@bongos/core 1.19.564 → 1.19.566

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.564",
-  "core_contract": "1.19.564",
-  "source_commit": "d4d0c5049c5c72237a81450221af13702a00ccb7",
+  "core_version": "1.19.566",
+  "core_contract": "1.19.566",
+  "source_commit": "b344a2bcd27acb87fd8d8bcac11241639954f7be",
   "source_ref": "HEAD",
-  "built_at": "2026-09-06T18:43:07.289Z",
+  "built_at": "2026-09-06T20:04:22.237Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 445,
+    "docs_redacted": 446,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2029,
+    "functional_verbatim": 2035,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2498,
-  "tree_sha256": "478ff6d025680dd25564647bac310bd570d0e58335d46a999cb9e4ed4d527aec",
+  "file_count": 2505,
+  "tree_sha256": "b8a38f68a219ad5d19cb432356353fa520857e09c5a5a8726caa463e577a99c1",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -372,12 +372,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "38988a49c2cdcc89db69602de1fe46cba0de430643c677352b9db36ed89c010c"
+      "sha256": "f94a07e3c135a5d6c41a2d16f722e86b990362996042dc2a5e05b2020f8cf376"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "bd7d31e9cff0d758cc66c1d4adcf52eeaa99acc2ef48d459265425e2a4d2fd19"
+      "sha256": "06d1814637fe2898f0d93a3870726d53102d02feeae4611fcca80f195e2e26e4"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -387,17 +387,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "33fbbbaf2a4a939b7351a7aa25264ddd609c1298d9ba809372a162983afe5038"
+      "sha256": "ee0e25848a938f675e7a2e6e0a48983308117ecafe93ca219f4f1df49cf7ea51"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "a0992ef72cffc0d200e62bd5315e64090eda7cbd3477a01ec041e2d08bb39b9e"
+      "sha256": "f7c16a633c0f5c3ba13421815d08f5fb935b8737433acffe72fef018adffbf25"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "e83e49178398441026fe6fd4822dd4eddae2c2316f5aa5006a090ef0d1a41b98"
+      "sha256": "6a3e4df57180f3c182fbadabe94030d06f125373c9336a7a4160015f1df5b11e"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1779,20 +1779,25 @@
       "mode": "0000644",
       "sha256": "a36e7591da769ef46cb4f1c62d5b941278478dbb93e0a94c4f18e35a91866082"
     },
+    {
+      "path": "docs/adr/0253-the-takedown-lever-has-two-writers-and-provenance-is-a-column.md",
+      "mode": "0000644",
+      "sha256": "1e17e1499be966af136b63f75693547d2e1e46f825af5755310b9096e949054f"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "f3fac1ec223ee6804f1b0a47734f030cc5f97226efc17f7a618cb55099d8e642"
+      "sha256": "0c072575a958a3377fe2c7237f9c5af69f00cf8aa1df2bd8c6a3f884ab656b37"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "ae645afb5ce376b7e7b4ad0a5c00f63e48a2d0540fe79af29106d174a41ac3e8"
+      "sha256": "33d4d9b7530ebeebffc8c7200a137f5624b8319ff9a26e8b7b1e3209acb413ae"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "a009aa37bc7698ac1469b45ac875b1b3884c0104b7f8a886e450082d503de45c"
+      "sha256": "b4c2891985427587d5a065b6e7d69638c5cd554d42d5eb22572b9c82f898431f"
     },
     {
       "path": "docs/architecture.md",
@@ -2667,7 +2672,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "726abfc14ae798baa3c7b55513db2ac74471ec78cc079efcf401b7ba409d25be"
+      "sha256": "7073e3d898b2a0d80c9cad6f2ed3a142f2071b9cd4095dae8c580acb2f2095e3"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4067,7 +4072,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "33fbbbaf2a4a939b7351a7aa25264ddd609c1298d9ba809372a162983afe5038"
+      "sha256": "ee0e25848a938f675e7a2e6e0a48983308117ecafe93ca219f4f1df49cf7ea51"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -4307,7 +4312,7 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "57b29298fa5707d3a1d59e78612d2b039b1559d26b8a9116812d5c76e9c3af87"
+      "sha256": "e2d8d2a3187598fe0c647d30cd333627feeb1aa5352fac8bafc922cf40750e12"
     },
     {
       "path": "modules/government/config.js",
@@ -6019,10 +6024,15 @@
       "mode": "0000644",
       "sha256": "112fd5dcc9d2bfbc8ec064963e1a783d8ef7855a1a47cf6575ea70da06803d68"
     },
+    {
+      "path": "modules/platform-identity/migrations/platform_identity_020_visibility_pull.sql",
+      "mode": "0000644",
+      "sha256": "d4e7b3562068397f63ec66c63da330fd3363ef2a1dbab0d069c995c2a6dbb3b7"
+    },
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
-      "sha256": "b798cbc2c6f4106c4eb94c9f7219ad1643bfb5ec9449e0384bf87b3f7ecccc30"
+      "sha256": "cc6f7ab084ee74715241220339411d1a10c8d6697af143df452278ea2c634f79"
     },
     {
       "path": "modules/platform-identity/platform-identity.js",
@@ -6034,20 +6044,25 @@
       "mode": "0000644",
       "sha256": "b6eea95dbe66a3126fc2c73d93237cf38dd648a803e910eb88fbd5c780ccef62"
     },
+    {
+      "path": "modules/platform-identity/pollers/visibility-pull.js",
+      "mode": "0000644",
+      "sha256": "f842d6ae04dbd2360703f72d35695d9d35c0eb51699d210bf3aa7af67750a009"
+    },
     {
       "path": "modules/platform-identity/project-catalog.js",
       "mode": "0000644",
-      "sha256": "6021d893691000a164d7d16e6f24b5bd91215c6dcb252557f0ffcd5d1d467e32"
+      "sha256": "7aa4866e134a9610a36b5c11efffc4ce53fa733be84d47f7b4c269a767c587c9"
     },
     {
       "path": "modules/platform-identity/project-stats.js",
       "mode": "0000644",
-      "sha256": "2e898799632a2b5c2ead9cb44fa0b8029fcb6d217f7d5f26c8a39b34c75bbea7"
+      "sha256": "20000528b99e9a52cd9bd2d02c7ca4b118a5b6432ae2902ff8f9bd0503d12d38"
     },
     {
       "path": "modules/platform-identity/projects-feed.js",
       "mode": "0000644",
-      "sha256": "7ba4e7f2a375a1197524106605ff5dd6e4e597b2926bf6498f784ede5099a447"
+      "sha256": "fac8b2f750a5a9fb3c05290223292449b04a45c33b6976da285126616a8e9e91"
     },
     {
       "path": "modules/platform-identity/publish-gate.js",
@@ -6077,7 +6092,7 @@
     {
       "path": "modules/platform-identity/routes/projects.js",
       "mode": "0000644",
-      "sha256": "dac39b920025d696ba34e20aa4a9fbfb70d1cbc9ffe8f3b0da823f333d6a8d7a"
+      "sha256": "af098885cd3d7e83a9302c7eb8213c3448d73ab79be53b2b5ff1467fbab3685a"
     },
     {
       "path": "modules/platform-identity/routes/public-profile.js",
@@ -6114,6 +6129,11 @@
       "mode": "0000644",
       "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
     },
+    {
+      "path": "modules/platform-identity/visibility-pull.js",
+      "mode": "0000644",
+      "sha256": "3eee70629402e2c9c8ee0a79466ed1c83f13cec151f60e5f57e7601813a47b58"
+    },
     {
       "path": "modules/provisioning/CLAUDE.md",
       "mode": "0000644",
@@ -6752,7 +6772,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "edc38e4ae7859c1dfc5422a4a0351c10f31cf119cab878dae0e25461c6121578"
+      "sha256": "7aa74c059670bd351bf8a4295e408aef4a908e3095711aee93f75408ccd837d5"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -7497,12 +7517,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "5c872f20ae1fd789c219dab32e15b3a7ca446d0451dc518709be7091f2d7e255"
+      "sha256": "319b45c1535e293ea0c0223c730ec9a08b1059469eb86edc61d3c3d8b9976eee"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "cd8cd65764759527985342aae0c228171fb47bba1164fd66a3282b1774c56aa8"
+      "sha256": "3884c6ddda900305c539824babe08c00fbf942a50c5f7c23bd805d674cae32dc"
     },
     {
       "path": "public-docs/index.html",
@@ -9007,7 +9027,7 @@
     {
       "path": "src/bongos/middleware/rate-limit.js",
       "mode": "0000644",
-      "sha256": "cd28f4517614b4b812aba3c051674ebaff8e78fd741a2e464966b687c459a654"
+      "sha256": "7a4a49df59dd3754fec468f1833514982b6e57c460dc531d5f6605cfe68d196f"
     },
     {
       "path": "src/bongos/module-scope-map.js",
@@ -9202,7 +9222,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "9cdb44aae69870c64cfb5ae2121af4b87bb09b2aeb77cb48827a029482b26862"
+      "sha256": "feb3d851877e533d53226ddb6b71bf5d2aa5a47c3a9b38d2bd4801d3a1e8a64b"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11094,6 +11114,11 @@
       "mode": "0000644",
       "sha256": "9a1813d6036886ea07d1563e71a466e66c28554b75b22605464c795fd9fa2ebb"
     },
+    {
+      "path": "tests/manage_settings_shared_read.mjs",
+      "mode": "0000644",
+      "sha256": "68a429b47a1ca36a41433c0d8c3298a0f54745a19b050675aedba658a2cea0ef"
+    },
     {
       "path": "tests/me_ship_days_bound.mjs",
       "mode": "0000644",
@@ -11192,7 +11217,7 @@
     {
       "path": "tests/module_api.mjs",
       "mode": "0000644",
-      "sha256": "c7eadd36ae57c2f8976bf30bbd4c5d6ac3db0c1a8f67319860b3e4f85b5b5bc1"
+      "sha256": "39812c560bcd88e3b3a7938ed2447fbd4ab24b0f925e9662b375910bcbe7f1da"
     },
     {
       "path": "tests/module_catalog.mjs",
@@ -11487,7 +11512,7 @@
     {
       "path": "tests/project_door_ui.mjs",
       "mode": "0000644",
-      "sha256": "29f59ab64b231a7ec5d17a3e784d451f75d80c19efd4cb6a523d263e8f88b581"
+      "sha256": "97d570d16414bb5c71d54223702058018a13c58cdf563448c7d28e2fcf80488e"
     },
     {
       "path": "tests/project_invite_ownership.mjs",
@@ -11529,6 +11554,11 @@
       "mode": "0000644",
       "sha256": "8cb5533aca29727c317450cf5730f309cdb5540265f8c150a8ea2242c7ef5656"
     },
+    {
+      "path": "tests/project_takedown_lever.mjs",
+      "mode": "0000644",
+      "sha256": "361a8baae6b15efa86bdb366076b6ba2ad237f2fa63d600bee879db19042dbef"
+    },
     {
       "path": "tests/project_visibility_db.mjs",
       "mode": "0000644",
@@ -11537,7 +11567,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "56b1ecd69244798b704b787e13fd9fc74ec07e575a847ef6603df7430b63a51e"
+      "sha256": "f93044429430c9fff4fe6860bae87ff8f67bc49a485391e659422e63f209e08c"
     },
     {
       "path": "tests/projects_hub_module_picker.mjs",
@@ -12454,10 +12484,15 @@
       "mode": "0000644",
       "sha256": "2a381bab380342e4fc556211d4821c85fdde1f676a6c5c6aa2421a89a573cd27"
     },
+    {
+      "path": "tests/visibility_pull.mjs",
+      "mode": "0000644",
+      "sha256": "57be5f1160903113241700d5d0474debfbe46184de45ed8f3aa210910f810729"
+    },
     {
       "path": "tests/visible_projects_feed.mjs",
       "mode": "0000644",
-      "sha256": "4bf47b6aee92c54099c583726d05421a433ac5b5e82792a848d11c80d7ee7bd1"
+      "sha256": "c5d4a17ba9765069a7850fef5d3843e076fbd08edbc7d690a36e2ff4299d10c2"
     },
     {
       "path": "tests/wandering_prefs.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 357 operations across 55 resource groups
+- 358 operations across 55 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -647,6 +647,8 @@ function createClient(opts = {}) {
       postProjects: (args) => request("POST", "/projects", { hasBody: true }, args),
       // PATCH /projects/{id}/featured — rank: metic+archon — PATCH /projects/:id/featured
       patchProjectsIdFeatured: (args) => request("PATCH", "/projects/{id}/featured", { hasBody: true }, args),
+      // PATCH /projects/{id}/status — rank: metic+archon — PATCH /projects/:id/status
+      patchProjectsIdStatus: (args) => request("PATCH", "/projects/{id}/status", { hasBody: true }, args),
       // GET /projects/featured — rank: public — GET /projects/featured
       getProjectsFeatured: (args) => request("GET", "/projects/featured", { hasBody: false }, args),
       // POST /projects/invite — rank: metic+archon — POST /projects/invite

package/clients/bongos-client/index.cjs

@@ -646,6 +646,8 @@ function createClient(opts = {}) {
       postProjects: (args) => request("POST", "/projects", { hasBody: true }, args),
       // PATCH /projects/{id}/featured — rank: metic+archon — PATCH /projects/:id/featured
       patchProjectsIdFeatured: (args) => request("PATCH", "/projects/{id}/featured", { hasBody: true }, args),
+      // PATCH /projects/{id}/status — rank: metic+archon — PATCH /projects/:id/status
+      patchProjectsIdStatus: (args) => request("PATCH", "/projects/{id}/status", { hasBody: true }, args),
       // GET /projects/featured — rank: public — GET /projects/featured
       getProjectsFeatured: (args) => request("GET", "/projects/featured", { hasBody: false }, args),
       // POST /projects/invite — rank: metic+archon — POST /projects/invite

package/clients/bongos-client/index.d.ts

@@ -175,6 +175,8 @@ export interface PatchProjectSettingsRotDaysRequest { days: number }
 export interface PatchProjectSettingsRotDaysResponse { ok: boolean; rot_days: unknown; source: unknown; describe: unknown }
 export interface PatchProjectsIdFeaturedRequest { featured: boolean }
 export interface PatchProjectsIdFeaturedResponse { project: unknown }
+export interface PatchProjectsIdStatusRequest { status: string }
+export interface PatchProjectsIdStatusResponse { project: unknown }
 export interface PatchProvisioningInstancesIdDetailRequest { description?: string; detail?: Record<string, unknown>; modules?: string[] }
 export interface PatchProvisioningInstancesIdDetailResponse { ok: boolean; description: unknown; detail: unknown; options: unknown; publish: unknown; modules: unknown }
 export interface PatchProvisioningInstancesIdSettingsResponse { ok: boolean; saved: unknown; planet: unknown; push: unknown }
@@ -971,6 +973,8 @@ export interface BongosClient {
     postProjects(args: RequestArgs & { body: PostProjectsRequest }): Promise<PostProjectsResponse>;
     /** PATCH /projects/{id}/featured — rank: metic+archon */
     patchProjectsIdFeatured(args: RequestArgs & { body: PatchProjectsIdFeaturedRequest }): Promise<PatchProjectsIdFeaturedResponse>;
+    /** PATCH /projects/{id}/status — rank: metic+archon */
+    patchProjectsIdStatus(args: RequestArgs & { body: PatchProjectsIdStatusRequest }): Promise<PatchProjectsIdStatusResponse>;
     /** GET /projects/featured — rank: public */
     getProjectsFeatured(args?: RequestArgs): Promise<GetProjectsFeaturedResponse>;
     /** POST /projects/invite — rank: metic+archon */

package/clients/bongos-client/index.mjs

@@ -643,6 +643,8 @@ export function createClient(opts = {}) {
       postProjects: (args) => request("POST", "/projects", { hasBody: true }, args),
       // PATCH /projects/{id}/featured — rank: metic+archon — PATCH /projects/:id/featured
       patchProjectsIdFeatured: (args) => request("PATCH", "/projects/{id}/featured", { hasBody: true }, args),
+      // PATCH /projects/{id}/status — rank: metic+archon — PATCH /projects/:id/status
+      patchProjectsIdStatus: (args) => request("PATCH", "/projects/{id}/status", { hasBody: true }, args),
       // GET /projects/featured — rank: public — GET /projects/featured
       getProjectsFeatured: (args) => request("GET", "/projects/featured", { hasBody: false }, args),
       // POST /projects/invite — rank: metic+archon — POST /projects/invite

package/docs/adr/0253-the-takedown-lever-has-two-writers-and-provenance-is-a-column.md

@@ -0,0 +1,144 @@
+# ADR 0253 — The takedown lever has two writers, and provenance has to be a column
+
+- **Status:** accepted
+- **Date:** 2026-09-06
+- **Task:** [task 1002327](https://cloudbongos.com/builders#/task/1002327) (BONGOS-V1, goal 1000046 — *Project creation*, criterion `proj-visibility-states` / C1), BV1.R08 — the build
+- **Deciders:** Claude, building R08 against ADR 0252's design
+- **Amends:** [ADR 0252](<redacted>.md) §4 and §5 — three premises that did not survive contact with the tree. The decisions ADR 0252 took are unchanged; what changes is what has to be built to make them true.
+- **Related:** [ADR 0246](<redacted>.md) (the control-plane projection, and the writer §5 missed) · [ADR 0247](<redacted>.md) D4 (the fail-closed trap, found live one column over) · [ADR 0182](<redacted>.md) D5 (dark matter) · [ADR 0083](<redacted>.md) (the one-way import rule that forces §2's shape) · [ADR 0209](<redacted>.md) (the limiter precedent) · [ADR 0199](<redacted>.md) / [ADR 0226](<redacted>.md) (reporting degrades; enforcement refuses)
+
+---
+
+## 1. Why this ADR exists
+
+ADR 0252 is a design ADR written from a spike. Building it surfaced three things about the
+live tree that the design's own text gets wrong. None of them changes a decision — the pull
+is still a pull, auto-appear still ships, `hidden` is still sticky — but each changes what
+has to be **built**, and two of them are the difference between a working retraction lever
+and a decorative one.
+
+They are recorded here rather than by editing ADR 0252, because ADR 0252 is the record of a
+decision that was actually taken on those terms. This is the record of what the terms turned
+out to be.
+
+## 2. `hidden` is sticky against TWO writers, and ADR 0252 names the wrong one
+
+**ADR 0252 §5 says:** *"`platform_identity_projects.status` is `('active','hidden')` and the
+public feed requires `active`. **No route writes it.** The only `status` write in the module
+is on `sso_clients`."* From there it defends the takedown against the visibility pull, and
+calls that "the single most important line in this ADR."
+
+**The tree says otherwise.** `project-catalog.js:upsertOwnedProject` writes `status =
+EXCLUDED.status` on every conflict, and `retireOwnedProject` writes `status = 'hidden'`
+outright. The value comes from `catalog-bridge.js:catalogStatusForInstance`, which returns
+`'active'` for any instance that is not `tearing_down`/`torn_down` — and ADR 0246's whole
+point is that this projection is **re-taken at every write that can change its inputs**
+(create, the detail answers, the settings door, a re-pointed address, plus the backfill
+poller).
+
+So the live failure is not the one ADR 0252 guards. It is:
+
+1. A curator hides a project.
+2. Its owner saves any setting at all.
+3. The bridge re-takes the projection, assigns `status = 'active'`, and the project is back
+   on the public map.
+
+**Decision.** The stickiness is a property of the ROW, not of one writer's manners.
+`status_pinned` is set by the curated `PATCH /projects/:id/status` and honoured by
+`upsertOwnedProject`; the pull, separately, never writes `status` at all (asserted against
+the statement text, so a later `status` write in that file reds a test rather than silently
+undoing every takedown).
+
+**`retireOwnedProject` deliberately does NOT honour the pin.** It is a safety retraction for
+an origin the project no longer answers on — the [ADR 0181](0181-teardown-state-gate-and-address-retention.md)
+§2 stale-orb leak — and a curator's `'active'` pin must not be able to keep a dead address
+drawing an orb. This is ADR 0252's own principle applied consistently: **narrowing is free;
+widening is what costs.** Every guard in R08 refuses in the direction of less exposure.
+
+## 3. Provenance has to be a stored column, because the discriminator does not exist
+
+**ADR 0252 §4 tabulates** control-plane rows against self-hosted ones as though the catalog
+knew which was which. It does not. `platform_identity_projects` has no `hosting_shape` and
+no other column that distinguishes them; `hosting_shape` lives on `provisioning_instances`,
+in a module `platform-identity` may not import (ADR 0083's one-way rule). Nor can it be
+inferred: `owner_github_id` is set by the bridge, by `registerClient` **and** left null by
+hand-seeded rows, so it separates nothing.
+
+**Decision.** `visibility_source` records which writer owns the row's door
+(`'control-plane'` | `'pull'` | NULL for unclaimed), stamped by whichever writer touches it.
+The pull's predicate is then a local column read — `visibility_source IS DISTINCT FROM
+'control-plane'` — re-asserted in the UPDATE's own `WHERE`, not merely checked before it, so
+a bridge projection landing mid-sweep cannot lose the race. "The two never write the same
+row" becomes an invariant the SQL enforces instead of a convention someone has to remember,
+and no new cross-module seam is opened to ask a question on every sweep.
+
+The rejected alternative — a `provisioning.instanceShape` port — is more general and worse:
+it puts a cross-module read in a background loop to answer a question that never changes for
+a given row, and it makes the catalog learn another module's vocabulary, which is exactly the
+ceiling ADR 0246 set.
+
+## 4. The tri-state cannot live in `visibility`, and the fail-closed default needs a backfill
+
+`visibility` is `NOT NULL DEFAULT 'public'` (migration 011), so it physically cannot express
+"never asked". The recency stamp ADR 0252 §4 asks for is therefore also the null-carrier:
+`visibility_reported_at IS NULL` **is** the never-read state, and it is the only condition
+under which ADR 0182 D5's "unreported ⇒ dark matter" applies. A failed read writes nothing at
+all — which is what keeps the stamp meaning *last successful read* and makes "keep the last
+known state" fall out rather than being implemented.
+
+**And the fail-closed predicate needed a backfill, for exactly the reason ADR 0247 D4
+gives.** Shipping `AND (visibility_source = 'control-plane' OR visibility_reported_at IS NOT
+NULL)` without one would have emptied the public map on deploy, because both columns are new
+and therefore NULL on every row — the same shape ADR 0247 D4 found live on this very table
+(`description: null` on every row, so a fail-closed join gate wired that day would have
+refused every join on the platform at once). Migration 020 stamps every pre-existing row
+`'control-plane'`, which is safe because it is **true**: every row that exists today got its
+door from the bridge or from an Archon, and no instance has ever been asked.
+
+## 5. Two smaller corrections, recorded so they are not rediscovered
+
+- **The manifest key is `brand`, not `branding`.** ADR 0252 §2 and task 1002327's body both
+  write `branding.project.visibility`; `buildInstanceManifest` projects the pack under
+  `brand`. Reading only the documented spelling would have made every pull a silent
+  no-verdict — a failure indistinguishable from "no self-hosted project ever reports". The
+  reader accepts both spellings and the test pins both.
+- **The pull is a POLLER, not a passenger on the feed's fan-out.** The obvious cheap move —
+  add a fifth fetch beside the four `project-stats.js` already makes — cannot work, and the
+  reason is invisible until you try it: **the feed excludes exactly the rows that need
+  pulling.** A pullable project that has never answered is dark matter, so it is not in
+  `listPublicProjects`, so it is never enriched, so it never answers. A read-path pull can
+  only refresh projects that are *already visible*, which is backwards; it cannot bootstrap.
+  Stealth rows are excluded from enrichment too (deliberately — asking a stealth project's
+  API would tell it it was being enumerated), so one could never be seen coming back. And it
+  would make a database write a side effect of an anonymous, CORS-open read.
+
+## 6. Consequences
+
+- **The retraction lever actually holds.** Not because the pull is polite, but because the
+  row carries a latch every automatic writer honours.
+- **`GET /projects/featured` is metered** (limiter #5, 120/min per IP, ADR 0209's shape: one
+  exported instance, never a factory). It guards the platform's most expensive anonymous
+  read — a cold call fans out to as many as 500 third-party origins — so the ceiling protects
+  other people's servers as much as ours.
+- **A hand-seeded catalog row created after this lands is dark until it answers.** That is
+  ADR 0252 §2's design working as specified, but it is a behaviour change for the Archon
+  `POST /projects` path and worth knowing before someone types a row in and wonders where it
+  went.
+- **ADR 0247 D4's `description: null` problem is NOT fixed here.** ADR 0247 names R08 as the
+  report that fills the catalog, but ADR 0252 §7 deliberately refuses to let the pull carry
+  name, tagline or description — so every catalog row still has `description: null` and the
+  publish gate is still unmet for self-hosted rows. The pull moves the door; it does not
+  publish the project. That gap is real and stays open.
+
+## 7. Rejected
+
+- **Editing ADR 0252 instead of amending it.** It records a decision taken on stated terms;
+  rewriting the terms afterwards loses what was actually decided and why.
+- **Defending `hidden` against the pull only**, as ADR 0252 §5.2 literally specifies. It
+  would satisfy the ADR's text and leave the lever decorative against the writer that fires.
+- **Inferring self-hosted from `owner_github_id`, or from the absence of a credentialed
+  `sso_clients` row.** Both are proxies that are wrong today for real rows.
+- **A `provisioning.instanceShape` port.** §3.
+- **Backfilling `visibility_reported_at = now()` instead of stamping the source.** It would
+  assert a reading that never happened, and it would make every existing row look freshly
+  confirmed by an instance that was never contacted.

package/docs/adr/README.md

@@ -340,6 +340,7 @@ This keeps the decision history honest and traceable.
 | 0250 | [**Strict versioning — the version boundary is the scope gate** ([task 1003589](https://cloudbongos.com/builders#/task/1003589) · goal 1000086). The work hierarchy ([ADR 0086](<redacted>.md)) has a bottom and no top: tasks close, criteria close, goals close, and a version never does. Measured live — **14 goals reading `achieved`/`archived` while holding 35 unfinished tasks**, 523 open tasks across 37 open goals, and **two versions `building` on one project**; every number was worse than the planning session had recorded two days earlier, which is the argument: the drift is the steady state, not a backlog. The cause is four mechanical gaps, not a social one — `POST /goals` fetches the version row and never reads its `status`; goal achievement is computed from criteria alone and never consults `tasks` (both the `db-goals.js` writer and the `done-when.js` cascade); `POST /goals/:id/archive` checks nothing at all; and no route ships a version, so version status has only ever moved as hand-run SQL on the droplet. **Decision, five rules:** the goal set closes when a version starts `building` (new goals go on the `planning` version — where the next version is scoped in advance) with a named 409 an agent can act on; a goal reaches `achieved` only when its criteria are satisfied **and** no task in it is non-terminal, where terminal is `shipped`|`abandoned` per [task 1003588](https://cloudbongos.com/builders#/task/1003588)'s one vocabulary and the mid-ship `completed`/`confirmed` hold it open; archiving a goal that holds open tasks refuses until the caller dispositions each (abandon with the reason, or move to a named surviving goal); `goal_id` becomes required and the per-version catch-all fallback is deleted; and exactly one version builds per project, auto-closing when its last non-maintenance goal achieves, with the single `planning` version promoting itself so the project is never without a live train. **The escape hatches are deliberate and visible**: an Archon may admit one *named* goal to a building version with a reason, and the overrides are counted on the version (the standard failure of a hard scope gate is a fake hotfix version cut to hold what did not fit — an untraced override is just a slower version of no rule); plus one auto-created maintenance goal per version, exempt from the auto-close count, so bugs never need an override to be filed. **Nothing here can refuse a ship, a claim, or a task** — every rule acts on a *closing* move. Rejected: counting `completed`/`confirmed` as finished (they can fail a grade or strand — the goals **board** buckets them as done, but that is a progress ring, and `task-status.js` keeps the two questions apart); a nightly reconciler that reopens wrongly-closed goals (detection is what you build when prevention is unavailable, and it is available here); a human review gate before a goal may close (the queue [ADR 0183](<redacted>.md) dismantled — the check is a fact the table already holds); concurrent building versions scoped by module (two live trains means every "what is in this version" question has two answers); retiring versions entirely (the version is the unit the owner sets scope in and `limitations/<version>-shipped.md` archives). **Amends [ADR 0157](<redacted>.md) for exactly one key:** `version.create` returns to the Archon floor. 0157's "authoring delegates, disposition does not" was right about what a version *was* — but once the boundary carries the scope gate, cutting a new version is no longer authoring, it is the way *around* the gate, so create joins close as a disposition over scope.](<redacted>.md) | lifecycle / versioning / scope |
 | 0251 | [**A suggestion of who to invite is a recruiting surface, and owes the recruiting opt-out** ([task 1002347](https://cloudbongos.com/builders#/task/1002347) · goal 1000046, criterion `proj-invite-builders` / C6). BV1.R28 fills the seam [ADR 0239](<redacted>.md) §6 left open: the wizard’s pure rule engine emits a **seek** (`solo` → `null`, `small-team` → 3, `community` → 5) and never a list, because ranking builders is a directory read a pure file may not run and `provisioning` may not import a sibling. Two readers could answer “who are the top builders” and they differ by **one SQL predicate**: `economy`’s `leaderboard()` joins `rollupVisibleSql` and deliberately honours **no** recruiting opt-out, while `platform-identity`’s `listScoutingRollup()` joins `scoutingListableSql`, which carries it. The leaderboard is cheaper in every mechanical sense — already a public route, no port, callable straight from the browser. **Decision: use the recruiting directory anyway**, because `account-visibility.js` says the split in its own words (`hide_stats` suppresses *numbers* everywhere; the recruiting opt-out “removes an account from the RECRUITING SURFACE only”, community spec D3), and a list of people the platform proposes you recruit **is** that surface — sourcing it from the leaderboard would route around the one control built for this exact case and name every builder who asked not to be recruited. The rule for later readers: **the cheapness of a public read is not an argument about who consented to appear in it.** The lookup ships as `listInviteSuggestions` on the existing `platform-identity.hub` port, reached with `resolveOptional` and NOT declared in `consumes` (the `catalog-bridge.js` precedent — platform-identity is hub-only, so its absence is “no suggestions”, never a 500); `github_id` **does not cross the port** (explicit whitelist — login, display name, avatar, disciplines, two counts — so a new rollup column cannot leak by default), and the owner-exclusion is applied inside, over-read by the exclusion count so filtering never returns short. The route `GET /provisioning/instances/:id/invite-suggestions` is own-scoped by the **existing** `instanceAccessDenied` (same 404 as the manage read) and deliberately does NOT reuse `/scouting`’s gate ([ADR 0210](<redacted>.md)): a brand-new owner has no hub-witnessed owner row at the moment the done panel paints, so the correct-looking gate would refuse the exact caller the feature exists for — and reaching the route IS the ownership answer ([ADR 0249](<redacted>.md) §4). On the surface: a **second door in** (`setInviteSuggestions`) beside `setInviteSlug`, so the widget still answers neither “signed in” nor “theirs”; the reason is **always** said including when the answer is nobody (`seeking: null` costs no query — rendering a stated answer as an empty list would make it look like a failed lookup); a picked name fills the field and takes the **same write path** as a typed one, so the refusal vocabulary cannot fork; a filed invite stops being a suggestion; and every failure is silent, because a suggestion is an extra and a just-created project must not look broken over one. Rejected: the browser reading the economy leaderboard (the whole decision — consent, not architecture); reusing `/scouting` (right data, gate that refuses this caller); filling `invites.suggested` inside the engine (I/O in a pure file + a sibling import); a `provisioning → economy` port (legal, still the wrong directory — the boundary was never the objection).](<redacted>.md) | provisioning / platform-identity / privacy |
 | 0252 | [**The self-hosted visibility report is a PULL, and auto-appear buys a retraction lever** ([task 1002321](https://cloudbongos.com/builders#/task/1002321) · goal 1000046, criterion `proj-visibility-states` / C1, BV1.R02 — a spike whose output is this decision; gates [task 1002327](https://cloudbongos.com/builders#/task/1002327) / R08). **The premise failed first:** a self-hosted instance has no channel to the hub and no credential to open one — `registerClient` has exactly one caller in the tree (the operator's own `provision-net.js`), gated `hosting_shape !== 'co-tenant'`, and no route registers a client. So *federated* ⊆ *operator-provisioned co-tenant* and *self-hosted* holds nothing, deliberately: [ADR 0145](<redacted>.md) says do NOT extend federation to `standalone`, and [ADR 0144](<redacted>.md)'s Known Limitation rests on "every secret-holder is an operator-provisioned, trusted instance … the proper fix must land before federation opens to untrusted third-party clients." [ADR 0182](<redacted>.md) D5's "accepts a report from the authenticated `sso_client`" described a client that, for this population, does not exist. **Decision 1 — the channel is a PULL of the instance's already-public manifest** (`GET <origin>/api/gds/instance` → `branding.project.visibility`, a value every core already serves and whose author anticipated this consumer). It buys five things a push must build: no credential (0144's tripwire untouched — the whole reason), **no replay surface** (a pull reads current state, so the `jti` machinery D5 handed R02 is moot — replay is answered by not having a message), no wire change on another instance's upgrade clock ([ADR 0205](<redacted>.md)'s and [ADR 0201](<redacted>.md) D2.2's rejected-required-field problem simply absent), the hub still authorising nothing (0182 D5 satisfied, [ADR 0238](<redacted>.md)'s rejected `PATCH /projects/:id/visibility` still rejected), and a fetch that already exists behind a real SSRF guard (`project-stats.js` — DNS-resolve-all, `redirect: 'error'`, TTL + negative caches). The pull carries `visibility` and NOTHING else, so the property the map has today — a project owner controls no free-text field that reaches the feed — is not spent. **Decision 2 (the Archon's) — auto-appear:** no human stands between a public project and the map; `featured` keeps only the ranking job [ADR 0182](<redacted>.md) D3 left it. Conditional on Decision 4. **Decision 3 (the Archon's) — trust follows provenance:** both populations auto-appear, and the asymmetry is in the GUARDS, not a gate — a control-plane row's `visibility` is *assigned* by the bridge from an own-scoped audited route (authoritative), a self-hosted row's is *pulled* from a manifest the hub does not control (a cached claim with a recency stamp, able to move its own row and nothing else). An instance is authoritative about its own door and about nothing else. **Absent is a THIRD state and must not purge:** `null` (never read) ≠ `false` (read, negative). 0182 D5's fail-closed default holds only for a self-hosted row that has NEVER answered; a row that answered before and is unreachable now keeps its last state with a recency stamp ([ADR 0199](<redacted>.md), [ADR 0226](<redacted>.md)), because [ADR 0247](<redacted>.md) D4 found the live shape of that trap — every catalog row at `description: null`, so naive fail-closed would have emptied the map at once. Narrowing is free; widening is what costs. **Decision 4 — auto-appear buys a retraction lever, in the same task** ([ADR 0047](<redacted>.md): the straight-through path and its abuse guard are one task, treated as binding): `platform_identity_projects.status` is `(active,hidden)` and **no route writes it** — takedown is hand SQL today, and a one-way door onto a public surface is not a door. R08 ships `PATCH /projects/:id/status` (curate floor, audited), a per-IP limit on the unmetered CORS-open feed read ([ADR 0209](<redacted>.md)), and above all **`hidden` STICKY against the pull** — a retracted project that keeps reporting `public` stays hidden, or the next sweep silently undoes every takedown and the lever is decorative. Also named: `hall_origin` reaches the feed from the remote's own discovery index checked only for *differing* from the project host — the opposite of containment — and gets `shipUrlWithinClientOrigin`'s downward-only rule, filed against R08. Rejected: a pushed credentialed report (the literal R08 — needs the credentials 0144/0145 forbid, plus replay, rate and a wire-compatible field, none of which the pull has); `PATCH /projects/:id/visibility` (0238 already); a one-time admission and ongoing curation (both offered to the Archon, both declined); trusting the pull to move `status`; enforcing "unreported ⇒ dark matter" across all rows; letting the pull carry name/tagline/art. The later ANALYTICS feed is deliberately NOT decided here — it carries per-person data, exactly what [ADR 0205](<redacted>.md) proved cannot ride an unwitnessed self-report, and it needs the 0144 credential work first.](<redacted>.md) | platform-identity / provisioning / federation trust |
+| 0253 | [**The takedown lever has two writers, and provenance has to be a column** ([task 1002327](https://cloudbongos.com/builders#/task/1002327) · goal 1000046, criterion `proj-visibility-states` / C1, BV1.R08 — the build). Amends [ADR 0252](<redacted>.md) §4/§5: three premises that did not survive contact with the tree. The decisions stand; what changes is what has to be BUILT. **(1) `hidden` is sticky against TWO writers, and 0252 names the wrong one.** 0252 §5 says "no route writes [`status`]" and defends the takedown against the PULL. But `project-catalog.js:upsertOwnedProject` writes `status = EXCLUDED.status` on every conflict, sourced from `catalog-bridge.js:catalogStatusForInstance` — which returns `active` for any instance not torn down — and [ADR 0246](<redacted>.md) re-takes that projection at EVERY provisioning write. So the live failure is: curator hides a project → its owner saves any setting → it is back on the map. Stickiness therefore belongs to the ROW (`status_pinned`, set by the curated PATCH, honoured by the projection), not to one writer's manners; the pull separately writes no `status` at all, asserted against the statement text. `retireOwnedProject` deliberately does NOT honour the pin — it is a safety retraction for an origin the project no longer answers on ([ADR 0181](0181-teardown-state-gate-and-address-retention.md) §2), and narrowing is always free. **(2) Provenance must be a stored column.** 0252 §4 tabulates control-plane vs self-hosted rows as though the catalog knew which was which; it has no `hosting_shape` (that lives on `provisioning_instances`, in a module platform-identity may not import — [ADR 0083](<redacted>.md)) and `owner_github_id` separates nothing (set by the bridge, set by `registerClient`, null on hand-seeded rows). `visibility_source` (`control-plane`|`pull`|NULL) records it on the row, re-asserted in the UPDATE's own WHERE so a mid-sweep projection cannot lose the race — making "the two never write the same row" an invariant the SQL enforces. Rejected a `provisioning.instanceShape` port: a cross-module read in a background loop, for a value that never changes per row. **(3) The tri-state cannot live in `visibility`** (`NOT NULL DEFAULT 'public'`), so the recency stamp IS the null-carrier: `visibility_reported_at IS NULL` is the never-read state, and a failed read writes nothing — which is what makes "keep the last known state" fall out rather than be implemented. The fail-closed feed predicate needed a BACKFILL for [ADR 0247](<redacted>.md) D4's exact reason: both columns are new, so unbackfilled it would have emptied the public map on deploy. Migration 020 stamps every existing row `control-plane`, which is safe because it is TRUE — no instance has ever been asked. Two smaller corrections: the manifest key is **`brand`**, not `branding` (0252 §2 and the task body both misname it; reading only the documented spelling makes every pull a silent no-verdict), and the pull is a **POLLER, not a passenger on the feed's fan-out** — the feed excludes exactly the rows that need pulling (a never-answered row is dark matter, so it is never enriched, so it never answers), stealth rows are excluded from enrichment by design, and a read-path pull would make a DB write a side effect of an anonymous CORS-open read. Honest limit recorded: 0247 D4's `description: null` problem is NOT fixed here — 0252 §7 refuses to let the pull carry name/tagline/description, so the publish gate stays unmet for self-hosted rows. The pull moves the door; it does not publish the project.](<redacted>.md) | platform-identity / provisioning / abuse guard |
 
 | 0246 | [**Catalog membership is a projection of the provisioning row, not a side effect of federation** ([task 1003576](https://cloudbongos.com/builders#/task/1003576) · goal 1000046, criterion `proj-detail-interview` / C3). The BV1.R18 proof ([task 1002337](https://cloudbongos.com/builders#/task/1002337)) demonstrated C3 against live and found its last clause — “then it publishes” — structurally false: the owner’s verdict reads `provisioning_instances` while the public map reads `platform_identity_projects`, and the ONLY bridge was `federateInstance → registerClient → upsertProject`, which `shouldFederate` refuses for anything but `co-tenant` (the wizard hard-codes `standalone`) and which runs ONCE, at provision time, through a COALESCE. So a wizard-made project was never catalogued at all and a co-tenant one that answered later never updated — `publishable: true`, `{"projects": []}`, forever. The same missing row is [task 1003580](https://cloudbongos.com/builders#/task/1003580)’s GAP 1: `POST /projects/invite` resolves against `platform_identity_sso_clients`, whose only writer is that same `registerClient`. Underneath is one conflation — federation mints CREDENTIALS and was incidentally the only thing that minted MEMBERSHIP, while [ADR 0182](<redacted>.md) D4 already fixed the map’s gate at IDENTITY, which has nothing to do with hosting topology. **Decision: the catalog row is a PROJECTION of the provisioning row, re-derived at every write that can change its inputs** — two halves, neither sufficient alone. (1) THE ROW SHAPE: every control-plane project gets both rows whatever its hosting shape, and the client row carries NO credential (`secret_hash = ''`, `redirect_uris = '{}'`), so **the shape is the enforcement** rather than a flag a caller could forget — `redirectUriAllowed` refuses `/sso/authorize`, `clientSecretValid` refuses `/sso/token`, `/sso/membership/check-in` and `/sso/activity/rollup`, and the one leg that checked NEITHER (`/sso/device/start`, which resolves a client from a user-typed origin) grew an explicit `clientIsCredentialed` guard. (2) THE TIMING: re-taken on create, on `PATCH …/detail`, on `PATCH …/settings` when the door changes, and on `POST …/domain` (which re-keys the row, retiring the abandoned origin — [ADR 0181](0181-teardown-state-gate-and-address-retention.md) §2’s leak, in the catalog instead of DNS). **NO MIGRATION** — `secret_hash` is `NOT NULL` and `''` satisfies it while hashing to nothing. `description` and `visibility` are ASSIGNED, not COALESCEd (clearing a description must UN-publish); `featured`/`tagline`/`art_url`/`template` are curation and stay untouched, so [ADR 0182](<redacted>.md) D3 holds. It grants nothing — the row is attribution per [ADR 0238](<redacted>.md), ownership stays `provisioning_instances.owner_builder_id` — and because it writes rows keyed on owner-supplied values (a slug, a BYO domain) each write carries its **claim rule in the ON CONFLICT action’s own WHERE**: the client is refreshed only `WHERE secret_hash = ''` (a real client’s origin, which binds the CLI mint audience, can never be rewritten) and the project only `WHERE owner_github_id = EXCLUDED.owner_github_id` (`NULL = anything` is not true, so the hand-seeded rows cannot be claimed). Writing `visibility` does not contradict [ADR 0182](<redacted>.md) D5: the hub authorizes nothing — the authority already ran on the provisioning plane ([ADR 0238](<redacted>.md)’s own-scoped, audited PATCH), and a project the control plane does NOT own has no provisioning row, so D5’s instance report (R08) stays the only channel for those. `tearing_down`/`torn_down` project `hidden`; a `no_address` instance is not catalogued at all. Travels on the kernel port `project.catalog`, the `project.publishGate` seam in the other direction ([ADR 0083](<redacted>.md) forbids the import). Rejected: extending `shouldFederate` to every shape (hands a real secret to instances whose web.env the platform does not write, and keeps the once-at-standup bug); bridging only at the publish moment (leaves the invite with nothing to resolve); registering only at standup (the bug itself); a `catalog_only` boolean column (needs a migration and is weaker than the shape); letting the bridge write `featured`; and backfilling the three existing catalog rows from code.](<redacted>.md) | provisioning / project creation |