@bongos/core 1.19.563 → 1.19.565

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.563",
-  "core_contract": "1.19.563",
-  "source_commit": "c8dc8ef54a7fd97c2ba21c436f6c1faf0a125f0f",
+  "core_version": "1.19.565",
+  "core_contract": "1.19.565",
+  "source_commit": "d4d7fdc583b75f4519d2f284349c53475e27f8dc",
   "source_ref": "HEAD",
-  "built_at": "2026-09-06T17:53:15.785Z",
+  "built_at": "2026-09-06T19:48:06.968Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 444,
+    "docs_redacted": 446,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2029,
+    "functional_verbatim": 2034,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2497,
-  "tree_sha256": "d705f290c86bc4240b5cd119cb250092b6b2d7af6d8ffc8e870dd1f0ae6cdef3",
+  "file_count": 2504,
+  "tree_sha256": "32eef9b483861a2a84b7778a4fb37713f88901efef248266aaa73c278a519d2b",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -372,12 +372,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "38988a49c2cdcc89db69602de1fe46cba0de430643c677352b9db36ed89c010c"
+      "sha256": "f94a07e3c135a5d6c41a2d16f722e86b990362996042dc2a5e05b2020f8cf376"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "bd7d31e9cff0d758cc66c1d4adcf52eeaa99acc2ef48d459265425e2a4d2fd19"
+      "sha256": "06d1814637fe2898f0d93a3870726d53102d02feeae4611fcca80f195e2e26e4"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -387,17 +387,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "33fbbbaf2a4a939b7351a7aa25264ddd609c1298d9ba809372a162983afe5038"
+      "sha256": "ee0e25848a938f675e7a2e6e0a48983308117ecafe93ca219f4f1df49cf7ea51"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "a0992ef72cffc0d200e62bd5315e64090eda7cbd3477a01ec041e2d08bb39b9e"
+      "sha256": "f7c16a633c0f5c3ba13421815d08f5fb935b8737433acffe72fef018adffbf25"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "e83e49178398441026fe6fd4822dd4eddae2c2316f5aa5006a090ef0d1a41b98"
+      "sha256": "6a3e4df57180f3c182fbadabe94030d06f125373c9336a7a4160015f1df5b11e"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1774,20 +1774,30 @@
       "mode": "0000644",
       "sha256": "8ccfe21df7ab80ed872565bc879fb21a1b35ce81da55151035f2dc45cd40e749"
     },
+    {
+      "path": "docs/adr/0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md",
+      "mode": "0000644",
+      "sha256": "a36e7591da769ef46cb4f1c62d5b941278478dbb93e0a94c4f18e35a91866082"
+    },
+    {
+      "path": "docs/adr/0253-the-takedown-lever-has-two-writers-and-provenance-is-a-column.md",
+      "mode": "0000644",
+      "sha256": "1e17e1499be966af136b63f75693547d2e1e46f825af5755310b9096e949054f"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "6d7f0b67401ca836ed08f5cea31ea578c10987718de48fecc0ac663528e9403d"
+      "sha256": "0c072575a958a3377fe2c7237f9c5af69f00cf8aa1df2bd8c6a3f884ab656b37"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "ae645afb5ce376b7e7b4ad0a5c00f63e48a2d0540fe79af29106d174a41ac3e8"
+      "sha256": "33d4d9b7530ebeebffc8c7200a137f5624b8319ff9a26e8b7b1e3209acb413ae"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "a009aa37bc7698ac1469b45ac875b1b3884c0104b7f8a886e450082d503de45c"
+      "sha256": "b4c2891985427587d5a065b6e7d69638c5cd554d42d5eb22572b9c82f898431f"
     },
     {
       "path": "docs/architecture.md",
@@ -2662,7 +2672,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f13bd014e6a89aefd27dbfbaf639b7c3f3e8b90c3adb69cedfb6a0b11b0d3daf"
+      "sha256": "17b7c3671b0652839a0983e0cbee2b00ca2438cb90e5d79771a1c7dd9415e64f"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4062,7 +4072,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "33fbbbaf2a4a939b7351a7aa25264ddd609c1298d9ba809372a162983afe5038"
+      "sha256": "ee0e25848a938f675e7a2e6e0a48983308117ecafe93ca219f4f1df49cf7ea51"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -4302,7 +4312,7 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "57b29298fa5707d3a1d59e78612d2b039b1559d26b8a9116812d5c76e9c3af87"
+      "sha256": "e2d8d2a3187598fe0c647d30cd333627feeb1aa5352fac8bafc922cf40750e12"
     },
     {
       "path": "modules/government/config.js",
@@ -6014,10 +6024,15 @@
       "mode": "0000644",
       "sha256": "112fd5dcc9d2bfbc8ec064963e1a783d8ef7855a1a47cf6575ea70da06803d68"
     },
+    {
+      "path": "modules/platform-identity/migrations/platform_identity_020_visibility_pull.sql",
+      "mode": "0000644",
+      "sha256": "d4e7b3562068397f63ec66c63da330fd3363ef2a1dbab0d069c995c2a6dbb3b7"
+    },
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
-      "sha256": "b798cbc2c6f4106c4eb94c9f7219ad1643bfb5ec9449e0384bf87b3f7ecccc30"
+      "sha256": "cc6f7ab084ee74715241220339411d1a10c8d6697af143df452278ea2c634f79"
     },
     {
       "path": "modules/platform-identity/platform-identity.js",
@@ -6029,20 +6044,25 @@
       "mode": "0000644",
       "sha256": "b6eea95dbe66a3126fc2c73d93237cf38dd648a803e910eb88fbd5c780ccef62"
     },
+    {
+      "path": "modules/platform-identity/pollers/visibility-pull.js",
+      "mode": "0000644",
+      "sha256": "f842d6ae04dbd2360703f72d35695d9d35c0eb51699d210bf3aa7af67750a009"
+    },
     {
       "path": "modules/platform-identity/project-catalog.js",
       "mode": "0000644",
-      "sha256": "6021d893691000a164d7d16e6f24b5bd91215c6dcb252557f0ffcd5d1d467e32"
+      "sha256": "7aa4866e134a9610a36b5c11efffc4ce53fa733be84d47f7b4c269a767c587c9"
     },
     {
       "path": "modules/platform-identity/project-stats.js",
       "mode": "0000644",
-      "sha256": "2e898799632a2b5c2ead9cb44fa0b8029fcb6d217f7d5f26c8a39b34c75bbea7"
+      "sha256": "20000528b99e9a52cd9bd2d02c7ca4b118a5b6432ae2902ff8f9bd0503d12d38"
     },
     {
       "path": "modules/platform-identity/projects-feed.js",
       "mode": "0000644",
-      "sha256": "7ba4e7f2a375a1197524106605ff5dd6e4e597b2926bf6498f784ede5099a447"
+      "sha256": "fac8b2f750a5a9fb3c05290223292449b04a45c33b6976da285126616a8e9e91"
     },
     {
       "path": "modules/platform-identity/publish-gate.js",
@@ -6072,7 +6092,7 @@
     {
       "path": "modules/platform-identity/routes/projects.js",
       "mode": "0000644",
-      "sha256": "dac39b920025d696ba34e20aa4a9fbfb70d1cbc9ffe8f3b0da823f333d6a8d7a"
+      "sha256": "af098885cd3d7e83a9302c7eb8213c3448d73ab79be53b2b5ff1467fbab3685a"
     },
     {
       "path": "modules/platform-identity/routes/public-profile.js",
@@ -6109,6 +6129,11 @@
       "mode": "0000644",
       "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
     },
+    {
+      "path": "modules/platform-identity/visibility-pull.js",
+      "mode": "0000644",
+      "sha256": "3eee70629402e2c9c8ee0a79466ed1c83f13cec151f60e5f57e7601813a47b58"
+    },
     {
       "path": "modules/provisioning/CLAUDE.md",
       "mode": "0000644",
@@ -7492,12 +7517,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "feb9b3919e27637f41f78010f3a31d662da752e2c3ea56555f919fae02758cff"
+      "sha256": "405ae99d31e8bad9522feb9eeaa8adf7154d0c018d2ea8a88661391e0ff512f6"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "29c0dd946891112260ed3da3ce17b036afa8019a9ca8a89defc4c291b7638d2e"
+      "sha256": "8766e1ea5753cf0dcc31419c38775984d84fed2170f81cc6ce715d87471c9ec8"
     },
     {
       "path": "public-docs/index.html",
@@ -9002,7 +9027,7 @@
     {
       "path": "src/bongos/middleware/rate-limit.js",
       "mode": "0000644",
-      "sha256": "cd28f4517614b4b812aba3c051674ebaff8e78fd741a2e464966b687c459a654"
+      "sha256": "7a4a49df59dd3754fec468f1833514982b6e57c460dc531d5f6605cfe68d196f"
     },
     {
       "path": "src/bongos/module-scope-map.js",
@@ -9197,7 +9222,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "51c39233a591b55aa092d440634e57ef51840118b5e7d9d93784b9a6de502b29"
+      "sha256": "6571323e133d1a8ce8cb6ecf15a668b0482c40352d64b0543739ba7407ae1da8"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11187,7 +11212,7 @@
     {
       "path": "tests/module_api.mjs",
       "mode": "0000644",
-      "sha256": "c7eadd36ae57c2f8976bf30bbd4c5d6ac3db0c1a8f67319860b3e4f85b5b5bc1"
+      "sha256": "39812c560bcd88e3b3a7938ed2447fbd4ab24b0f925e9662b375910bcbe7f1da"
     },
     {
       "path": "tests/module_catalog.mjs",
@@ -11524,6 +11549,11 @@
       "mode": "0000644",
       "sha256": "8cb5533aca29727c317450cf5730f309cdb5540265f8c150a8ea2242c7ef5656"
     },
+    {
+      "path": "tests/project_takedown_lever.mjs",
+      "mode": "0000644",
+      "sha256": "361a8baae6b15efa86bdb366076b6ba2ad237f2fa63d600bee879db19042dbef"
+    },
     {
       "path": "tests/project_visibility_db.mjs",
       "mode": "0000644",
@@ -12449,10 +12479,15 @@
       "mode": "0000644",
       "sha256": "2a381bab380342e4fc556211d4821c85fdde1f676a6c5c6aa2421a89a573cd27"
     },
+    {
+      "path": "tests/visibility_pull.mjs",
+      "mode": "0000644",
+      "sha256": "57be5f1160903113241700d5d0474debfbe46184de45ed8f3aa210910f810729"
+    },
     {
       "path": "tests/visible_projects_feed.mjs",
       "mode": "0000644",
-      "sha256": "4bf47b6aee92c54099c583726d05421a433ac5b5e82792a848d11c80d7ee7bd1"
+      "sha256": "c5d4a17ba9765069a7850fef5d3843e076fbd08edbc7d690a36e2ff4299d10c2"
     },
     {
       "path": "tests/wandering_prefs.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 357 operations across 55 resource groups
+- 358 operations across 55 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -647,6 +647,8 @@ function createClient(opts = {}) {
       postProjects: (args) => request("POST", "/projects", { hasBody: true }, args),
       // PATCH /projects/{id}/featured — rank: metic+archon — PATCH /projects/:id/featured
       patchProjectsIdFeatured: (args) => request("PATCH", "/projects/{id}/featured", { hasBody: true }, args),
+      // PATCH /projects/{id}/status — rank: metic+archon — PATCH /projects/:id/status
+      patchProjectsIdStatus: (args) => request("PATCH", "/projects/{id}/status", { hasBody: true }, args),
       // GET /projects/featured — rank: public — GET /projects/featured
       getProjectsFeatured: (args) => request("GET", "/projects/featured", { hasBody: false }, args),
       // POST /projects/invite — rank: metic+archon — POST /projects/invite

package/clients/bongos-client/index.cjs

@@ -646,6 +646,8 @@ function createClient(opts = {}) {
       postProjects: (args) => request("POST", "/projects", { hasBody: true }, args),
       // PATCH /projects/{id}/featured — rank: metic+archon — PATCH /projects/:id/featured
       patchProjectsIdFeatured: (args) => request("PATCH", "/projects/{id}/featured", { hasBody: true }, args),
+      // PATCH /projects/{id}/status — rank: metic+archon — PATCH /projects/:id/status
+      patchProjectsIdStatus: (args) => request("PATCH", "/projects/{id}/status", { hasBody: true }, args),
       // GET /projects/featured — rank: public — GET /projects/featured
       getProjectsFeatured: (args) => request("GET", "/projects/featured", { hasBody: false }, args),
       // POST /projects/invite — rank: metic+archon — POST /projects/invite

package/clients/bongos-client/index.d.ts

@@ -175,6 +175,8 @@ export interface PatchProjectSettingsRotDaysRequest { days: number }
 export interface PatchProjectSettingsRotDaysResponse { ok: boolean; rot_days: unknown; source: unknown; describe: unknown }
 export interface PatchProjectsIdFeaturedRequest { featured: boolean }
 export interface PatchProjectsIdFeaturedResponse { project: unknown }
+export interface PatchProjectsIdStatusRequest { status: string }
+export interface PatchProjectsIdStatusResponse { project: unknown }
 export interface PatchProvisioningInstancesIdDetailRequest { description?: string; detail?: Record<string, unknown>; modules?: string[] }
 export interface PatchProvisioningInstancesIdDetailResponse { ok: boolean; description: unknown; detail: unknown; options: unknown; publish: unknown; modules: unknown }
 export interface PatchProvisioningInstancesIdSettingsResponse { ok: boolean; saved: unknown; planet: unknown; push: unknown }
@@ -971,6 +973,8 @@ export interface BongosClient {
     postProjects(args: RequestArgs & { body: PostProjectsRequest }): Promise<PostProjectsResponse>;
     /** PATCH /projects/{id}/featured — rank: metic+archon */
     patchProjectsIdFeatured(args: RequestArgs & { body: PatchProjectsIdFeaturedRequest }): Promise<PatchProjectsIdFeaturedResponse>;
+    /** PATCH /projects/{id}/status — rank: metic+archon */
+    patchProjectsIdStatus(args: RequestArgs & { body: PatchProjectsIdStatusRequest }): Promise<PatchProjectsIdStatusResponse>;
     /** GET /projects/featured — rank: public */
     getProjectsFeatured(args?: RequestArgs): Promise<GetProjectsFeaturedResponse>;
     /** POST /projects/invite — rank: metic+archon */

package/clients/bongos-client/index.mjs

@@ -643,6 +643,8 @@ export function createClient(opts = {}) {
       postProjects: (args) => request("POST", "/projects", { hasBody: true }, args),
       // PATCH /projects/{id}/featured — rank: metic+archon — PATCH /projects/:id/featured
       patchProjectsIdFeatured: (args) => request("PATCH", "/projects/{id}/featured", { hasBody: true }, args),
+      // PATCH /projects/{id}/status — rank: metic+archon — PATCH /projects/:id/status
+      patchProjectsIdStatus: (args) => request("PATCH", "/projects/{id}/status", { hasBody: true }, args),
       // GET /projects/featured — rank: public — GET /projects/featured
       getProjectsFeatured: (args) => request("GET", "/projects/featured", { hasBody: false }, args),
       // POST /projects/invite — rank: metic+archon — POST /projects/invite

package/docs/adr/0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md

@@ -0,0 +1,109 @@
+# ADR 0252 — The self-hosted visibility report is a PULL, and auto-appear buys a retraction lever
+
+- **Status:** accepted
+- **Date:** 2026-09-06
+- **Task:** [task 1002321](https://cloudbongos.com/builders#/task/1002321) (BONGOS-V1, goal 1000046 — *Project creation*, criterion `proj-visibility-states` / C1), BV1.R02 — a spike whose output is this decision
+- **Gates:** [task 1002327](https://cloudbongos.com/builders#/task/1002327) (BV1.R08 — the build)
+- **Deciders:** the Archon (the two product calls in §3 and §5), Claude (the mechanism)
+- **Depends on:** [ADR 0182](<redacted>.md) D3/D5 (the two axes, and the hand-off that named this ADR's scope) · [ADR 0238](<redacted>.md) (the owner's door is a provisioning settings key; the hub column stays the cache) · [ADR 0246](<redacted>.md) (the control-plane projection, and the line this ADR sits on)
+- **Related:** [ADR 0144](<redacted>.md) (the tripwire this route avoids) · [ADR 0145](<redacted>.md) (why `standalone` holds no credential) · [ADR 0205](<redacted>.md) (what a self-report may and may not buy) · [ADR 0047](<redacted>.md) (the straight-through path and its abuse guard are one task) · [ADR 0199](<redacted>.md) / [ADR 0226](<redacted>.md) (a degraded report is not a state change)
+
+---
+
+## 1. The problem, and a premise that turned out to be false
+
+BV1.R02 was written to design "how a self-hosted instance reports its visibility to the hub, and how far the hub trusts it," and to settle the **auto-appear vs. Archon-curate** question the planning interview deferred.
+
+Reading the tree first changed the question. **A self-hosted instance has no channel to the hub at all, and no credential with which to open one.** `registerClient` has exactly one caller in the repository — `scripts/gds/provision-net.js:84`, inside the operator's own control-plane `federateInstance` — and that call is gated:
+
+```js
+if (inst.hosting_shape !== 'co-tenant') return { federate: false, reason: … };
+```
+
+Every writer of `sso_clients` is control-plane; no route registers a client. So *federated* ⊆ *operator-provisioned co-tenant*, and *self-hosted* is a disjoint set holding nothing. That is deliberate on two counts: [ADR 0145](<redacted>.md) says in as many words **do not** extend federation to `standalone` as it exists today, and [ADR 0144](<redacted>.md)'s Known Limitation rests on it — *"today every secret-holder is an operator-provisioned, trusted instance … the proper fix must land before federation opens to untrusted third-party clients."*
+
+So the literal reading of R08 — "a self-hosted instance authenticates and pushes a report" — cannot be built without first minting credentials for untrusted third parties, which walks straight into that tripwire. [ADR 0182](<redacted>.md) D5's phrasing ("accepts a report from the authenticated `sso_client`") described a client that, for this population, does not exist.
+
+## 2. The channel is a PULL of the instance's own public manifest
+
+**Decision.** The hub does not receive a pushed report. It **reads the instance's already-public declaration**: `GET <origin>/api/gds/instance` → `branding.project.visibility`.
+
+That value is already there and already public. The owner's pick lives at `provisioning_instances.settings.visibility`, is handed to the instance as `<PREFIX>_VISIBILITY`, and the instance re-serves it on a CORS-open route (`src/branding.js`, `src/bongos/routes/instance.js`). The comment that put it there already anticipated this consumer: *"which is what lets a later task enforce the door there and report the value to the hub catalog (R08)."*
+
+Five things a pull gets for free, each of which a push would have had to build:
+
+1. **No credential.** Nothing is minted for anyone, so ADR 0144's tripwire is untouched and ADR 0145's rule holds. This is the whole reason the decision goes this way.
+2. **No replay surface.** ADR 0182 D5 handed R02 "replay, rate" as its scope. A pull reads *current state*, so there is no message to capture and resend — the `jti`-style machinery [ADR 0144](<redacted>.md) D6 needed for the push direction is moot here. Replay is answered by not having a message.
+3. **No wire change on anyone else's upgrade clock.** [ADR 0205](<redacted>.md) rejected adding a required body field precisely because "the callers are other instances on their own upgrade schedule," and [ADR 0201](<redacted>.md) D2.2 solved the same problem with a header. Here the field already ships in every core; nothing has to be added at all.
+4. **The hub still authorizes nothing.** It reads a declaration and caches it, which is exactly what [ADR 0182](<redacted>.md) D5 requires and what [ADR 0238](<redacted>.md) rejected a `PATCH /projects/:id/visibility` for failing.
+5. **The fetch is already written.** `modules/platform-identity/project-stats.js` fans out to project origins today behind a real SSRF guard — DNS-resolve-all with a public-address assertion, `redirect: 'error'` (a curated origin is trusted, a redirect target is not), per-request timeouts, a TTL cache, a negative cache and inflight collapsing. The visibility read rides that machinery rather than opening a second, weaker outbound path.
+
+**The pull carries `visibility` and nothing else.** It is a three-value closed enum; an absent or off-vocabulary answer yields *no verdict* (§4), never a default. No free text, no name, no tagline, no art reaches the catalog through this channel — those stay curated fields, so the property the map has today (a project owner controls no free-text field that reaches the feed) is not spent here.
+
+## 3. Auto-appear: no human stands between a public project and the map
+
+**Decision (the Archon's).** A self-hosted project reporting `public` appears on the map with **no human act**. `featured` keeps the only job [ADR 0182](<redacted>.md) D3 left it — ranking among rows already there — and curation stays editorial.
+
+The alternative (a one-time admission, or ongoing curation) was offered and declined. What was declined with it is the friction ADR 0182 D3 had already removed once: an owner setting their project public and seeing nothing happen until someone else acted.
+
+**This decision is conditional, and the condition is §5.** Auto-appear is only defensible because retraction ships beside it; [ADR 0047](<redacted>.md) is explicit that the straight-through path and the abuse guard are the *same* task, and this ADR treats that as binding rather than advisory.
+
+## 4. Trust follows provenance — the asymmetry is in the guards, not in a gate
+
+**Decision (the Archon's).** Hosted and self-hosted projects are **not** held to the same bar. Both auto-appear; what differs is what each is trusted to *say*, because the evidence behind each differs:
+
+| | control-plane / co-tenant | self-hosted |
+|---|---|---|
+| how `visibility` arrives | **assigned** by the bridge from `provisioning_instances.settings` | **pulled** from a manifest the hub does not control |
+| evidence | an own-scoped, vocab-validated, audited route the operator's own plane ran | someone pointed a domain at the hub |
+| status of the value | authoritative | a **cached claim, with a recency stamp** |
+| may move | its own row | its own row, and only its own row |
+
+Stated once, so it is not re-litigated: **an instance is authoritative about its own door and about nothing else.** That is [ADR 0016](<redacted>.md) and [ADR 0141](<redacted>.md)'s line held in a new place — identity and self-description federate, authority does not.
+
+### Absent is a third state, and it must not purge
+
+[ADR 0182](<redacted>.md) D5 says the absent-report default is fail-closed: unreported ⇒ dark matter. That stands, **scoped to a self-hosted row that has never once answered** — such a project is off the map rather than exposed by omission.
+
+It must never be evaluated against control-plane rows, and it must never be read as "answered before, silent now." [ADR 0247](<redacted>.md) D4 found the live shape of this trap: at the time of writing, *every* catalog row carried `description: null`, so a naive fail-closed enforcement wired that day would have refused every join on the platform at once. The same hazard applies here.
+
+So the tri-state is explicit — `null` (never read) ≠ `false` (read, and negative) ≠ `true`:
+
+- **never successfully read** → dark matter (D5's rule, doing its job)
+- **read before, unreachable now** → **keep the last known state, stamped with its recency.** A project does not leave the map because its server was down for a sweep. [ADR 0199](<redacted>.md): liveness is an overlay, never a lifecycle state. [ADR 0226](<redacted>.md): reporting may degrade where enforcement must refuse — and this is reporting.
+- **read, and narrower than before** → applied immediately and unconditionally. A report that *reduces* exposure needs no trust at all: the worst a lying instance achieves is hiding itself.
+
+That last line is the shape of the whole trust model. **Narrowing is free; widening is what costs.**
+
+## 5. Auto-appear buys a retraction lever — and `hidden` is sticky
+
+`platform_identity_projects.status` is `('active','hidden')` and the public feed requires `active`. **No route writes it.** The only `status` write in the module is on `sso_clients`. Today, removing a project from the map is hand-written SQL on production.
+
+Under control-plane provisioning that was survivable, because the set of rows was bounded by who the operator had provisioned. Auto-appear replaces that bound with *whoever points a domain at us*, and a one-way door onto a public surface is not a door. So R08 ships, in the same task:
+
+1. **`PATCH /projects/:id/status`** — `active|hidden`, `project.curate` floor (metic, per [ADR 0157](<redacted>.md)), audited.
+2. **`hidden` is STICKY against the pull.** A retracted project that keeps reporting `public` **stays hidden**. This is the single most important line in this ADR: without it the next sweep silently undoes every takedown, and the lever is decorative. Retraction is a hub decision about the hub's own surface, and the pull may not overwrite it — the pull moves `visibility`, never `status`. The two columns answer different questions and this is where that separation earns its keep.
+3. **A per-IP read limit on the public feed** (the [ADR 0209](<redacted>.md) precedent). `GET /projects/featured` is unauthenticated, CORS-open and currently unmetered, and each cold sweep can drive up to 500 rows × 4 outbound fetches.
+
+### One gap this decision widens, named rather than left
+
+`hall_origin` reaches the public feed from the remote instance's own discovery index, and the hub relays it into an `<a href>`. Its only check is that it *differs* from the project's site host — the opposite of a containment rule. Under curated provenance that was survivable; under auto-appear it is a phishing hop anyone can mint.
+
+The corpus already has the right rule and applies it one field over: `shipUrlWithinClientOrigin` requires a pushed ship link to point **at or below** the reporting instance, and explains why the mirror rule is not symmetric (on a shared apex, `foo.github.io` must not publish links on bare `github.io`). **`hall_origin` gets the same downward-only containment**, filed as its own task against R08.
+
+## 6. Consequences
+
+- **A self-hosted project can put itself on the public map, and that is now a supported, un-gated path.** The hub will also, once the SEO work lands, serve it an indexable `cloudbongos.com/<slug>` page — so auto-appear is also auto-issue of a page on the hub's own domain. Accepted knowingly; §5 is the counterweight.
+- **The hub reaches out to more origins.** The fan-out ceiling is unchanged (500 rows, TTL + negative caches), but the *population* is no longer bounded by provisioning. The feed read limit exists for this.
+- **Two populations, one column, different provenance** — readers of `platform_identity_projects.visibility` cannot assume how it got there. The recency stamp is what tells them.
+- **A self-hosted instance that never upgrades never appears.** It already serves `branding.project.visibility`, so in practice this is only the very old.
+- **Nothing here federates a self-hosted instance.** It holds no credential, mints no assertion, writes no membership, and reports no analytics. The later analytics feed R02 was asked to anticipate is deliberately *not* decided here: it carries per-person data, which is exactly what [ADR 0205](<redacted>.md) proved cannot ride an unwitnessed self-report. It needs the ADR 0144 credential work first, and it is a separate decision.
+
+## 7. Rejected
+
+- **A pushed report authenticated by a client credential.** The literal reading of R08. Rejected: self-hosted instances hold no credential, and minting them is the exact move [ADR 0144](<redacted>.md) and [ADR 0145](<redacted>.md) say must not happen yet. It would also have owed replay protection, a rate budget and a wire-compatible field — three problems the pull does not have.
+- **`PATCH /projects/:id/visibility` on the hub.** Already rejected by [ADR 0238](<redacted>.md) for making the hub authorize a door change; restated here because a pull could be mistaken for a licence to add one.
+- **A one-time admission, and ongoing curation.** Both offered to the Archon; both declined in favour of auto-appear (§3).
+- **Trusting the pull to move `status`.** The retraction lever would be decorative (§5.2).
+- **Enforcing "unreported ⇒ dark matter" across all rows.** [ADR 0247](<redacted>.md) D4's live finding: it empties the map (§4).
+- **Letting the pull carry name, tagline or art.** Today no project owner controls a free-text field that reaches the feed. That is a property worth keeping, and a visibility report is not the place to spend it.

package/docs/adr/0253-the-takedown-lever-has-two-writers-and-provenance-is-a-column.md

@@ -0,0 +1,144 @@
+# ADR 0253 — The takedown lever has two writers, and provenance has to be a column
+
+- **Status:** accepted
+- **Date:** 2026-09-06
+- **Task:** [task 1002327](https://cloudbongos.com/builders#/task/1002327) (BONGOS-V1, goal 1000046 — *Project creation*, criterion `proj-visibility-states` / C1), BV1.R08 — the build
+- **Deciders:** Claude, building R08 against ADR 0252's design
+- **Amends:** [ADR 0252](<redacted>.md) §4 and §5 — three premises that did not survive contact with the tree. The decisions ADR 0252 took are unchanged; what changes is what has to be built to make them true.
+- **Related:** [ADR 0246](<redacted>.md) (the control-plane projection, and the writer §5 missed) · [ADR 0247](<redacted>.md) D4 (the fail-closed trap, found live one column over) · [ADR 0182](<redacted>.md) D5 (dark matter) · [ADR 0083](<redacted>.md) (the one-way import rule that forces §2's shape) · [ADR 0209](<redacted>.md) (the limiter precedent) · [ADR 0199](<redacted>.md) / [ADR 0226](<redacted>.md) (reporting degrades; enforcement refuses)
+
+---
+
+## 1. Why this ADR exists
+
+ADR 0252 is a design ADR written from a spike. Building it surfaced three things about the
+live tree that the design's own text gets wrong. None of them changes a decision — the pull
+is still a pull, auto-appear still ships, `hidden` is still sticky — but each changes what
+has to be **built**, and two of them are the difference between a working retraction lever
+and a decorative one.
+
+They are recorded here rather than by editing ADR 0252, because ADR 0252 is the record of a
+decision that was actually taken on those terms. This is the record of what the terms turned
+out to be.
+
+## 2. `hidden` is sticky against TWO writers, and ADR 0252 names the wrong one
+
+**ADR 0252 §5 says:** *"`platform_identity_projects.status` is `('active','hidden')` and the
+public feed requires `active`. **No route writes it.** The only `status` write in the module
+is on `sso_clients`."* From there it defends the takedown against the visibility pull, and
+calls that "the single most important line in this ADR."
+
+**The tree says otherwise.** `project-catalog.js:upsertOwnedProject` writes `status =
+EXCLUDED.status` on every conflict, and `retireOwnedProject` writes `status = 'hidden'`
+outright. The value comes from `catalog-bridge.js:catalogStatusForInstance`, which returns
+`'active'` for any instance that is not `tearing_down`/`torn_down` — and ADR 0246's whole
+point is that this projection is **re-taken at every write that can change its inputs**
+(create, the detail answers, the settings door, a re-pointed address, plus the backfill
+poller).
+
+So the live failure is not the one ADR 0252 guards. It is:
+
+1. A curator hides a project.
+2. Its owner saves any setting at all.
+3. The bridge re-takes the projection, assigns `status = 'active'`, and the project is back
+   on the public map.
+
+**Decision.** The stickiness is a property of the ROW, not of one writer's manners.
+`status_pinned` is set by the curated `PATCH /projects/:id/status` and honoured by
+`upsertOwnedProject`; the pull, separately, never writes `status` at all (asserted against
+the statement text, so a later `status` write in that file reds a test rather than silently
+undoing every takedown).
+
+**`retireOwnedProject` deliberately does NOT honour the pin.** It is a safety retraction for
+an origin the project no longer answers on — the [ADR 0181](0181-teardown-state-gate-and-address-retention.md)
+§2 stale-orb leak — and a curator's `'active'` pin must not be able to keep a dead address
+drawing an orb. This is ADR 0252's own principle applied consistently: **narrowing is free;
+widening is what costs.** Every guard in R08 refuses in the direction of less exposure.
+
+## 3. Provenance has to be a stored column, because the discriminator does not exist
+
+**ADR 0252 §4 tabulates** control-plane rows against self-hosted ones as though the catalog
+knew which was which. It does not. `platform_identity_projects` has no `hosting_shape` and
+no other column that distinguishes them; `hosting_shape` lives on `provisioning_instances`,
+in a module `platform-identity` may not import (ADR 0083's one-way rule). Nor can it be
+inferred: `owner_github_id` is set by the bridge, by `registerClient` **and** left null by
+hand-seeded rows, so it separates nothing.
+
+**Decision.** `visibility_source` records which writer owns the row's door
+(`'control-plane'` | `'pull'` | NULL for unclaimed), stamped by whichever writer touches it.
+The pull's predicate is then a local column read — `visibility_source IS DISTINCT FROM
+'control-plane'` — re-asserted in the UPDATE's own `WHERE`, not merely checked before it, so
+a bridge projection landing mid-sweep cannot lose the race. "The two never write the same
+row" becomes an invariant the SQL enforces instead of a convention someone has to remember,
+and no new cross-module seam is opened to ask a question on every sweep.
+
+The rejected alternative — a `provisioning.instanceShape` port — is more general and worse:
+it puts a cross-module read in a background loop to answer a question that never changes for
+a given row, and it makes the catalog learn another module's vocabulary, which is exactly the
+ceiling ADR 0246 set.
+
+## 4. The tri-state cannot live in `visibility`, and the fail-closed default needs a backfill
+
+`visibility` is `NOT NULL DEFAULT 'public'` (migration 011), so it physically cannot express
+"never asked". The recency stamp ADR 0252 §4 asks for is therefore also the null-carrier:
+`visibility_reported_at IS NULL` **is** the never-read state, and it is the only condition
+under which ADR 0182 D5's "unreported ⇒ dark matter" applies. A failed read writes nothing at
+all — which is what keeps the stamp meaning *last successful read* and makes "keep the last
+known state" fall out rather than being implemented.
+
+**And the fail-closed predicate needed a backfill, for exactly the reason ADR 0247 D4
+gives.** Shipping `AND (visibility_source = 'control-plane' OR visibility_reported_at IS NOT
+NULL)` without one would have emptied the public map on deploy, because both columns are new
+and therefore NULL on every row — the same shape ADR 0247 D4 found live on this very table
+(`description: null` on every row, so a fail-closed join gate wired that day would have
+refused every join on the platform at once). Migration 020 stamps every pre-existing row
+`'control-plane'`, which is safe because it is **true**: every row that exists today got its
+door from the bridge or from an Archon, and no instance has ever been asked.
+
+## 5. Two smaller corrections, recorded so they are not rediscovered
+
+- **The manifest key is `brand`, not `branding`.** ADR 0252 §2 and task 1002327's body both
+  write `branding.project.visibility`; `buildInstanceManifest` projects the pack under
+  `brand`. Reading only the documented spelling would have made every pull a silent
+  no-verdict — a failure indistinguishable from "no self-hosted project ever reports". The
+  reader accepts both spellings and the test pins both.
+- **The pull is a POLLER, not a passenger on the feed's fan-out.** The obvious cheap move —
+  add a fifth fetch beside the four `project-stats.js` already makes — cannot work, and the
+  reason is invisible until you try it: **the feed excludes exactly the rows that need
+  pulling.** A pullable project that has never answered is dark matter, so it is not in
+  `listPublicProjects`, so it is never enriched, so it never answers. A read-path pull can
+  only refresh projects that are *already visible*, which is backwards; it cannot bootstrap.
+  Stealth rows are excluded from enrichment too (deliberately — asking a stealth project's
+  API would tell it it was being enumerated), so one could never be seen coming back. And it
+  would make a database write a side effect of an anonymous, CORS-open read.
+
+## 6. Consequences
+
+- **The retraction lever actually holds.** Not because the pull is polite, but because the
+  row carries a latch every automatic writer honours.
+- **`GET /projects/featured` is metered** (limiter #5, 120/min per IP, ADR 0209's shape: one
+  exported instance, never a factory). It guards the platform's most expensive anonymous
+  read — a cold call fans out to as many as 500 third-party origins — so the ceiling protects
+  other people's servers as much as ours.
+- **A hand-seeded catalog row created after this lands is dark until it answers.** That is
+  ADR 0252 §2's design working as specified, but it is a behaviour change for the Archon
+  `POST /projects` path and worth knowing before someone types a row in and wonders where it
+  went.
+- **ADR 0247 D4's `description: null` problem is NOT fixed here.** ADR 0247 names R08 as the
+  report that fills the catalog, but ADR 0252 §7 deliberately refuses to let the pull carry
+  name, tagline or description — so every catalog row still has `description: null` and the
+  publish gate is still unmet for self-hosted rows. The pull moves the door; it does not
+  publish the project. That gap is real and stays open.
+
+## 7. Rejected
+
+- **Editing ADR 0252 instead of amending it.** It records a decision taken on stated terms;
+  rewriting the terms afterwards loses what was actually decided and why.
+- **Defending `hidden` against the pull only**, as ADR 0252 §5.2 literally specifies. It
+  would satisfy the ADR's text and leave the lever decorative against the writer that fires.
+- **Inferring self-hosted from `owner_github_id`, or from the absence of a credentialed
+  `sso_clients` row.** Both are proxies that are wrong today for real rows.
+- **A `provisioning.instanceShape` port.** §3.
+- **Backfilling `visibility_reported_at = now()` instead of stamping the source.** It would
+  assert a reading that never happened, and it would make every existing row look freshly
+  confirmed by an instance that was never contacted.