c3206ea44ed98c527b3c1c7b696879c"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -6107,7 +6132,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "3528d699cb9c0f396eeda2e9fc26eb9b89c02e0b0ca34beeb20fd84c832f5241"
+      "sha256": "f9231eb18211a2586d2ee1919ff817ac5fa14f1ea5ad1906ad5c58437f6238f6"
     },
     {
       "path": "modules/provisioning/starter-bundles.js",
@@ -6122,7 +6147,7 @@
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
       "mode": "0000644",
-      "sha256": "4dceb82f4dbeb39128c66d666df0642aacb38988f7c6d01c55f6515bcd8ad798"
+      "sha256": "aac930ed566f9b6fb7ec9fa4e240f42025e854369a94f6a8c63aa20b5d1995a8"
     },
     {
       "path": "modules/provisioning/ui/.gitkeep",
@@ -7367,12 +7392,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e69764b2f667310f66f5f6cb79ddcc60a5c16f794b990122f8c28bc0c5bbcd50"
+      "sha256": "b52e9fc284a5e725c64604313074cc5b72653d3158a38ed20556a7a79d6649e8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3749c78220c65bc15028e39440ca6e22e20843a1c1bf27cfcf298307d6393ba8"
+      "sha256": "a035e8e7a14e9ebce98dada6fd2bad96f3f9f0028707412394714c9edd538b77"
     },
     {
       "path": "public-docs/index.html",
@@ -9022,7 +9047,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "d914b8304d5de3b325ef5996d30ca47c8ae91db26f561646271f11f77c3c37f0"
+      "sha256": "628beaca086bc9f793a342f858ced847a889e205b299cb0269797b61ff5ff382"
     },
     {
       "path": "src/bongos/stealth-gate.js",
@@ -9057,7 +9082,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d0091aba7ff4e0bf36b94ba0251f05eda296291e5ab3ad7f2775cd205a5fd306"
+      "sha256": "bbd37b696a4b36e1e5a572719a92e7a187b8653fcf360a658de83c43ef4e8331"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10492,7 +10517,7 @@
     {
       "path": "tests/hall_nav.mjs",
       "mode": "0000644",
-      "sha256": "f621410c18a7f4c69108ddad5cd4047e303df4f774503d13cc650a5e255f8d52"
+      "sha256": "08b0c9585aca63a52e7c89abc630392b80faf8b053fba24d1796771d253bf26a"
     },
     {
       "path": "tests/hall_oversight_world.mjs",
@@ -10502,7 +10527,7 @@
     {
       "path": "tests/hall_page_gate_map.mjs",
       "mode": "0000644",
-      "sha256": "e65e22471469a9bf4551925f0549cfd6720aa7d5b7b7cf9df17984604e07c3cb"
+      "sha256": "eb8026d8001595c11eaf52880f4a46cba00f4eea4fbe2c1ceb16fe977f5e33e9"
     },
     {
       "path": "tests/hall_palette.mjs",
@@ -11304,6 +11329,11 @@
       "mode": "0000644",
       "sha256": "e728a4c1d13ea3a54910d0a706522a780db138783202a09f300900b8c661ae2e"
     },
+    {
+      "path": "tests/project_settings_page.mjs",
+      "mode": "0000644",
+      "sha256": "7fbee4c75fe95ba9c49ace4b492c2fb0a8a6c964da6ce84251e7daa27b974611"
+    },
     {
       "path": "tests/project_stats.mjs",
       "mode": "0000644",
@@ -11377,7 +11407,7 @@
     {
       "path": "tests/provisioning_module_selection.mjs",
       "mode": "0000644",
-      "sha256": "a8cb68c1f21a7c6547ef382b4641b80c1c9e46a2aad415f75dbfde36224079fd"
+      "sha256": "92db65b8da5b849379bab03e70287239deab8b9a2b2e47b4574f12b8acac013e"
     },
     {
       "path": "tests/provisioning_onboard_mode.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 352 operations across 54 resource groups
+- 355 operations across 55 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -634,6 +634,12 @@ function createClient(opts = {}) {
       // GET /profiles/{handle} — rank: public — GET /profiles/:handle
       getProfilesHandle: (args) => request("GET", "/profiles/{handle}", { hasBody: false }, args),
     },
+    "projectSettings": {
+      // GET /project-settings — rank: metic+archon — GET /project-settings
+      getProjectSettings: (args) => request("GET", "/project-settings", { hasBody: false }, args),
+      // PATCH /project-settings/rot-days — rank: metic+archon — PATCH /project-settings/rot-days
+      patchProjectSettingsRotDays: (args) => request("PATCH", "/project-settings/rot-days", { hasBody: true }, args),
+    },
     "projects": {
       // GET /projects — rank: metic+archon — GET /projects
       getProjects: (args) => request("GET", "/projects", { hasBody: false }, args),
@@ -895,6 +901,8 @@ function createClient(opts = {}) {
       getWorkCategories: (args) => request("GET", "/work-categories", { hasBody: false }, args),
       // POST /work-categories — rank: metic+archon — POST /work-categories
       postWorkCategories: (args) => request("POST", "/work-categories", { hasBody: true }, args),
+      // PATCH /work-categories/{id} — rank: metic+archon — PATCH /work-categories/:id
+      patchWorkCategoriesId: (args) => request("PATCH", "/work-categories/{id}", { hasBody: true }, args),
     },
   };
 }

package/clients/bongos-client/index.cjs

@@ -633,6 +633,12 @@ function createClient(opts = {}) {
       // GET /profiles/{handle} — rank: public — GET /profiles/:handle
       getProfilesHandle: (args) => request("GET", "/profiles/{handle}", { hasBody: false }, args),
     },
+    "projectSettings": {
+      // GET /project-settings — rank: metic+archon — GET /project-settings
+      getProjectSettings: (args) => request("GET", "/project-settings", { hasBody: false }, args),
+      // PATCH /project-settings/rot-days — rank: metic+archon — PATCH /project-settings/rot-days
+      patchProjectSettingsRotDays: (args) => request("PATCH", "/project-settings/rot-days", { hasBody: true }, args),
+    },
     "projects": {
       // GET /projects — rank: metic+archon — GET /projects
       getProjects: (args) => request("GET", "/projects", { hasBody: false }, args),
@@ -894,6 +900,8 @@ function createClient(opts = {}) {
       getWorkCategories: (args) => request("GET", "/work-categories", { hasBody: false }, args),
       // POST /work-categories — rank: metic+archon — POST /work-categories
       postWorkCategories: (args) => request("POST", "/work-categories", { hasBody: true }, args),
+      // PATCH /work-categories/{id} — rank: metic+archon — PATCH /work-categories/:id
+      patchWorkCategoriesId: (args) => request("PATCH", "/work-categories/{id}", { hasBody: true }, args),
     },
   };
 }

package/clients/bongos-client/index.d.ts

@@ -89,6 +89,7 @@ export interface GetMyProjectsInvitesResponse { invites: unknown }
 export interface GetMyProjectsResponse { owned: unknown; building: unknown; applied: unknown }
 export interface GetOverrideRequestsResponse { requests: unknown }
 export interface GetProfilesHandleResponse { account: unknown; cross_project: unknown }
+export interface GetProjectSettingsResponse { rows: unknown }
 export interface GetProjectsFeaturedResponse { projects: unknown }
 export interface GetProjectsResponse { projects: unknown }
 export interface GetProvisioningFleetResponse { instances: unknown }
@@ -169,6 +170,8 @@ export interface PatchMeProfileRequest { display_name?: unknown; bio?: unknown;
 export interface PatchMeProfileResponse { display_name: unknown; bio: unknown; links: unknown }
 export interface PatchMeSkillPrefsResponse { prefs: unknown; effective: unknown; defaults: unknown; known_skills: unknown; allowed_models: unknown }
 export interface PatchMeSoundPrefsResponse { prefs: unknown; effective: unknown; effective_map: unknown; volume: unknown; defaults: unknown; known_sounds: unknown }
+export interface PatchProjectSettingsRotDaysRequest { days: number }
+export interface PatchProjectSettingsRotDaysResponse { ok: boolean; rot_days: unknown; source: unknown; describe: unknown }
 export interface PatchProjectsIdFeaturedRequest { featured: boolean }
 export interface PatchProjectsIdFeaturedResponse { project: unknown }
 export interface PatchProvisioningInstancesIdDetailRequest { description?: string; detail?: Record<string, unknown>; modules?: string[] }
@@ -954,6 +957,12 @@ export interface BongosClient {
     /** GET /profiles/{handle} — rank: public */
     getProfilesHandle(args?: RequestArgs): Promise<GetProfilesHandleResponse>;
   };
+  "projectSettings": {
+    /** GET /project-settings — rank: metic+archon */
+    getProjectSettings(args?: RequestArgs): Promise<GetProjectSettingsResponse>;
+    /** PATCH /project-settings/rot-days — rank: metic+archon */
+    patchProjectSettingsRotDays(args: RequestArgs & { body: PatchProjectSettingsRotDaysRequest }): Promise<PatchProjectSettingsRotDaysResponse>;
+  };
   "projects": {
     /** GET /projects — rank: metic+archon */
     getProjects(args?: RequestArgs): Promise<GetProjectsResponse>;
@@ -1215,6 +1224,8 @@ export interface BongosClient {
     getWorkCategories(args?: RequestArgs): Promise<ApiResponse>;
     /** POST /work-categories — rank: metic+archon */
     postWorkCategories(args?: RequestArgs): Promise<ApiResponse>;
+    /** PATCH /work-categories/{id} — rank: metic+archon */
+    patchWorkCategoriesId(args?: RequestArgs): Promise<ApiResponse>;
   };
 }
 export declare function createClient(opts?: ClientOptions): BongosClient;

package/clients/bongos-client/index.mjs

@@ -630,6 +630,12 @@ export function createClient(opts = {}) {
       // GET /profiles/{handle} — rank: public — GET /profiles/:handle
       getProfilesHandle: (args) => request("GET", "/profiles/{handle}", { hasBody: false }, args),
     },
+    "projectSettings": {
+      // GET /project-settings — rank: metic+archon — GET /project-settings
+      getProjectSettings: (args) => request("GET", "/project-settings", { hasBody: false }, args),
+      // PATCH /project-settings/rot-days — rank: metic+archon — PATCH /project-settings/rot-days
+      patchProjectSettingsRotDays: (args) => request("PATCH", "/project-settings/rot-days", { hasBody: true }, args),
+    },
     "projects": {
       // GET /projects — rank: metic+archon — GET /projects
       getProjects: (args) => request("GET", "/projects", { hasBody: false }, args),
@@ -891,6 +897,8 @@ export function createClient(opts = {}) {
       getWorkCategories: (args) => request("GET", "/work-categories", { hasBody: false }, args),
       // POST /work-categories — rank: metic+archon — POST /work-categories
       postWorkCategories: (args) => request("POST", "/work-categories", { hasBody: true }, args),
+      // PATCH /work-categories/{id} — rank: metic+archon — PATCH /work-categories/:id
+      patchWorkCategoriesId: (args) => request("PATCH", "/work-categories/{id}", { hasBody: true }, args),
     },
   };
 }

package/docs/api/openapi.json

@@ -181,6 +181,10 @@
       "name": "profiles",
       "description": "Endpoints under `/api/bongos/profiles`."
     },
+    {
+      "name": "project-settings",
+      "description": "Endpoints under `/api/bongos/project-settings`."
+    },
     {
       "name": "projects",
       "description": "Endpoints under `/api/bongos/projects`."
@@ -10939,6 +10943,99 @@
         "security": []
       }
     },
+    "/project-settings": {
+      "get": {
+        "operationId": "get_project_settings",
+        "tags": [
+          "project-settings"
+        ],
+        "summary": "GET /project-settings",
+        "description": "GET /project-settings — all five rows in ONE read. rank: project.settings.manage (metic+, government_010), the SAME floor as the page it serves (requireGovernmentPage). The first cut gated this any-builder on the reasoning that it is \"the project's own published terms\" — but the payload also carries reward-policy internals (marginPct, usdPeg, mode), a raw rejected project_settings value, and internal file/migration paths, and a xenos who cannot even load the page could still curl those. Matching the read floor to the page's (task 1003280 grade, hacker lens) closes that asymmetry; the two WRITES already gate on this same atom, so the whole surface is now one floor. One read, not five: the page draws five rows, so it asks for five rows. Fetching per-row would put the hall's own settings page in the shape goal 1000072's criterion names (hall-ui/CLAUDE.md, \"a card asks the server for the rows it draws\").\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `project.settings.manage` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/lifecycle/routes/project-settings.js",
+        "x-permissions": [
+          "project.settings.manage"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetProjectSettingsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/project-settings/rot-days": {
+      "patch": {
+        "operationId": "patch_project_settings_rot_days",
+        "tags": [
+          "project-settings"
+        ],
+        "summary": "PATCH /project-settings/rot-days",
+        "description": "PATCH /project-settings/rot-days — body { days }. The one number this page writes. rank: project.settings.manage (metic+, government_010). Validated HERE against the resolver's own parser rather than a re-typed range, so the page and the reader of the value can never disagree about what is acceptable — the second copy of \"1..365\" would be the drift this file exists to prevent. rank: project.settings.manage (metic+, granted by government_010). THE ATOM IS A STRING LITERAL, not a named constant, and that is load-bearing: the route-rank auditor (src/bongos/route-rank-check.js) reads this file statically and pulls the atom out of `requirePermission(...)` with a QUOTED-STRING match. A `requirePermission(SETTINGS_ATOM)` therefore resolves to an EMPTY gate — rank 'unknown' — which is a hard ADR 0016 build failure, and the generated OpenAPI would have carried no `x-permissions` either. This route was written with a constant first and fitness.js caught it; that is why every gated route in the tree spells its atom inline. (Wrapping the middleware list across lines is fine — the sibling PATCH /work-categories/:id does exactly that and still classifies metic+archon.)\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `project.settings.manage` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/lifecycle/routes/project-settings.js",
+        "x-permissions": [
+          "project.settings.manage"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PatchProjectSettingsRotDaysRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PatchProjectSettingsRotDaysResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/projects": {
       "get": {
         "operationId": "get_projects",
@@ -11458,7 +11555,7 @@
           "provisioning"
         ],
         "summary": "PATCH /provisioning/instances/:id/detail",
-        "description": "── The optional project detail (task 1002334, goal 1000046) ────────────── PATCH /provisioning/instances/:id/detail — answer (or re-answer) the wizard's OPTIONAL creation steps after creation. Body: any subset of { description, detail, modules }. rank: any authenticated builder (own resource; archon may change any — same gate as settings). THIS ROUTE IS WHAT MAKES THE STEP SKIPPABLE. Skipping at creation leaves the project dark-matter — off the map and un-joinable (ADR 0182 D4) — and that is a supported default only because there is a way back. Without this route \"optional\" would mean \"permanently unpublishable\", i.e. a dead end, which is precisely what criterion `proj-detail-interview` refuses. Deliberately NOT a settings-apply: nothing here is a policy the running instance obeys, so there is no web.env to patch and no restart to queue. The answers live on the platform row until a catalog row materializes (the provisioning_007 `type` precedent), and R16 (task 1002335) is the surface that reads `description` to compute publishability and name what is still missing. `modules` rides the SAME route for the same reason (BV1.R23, task 1002342, ADR 0245): step 4 of the wizard is skippable exactly as step 3 is, so it needs the same way back, and it lands on the same platform row under the same ownership gate. Only an ARRAY is a change — an omitted or null key leaves the column alone, so the \"never asked\" NULL (ADR 0240 §2) can never be written by a later edit. The always-on core stays unremovable by construction: badModuleSelection refuses its keys and `effectiveModules` re-adds it on read.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "── The optional project detail (task 1002334, goal 1000046) ────────────── PATCH /provisioning/instances/:id/detail — answer (or re-answer) the wizard's OPTIONAL creation steps after creation. Body: any subset of { description, detail, modules }. rank: any authenticated builder (own resource; archon may change any — same gate as settings). THIS ROUTE IS WHAT MAKES THE STEP SKIPPABLE. Skipping at creation leaves the project dark-matter — off the map and un-joinable (ADR 0182 D4) — and that is a supported default only because there is a way back. Without this route \"optional\" would mean \"permanently unpublishable\", i.e. a dead end, which is precisely what criterion `proj-detail-interview` refuses. Deliberately NOT a settings-apply: nothing here is a policy the running instance obeys, so there is no web.env to patch and no restart to queue. The answers live on the platform row until a catalog row materializes (the provisioning_007 `type` precedent), and R16 (task 1002335) is the surface that reads `description` to compute publishability and name what is still missing. `modules` rides the SAME route for the same reason (BV1.R23, task 1002342, ADR 0245): step 4 of the wizard is skippable exactly as step 3 is, so it needs the same way back, and it lands on the same platform row under the same ownership gate. Only an ARRAY is a change — an omitted or null key leaves the column alone, so the \"never asked\" NULL (ADR 0240 §2) can never be written by a later edit. The always-on core stays unremovable by construction: badModuleSelection refuses its keys and `effectiveModules` re-adds it on read. AN ANSWER CAN BE TAKEN BACK (task 1003577). `detail` merges, so before this the first `team_shape` an owner sent was permanent — and \"never answered\" is a state `effectiveModules` reads (ADR 0240), not merely the absence of one. Sending `detail: { <key>: null }` UN-ANSWERS that question: the key is dropped from the jsonb, so the row reads back exactly as one that was never asked and the bundle the answer moved moves back. Only null does it — an empty string or any other value is still refused as off-vocabulary, and `detail: {}` still changes nothing, because a form that collected no answers is not asking for any to be erased.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "parameters": [
@@ -16012,6 +16109,54 @@
           }
         ]
       }
+    },
+    "/work-categories/{id}": {
+      "patch": {
+        "operationId": "patch_work_categories_id",
+        "tags": [
+          "work-categories"
+        ],
+        "summary": "PATCH /work-categories/:id",
+        "description": "PATCH /work-categories/:id — body { label?, sort_order?, active? }: rename a category, move it in the order, or stop offering it. The set has been list+add only since core_226 even though the table carries both columns, so a project could grow its vocabulary and never tidy it (task 1003280). rank: project.settings.manage (metic+, government_010) — the SHAPE of the set, one tier up from POST's goal.create, because reordering and deactivating affect what every future author is offered rather than adding one label to the tail. The slug is deliberately NOT patchable: it is the stable key goal prose and the /goal-create prompt refer to. Deactivating never deletes — goals already carrying a retired category keep a resolvable label.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `project.settings.manage` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/lifecycle/routes/goals.js",
+        "x-permissions": [
+          "project.settings.manage"
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
     }
   },
   "components": {
@@ -17176,6 +17321,15 @@
           "cross_project"
         ]
       },
+      "GetProjectSettingsResponse": {
+        "type": "object",
+        "properties": {
+          "rows": {}
+        },
+        "required": [
+          "rows"
+        ]
+      },
       "GetProjectsFeaturedResponse": {
         "type": "object",
         "properties": {
@@ -18208,6 +18362,35 @@
           "known_sounds"
         ]
       },
+      "PatchProjectSettingsRotDaysRequest": {
+        "type": "object",
+        "properties": {
+          "days": {
+            "type": "number"
+          }
+        },
+        "required": [
+          "days"
+        ],
+        "additionalProperties": false
+      },
+      "PatchProjectSettingsRotDaysResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "rot_days": {},
+          "source": {},
+          "describe": {}
+        },
+        "required": [
+          "ok",
+          "rot_days",
+          "source",
+          "describe"
+        ]
+      },
       "PatchProjectsIdFeaturedRequest": {
         "type": "object",
         "properties": {
@@ -22201,9 +22384,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 352,
-  "x-schema-count": 387,
+  "x-endpoint-count": 355,
+  "x-schema-count": 390,
   "x-undocumented-bodies": 9,
-  "x-response-schemas": 263,
+  "x-response-schemas": 265,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }